🚀 go-pugleaf

I posted the following survey question to this newsgroup in an effort to help  
decide our course of action in the mentioned situation:

> Newsgroups: comp.admin.policy
> From: sears@tree.egr.uh.edu (Paul S. Sears)
> Subject: Survey on user privacy
> Reply-To: sears@tree.egr.uh.edu
> Organization: University of Houston
> Date: Thu, 23 Jul 1992 21:59:31 GMT
> 
> Today we have a very interesting and sensitive situation arise -- a user  
> passed away and now the user's parents would like access to the user's  
> account.
> 
> This is a situation that I have not had to deal with before.  There are some  
> ethical considerations that need to be understood.  I am wondering how other  
> Administrators/Managers have handled similar situations.
> 
> 1)  I consider a users's account to be "private" and that privacy would only  
> be compromised by their own choice (i.e., lend their password to a friend,  
not  
> acceptable under our computer usage policies, btw, but it does happen) or in  
> the event of a system/security problem.  Is privacy still an issue when the  
> user is deceased?
> 
> 2)  The account of the deceased user may contain information that could be  
> considered "sensitive" or "revealing."  And then it may not.  I am not in  
the  
> position to determine what is sensitive.  However, there may be information  
in  
> that account that the user would never want anyone to see.  But what about  
the  
> desire of the parents to claim his "personal" files, much like cleaning out  
> his office (this is being done also)?
> 
> 3) Is there legal recourse for the parents or relatives of the user if  
access  
> is denied?  
> 
> 4) The current policy of Academic Computing is that the only person who can  
> *legally* access an account is the one who signed the account application,  
> which means that the parents cannot be given access.  In essence I agree,  
but  
> shows a lack of compassion.  One manager suggested that I move all the users  
> files to removable media and then give the media to the parents and then  
> archive the account.  It is fairly obvious after searching through policies  
> and talking with various administrators and managers that this it not a  
common  
> problem.  Has any organization's computing policy explicitly cover this  
> particular situation?  If so and the policy was to completely deny access,  
was  
> that a decision that would legally hold water??  
> 
> I would really appreciate hearing from those who have faced a similar  
> situation.  I would like to see this issue resolved fairly and ethically to  
> all parties involved.  
> 
> 
> I will provide a summary.
> 

The general consensus is that I _should_ allow the parents (because it is the  
morally right thing to do) or that I _have_ to allow the executor of the  
estate access to the account, *if they request access*.   This is the key  
point.  Legally, we are not required to allow access unless a designated  
person by a court needs/requests access (specified in will, petition filed by  
relatives, etc).  Our intent was not to delay access but simply to determine  
the bounds of the access and what procedures should be used.  In the survey,  
some stated that the entire account should be handed over to the requesters,  
while others stated that a responsible person should comb through the account  
to determine what might be considered property of the institution(s) involved  
(research projects, software packages, etc) and that property should not be  
given to the requesters. 

Based on this experience and because this situation has now involved other  
computing facilities on campus, Academic Computing is considering drafting a  
policy that will help eliminate some of the red tape.  How successful we will  
be at drafting such a policy is hard to guess.

I would like to thank everyone who responded to the posting.

Here are the responses we have received:

*******************************************************************

Date: Thu, 23 Jul 92 16:39:05 PDT
From: paul@cheshire.oxy.edu (Paul Hubbard)
To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Newsgroups: comp.admin.policy
In-Reply-To: <1992Jul23.215931.13522@menudo.uh.edu>
Organization: Occidental College, Los Angeles, CA 90041 USA.
Cc: 

I don't know if this will help since we do not have a written policy
that includes what to do if a user dies, but we just had a faculty die
and we downloaded his account to floppies and gave them to his
daughter.  She was also the person that was cleaning out his office.

I don't really see any difference between giving someone the data from
a computer account and giving them full access to an office.

