Suit says chain put spyware in its rental PCs

PITTSBURGH – A major furniture rental chain provides its customers with computers that allow the company to track keystrokes, take screenshots and even snap webcam pictures of renters using the devices at home, a Wyoming couple said in a lawsuit Tuesday.

Computer privacy experts said the firm has the right to equip its computers with software it can use to shut off the devices remotely if customers stop paying their bills, but they must be told if they’re being monitored.

“If I’m renting a computer … then I have a right to know what the limitations are and I have a right to know if they’re going to be collecting data from my computer,” said Annie Anton, a professor and computer privacy expert with North Carolina State University.

But the couple who sued Atlanta-based Aaron’s Inc. said they had no clue the computer they rented last year was equipped with a device that could spy on them.

Brian Byrd, 26, and his 24-year-old wife, Crystal, said they didn’t even realize that was possible until a store manager in Casper came to their home on Dec. 22.

The manager tried to repossess the computer because he mistakenly believed the Byrds hadn’t paid off their rent-to-own agreement. When Brian Byrd showed the manager a signed receipt, the manager showed Byrd a picture of Byrd using the computer – taken by the computer’s webcam.

Brian Byrd demanded to know where the picture came from, and the manager “responded that he was not supposed to disclose that Aaron’s had the photograph,” the lawsuit said.

Byrd told the Associated Press in an interview, the day before the suit was filed Tuesday in U.S. District Court in Erie, that he believes the store manager showed him the picture because he “was just trying to throw his weight around and get an easy repossession.”

That’s when the Byrds contacted police who, their attorney said, have determined the image was shot with the help of spying software, which the lawsuit contends is made by North East, Pa.-based Designerware LLC and is installed on all Aaron’s rental computers. Designerware is also being sued.

“It feels like we were pretty much invaded, like somebody else was in our house,” Byrd said.

David Katz, an attorney at Atlanta-based Aaron’s, said he was not familiar with the lawsuit, but was hoping to issue a response after reviewing a copy. The company’s website says it has more than 1,500 stores in the United States and Canada.

Two attorneys who are experts on the relevant computer privacy laws, the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, said it’s difficult to tell if either was broken, though both agree the company went too far.

Peter Swire, an Ohio State professor, said using a software “kill switch” is legal because companies can protect themselves from fraud and other crimes.

“But this action sounds like it’s stretching the self-defense exception pretty far,” Swire said, because the software “was gathering lots of data that isn’t needed for self-protection.”

Further, Swire said the Computer Fraud and Abuse Act “prohibits unauthorized access to my computer over the Internet. The renter here didn’t authorize this kind of access.”

According to the lawsuit, the PC Rental Agent product includes components soldered into the computer’s motherboard or otherwise physically attached to the PC’s electronics. It therefore cannot be uninstalled and can only be deactivated using a wand, the suit said.

The Byrds want the court to declare their case a class-action, and are seeking unspecified damages and attorneys’ fees. The privacy act allows for a penalty of $10,000 or $100 per day per violation, plus punitive damages and other costs, the lawsuit said.