Chapter 2. Dealing with the Digital Legacy of an Unexpected Death

Introduction

If you are reading this chapter of the report due to a recent loss, let me first say, I’m so very sorry for your loss. Everyone’s grief is unique, I know mere words do little to assuage the pain and grief you must be feeling, but I hope this guide will help in some small way.

I can only hope that some of the preparation work outlined in Chapter 1 is available to the surviving spouse or family member to help pick up the pieces, but I will not assume that for this part of the report. However, there are a lot of helpful items in Chapter 1 that can help organize your thoughts and approach to this information. It might be useful to review that portion of this report to help sort through the details of a sudden death.

There are great tasks and concerns that come into play when dealing with an unexpected death. For this report, I will focus only on the digital aspects of an unexpected death. I have added some additional nondigital items in an Appendix following this report; however, the scope here will be mainly digital items.

In general, aside from the largest companies, very few online companies have a solid and known policy for dealing with the sudden death of a customer or member. Often, they must invent an ad hoc process and figure out how to resolve the situation without any existing guidance. Patience and kindness will go a long way to getting help from various companies who were in this circumstance. Most people will want to help but must figure out how and what they are allowed to do. As with most things that fall outside the normal bounds of business, you might need to escalate the issue to someone with sufficient authority to resolve it.

This can be a maddeningly difficult and frustrating task. Be patient, be persistent, and keep at it.

Section 1: Passwords and Computers

Today, most people manage their information with some sort of computing device. In the aftermath of an unexpected death, the likely source of information for dealing with a digital legacy will be the computers of the deceased. This section discusses strategies, techniques, and ideas for accessing this key information.

Finding the Data/Accessing Systems

Inevitably, in our online and digital world, key information that the surviving spouse will need or want will be on some computer system of the deceased. Without passwords having been preshared or alternate account access enabled, it can be a great challenge to obtain this information.

This can be more than just a nice to have. Often, key family memories, documents, photos and other shared data can reside on the deceased’s computer. Nothing is more heartbreaking than losing a spouse unexpectedly; being denied access to the photos of your life together only compounds this.

Often the surviving spouse will have zero passwords for any of the IT equipment their deceased loved one set up. For most types of situations, there are ways to gain access, but it’s not certain, especially when faced with full-disk encryption.

There are entire books written on gaining access to locked systems, but we will cover some basics that will work most of the time, as long as you have physical access to the computer system you are trying to access.

Assuming that no passwords are available, we need to begin with the basics of identifying which operating system we are dealing with. This is usually best established by connecting a monitor and keyboard to desktops and servers. At that point, it is a simple matter to find out what operating system you are dealing with. Laptops, of course, make this even easier.

Depending on the complexity and number of systems involved, you might find a large mixture of operating systems on the various devices, each with possibly different passwords, administrative accesses, or root recovery strategies. For instance, most operating systems will allow you to create a startup device, usually a USB stick, or a bootable CD/DVD that can start the same operating system off that device, rather than the internal hard drive. Assuming that the internal hard drive isn’t encrypted, it is usually a simple matter to reset the administrative password to something you know and then restart off the internal hard drive.

As is often the case now, personal computers also contain a great deal of family photos and important documentation. Depending on the security enabled on the surviving spouse’s personal computers, this can be a highly difficult item to access. For instance, let’s examine the case of a MacBook with full-disk encryption enabled, which contains all of the personal photos and other key documents that a surviving spouse wants to recover.

In most cases, the surviving spouse does not know the passwords to these computers, and would not have her own account to access this data. Typically, this is not out of any malicious intent; it’s just the way things happen with computers and day-to-day life.

In most cases, when you find a MacBook you need access to, it’s not too much of a problem: just treat it like any box you don’t have the password for, because you have physical access. As such, you would create a Mac OS X install disk of the correct version on a USB stick and start up from this on the system in question.

However, this is where things can begin to go a bit sideways if the deceased was security-conscious. The instructions for resetting a lost administrator password on a Mac are very straightforward. Simply start using the appropriate install disc, mount the main hard drive, and use the built-in utilities to change the password.

But this will not work in the case of an internal hard drive encrypted with full-disk encryption. The built-in utilities on the startup device won’t be able to mount the main hard drives in the password recovery utility. When a MacBook drive is set up with full-disk encryption using File Vault, it is impossible to use the startup device technique to recover access to the system. There is no way the recovery drive is going to be able to see and talk to a fully encrypted hard drive. You will need the administrator password or a recovery code to unlock the drive.

Apple is kind enough to give you a lot of options for recovery in this situation. To ensure access to a File Vault–encrypted drive, you can create a recovery key. You can use this recovery key to decrypt a drive in the event that all other access methods fail. The recovery key is not that long, and you can write it down. You also can store it in an Apple iCloud account for later access.

