1.0 Law & Legal CLE Credit – A/V Approval #1079241 Recording Date – December 6, 2017 Recording Availability – September 4, 2018

Meeting Location Date Time Topic

King County Bar Association 1200 Fifth Avenue - Suite 700

Seattle, WA

Wednesday, December 6, 2017

12:00 PM to 1:15 PM

Digital Assets: Estate Planning and

Administration

AGENDA 12:00 PM Introduction 12:10 PM Presentation: ‘Digital Assets: Estate Planning and Administration’, by Anton B.

Cauthorn, Reed Longyear Malnati & Ahrens, PLLC

Planning for digital assets.

Locating digital assets in a probate or as an attorney-in-fact.

Accessing digital assets in a probate or as an attorney-in-fact. 1:15 PM Adjourn

SPEAKER BIOGRAPHY Anton B. Cauthorn, Reed Longyear Malnati & Ahrens, PLLC - Anton Cauthorn is an estate planning attorney at Reed Longyear focusing his practice on estate planning, probate, tax law, and small business planning. Anton is also adjunct faculty at Seattle University and will be teaching Estate and Gift Taxation and is on the board for Northwest Family Business Advisors. Anton received his Juris Doctor degree from the University of San Diego School of Law and an LLM in tax law from the University of Washington. Prior to joining Reed Longyear, Anton founded a solo estate planning law firm in Santa Monica, California and worked at Rehberg Law Group, a boutique estate planning law firm in Seattle. When not practicing law, Anton is an active outdoors enthusiast spending his weekends hiking and climbing in the Cascades. He is also a member of the Cystic Fibrosis Foundation and volunteers for the Foundation’s annual Breath of Life Gala.

HOW DO I EARN CREDIT FOR SELF-STUDY

OR AUDIO/VISUAL (A/V) COURSES?

For pre-recorded A/V (self-study) programs, although the sponsor should apply for

accreditation, lawyers need to report the credits earned for taking the course.

To add an approved course to your roster, follow the procedures below:

Go to the "mywsba" website at www.mywsba.org/.

Log in.

Click on the "Access MCLE" link in the "MCLE Info" box on your home profile

page.

Click on "Add Activity." Search to find the approved course in our system. (See

search suggestions on the screen.)

Adding a Recorded Course Select Recorded Course from the Add New Activity screen.

This will prompt you to search for the activity in case the activity has already been

accredited in the MCLE system.

You can search by Activity ID or by specific Activity Details. For the Activity Details

search, you can use keywords for the title, sponsor name and date.

After entering your search criteria and selecting Search at the bottom of the screen, a list

of possible activities will be provided.

You can select the correct one by clicking the Activity ID. This will take you to the

specific activity. Entered the date(s) on which you began and ending viewing this

recorded activity.

Then claim the correct credits for which you attended this activity in the Credits Claimed

fields and click the Submit button at the bottom of the page.

You will receive a confirmation message at the top of your screen stating, “The activity

has been added to your roster.

1.

2.

3.

4.

Which Digital Assets do You

need to find?

&

How do you find them?

1. Does it have monetary value?

2. Does Anyone Want It?

3. Can it be transferred?

4. What is the return on investment?

5. Is the Fiduciary a POA or Personal Rep?

1. Personal Story Assets

2. Online Revenue

3. Purchased Assets: Mp3,

Videos, Books, Bitcoin

4. Intellectual Property

5. Online services with

recurrent billing

6. Online access to accounts

Description Assets that tell a personal story.

Emotional value for family.

No monetary value.

Examples Email

Social Media

Non-revenue Blogs

Pictures

Videos

Personal writings

Description

Assets that generate revenue.

Advertising Revenue.

Online Sales.

Examples

Blogs with advertising revenue

Youtube channels

Online product sales

Online businesses

https://www.youtube.com/watch?v=ckDVpihCPq8

Description Assets with actual or

potential monetary value.

Purchased digital assets.

Examples Digital Currency: Bitcoin

Domain Names

mp3s, videos, etc…

Video games

Description

Creative works of decedent.

Examples

Writing/Manuscripts

Recorded Music

Produced Videos

Description

Monthly billed online services.

Automatic billing.

