1.0 Law & Legal CLE Credit A/V Approval #1079241 · 2018-09-04 · Washington’s fiduciary access...
Transcript of 1.0 Law & Legal CLE Credit A/V Approval #1079241 · 2018-09-04 · Washington’s fiduciary access...
1.0 Law & Legal CLE Credit – A/V Approval #1079241 Recording Date – December 6, 2017 Recording Availability – September 4, 2018
Meeting Location Date Time Topic
King County Bar Association 1200 Fifth Avenue - Suite 700
Seattle, WA
Wednesday, December 6, 2017
12:00 PM to 1:15 PM
Digital Assets: Estate Planning and
Administration
AGENDA 12:00 PM Introduction 12:10 PM Presentation: ‘Digital Assets: Estate Planning and Administration’, by Anton B.
Cauthorn, Reed Longyear Malnati & Ahrens, PLLC
Planning for digital assets.
Locating digital assets in a probate or as an attorney-in-fact.
Accessing digital assets in a probate or as an attorney-in-fact. 1:15 PM Adjourn
SPEAKER BIOGRAPHY Anton B. Cauthorn, Reed Longyear Malnati & Ahrens, PLLC - Anton Cauthorn is an estate planning attorney at Reed Longyear focusing his practice on estate planning, probate, tax law, and small business planning. Anton is also adjunct faculty at Seattle University and will be teaching Estate and Gift Taxation and is on the board for Northwest Family Business Advisors. Anton received his Juris Doctor degree from the University of San Diego School of Law and an LLM in tax law from the University of Washington. Prior to joining Reed Longyear, Anton founded a solo estate planning law firm in Santa Monica, California and worked at Rehberg Law Group, a boutique estate planning law firm in Seattle. When not practicing law, Anton is an active outdoors enthusiast spending his weekends hiking and climbing in the Cascades. He is also a member of the Cystic Fibrosis Foundation and volunteers for the Foundation’s annual Breath of Life Gala.
HOW DO I EARN CREDIT FOR SELF-STUDY
OR AUDIO/VISUAL (A/V) COURSES?
For pre-recorded A/V (self-study) programs, although the sponsor should apply for
accreditation, lawyers need to report the credits earned for taking the course.
To add an approved course to your roster, follow the procedures below:
Go to the "mywsba" website at www.mywsba.org/.
Log in.
Click on the "Access MCLE" link in the "MCLE Info" box on your home profile
page.
Click on "Add Activity." Search to find the approved course in our system. (See
search suggestions on the screen.)
Adding a Recorded Course Select Recorded Course from the Add New Activity screen.
This will prompt you to search for the activity in case the activity has already been
accredited in the MCLE system.
You can search by Activity ID or by specific Activity Details. For the Activity Details
search, you can use keywords for the title, sponsor name and date.
After entering your search criteria and selecting Search at the bottom of the screen, a list
of possible activities will be provided.
You can select the correct one by clicking the Activity ID. This will take you to the
specific activity. Entered the date(s) on which you began and ending viewing this
recorded activity.
Then claim the correct credits for which you attended this activity in the Credits Claimed
fields and click the Submit button at the bottom of the page.
You will receive a confirmation message at the top of your screen stating, “The activity
has been added to your roster.
1.
2.
3.
4.
Which Digital Assets do You
need to find?
&
How do you find them?
1. Does it have monetary value?
2. Does Anyone Want It?
3. Can it be transferred?
4. What is the return on investment?
5. Is the Fiduciary a POA or Personal Rep?
1. Personal Story Assets
2. Online Revenue
3. Purchased Assets: Mp3,
Videos, Books, Bitcoin
4. Intellectual Property
5. Online services with
recurrent billing
6. Online access to accounts
Description Assets that tell a personal story.
Emotional value for family.
No monetary value.
Examples Email
Social Media
Non-revenue Blogs
Pictures
Videos
Personal writings
Description
Assets that generate revenue.
Advertising Revenue.
Online Sales.
Examples
Blogs with advertising revenue
Youtube channels
Online product sales
Online businesses
https://www.youtube.com/watch?v=ckDVpihCPq8
Description Assets with actual or
potential monetary value.
Purchased digital assets.
Examples Digital Currency: Bitcoin
Domain Names
mp3s, videos, etc…
Video games
Description
Creative works of decedent.
