Imagine if you ceased to be today; what digital value would be lost? Family photographs , digital media, loyalty points… all these are as much a part of your Estate as a car or a house, but surprisingly few people make provisions for digital estate planning while they are […]
In January 2015, security researcher and beloved, prolific geek Michael “Hackerjoe” Hamelin died in a head-on collision that also hospitalized his widow, Beth Hamelin.
Hackerjoe had not done anything to prepare for his unexpected death, and he had an exceptionally complex tangle of IT systems and obligations that no one else was prepared to run — or even rescue.
As the widowed Beth Hamelin recovered from her own injuries, she was faced with the task of untangling Michael Hamelin’s affairs, which ranged from the data needed to pay the household bills to the crypto-keys to access the family photographs and archives, to the authentication tokens and knowledge necessary to gracefully wind down the many hosting/IT businesses he ran without leaving his customers in the lurch.
Andrew Kalat — a close friend of the Hamelins and an IT expert himself — stepped in to help, booting Hamelin’s systems with “crash-carts,” begging companies like Apple, Facebook, Twitter and Goolge to let him recover Hamelin’s data, and trying (unsuccessfully) to recover the keys to unlock the Hamelin family’s personal memories. As of the time of the talk, all of the Hamelins’ photos were considered unrecoverable.
Kalat’s talk is a brilliant example of the premise that “we can’t make back doors than only good guys can get through.” When Hamelin hardened his systems against the attackers who might target him or his customers, he also hardened it against his loved ones.
I wrote about the “Internet of the Dead” in 2012, when my good friend Erik “Possum Man” Stewart, also a prolific and eclectic hacker, died unexpectedly in his sleep and I tried to help his family rescue a little of his digital legacy.
That incident prompted me to create my own digital death plan, which, now that I think of it, is woefully out of date, and, having seen Kalat’s presentation, I realize is also inadequate.
I like Kalat’s proposal that once a year, couples should switch household roles, each paying the bills and taking care of the paperwork the other deals with, just to “stress test” your family’s preparedness for these terrible, unexpected calamities — to make your family a system that fails well, as well as working well.
Most hackers have a massive digital footprint: social media, servers at co-location sites, servers at home, overly-complicated IT infrastructure, and various other IT gear connected in crazy ways. What happens when one of us suddenly dies? How do our loved ones pick up the pieces, figure out all of our random IT crap that we’ve setup, and move forward? This talk explores the challenges, opportunities, and lessons learned as I aided in figure out the IT gear after the passing of a dear friend to the hacking community, HackerJoe, aka Michael Hamelin. I will share details of the challenges Michael’s widow and I faced, how we overcame them, and advice to better prepare your loved ones if you were to suddenly shake off the mortal coil…
July 24–DOVER, Del. — When Donna Johnson’s father died suddenly of a massive heart attack, her mother tried to get access to his email account and digital photo repository. She wanted to pay bills and make sure that treasured family photos remained intact.
Even though she was executor of his will, his widow was stunned to learn that in her state — as in many others — she had no legal right to access his online accounts.
“This caused a lot of emotional wear and tear on my mother. The whole situation was extremely traumatic, and this was just one more thing she had to deal with,” said Johnson, 43, who is executive director of the Delaware State Board of Education.
Johnson eventually reached out to a state legislator she knew, and last month, the Delaware Legislature passed a bill that would grant executors and other fiduciaries access to a dead person’s digital information. It is awaiting action by Democratic Gov. Jack Markell.
If the bill is signed into law, Delaware would join at least eight other states in enacting legislation dealing with digital assets.
The laws run the gamut from requiring Internet providers to give an executor access to all contents of a dead person’s email to granting the personal representative of someone who dies the power to terminate his social media accounts. At least 10 other states considered digital assets legislation this year.
“This is one of those issues where the law has not kept up with these new technologies and accounts that have been created,” said Pam Greenberg, a senior fellow at the National Conference of State Legislatures. “I’m sure we’ll see additional legislation in this area.”
While a growing number of states are passing digital estate laws, many in the tech industry have been fighting back, citing concerns about privacy and liability.
Lobbyists for some of the nation’s largest tech companies tried to kill the Delaware bill, which deems digital assets such as email, social media, photos and financial management accounts part of a person’s estate upon death. Executors or trustees would be given the same control over those assets as they have with physical assets, such as safety deposit boxes and stock certificates, unless the person stipulates in his will that he does not want that information released or gives other specific instructions.
Guardians of people who become incapacitated also could gain access to digital assets, but they would need a court order.
If the Delaware measure becomes law, it would supersede any “terms of service” agreements that users have with Internet and social media providers. However, if a person specifies in a separate online tool, such as Google’s “inactive account manager” that he wants emails deleted or transferred to a particular person after a period of inactivity, that would take precedence.
“We put in provisions that prohibit the tech companies from making the choice for you. They can’t, in their service agreement, say that upon your death, we’re going to delete your account,” said Democratic state Rep. Darryl Scott, who co-sponsored the legislation and worked with the state’s bar association to get it passed. “We were trying to restore control to the family to make those decisions, just as they do with many other things, like journals and letters and safety deposit boxes.”
Delaware’s bill is similar to a model law endorsed last week by the Uniform Law Commission, a nonprofit organization of lawyers, including legislators and judges, appointed by each state government. The group researches and drafts standardized state laws that can then be considered by legislatures.
