FTC Settles With Software Firm, Stores Over Use of Spyware to Track Customers

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Michael Bologna  

CHICAGO--The Federal Trade Commission announced Sept. 25 that it has agreed to settle charges that a software design firm and seven franchisees of national rent-to-own retailers used spyware technology on rented home computers to capture confidential and personal information about hundreds of thousands of customers without their knowledge or consent (In re DesignerWare LLC, FTC, File No. 1123151, proposed consent order released 9/25/12).

The FTC alleged in an administrative complaint that the retailers used a software product branded as “PC Rental Agent’’ to track the location of computers rented to consumers. But the product also had the ability to capture screenshots of consumers' personal financial and medical information, log their keystrokes, and shoot webcam pictures of consumers in their homes. FTC investigators also found evidence of some retailers using the technology in highly intrusive ways to record family activities and couples engaged in intimate relations.

According to the complaint, the spying activity was widespread in some sectors of the rent-to-own (RTO) industry over the last five years. As of August 2011, PC Rental Agent was being used on computers leased from 1,617 RTO stores in the United States, Canada, and Australia. PC Rental Agent was being used by franchisees of the national chains Aaron's, ColorTyme, and Premier Rental Purchase. The FTC's complaint asserted that PC Rental Agent was installed on approximately 420,000 computers worldwide.

Joint FTC, Illinois Attorney General Action.

“An agreement to rent a computer doesn't give a company license to access consumers' private emails, bank account information, and medical records, or, even worse, webcam photos of people in the privacy of their own homes,’’ FTC Chairman Jon Leibowitz said in the FTC's Sept. 25 statement announcing the proposed settlements. “The FTC orders today will put an end to their cyber spying.’’

The commission said that the Office of the Illinois Attorney General partnered with it in the investigation. Illinois Attorney General Lisa Madigan (D) Sept. 25 announced that she had joined the FTC in the settlement with a franchisee of Aaron's Inc., Watershed Development Corp. “There's just no justification for spying on customers,” Madigan said. “These tactics are offensive invasions of personal privacy.”

“I was dumbfounded when I heard about this case. How can any company believe that it is ok to secretly gather data such as medical records, keystrokes, and even taking webcam pictures of unknowing customers inside their homes?” Rep. Joe Barton (R-Texas), co-chair of the Bipartisan Congressional Privacy Caucus, said in a Sept. 26 statement.

“I am glad that the Federal Trade Commission has filed charges against these companies and the software designer, but I believe that we desperately need stronger privacy laws to fight against this type of behavior,” Barton said. “Everyone should have a say in how their personal information is used.”

Class Action in Pennsylvania.

The FTC's investigation focused primarily on a small Pittsburgh software firm known as DesignerWare LLC, which designed and licensed PC Rental Agent, and its two co-owners.

DesignerWare is reorganizing under Chapter 11 of the U.S. Bankruptcy Code, but PC Rental Agent is still being licensed to RTO retailers, William Webb of Edmisten, Webb & Moore in Raleigh, N.C., who represented the two DesignerWare owners, told BNA Sept. 25.

“An agreement to rent a computer doesn't give a company license to access consumers' private emails, bank account information, and medical records, or, even worse, webcam photos of people in the privacy of their own homes.’’  

Federal Trade Commission Chairman Jon Leibowitz

The software company and several of the RTO retailers are also targets in a putative consumer class action filed in the U.S. District Court for the Western District of Pennsylvania alleging that Aaron's violated the Wiretap Act and the Computer Fraud and Abuse Act by installing spyware on the computers it rented (10 PVLR 696, 5/9/11). In July 2011, the court denied the plaintiffs' motion for preliminary injunction, finding that the speculative possibility of harm to the plaintiffs fell short of the irreparable harm required to obtain a preliminary injunction (10 PVLR 1061, 7/25/11). On Sept. 14 the plaintiffs filed a second amended complaint (Byrd v. Aaron's Inc., W.D. Pa., No. 1:11-cv-00101-SJM-SPB, second amended complaint filed 9/14/11).

According to the FTC's complaint, PC Rental Agent permits RTO stores to track and recover personal computers, particularly in cases of theft or nonpayment. A key feature of the software is a “kill switch,’’ which stores can use to disable a computer if it is stolen or the renter fails to make timely payments.

But PC Rental Agent also carried an add-on program known as “Detective Mode’’ that could log keystrokes, gather screenshots, and capture photographs using a computer's webcam. In addition, Detective Mode presented the user with a fake software program registration screen that tricked consumers into providing personal contact information. Neither DesignerWare nor the RTO stores disclosed to consumers that their computers could be monitored in this fashion.

The FTC said Detective Mode was intended to assist RTO stores locate stolen computers and customers who failed to make their rental payments. But some stores began using the software in ways that compromised the privacy and personal security of consumers. In its complaint targeting DesignerWare, the commission said the software and the usage patterns of retailers violated Section 5 of the FTC Act, 15 U.S.C. § 45(a).

“Because of DesignerWare's intrusions, consumers are at risk of harm from the exposure of personal, financial account access, and medical information to strangers,’’ the FTC noted. “Consumers are harmed by DesignerWare's unwarranted invasion into their homes and lives and its capture of the private details of individual and family life, including, for example, images of visitors, children, family interactions, partially undressed individuals, and couples engaged in intimate activities. Sharing these images with third parties can cause consumers financial and physical injury and impair their peaceful enjoyment of their homes.’’

Prohibitions on Monitoring.

Under the proposed settlement orders, DesignerWare and the RTO stores would be prohibited from using monitoring software such as Detective Mode and other deceptive schemes for gathering information from consumers. The firms would also be barred from using geolocation tracking without notice and consent from consumers. The RTO stores would be prohibited from using any improperly gathered information in connection with their consumer debt collection activities.

Webb said his clients are pleased to have reached an agreement with the FTC. He noted that Detective Mode, which has been discontinued, was the only function associated with PC Rental Agent that concerned the FTC.

“We were gratified we were able to settle this without monetary penalties,’’ Webb told BNA. “The company had no intention of continuing the Detective Mode software anyway. It was leasing it out to licensees, and obviously it lost control of what some of the licensees were doing so it intended to abandon that software anyway.’’

Elizabeth Gibbs, vice president and general counsel of Aaron's, stressed that her company was not involved with the settlement. She noted that some of the firm's franchisees were implicated in the FTC's investigation but not the parent company.

“Aaron's, Inc. did not and does not use any computer spyware,’’ Gibbs said in a Sept. 25 statement to BNA. “Its franchisees are independently owned and operated.”

By Michael Bologna  

The administrative complaint against DesignerWare is available at http://www.ftc.gov/os/caselist/1123151/designerware/120925designerwarecmpt.pdf.

The proposed agreement containing consent order with DesignerWare is available at http://www.ftc.gov/os/caselist/1123151/designerware/120925designerwareagree.pdf.

The proposed consent orders with the two co-owners and the franchisees are available under “September 25, 2012” at http://www.ftc.gov/os/actions.shtm.

Full text of the second amended complaint in “Byrd v. Aaron's Inc.” is available at http://op.bna.com/pl.nsf/r?Open=kjon-8yjmur.