How to prepare and protect your digital legacy | WeLiveSecurity

Forgive me for writing about what may seem, at first glance, like a sensitive topic while many parts of the world continue to struggle with the COVID-19 pandemic.

I, like many people, use the internet as a daily part of life and in ways that cause my online and offline worlds to be entwined. Recent events have provoked me into thinking about creating guidance while preparing my own digital world so that, if something unexpected happens to me, those that I leave behind will be less stressed when dealing with my digital legacy.

The important elements of a digital footprint may include, but are not limited to, financial accounts, family photographs, music collections and playlists through to social media and email accounts. Some service providers may have a broad range of services: for example, Google could be providing email, photos and cloud storage, while Spotify may be storing your favorite playlists. Accessing the data or managing the online accounts could be important both short-term: to inform people about a situation, and long-term: to ensure no important data needed by those you leave behind is lost. If, as in my situation, you store important documents and family photographs in the cloud, when you pass others may need to access, and possibly to manage, this storage so matters can be dealt with and memories captured in photos are preserved.

I have never been an avid user of social media apps other than LinkedIn and Twitter, and then really only for business purposes, so my footprint may be much lighter than the typical user. However, I do have a relatively unused account on Facebook and Instagram so there are considerations to ensure they are taken care of in the right way. One of the key considerations is whether you want your social media profiles to be memorialized or deleted, or to leave this decision to others after your passing. The suggested actions below may not cover all services or accounts, but it should constitute a good starting point for making the preparations needed to ensure your data lives on, that loved ones can gain the access needed or your right to be forgotten is observed.

Getting your digital affairs in order

Appoint a digital executor. It’s common practice to appoint an executor in a will, someone trusted who takes care of property, finances and assets and distributes them according to your wishes. Today’s world means you may also need a digital executor to take charge of and handle digital assets – deleting, converting, downloading and managing accounts and profiles. In the same way that you list important financial assets, you may wish to list digital assets and what your specific instructions are for each one, so that there is no confusion or disagreement among the people you leave behind. Currently, not all states or countries recognize the legal status of a digital executor, but it does demonstrate the precise wishes of the deceased and would hopefully be respected by companies where permitted by law.

Entrusting a person with the information needed to access a service or data may be imperative in some instances. For example: if you hold any cryptocurrency in a digital wallet, it would be challenging, or impossible, for the executor or a beneficiary of  your estate to access this without knowing the personal private key. It’s estimated by Coin Metrics that at least 1.5 million bitcoins are assumed lost for a variety of reasons, including death, which equates to over US$16 billion dollars in just one cryptocurrency. It’s not recommended to store the details of the private key in a will, since this may become a public document after death. Whether you share the passwords and PIN with a loved one, write them down and keep them in a safe, or distribute different parts of the key to a group of friends: it is clear that you need to take advance preparations so that any assets held in cryptocurrency can be passed on.

Another option is to use a password manager to create a single repository where account credentials are stored. This option has the benefit of enabling extremely complex (and hence secure) passwords to be generated, since the need to remember them all is removed; all you need to remember is one single, very strong, password to unlock the password manager. It’s also a protection against keyloggers, as they cannot monitor something that is not being typed in. Some password managers include a variety of options including creating a family plan, a file vault providing each user a secure place to store important documents and information and a variety of options for password recovery should it be needed.

There is commonality among most service providers on the documentation they require to be submitted when notifying them that someone has passed; for the requester these include, power of attorney, birth certificate, the will or an estate letter. Official documents validating the death, such as a death certificate or link to an obituary, will also need to be submitted. Below are some examples of information required and options offered by some of the most popular services and a few helpful links.

• Facebook allows you to appoint a legacy contact; this gives the nominated person the ability to memorialize the account and post a final message. The legacy contact can also delete any unwanted tribute posts, remove tags, respond to friend requests, request account deletion and such like. Be cautious, though, for they can also see all posts you made even if marked as ‘Only Me’ in the privacy settings. The instructions to assign a legacy contact on Facebook can be found here. The other option is to request deletion of the account – note, though that once deleted, access can never be regained; the details to make a deletion request can be found here.
• Curiously, Instagram, which is owned by Facebook, does not allow you to appoint a legacy contact. The account can be memorialized or deleted with separate online forms needing to be completed and they include the need to provide proof of death, such as a death certificate. If the request is to delete the account, it needs to be made by an immediate family member who will need to provide proof of their relationship and their authority. While the guidance does not state that a digital executor can submit this instruction, I hope they would be afforded this privilege; it may depend on local legislation recognizing this status.
• Google takes a different approach and uses an Inactive Account Manager; the default is set to three months with notification to the account holder one month prior by SMS to a preregistered phone number and an email. The inactivity waiting period can be set to 3, 6, 12 or 18 months, this also extends the notification period to up to three months prior. The next step is to select whom to notify if you have failed to respond once the inactivity period has been reached and to decide what data and services to give them access to; the list is long. The designated person will be notified by email and their identity will be validated using multifactor authentication through a predefined phone number. They will then have the ability to download a copy of the data selected. The last step is to decide if accounts should be deleted, including public content such as YouTube videos. Inactive Account Manager provides many options and is the most comprehensive I have witnessed while writing this blogpost.
• LinkedIn provides the ability to remove an account by reporting it and providing documented evidence similar to that of Instagram. Amusingly, one piece of information required is the most recent employer, which would probably be listed on the deceased’s public LinkedIn profile.
• Twitter provides this account deactivation form.
• Snapchat only offers account deletion via this form.

This is a delicate topic, especially during a pandemic, and I hope it prompts you to consider taking some action to make a plan, appoint a digital executor, preselect legacy and inactivity contacts or discuss with the family lawyer. While it may be an awkward topic, a discussion directly with family members, close friends or colleagues may prove to be the most effective course of action. The important thing is to do something rather than to do nothing.