We've got a trifecta of brains joining us for our next conversation on final footprints, and they'll be able to explain a little more what we can take away from a name like this. But up here on the stage, we've got our own Eve Maler. Thank you for moderating as well. We have Kaliya Young, and we have Mike Kiser. So please get comfortable, and thank you. This stage is yours. Switching hats here for a second, although I don't have a hat, some people do. We really appreciate your coming to this session.
This was a sort of a last minute replacement session, and it's a topic that gets a little bit to heart and philosophy and real life, along with digital identity that we all know and love. I'm Eve Maler. I've been co-moderating this track, but I'm also privileged to have a role in this panel as well, and I'd love for you to introduce yourselves. Sure. My name is Kaliya Young. Some of you may know me as Identity Woman. That's the handle I've been using to blog and to work in this industry for about 20 years. And I co-founded the Internet Identity Workshop. Some of you may have heard of it.
I'm Mike Kiser. I'm the Director of Strategy and Standards at SailPoint. All right.
Well, thank you guys for joining me, especially at last minute. So we're here to talk about what we termed final footsteps and talking about digital legacies. When somebody passes away, and they have what can be considered a digital estate, what should happen? What is happening? What are the challenges in these very difficult circumstances? And we three had the privilege to be on a panel last week at Identiverse with Dean Sachs from Amazon Web Services, who has really been kind of a leading light on this topic and kind of holding a torch for better solutions than we have now.
And unfortunately, Dean couldn't join us today. You know, he shared a poignant story about we've lost people in this industry, and he had lost a friend some years ago, and he started observing. It kind of got him into identity. I don't wanna speak for Dean, but one of the things he shared was looking at what happens to LinkedIn when somebody dies. You may have noticed that you might have seen some posts that say, I'm happy to share that I have a new position as deceased at none. This is really, really common and really heartrending.
Like, that should not be the way that people find out about what happened to you. There's family, there's loved ones, there's a whole circle of digital friends that we've all collected. And this was the context in which he brought us all together for conversation. And even just in the last week, the conversation has fortuitously moved forward a little bit by virtue of the kind of standardization mindset, the wonderful conversation that we have going on here. So I'll certainly invite all of you to share your questions with us.
But for now, I kind of wanna catch us up to what we've been thinking, what we've been up to. So there's a little bit of a reprise of last week.
So, and now she goes to her notes. Yeah, go for it. I will add to what you just shared about LinkedIn. I haven't gotten on any of these that recently, but I got several, hi, I'm dead emails. Oh my gosh. Because that was the way that family members were able to communicate to their digital networks that somebody had passed. Like an autoresponder?
No, no, like a, like their email is the email, sending the email. And it's the family using it to communicate to the network of people to whom the deceased person is connected that they otherwise wouldn't know how to read.
So, and- That's even worse. That's even worse because you trust an email to come in from a person fishing aside, but it's a real email from somebody who's passed.
So, you know, why talk about death and the digital estate now? Like, has anything changed? What's going on now? One thing that's changed is that someone in our community, we lost him this past year, right? The last two years at EIC, I've stood backstage as the session right after Vittorio's keynote, and it's something that I've missed this year, right?
It was sudden, it was quick, and it kind of really brought to the forefront of a lot of our minds that this is an issue that people typically tend to ignore or tend not to want to discuss, but it's a classic intersection of identity technology and real-world identity and real-world humanity. So that's one thing I would say.
Yeah, do you have, what's your perspective on why now? Well, because before it didn't go anywhere. About well over 10 years ago, I was part of co-facilitating and pulling together a series of conferences we called Digital Death Day. So there were unconferences situated next to IIW, and we also had a couple in London. So really making space for people who think about this issue a lot. There's a whole academic discipline that considers this, and a bunch of us thoughtful identity people at the time were thinking about this. But the industry wouldn't come out of its shell.
I did my best to reach out to, we're in Silicon Valley at IIW, like Yahoo and LinkedIn and Google, and being like, hey, do you have somebody who deals with accounts for people who died? And they're like, we do, but we don't want to talk to anybody. Because it's, they didn't want to join a conversation about how there might be some common patterns or practices or norms throughout the industry.
But now, I sense we're in a, there's potential now, like that just, there wasn't capacity or willingness to have this conversation. I don't know that we will for sure succeed, but I feel there's a different energy and momentum.
Yeah, I mean, I sense that. And you know, last year, there was this sort of groundswell of, well, we seem to have solved authentication, and then looking around for other problems to solve. And if that's the way in, to talk about these difficult things, maybe that's the way in, you know? And we've had the passing of some identity royalty, and a passing of a lot of folks, you know? Passing of people in our lives.
And so, you know, with each passing year that identity itself as a discipline matures, I think it behooves us to just sort of talk about it and name the nameless. So one of the things that comes up when you think about calling it a digital estate is, well, it's property, and you'd have an executor of an estate. And is it simply, she makes air quotes, a solution of handing that digital property to somebody else?