Unfortunately, if the deceased chose to not write down the encryption recovery key or did not tell the surviving spouse where it was, there is no choice but to hope he stored it on his iCloud account.

However, accessing an iCloud account is no trivial task. Most surviving spouses will have no information or preexisting access to a deceased spouse’s iCloud account. In most cases, it’s safe to assume that you would have no usernames, no email addresses, and, of course, no passwords to the iCloud account.

Apple’s policies on this matter are actually not very helpful, either, though it is a very security-conscious philosophy. Apple has a very clear policy on the death of an account holder, and the right of survivorship. Quoting the Apple website:

Unless otherwise required by law, you agree that your account is non-transferable and that any rights to your Apple ID or content within your account terminate upon your death. Upon receipt of a copy of a death certificate your account may be terminated and all content within your account deleted.

In other words, Apple basically says that your next-of-kin will have no right to access your account after you die, and they will not help provide this access. You can, however, send them a death certificate and they will delete the account and all data contained within it.

In general, Apple will not help in this case, so your best option is to try to gain access to the iCloud account directly. First, it’s useful to figure out what email account the deceased used as the recovery email for his iCloud account. Of course, simply finding out the email account is not enough; you also need to get access to it. Access to the email account is its own highly complex task, depending on the email provider and security features available and enabled on the deceased spouse’s account. For instance, if it is a small vanity domain, hosted at a computer server colocation facility (aka co-lo), it can be trivial to gain access, but if it is a Gmail account, it can be nearly impossible without the actual passwords or ability to do a password recovery.

Returning to the topic of iCloud, and assuming that you now have access to the configured recovery email and username, you can attempt to do a password reset on the iCloud account, hoping for a nice easy password reset link sent to the email address.

Sometimes it can be that simple, and an email with a password reset link will show up in the email and allow a quick reset. However, Apple, being security-minded, has implemented a much more robust password reset process. Apple allows for the configuration of a two-step verification process on recovery of an iCloud password. If you lost the password, you need two of the following items to recover it:

  • Apple ID password

  • Access to a configured trusted device, such as a iPhone or iPad

  • A preconfigured recovery key

This can be a real challenge. In this case, if you had the Apple ID password, this entire issue would be moot. Also, the recovery key is not typically known; otherwise, you could easily access the encrypted hard drive. As for the trusted device, such as an iPhone, it really depends on whether the deceased’s cell phone accounts had already been disabled. If you happen to still have an active phone, it’s possible that a recovery code could be sent to the phone, but often these are some of the first accounts that are turned off when someone passes away.

So, again, it is vital to have this sort of information shared ahead of time. Without access to these encrypted drives, incredible amounts of personal data such as family photos can be lost forever. This can be absolutely devastating to a surviving spouse.

One other option with full-disk encrypted systems is available, if—and this is a big if—they have not been powered down or rebooted since last logged in with a valid password. There is a chance that the system could be accessed more easily over the network, if you can get it online. It is possible that a known vulnerability or more easily accessed system component could be used to access data on the system, rather than trying to beat your way through the full-disk encryption.

After a system is rebooted, it can often be configured to ask for a full-disk encryption password or login password before the operating system even starts. Without it, the system would never reach a state at which it could be communicated with over the network.

Most of these concepts also apply to Microsoft operating systems. Depending on configuration and the technology in use, the same challenges and similar solutions apply. In general, Microsoft is less tied to a centralized account than Apple systems are, and typically are approached on a system-by-system basis. If full-disk encryption is in use, it can be configured a number of ways, some of which make life more difficult in this situation. If the system asks for a valid username and password before the operating system has started—often called a preboot authentication—you have very limited options for accessing this system, aside from knowing the username and password.

Another possible configuration is to utilize full-disk encryption, but allow the OS to fully start before requesting any username or password. This is a less secure but also less invasive methodology. This gives you some options to attach the booted system to the network and attempt to access it via the network, looking for exploitable services or weak configurations, in the case that the username and password is not known.

Recommendations:

  • Don’t disable the phone account of the deceased until you have exhausted all avenues of access to key accounts and systems. Many services now allow for enablement of a Short Messaging Service (SMS) password recovery system, and without the phone service, that SMS send will fail.

  • If possible, don’t restart or turn off a deceased’s machine if it is suspected of having full-disk encryption. It might be easier to access the system over a network connection.

  • Gather as much information as you can about the operating system, version number, and settings. Research possible exploits against this system to gain access if all else fails.

Section 2: Home IT

In the event that the surviving spouse has no idea how the home IT system was set up, it might be necessary to get an IT-savvy friend of the family to do some investigation and possibly rebuild the home IT network gear to reset the passwords and map out the configuration.

