A young couple in Wyoming claim that images of them were secretly snapped by a rented laptop's webcam, prompting them to file a lawsuit. NBC's Janet Shamlian reports.
People who advocate for privacy in the digital age spend a lot of conjuring up hypothetical situations to illustrate how technology could be misused to violate basic human rights.
They won't have to tax their imagination so much anymore. A new lawsuit suggests consumers who rent computers may be suffering the most dramatic kind of privacy violation.
Crystal and Brian Byrd, of Casper, Wyo, told TODAY's Janet Shamlian on Thursday that a company that sold them a rent-to-own computer spied on them, using the laptop's Webcam to take pictures of them in their home. The spying came to light when someone who worked at the firm came to their house and tried to repossess the machine.
The couple is now suing Aaron's, a nationwide chain that rents furniture and other equipment, and the franchisee that rented the machine to them, Aspen Way Enterprises. A note on the Aaron’s Web site says, "We’re taking this allegation very seriously. We are conducting a thorough investigation and diligently reaching out to our customers to address any of their concerns."
The couple's lawsuit alleges that pop-up boxes regularly appeared on the rented machine, claiming they needed to "register" software. Each time that happened, the suit claims, a Webcam image of them was taken without their knowledge, and transmitted to a firm that managed tracking software for the rental company.
The lawsuit further alleges that law enforcement investigators have been told that other Aaron's customers have been similarly tracked and seeks class action status.
Hardware tracking software has been defended in the past as a tool for helping rental companies recover stolen items. The software is chiefly used to ensure lease terms are honored, and allows the rental firm to remotely disable rented machines or put time limits on their use.
Brian Byrd, along with his wife Crystal, discusses the spyware they discovered on a rent-to-own laptop, claiming the company "invaded our house and watched us" after we paid a "ridiculous amount" of money for the computer.
Designerware LLC, which is also named in the suit for selling the tracking tools to Aspen Way Enterprises, says it encourages rental firms to get signatures from consumers declaring they know they might be tracked.
But contract or not, there isn't a person in America who thinks that their rented equipment could do this:
"I was completely taken aback by all this, to know that they were taking pictures of all us with webcam in our home, I totally felt invaded," Crystal Byrd told NBC News. "I have used (the computer) in my bra and underwear. I spent a few times checking my grades for school and I'm ready to get into the shower and I'm in my bra and underwear not thinking that anyone is watching me."
The lawsuit crystalizes the central issue in the ongoing debate about privacy: Powerful software is easy to use, and also very easy to abuse.
It's common for computer rental firms to place so-called "bricking software" on hardware they lease, said Mark Rasch, former head of the Department of Justice Computer Crime Unit. If a renter doesn't pay the bill, the computer can be remotely disabled.
Software powerful enough to remotely control a computer, however, necessarily comes with all sorts of other capabilities -- such as remotely turning on a Web cam.
"When you have this kind of powerful software, there is an enormous temptation to use it,” said Rasch, now an executive at CyberSecurity and Privacy Consulting in Virginia. “There is often little employee training, and little appreciation of the legality involved."
Without gaining express consent of those who are tracked, this kind of remote monitoring would clearly violate federal wiretap laws, the Electronic Communications Privacy Act and probably fraud laws, Rasch said. He stressed that consumers would have to provide "informed consent," which couldn’t be obtained by fine print hidden in a rental agreement.
"It's hard to invade someone's privacy more than taking pictures inside their home," he said.
WHAT YOU SHOULD KNOW
Even if the Byrd family's situation turns out to be the result of a rogue employee misbehaving, he or she will undoubtedly not be the last one.
Consumers should know that when computers are rented, it's possible that remote control software is installed and that software could be used to invade your privacy.
What to look for in the fine print: Designerware told NBC News that it recommends an addendum be added to all lease agreements. It reads, in part: "While you are renting, the computer you are renting has security, locking and tracking software installed on it. If at any time you fail to make your rental/renewal payment, your computer may be locked down and/or electronically tracked and monitored." Language like that is a sure sign that the firm you've rented from has installed powerful software on your machine.
What to do: No one spites a rental company's right to get paid or recover its equipment. But even a broken rental agreement doesn't force a consumer to forgo his or her right to privacy at home. If you have any reason to believe tracking software has been placed on a computer in your home, it makes sense to disable the Web cam when not in use. A gently placed piece of electrical tape or a band-aid will do the trick.
It's much harder to disable other monitoring components -- keylogger software or programs that "phone home" with IP addresses and locations, for example. Doing so would likely be a violation of the lease terms. Still, it's a good idea to install your own anti-virus software to make sure no unauthorized spy programs are on your machine.
Finally, awareness is key: Understand that a computer leasing company armed with tracking software can learn your whereabouts whenever you are connected to the Internet, and has the ability to know what you are typing and what websites you visit. Behave accordingly. That might mean avoiding laptop leasing agreements altogether.