Benjamin Orzeske, the commission’s legislative counsel, said the group spent two years working on the digital assets proposal, and he thinks it will be introduced in about a dozen states next year. “This law isn’t changing the level of privacy,” Orzeske said. “It’s just making it media neutral, whether it’s on paper or online.”
But some in the technology industry warn that the model law and the Delaware bill remove users’ privacy protections.
“What happens to digital accounts when you die is an issue of great concern to our members because they are the custodians. They are concerned about creating a safe and secure environment for our users,” said Carl Szabo, policy counsel for NetChoice, a trade association whose members include AOL, Yahoo, Facebook and Google.
Online providers also worry about liability, especially if an email contains information about a third party.
“If somebody died who’s a drug counselor or psychiatrist or doctor, they’re likely to have a lot of stuff in their email from patients, which is quite confidential,” said Jim Halpert, an attorney for DLA Piper who represents a coalition of 21 technology and media companies. “Under these bills, the fiduciary gets everything. They could turn around and file a very costly class action lawsuit against the service provider.”
Orzeske, of the Uniform Law Commission, disputes that scenario. He said that before the Internet age, doctors and drug counselors kept files with confidential information that could be accessed by a fiduciary if they died. Any fiduciary who released confidential information about a patient would bear the liability, Orzeske said.
“If the executor of a doctor’s estate needed to get into his office and shred files or give them to the doctor’s business partner, they’d have to get into his office, and they’d have access to confidential records,” Orzeske said. “If the building custodian lets them into the office, he isn’t the one who is liable. The fiduciary is.”
The tech industry also argues that this type of legislation is in direct conflict with the 1986 federal Electronic Communications Privacy Act, which prohibits custodians of digital assets from releasing them to a third party without the sender’s or receiver’s permission or a court order.
“Not only is it a privacy issue, but the federal law prohibits us from disclosing that information without consent. The act of dying is not equal to consent,” Szabo said. “We’re not only liable to the sender and recipient but anyone harmed or grieved by that disclosure.”
Szabo said that companies are being forced to decide which law to violate — federal or state. In states that have enacted digital assets laws, his association’s members have “let the terms of service dictate.” He said Facebook has been “very reticent” to turn over contents of communications and private messages, and Yahoo has taken a similar view.
His group does support Rhode Island’s digital assets law, he said, which requires that executors get a court order to access email accounts of people who die and indemnifies the provider from liability.
Szabo points out that Internet companies also have created tools to help users decide what happens to their digital accounts when they die. He cited Google’s inactive account manager and Facebook’s feature that “memorializes” an account and allows friends to post remembrances while the user’s privacy settings remain.
Some privacy groups also have qualms about digital assets laws.
“People live with personal information that they do not wish to share with, say, their parents or their significant others,” said Adi Kamdar, a policy analyst for the Electronic Frontier Foundation, a digital rights organization. “The best course of action should be to respect this decision, even after death, unless the deceased takes steps to allow their estate’s administrator access to their email.”
Digital Access Laws
A number of states already have tackled the issue of digital estates.
In Nevada, a personal representative has the power to terminate the dead person’s email, social media and other digital accounts unless a will or court order states otherwise.
In Louisiana, Republican Gov. Bobby Jindal signed a bill last month that has a similar provision, but also allows executors to take control of and handle a dead person’s electronic information.
“So much of our lives are now on the Internet. Correspondence is done digitally through social media, pictures, emails,” said Republican state Sen. Barrow Peacock, who co-authored the bill.
“We’re not trying to ‘get’ a company,” Peacock said. “We’re trying to make it easier for the family to gain access.”
Virginia’s law focuses on minors who have died, giving personal representatives access to their online accounts, unless it is contrary to the provisions of a will, trust or court order. Legislators took action after a teen from rural Virginia committed suicide and his family tried unsuccessfully to get access to his Facebook page to search for answers.
Democratic Del. David L. Bulova said he co-sponsored the legislation, which was signed into law last year, because he felt that parents of children who die should have access to their digital world.
“Back when I was a kid, everything that was mine could be stored under a bed or in a drawer. With my kids, everything they have is online,” said Bulova, the father of three children. “If something was to happen to them, I’d want to know what happened. The idea that I would lose access to so many memories that were stored digitally just didn’t seem right.”
Estate Planning Key
Ultimately, both supporters and opponents of the Delaware bill and the Uniform Law Commission’s model law say they think the issue will wind up being decided by the courts.
In the meantime, Donna Johnson, the woman who inspired Delaware’s legislation, said she believes that lawmakers in her state did the right thing for people like her mother, Claudia, who spent months trying unsuccessfully to access her late husband’s digital assets.
Johnson said that her father, an accountant, handled most of the couple’s financial transactions. He paid bills, banked and invested online. He booked vacations online. And he kept treasured family photographs in an online photo repository.
She said that her mother had no idea that her car insurance had lapsed because she didn’t have access to the alert that had popped up in his email, which the Internet provider shut down after his death. Nor could she get access to his online photo album because that account was closed.
Because of all the challenges her family faced, Johnson said she ended up drafting her own will and making sure that her passwords and log-ins were included so that survivors wouldn’t have to go through the same ordeal.
“The bill our legislature passed won’t fix everything, but hopefully, it will bring this issue into the forefront,” Johnson said. “People need to think about their digital assets when they prepare their estates. Hopefully, we can get them talking about it and planning ahead of time.”