-Paul Hubbard
 Systems Administrator
 Occidental College


Date: Thu, 23 Jul 92 21:09:42 EDT
From: chip@midnight.seas.upenn.edu (Charles H. Buchholtz)
Posted-Date: Thu, 23 Jul 92 21:09:42 EDT
To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Newsgroups: comp.admin.policy
In-Reply-To: <1992Jul23.215931.13522@menudo.uh.edu>
Organization: University of Pennsylvania
Cc: 

I was in a similar situation, where a professor died.  He had only
used his account for electronic mail, so there weren't any files to
deal with, but he did have a large /usr/spool/mail file.

We worked on the general principal that a professor's/grad student's
account was like their desk; in general it was private, but under
special circumstances their "boss" could have access to it.  So, I
turned over the files to the department chair.

In the case where a person leaves the company, I think I would turn
the contents of their account over to their replacement or boss, after
warning them to transfer and delete files as they saw fit before they
left.  This is equivalent to what happens to someone's desk and paper
files when they leave a position.

In the case of death, of course, the person doesn't have a chance to
transfer or destroy any sensitive material.  In the case of a
professor, grad student, or staff member, it's assumed that the
majority of work done on the system was work-related, and so the
files go the person responsible for that work.  You don't burn a
secretary's files when she leaves!

It's late, and I've been fighting fires all day, so this is somewhat
disorganized.  I'm sure you get the idea.

Your case is confounded by two issues: (1) the person may not have had
a chance to clean out their account, and (2) if the person was an
undergraduate, the person wasn't working for anyone, so no one in your
organization has a claim on the files.

I'd contact your university's legal counsel.  Failing that, I'd find
out what happens to a deceased student's personal property in their
dorm room.  

Charles H. Buchholtz                           chip@seas.upenn.edu
Systems Programmer                             (215) 898-2491
School of Engineering and Applied Science      200 S. 33rd St, rm 154
University of Pennsylvania                     Philadelphia, PA 19104


To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Reply-To: spaf@cs.purdue.edu
Organization: SERC, Department of Computer Sciences, Purdue Univ.
In-Reply-To: sears@tree.egr.uh.edu's message of 23 Jul 92 21:59:31 GMT
Date: Thu, 23 Jul 92 20:15:15 EST
From: Gene Spafford <spaf@cs.purdue.edu>

A very interesting problem.

I'd like to hear how you end up resolving it.

I would archive it, then ask the parents to sign a non-disclosure
agreement, then let them have access.

--spaf

Date: Thu, 23 Jul 1992 23:02:20 -0400
From: Brendan Kehoe <brendan@cs.widener.edu>
To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Newsgroups: comp.admin.policy
In-Reply-To: <1992Jul23.215931.13522@menudo.uh.edu>
Organization: Widener University Computer Science Dept, Chester PA
Cc: 

I've never faced such a thing (god forbid I ever do), but my first
reaction would be to allow access.  The nearest analogy I could think
of is the right of the family to go through a person's personal affects
after they've died.  I'd really push to have this kind of situation
fall under the same umbrella.  (Since, in my opinion, they have
absolutely every right to anything and everything involving their dead
son or daughter.)

-- 
Brendan Kehoe, Sun Network Manager                      brendan@cs.widener.edu
Widener University                                                 Chester, PA
            "Life is a process, and it shouldn't matter what the hardware is."
                                                              -- Chris Langton

Date: Fri, 24 Jul 92 03:28:08 GMT
From: Michael Friedman <mfriedma@us.oracle.com>
To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Newsgroups: comp.admin.policy
In-Reply-To: <1992Jul23.215931.13522@menudo.uh.edu>
Organization: Oracle Corporation

Seems to me that the user's account should be handled like a locked
file cabinet in his room marked "Private and Personal".

Now how would you handle that?  Well, you would give it to the
executor of his estate to handle as specified in his will and to go,
by default, to his heir or heirs.

Seems like the information he owns is the same.

Mie

To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Newsgroups: comp.admin.policy
References: <1992Jul23.215931.13522@menudo.uh.edu>
Date: 24 Jul 92 00:06:03 PDT (Fri)
From: jackw@drbear.com (Jack E. Wilkinson)

Hmmm.... 

1) I'm in California, not Texas, so some of these thoughts just may not
apply.

