Slashdot Mirror
Post-Suicide Account Cracking?
An anonymous reader writes "A good friend of mine had her younger brother apparently commit suicide last week. He was a young, promising CS major who was close to being accepted into a very prestigious school. He was very into Linux as well as PHP/MySQL coding. He left absolutely nothing behind for the family as far as a death note or explanation, and there is some possibility that this was all somehow a tragic accident. The family is in a situation where proof of accidental death would change how this was viewed in terms of paying for parts of the funeral. More importantly, some members of the family are hoping to find something, anything, that might explain why this all went down. Since I'm the most computer-skilled person the family knows, they have asked me if I could help them try to find some information. My possible approaches are: his Linux laptop, his university, Gmail And Hotmail email accounts, and a second MySpace profile that apparently has been tagged as private. How ethical would it be to, say, try to crack his root password in a situation like this? I wouldn't attempt to crack a man's account for his wife because she thinks he is cheating on her, as his life is his own business. In death, would you have the same respect for a person's private thoughts? Secondly, If I contacted places like Google, MSN, the university, and MySpace, what are the odds that they would give me access to any of his accounts? I have links to obituaries and such to prove that he is indeed gone. Would it be a matter of not giving it to me (maybe only to the family), or is this something that they would not do at all? Any opinions on if I should do this and if so, how I should go about it?"
dead people don't really care, one way or another.
a court order will streamline all this for you
Your friend is gone; he no longer owns anything. His worldly possessions, including his accounts and passwords, belong to those he left behind. They have asked you to open the locked box, open it.
There is no ethical delimma. You are being asked to open something by that something's owner. NOT cracking passwords would be wrong.
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
"I don't know, therefore Aliens" Wafflebox1
If you saw your friend again, would you be able to explain why you did it? Would he agree with your reasoning or would he feel you had violated his sovereignty? You can still respect him in death, what would he say?
Happiness does not come from having much, but from being attached to little.
Well, if it was suicide, and there was anything he didn't want people seeing, then he had his chance to delete it. If it was not suicide then I think you have to tread more carefully, but in the end the dead have no right to privacy (or reason to care).
For FSM's sake, though, take a moment to "accidentally" delete his porn and such while you are going about this. That's just basic courtesy.
...but...
The belongings of the deceased become part of the estate. The estate, with a lack of a will, can go either to the 'state' or to the next of kin (depending where you live). The 'state' usually takes its taxes and give the rest to the next of kin. This means that the laptop and accounts now belong to the family (barring the EULA on myspace and google which, correct me if I'm wrong, state that the ownership resides with them). This means that you are cracking a laptop for an OWNER that no longer has a password (forgotten it, so to speak). There is no ethical issue here.
Gregor
You beat me to the punch. Having worked in the financial sector for a time, a death certificate should do the trick.
The catch will be is if the person signed up for accounts but didn't use his real name, address, etc. Then you may have a problem. Otherwise, submitting the certificate (more than likely official copies) should suffice to prove to the various places that the person is truly dead and you are doing a port mortem of his accounts.
The family should be the ones contacting these places as they are next of kin.
I know it's asking for trouble, but this is why all your accounts including username and password should be written down and stored in a separate location. Regardless if it's suicide or getting run over by a wildebeast, someone, somewhere, will need to be able to get into your accounts to clear things up.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Seriously. Speak to a lawyer, and then recommend a professional data recovery company to the family. You do not want to get involved with this. Best case, it turns out there's proof it was accidental. I'm not sure how that could be proved, but let's assume it was.
Worst case, you find evidence of... something. Drug use, criminal activity, involvement with a cult, something like that. Whatever it was, it drove him to suicide. Now you're in the position of telling the family that their son/brother was doing something they wouldn't have approved of. Yes, they may be glad to know what really happened, but you'd better believe that things are going to be awkward with the family from now on.
Or, possibly even worse than that... what if it turns out it was something the family did? Even if it wasn't anything illegal or even dishonest... do you want to be in the position of telling the parents that something they did caused their son to kill himself? I wouldn't. I wouldn't want to do that to my worst enemy, let alone people I liked.
Speak to a lawyer to find out the legal issues and what is needed to get information from various hosting services, then suggest that the family contact a good data recovery firm. Have them hire a lawyer to get the data from the hosting services. No matter how much you want to help, restrict it to helping them find professionals to get the data, don't try to do it yourself.
Your ethics in this case extend to the living, not the dead. "First, do no harm..." might be a good motto here. You are going to be mucking about in some content that might not be what anyone is expecting, but there is a story there and the living want it told-- at least to them.
So long as you are discreet and have the consent of the family, do what you need to do to bring them closure.
I've lost a child. I can assure you that it is important to the family that the tragedy not be a pointless one. A tragedy happened, and at the very least they want to know that they handled it well, that perhaps they are wiser for it, SOMETHING. It's called closure, and it doesn't ease the loss but it does help with the frustration.
