A digital last-will-and-testament: who gets your accounts?

That humans are mortal is not news. What is novel, however, is that over the past two decades people have accumulated digital assets that never used to exist. And many of us have probably posed the question at some point: what will happen afterward to all my social media and messenger accounts, all my cloud archives of e-mails and photos, plus domains and websites, not to mention e-wallets and accounts on trading platforms?

Posthumous account

In 2012, the parents of a 15-year-old girl from Berlin tried to log into her Facebook account after their daughter jumped in front of a train. Her parents wanted to find out what had led to her suicide; they suspected cyberbullying. However, the account had already been memorialized and no one could access it.

Only after six years (!) of litigation, in 2018, did the German Supreme Court rule that, when it comes to inheritance, social media accounts are no different to personal letters and diaries; that is, they must be transferred to the legal heirs — in this case, the parents.

But why did the process take so long? Because the IT industry doesn’t agree with this characterization of digital assets. There are usually two counterarguments. First, Facebook and other services cite personal data protection laws: such data cannot be transferred to third parties without the owner’s permission. True, the owner is deceased in this case, but the people they exchanged messages with are still alive and haven’t given permission to read their correspondence.

Another reason to refuse potential heirs’ request is that many digital services provide their products under a license — as a service for temporary use. And the law doesn’t provide for the inheritance of such a “lease.” For example, in some countries domain names are registered on the basis of a service agreement, and services are not included in the will of the deceased.

Rules for digital cemeteries

When inheritance laws don’t cover a digital asset, hope lies with the company’s policy and the steps taken by the testator before their death. Some domain registrars make it possible to transfer a domain to the next of kin, provided the necessary documents are presented.

Other services are also slowly beginning to introduce a similar policy. The latest versions of iOS allow you to designate a legacy contact — a digital successor who will have access to your Apple ID in the event of your death. True, not all of your digital assets will be made available to your chosen heir. In particular, they won’t get access to your e-books, movies, music or other purchases made online (recall that a digital book isn’t a book, but a temporarily rented service!).

For Google accounts, this feature is called Inactive Account Manager. Your designated successor will have access to your data if the account is inactive for a long time (you set the period of inactivity yourself).

Facebook has something similar for memorializing accounts. You can inform the company in advance of your posthumous wishes regarding your account: either to have it deleted entirely, or to specify legacy contacts, who’ll manage your memorialized account; or rather — watch over it: they’ll not be able to change old content, read messages or delete friends, but only change your profile photo, post a memorial, and allow selected friends to write tributes in a special memorial feed. In addition, legacy contacts must have their own Facebook account (yes, the social network never misses an opportunity to boost its user base).

All the same, the rules differ from service to service, each with its own peculiarities. There are already tens of millions of social media accounts that belong to folks no longer with us. And by far not all of them have been memorialized. After all, as in the case of deleting an account, it’s necessary to provide the service with documents proving the owner’s death (Instagram, LinkedIn and other social networks operate similar rules). But in many cases accounts continue to be maintained by relatives, and sometimes by complete strangers, using the popularity of the deceased for their own purposes. And social networks themselves automatically invite us to congratulate the deceased on their birthdays or inadvertently confront us with painful memories. It’s possible that in the virtual metaverses of the future, hordes of the dead will roam the streets on autopilot, like in the worst kind of zombie apocalypse movie.

What to do — when still alive!

Let’s recap. There’s no one-size-fits-all solution, but we can all individually take care of what happens to our digital assets after we shuffle off this mortal coil.

• You might want to make a will with a lawyer, specifying your digital assets and the people who will inherit them. Even if the inheritance law in your country doesn’t cover such assets, having a will can help in disputes.
• Find out about the legacy policy of each digital service you use, and what needs to be done in the settings or contracts. For example, funds in e-wallets can pass to the rightful heirs without additional measures, as money is covered by inheritance law. But in the case of e-mail and various types of digital storage and social networks, it makes sense to set up a legacy contact in the service. To do this, you’ll have to read and follow the guidelines of each specific service.
• For their part, your heirs will have to figure out what the procedure is for gaining access in each of these services. If you’ve set up a legacy contact, they’ll have to present a certain document or electronic code to gain access, depending on the rules of the service in question.
• Many services (such as Twitter, Instagram and LinkedIn) don’t transfer access to deceased users’ accounts to anyone. They may, at the request of relatives, delete or memorialize an account — but even this requires the right documentation. And in certain cases you may need to prove your rights in court.

Kaspersky Global Research & Analysis Team (GReAT) experts Marco Preuss (Deputy Director) and Dan Demeter (Senior Security Researcher), in their “Digital Life and Physical Death” session at the RSA Conference 2023, raised a number of additional factors for us to consider while alive.

It’s necessary to decide in advance what kind of data you want to bequeath, in what format, and on what media it will be stored. Unfortunately, the lifespan of modern storage media is 5–30 years, so digital archives need to be periodically updated and transferred to more modern media. Don’t rely too much on cloud storage: how many of those have closed down in the last 10 years?

If your digital storage contains documents in proprietary formats, also take care of the software for opening them. Imagine you have valuable documents in, say, SuperCalc or other outdated formats. Either convert the documents to modern open formats, or attach copies of software that can open them. The same goes for any specialized hardware that may be needed to access your data.

Include a detailed description of everything you’ve collected, where it’s located, and how to use it. Besides a textual description, it’s worth adding audio or video recordings which, as well as giving instructions, clearly express your wishes regarding what’s to be done with your digital legacy.

Keep passwords, private keys, and other tools for accessing encrypted and private data in a safe, separate place. Important! Don’t include passwords or private keys in your will. Wills become a matter of public record in certain countries. The most reliable way to store them is in a dedicated digital vault, such as Kaspersky Password Manager, protected with a master password, and to transfer access to this storage to a trusted person along with posthumous instructions: for example, “Delete everything.”

The main thing here is to choose the right person. Remember the case of writer Vladimir Nabokov: he left instructions to destroy the manuscript of his last unfinished novel, but his wife didn’t comply, and his son published his father’s drafts in Playboy magazine.