Monetary Value of Passwords

Long backstory:
I have a friend who was arrested for violating parole about 4 1/2 years ago. He got out again last October, and I’ve been trying to help him get his life back together. Before he was arrested, he had Hotmail email, and possibly 1 or 2 others. (He’s asked me to set up some email accounts for him, and at this point I don’t really remember which was which.)

After he was arrested, he gave me the passwords, and asked me to change them, so that a certain person would no longer have access to his accounts. Now that he’s out, he’s been asking me for the passwords, and I’m having a hard time finding them. I did occasionally check his emails for him, but not for some time–at least a year, and possibly much longer. I suspect that all accounts (Hotmail, Yahoo, and Gmail) have been dormant long enough that everything he had has almost certainly been deleted.

He’s not a very reasonable person in some ways, and now he’s making noises about taking me to court if I don’t produce his passwords. (He’s too stubborn to simply make new accounts.) I was researching Colorado court rules, and the part about suing for return of property says that if the property can’t be returned, the court can order the defendant to pay the value of the property.

So here is my question–Has any court ruled whether or not a password for a totally free service has any monetary value?

IANA Attorney, but if someone is threatening to sue you, you probably need to contact one.

If you have the email addresses, and they are still active, why not try the standard password recovery process?

I doubt a password is considered “property” in most jurisdictions. It’s not a material thing; you can’t “return” it because it was never “given” to you in the first place. It was just a piece of information which was disclosed to you.

If the court recognizes that your friend has a valid claim against you, it’s probably not going to be under the rules you mention. More likely they’ll ask him to demonstrate actual damages resulting from his inability to check the e-mail accounts.

IANAL but I am a computer guy. Generally speaking, he does not own the account, the provider does, and would need to articulate a legitimate loss from being denied those accounts.

For example if this was a business that collected orders from this account and now refused to hand over hundreds of orders he was losing because of it, then he would probably have some justifiable action.

Under the circumstances he probably is looking for info he saved or sent there for some illegal purpose. At which point you may be implicated if you have any access at all to those accounts, or he would try to blame you if he was taking orders for drugs, etc.

Your “friend” would need to allege that you have deprived him of something that is of monetary value, such as information that is stored on the email provider’s servers or the ability to receive Paypal payments. It’s unlikely that free email accounts have any monetary value, although conceivably a distinctive email address might be worth something (e.g., sex@gmail.com, if your friend is a pornographer).

I actually went through some legal action related to information I no longer had, which a former client wanted me to give them. I won’t go into any more detail about the specifics except that it was resolved via an arbitration process rather than lawyers and judges and it did involve information you could put a dollar value on for damages.

Part of the resolution was that I was under no contractual obligation to keep that information. If I had kept it, I’d have a responsibility to turn it over, but my agreement with the client did not include indefinite storage of information.

So… just because your friend gave you passwords doesn’t necessarily give him ground to sue, even if there are some kind of damages.

I’m guessing they are not still active. Most free services (hotmail, yahoo mail, etc.) require that you log in periodically or else you lose access to the account.

I agree with this.

This is someone with at least one term in prison (fairly long - 4 years), and he’s asked you to set up multiple email accounts for him? Seems obvious that he is doing or planning some type of scam operation, given the multiple accounts.

I would certainly hesitate to become involved, even unwittingly, in such activities. Especially if he is already threatening to take you to court.

I’ve successfully returned to Yahoo and Gmail accounts after yearS of inactivity. I’ve not tried Hotmail but am told it happily deletes accounts after a few months. YMMV.