Examples

Netflix

Amazon Prime

Match.com

Office 365

Description Online Accounts for real

world companies

Examples Online banking

Online utilities

Online medical information & billing

Online employee information

Look for Password List

(hard copy or digital)

Check Credit Card Bills

Review browser history

(caution)

Look for Stored

Passwords in Browser

1. Anti-Hacking Laws

2. Access to cell phone for multi-

factor authentication.

3. If you have the password.

4. If you don’t have the password

Computer Fraud and Abuse

Act.

“Authorization” required to

access online accounts.

Whose authorization?

› User?

› Service Provider?

› Both?

Locate cell phone

and password.

Some websites will

require

authentication

through a cell

phone.

Are you “hacking”

under Federal Law?

Often Unclear.

Encourage PRs to be

cautious.

UFADA: RCW 11.120

Does not guarantee the ability to log on.

Decedent mustspecifically allow access in a will.

Allows you to obtain a copy.

Still bound by user license agreements.

Computer Fraud and Abuse

Act. 18 U.S.C. 1030

“Whoever intentionally accesses a computer

without authorization . . . and thereby obtains

information from any protected computer [any

computer connected to the internet]. . . shall be

punished as provided in subsection (c) of this

section.”

Protected Computer: Any computer or electronic device connected to the internet.

Authorization: unclear whose authorization is required.

› User?

› Service provider?

› Both?

US V. Nosal, 844 F.3d 1024 (9th 2016) (amended)

“‘without authorization’ is an unambiguous term

that should be given its ordinary meaning.”

Employer “unequivocally” told Nosal that he was

barred from access.

“bears little resemblance to asking a spouse to log

in to an email account to print a boarding pass.”

“The majority does not provide, nor do I see, a

workable line which separates the consensual

password sharing in this case from the

consensual password sharing of millions of

legitimate account holders, which may also be

contrary to the policies of system owners. There

simply is no limiting principle in the majority's

world of lawful and unlawful password sharing.”

Facebook, Inc. v. Power Ventures, Inc., 844

F.3d 1058 (9th 2016)

The initial use did not violate the CFAA.

After facebook sent a cease and desist the

CFAA was violated.

Does access violate

the CFAA even with

permission?

Trustees?

POAs?

Personal

Representatives?

Brady goes to an internet café while on vacation.

Mike pays for two hours access.

License forbids him from sharing password and prohibits anyone else from using their computers.

Entire Brady Bunch uses the computers.

Question: Who has committed a federal crime?

Carol Read the license agreement. Uses computer anyway.

Greg Didn’t read the license agreement, but knows most

license agreements forbid password sharing. Uses

computer anyway.

Marcia Didn’t read license agreement; doesn’t know or care

what it says. Uses computer.

Peter Didn’t read license agreement, overheard someone say

café forbids password sharing. Uses computer anyway.

Jan Uses her own password, gets kicked out of the café for

spilling a drink, and owner forbids her from using the

computers. Reenters and uses her father’s password.

Bobby Owner sees him on the computer and tells him he

cannot use someone else’s password. He stays on.

Cindy Cindy previously paid for computer use and agreed to

license. License expires and Cindy uses Mike’s password.

How to Properly Plan for

Digital Assets

Keep up to date

inventory of

accounts &

passwords.

Store securely.

Notify POAs.

Add provisions in

POA and Will

granting authority

to access digital

assets.

Grant authority

under UFADA.

Backup critical

data locally

often.

Backup all apple

services.

DIGITAL ASSETS

Page 1 of 18

Planning for Digital Assets Version: 4/5/2017

1. INTRODUCTION. ........................................................................................................................................... 1 2. PROVIDING GENERAL ADVICE RELATED TO DIGITAL ASSETS. ........................................................................ 2 3. LOCATING AND INVENTORYING DIGITAL ASSETS. ......................................................................................... 3

GENERAL ADVISING RELATING TO INVENTORYING DIGITAL ASSETS. ........................................................................... 3 HOW TO LOCATE DIGITAL ASSETS. ...................................................................................................................... 4

Cell Phone and Phone Number. ............................................................................................................. 5 Assets with Personal Value. ................................................................................................................... 6 Monetary Value. .................................................................................................................................... 7 Administrative Value. ............................................................................................................................. 8 Monthly Billing. ...................................................................................................................................... 8

4. CONCERNS WHEN ACCESSING DIGITAL ASSETS. ............................................................................................ 9

