Apple asked widow for court order when she sought late husband’s password

Woman supplied Apple will and death certificate, but it wasn't enough.

Read the whole story

 

[Belisarius]

This is one of those damned-if-you-do, damned-if-you-don't sort of things: if Apple doesn't give over the account, you get a "grieving widow can't get mean old Apple to give her the info" story; if Apple does, as a policy, do this, then inevitably it'll be a vector for someone to social-engineer their way into compromising Apple IDs, then they'll get those stories.

Though it seems arduous, Apple is probably better off being stringent in their requirements than not.

 

[c600g]

Belisarius[/url]":3tpjaysi]Though it seems arduous, Apple is probably better off being stringent in their requirements than not.

Is acquiring a notarized death certificate that easy? Honest question.

 

[solarium_rider]

For those who choose to use Lastpass, they have now added a feature called Emergency Access to allow someone you designate to gain access to your account in the case of an emergency/death It would be useful in situations like this. It's kinda scary that your virtual assets (accounts) are not held to same standards as your physical assets when it comes to the estate.

 

[ajmas]

While this in this situation this is Apple, I am sure a number of online services would leave you in limbo, without correct paper work. The problem is I suspect a good number of companies have no process for this? Google has at least added an emergency contact option for their accounts, so someone you trust can access your account, in case of an emergency.

The advice of a safe place to store a password is probably the best, since it protects you from being in limbo. Sure it means writing things down somewhere, but from my experience people are managing so many passwords, for different services, so this is the only approach which works for them.

 

[DCStone]

PhillipG[/url]":626u8nvo]so if they are even capable of providing this at all what is the debate about forcing them to implement a backdoor? if they know/can provide a password isn't that basically a back door already in the system?

No, because access to an iTunes account is not the same as access to a specific device. You'd still need the device's pass code to unlock it before you could access the associated iTunes account through it.

In this case, since the husband and wife shared the iPad, they obviously both knew the pass code.

 

[renny]

solarium_rider[/url]":lzewnqoa]For those who choose to use Lastpass, they have now added a feature called Emergency Access to allow someone you designate to gain access to your account in the case of an emergency/death.

The allow may be crucial here. With Lastpass, the account holder has to make the conscious decision to say, "In case I'm dead, this person should have access to my account."

In the Apple case, the account holder may not have expressed such a wish.

 

[MikhailT]

PhillipG[/url]":3pf4l044]so if they are even capable of providing this at all what is the debate about forcing them to implement a backdoor? if they know/can provide a password isn't that basically a back door already in the system?

I think the family wants access to the content bought with the Apple ID, not the private data that's encrypted with the Apple ID password like photos, emails, etc.

That's one of the problems with digital content purchases right now. In most cases, you are getting a license to said content, not owning them outright. These cannot be transferred to the next of kin because it is not a purchase but a license that expires upon death.

This is something we need to clarify in the laws and allow folks to transfer the licenses to the next of kin upon deaths.

 

[daysd01]

I used to work at Apple for years. Yes, this has been policy for a long time. It has never been fun asking people for a court order. I've never actually seen someone provide one.

But I do understand Apple's perspectives. If they let just anyone get access then they open themselves up to social engineering attacks.

Personally there is no way I would ever want my family members to get access to my account after I died. There is some very personal stuff in there about my past that I would never want anyone to see.

 

[roe]

Jousle[/url]":35ynybzp]

Belisarius[/url]":35ynybzp]This is one of those damned-if-you-do, damned-if-you-don't sort of things: if Apple doesn't give over the account, you get a "grieving widow can't get mean old Apple to give her the info" story; if Apple does, as a policy, do this, then inevitably it'll be a vector for someone to social-engineer their way into compromising Apple IDs, then they'll get those stories.

Though it seems arduous, Apple is probably better off being stringent in their requirements than not.

Is the wife of the deceased who brings a death certificate a social engineer?

No, but the one who forged the death certificate (or copy thereof) is.

 

[mad_magician]

This is not an uncommon policy in the non-digital world either. It sucks, it is painful for the family, but there is an entire segment of law, Probate, that deals with just this issue.

I don't feel this is an issue of law needing to keep up with technology for once. It is an issue of folks remembering to actually properly plan their estate (to include digital goods, passwords and accounts.)

 

[wangstramedeous]

Apple is right to refuse to grant entry without further documentation. Just because her spouse is dead doesn’t mean he wanted her to access all of his personal data. Having said that, when an estate goes through probate, most probate courts issue some official document showing that the executor has authority over the estate. This official document is essentially a “court order,” which should be sufficient authority for most entities, like banks, etc., to grant access to the deceased person’s assets.

