Aaron Bros installs spyware on rentals

PITTSBURGH — A major furniture rental chain provides its customers with computers that allow it to track keystrokes, take screenshots and even snap webcam pictures of renters using the devices at home, a Wyoming couple said in a lawsuit Tuesday.

Computer privacy experts said the firm has the right to equip its computers with software it can use to shut off the devices remotely if customers stop paying their bills, but they must be told if they're being monitored.

"If I'm renting a computer ... then I have a right to know what the limitations are and I have a right to know if they're going to be collecting data from my computer," said Annie Anton, a professor and computer privacy expert with North Carolina State University.

But the couple who sued Atlanta-based Aaron's Inc. said they had no clue the computer they rented last year was equipped with a device that could spy on them. Brian Byrd, 26, and his wife, Crystal, 24, said they didn't even realize that was possible until a store manager in Casper came to their home on Dec. 22.
The manager tried to repossess the computer because he mistakenly believed the Byrds hadn't paid off their rent-to-own agreement. When Brian Byrd showed the manager a signed receipt, the manager showed Byrd a picture of Byrd using the computer — taken by the computer's webcam.

Byrd demanded to know where the picture came from, and the manager "responded that he was not supposed to disclose that Aaron's had the photograph," the lawsuit said.

Aaron's, which bills itself as the nation's leader in the sales and lease ownership of residential furniture, consumer electronics and home appliances, said the lawsuit was meritless. It said it respects its customers' privacy and hasn't authorized any of its corporate stores to install the software described in the lawsuit.

Byrd told The Associated Press by telephone the day before the suit was filed Tuesday in U.S. District Court in Erie that he believes the store manager showed him the picture because he "was just trying to throw his weight around and get an easy repossession."

That's when the Byrds contacted police, who, their attorney said, have determined the image was shot with the help of spying software, which the lawsuit contends is made by North East, Pa.-based Designerware LLC and is installed on all Aaron's rental computers. Designerware is also being sued.

"It feels like we were pretty much invaded, like somebody else was in our house," Byrd told the AP. "It's a weird feeling, I can't really describe it. I had to sit down for a minute after he showed me that picture."

Aaron's, which also manufactures furniture and bedding, said it believes that none of its more than 1,140 company-operated stores had used Designerware's product or had done any business with it.

Aaron's, with more than 1,800 company-operated and franchised stores in the United States and Canada, said the Byrds leased their computer from an independently owned and operated franchisee.

Tim Kelly, who said he's one of the owners of Designerware, said he wasn't aware of the lawsuit and declined to comment.

Two attorneys who are experts on the relevant computer privacy laws, the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, said it's difficult to tell if either was broken, though both said the company went too far.

Peter Swire, an Ohio State professor, said using a software "kill switch" is legal because companies can protect themselves from fraud and other crimes.

"But this action sounds like it's stretching the self-defense exception pretty far," Swire said, because the software "was gathering lots of data that isn't needed for self-protection."

Further, Swire said the Computer Fraud and Abuse Act "prohibits unauthorized access to my computer over the Internet. The renter here didn't authorize this kind of access."

Fred Cate, an information law professor at Indiana University agrees that consent is required but said the real question might be: "Whose consent?"

Courts have allowed employers to record employee phone calls because the employers own the phones. Similar questions arise as digital technology becomes more omnipresent, Cate said.

"Should Google let you know they store your search terms? Should Apple let you know they store your location? Should your employer let you know 'We store your e-mail?'" Cate said.

If the Byrds' claims are true, Cate said Aaron's made an error in not notifying customers.

"We always talk about deterrence value. Well it doesn't make sense to put (the software) on there" without telling people what it can do," Cate said. "That's why we all put alarm signs in front of our houses, even if we don't have alarms."

According to the lawsuit, the PC Rental Agent product includes components soldered into the computer's motherboard or otherwise physically attached to the PC's electronics. It therefore cannot be uninstalled and can only be deactivated using a wand, the suit said.

The couple's attorney, John Robinson, of Casper, said the computer is currently in police evidence. Prosecutors in Natrona County, Wyo., did not immediately return a call about the progress of any criminal investigation.

The Byrds want the court to declare their case a class action and are seeking unspecified damages and attorneys' fees. The privacy act allows for a penalty of $10,000 or $100 per day per violation, plus punitive damages and other costs, the lawsuit said.

"Crystal gets online before she gets a shower and checks her grades," Brian Byrd said. "Who knows? They could print that stuff off there and take it home with them."

He added: "I've got a 5-year-old boy who runs around all day and sometimes he gets out of the tub running around for 20, 30 seconds while we're on the computer. What if they took a picture of that? I wouldn't want that kind of garbage floating around out there."

http://www.ajc.com/business/pa-suit-furniture-rental-933410.html