TERMS OF SERVICE AGREEMENTS. ...................................................................................................................... 9 Apple ...................................................................................................................................................... 9 Google .................................................................................................................................................. 10 Facebook .............................................................................................................................................. 11

FEDERAL ANTI-HACKING LAWS. ....................................................................................................................... 11 Estate Plan Silent as to Authorization. ................................................................................................. 13 Estate Plan Authorizes Personal Representative. ................................................................................ 13

5. HOW TO ACCESS DIGITAL ASSETS. .............................................................................................................. 15

UNIFORM FIDUCIARY ACCESS TO DIGITAL ASSETS ACT—11.120. .......................................................................... 16 FIDUCIARIES DIRECTLY LOGGING ON TO ELECTRONIC SERVICE PROVIDERS. ................................................................ 18

6. CONCLUSION. ............................................................................................................................................. 18

1. Introduction. Digital assets are a unique class of assets that require special consideration in probate.

Although digital assets may in some ways appear to be analogous to traditional assets such as

tangible personal property, real estate, and financial accounts, there is one substantial

difference—electronic access. Digital assets can only be accessed through a computer, tablet,

phone, or other electronic device. Additionally, many digital assets are stored remotely on

servers owned by electronic service providers further limiting access. This limited access gives

rise to a number of planning concerns such as the ability of a personal representative to locate

DIGITAL ASSETS

Page 2 of 18

assets, locate passwords, access assets, and avoid criminal liability under federal anti-hacking

laws.

Probate is the process of administering an estate after death—paying bills, settling

disputes, and distributing the remainder of the estate. Probating digital assets adds a twist to

traditional probates, requiring special consideration of the decedent’s unique collection of digital

assets. The unique nature of digital assets can make access difficult if not impossible and subject

the Personal Representative to threat of federal criminal liability. Thus, when working with a

Personal Representative, it is important to determine the extent and nature of the decedent’s

digital estate to determine which digital assets should be found and preserved and how best to

achieve those goals. This should involve a cost-benefit analysis—the potential benefit to the

estate versus the time and effort required to locate and access asset.

2. Providing General Advice Related to Digital Assets. Often there is a minimal return on investment for advising Personal Representatives

about specific websites and specific assets until a clearer picture of the decedent’s digital estate

is achieved. Charging your hourly rate to help a Personal Representative access the decedent’s

iTunes account will likely be unreasonable in most cases. Under RCW 11.48.210 a court can

deny payment of an unreasonable attorney’s fee from an estate so it is important to use carefully

consider how much assistance should be provided with respect to digital assets.

Your initial meeting with the Personal Representative should encourage him or her to

create a comprehensive inventory of digital assets and their potential value to the estate and

beneficiaries. It is not worth your time to learn about and discuss every website, how each

website works, and the terms-of-service for each website. The more valuable service you can

DIGITAL ASSETS

Page 3 of 18

provide to a Personal Representative is a general overview of how to locate and access digital

assets while avoiding or reducing potential federal criminal liability.

To competently provide advice relating to digital assets you should be generally aware of

these three things: 1. The terms of service for some of the more common websites (e.g. apple,

google, and Facebook); 2. Washington’s fiduciary access to digital assets act (RCW 11.120); and

3. Federal anti-hacking laws (the Computer Fraud and Abuse Act [CFAA] 18 U.S.C. § 1030).

With this information, you can provide the Personal Representative a general overview of

potential issues and, once the Personal Representative has created an inventory of digital assets,

you can provide hands on assistance where the value of the asset warrants your involvement.

3. Locating and Inventorying Digital Assets. General Advising Relating to Inventorying Digital Assets.

The Personal Representative should begin by determining whether it is a valuable use of

time to locate and access the digital estate. Do the beneficiaries or family want copies of the

decedent’s digital photos? Does anyone want to obtain copies of the mp3s? Does the family care

about the decedent’s travel blog? Will the Personal Representative be able find the password

necessary to access the bitcoin? Digital hoarding is just as real as hoarding in the home and the

proper solution in many cases may be simply to throw it all in the trash can. Before investing any

significant time into digital estate management, the Personal Representative needs to carefully

consider: is it worth it?