This lady would probably have had such a document issued, and I feel certain that Apple would have accepted this as her authority over her late husband’s account. That would have been the ideal way for the widow to resolve this. Apple isn't being tone deaf but actually protecting itself and its customers.

 

[RRob]

mad_magician[/url]":2yaosb2q]It is an issue of folks remembering to actually properly plan their estate (to include digital goods, passwords and accounts.)

Does giving someone the passwords to your accounts actually give them legal rights and control over your accounts? No. Just like I can't leave my house to my kid by leaving them a copy of the door key.

Was the wife an actual joint account holder, who was locked out of something she had legal rights to? It just needs to be spelled out.

 

[Coriolanus]

RRob[/url]":2px7ix8g]

mad_magician[/url]":2px7ix8g]It is an issue of folks remembering to actually properly plan their estate (to include digital goods, passwords and accounts.)

Does giving someone the passwords to your accounts actually give them legal rights and control over your accounts? No. Just like I can't leave my house to my kid by leaving them a copy of the door key.

Was the wife an actual joint account holder, who was locked out of something she had legal rights to? It just needs to be spelled out.

From a the CBC article:

Bush lost her husband David to lung cancer in August. The couple owned an iPad and an Apple computer. Bush knew the iPad's log-in code, but didn't know the Apple ID password.
Peggy and David Bush

"I just had the iPad. I didn't touch his computer, it was too confusing to me … I didn't realize he had a specific password I should have known about … it just never crossed my mind," Bush said.

http://www.cbc.ca/news/business/apple-w ... -1.3405652

 

[H2O Rip]

Interesting stuff, but to be honest I'm not sure I feel that Apple is in the wrong here. I'm assuming notarized death certificates aren't exactly impossible to social engineer or fake, and the court order is really more of a "these people had to show up somewhere in person". Plus the mention of non-transferable upon death in account terms. Of course this does raise the question of - how hard is it to get a court order for this kind of thing anyway?

A lot of other things (i.e. financial / housing / etc) generally require you to show up in person with the death certificate or power of attorney as far as I know. Tech services don't really have branches everywhere to allow for that. I suppose they could have that kind of service through the store, but that isn't really the purpose of the store either.

That must have been one important card game to them though to go through all that (the article doesn't mention anything else they needed to get access to )

 

[elomire678]

c600g[/url]":28ed0w9r]

Belisarius[/url]":28ed0w9r]Though it seems arduous, Apple is probably better off being stringent in their requirements than not.

Is acquiring a notarized death certificate that easy? Honest question.

If someone is dead, and you're related to them. Yes. It usually has the same requirements as getting a birth certificate.

 

[Batmanuel]

MikhailT[/url]":2bpcuse6]

PhillipG[/url]":2bpcuse6]so if they are even capable of providing this at all what is the debate about forcing them to implement a backdoor? if they know/can provide a password isn't that basically a back door already in the system?

I think the family wants access to the content bought with the Apple ID, not the private data that's encrypted with the Apple ID password like photos, emails, etc.

That's one of the problems with digital content purchases right now. In most cases, you are getting a license to said content, not owning them outright. These cannot be transferred to the next of kin because it is not a purchase but a license that expires upon death.

This is something we need to clarify in the laws and allow folks to transfer the licenses to the next of kin upon deaths.

Apple at least has Family Sharing so your whole family can have joint access to content that has been purchased. Not a perfect solution, but it is something in the short term until we figure out how I can bequeath my Comixology collection to my heirs.

 

[Terabitman]

I guess it might be good to leave your passwords in your will if you want anyone to have them.

Personally, my will is going to require all my devices be wiped clean. ;-)

 

[SixDegrees]

Belisarius[/url]":3klw1gjh]This is one of those damned-if-you-do, damned-if-you-don't sort of things: if Apple doesn't give over the account, you get a "grieving widow can't get mean old Apple to give her the info" story; if Apple does, as a policy, do this, then inevitably it'll be a vector for someone to social-engineer their way into compromising Apple IDs, then they'll get those stories.

Though it seems arduous, Apple is probably better off being stringent in their requirements than not.

I disagree. A death certificate is accepted as proof by pretty much every other entity I can think of. It sounds more like Apple is just a newbie here, and doesn't understand that yet.

A death certificate is pretty hard to counterfeit, but more importantly its validity can be confirmed by contacting the issuing county or other authority, and most institutions certainly take this extra step when large sums or sensitive information is being transferred.

Insisting on a court order is excessive in the extreme, and Apple needs to rethink such requirements. Circumstances like this are only going to increase, and Apple ought to understand that.