2) I'm writing in perspective of a person who has just lost a non-related
friend, but someone that I did have all the legal paperwork, and therefore
responsibility, for (i.e.: durable power of attorney, etc.).  This is the
equivalent of a parent's access to a non-married or otherwise "allocated"
child's property.  (if that didn't make sense, ask and i'll try again.)

I should have full access to whatever is on the account.  Because with the
death of the responsible party, that responsibility legally passes on to me.

If there is concern about data that is project/job related falling into my 
hands, that data should be handled by the appropriate manager/system admin.
All other data belongs to the party that is responsible for all of the user's
property.  I think the suggestion of giving a copy to the person's parents on
floppy AND archiving it off is the correct solution.

Feel free to write me back or call me if you want to dig into this further.
Peace....

---
Jack E. Wilkinson            \           Drummer Bear Systems
1259 El Camino Real, #214     \          Providing computer and theatre
Menlo Park, CA 94025          /\         production services since 1984.
I am out, therefore I am!    /  \   jackw@drbear.COM or  
..!decwrl!drbear!jackw

Newsgroups: comp.admin.policy
From: ldg@scott.skidmore.edu (Leo D. Geoffrion)
Subject: Re: Survey on user privacy
Message-ID: <1992Jul23.234640.8728@scott.skidmore.edu>
Organization: Skidmore College, Saratoga Springs NY, 12866
References: <1992Jul23.215931.13522@menudo.uh.edu>
Date: Thu, 23 Jul 1992 23:46:40 GMT
Lines: 33


In general, I find it very helpful to draw analogies to conventional
technologies when dealing with computing situations where there is no
standard procedure.  If nothing else, this analogy helps lawyers and
administrators better understand the issues.

Change the details just a little bit... Suppose that you have a file
of papers belonging to the deceased person.  What is your
responsibility in that case?

If I'm not mistaken, someone is designated as the executor of the
person's estate.  Most likely this will be the parents, unless the
student was married or had otherwise designated someone else. The
executor has the legal right/responsibility to retrieve all personal
items and settle all debts.  Collecting papers stored in various
locations, items loaned to others, charge cards, bank papers, ... are
all part of an executor's traditional work.  Within that context,
I'd be inclined to turn over any files to the executor if that
person so requests.

-- 
Leo Geoffrion, Skidmore College Computer Services, Saratoga Springs, NY 12866
EMAIL: ldg@scott.skidmore.edu   VOICE: (518) 584-5000 Ext. 2919

Newsgroups: comp.admin.policy
From: bogstad@rhombus.cs.jhu.edu (Bill Bogstad)
Subject: Re: Survey on user privacy
Sender: news@blaze.cs.jhu.edu (Usenet news system)
Organization: Johns Hopkins Computer Science Department, Baltimore, MD
Date: Fri, 24 Jul 1992 04:06:11 GMT
Lines: 25

In article <1992Jul23.234640.8728@scott.skidmore.edu> ldg@scott.skidmore.edu  
(Leo D. Geoffrion) writes:
>...
>If I'm not mistaken, someone is designated as the executor of the
>person's estate.   ...
>...  Within that context,
>I'd be inclined to turn over any files to the executor if that
>person so requests.

	I mostly agree, however, the one caveat is that the executor would
only expect to receive personal papers or property.  The user might have
files in his account which would not in fact be considered her property; but
instead the property of the computing center, perhaps an employer or a
research adviser.  If you were dealing with physical files someone would
have to sort through them to decide which were personal and which were not.
Depending on the circumstances you might have to do the same with the
computer files.

				Bill Bogstad


Subject: Re: Survey on user privacy
To: sears@tree.egr.uh.edu
Date: Fri, 24 Jul 92 14:15:13 EDT
In-Reply-To: <1992Jul23.215931.13522@menudo.uh.edu>; from "Paul S. Sears" at  
Jul 23, 92 9:59 pm
X-Mailer: ELM [version 2.3 PL11]

:Today we have a very interesting and sensitive situation arise -- a user  
:passed away and now the user's parents would like access to the user's  
:account.