However, a Personal Representative will likely have no idea of whether it is worth it until

he or she does some research. Your job as the attorney should be to advise the Personal

Representative to have a conversation with the beneficiaries and family about the basic

categories of assets to determine which digital assets are worth locating and accessing. The goal

DIGITAL ASSETS

Page 4 of 18

is to determine whether the decedent had any specific digital assets which require focused

consideration and planning.

Advising Personal Representatives with respect to digital assets is a balancing process. If

a decedent has a minimal digital estate, a long discussion may either increase costs to the estate

with little return on value, or if you bill flat fee, may cause you to spend significant time assisting

a Personal Representative on an unimportant issue. Even if a decedent has a large digital estate, a

Personal Representative may be unwilling to pay you a high fee to learn what they could

discover on a quick google search.

Thus, it is important to be able to quickly and efficiently discuss issues relating to digital

estates to identify potential areas that the Personal Representative should focus on. The following

categories should be considered when discussing digital assets with your clients:

How to Locate Digital Assets. Locating Digital assets can be a complicated and time-consuming process. In the simplest

cases, a decedent will have a comprehensive list of digital assets and up to date log on

information. However, this is rarely the case as our digital lives change on a daily basis as new

accounts are created and passwords changed. Digital estates pose a unique difficulty for Personal

Representatives. With non-digital assets, it can usually be safely assumed that assets with value

will eventually be discovered through the mail. However, online billings and statements can ma

The Personal Representative will likely need to play detective to determine the nature and

extent of the digital estate. The process that needs to be taken will be unique to every decedent.

However, some general steps can make locating digital assets simpler:

Step 1: Search the decedent’s files for lists of passwords and account information.

DIGITAL ASSETS

Page 5 of 18

Step 2: Search the decedent’s computer for passwords and account information.

Specifically look for any password management services or files containing lists

of passwords.

Step 3: Review the decedent’s browsing history and passwords stored in the browser.

Step 4: Gain access to the decedent’s email accounts through use of the password or by

requesting a copy of the email accounts through RUFADA. If RUFADA is used,

the Personal Representative may need to make a new request each month to

obtain all emails that arrive each month.

Step 5: Review emails monthly for any statements or notices.

Step 6: Watch credit card bills monthly for online billings.

When advising a Personal Representative to search for digital assets it is crucial to

mention the issue of sensitive and private data which may be located on a computer or in the

cloud. Digital lives are private and the Personal Representative may discover personal

information about the decedent which could be alarming to the Personal Representative. Thus, a

Personal Representative should use caution when searching for digital assets to maintain the

privacy of the decedent.

Locating digital assets can be a complex process. It is important to remember that it may

be impracticable or impossible to locate all digital assets. Your job should be to give the Personal

Representative sufficient guidance to find the assets that are valuable to the estate, family, or

beneficiaries. Some specific categories of digital assets are discussed below:

Cell Phone and Phone Number.

Cell phones are a ubiquitous part of modern life and the number of clients who do not

have a cell phone has dwindled to nearly zero. Although it may seem trivial to be able to log on

DIGITAL ASSETS

Page 6 of 18

to the personal cell phone of a decedent, it can be extremely important for a Personal

Representative to have access to a cell phone. Two-factor authentication is becoming more and

more common. Two factor authentication is when a website requires a password and a second

security option to log on to a website. A common form of two-factor authentication is where a

code is sent to the user’s cell phone via text message that must then be entered to complete the

log on process. Thus, in many cases, having a password to log on to an account may be

insufficient and it could be necessary to have access to the cell phone of a user. For this reason, it

is important that Personal Representatives have access to a cell phone. This problem can be

exacerbated by cell phone security measures such as devices which completely erase all data

after too many failed log on attempts.

Thus, when advising Personal Representatives, it is important to ensure they do not

cancel a cell phone number before obtaining access to all digital accounts and that they do not

accidentally erase a device by failing to enter the password correctly. If a Personal

Representative terminates cell phone service and a website requires two-factor authentication via

text message, it may become difficult or impossible to log on to that account.

Assets with Personal Value.

Some assets may not have monetary value but may have personal value to the Decedent’s

family and beneficiaries. Prior to the digital age, family members would often pass down

memorabilia including photo albums, war-time love letters, or diaries to children or

grandchildren. As tangible objects these items would be found when cleaning out a home and

could be saved. However, when photo albums, love letters, and diaries are stored digitally, they

can be lost forever if Personal Representatives are unaware of their existence or lack access.