Examples
Writing/Manuscripts
Recorded Music
Produced Videos
Description
Monthly billed online services.
Automatic billing.
Examples
Netflix
Amazon Prime
Match.com
Office 365
Description Online Accounts for real
world companies
Examples Online banking
Online utilities
Online medical information & billing
Online employee information
Look for Password List
(hard copy or digital)
Check Credit Card Bills
Review browser history
(caution)
Look for Stored
Passwords in Browser
1. Anti-Hacking Laws
2. Access to cell phone for multi-
factor authentication.
3. If you have the password.
4. If you don’t have the password
Computer Fraud and Abuse
Act.
“Authorization” required to
access online accounts.
Whose authorization?
› User?
› Service Provider?
› Both?
Locate cell phone
and password.
Some websites will
require
authentication
through a cell
phone.
Are you “hacking”
under Federal Law?
Often Unclear.
Encourage PRs to be
cautious.
UFADA: RCW 11.120
Does not guarantee the ability to log on.
Decedent mustspecifically allow access in a will.
Allows you to obtain a copy.
Still bound by user license agreements.
Computer Fraud and Abuse
Act. 18 U.S.C. 1030
“Whoever intentionally accesses a computer
without authorization . . . and thereby obtains
information from any protected computer [any
computer connected to the internet]. . . shall be
punished as provided in subsection (c) of this
section.”
Protected Computer: Any computer or electronic device connected to the internet.
Authorization: unclear whose authorization is required.
› User?
› Service provider?
› Both?
US V. Nosal, 844 F.3d 1024 (9th 2016) (amended)
“‘without authorization’ is an unambiguous term
that should be given its ordinary meaning.”
Employer “unequivocally” told Nosal that he was
barred from access.
“bears little resemblance to asking a spouse to log
in to an email account to print a boarding pass.”
“The majority does not provide, nor do I see, a
workable line which separates the consensual
password sharing in this case from the
consensual password sharing of millions of
legitimate account holders, which may also be
contrary to the policies of system owners. There
simply is no limiting principle in the majority's
world of lawful and unlawful password sharing.”
Facebook, Inc. v. Power Ventures, Inc., 844
F.3d 1058 (9th 2016)
The initial use did not violate the CFAA.
After facebook sent a cease and desist the
CFAA was violated.
Does access violate
the CFAA even with
permission?
Trustees?
POAs?
Personal
Representatives?
Brady goes to an internet café while on vacation.
Mike pays for two hours access.
License forbids him from sharing password and prohibits anyone else from using their computers.
Entire Brady Bunch uses the computers.
Question: Who has committed a federal crime?
Carol Read the license agreement. Uses computer anyway.
Greg Didn’t read the license agreement, but knows most
license agreements forbid password sharing. Uses
computer anyway.
Marcia Didn’t read license agreement; doesn’t know or care
what it says. Uses computer.
Peter Didn’t read license agreement, overheard someone say
café forbids password sharing. Uses computer anyway.
Jan Uses her own password, gets kicked out of the café for
spilling a drink, and owner forbids her from using the
computers. Reenters and uses her father’s password.
Bobby Owner sees him on the computer and tells him he
cannot use someone else’s password. He stays on.
Cindy Cindy previously paid for computer use and agreed to
license. License expires and Cindy uses Mike’s password.
How to Properly Plan for
Digital Assets
Keep up to date
inventory of
accounts &
passwords.
Store securely.
Notify POAs.
Add provisions in
POA and Will
granting authority
to access digital
assets.
Grant authority
under UFADA.
Backup critical
data locally
often.
Backup all apple
services.