Is there any particular reason that the parents have expressed?

:This is a situation that I have not had to deal with before.  There are some  
:ethical considerations that need to be understood.  I am wondering how other  
:Administrators/Managers have handled similar situations.
:
:1)  I consider a users's account to be "private" and that privacy would only  
:be compromised by their own choice (i.e., lend their password to a friend,  
not  
:acceptable under our computer usage policies, btw, but it does happen) or in  
:the event of a system/security problem.  Is privacy still an issue when the  
:user is deceased?

Indeed.  Consider JFK.  The issues of confidence extend to other
people whose privacy he may also be concealing.

:2)  The account of the deceased user may contain information that could be  
:considered "sensitive" or "revealing."  And then it may not.  I am not in the  
:position to determine what is sensitive.  However, there may be information  
in  
:that account that the user would never want anyone to see.  But what about  
the  
:desire of the parents to claim his "personal" files, much like cleaning out  
:his office (this is being done also)?

What is your ability to view his/her files?  In a secure facility,
generally speaking, a supervisory sort clears out personal effects
before the family does.  Does your computing policy specify that you
have the ability to view his files under certain circumstances?

:3) Is there legal recourse for the parents or relatives of the user if access  
:is denied?  

Depends.  Are they his executor?  I would definitely have that
confirmed before proceeding further.  

:4) The current policy of Academic Computing is that the only person who can  
:*legally* access an account is the one who signed the account application,  
:which means that the parents cannot be given access.  In essence I agree, but  
:shows a lack of compassion.  One manager suggested that I move all the users  
:files to removable media and then give the media to the parents and then  
:archive the account.  It is fairly obvious after searching through policies  

I definitely would NOT have them poke interactively on the account.
An archival approach is definitely the way to go.  Be sure that there
aren't any files owned by him that aren't necessarily in his account
directory (speaking from a Unixish perspective here).

:and talking with various administrators and managers that this it not a  
common  
:problem.  Has any organization's computing policy explicitly cover this  
:particular situation?  If so and the policy was to completely deny access,  
was  
:that a decision that would legally hold water??  

Government and corporate facilities do this and legally hold water.
(Usually, no one bothers to ask.)

:I would really appreciate hearing from those who have faced a similar  
:situation.  I would like to see this issue resolved fairly and ethically to  
:all parties involved.  

I had a somewhat similar incident occur here a few weeks ago.  Someone
died of a heart attack (Ford claims yet another victim <sigh>) and I
had to differentiate the project-oriented files from his personal
files.  While both were accessible to me, I didn't feel that having
personal email (undoubtedly including flames about management and
whatnot) should be part of the public record.

Date: Sun, 26 Jul 92 07:09:21 -0400
From: stauffer@cc.swarthmore.edu (Glenn Stauffer)
To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
References: <1992Jul23.215931.13522@menudo.uh.edu>
Organization: Swarthmore College

In article <1992Jul23.215931.13522@menudo.uh.edu>, you wrote:
> 
> 3) Is there legal recourse for the parents or relatives of the user if  
access  
> is denied?  
> 

I'm not a lawyer, but I believe that the executor of an estate has full
rights to everything owned by that estate.  I believe that this applies
even to mail and other things normally protected by strict privacy laws.  I
worked in banking and, upon death, a person's accounts became the property
of the estate.

Another situation that you may want to consider - what if a user was in a
coma and power of attorney was issued to a family member who then wanted
access to that person's computer account?

I feel that you are obligated to give his family access to that person's
computer account.  However, I don't believe that the family has a right to
take anything that might be deemed to be owned by the college - ie. backup
copies of college owned software or data files prepared for the college (if
the person is faculty or staff).

Glenn Stauffer
stauffer@cc.swarthmore.edu

To: sears@tree.egr.uh.edu
Date: Sat Jul 25 17:57:42 1992
From: billmcc@seanews.akita.com (Bill McCormick)

To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Newsgroups: comp.admin.policy
In-Reply-To: <1992Jul23.215931.13522@menudo.uh.edu>
Organization: SEANEWS - Seattle Public Access News & Mail
Cc: 

The executor of the estate legally represents that person in every respect.
This includes medical records, computer files, bank accounts, etc.

