Suit against PC renter raises privacy questions

By JOE MANDAK, Associated Press Joe Mandak, Associated Press – Wed May 4, 2011

PITTSBURGH – You didn't pay your bill. We need our computer back. And here's a picture of you typing away on it, the computer rental company told a client as it tried to repossess the machine.

Those allegations appear in a federal lawsuit alleging that the firm, Atlanta-based Aaron's Inc., loaded computers with spyware to track renters' keystrokes, make screenshots and even take webcam images of them using the devices at home. The suit filed by a Wyoming couple Tuesday raises anew questions of how invasive custodians of technology should be in protecting their equipment.

Computer privacy experts said Aaron's, a major furniture rental chain, has the right to equip its computers with software it can use to shut off the devices remotely if customers stop paying their bills, but they must be told if they're being monitored.

"If I'm renting a computer ... then I have a right to know what the limitations are and I have a right to know if they're going to be collecting data from my computer," said Annie Anton, a professor and computer privacy expert with North Carolina State University.

But the couple who sued Aaron's said they had no clue the computer they rented last year was equipped with a device that could spy on them. Brian Byrd, 26, and his wife, Crystal, 24, said they didn't even realize that was possible until a store manager in Casper came to their home Dec. 22.

The manager tried to repossess the computer because he mistakenly believed the Byrds hadn't paid off their rent-to-own agreement. When Brian Byrd showed the manager a signed receipt, the manager showed Byrd a picture of Byrd using the computer — taken by the computer's webcam.

Byrd demanded to know where the picture came from, and the manager "responded that he was not supposed to disclose that Aaron's had the photograph," the lawsuit said.

Aaron's, which bills itself as the nation's leader in the sales and lease ownership of residential furniture, consumer electronics and home appliances, said the lawsuit was meritless. It said it respects its customers' privacy and hasn't authorized any of its corporate stores to install the software described in the lawsuit.

The Byrds contacted police, who, their attorney said, have determined the image was shot with the help of spying software, which the lawsuit contends is made by North East, Pa.-based Designerware LLC and is installed on all Aaron's rental computers. Designerware is also being sued in U.S. District Court in Erie.

Aaron's, with more than 1,800 company-operated and franchised stores in the United States and Canada, said the Byrds leased their computer from an independently owned and operated franchisee. Aaron's, which also manufactures furniture and bedding, said it believes that none of its more than 1,140 company-operated stores had used Designerware's product or had done any business with it.

Tim Kelly, who said he's one of the owners of Designerware, said he wasn't aware of the lawsuit and declined to comment.

Two attorneys who are experts on the relevant computer privacy laws, the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, said it's difficult to tell if either was broken, though both said the company went too far.

Peter Swire, an Ohio State professor, said using a software "kill switch" is legal because companies can protect themselves from fraud and other crimes.

"But this action sounds like it's stretching the self-defense exception pretty far," Swire said, because the software "was gathering lots of data that isn't needed for self-protection."

Further, Swire said the Computer Fraud and Abuse Act "prohibits unauthorized access to my computer over the Internet. The renter here didn't authorize this kind of access."

Fred Cate, an information law professor at Indiana University agrees that consent is required but said the real question might be: "Whose consent?"

Courts have allowed employers to record employee phone calls because the employers own the phones. Similar questions arise as digital technology becomes more omnipresent, Cate said.

"Should Google let you know they store your search terms? Should Apple let you know they store your location? Should your employer let you know 'We store your e-mail'?" Cate said.

Last year, a Philadelphia-area school district agreed to pay $610,000 to settle two lawsuits over secret photos taken on school-issued laptops, admitting it captured thousands of webcam photographs and screen shots from student laptops in a misguided effort to locate missing computers.

Harriton High School student Blake Robbins, then 15, charged in an explosive civil-rights lawsuit that the Lower Merion School District used its remote tracking technology to spy on him inside his home. Evidence unearthed in the case showed that he was photographed 400 times in a two-week period, sometimes as he slept, according to his lawyer, Mark Haltzman.

The FBI investigated whether the district broke any criminal wiretap laws, but prosecutors declined to bring any charges. The district no longer uses the tracking program.

The Byrds want the court to declare their case a class action and are seeking unspecified damages and attorneys' fees. The privacy act allows for a penalty of $10,000 or $100 per day per violation, plus punitive damages and other costs, the lawsuit said.

"It feels like we were pretty much invaded, like somebody else was in our house," Byrd said. "It's a weird feeling, I can't really describe it. I had to sit down for a minute after he showed me that picture."