DIGITAL ASSETS
Page 1 of 18
Planning for Digital Assets Version: 4/5/2017
1. INTRODUCTION. ........................................................................................................................................... 1 2. PROVIDING GENERAL ADVICE RELATED TO DIGITAL ASSETS. ........................................................................ 2 3. LOCATING AND INVENTORYING DIGITAL ASSETS. ......................................................................................... 3
GENERAL ADVISING RELATING TO INVENTORYING DIGITAL ASSETS. ........................................................................... 3 HOW TO LOCATE DIGITAL ASSETS. ...................................................................................................................... 4
Cell Phone and Phone Number. ............................................................................................................. 5 Assets with Personal Value. ................................................................................................................... 6 Monetary Value. .................................................................................................................................... 7 Administrative Value. ............................................................................................................................. 8 Monthly Billing. ...................................................................................................................................... 8
4. CONCERNS WHEN ACCESSING DIGITAL ASSETS. ............................................................................................ 9
TERMS OF SERVICE AGREEMENTS. ...................................................................................................................... 9 Apple ...................................................................................................................................................... 9 Google .................................................................................................................................................. 10 Facebook .............................................................................................................................................. 11
FEDERAL ANTI-HACKING LAWS. ....................................................................................................................... 11 Estate Plan Silent as to Authorization. ................................................................................................. 13 Estate Plan Authorizes Personal Representative. ................................................................................ 13
5. HOW TO ACCESS DIGITAL ASSETS. .............................................................................................................. 15
UNIFORM FIDUCIARY ACCESS TO DIGITAL ASSETS ACT—11.120. .......................................................................... 16 FIDUCIARIES DIRECTLY LOGGING ON TO ELECTRONIC SERVICE PROVIDERS. ................................................................ 18
6. CONCLUSION. ............................................................................................................................................. 18
1. Introduction. Digital assets are a unique class of assets that require special consideration in probate.
Although digital assets may in some ways appear to be analogous to traditional assets such as
tangible personal property, real estate, and financial accounts, there is one substantial
difference—electronic access. Digital assets can only be accessed through a computer, tablet,
phone, or other electronic device. Additionally, many digital assets are stored remotely on
servers owned by electronic service providers further limiting access. This limited access gives
rise to a number of planning concerns such as the ability of a personal representative to locate
DIGITAL ASSETS
Page 2 of 18
assets, locate passwords, access assets, and avoid criminal liability under federal anti-hacking
laws.
Probate is the process of administering an estate after death—paying bills, settling
disputes, and distributing the remainder of the estate. Probating digital assets adds a twist to
traditional probates, requiring special consideration of the decedent’s unique collection of digital
assets. The unique nature of digital assets can make access difficult if not impossible and subject
the Personal Representative to threat of federal criminal liability. Thus, when working with a
Personal Representative, it is important to determine the extent and nature of the decedent’s
digital estate to determine which digital assets should be found and preserved and how best to
achieve those goals. This should involve a cost-benefit analysis—the potential benefit to the
estate versus the time and effort required to locate and access asset.
2. Providing General Advice Related to Digital Assets. Often there is a minimal return on investment for advising Personal Representatives
about specific websites and specific assets until a clearer picture of the decedent’s digital estate
is achieved. Charging your hourly rate to help a Personal Representative access the decedent’s
iTunes account will likely be unreasonable in most cases. Under RCW 11.48.210 a court can
deny payment of an unreasonable attorney’s fee from an estate so it is important to use carefully
consider how much assistance should be provided with respect to digital assets.
Your initial meeting with the Personal Representative should encourage him or her to
create a comprehensive inventory of digital assets and their potential value to the estate and
beneficiaries. It is not worth your time to learn about and discuss every website, how each
website works, and the terms-of-service for each website. The more valuable service you can
DIGITAL ASSETS
Page 3 of 18
provide to a Personal Representative is a general overview of how to locate and access digital
assets while avoiding or reducing potential federal criminal liability.
To competently provide advice relating to digital assets you should be generally aware of
these three things: 1. The terms of service for some of the more common websites (e.g. apple,
google, and Facebook); 2. Washington’s fiduciary access to digital assets act (RCW 11.120); and
3. Federal anti-hacking laws (the Computer Fraud and Abuse Act [CFAA] 18 U.S.C. § 1030).
With this information, you can provide the Personal Representative a general overview of
potential issues and, once the Personal Representative has created an inventory of digital assets,
you can provide hands on assistance where the value of the asset warrants your involvement.
3. Locating and Inventorying Digital Assets. General Advising Relating to Inventorying Digital Assets.
The Personal Representative should begin by determining whether it is a valuable use of
time to locate and access the digital estate. Do the beneficiaries or family want copies of the
decedent’s digital photos? Does anyone want to obtain copies of the mp3s? Does the family care
about the decedent’s travel blog? Will the Personal Representative be able find the password
necessary to access the bitcoin? Digital hoarding is just as real as hoarding in the home and the
proper solution in many cases may be simply to throw it all in the trash can. Before investing any
significant time into digital estate management, the Personal Representative needs to carefully
consider: is it worth it?
