Clear rules needed for managing digital afterlife

Update a password list

Why would it be important to be prepared to give away your accounts information? Different emails providers have different policies. Google allows your next of kin to access your correspondence if they produce a proof of death ; Hotmail does the same, and asks the next of kin to show they have power of attorney. YahooMail.. simply erases your mail history.

Hence, it may be easier for everyone to get access to your mails and execute your will concerning the future of these assets.

Along with the usernames, passwords and emails potentially linked to the accounts, be also prepared to write down the security questions. Your loved ones may be or may not be the one knowing ALL of the details contained in the security questions, leading to an easy recovery of the accounts.

However, do not hesitate to segregate your different passwords in separate, password protected, lists, depending on the beneficiary of your goods. You can then store the different lists on a common storage medium (online storage, physical medium, …) and to limit the access to this resource only to your executor. It’s the same as putting different boxes with different locks for different beneficiaries, waiting in a global safe which is only accessible by you and your executor, but where your executor does not own the key to individual boxes.

 

Is Your Digital Life Ready for Your Death?

Legal Framework and Limitations

                  Federal Criminal Legislation. The Federal Government enacted the Computer Fraud and Abuse Act (CFAA”) in part to criminalize internet theft, data theft, computer hacking, and other forms of internet crime. As written, CFAA criminalizes the unauthorized access to any computer, online service or online account. Unfortunately, to determine who may and may not access a specific account, even with the explicit permission of the account holder, you must read the service or account provider’s Terms of Service contract. As an example, Facebook’s Terms of Service Agreement prohibits anyone from logging into a user’s Facebook account, other than the user themself, even with the permission of the user. Therefore, a family member, friend, or even a fiduciary that logs into a Facebook account, using the password provided to them by the user themself, has violated the Terms of Service contract and is now committing a federal crime under the CFAA. Fortunately, the Department of justice has made it clear that they are not looking to enforce the CFAA when dealing with simple violations of online Terms of Service contracts, unless there are other more criminal factors involved. However, as advisors to our clients, and to fiduciaries such as Power of Attorneys, Executors, and Trustees, can we ethically advise clients to access digital assets and accounts where we know that they will be committing a crime under the CFAA? Further, if our fiduciaries do decide to access such accounts and commit a crime, how will we respond to a challenge from an unhappy beneficiary who is aware of the access and its violation of the CFAA?

B.                  Federal Privacy Legislation. In addition to the criminalization of unauthorized access of digital assets and online accounts, the Federal Government has also passed the Stored Communications Act (“SCA”) which creates a right to privacy for data and information stored online. Similar in nature to the federal health information privacy act (often referred to as HIPAA), the SCA creates specific guidelines as to whether, and when, providers of electronic communication services and holders of online data can release the information. As you will see below, these protections can create significant hurdles for family members and fiduciaries who attempt to access information stored online with these service providers and content holders.

1)                  Law Enforcement Agencies may compel the release of the information otherwise protected by the SCA through the use of subpoenas and other legal procedures.

2)                  Service providers are prohibited from disclosing information, or granting access to accounts, to non-Law Enforcement individuals (family and fiduciaries), unless one of the statutory exemptions are met. While there are exemptions for specific situations such and employment related emails being released to an employer or being disclosed during a lawsuit against a business, the main exemption that we should be aware of and plan with is the “Lawful Consent” exemption found in Code Section 2701(b)(3) of the SCA. This exemption allows a service provider to voluntarily turn over (or grant access to) stored information if the recipient has the lawful consent of the creator of such digital asset to access such information. However, this exception only provides that the service provider MAY turn over the information, but does not require them to. In fact, there are several national cases where service providers have chosen not to disclose the information. In these situations where the recipient actually had lawful consent, the courts indicated that the SCA exemption does not mandate the disclosure of the stored information, and that the courts could not compel the distribution of the information under the SCA even through legal proceedings.

 

C.                        State Criminal Legislation. Every state in the United States has its own version of computer and online fraud statutes that it uses to be able to bring state law charges for online theft, fraud, hacking, and other internet and computer crimes. In Florida, we have Florida Statute §§ 815.01-815.07 (“Florida Computer Crimes Act” or “Florida CCA”), enacted in 1979, which provides our state legislation. Typical violations under the Florida CCA are

  • unauthorized access of another user’s account
  • unauthorized modification, deletion, copying of files, or programs
  • unauthorized modification or damage of computer equipment.

However, Florida-based businesses usually prefer to pursue cases under the federal CFAA for relief because the Florida CCA allows plaintiffs to bring the civil action against a hacker only after a criminal conviction is successful.