For most home IT setups, only the basics are needed:

  • Internet modem for service provider, such as cable, phone company, and so on.

  • Home router for connecting to the internet provider, often with integrated WiFi access point

If all else is unknown, almost all devices can be reset to factory defaults and will grant access so that they can be reconfigured and rebuilt. Internet modems are often managed by the Internet Service Provider (ISP). For instance, for those with Comcast internet provided via coaxial cable, the modem usually has very little configuration available, depending on the make and model. Contacting the ISP can be helpful here in making sure that no configuration needs to be done by the home owner.

Most home routers and WiFi access points have a factory default setting that you can trigger. The best way to figure this out is to obtain the make and model of the device, and do an internet search for how to reset to factory defaults. Often, this will come with a default password as well, which will allow initial configuration and access to the device. More often than not, most of the basics in the factory default are fine for general use, and you will only be required to set the WiFi network SSID and password.

Warning

When you reset to factory defaults, any currently connected home network devices will lose their connection and will need to be reconfigured after the router and WiFi are set up again.

This at least covers the basics so a surviving spouse can get online at home and use basic services. This might sound trivial, but in the aftermath of a sudden death, having the solid internet access one is accustomed to can be a huge help in researching, contacting, and working through all of the issues involved with a loved one’s passing.

Section 3: Smartphones

Today, we live the majority of our digital worlds on our smartphones. They can be the keys to the castle if handled properly. But, like many computer systems, they can be locked down and secured very tightly if the owner chooses to do so, including biometric authentication with fingerprints.

In addition, many services now offer a two-factor authentication system involving the transmission of a text message to a smartphone, particularly for cases in which a password reset is being requested. When working through other areas of a digital legacy, you might need to be able to receive these text messages in order to access accounts. Key to all of this is that you must keep the account active with the cell phone provider, and ideally be able to fully access the phone. Depending on configuration, some text messages will appear in full on the lock screen of the phone, but not everyone configures their phone this way, so having complete access is best. Often, the vendor will not help, but it never hurts to try. Reaching out to Apple, Samsung, or the cell phone carrier can often yield results in accessing the account.

Beyond access to text-based authentication messages, there are likely a large number of very useful apps loaded onto the phone that can yield a great deal of information and possible access into items of interest to a digital legacy. For instance, there might be a Twitter or Facebook app that’s configured to automatically log in. Beyond that, many other online accounts now have smartphone apps that can be accessed after the phone is unlocked.

Again, the key is to keep the phone line up and running until you are sure you no longer need to worry about accessing accounts of interest. It might also be possible to assign the phone number to another phone that you do have access to, in order to receive texts and messages on a new device. After the cell phone account is cancelled, it is next to impossible to regain access to the number that was assigned to the deceased.

When attempting to access a phone that utilizes a passcode for authentication, be careful that there is not a limit set for authentication attempts. It is possible now to configure a phone to wipe itself or lock itself down after a certain number of incorrect password attempts. You should not begin randomly guessing passcodes if you suspect a phone uses this setting.

Another aspect of smartphone recovery might be photos and video. There will likely be many photos on the phone that are not available any other way. These photos might be unique and precious to surviving family members. We can recover these items in a number of ways, but the easiest is, of course, if someone has passcode/password access to the phone.

Section 4: Online Digital Services

As more of our digital legacies involve large online services, the concept of death of a member is no longer something that can be ignored by many of the key vendors in the space. Most of the major vendors have now developed a policy for handling the death of a member. This section details some of these policies, how to utilize them, and what you might expect.

Google Death Policy

Google, like Apple, has a well-developed policy with regard to death of an account holder. Much like Apple, Google first and foremost wants to protect the privacy of its users, and, in general, does not feel that the account of a deceased member is the property of a valid next-of-kin.

Quoting from Google’s policy page:

If an individual has passed away and you need access to the contents of his or her Google Account, in rare cases we may be able to provide the account content to an authorized representative of the deceased user. We extend our condolences and appreciate your patience and understanding throughout this process.

At Google, we’re keenly aware of the trust users place in us, and we take our responsibility to protect the privacy of people who use Google services very seriously. Any decision to provide the contents of a deceased user’s account will be made only after a careful review, and the application to obtain account content is a lengthy process. Before you begin, please understand that Google may be unable to provide the account content, and sending a request or filing the required documentation does not guarantee that we will be able to assist you.

On another area, it has a similar statement:

Users have a strong and reasonable expectation of privacy and security when using Google’s products. We believe that the trust placed in us by our users requires us to make sure that their information is safe, even in the event of their death.