However, a Personal Representative will likely have no idea of whether it is worth it until
he or she does some research. Your job as the attorney should be to advise the Personal
Representative to have a conversation with the beneficiaries and family about the basic
categories of assets to determine which digital assets are worth locating and accessing. The goal
DIGITAL ASSETS
Page 4 of 18
is to determine whether the decedent had any specific digital assets which require focused
consideration and planning.
Advising Personal Representatives with respect to digital assets is a balancing process. If
a decedent has a minimal digital estate, a long discussion may either increase costs to the estate
with little return on value, or if you bill flat fee, may cause you to spend significant time assisting
a Personal Representative on an unimportant issue. Even if a decedent has a large digital estate, a
Personal Representative may be unwilling to pay you a high fee to learn what they could
discover on a quick google search.
Thus, it is important to be able to quickly and efficiently discuss issues relating to digital
estates to identify potential areas that the Personal Representative should focus on. The following
categories should be considered when discussing digital assets with your clients:
How to Locate Digital Assets. Locating Digital assets can be a complicated and time-consuming process. In the simplest
cases, a decedent will have a comprehensive list of digital assets and up to date log on
information. However, this is rarely the case as our digital lives change on a daily basis as new
accounts are created and passwords changed. Digital estates pose a unique difficulty for Personal
Representatives. With non-digital assets, it can usually be safely assumed that assets with value
will eventually be discovered through the mail. However, online billings and statements can ma
The Personal Representative will likely need to play detective to determine the nature and
extent of the digital estate. The process that needs to be taken will be unique to every decedent.
However, some general steps can make locating digital assets simpler:
Step 1: Search the decedent’s files for lists of passwords and account information.
DIGITAL ASSETS
Page 5 of 18
Step 2: Search the decedent’s computer for passwords and account information.
Specifically look for any password management services or files containing lists
of passwords.
Step 3: Review the decedent’s browsing history and passwords stored in the browser.
Step 4: Gain access to the decedent’s email accounts through use of the password or by
requesting a copy of the email accounts through RUFADA. If RUFADA is used,
the Personal Representative may need to make a new request each month to
obtain all emails that arrive each month.
Step 5: Review emails monthly for any statements or notices.
Step 6: Watch credit card bills monthly for online billings.
When advising a Personal Representative to search for digital assets it is crucial to
mention the issue of sensitive and private data which may be located on a computer or in the
cloud. Digital lives are private and the Personal Representative may discover personal
information about the decedent which could be alarming to the Personal Representative. Thus, a
Personal Representative should use caution when searching for digital assets to maintain the
privacy of the decedent.
Locating digital assets can be a complex process. It is important to remember that it may
be impracticable or impossible to locate all digital assets. Your job should be to give the Personal
Representative sufficient guidance to find the assets that are valuable to the estate, family, or
beneficiaries. Some specific categories of digital assets are discussed below:
Cell Phone and Phone Number.
Cell phones are a ubiquitous part of modern life and the number of clients who do not
have a cell phone has dwindled to nearly zero. Although it may seem trivial to be able to log on
DIGITAL ASSETS
Page 6 of 18
to the personal cell phone of a decedent, it can be extremely important for a Personal
Representative to have access to a cell phone. Two-factor authentication is becoming more and
more common. Two factor authentication is when a website requires a password and a second
security option to log on to a website. A common form of two-factor authentication is where a
code is sent to the user’s cell phone via text message that must then be entered to complete the
log on process. Thus, in many cases, having a password to log on to an account may be
insufficient and it could be necessary to have access to the cell phone of a user. For this reason, it
is important that Personal Representatives have access to a cell phone. This problem can be
exacerbated by cell phone security measures such as devices which completely erase all data
after too many failed log on attempts.
Thus, when advising Personal Representatives, it is important to ensure they do not
cancel a cell phone number before obtaining access to all digital accounts and that they do not
accidentally erase a device by failing to enter the password correctly. If a Personal
Representative terminates cell phone service and a website requires two-factor authentication via
text message, it may become difficult or impossible to log on to that account.
Assets with Personal Value.
Some assets may not have monetary value but may have personal value to the Decedent’s
family and beneficiaries. Prior to the digital age, family members would often pass down
memorabilia including photo albums, war-time love letters, or diaries to children or
grandchildren. As tangible objects these items would be found when cleaning out a home and
could be saved. However, when photo albums, love letters, and diaries are stored digitally, they
can be lost forever if Personal Representatives are unaware of their existence or lack access.
