There’s a new law in Colorado regarding digital assets, and we affectionately refer to the law as RUFADA. That stands for the Revised Uniform Fiduciary Access to Digital Assets Act. It is a mouthful, but what this act is trying to do is it’s trying to reverse the issues that federal law has presented.
Under federal law it’s actually illegal for somebody to get access to your digital access using your username and password. Say I become incapacitated, and my brother decides that he’s going to use my username and password to get access to my email. He’s not doing that out of malice or anything bad. He’s trying to find out what business hasn’t been taken care of. Under federal law it is illegal, whether he’s the agent or not, to get access to my accounts. He’s not allowed to use my username or password. He’s impersonating me, and he’s not allowed to do that.
We have a hole in federal law. There’s no exception for who can get access if you are incapacitated or if you’ve died. So, we need a way to fix that. How do we get access in those situations? Colorado law passed this act, and the act is very specific in who can get access. We really haven’t had this come up yet, because it’s still a fairly new law, but the issue becomes: What’s the jurisdiction for digital assets? They’re living in the digital abyss … We have Facebook, emails … but what law controls? Is it federal? Is it state? Is it international law?
Although Colorado law allows these individuals to get access, there isn’t necessarily guaranteed access, because if you were to try to get into Google, Google could very easily say to you, “Well, under federal law this is illegal. We won’t give you access to this information.” That’s when you would try to argue under Colorado law, “I do have the authority to get in.” What’s to happen with that? We’ll have to see.