Like Google has a solution now, the inactive account manager, where it sort of notices if you haven't been around for a while, and you can sort of designate other people to sort of pick up the slack. But is it just a matter of property?
I mean, you know, Mike, you come from disciplines other than tech, so. Yeah, I think there's a lot there, right? Like it may be a matter of property, but even if like a legal framework is in place, that doesn't mean people have taken advantage of that legal framework, right? How many of you in this room have actually had a conversation with your loved ones saying, if I am no longer here next week, here are the steps you take. Here's how you access, oh, I'm proud of you, by the way. I didn't know that. That's tough conversations. People don't like having those conversations.
When my father died, he didn't have that conversation with any of us. At the same time, my father's personality was the opposite of mine, by which I mean, he wrote everything down. He balanced his checkbook every week. What that meant was there was a filing cabinet I could pull open, and I could find every account he ever had, every password, I think five passwords deep every time he changed it. So it was super, super easy, right? I have another friend whose partner was the opposite. He passed this past year, again, quite quickly.
He was a Linux administrator for 30 years that ran his own home network, and he was also very acquisitive, like acquired a lot of stuff. We'll put it that way. She couldn't find all the networks, much less find the systems or the accounts. She happens to have some very talented friends who are world-class white hat hackers, and so they volunteered to fly into town, discovered, mapped out her whole network, and then hacked into everything.
Now, most people don't have those friends, right? And so I think that kind of moves us to not just have a legal framework, but some kind of technical process or something to A, force these discussions, but also make it easier to have that process go more smoothly.
Yeah, I'll build on what you shared. I think through Digital Death Day, I met some super deep experts, and two of them have a site, Death in the Digital Beyond, and they actually have a listing of over 50 different services related to sending messages after you die, to here's the passwords you send to your loved ones, different services trying to address this problem. The challenge is many of those services are old. It's unclear, are they still even up and running? If I did use a service today, will it still work in 20, 30, 40 years after I die?
Am I keeping it updated with who I want to get that information? There's just a ton of questions about the longevity of tools that are meant to address some aspects of this problem, and I think it would be interesting to consider what are core essential functions. How do you, how do we as an industry support this function like staying alive, right? Like this is almost a public service sort of tool, not a profit making thing, but if we don't have it running well, we're not doing service to us as a living or the people who are passing. So how do we, as you're, like what would be the standards?
If you did have a service, do you get it certified that it's actually good and run well so that people could trust it? Like these are really good questions.
Yeah, if I'm no longer here next week, like my MySpace page, that can go away, right? I don't need that anymore.
But even, but you have to think about it. It's even more a technology problem. It's also an existential question, right? What are your personal beliefs? Does the person who passed away, do they still exist after they die and in this world, quote unquote? I'm not trying to be facetious. Every culture is going to have a different expression at the very least of grief, if not life beyond death. So what does that mean for your digital life? Does that mean that my account should stay up for the same period of time that I'm mourning?
Does it mean that if someone is too famous that it has to stay up as a tribute? How do you lock that down? What about people that want to do things and keep you around digitally? Do you have to specify that I don't want to exist online explicitly? There are lots of questions that tie into people's worldviews and we're gonna have to think through all of those edge cases if we want a standard to really address everyone's needs, right?
Yeah, I mean, you're pointing exactly to that these aren't just assets that you treat sort of the same with, I don't know, retention policies of the usual sort. It's more like they're representations of people and those people may not be around but those representations may have, there may be cultural or religious or philosophical aspects to people's own choices about what they like to have happen in their family's choices.
Mike, you had an interesting example that you came across of a kind of a digital avatar that somebody created. Yeah, you talk about, we've heard a lot about Gen AI and LLMs, right? There was a gentleman back a couple of years ago, his fiancee died suddenly. All of our stories today start by the way, so just get used to that. She passed away suddenly and he could not get past her death. He was mourning for a year, year plus. He read in Wired or some other magazine about this new technology that was coming out called GPT-3, maybe you've heard of it.
It was very new back then and a guy had set up a service where you could create your own chat bot and you pay a number of credits. He paid a thousand credits in and then fed GPT-3 all of her tweets and all of her messages that had been sent to him, right? And started chatting with it. And it was enough like her that it actually helped him on one hand, right? It helped him move on.
She would, the chat bot would tell him, I think it's time for you to keep on going and didn't say he didn't need me, but it helped him process, right? On the other hand, when those credits ran out, it built into the system was a limiter, a limitation that you couldn't extend the life of the bot. Even if you put in more credits, the seed values of the original foundational model would change enough that her personality would change.
So that was actually really helpful for him because otherwise what's the ethical moral danger here is that you could keep your loved one in a box as long as you wanted and trot them out and let them lead this Harry Potter-like half-life, right? So it's fascinating. The considerations are endless where there's a new effort that's just been launched to address some of the considerations. And this is what Dean Sachs has done.