Assets that may have personal value to your clients or their families include:
DIGITAL ASSETS
Page 7 of 18
Personal Emails
Social Media Accounts
Non-revenue generating blogs
Family Pictures
Family Videos
Writings
Artwork
Music
Advising the Personal Representative to have a quick discussion with the family and
beneficiaries can help to identify any particularly relevant assets with personal value that should
be preserved for future generations.
Monetary Value.
Some digital assets have actual monetary value. Personal Representatives should be
advised to spend some time looking for these assets. Assets that may have monetary value
include:
Online Revenue Streams
o Blogs with advertising revenue
o Youtube accounts with advertising revenue
Purchased digital assets
o Mp3
o Videos
o Domain Name
o Video Games
Digital Currency
o Bitcoin
Self-created assets
o Writings – authors
o Music – musicians
o Artwork – artists
These are important assets to identify, locate, and inventory, though they may be difficult
to find. Self-created digital assets such as writings, music, or artwork can be a particularly
valuable type of digital asset that can be easily lost if the Personal Representative does not
thoroughly search local devices as well as the cloud.
DIGITAL ASSETS
Page 8 of 18
Administrative Value.
Some assets merely provide administrative value. These assets can facilitate the
administration of the estate of the decedent if the Personal Representative can gain access.
Examples of assets with administrative value include:
Emails accounts that receive electronic billings
Online banking
Online medical records
Online bill pay
Online utilities
Online employment information
Monthly Billing.
If the decedent had online subscriptions they may have automatic billings which are paid
directly from accounts. If a Personal Representative is not aware of these accounts, automatic
payments may be made which are unnecessary. A deceased client has no need for a Netflix
subscription, amazon prime subscription, or access to a dating website, but a Personal
Representative may not discover these automatic billings until they appear on a credit card
statement. Many online services provide discounted rates if a customer signs up for annual
automatic billing. In these cases, this can create a large unexpected charge to a decedent’s
account if the Personal Representative is not able to discover and terminate the service prior to
the next billing cycle. Examples of automatic billings to be aware of include:
Video subscriptions
o Netflix
o Amazon prime
Software subscriptions
o Microsoft office 365
o Adobe
Dating subscriptions
o Okcupid
o match.com
Automatic purchases
o Amazon recurring purchases
DIGITAL ASSETS
Page 9 of 18
o Amazon Fresh
4. Concerns When Accessing Digital Assets. Once the Personal Representative has created an inventory of the digital estate he or she
will need to find a way to access those assets. Before accessing digital assets, the Personal
Representative first needs to determine whether they are violating any terms of service
agreements for those online providers and, next, whether they are violating federal anti-hacking
laws.
Terms of Service Agreements. Nearly every website will have a terms of service agreement—a contractual agreement
that specifies a user’s rights. Unfortunately, terms of service agreements can differ greatly from
website to website. When advising a Personal Representative, your primary concern will be
whether a terms of service agreement limits access by the Personal Representative or prohibits
password sharing. Although it is not practical to know the terms of service of every website, a
good rule of thumb is that the majority of websites will forbid password sharing. Further
discussion of three of the most common online service providers are discussed below:
Apple
Apple’s terms of service agreement is likely one of the most problematic in probate. Not
only does Apple forbid password sharing but they also reserve the right to completely delete all
content in an account upon the death of the user:
Unless otherwise required by law, you agree that your Account is non-
transferable and that any rights to your Apple ID or Content within your
Account terminate upon your death. Upon receipt of a copy of a death certificate
your Account may be terminated and all Content within your Account deleted.
Contact iCloud Support at www.apple.com/support/icloud for further
assistance.
http://www.apple.com/legal/internet-services/icloud/en/terms.html
DIGITAL ASSETS
Page 10 of 18
The right to delete all content upon death can be a large concern for decedents who stored
a large portion of their personal data on apple’s cloud server icloud and apple devices. If an
estate has important data stored on icloud or apple devices (such as family photos, writings, or
artwork) you should encourage the Personal Representative to proceed with caution when
notifying apple of the death of the account holder.
