By JOE MANDAK Associated Press
Story Updated:
May 4, 2011 at 8:07 AM PDT
Brian and Crystal Byrd pose in front of their lawyers office on Tuesday, May 3, 2011 in Casper, Wyo.
PITTSBURGH (AP) - You didn't pay your bill. We
need our computer back. And here's a picture of you typing away on it,
the computer rental company told a client as it tried to repossess the
machine.
Those allegations appear in a federal lawsuit alleging
that the firm, Atlanta-based Aaron's Inc., loaded computers with spyware
to track renters' keystrokes, make screenshots and even take webcam
images of them using the devices at home. The suit filed by a Wyoming
couple Tuesday raises anew questions of how invasive custodians of
technology should be in protecting their equipment.
Computer
privacy experts said Aaron's, a major furniture rental chain, has the
right to equip its computers with software it can use to shut off the
devices remotely if customers stop paying their bills, but they must be
told if they're being monitored.
"If I'm renting a computer ...
then I have a right to know what the limitations are and I have a right
to know if they're going to be collecting data from my computer," said
Annie Anton, a professor and computer privacy expert with North Carolina
State University.
But the couple who sued Aaron's said they had
no clue the computer they rented last year was equipped with a device
that could spy on them. Brian Byrd, 26, and his wife, Crystal, 24, said
they didn't even realize that was possible until a store manager in
Casper came to their home Dec. 22.
The manager tried to repossess
the computer because he mistakenly believed the Byrds hadn't paid off
their rent-to-own agreement. When Brian Byrd showed the manager a signed
receipt, the manager showed Byrd a picture of Byrd using the computer -
taken by the computer's webcam.
Byrd demanded to know where the
picture came from, and the manager "responded that he was not supposed
to disclose that Aaron's had the photograph," the lawsuit said.
Aaron's,
which bills itself as the nation's leader in the sales and lease
ownership of residential furniture, consumer electronics and home
appliances, said the lawsuit was meritless. It said it respects its
customers' privacy and hasn't authorized any of its corporate stores to
install the software described in the lawsuit.
The Byrds
contacted police, who, their attorney said, have determined the image
was shot with the help of spying software, which the lawsuit contends is
made by North East, Pa.-based Designerware LLC and is installed on all
Aaron's rental computers. Designerware is also being sued in U.S.
District Court in Erie.
Aaron's, with more than 1,800
company-operated and franchised stores in the United States and Canada,
said the Byrds leased their computer from an independently owned and
operated franchisee. Aaron's, which also manufactures furniture and
bedding, said it believes that none of its more than 1,140
company-operated stores had used Designerware's product or had done any
business with it.
Tim Kelly, who said he's one of the owners of Designerware, said he wasn't aware of the lawsuit and declined to comment.
Two
attorneys who are experts on the relevant computer privacy laws, the
Electronic Communications Privacy Act and the Computer Fraud and Abuse
Act, said it's difficult to tell if either was broken, though both said
the company went too far.
Peter Swire, an Ohio State professor,
said using a software "kill switch" is legal because companies can
protect themselves from fraud and other crimes.
"But this action
sounds like it's stretching the self-defense exception pretty far,"
Swire said, because the software "was gathering lots of data that isn't
needed for self-protection."
Further, Swire said the Computer
Fraud and Abuse Act "prohibits unauthorized access to my computer over
the Internet. The renter here didn't authorize this kind of access."
Fred
Cate, an information law professor at Indiana University agrees that
consent is required but said the real question might be: "Whose
consent?"
Courts have allowed employers to record employee phone
calls because the employers own the phones. Similar questions arise as
digital technology becomes more omnipresent, Cate said.
"Should
Google let you know they store your search terms? Should Apple let you
know they store your location? Should your employer let you know 'We
store your e-mail'?" Cate said.
Last year, a Philadelphia-area
school district agreed to pay $610,000 to settle two lawsuits over
secret photos taken on school-issued laptops, admitting it captured
thousands of webcam photographs and screen shots from student laptops in
a misguided effort to locate missing computers.
Harriton High
School student Blake Robbins, then 15, charged in an explosive
civil-rights lawsuit that the Lower Merion School District used its
remote tracking technology to spy on him inside his home. Evidence
unearthed in the case showed that he was photographed 400 times in a
two-week period, sometimes as he slept, according to his lawyer, Mark
Haltzman.
The FBI investigated whether the district broke any
criminal wiretap laws, but prosecutors declined to bring any charges.
The district no longer uses the tracking program.
The Byrds want
the court to declare their case a class action and are seeking
unspecified damages and attorneys' fees. The privacy act allows for a
penalty of $10,000 or $100 per day per violation, plus punitive damages
and other costs, the lawsuit said.
"It feels like we were pretty
much invaded, like somebody else was in our house," Byrd said. "It's a
weird feeling, I can't really describe it. I had to sit down for a
minute after he showed me that picture."