Life and Death Online: Who Controls a Digital Legacy?

With so much of one’s life in some form of online, digital media – coupled with patchwork body of law and requirements by companies such as Facebook and Instagram for its users to sign over the rights to their photographs – a recent Wall Street Journal article discloses the harsh reality for grieving family members hoping to hold on to the digital life of their deceased loved ones.  A copy of the article can be found below.

———————————————————-
Life and Death Online:  Who Controls a Digital Legacy?

By:  Geoffrey A. Fowler

Alison Atkins died on July 27 at age 16. Online, her family is losing its hold on her memory.

Three days after the Toronto teen lost a long battle with a colon disease, her sister Jaclyn Atkins had a technician crack Alison’s password-protected MacBook Pro. Her family wanted access to Alison’s digital remains: Facebook, Twitter, Tumblr, Yahoo and Hotmail accounts that were her lifeline when illness isolated her at home.

“Alison had pictures, messages and poems written that we wanted to keep to remember her,” says Ms. Atkins, 20, an undergraduate at the University of Toronto.

But using Alison’s passwords violated some of those websites’ terms of service, and possibly the law. None of the services allow the Atkins family—or any others—to retrieve the passwords of the deceased. Their argument is that it would violate Alison’s privacy.

Since then, Ms. Atkins’s attempts to recover Alison’s online life have begun falling apart. The websites that previously logged in automatically on Alison’s laptop began locking out Ms. Atkins as part of their standard security procedures. Her attempts to guess or reset her sister’s passwords backfired. Some of the accounts have been shutting themselves down.

On Nov. 21, Alison disappeared from Facebook, where her family used her account to communicate and share memories with more than 500 friends. “We have already lost Alison,” says Ms. Atkins. Now the family says it fears losing another part of her.

The digital era adds a new complexity to the human test of dealing with death. Loved ones once may have memorialized the departed with private rituals and a notice in the newspaper. Today, as family and friends gather publicly to write and share photos online, the obituary may never be complete.

But families like the Atkinses can lose control of a process they feel is their right and obligation when the memories are stored online—encrypted, locked behind passwords, just beyond reach. One major cause is privacy law. Current laws, intended to protect the living, fail to address a separate question: Who should see or supervise our online legacy?

In Toronto, taking hold of Alison Atkins’s digital afterlife forced her family to tread a line between celebrating her, and invading her privacy. In the process, her family discovered some dark journals Alison clearly meant to conceal. “She had passwords for a reason,” Ms. Atkins says.

U.S. and Canadian laws, which are similar for the most part, don’t treat digital assets like physical ones that can be distributed according to wills. In 1986, Congress passed a law forbidding consumer electronic-communications companies from disclosing content without its owner’s consent or a government order like a police investigation. Although that law predates the rise of the commercial Internet, courts and companies have largely interpreted it to mean that the families can’t force companies to let them access the deceased’s data or their accounts.

Yahoo Inc. lays it out plainly in its terms of service. “Upon receipt of a copy of a death certificate, your account may be terminated and all contents therein permanently deleted.”

A Yahoo spokeswoman said that users of the company’s mail and photo services “agree that their account content won’t be transferred without their explicit permission.” To ensure an account gets transferred at death, “users need to provide consent and their account information in their estate plans.”

Microsoft Corp., which owns Hotmail, won’t provide families with passwords or control of accounts, a spokeswoman said. But with “appropriate documentation” it will give next of kin the deceased’s email on discs.

Customers’ privacy is “something the company respects both in life and in death,” says Dharmesh Mehta, Microsoft’s senior director of product management.

Facebook Inc., which by one estimate saw 580,000 American members die this year, has gone to court to oppose the notion that families can compel it to hand over data. In September, Facebook successfully blocked the estate of British model Sahar Daftary from getting account details in U.S. District Court of Northern California, San Jose Division. The executor was hoping Ms. Daftary’s posts and messages might help prove to a coroner that she didn’t commit suicide by showing her state of mind.

A Facebook spokesman said, when it receives requests for user data, “We will respond in a way that is sensitive to [a family’s] loss and is consistent with applicable law, which limits a provider’s ability to disclose data to third parties.”

Five states have passed legislation giving executors power over digital assets. Connecticut and Rhode Island laws cover only email, while Indiana, Idaho, and Oklahoma laws include social-networking and blogging accounts. The laws remain largely untested in court.

National action isn’t expected for at least two years. The Uniform Law Commission, a group that drafts state laws for nationwide consideration, met for the first time in November to tackle a digital-asset law. Under one proposal, the law could broadly redefine the “authorized user” of an account to include an agent or a representative of his estate, says Suzanne Walsh, a Connecticut estate lawyer leading the committee.

