> Really, the issue is straightforward: did the person accessing the information have a reasonable belief that they were authorized to access it?
The inherent flaw in this interpretation is that it uses a self-referential definition of authorization. Saying "access is authorized if it is reasonable to believe that access is authorized" is meaningless. You would need an independent definition of authorized access in order to evaluate the reasonableness of the belief, which defeats the purpose of using it to define authorization.
Where a "reasonable belief" standard makes sense is in determining intent, not in establishing the definition of an element of the crime. For example, it may be illegal for you to steal my laptop (where the definition of the elements of theft are fairly rigorous), but if it turns out that you have exactly the same model of laptop and "reasonably believed" mine to be yours then even though you objectively stole my laptop, the prosecution may not be able to prove that you intended to.
But "authorization" is clearly not about intent. The alleged perpetrator is not the one permitted to define the scope of authorization, so their intent is irrelevant in determining whether the access was in fact authorized, and the intent of the owner of the computer system is also irrelevant because it isn't reasonable to subject a defendant to the intent of a third party if that third party fails to clearly articulate it. What matters instead is what has been articulated -- the information made available to users of the computer system about what level of access is permitted.
But then we're back to the terms of service trouble again. If you allow contractual restrictions to define authorization then you're allowing corporations to define the contours of a federal felony and anyone who lies about their name on Facebook can be thrown in prison at the whim of an overzealous prosecutor. Conversely, relying on technological authorization makes the law extremely narrow (capturing only the likes of perpetrators who defeat technological denials of authorization via e.g. physical intrusion into the victim's data center -- although that would align better with the established penalties). Neither seems particularly satisfactory, and the reason is that "unauthorized access" is the wrong thing to prohibit. "Authorization" is vague and subjective, and the specifics of a violation span such a wide range of conduct and misconduct that lumping them all together under the same set of penalties is all but guaranteed to violate proportionality unless the penalties are set so low as to make the prohibition nominal.
And I still don't understand what useful purpose it serves as distinguished from the already-existing penalties for vandalism, fraud, misappropriation of trade secrets, etc. etc. If someone engages in access without authorization, without more, the warranted level of punishment is minimal and almost never even worth prosecuting. If they engage in some further malicious act then the penalty for the greater crime can be imposed and unauthorized access is only a side show and a dangerous instrument of prosecutorial overreach. When is it ever supposed to be useful in proportion to the controversy and abuse it produces?