Laptop Spying: Rental Company Sued Over Alleged Webcam Spying

May 4, 2011— -- A furniture and electronics rental company accused of using rented laptops to spy on customers in their own homes has already been hit with a lawsuit, and a computer privacy expert said he wouldn't be surprised if the allegations now catch the FBI's attention.

A Wyoming couple on Tuesday filed a lawsuit seeking class action status with a district court in Pennsylvania, citing the Federal Wiretap Act and alleging that Aaron's Inc., an Atlanta-based national rent-to-own chain, secretly spied on them with a laptop rented from a local franchise.

In the suit, Brian and Crystal Byrd claim that, without their knowledge, a computer rented from Aaron's was equipped with software capable of intercepting electronic messages, taking webcam pictures and tracking keystrokes.

The Byrds said they only learned about the spyware when the store manager, incorrectly believing that the couple was in default on their agreement, stopped by their house in December 2010 with a picture of Brian Byrd taken remotely with the computer's webcam.

Several legal experts told ABC News that although the rental company may have the right to use technology to track their property or shut it down if customers don't pay, the customers need to be told when they are being monitored.

"It's really, really outrageous behavior," said Paul Ohm, an assistant professor at the University of Colorado Law School. "To me, this seems to cross all sorts of ethics lines and lines of custom."

Ohm, who said he previously worked for the U.S. Department of Justice's Computer Crime and Intellectual Property Section, said, the facts cited in the suit are "the kind of facts that might interest the FBI." An FBI spokesman for the Denver office (which covers Colorado and Wyoming) said he was not aware of the case.

Ohm said cases involving the Federal Wiretap Act can turn on fine details, such as the number of keystrokes recorded or whether the device was connected to the Internet. From what he knows of the Byrds' suit, he said it sounds like the activities, if proven true, were probably illegal and maybe even a felony.

In addition to naming Aaron's, the Byrds' lawsuit lists the Billings, Mont.-based Aspen Way Enterprises, the Aaron's franchisee that leased the laptop, and DesignerWare, LLC, the Pennsylvania-based company behind the surveillance software PC Rental Agent.

Monitoring Software Intended for Use With Law Enforcement, Company Says

In a statement released Tuesday, Aaron's, which says it has more than 1,800 company-operated and franchised stores across the country, said, "The Company believes that none of its over 1,140 Company-operated stores have used the product developed or provided by PC Rental Agent or Designerware LLC, the two vendors named in the lawsuit, and neither vendor is approved or have done any business with Aaron's, Inc."

When asked whether the company's statement applies to its franchisees, an Aaron's spokeswoman declined to provide more detail but said the matter is under investigation. Aspen Way Enterprises did not immediately respond to a request for comment from ABCNews.com.

Tim Kelly, an owner of DesignerWare, said that while the PC Rental Agent software includes a webcam surveillance feature, the company recommends that companies use it only when working with local authorities to recover stolen property.

"That's a restricted feature that can only be turned on by one person," he said, emphasizing that it's not intended to monitor or spy on anyone.

Couple: It Feels Like We Were Invaded

Marc Zwillinger, a computer privacy and security lawyer, said that although businesses may be able to activate such technology to track stolen property, they could still find themselves in trouble if they're not careful to notify customers about the possibility.

"Was the notice clear? Did the people know what they were doing?" he asked. "Was there a document that told them and they didn't read it or was it not even disclosed to them?"

The Byrds, who were not immediately available to speak with ABCNews.com, told the Associated Press that they didn't know that remote laptop spying was possible until the experience they allege.

"It feels like we were pretty much invaded, like somebody else was in our house," Byrd said. "It's a weird feeling, I can't really describe it. I had to sit down for a minute after he showed me that picture."

The University of Colorado's Ohm said that in cases involving privacy and the wiretap law, it's not a sufficient defense for an employee to say he or she was just following orders.

"It's not necessarily a defense to say my boss asked me to do this," he said.

Last year, a suburban school district in Pennsylvania paid more than $600,000 to settle two lawsuits over photos similarly taken with laptop surveillance technology. The FBI investigated the matter to see if any criminal wiretap laws were violated, but no charges were ultimately brought against the school district.

"What's so remarkable is the case in Pennsylvania was so widely reported and I thought there was going to be a shift in the security world," said Marc Rotenberg, executive director of the Electronic Privacy Information Center.

He said the Byrds' case is different but the allegations still raise privacy concerns.

"If someone is looking at you remotely and you have no idea that it's happening, that's a real concern," he said. "I think part of the problem is in the computer security industry there's a view that says it's OK to use electronic techniques to capture pictures. That just can't be right. That has to stop."