If the executor asks for the information you should give it to him or her.

Bill

From: betsys@cs.umb.edu (Elizabeth Schwartz)
Newsgroups: comp.admin.policy
Subject: Re: Survey on user privacy
Message-ID: <BETSYS.92Jul24164922@ra.cs.umb.edu>
Date: 24 Jul 92 21:49:22 GMT
References: <1992Jul23.215931.13522@menudo.uh.edu>
Sender: news@cs.umb.edu (USENET News System)
Organization: University of Massachusetts at Boston
Lines: 25

In article <1992Jul23.215931.13522@menudo.uh.edu> sears@tree.egr.uh.edu (Paul  
S. Sears) writes:

>Today we have a very interesting and sensitive situation arise -- a user  
>passed away and now the user's parents would like access to the user's  
>account.

>4) The current policy of Academic Computing is that the only person who can  
>*legally* access an account is the one who signed the account application,  
>which means that the parents cannot be given access.  In essence I agree, but  
I don't think that will hold up. Look at it the other way. What gives
the computer center the right to decide, for the family, that they
cannot have access to this particular subset of the deceased person's
possesions? I think that is for the executor of the will to decide. 
   Mind you, I am not sure that it *should* be this way. But unless
something happens, I would imagine that computer files fall under the
same laws that apply to other intellectual property.
  I would give the tape to the family, perhaps through an
administration contact, who could perhaps tactfully comment on the 
nature of computer communications....

--
System Administrator                  Internet: betsys@cs.umb.edu
MACS Dept, UMass/Boston               BITNET:ESCHWARTZ%UMBSKY.DNET@NS.UMB.EDU
100 Morrissy Blvd                     Staccato signals
Boston, MA 02125-3393                      of constant information....

Newsgroups: comp.admin.policy
From: scoile@gmuvax2.gmu.edu (Steve Coile)
Subject: Re: Survey on user privacy
Message-ID: <1992Jul25.152810.19066@gmuvax2.gmu.edu>
Organization: George Mason University, Fairfax, Va.
References: <1992Jul23.215931.13522@menudo.uh.edu>  
<BETSYS.92Jul24164922@ra.cs.umb.edu>
Date: Sat, 25 Jul 1992 15:28:10 GMT
Lines: 47

In another article, Elizabeth Schwartz writes:
>In article <1992Jul23.215931.13522@menudo.uh.edu> sears@tree.egr.uh.edu (Paul  
S. Sears) writes:
>
>>Today we have a very interesting and sensitive situation arise -- a user  
>>passed away and now the user's parents would like access to the user's  
>>account.
>
>>4) The current policy of Academic Computing is that the only person who can  
>>*legally* access an account is the one who signed the account application,  
>>which means that the parents cannot be given access.

>In essence I agree, but I don't think that will hold up. Look at it the
>other way. What gives the computer center the right to decide, for the
>family, that they cannot have access to this particular subset of the
>deceased person's possesions?  I think that is for the executor of the will
>to decide. 
>[...]

I disagree.  The account, consisting of the files (not necessarily the
contents), and the resources upon which they are located are property of the
site, not the account holder.  The site still has the right to deny access
to anyone but the account holder.  In my opinion, in all cases where the
designated holder of an account is unable to take responsibility for the
account, system management implicitly assumes ownership[1].

I see three possible solutions:

A)  Waive the restriction and allow the relatives access to the system.
    Perhaps additional restrictions could be placed on the account (limiting
    privileges, resources, time, et cetera).

B)  Transfer ownership of the account to the relatives.  Because the relatives
    may not be part of the university or college, a fee of some sort might
    be imposed.

C)  As suggested by the previous poster, provide the contents to the family,
    either through transferable media (floppy disk, tape, or whathaveyou),
    or through hard-copy.

[1] (footnote from above) Note that "ownership" in the context used in this
    posting denotes the rights and responsibilities of the account holder,
    as established by the system's administration, and not ownership in the
    legal sense.

