Pa. suit: Furniture rental co. spies on PC users

Computer privacy experts said the firm has the right to equip its computers with software it can use to shut off the devices remotely if customers stop paying their bills, but they must be told if they're being monitored.

"If I'm renting a computer ... then I have a right to know what the limitations are and I have a right to know if they're going to be collecting data from my computer," said Annie Anton, a professor and computer privacy expert with North Carolina State University.

But the couple who sued Atlanta-based Aaron's Inc. said they had no clue the computer they rented last year was equipped with a device that could spy on them.

Brian Byrd, 26, and his 24-year-old wife, Crystal, said they didn't even realize that was possible until a store manager in Casper came to their home on Dec. 22.

The manager tried to repossess the computer because he mistakenly believed the Byrds hadn't paid off their rent-to-own agreement. When Brian Byrd showed the manager a signed receipt, the manager showed Byrd a picture of Byrd using the computer - taken by the computer's webcam.

Brian Byrd demanded to know where the picture came from, and the manager "responded that he was not supposed to disclose that Aaron's had the photograph," the lawsuit said.

Byrd told The Associated Press in an exclusive telephone interview, the day before the suit was filed Tuesday in U.S. District Court in Erie, that he believes the store manager showed him the picture because he "was just trying to throw his weight around and get an easy repossession."

That's when the Byrds contacted police who, their attorney said, have determined the image was shot with the help of spying software, which the lawsuit contends is made by North East, Pa.-based Designerware LLC and is installed on all Aaron's rental computers. Designerware is also being sued.

"It feels like we were pretty much invaded, like somebody else was in our house," Byrd told the AP. "It's a weird feeling, I can't really describe it. I had to sit down for a minute after he showed me that picture."

David Katz, an attorney at Atlanta-based Aaron's, said he was not familiar with the lawsuit, but was hoping to issue a response after reviewing a copy. The company's website says it has more than 1,500 stores in the United States and Canada.

Tim Kelly, who said he is one of the owners of Designerware, also wasn't aware of the lawsuit and declined to comment.

Two attorneys who are experts on the relevant computer privacy laws, the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, said it's difficult to tell if either was broken, though both agree the company went too far.

Peter Swire, an Ohio State professor, said using a software "kill switch" is legal because companies can protect themselves from fraud and other crimes.

"But this action sounds like it's stretching the self-defense exception pretty far," Swire said, because the software "was gathering lots of data that isn't needed for self-protection."

Further, Swire said the Computer Fraud and Abuse Act "prohibits unauthorized access to my computer over the Internet. The renter here didn't authorize this kind of access."

Fred Cate, an information law professor at Indiana University agrees that consent is required but said the real question might be: "Whose consent?"

Courts have allowed employers to record employee phone calls because the employers own the phones. Similar questions arise as digital technology becomes more omnipresent, Cate said.

"Should Google let you know they store your search terms? Should Apple let you know they store your location? Should your employer let you know 'We store your e-mail?'" Cate said.

If the Byrds' claims are true, Cate said Aaron's made an error in not notifying customers.

"We always talk about deterrence value. Well it doesn't make sense to put (the software) on there" without telling people what it can do," Cate said. "That's why we all put alarm signs in front of our houses, even if we don't have alarms."

According to the lawsuit, the PC Rental Agent product includes components soldered into the computer's motherboard or otherwise physically attached to the PC's electronics. It therefore cannot be uninstalled and can only be deactivated using a wand, the suit said.

The couple's attorney, John Robinson, of Casper, said the computer is currently in police evidence. Prosecutors in Natrona County, Wyo., did not immediately return a call about the progress of any criminal investigation.

The Byrds want the court to declare their case a class-action, and are seeking unspecified damages and attorneys' fees. The privacy act allows for a penalty of $10,000 or $100 per day per violation, plus punitive damages and other costs, the lawsuit said.

"Crystal gets online before she gets a shower and checks her grades," Brian Byrd said. "Who knows? They could print that stuff off there and take it home with them."

He added: "I've got a 5-year-old boy who runs around all day and sometimes he gets out of the tub running around for 20, 30 seconds while we're on the computer. What if they took a picture of that? I wouldn't want that kind of garbage floating around out there."

©2011 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.