> So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win.

Whether Van Buren deserves punishment is a separate question from whether the legal theory the DoJ sought to use to get him punished was proper.

> Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it.

No, it doesn't. This is not a finding that the activity is Constitutionally protected, or even non-criminal in any broad sense, but that it is not within the scope of the criminal provisions of the CFAA, which is a win, because the interpretation of the CFAA necessary to make it applicable is ludicrously broad.

> In other words, lets say I work at a gay hookup website and they grant me access to their production database as part of my job. If I start selling off information about user to third parties (say journalists), how can that be legal

It shouldn't be, but that doesn’t justify abusing the CFAA into a blank prosecutorial check.