 Steve "Stevers!" Coile                     
scoile@gmuvax[{.BITNET|[2].gmu.edu}]
   disclaimer:  opinions are my own and not necessarily those of my employer.
            "Maturity is knowing when and where to act immature"

Date: Mon, 27 Jul 92 14:51:14 PDT
From: frank@odetics.com (Frank Merrow)
Subject: Survey on user privacy
To: sears@uh.edu

Hi Paul,

As the executor of two estates (about 10 years ago) I would offer
you this advice from THAT prospective.

As executor (or administrator) of an estate, I legally AM THAT PERSON
for all intents and purposes.  You have no right to refuse me entry
into ANYTHING related to that person that might have any value
that was "personal property".  I can open safety deposit boxes,
enter a house, pretty much anything that person could do I can
do with court approval.

If a court appointed executor/administor shows up (or mails you)
a copy of the dead certificate and proper court documents, you
have no choice.

In your particular case, if the individual is not married, then
expect one of the parents to be appointed.

On the flip side, if you allow a parent access WITHOUT such documentation
and something of value is taken from the account that the executor
deemed part of the estate, you are probably in very hot water.

Frank

Date: 	Mon, 27 Jul 1992 19:22:34 -0400
From: Jim Prall <trigraph!jimp>
To: sears@tree.egr.uh.edu
Subject: Re: Survey on user privacy
Newsgroups: comp.admin.policy
References: <1992Jul23.215931.13522@menudo.uh.edu>

Paul,
A very interesting question. My feeling is you may treat the user's data
as personal effects, which become part of his estate. Just as his parents
are now going through his belongings, it seems consistent to give them copies
of his files. 
If the parents found a paper diary in his effects, they would have to
decide how they feel about his privacy, and would also have to live 
with their own feelings about what they discover if they look.

The same would seem to hold for computer data. Most will be innocuous
and pedestrian, but if there is personal e-mail, the impact is likely
to be similar to that of paper mail. 

I favour giving the parents access to copies of the user's data. 
I feel this will allow them to see another facet of their son's life
in the course of working through their grief. Just as they will be
reacting to memories triggered by their son's belongings, any time
they spend viewing his electronic 'effects' will play a part in 
their grieving process. It is up to them how they want to approach
looking inside his electronic letters. You may want to talk over with
them the similarity of e-mail to written correspondence. 

It occurs to me that the real privacy issue here is the privacy of
the people who may have sent private mail to the deceased. If you
are able, perhaps you could familiarize the parents with e-mail only
so far as to identify messages sent privately as opposed to general
circulation messages. Also, if there are records of outgoing messages,
the privacy of the recipients should be respected. This does not mean
the parents should not be given access to 'carbon copy' records of
outgoing messages. It does mean they should first understand the
nature of the messages. The analogy with paper mail is useful again
here - compare the old days when people really used carbon paper
to keep copies of outgoing mail. Only now, mail we might never
think of copying for our records might be archived forever without
our thinking about it.

By treating the user's files as personal effects, I think you would
be justified in making them available to the parents. If the files
include material written for an employer - source code, reports,
memos, or the like - I think the employer could claim ownership
of these files. Anyway, I dont think the parents would be interested
in those files, only the 'personal' ones.

Is it a problem to figure out which files fall on either side of
this division?

I hope you can acceed to the parent's request. The fact that they actually
asked at all suggests it would mean a lot to them. I would hate to see
them become frustrated at an administrative obstacle. 

-- 
Jim Prall                          jimp%trigraph.uucp@csri.toronto.edu
Trigraph, Inc.                     (Our mailer gives bad reply paths. 
Toronto, CANADA                     Use above address.) 

****************************************************

--
Paul S. Sears               * sears@uh.edu (NeXT Mail OK)
The University of Houston   * suggestions@tree.egr.uh.edu (NeXT
Engineering Computing Center*     comments, complaints, questions)
NeXT System Administration  * DoD#1967 '83 NightHawk 650SC SSI#755020059
"Programming is like sex: One mistake and you support it a lifetime."