But Google Inc. and Facebook representatives raised concerns about how such a law might upend users’ privacy expectations and how it might be implemented, attendees say.

There are also the business costs. Companies fear a patchwork of laws or having to adjudicate who should get a dead person’s files. Handing over data too readily could undermine their users’ trust. And fundamentally, leaving dead people’s accounts active runs counter to a core business proposition of sites like Facebook, which is to sell advertising targeted at real living people.

Internet companies face a “conflict between federal law, which strictly limits” disclosure, and state laws “seeking to expand the authority of the deceased,” a Facebook spokesman said. He also said that keeping dead people’s accounts active “would undermine the fundamental concept of authenticity on Facebook.”

A Google spokesman said, “It’s crucial to strike a balance” between the grieving family and the user’s privacy. He said Google is also concerned that an account could be used to impersonate the dead.

Some people may have good reason to keep their files private. Minneapolis computer expert Mark Lanterman recalls a computer hard drive he recovered for a family after a 2009 fire revealed that its owner was researching arson-investigation techniques, had a female companion not his wife, and was an embezzler.

Facing a lack of legal clarity, families are charting their own course. In one the first lawsuits over the issue, the parents of Justin Ellsworth, a Marine who died in Afghanistan in 2004, sued Yahoo to access his email. Yahoo at first refused, but ultimately complied with a court order to hand over his data.

Since then, a Yahoo spokeswoman said, the company has revised its terms of service to make it clear that the accounts aren’t the property of the estate. (However it will respect a person’s wishes if consent and account details including the password is given in an estate plan.)

Today, some people share passwords so others can access their accounts after death, or write clauses into their wills, though the legality of either is unclear. The Justice Department has said in testimony to Congress that it believes fraud laws would permit criminal charges if a person “exceeds authorized access” by violating a website’s terms of service, which often say nobody else can access an account.

In the Atkins situation, no law-enforcement agency or company is suggesting it would press charges. Still “there hasn’t been a lot of case law on this,” says Jim Lamm, a Minnesota estate lawyer who focuses on digital issues. “It’s up to a prosecuting attorney whether to charge” a family member with a crime for accessing the accounts of the dead, he says, “and that’s not a risk that I would advise them to take.”

In 2009, Facebook began allowing family members to either delete or “memorialize” the accounts of the deceased. In a memorialized account, a person’s existing friends network can still leave comments and photos with the account of a dead person. But nobody has permission to log in or edit the account.

For Teddy Campagna of Salt Lake City, his dead brother’s online presence is making the private process of grieving excruciatingly public. After his brother B.J. committed suicide at age 40 in April, Mr. Campagna planned a fitting funeral for the former photographer of rock concerts, car shows and other events. He dressed his brother in a pair of “really cool Levi’s” and two of his favorite shirts, as well as a beanie, and blasted Pink Floyd music.

Mr. Campagna has struggled to maintain that kind of control online. “His Facebook page is one of only a few things we have left of him,” he says.

So he has kept the account active, which he is able to do because his brother had given him the password. But he’s sensitive about his brother’s suicide and doesn’t want B.J.’s profile tarnished by off-color comments or gruesome details about his cause of death.

Around B.J.’s birthday this summer, an ex-girlfriend of his posted something negative, he says. “I am protecting my little brother, who can’t fight back,” he says.

He says he contacted Facebook to ask what would happen if he “memorialized” his brother’s page and then someone posted an unwelcome message on it. He didn’t like the answer: “That message is also memorialized—forever,” he says, unless its author deletes it.

The Facebook official said the company’s “hearts go out to those who have lost loved ones.” Memorialization, he said, is designed to respect the privacy of the dead. “Allowing ongoing access to accounts,” he said, “could potentially run afoul of federal wiretapping law as well as state computer trespass and online impersonation laws.”

“I think that is a cop-out,” says Mr. Campagna.

In Toronto, Alison Atkins was diagnosed with ulcerative colitis, a painful colon disease, when she was 12. A petite brunette with a broad smile, Alison tried to live a normal teen life. She played the violin and kept pet hermit crabs.

As part of her disease, she had her colon removed—one of at least eight surgeries. “She was wise beyond her years,” says her mother, Lyn Atkins. “We talked about lots of things, including organ donation or being kept alive on machines.”

Alison worked to raise money and awareness for people like her who live with ostomies, which require people to attach a pouch to their bodies to collect waste. At age 13, she posed for modeling portraits wearing her ostomy bag.

In her better moments, she counseled suicidal kids online, her father says. But as her health declined, she could no longer attend school regularly and became suicidal herself, says her sister Ms. Atkins.