Assets that may have personal value to your clients or their families include:

DIGITAL ASSETS

Page 7 of 18

Personal Emails

Social Media Accounts

Non-revenue generating blogs

Family Pictures

Family Videos

Writings

Artwork

Music

Advising the Personal Representative to have a quick discussion with the family and

beneficiaries can help to identify any particularly relevant assets with personal value that should

be preserved for future generations.

Monetary Value.

Some digital assets have actual monetary value. Personal Representatives should be

advised to spend some time looking for these assets. Assets that may have monetary value

include:

Online Revenue Streams

o Blogs with advertising revenue

o Youtube accounts with advertising revenue

Purchased digital assets

o Mp3

o Videos

o Domain Name

o Video Games

Digital Currency

o Bitcoin

Self-created assets

o Writings – authors

o Music – musicians

o Artwork – artists

These are important assets to identify, locate, and inventory, though they may be difficult

to find. Self-created digital assets such as writings, music, or artwork can be a particularly

valuable type of digital asset that can be easily lost if the Personal Representative does not

thoroughly search local devices as well as the cloud.

DIGITAL ASSETS

Page 8 of 18

Administrative Value.

Some assets merely provide administrative value. These assets can facilitate the

administration of the estate of the decedent if the Personal Representative can gain access.

Examples of assets with administrative value include:

Emails accounts that receive electronic billings

Online banking

Online medical records

Online bill pay

Online utilities

Online employment information

Monthly Billing.

If the decedent had online subscriptions they may have automatic billings which are paid

directly from accounts. If a Personal Representative is not aware of these accounts, automatic

payments may be made which are unnecessary. A deceased client has no need for a Netflix

subscription, amazon prime subscription, or access to a dating website, but a Personal

Representative may not discover these automatic billings until they appear on a credit card

statement. Many online services provide discounted rates if a customer signs up for annual

automatic billing. In these cases, this can create a large unexpected charge to a decedent’s

account if the Personal Representative is not able to discover and terminate the service prior to

the next billing cycle. Examples of automatic billings to be aware of include:

Video subscriptions

o Netflix

o Amazon prime

Software subscriptions

o Microsoft office 365

o Adobe

Dating subscriptions

o Okcupid

o match.com

Automatic purchases

o Amazon recurring purchases

DIGITAL ASSETS

Page 9 of 18

o Amazon Fresh

4. Concerns When Accessing Digital Assets. Once the Personal Representative has created an inventory of the digital estate he or she

will need to find a way to access those assets. Before accessing digital assets, the Personal

Representative first needs to determine whether they are violating any terms of service

agreements for those online providers and, next, whether they are violating federal anti-hacking

laws.

Terms of Service Agreements. Nearly every website will have a terms of service agreement—a contractual agreement

that specifies a user’s rights. Unfortunately, terms of service agreements can differ greatly from

website to website. When advising a Personal Representative, your primary concern will be

whether a terms of service agreement limits access by the Personal Representative or prohibits

password sharing. Although it is not practical to know the terms of service of every website, a

good rule of thumb is that the majority of websites will forbid password sharing. Further

discussion of three of the most common online service providers are discussed below:

Apple

Apple’s terms of service agreement is likely one of the most problematic in probate. Not

only does Apple forbid password sharing but they also reserve the right to completely delete all

content in an account upon the death of the user:

Unless otherwise required by law, you agree that your Account is non-

transferable and that any rights to your Apple ID or Content within your

Account terminate upon your death. Upon receipt of a copy of a death certificate

your Account may be terminated and all Content within your Account deleted.

Contact iCloud Support at www.apple.com/support/icloud for further

assistance.

http://www.apple.com/legal/internet-services/icloud/en/terms.html

DIGITAL ASSETS

Page 10 of 18

The right to delete all content upon death can be a large concern for decedents who stored

a large portion of their personal data on apple’s cloud server icloud and apple devices. If an

estate has important data stored on icloud or apple devices (such as family photos, writings, or

artwork) you should encourage the Personal Representative to proceed with caution when

notifying apple of the death of the account holder.