  1. State Fiduciary Powers. Given the lawful consent exemption to the SCA that was discussed above, several states have amended their state statutes to provide that fiduciaries in their state shall be deemed to have lawful consent to access online information under the SCA. This is intended to open the door to allow service providers to voluntarily disclose stored content without the fear of having to determine on a case by case basis whether the fiduciary of an account holder has been given lawful consent. Unfortunately, to date, only five states have enacted such laws (Connecticut, Idaho, Oklahoma, Rhode Island and Indiana), and another 18 states have a relevant bill introduced (California, Colorado, Maine, Maryland, Massachusetts, Michigan, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oregon, Pennsylvania, Virginia), with the majority of the pending legislation introduced in the last 2 years. Unfortunately, even the enacted statutes provide little guidance in the form of definitions and procedure, and therefore while certainly a step in the right direction, these enacted and pending statutes have a long way to go to fully fix the access problems.
  2. Website and Service Provider Contracts. Online service providers mandate that all users agree to the provisions of a Terms of Service Contract (“TOSC’s”) which governs the actions of both the service provider and the user. Unfortunately, the TOSC’s are a take it or leave it situation, and can not be negotiated by the user. Can you imagine if each user could independently negotiate the terms of his or her contract with iTunes or their email service provider? Therefore we are relegated to accepting the often one-sided terms mandated by the service provider. These TOSC’s often restrict who may access a registered account or service to the individual that created the account, thereby eliminating any flexibility for fiduciaries or other authorized people from accessing the account. Likewise, such TOS’s will usually create restrictions on the ability of someone other than the user to reset or obtain password. In general, it’s the restrictions found in these TOCS’s that set up our fiduciaries for failure under the CFA and SCA.

Template of Digital Property Provision for a Power of Attorney

(template)  Generally the following provision will be inserted as a subparagraph in the section of a Power of Attorney which explicitly enumerates the powers granted to a Attorney in Fact.

Power With Regard to Digital and other Intangible Property.

In the event that I own an interest in any form of electronic, digital or intangible assets (including but not limited to leaseholds, licenses, contractual rights, computing devices, data storage devices, a domain names, user accounts, email accounts, digital pictures, digital music, or any other form of electronically stored information (collectively, “Digital Assets”)), then in addition to any other powers granted to my Attorney in Fact under this Durable Power of Attorney, or which may otherwise be provided for under applicable law, my Attorney in Fact shall have the following powers:

(1)   the power to obtain copies of any electronically stored information of mine from any person or entity that possesses, custodies, or controls that information, including but not limited to entities that may be subject to the Stored Communications Act under or similar state laws that may then be in effect;

(2)   power to decrypt any encrypted electronically stored information of mine or to bypass, reset, or recover any passwords or other kind of authentication or authorization necessary to gain access to access the Digital Assets;

(3)   the power to waive any confidentiality that I may have had under any Terms of Service Agreement or Privacy Policy that I had previously agreed to in regards to any Digital Asset, to the extent allowable under such Terms of Service or Privacy Policy;

(4)   all other powers that an absolute owner of a Digital Asset would have, and any other powers appropriate to achieve the proper investment, management, and distribution of my Digital Assets, including the power to employ any consultants or agents to advise or assist the Attorney in Fact in exercising the powers listed above.

In furtherance of such powers which are granted to the Attorney In Fact above, I hereby authorize, to the extent permitted by federal and state law, including the Electronic Communications Privacy Act of1986 (which includes the Stored Communications Act), as amended, and the Computer Fraud and Abuse Act of 1986, as amended, any person or entity that possesses, custodies, or controls any electronically stored information of mine or that provides to me an electronic communication service or remote computing service, whether public or private, to divulge to my Attorney in Fact (1) any electronically stored information of mine; (2) the contents of any communication that is in electronic storage by that service or that is carried or maintained on that service; and (3) any record or other information pertaining to me with respect to that service. This authorization is to be construed to be my lawful consent under the Stored Communications Act, as amended, and any other applicable federal or state data privacy law or criminal law. The terms used in this paragraph are to be construed as broadly as possible, and the term “user account” includes without limitation an established relationship between a user and a computing device or between a user and a provider of Internet or other network access, electronic communication services, or remote computing services, whether public or private.

The forgotten assets: Protecting your client's digital assets at death

Template of an Authorization and Consent for Release of Electronically Stored Information

(template)

I, __________________________________________ , hereby authorize any person or entity that possesses, custodies, or controls any electronically stored information of mine or that provides to me an electronic communication service or remote computing service, whether public or private, to divulge to my then-acting fiduciaries at any time: (1) any electronically stored information of mine, (2) the contents of any communication that is in electronic storage by that service or that is carried or maintained on that service, and (3) any record or other information pertaining to me with respect to that service. The terms used in this authorization are to be construed as broadly as possible, and the term “fiduciaries” includes a guardian or conservator appointed for me, a trustee of my revocable trust, an Attorney in Fact under a valid Power of Attorney, and a Personal Representative (executor) of my estate.

This authorization is to be construed to be my lawful consent under the Electronic Communications Privacy Act of 1986 (which includes the Stored Communications Act), as amended, the Computer Fraud and Abuse Act of 1986, as amended, and any other applicable federal or state data privacy law or criminal law. This authorization is effective immediately. Unless this authorization is revoked by me in writing while I am competent, this authorization continues to be effective during any period that I am incapacitated and continues to be effective after my death.

Unless a person or entity has received actual notice that this authorization has been validly revoked by me, that person or entity receiving this authorization may act in reliance on the presumption that it is valid and unrevoked, and that person or entity is released and held harmless by me, my heirs, legal representatives, successors, and assigns from any loss suffered or liability incurred for acting according to this authorization. A person or entity may accept a copy or facsimile of this original authorization as though it were an original document.

Dated this_______ day of_________________________ , 20__