We recognize, however, that many people pass away without leaving clear instructions about how to manage their online accounts. We can work with immediate family members and representatives to close online accounts in some cases once a user is known to be deceased, and in certain circumstances we may provide content from a deceased user’s account. In all of these cases, our primary responsibility is to keep our users’ information secure, safe, and private. Note that Google is not able to provide passwords or other mechanisms that would enable anyone to log in to a user’s account.

Google provides a number of options for a next-of-kin to pursue:

  • Close the account of a deceased user

  • Submit a request for funds from a deceased user’s account

  • Obtain data from a deceased user’s account

  • Resolve a potential hijacking of a deceased user’s account

  • Make plans for what should happen to my own account

As of this writing, if the objective is to “obtain data from a deceased user’s account,” Google now requires a court order issued by a court in the United States.

Facebook Death Policy

Of the major digital services I researched for this project, Facebook has one of the more robust policies for managing the death of its users. Though most users did not have any critical data on Facebook to which a surviving spouse would need access, if someone uses Facebook, it can become a very public aspect of our digital legacy, bringing both comfort and possibly renewed grief to friends and family members.

Access to a deceased member’s account is fairly straightforward: you can complete a simple on Facebook’s site, which requires a death certificate of the deceased member.

Facebook offers a few unique options for handling an account of a deceased member.

First, as with most services, the next-of-kin can request that the account simply be deleted and removed from the site. Second, it offers the option of changing the account to a special type called a memorialized account.

A memorialized account preserves the account online, but changes the functionality a bit. The idea behind these types of accounts is that it allows a place for friends and family of the deceased to gather. They can continue to view all of the posts and data previously posted by the deceased member, as well as posting their own memories and thoughts. The accounts are designated by the special heading “Remembering” next to the deceased member’s name on their profile, and the profiles do not appear in suggestions, ads, birthday reminders, or similar public places. Additionally, no one can actually login to a memorialized account.

Another option is for a member to designate a legacy contact for their account. A legacy contact is a trusted third party who will have the ability to manage the deceased member’s account after the death of that member. Based on the member’s preferences, the third party can simply delete the account or turn it in a memorialized account with some ability to manage it. The third party can manage the profile, approve new friends, write posts on the profile (perhaps to alert friends and followers of funeral plans), and update pictures. A legacy contact doesn’t have the same controls as a normal user, but it’s a great option to consider. So much of our life is lived online these days, and a lot of people use Facebook to document and share it. As part of our digital legacy, it’s quick and easy to set up someone to handle this account after our death.

Note

For more information about memorializing and deleting accounts, and establishing legacy contacts in Facebook, go to http://bit.ly/2qopUlG.

Twitter Death Policy

Twitter is very straightforward about its policy on handling a deceased member. Quoting from Twitter:

In the event of the death of a Twitter user, we can work with a person authorized to act on the behalf of the estate or with a verified immediate family member of the deceased to have an account deactivated.

To request the removal of a deceased user’s account, click here. After you submit your request, we will email you with instructions for providing more information, including information about the deceased, a copy of your ID, and copy of the deceased’s death certificate.

Please note: We are unable to provide account access to anyone regardless of his or her relationship to the deceased.

One other option Twitter offers is to remove pictures of the deceased member in certain circumstances, mainly relating to media involving the injury or death of the user.

Microsoft Death Policy

Rounding out our tour of the major online players, Microsoft also has a policy for managing the accounts of deceased members. Microsoft won’t provide the password or transfer ownership of an account to a verified next-of-kin, but it does offer the option of sending all contents of an account via DVD to the next-of-kin. Interestingly, Microsoft also helpfully points out the following:

If you have the family member’s sign-in info (e.g., email address and password), and you can sign in to the account or accounts, there’s no need to go through the next-of-kin process. You already have access to all the info we would compile on the DVD.

Microsoft seems to have a softer stance on this issue than Apple or Google. It will be interesting to see if this changes as time goes on and this issue becomes more widespread.

As usual, Microsoft requires a number of items to complete these requests, including the death certificate and proof of valid next-of-kin status by the requestor.

Final Thoughts

I know that this is not an easy topic to think about. I can tell you with certainty that it’s not an easy topic to write about, either. But I do hope it brings some small amount of comfort to those dealing with the sudden loss of someone close. We all think this can’t happen to us; we all think this is something that happens to someone else. But, sadly, the statistics don’t support that.

The ideas presented herein can assist in easing some of the pain and stress we encounter during a time that is usually one if the worst in anyone’s life. To prepare your loved ones, and know they are equipped with the knowledge and skills to continue on, to manage your digital legacy, will hopefully bring a small sense of peace and confidence to your life.

Thank you for reading this.

I invite feedback, questions and suggestions. Please contact me at [email protected] or on Twitter @Lerg.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.142.172.166