Although the Washington’s version of the Uniform Fiduciary Access to Digital Assets act

(“UFADA”) grants a fiduciary the right to access the account of a deceased user, the UFADA

grants no more rights than a user had under a terms of service agreement. See Section 5.1. Thus,

it is arguable that Apple could delete all contents of an Apple user’s account following the user’s

death rather than granting a copy of the account to the personal representative after death without

violating the UFADA. Further, the fact that apple forbids password sharing creates risk that a

fiduciary logging on to an Apple account would be violating the Computer Fraud and Abuse Act.

See Section 4.2. Thus, it is critical to advise Personal Representatives of these risks, especially if

the decedent had important digital assets stored on apple devices.

Currently, there is no definite legal solution to this issue. When advising a Personal

Representative, you will need to discuss the possibility that an account may be completely

deleted by apple and assist your client in trying to prevent that outcome by persuading apple to

take a different approach.

Google

Google’s terms of service are far more liberal than Apple. Google does not explicitly

forbid password sharing, though it encourages users not to do it. Thus, absent a change in terms

of service, it is likely that a fiduciary could access a google account without violating the

DIGITAL ASSETS

Page 11 of 18

UFADA. Thus, clients who use google for cloud storage or email may be in a far better position

for fiduciary access than Apple users.

Facebook

Facebook has a restrictive use policy forbidding use by non-authorized users and

forbidding password sharing:

You will not share your password (or in the case of developers, your secret key),

let anyone else access your account, or do anything else that might jeopardize

the security of your account.

https://www.facebook.com/terms

The primary reasons that a fiduciary may want to access Facebook would be for personal

family history including family photos or Facebook messenger conversations. However, due to

Facebook’s restrictive terms of service agreement there appears to be a large risk that a fiduciary

would be considered to violate the CFAA by accessing Facebook.

Federal Anti-Hacking Laws. There is a risk that a Personal Representative who accesses accounts of the decedent

could be violating the Computer Fraud and Abuse Act (the “CFAA”). The CFAA is a federal

criminal law designed to prevent hacking but which contains overbroad and ambiguous wording.

18 U.S.C. § 1030. The concerning language is found 18 U.S.C. section 1030: “Whoever

intentionally accesses a computer without authorization . . . and thereby obtains information

from any protected computer [any computer connected to the internet]. . . shall be punished as

provided in subsection (c) of this section.” (emphasis added). The concerning part of this

wording is the ambiguity of the term authorization. The term authorization is inherently

ambiguous as it is completely silent as to whose authorization is required and what type of

authorization is sufficient.

DIGITAL ASSETS

Page 12 of 18

Applying a few hypotheticals to this statute quickly demonstrates how unclear the statute

is:

1. A child goes into work with his mother. Mother goes into a meeting and gives Son

her computer password and he logs on. However, the office has a specific policy that

forbids password sharing and forbids computer use by non-employees. Is Son a

criminal under the CFAA?

2. A husband shares his Facebook password with his wife. Facebook forbids password

sharing but Wife is unaware of this. Wife uses the password to log on to Husband’s

facebook to see if he is cheating on her. Is Wife a criminal under the CFAA?

3. The same example as above but this time, Wife knows that facebook prohibits

logging on to other people’s facebook accounts. Is Wife a criminal under the CFAA?

4. The same example as above, but facebook has discovered Wife is using husband’s

password. Facebook sends wife an email to stop using the password. Husband grants

wife permission to use the password after Facebook’s email. Wife continues using the

password. Is Wife a criminal under the CFAA?

The answer to the first three of these hypotheticals is maybe. The answer to third

hypothetical is currently yes, wife has violated the CFAA and could be prosecuted as a hacker

under the CFAA.

In the probate context, the CFAA creates a serious concern for Personal Representatives

wishing to access accounts of a principal. If an estate plan is silent to authorization it is unclear

whether a Personal Representative can access digital accounts. In fact, even if an estate plan

specifically authorizes the Personal Representative to access accounts, it is unclear whether the

Personal Representative can avoid criminal liability under the CFAA.

DIGITAL ASSETS

Page 13 of 18

Estate Plan Silent as to Authorization.

If the estate plan does not specifically grant the Personal Representative access to the

decedent’s online accounts it is entirely unclear how the CFAA applies. It is clear that the

Personal Representative has not been granted “authorization” by the user or by the service

provider. However, it would appear reasonable to assume that a Personal Representative, as a

fiduciary, effectively steps into the shoes of the decedent for all purposes and thus would be

authorized to use passwords to the same extent that the decedent could during life.