He's working to start an OpenID Foundation group called Death in the Digital Estate, and he started to charter this group so that we could reason together about what to do next. And for starters, I'm gonna give you the URL, sorry, no slides, no QR codes here, but on GitHub, the dhs-aws is Dean's space and you could find his Death in the Digital Estate or DADE area where we're starting to collect resources and where we're working on a charter, which I believe he started with ChadGBT.
I'd love to know from you guys, like, all right, there's an effort that's great for gathering people and getting the sort of neural network going. What do you think might be the top thing that we should solve or discuss first in such a forum?
Okay, I'm gonna name something that is adjacent, it's in the lane, but it's a bit more practical and sort of things we used to do with paper and now how do we do them with digital, which is our papers, right? Like Kim Cameron was a incredible thinker in the space. What is happening to his digital papers that tell some of the history of this industry? I'd argue the same with Vittorio. So there's a kind of like we had a tradition of people contributing their papers to libraries. You can do this in the digital world. I think it would be good to have a conversation about that.
It sort of seems like a clear boxed conversation though. You know, there's a thing called a festschrift, which is done in the academic world, which is celebrating somebody by publishing a collection of their works. And I can imagine that being a wonderful way to celebrate somebody after their passing.
Mike, do you have any thoughts? Yeah, quick side note. I'm doing a talk about Gen AI and its impact on human authenticity tomorrow. The reason I mentioned it, it's only tangentially related, but at the end of that deck is the QR code and the URL. So you can go online and find that. I think maybe my default is to rush and go find technical solutions. But I think I'm wary of that.
I think maybe stating, and we've already have an attempt at it, but stating what our base principles are seems like a, and getting consensus on that, because I don't know if we have that yet, like almost like a Hippocratic, do no harm, but the opposite, do good. What does that mean in this situation? I'm not really sure. That's a great suggestion.
I, for one, endorse it. I love the kind of design principle approach, start with your why approach. Do we have any questions from the audience? Can I borrow a microphone real quick? In what extent do you consider like GDPR is purely for natural persons? So not once you're deceased, GDPR is not active anymore for that case? How do you see that as a risk, or? I got a take on that.
I mean, this goes beyond privacy rights, and I don't think that deceased people generally are counted as having privacy rights, but this is really much more, it should be about human rights of a much deeper sort, and that needs to be sorted out, because in the digital realm, I don't think we have good mappings. Another question.
Yeah, I have a question, have a comment. I think the Pope gets to choose whether his journals are made public or get burned, right? So I think there's an aspect here of having a conversation, if you have the opportunity with the person to sort of like figure out what is their desire as it relates to the future, and how should that happen. It isn't just the family's choice, I think if you get to have the conversation or in an environment where you can do that.
I think there's a lot of practical things that are outside of technology that are a little bit like you were talking about, Kalia, which is, here are the things that you should do, like don't get rid of the phone number, don't change the bank account, whatever, because you never know when you're gonna get a check made out to your loved ones, and if they're no longer on the bank account, you can't cash it. So maybe user-centric retention policies or something like that might work. Stuff like that is really practical, it can be very helpful.
And when they're doing this, keep in mind that when they're doing this, they're not necessarily in their right mind, right? It is an impaired user because of deep trauma, probably. The parallel here, too, is for people who exist today, people are stealing it with Gen AI, their image and their voice, it's kind of the logical equivalent. Another flip side aspect that may be out of scope, I think, is that if you are declared dead by your government and you are still alive, it's very hard to get that reversed.
There's a talk at DEF CON where, yeah, there's a long story, but I'll tell you that later. So, thank you all. We have one more question here in the center, and then we'll let you out to break. Following on that, actually, a personal story, I had to go through a small procedure, and then I was thinking, what if I don't come out of this procedure?
So what I did, I sort of wrote all my passwords and everything on a piece of paper, I addressed it to my brother and kept it in the drawer, and everybody, my wife has a lot of documents, and I'm like, okay, I'm gonna go through this procedure, my wife has access to that drawer. So it's sort of thinking that way. My cousin passed away probably six months ago, and they sent through his Instagram thing, sort of, this guy passed away. So it's important, I think, to actually write it down. You come to a realization that, hold on, we are not permanent here, so take care of what's gonna happen.
And on the banking sort of check, the gentleman said, actually, he received something from a bank that says, do your KYC, otherwise we'll shut down your bank account. So the bank accounts cannot be even permanent, if you don't keep it going, but that's sort of my take on it. Thanks. Thank you for sharing that. The memento mori concept, when you have a reminder of your own mortality, it's a great reminder to go take care of some things.
Yeah, I'll just add, there was a ton of questions that were surfaced in Digital Death Day, and there's a video, actually, in the resources page of D.A.D.E. with the talk that I gave, but one of the questions is, what happens when there's more profiles of dead people online than live people online? And this hasn't happened yet, but it will.
And, you know, it's a question. We should save all these questions and join the D.A.D.E. group and contribute, because I think it's gonna be very fertile. Thank you all. Thank you. Thank you.
