The sudden death of Gerald Cotten, owner of Canada's biggest crypto-currency exchange, Quadriga, has left thousands of investors in a quandary. At the same time, Mr Cotten's death has left security experts and legal professionals searching for answers. The reason is that Quadriga is required to repay money to over 100,000 investors, which was kept in safe custody by Mr Cotten and only he knew the password to access the $145 million in bitcoin and other digital assets.
Mr Cotten's laptop and mobile phone are highly encrypted and, so far, investigators have had limited success in recovering bitcoins and some bit of information from these devices.
This case highlights two issues. One, about the level of encryption and security; and two, inheritance. In Mr Cotten's case, there is apparently no issue about succession as his wife has taken over the reins. However, her affidavit posted on the exchange, says the laptop that Mr Cotten used to run the currency exchange is encrypted. "I do not know the password or recovery key. Despite repeated and diligent searches, I have not been able to find them written down anywhere," she said.
So, unless investigators are able to open and the retrieve locked information, the $145 million are as good as money gone down the drain.
While I would still urge everyone to use robust passwords to secure own digital assets, especially the financial ones, one must also plan to pass on one's digital inheritance to successors. Writing a Will for your digital assets is one such way.
Popular social media and services platforms, like Google, Facebook and Twitter, do offer some help in retrieving accounts of their dead user. But the nominee may not have full rights to operate the inherited account/s.
For example, Facebook allows the user to choose a 'legacy contact'
to manage her account after her death. However, the nominee can only add a pinned post (like announcing the death or funeral arrangement) and change the profile and cover photo. The legacy contact cannot log into the account, read messages or add or remove friends.
Google also has an 'inactive account manager'
that allows a user to nominate or add a trusted contact who can have access to the data in the account after a certain period of inactivity. Once an account remains inactive for a certain amount of time, Google sends a notification to the trusted contact. If the user has chosen to share data with her trusted contact, the notification mail from Google will inform about the data that can be accessed by the nominee.
Twitter, however, allows only the legal successor to deactivate the user account and nothing else.
In July 2018, in a landmark order, the Federal Constitutional Court in Karlsruhe in southwest Germany had allowed a woman access to the Facebook account of her 15-year-old daughter, who was killed in an accident in an underground train in Berlin, in 2012.
For passing on digital inheritance, there are a few other options like using password vaults and digital inheritance services. The password vault service-providers store multiple passwords that can be sent to the designated person after the death of the user. A few of them send periodic emails to the user to check if the user is alive. If there is no response to multiple mails (depends on the service-provider’s criteria), the passwords are shared with the designated person(s). The service-provider can ask for an authentic death certificate and verify the death claim with two persons.
Some service–providers, like DigiPulse, offer to pass on social accounts and digital crypto-currencies to the legal heirs or person(s) designated by the user. Mylennium from Eclectic Electric also offers digital estate planning and executor services. All the services mentioned above are paid services.
However, there are no explicit legal provisions in most countries, including India, on digital inheritance. The reason for this is the absence of a clear definition in laws to include digital estate which may also include outstanding debts and intellectual property rights.
In legal parlance, there is a clear distinction between ownership and the right to use (for software, and music, film, books stored digitally). In such a scenario, only the original digital data of the user that may be stored on a medium offered by the service-provider can be called the digital estate of the user.
In fact, laws for digital assets in the US make it a criminal offence for a spouse or family member to access email, social media or other online accounts of the user.
In addition, terms of service agreements of several service-providers bar the user from sharing or providing access to contents of the user’s account.
This means that, unless you have planned and shared the details of your entire digital assets with your heirs through a clearly defined Will, they may remain locked forever. But, even with the Will, the heir or nominee may not be able to take control of your account and some of it may remain locked forever. We hope governments will take a note of this and come out with legal provision for smooth bequeathing of digital assets or estate to legal heirs or person(s) designated by the user.