However, there is no law on point to support this conclusion. Thus, it is unclear whether

being a fiduciary would shield a Personal Representative from criminal liability under the

CFAA. The only advice you can provide to the Personal Representative is that the law is unclear

and that they may be violating criminal law by accessing digital assets.

Estate Plan Authorizes Personal Representative.

Even if an estate plan specifically authorizes the personal representative to access digital

accounts, there are concerns. Authorization from the decedent alone may not be sufficient to

avoid criminal liability under the CFAA.

The majority of electronic service providers forbid password sharing in their terms of

service agreements. This creates a legitimate concern as to whether a Personal Representative

who accesses the decedent’s digital assets with the permission of the decedent but in violation of

the terms of service has authorization under the CFAA. It is completely unclear how the CFAA

should be applied to a fiduciary. Potential interpretations include:

1. A fiduciary is effectively stepping into the shoes of the principal and thus an act of

the fiduciary is an act of the principal. So long as the principal was authorized, the

fiduciary would be authorized as well.

2. The principal’s authorization is sufficient to allow access even without the

authorization of the electronic service provider.

DIGITAL ASSETS

Page 14 of 18

3. Both the principal and electronic service provider’s affirmative authorization is

required.

4. The principal’s authorization is required and the fiduciary can act until authorization

has been affirmatively revoked by the electronic service provider.

Unfortunately, 9th Circuit case law has only confused the issue further. There are two cases

relevant to this issue: U.S. v. Nosal, 844 F.3d 1024 (9th Cir. 2016) and Facebook, Inc. v. Power

Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016). In Nosal, David Nosal, an ex-employee of a

company accessed company computers using the password of a former co-worker after having

his access to company computers formally and explicitly revoked. The court found that Nosal

had accessed computers “without authorization” within the meaning of the CFAA because his

access to the company computers had been affirmatively “revoked” by his employer. The

problem with this ruling is that it is unclear what constitutes a “revocation.” It is possible that a

fiduciary who is aware that an electronic service provider forbids password sharing has had his

or her authorization revoked under the CFAA. Although the court in dicta stated that the ruling

does not apply to family password sharing, the court’s reasoning appears to in fact criminalize

family password sharing.

The second case, Power Ventures, dealt with a social media company which helped users

gather data from multiple social media websites and display all the information on a single

website. To access data, Power Ventures obtained its users Facebook passwords and then pulled

each users data from the Facebook website. Facebook discovered Power Venture’s actions and

sent a cease and desist letter; however, Power Ventures continued to access Facebook via the

users’ passwords. In a subsequent civil lawsuit, the 9th circuit held that Power Ventures did not

have authorization under the CFAA. The court reasoned that Power Ventures originally had

proper authorization from the users, but upon notice that Facebook prohibited Power Ventures’

DIGITAL ASSETS

Page 15 of 18

access, authorization had been terminated. However, the court did not resolve what constituted

sufficient notice of revocation of access.

Thus, under the CFAA there is still a question as to whether terms of service limitations

forbidding password sharing would constitute a criminal violation under the CFAA. When

advising Personal Representatives, the best advice to give is that the law is unclear and access by

a Personal Representative, even with the authorization of the decedent, could potentially give

rise to criminal liability under the CFAA.

Although the risk to a Personal Representative acting in the best interest of an estate may

seem low, the risk, in some cases, may be higher than anticipated. The actions of Personal

Representatives are sometimes challenged by unhappy beneficiaries. Children who act as

caretakers and financial powers of attorney for their parents and later as a Personal

Representatives may find their actions challenged by unhappy siblings at the death of the

parents. The unhappy siblings remember how wealthy the parents were and, when they discover

the extent to which assets were consumed at the end of life, assume that the caretaker sibling

must have absconded with the parents’ money. If the caretaker sibling was accessing electronic

accounts under the power of attorney and then as Personal Representative, there is a risk that the

unhappy sibling could bring a civil suit or potentially report the action to federal prosecutors.