 

[keath]

Hopefully Smarter[/url]":mt0silof]A death certificate is what is needed. A Death Certificate is a Court Order

I don't think it's necessarily enough.

When I die, I don't think that should mean an open invitation for anyone to go through my things. I'd rather a court determine a need if I haven't expressly willed it.

 

[mistakenot]

ajmas[/url]":ei8dtt9j]While this in this situation this is Apple, I am sure a number of online services would leave you in limbo, without correct paper work. The problem is I suspect a good number of companies have no process for this? Google has at least added an emergency contact option for their accounts, so someone you trust can access your account, in case of an emergency.

The advice of a safe place to store a password is probably the best, since it protects you from being in limbo. Sure it means writing things down somewhere, but from my experience people are managing so many passwords, for different services, so this is the only approach which works for them.

For those interested, Google's tool is called "Inactive Account Manager", and it allows users to send selected data to trusted contacts (up to 10) after a certain period of inactivity (from 3 to 18 months): https://support.google.com/accounts/answer/3036546

You can also set it to delete your Google account, with or without sending data to trusted contacts.

Google also has a form for requesting access to data if a person passes away without setting up the inactive account manager, though they make no guarantees if the deceased didn't leave clear instructions: https://support.google.com/accounts/contact/deceased

 

[SixDegrees]

MikhailT[/url]":3v5mkv4m]While I do understand what the family is going through, it is not up to Apple to give them the passwords nor build in a backdoor to let them gain access to the content.

What does these folks want from Apple exactly? I don't understand what recovery means in this context. Certain stuff are encrypted, you can't get these info without the password.

If I died, I have no intentions in allowing my family members to read my emails and all the personal information. If I leave my stuff to them in the will, that does not include private information that I've encrypted.

If in fact that all the widow and the kid wants is the app purchases transferred to their own Apple ID accounts then in that case, Apple should have an easy way to do that without transferring any personal data. These data are not encrypted and Apple can access them without the password.

What these folks want is for Apple to turn over the property they're entitled under the deceased's Will, or in the absence of a will, they want it turned over according to whatever formulation their state's probate mechanism defaults to in such cases.

 

[SixDegrees]

Hopefully Smarter[/url]":2cjyscga]A death certificate is what is needed. A Death Certificate is a Court Order

Apparently, Apple doesn't share your view.

I'm pretty sure I don't, either. As I recall, I obtained my grandparent's death certificates through the hospital they died at, and it was signed by the attending physician.

Now, it's entirely possible, even likely, that a copy of that certificate is filed with the local court system, but that seems to be more of a bookkeeping operation than an actual court order, which would involve the actions of an actual court and actual judge.

 

[Jousle]

roe[/url]":27elk0um]

Jousle[/url]":27elk0um]

Belisarius[/url]":27elk0um]This is one of those damned-if-you-do, damned-if-you-don't sort of things: if Apple doesn't give over the account, you get a "grieving widow can't get mean old Apple to give her the info" story; if Apple does, as a policy, do this, then inevitably it'll be a vector for someone to social-engineer their way into compromising Apple IDs, then they'll get those stories.

Though it seems arduous, Apple is probably better off being stringent in their requirements than not.

Is the wife of the deceased who brings a death certificate a social engineer?

No, but the one who forged the death certificate (or copy thereof) is.

In that case we are not talking about social engineering anymore.

 

[Jeff3F]

I thought that for privacy minded folks, it is possible to setup an apple account that cannot be recovered...just use 2 factor authentication and when they ask, choose the option where Apple doesn't get a copy of the encryption key. Then store the recovery key in a safe place or destroy it.

I would be okay for my kin to access my stuff as it includes family property (photos). I would argue that media are also family stuff in the sense that my immediate household (spouse, kids living at home) would normally expect to access them. This is hopefully something that good estate planning would accommodate these days.

 

[Turbo_Gecko]

I think the family wants access to the content bought with the Apple ID, not the private data that's encrypted with the Apple ID password like photos, emails, etc.

That's one of the problems with digital content purchases right now. In most cases, you are getting a license to said content, not owning them outright. These cannot be transferred to the next of kin because it is not a purchase but a license that expires upon death.

This is something we need to clarify in the laws and allow folks to transfer the licenses to the next of kin upon deaths.

Perhaps if folks are unable to transfer the license for copyrighted material on their death then maybe we should apply the same logic to the passing on of the copyrights themselves. When a copyright holder dies, the copyright dies with them.