It's actually a bit gray. If the deceased were not so then you would be entirely correct, as this would be unsolicited system intrusion. However, upon his death his possessions, including his various passwords and access to his accounts, became the responsibility of the executor (one would assume that either the mother or father took on this role, as it would be an exceptionally odd thing for a 21 year old to actually write up a will stating otherwise), who has since requested that the intrusion be done on what is, essentially, their property.
What shocks me is that this was ruled a suicide without an inquest going through all of this already. That is a very radical conclusion to come to, and one with (as stated in the story) some pretty serious legal and financial ramifications; happy successful people don't just off themselves for no reason and without any sort of note or indication that things were not going quite so peachy as believed i am surprised that no investigation has been done if only to rule the possibility that it's an accident.
Try not to take me more seriously than I take myself.
I would agree with the parent post.
Understand that if your going to crack into his laptop or recover his account information for his online services, you will be acting as an arbiter of knowledge (granted that you have permission) concerning the final moments before this person's death.
A year ago my aunt committed suicide, and my mother asked me to crack into her laptop so that she could feel closer to her sister and understand more of what she was thinking before she died. I thought about it for a long time and then I went ahead and did it, managing also to recover her password. The password *itself* just so happened to be meaningful to the family, as was the desktop background she left up the day she died (it was a picture of her two children when they were young).
On the other hand, when they asked me to recover deleted data, I decided not to return the deleted data (I actually denied that I could even do it), to the family. The reason was that she had written a lot of hastily thought out "hate notes" to some members of her family, and in the end she probably didn't mean what she said, because the text files were deleted.
There weren't any "skin mags", but make sure that you don't hand over anything that will open old wounds - wounds that won't heal very easily, now that the person related to them is deceased. On the other hand, if you find touching things, hand them over.
Also understand what this will do to you personally- it will put you in a position of knowing things that your family will not, if you have to hide things from them. That is its own particular burden, and its up to you to decide if you want to carry it. I did, but not everyone would make the same decision.
Lots of options here.
first try to crack the passwords on his machine. If you can get any passwords in plain text write them down. He may have reused them. If you can get into his profile, its possible he set his cookies to auto login to his websites.
Next try to get into his email. Call the provider and ask about your situation and find out what the rules are with out ever telling the operator your name or the account name. If the info they give you will not help you, hang up and call back pretending to be the deceased. They dont know he is dead yet.
Get the birth cert, social security number, phone numbers and addresses (current and past), birthdate, drivers lic, mothers maiden name. Try calling from his home phone, or be near that phone when you make your call. Just pretend to be an average user that cant get into your email. Reset the password.
Once you have the email account under your control you can just request a password reset from most of the other services.
Basicly steal his identity, if they cant prove you are not him its hard for them to not let you in. Just play dumb. Dont say you forgot your password, tell them that your email is broken because your account won't work.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
After reading the post and some of the replies I wanted to try and provide some insight on a few things. First of all I should mention that I'm a coroner in British Columbia, Canada, so not everything that applies here will apply in other jurisdictions. However I hope I can still be of some help. In regard to suicide vs. accident, there is typically a presumption against suicide and the coroner or medical examiner should have some substantial evidence if they are going to rule the death a suicide. Having said that, suicide is a lot more common than most people believe. For example, British Columbia has a population of a little over 4 million and we see approximately 500 suicides per year. Contrary to what some people are suggesting there is usualy no suicide note. Also, the person is not always known to be suicidal or even depressed. Sometimes a suicide comes as a complete surprise to family and friends. I would not say that this is the norm but it definitely happens. Evidence of a suicide can take several forms. Ideally there should be a history of some kind to support that the death was a suicide but I have had cases in which the circumstances of the death were such that it was unreasonable to conclude that the death was anything other than a suicide, even though the person had no history of depression, suicidal ideation or behaviour that suggested they might harm themselves. As far as the information on the computer, I have taken information from people's computers and in one case seized a computer to get further info from it. I do not see an ethical issue with this if it will help to determine the manner of death. My only suggestion is that the coroner or medical examiner should perhaps be contacted to see if they are willing to do this. They may not be willing to get involved if they feel that they already have sufficient evidence to classify the death. Also, I do not know if the coroner/ME in your area has the legal authority to do this. Still, if the family strongly believes that the death is an accident and not a suicide they should talk to the coroner/ME about their concerns. When family members have raised such concerns with me I have found that sometimes they have very useful information or insight that can have a significant impact on my investigation. Other times it is clear that they are just not willing or able to accept the truth. As far as legalities, I can tell you that here in BC (and I suspect in most cases) it is the same as most people have stated - the things that belonged to the decedent now belong to the estate. The executor or legal next of kin will likely have the legal authority to give you permission to do what you are talking about. Having said that, I will give the standard IANAL disclaimer along with a reminder that laws can of course vary from one jurisdiction to another. NOTE: sorry about the wall of text. This is my first Slashdot post and I haven't yet figured out how to make it appear in paragraphs the way I wrote it.