1. Definitions

A. Access Control Policy: What the document says should happen.

Example: "Principle of least privilege requires limiting access to minimum permissions necessary for legitimate business functions. Role: Customer Support can read tickets, cannot export PII bulk."

Defined in ISO 27001, RBAC matrix, ABAC rules, SOC2 CC6.1

B. Entitlement / Actual Permission: What the identity actually possesses in AD / AWS IAM / GCP / SaaS.

Example: Support user support@ has SELECT * FROM customers + s3:GetObject * + admin in Zendesk because someone added him to All-Users-Admin 3 years ago for incident.

C. Operational Consequence: A compromised marketing account with database admin rights can exfiltrate customer data even though policy says it cannot. This is how 80% of breaches happen - not zero-day, but over-privileged account.

Three Types of Drift:

1. Privilege Creep: Joiner-mover-leaver - employee moves from Finance to Marketing, keeps both roles
2. Orphaned Permissions: Service account created for migration, never removed
3. Shadow Admin: Nested groups - User -> Group A -> Group B -> Admin, policy checker misses transitive closure

2. Legal & Regulatory Conflict

A. Data Protection Breach:

• GDPR Art 32 - Security of Processing - requires restriction of access
• In a case where breaches took place due to human errors when assigning employees access rights to employees' data, the LSA acknowledged mitigating circumstance that data controller had taken measures to ensure restriction of access - but still breach if not restricted.
• If policy says least privilege but actual permissions violate, regulator treats it as failure to implement appropriate technical measures - fine even if no breach.

B. Computer Fraud and Abuse:

Does violating internal policy = hacking?

3. Landmark Case Law

1. Van Buren v. United States - 593 U.S. 374 - SCOTUS 2021 - THE Defining Case for Policy vs Permission

Facts: Nathan Van Buren, police officer, authorized to access law enforcement database for law enforcement purposes. FBI sting: paid him to run license plate for non-police purpose. He had valid credentials, accessed area he was allowed to access, but violated department policy.

Lower Courts: 11th Circuit affirmed conviction - exceeding authorized access includes using for improper purpose.

SCOTUS 6-3 - Justice Barrett:

CFAA "covers those who obtain information from particular areas in the computer - such as files, folders, or databases - to which their computer access does not extend"
Van Buren plainly flouted department's rules, but did not violate CFAA because he had legitimate access to the database.

Rule Created:

• "Exceeds authorized access" = Accessing files/folders you are NOT allowed to access at all.
• NOT = Accessing files you ARE allowed to access but for wrong reason / violating policy.

Impact for your conflict: If your policy says "Support cannot export PII" but IAM still allows SELECT *, and employee does it, under Van Buren it's policy violation, not CFAA hacking. You cannot prosecute as hacker, but you are liable to regulator for failure to enforce least privilege.

Before Van Buren, circuit split: 1st, 5th, 7th said policy violation = hacking. 2nd, 4th, 9th said no. Van Buren resolved to narrow interpretation.

2. hiQ Labs Inc v. LinkedIn Corp - 9th Cir 2019, 2022

hiQ scraped public LinkedIn profiles, LinkedIn said violated Terms of Service / access policy.
Court held: Accessing publicly available data even if violating policy is NOT unauthorized under CFAA. Same principle - policy ≠ permission.

3. Morrisons Supermarket - WM Morrisons Supermarket plc v Various Claimants - UK Supreme Court 2020

Facts: Employee Andrew Skelton, internal auditor, had legitimate access to payroll data for 100k employees per policy (could access). He copied and posted on file-sharing site to damage employer, violating policy. Employees sued Morrisons.

Lower Court: Employer vicariously liable for employee's data breach.

Supreme Court: Overturned - employee was not acting in course of employment when he leaked data; personal vendetta. Employer NOT liable for rogue act if it had implemented appropriate controls. But: Court noted breach due to human error assigning access rights - if Morrisons had restricted access, breach wouldn't happen. Shows policy vs actual permission gap is negligence.

4. LabMD v. FTC - FTC Administrative Case 2016

Judge applies common sense to question of what constitutes a data breach. LabMD employee violated company policies and downloaded P2P software, inadvertently exposing sensitive patient information on file-sharing network. FTC tried to punish company, Judge ruled breach needs actual victims, not hypothetical.

Principle: Company had policy prohibiting P2P, but actual permission allowed install. Policy alone not enough, must technically enforce.

5. DSG Retail Ltd - UK ICO Fine £500k - 2020 - Overruled on breach definition but liability remains

Attacker accessed via over-privileged account. DSG argued attacker did breach, not DSG. High Court held there was no basis for claiming against DSG as data controller for breach of confidence as acts committed by anonymous attacker itself, BUT DSG still failed to take reasonable steps to prevent cyberattack under DPA. Policy said least privilege, actual POS systems had admin rights.

6. Indian Case Law:

Syed Asifuddin v. State of AP - 2005 - First Indian case on unauthorized access
Defined unauthorized access under Sec 43 IT Act - access without permission. Court held even if employee has general access, exceeding purpose is unauthorized.

CBI v. Arif Azim (Bazee.com) - 2004 - CEO held liable because employee had actual permission to list pornographic content, though policy prohibited. Shows gap liability.

RBI Cyber Security Framework for Banks 2016: Mandates quarterly Access Recertification and entitlement review - policy must match actual permissions, or bank faces penalty.

4. How to Prove Conflict & Fix

Audit Query that finds gap:

Code

Policy = {Support: read tickets}Actual = {Support: read tickets + s3:Get* + rds:*}Gap = Actual - Policy = Privilege Creep

Legal Fix that Courts Accept:

1. RBAC with SoD + Quarterly Recertification: Manager must attest "Does this person still need this?"
2. ABAC Enforcement: Policy engine (OPA / AWS Verified Permissions) evaluates request in real-time, not just static IAM.
3. Zero Standing Privilege: No permanent admin, just-in-time elevation.
4. Log Policy vs Permission Decisions: If user accesses via permission but violates policy, log as policy violation - not CFAA crime but internal misconduct.

Under Van Buren, you cannot rely on criminal law to punish employee who misuses access they technically have. You must technically remove permission.