 

[Fatesrider]

renny[/url]":hacf8voo]

solarium_rider[/url]":hacf8voo]For those who choose to use Lastpass, they have now added a feature called Emergency Access to allow someone you designate to gain access to your account in the case of an emergency/death.

The allow may be crucial here. With Lastpass, the account holder has to make the conscious decision to say, "In case I'm dead, this person should have access to my account."

In the Apple case, the account holder may not have expressed such a wish.

In this case, he did, in his will.

So as much as I can relate to the desire to keep things secure on Apple's part, two things I get from this:

1. Apple can give out your password (or grant access to Apple accounts) to anyone.

2. Don't try to get access through Apple (or anyone else) and keep a list of passwords (with instructions) in a location designated in the will. That way you can update your password list without having to amend your will each time.

 

[forerunner]

ajmas[/url]":1djs3g8x]While this in this situation this is Apple, I am sure a number of online services would leave you in limbo, without correct paper work. The problem is I suspect a good number of companies have no process for this? Google has at least added an emergency contact option for their accounts, so someone you trust can access your account, in case of an emergency.

The advice of a safe place to store a password is probably the best, since it protects you from being in limbo. Sure it means writing things down somewhere, but from my experience people are managing so many passwords, for different services, so this is the only approach which works for them.

Google actually allows you to designate multiple people to gain access to your account should your account go "inactive" after a specified amount of time (they aren't notified before that so you don't creep them out beforehand and from there that will be able to reset all of your passwords).

https://support.google.com/accounts/ans ... 6546?hl=en

As part of my Living Trust (it avoid 7% probate fees on your entire estate when it is passed to your children)... my lawyer mentioned this scenario (a spouse being unable to access accounts) and you are suppose to provide some passwords to your major accounts (because even sending death certificates is a pain).

 

[SinclairZX81]

c600g[/url]":c4l0knlr]

Belisarius[/url]":c4l0knlr]Though it seems arduous, Apple is probably better off being stringent in their requirements than not.

Is acquiring a notarized death certificate that easy? Honest question.

Very easy. Here in California, it costs you about $10 per copy.

As someone who is currently going through probate of my late mother's estate, the problem here is that the widow is missing a key piece of paperwork. A will and a death certificate mean literally nothing, when you want to be allowed to handle the effects and property of someone who has died.

In most situations, an estate passes immediately to the surviving spouse, with little court paperwork. However, we're dealing with corporate pedantry here. What needs to happen is that probate proceedings need to be opened, and someone named Executor of the dead person's estate (or Administrator if, as in my case, there wasn't a will). That person would probably be the widow herself, unless she wants to hire a lawyer to do the leg-work.

The executor receives an "Order of Administration" (it's probably "Order of ... <something else>" for a case with a will), which is their court-ordered right to handle the affairs of the deceased. This is almost certainly the "court order" that Apple is talking about. Banks will make the same demand, as will anyone with more than a passing interest in the estate.

My guess is that some functionary at Apple is being really pedantic about this, and playing CYA games. An Order of Administration will take care of that. Oh, the functionary at Apple will still try to demand more, but that's their problem, and leaning forward and recommending that they contact the court to verify the authority granted by your Order usually gets the ball rolling. I had to do that with a bank, and mom's HOA.

 

[KidSizedCoffin]

Access to my porn should die with me.

 

[praetor_alpha]

Hopefully Smarter[/url]":1sfamdsi]A death certificate is what is needed. A Death Certificate is a Court Order

Apple doesn't think so. Didn't you read the article? They got one.

 

[SinclairZX81]

wangstramedeous[/url]":uaqtji0h]Apple is right to refuse to grant entry without further documentation. Just because her spouse is dead doesn’t mean he wanted her to access all of his personal data. Having said that, when an estate goes through probate, most probate courts issue some official document showing that the executor has authority over the estate. This official document is essentially a “court order,” which should be sufficient authority for most entities, like banks, etc., to grant access to the deceased person’s assets.

This lady would probably have had such a document issued, and I feel certain that Apple would have accepted this as her authority over her late husband’s account. That would have been the ideal way for the widow to resolve this. Apple isn't being tone deaf but actually protecting itself and its customers.

Likely she didn't, because "probate" between spouses is such a perfunctory affair. I don't think formal Orders of Administration (or whatever they're called for an Executor) are normally issued in such a case. She probably didn't have one to give. Perhaps someone who is an actual estate attorney can clear this up.

At any rate, now it comes down to whether the property in question is really worth all the filing, court fees, and hearings necessary to get the formal order. For example, the *filing fee* to open probate on my mother's estate was $465. Not sure it's worth it, in this case.