5. How to Access Digital Assets. Now that the Personal Representative has inventoried the digital estate, the next step is

determining how the Personal Representative will access those digital assets. The apparent

simplicity of accessing accounts of a deceased user by entering a user name and password

obscures many complex issues. First, the fiduciary must be aware that an account exists and have

the proper user name and password. Second, two-factor authentication may also require more

DIGITAL ASSETS

Page 16 of 18

information than a password and can frustrate a fiduciary trying to access accounts. Third, terms

of service may prohibit a Personal Representative from accessing a decedent’s account. And

finally, the Personal Representative may be violating the CFAA.

Assuming that the Personal Representative is aware of an account, there are two options

for accessing the account. First, the Personal Representative may use Washington’s Uniform

Fiduciary Access to Digital Assets Act (UFADA). The benefit of UFADA is that it provides a

clear structured path for a fiduciary to access digital assets even if the fiduciary lacks a password

to log on to the account. The drawback to UFADA is that the method of access is clunky and

may not be effective. Second, the Personal Representative may simply log on to the accounts.

The benefit to logging on to accounts is that it is usually simple and effective. The drawback, is

that it may violate the terms of service of the account and, worse, could expose the fiduciary to

federal criminal liability under the Computer Fraud and Abuse Act (CFAA).

Uniform Fiduciary Access to Digital Assets Act—11.120. Washington’s uniform fiduciary access to digital assets act provides some clarity as to the

rights of fiduciaries to access digital assets by outlining processes for fiduciaries to contact

electronic service providers and obtain account information. The act provides fiduciaries a bright

line set of rules for how they can access digital assets.

However, it is important to realize that access under the UFADA does not mandate that

service providers grant authority to log on to accounts, it merely requires service providers to

provide a copy of the files held on a remote server. Under the UFADA, a fiduciary will have

access to the assets only if the fiduciary has been explicitly granted access either in a power of

attorney or will. Thus, if the will does not grant the Personal Representative authority to access

digital assets, the UFADA does not apply. In addition, an important exception to be aware of is

DIGITAL ASSETS

Page 17 of 18

that if a user completes an online tool granting or restricting assets to digital assets, the online

tool will override previously drafted estate planning documents. 11.120.040.

To access digital assets a Personal Representative will be required to write to the

electronic service provider requesting the information, provide letters testamentary, a copy of the

will granting authority to access digital assets, and potentially provide a sworn statement made

under penalty of perjury that the fiduciary has the right to access the information. Once the

electronic service provider receives this information they have the option to either: grant full

access to the user’s account; grant partial access as necessary to carry out the Personal

Representative’s task; or provide a copy of any digital asset the user could have accessed if alive

and had capacity. 11.120.060(1). In addition, an electronic service provider can charge the

Personal Representative for the cost of providing the records. 11.120.060(2).

The access rules under the UFADA can make it burdensome for a Personal

Representative to access digital assets. This limited method of access can create headaches for

Personal Representative. For example, a Personal Representative may need to monitor an email

address to find electronic billings. However, the email provider may refuse to provide access and

merely provide a copy of the account. Without immediate access to accounts, the Personal

Representative will be required to make monthly or more frequent requests to the email provider

to obtain new emails as they arrive. If the email provider chooses to bill the fiduciary this can

quickly create large costs between the time spent by the Personal Representative and the email

provider.

Although the UFADA provides a bright line rule for accessing digital assets, in practice

UFADA may not provide fiduciaries with the ease of administration that they desire. An

DIGITAL ASSETS

Page 18 of 18

alternative to the UFADA for fiduciaries who have the requisite logon information is simply

accessing the accounts via log on credentials. However, there are risks, as discussed below.

Fiduciaries Directly Logging on to Electronic Service Providers. A fiduciary who has the requisite logon information for an account could theoretically

bypass the UFADA and simply use the logon information to access the principal’s accounts.

However, there are concerning risks involved with this option. Many electronic service providers

specifically prohibit password sharing and such prohibition could theoretically include sharing a

password with a fiduciary. However, the risk of any serious consequences to a user for sharing a

password or a fiduciary for using said password would appear to be minimal. The larger concern

is that the CFAA could be interpreted to criminalize password sharing when a website’s terms of

service forbid password sharing. See Section 4.2.

6. Conclusion. Probating Digital Assets can be a complex process. As the attorney, your role will be to

guide the Personal Representative in his or her inventory of the Digital Estate. In most cases,

your assistance will likely be unneeded but it is important to explain the difficulties around the

CFAA and options for accessing digital assets including using passwords and the UFADA.