As a new way to connect with his fans, Jack Johnson—one half of the pop-rap duo Jack & Jack, not to be confused with the laid back Hawaiian singer-songwriter of the same name—has spent the last month soliciting social media passwords.
Using the hashtag #HackedByJohnson, the performer has tweeted at his fans to send him their passwords. (Why he didn’t go for the shorter and catchier #JackHack, we’ll never know.) Then, Johnson posts under his fans’ Twitter accounts, leaving a short personalized message, as them.
Here’s one example:
— Jack and Jack (@jacksmeup) July 12, 2016
While Johnson and his fans likely find this password sharing silly and innocuous, legal experts say that Jack Johnson, 20, may be opening himself up to civil or criminal liability under the Computer Fraud and Abuse Act, a notorious anti-hacking statute that dates back to the 1980s.
“While the entertainer in question likely considers this password collection to be a harmless personalized promotional activity, there may indeed be legal implication of both the fans’ and the entertainer’s conduct,” Andrea Matwyshyn, a law professor at Northeastern University, told Ars.
Recent years have seen a number of high-profile CFAA criminal prosecutions, including Matthew Keys, Chelsea Manning, and the late Aaron Swartz. An effort to reform that law has languished in Congress. (Keys is likely to report for a two-year prison sentence next month after he was convicted of …