Although the Washington’s version of the Uniform Fiduciary Access to Digital Assets act
(“UFADA”) grants a fiduciary the right to access the account of a deceased user, the UFADA
grants no more rights than a user had under a terms of service agreement. See Section 5.1. Thus,
it is arguable that Apple could delete all contents of an Apple user’s account following the user’s
death rather than granting a copy of the account to the personal representative after death without
violating the UFADA. Further, the fact that apple forbids password sharing creates risk that a
fiduciary logging on to an Apple account would be violating the Computer Fraud and Abuse Act.
See Section 4.2. Thus, it is critical to advise Personal Representatives of these risks, especially if
the decedent had important digital assets stored on apple devices.
Currently, there is no definite legal solution to this issue. When advising a Personal
Representative, you will need to discuss the possibility that an account may be completely
deleted by apple and assist your client in trying to prevent that outcome by persuading apple to
take a different approach.
Google’s terms of service are far more liberal than Apple. Google does not explicitly
forbid password sharing, though it encourages users not to do it. Thus, absent a change in terms
of service, it is likely that a fiduciary could access a google account without violating the
DIGITAL ASSETS
Page 11 of 18
UFADA. Thus, clients who use google for cloud storage or email may be in a far better position
for fiduciary access than Apple users.
Facebook has a restrictive use policy forbidding use by non-authorized users and
forbidding password sharing:
You will not share your password (or in the case of developers, your secret key),
let anyone else access your account, or do anything else that might jeopardize
the security of your account.
https://www.facebook.com/terms
The primary reasons that a fiduciary may want to access Facebook would be for personal
family history including family photos or Facebook messenger conversations. However, due to
Facebook’s restrictive terms of service agreement there appears to be a large risk that a fiduciary
would be considered to violate the CFAA by accessing Facebook.
Federal Anti-Hacking Laws. There is a risk that a Personal Representative who accesses accounts of the decedent
could be violating the Computer Fraud and Abuse Act (the “CFAA”). The CFAA is a federal
criminal law designed to prevent hacking but which contains overbroad and ambiguous wording.
18 U.S.C. § 1030. The concerning language is found 18 U.S.C. section 1030: “Whoever
intentionally accesses a computer without authorization . . . and thereby obtains information
from any protected computer [any computer connected to the internet]. . . shall be punished as
provided in subsection (c) of this section.” (emphasis added). The concerning part of this
wording is the ambiguity of the term authorization. The term authorization is inherently
ambiguous as it is completely silent as to whose authorization is required and what type of
authorization is sufficient.
DIGITAL ASSETS
Page 12 of 18
Applying a few hypotheticals to this statute quickly demonstrates how unclear the statute
is:
1. A child goes into work with his mother. Mother goes into a meeting and gives Son
her computer password and he logs on. However, the office has a specific policy that
forbids password sharing and forbids computer use by non-employees. Is Son a
criminal under the CFAA?
2. A husband shares his Facebook password with his wife. Facebook forbids password
sharing but Wife is unaware of this. Wife uses the password to log on to Husband’s
facebook to see if he is cheating on her. Is Wife a criminal under the CFAA?
3. The same example as above but this time, Wife knows that facebook prohibits
logging on to other people’s facebook accounts. Is Wife a criminal under the CFAA?
4. The same example as above, but facebook has discovered Wife is using husband’s
password. Facebook sends wife an email to stop using the password. Husband grants
wife permission to use the password after Facebook’s email. Wife continues using the
password. Is Wife a criminal under the CFAA?
The answer to the first three of these hypotheticals is maybe. The answer to third
hypothetical is currently yes, wife has violated the CFAA and could be prosecuted as a hacker
under the CFAA.
In the probate context, the CFAA creates a serious concern for Personal Representatives
wishing to access accounts of a principal. If an estate plan is silent to authorization it is unclear
whether a Personal Representative can access digital accounts. In fact, even if an estate plan
specifically authorizes the Personal Representative to access accounts, it is unclear whether the
Personal Representative can avoid criminal liability under the CFAA.
DIGITAL ASSETS
Page 13 of 18
Estate Plan Silent as to Authorization.
If the estate plan does not specifically grant the Personal Representative access to the
decedent’s online accounts it is entirely unclear how the CFAA applies. It is clear that the
Personal Representative has not been granted “authorization” by the user or by the service
provider. However, it would appear reasonable to assume that a Personal Representative, as a
fiduciary, effectively steps into the shoes of the decedent for all purposes and thus would be
authorized to use passwords to the same extent that the decedent could during life.