Some mystery shrouded Alison’s death. She was found unconscious in her bed on July 26, and suffered heart attacks that left her brain-dead. Her family wasn’t initially certain if she accidentally choked, or intentionally overdosed on pain killers.

Three days after Alison died, Ms. Atkins says her parents asked her to try to access her sister’s Internet accounts to find photos and to better understand what she was thinking in her final days. She took her sister’s MacBook, a hand-me-down that was missing the return key, to a friend who is a computer repairman. Within 10 minutes, she says, he circumvented the computer’s password.

Once on the computer, Ms. Atkins found that it automatically logged her into her sister’s Twitter, Tumblr and Facebook accounts. She spent hours scouring their pages. “I felt a longing, like I was going to find a secret code that is going to change everything and make everything better,” Ms. Atkins says.

Logged in as Alison, her mother posted to Facebook: “We unlocked Alison’s MacBook Pro so don’t be alarmed if you see her online on Facebook.…It’s just her family getting information and all the messages!”

Alison’s sister discovered some of Alison’s most intimate thoughts and feelings. On her Tumblr account, Ms. Atkins found a password-protected second blog under the heading “you wouldn’t want to know.” Inside, she found posts about suicide and what she describes as “dark” comments.

Ms. Atkins and her cousins debated whether to tell Alison’s parents about the private account. Eventually, they did.

As difficult as that was, Alison’s mother, Lyn, says she has no regrets. “I read it with sadness. There were no surprises,” she says.

Ultimately, Alison’s online activities helped the family feel more certain that she likely hadn’t attempted suicide. In some of her final writings, she expressed excitement about plans to meet a boyfriend in coming days.

Asked if she felt Alison had a right to privacy, her mother says she doesn’t believe so. “She was my child. I felt I had a right to know.”

A Tumblr Inc. spokeswoman says the company doesn’t provide passwords to families of the dead, but will shut down accounts upon a family’s request.

Ms. Atkins used her access to Alison’s accounts to change Alison’s privacy settings, she says. She gave herself access to her sister’s private Twitter posts, and unblocked herself and her parents on Alison’s Facebook profile.

A Twitter Inc. spokesman declined to comment on an individual account.

As Alison’s friend network learned of her death, they began posting photos, videos and other memorials to her Facebook page. More than 20 people sent Alison’s Facebook account new friend requests, which her family approved.

Alison’s death notice in the Toronto Star, written by her father and aunt, was short and said little about her struggle or accomplishments. But across hundreds of posts on Facebook, friends wrote their own testimonials about how much they missed Alison and had been inspired by her bravery in confronting disease.

Amid the mourning, Ms. Atkins hadn’t dealt with an issue she knew was coming: Sooner or later, the Twitter, Facebook and other accounts on Alison’s MacBook would automatically log out and require her to type in passwords. She didn’t possess the passwords.

It started happening in early November. She could no longer get into Facebook on Alison’s computer. “I thought I could fix this or figure it out, but I was afraid of telling my parents,” she says.

Her attempts to reset Alison’s passwords made things worse. She couldn’t reset Facebook without access to Alison’s Yahoo mail account. But when she tried to log in to Yahoo, it asked her a series of “challenge” questions, put in place by Alison, which she kept getting wrong.

She suspects her sister intentionally put in the wrong answers to the questions. “Very sneaky on Alison’s part,” she says. The same happened with Microsoft Hotmail.

On Nov. 21, Ms. Atkins noticed that her sister’s Facebook account was gone entirely. Clicking on Alison from her own account brought up an error message. Alison’s profile photo, which once showed the family together at Disney World, had been replaced by a generic outline of a head.

She sent Facebook a message, pleading that the company return her sister’s account to its former state. “We just want her account back the way it was!” she wrote.

On Nov. 26, Ms. Atkins received a response from a Facebook staffer named Chester. “We are very sorry to hear about your loss,” he wrote. “Per our policy for deceased users, we reactivated and memorialized this account.”

Ms. Atkins is happy to have Alison’s Facebook content back, but sad that Alison no longer appears in search results, and that she can’t add any more friends to Alison’s account.

If she herself were to die, Ms. Atkins says, she would want her boyfriend or parents to have access to her accounts. But there is no system to make that happen. The Internet seems like “a scrapbook and a memory book that is going to be there forever—but it isn’t,” she says. “It could all be gone in an instant.”

Write to Geoffrey A. Fowler at geoffrey.fowler@wsj.com

A version of this article appeared Jan. 5, 2013, on page A1 in some U.S. editions of The Wall Street Journal, with the headline: Life and Death Online: Who Controls a Digital Legacy?.
———————————————————-

Submitted by: Anna E. Lineberger