scrapbook

Whose Data Is It, Anyway?

WHEN Tomm Purnell's uncle, Keith Cochran, died last year, Mr. Purnell's mother received two of Mr. Cochran's computers. One of them, a laptop, is password-protected, and even though Mr. Purnell considers himself somewhat of a computer geek, "the really obvious passwords," he said, like the names of Mr. Cochran's cats and combinations of his Social Security number, have failed.

"I guess he assumed that whoever came in would figure it out," said Mr. Purnell, a physics student at Colorado State University. "I have no clue what's on there, but I'd like to find out."

While terminally ill, Mr. Cochran, a programmer, left a full list of passwords for his work files with his employer, Mr. Purnell said. But he failed to do the same thing with the personal files, so they are now inaccessible.

With home computers largely replacing filing cabinets as the secure storage place for financial records, tax returns and even sentimental pictures, the problem confronting Mr. Purnell may become more common. Since most people do not leave a list of passwords before they die, their relatives and lawyers must often figure out how to break into the computer themselves or hire someone to do it.

Mr. Purnell said he intended to keep trying to unlock his uncle's laptop. But for some survivors, the effort of gaining access to a loved one's data is not worth the time. In many cases, they simply erase the hard drive and get rid of the computer without ever knowing what was on it.

"We're probably wiping away a lot of memories," said George Ehrlich, manager of Machaven, a computer-repair service near Washington, who is asked every few months to erase a hard drive of someone who has died. "Most people want to give the computer away without worrying about someone else getting access to personal information. When they bring it in, they don't know what's on it and they don't seem to care."

Sometimes, too, relatives realize that there may be things left on the hard drive - embarrassing e-mail messages in particular - that they would rather not see.

Gaining access to a person's data if the person is no longer living raises legal issues as well. Small mom-and-pop computer services may break into a machine without asking for any proof of death. But large companies like America Online require at least a death certificate before sharing e-mail messages or data stored on their servers with survivors.

Once survivors gain access to the data, questions may also arise about who actually owns it. If a person saved a book manuscript on a hard drive and left the machine to a friend, for instance, the friend might try to claim ownership of the manuscript as well.

While no case law exists in this area, several lawyers who are experts on estate planning and probate matters generally agreed that anything stored on a computer is considered "intangible" property, meaning that like a stock certificate or a rare baseball card, it is probably worth more than the piece of tangible property it occupies, in this case, disk space on a computer. As a result, they say, the manuscript would not automatically become the property of the friend who received the computer. The manuscript itself would have had to have been bequeathed to the friend.

To avoid such a predicament, executors should go though the computer files of the deceased, print out important documents and then delete everything else, said Dennis I. Belcher, a lawyer with McGuireWoods, a firm in Richmond, Va. "In the end, the executor needs to make sure the computer is completely clean before giving it up."

One worry for Mr. Belcher is the growing trend of keeping work-related documents on home computers. If those files remained on a machine that was given away after the owner died and ended up in the wrong hands, the executor of the estate could be held responsible. "Even if the executor disseminated that proprietary information unknowingly, they could still be held liable," Mr. Belcher said.

For Mr. Belcher and other lawyers, the issue of what happens to data on a computer when its owner dies remains largely uncharted territory. After all, they say, many people who die now are not routine computer users. But as the baby-boom generation ages, "lawyers will probably deal with these questions all the time," said Edward F. Koren, a lawyer at Holland & Knight in Tampa, Fla., and an expert on estate planning and probate matters.

Advertisement

"The entire lives of some people are on their computers," he said, "and they forget all about that when planning for death."

Mr. Purnell said that some of his uncle's files are gone forever. Mr. Cochran stored digital photos on two computers that used the Linux operating system. The machines were given to his brothers, "who are Windows guys, so they erased and reformatted them," Mr. Purnell said.

"Work is important," he added. "But people shouldn't forget that some of us left behind would like to be able to get those nice photos of you or save your Web site from being lost. The moral of the story is make sure you give your passwords to someone you trust. I already gave mine to my wife."

While personal information like digital photos and e-mail messages is often what survivors want to keep, access to financial information can be critically important so that bills can be paid after someone dies. These days, much of that information is kept on a computer through electronic-bill paying, online banking and the use of personal-finance programs like Quicken or Microsoft Money.

Bob Weiss, owner and president of Password Crackers, a Maryland-based company that mostly cracks passwords for computer users who have forgotten them or for companies where employees departed without leaving them, said he receives a handful of frantic calls every year from people seeking to break into computers and software of deceased people. Last month a business owner asked him to break into QuickBooks, a business-accounting program, after his accountant, who was also his fiancée, died suddenly.

"Not having a simple password causes a lot of needless stress at exactly the wrong time," Mr. Weiss said. "Here was a guy trying to make funeral arrangements and he couldn't keep his business running without that password."

Mr. Weiss charges $40 to crack open most files. Almost anything stored on a local hard drive is accessible to him, including Microsoft Office documents, but he cannot break into files when passwords are stored on an external server, like Yahoo or AOL e-mail.

A spokesman for AOL, Nicholas Graham, said the company had an employee dedicated to handling requests from survivors seeking to transfer an account or close it out. "Accessing e-mail is usually not on the top of the list of priorities when someone passes away, but time is of the essence," Mr. Graham said. Any AOL e-mail that has not been downloaded to a computer's hard drive is deleted from the company's server in 28 days. "There's no way of getting it back," he said.

Sometimes extraordinary measures are required to gain access to data after a death. When a man who maintained a database of 15,000 historical books at the Ivar Aasen Center of Language and Culture in Norway died suddenly a few years ago, other employees discovered that they could not gain access to the book list, which was on a computer disk. It seemed that the dead man had been the only person who knew the password to unlock the file. A team of computer technicians tried but failed to crack the password.

"I was frustrated and confused," the center's director, Ottar Grepstad, said in a telephone interview. "How could all this work be done with such bad security routines?"

So in a national radio broadcast, Mr. Grepstad appealed to hackers. Some 25,000 people worldwide responded, and one of them suggested the password in less than an hour: the deceased man's last name, only reversed. Employees now write their passwords on papers that are stored in the center's safe.

Cracking open the computer files of a deceased person is usually not that difficult, said Eric Thompson, founder of the AccessData Corporation, a computer forensics and cryptography software company based in Salt Lake City. Most people choose passwords related to their life. When AccessData performed an analysis of security at a Dallas company recently, for instance, it found that more than half of the employees had chosen as their password a variation of "cowboys" in homage to the city's professional football team.

One program developed by the company scans the hard drive and creates a word list of everything typed by the user. Through that list, the software can detect the most often typed words or combinations of letters and words to figure out passwords.

Of course, sometimes it might be best to let some secrets go to the grave with the deceased. Mr. Thompson said he once helped a man break into encrypted Microsoft Word documents belonging to his father that turned out to be love letters from an extramarital affair.

"When you break into computer files," Mr. Thompson said, "you're reconstructing a person's life, both the good and the bad."

Posted by thinkum at June 3, 2004 01:36 PM