However, there is no law on point to support this conclusion. Thus, it is unclear whether
being a fiduciary would shield a Personal Representative from criminal liability under the
CFAA. The only advice you can provide to the Personal Representative is that the law is unclear
and that they may be violating criminal law by accessing digital assets.
Estate Plan Authorizes Personal Representative.
Even if an estate plan specifically authorizes the personal representative to access digital
accounts, there are concerns. Authorization from the decedent alone may not be sufficient to
avoid criminal liability under the CFAA.
The majority of electronic service providers forbid password sharing in their terms of
service agreements. This creates a legitimate concern as to whether a Personal Representative
who accesses the decedent’s digital assets with the permission of the decedent but in violation of
the terms of service has authorization under the CFAA. It is completely unclear how the CFAA
should be applied to a fiduciary. Potential interpretations include:
1. A fiduciary is effectively stepping into the shoes of the principal and thus an act of
the fiduciary is an act of the principal. So long as the principal was authorized, the
fiduciary would be authorized as well.
2. The principal’s authorization is sufficient to allow access even without the
authorization of the electronic service provider.
DIGITAL ASSETS
Page 14 of 18
3. Both the principal and electronic service provider’s affirmative authorization is
required.
4. The principal’s authorization is required and the fiduciary can act until authorization
has been affirmatively revoked by the electronic service provider.
Unfortunately, 9th Circuit case law has only confused the issue further. There are two cases
relevant to this issue: U.S. v. Nosal, 844 F.3d 1024 (9th Cir. 2016) and Facebook, Inc. v. Power
Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016). In Nosal, David Nosal, an ex-employee of a
company accessed company computers using the password of a former co-worker after having
his access to company computers formally and explicitly revoked. The court found that Nosal
had accessed computers “without authorization” within the meaning of the CFAA because his
access to the company computers had been affirmatively “revoked” by his employer. The
problem with this ruling is that it is unclear what constitutes a “revocation.” It is possible that a
fiduciary who is aware that an electronic service provider forbids password sharing has had his
or her authorization revoked under the CFAA. Although the court in dicta stated that the ruling
does not apply to family password sharing, the court’s reasoning appears to in fact criminalize
family password sharing.
The second case, Power Ventures, dealt with a social media company which helped users
gather data from multiple social media websites and display all the information on a single
website. To access data, Power Ventures obtained its users Facebook passwords and then pulled
each users data from the Facebook website. Facebook discovered Power Venture’s actions and
sent a cease and desist letter; however, Power Ventures continued to access Facebook via the
users’ passwords. In a subsequent civil lawsuit, the 9th circuit held that Power Ventures did not
have authorization under the CFAA. The court reasoned that Power Ventures originally had
proper authorization from the users, but upon notice that Facebook prohibited Power Ventures’
DIGITAL ASSETS
Page 15 of 18
access, authorization had been terminated. However, the court did not resolve what constituted
sufficient notice of revocation of access.
Thus, under the CFAA there is still a question as to whether terms of service limitations
forbidding password sharing would constitute a criminal violation under the CFAA. When
advising Personal Representatives, the best advice to give is that the law is unclear and access by
a Personal Representative, even with the authorization of the decedent, could potentially give
rise to criminal liability under the CFAA.
Although the risk to a Personal Representative acting in the best interest of an estate may
seem low, the risk, in some cases, may be higher than anticipated. The actions of Personal
Representatives are sometimes challenged by unhappy beneficiaries. Children who act as
caretakers and financial powers of attorney for their parents and later as a Personal
Representatives may find their actions challenged by unhappy siblings at the death of the
parents. The unhappy siblings remember how wealthy the parents were and, when they discover
the extent to which assets were consumed at the end of life, assume that the caretaker sibling
must have absconded with the parents’ money. If the caretaker sibling was accessing electronic
accounts under the power of attorney and then as Personal Representative, there is a risk that the
unhappy sibling could bring a civil suit or potentially report the action to federal prosecutors.
5. How to Access Digital Assets. Now that the Personal Representative has inventoried the digital estate, the next step is
determining how the Personal Representative will access those digital assets. The apparent
simplicity of accessing accounts of a deceased user by entering a user name and password
obscures many complex issues. First, the fiduciary must be aware that an account exists and have
the proper user name and password. Second, two-factor authentication may also require more
DIGITAL ASSETS
Page 16 of 18
information than a password and can frustrate a fiduciary trying to access accounts. Third, terms
of service may prohibit a Personal Representative from accessing a decedent’s account. And
finally, the Personal Representative may be violating the CFAA.
Assuming that the Personal Representative is aware of an account, there are two options
for accessing the account. First, the Personal Representative may use Washington’s Uniform
Fiduciary Access to Digital Assets Act (UFADA). The benefit of UFADA is that it provides a
clear structured path for a fiduciary to access digital assets even if the fiduciary lacks a password
to log on to the account. The drawback to UFADA is that the method of access is clunky and
may not be effective. Second, the Personal Representative may simply log on to the accounts.
The benefit to logging on to accounts is that it is usually simple and effective. The drawback, is
that it may violate the terms of service of the account and, worse, could expose the fiduciary to
federal criminal liability under the Computer Fraud and Abuse Act (CFAA).
Uniform Fiduciary Access to Digital Assets Act—11.120. Washington’s uniform fiduciary access to digital assets act provides some clarity as to the
rights of fiduciaries to access digital assets by outlining processes for fiduciaries to contact
electronic service providers and obtain account information. The act provides fiduciaries a bright
line set of rules for how they can access digital assets.
However, it is important to realize that access under the UFADA does not mandate that
service providers grant authority to log on to accounts, it merely requires service providers to
provide a copy of the files held on a remote server. Under the UFADA, a fiduciary will have
access to the assets only if the fiduciary has been explicitly granted access either in a power of
attorney or will. Thus, if the will does not grant the Personal Representative authority to access
digital assets, the UFADA does not apply. In addition, an important exception to be aware of is
DIGITAL ASSETS
Page 17 of 18
that if a user completes an online tool granting or restricting assets to digital assets, the online
tool will override previously drafted estate planning documents. 11.120.040.
To access digital assets a Personal Representative will be required to write to the
electronic service provider requesting the information, provide letters testamentary, a copy of the
will granting authority to access digital assets, and potentially provide a sworn statement made
under penalty of perjury that the fiduciary has the right to access the information. Once the
electronic service provider receives this information they have the option to either: grant full
access to the user’s account; grant partial access as necessary to carry out the Personal
Representative’s task; or provide a copy of any digital asset the user could have accessed if alive
and had capacity. 11.120.060(1). In addition, an electronic service provider can charge the
Personal Representative for the cost of providing the records. 11.120.060(2).
The access rules under the UFADA can make it burdensome for a Personal
Representative to access digital assets. This limited method of access can create headaches for
Personal Representative. For example, a Personal Representative may need to monitor an email
address to find electronic billings. However, the email provider may refuse to provide access and
merely provide a copy of the account. Without immediate access to accounts, the Personal
Representative will be required to make monthly or more frequent requests to the email provider
to obtain new emails as they arrive. If the email provider chooses to bill the fiduciary this can
quickly create large costs between the time spent by the Personal Representative and the email
provider.
Although the UFADA provides a bright line rule for accessing digital assets, in practice
UFADA may not provide fiduciaries with the ease of administration that they desire. An
DIGITAL ASSETS
Page 18 of 18
alternative to the UFADA for fiduciaries who have the requisite logon information is simply
accessing the accounts via log on credentials. However, there are risks, as discussed below.
Fiduciaries Directly Logging on to Electronic Service Providers. A fiduciary who has the requisite logon information for an account could theoretically
bypass the UFADA and simply use the logon information to access the principal’s accounts.
However, there are concerning risks involved with this option. Many electronic service providers
specifically prohibit password sharing and such prohibition could theoretically include sharing a
password with a fiduciary. However, the risk of any serious consequences to a user for sharing a
password or a fiduciary for using said password would appear to be minimal. The larger concern
is that the CFAA could be interpreted to criminalize password sharing when a website’s terms of
service forbid password sharing. See Section 4.2.
6. Conclusion. Probating Digital Assets can be a complex process. As the attorney, your role will be to
guide the Personal Representative in his or her inventory of the Digital Estate. In most cases,
your assistance will likely be unneeded but it is important to explain the difficulties around the
CFAA and options for accessing digital assets including using passwords and the UFADA.