BULLETIN: In announcing deeply troubling allegations today, the FTC said that seven rent-to-own companies and a software firm spied on customers who leased computers.
The customers were spied on in their own homes and at WiFi spots, the FTC alleged.
Although the companies agreed to settle the FTC’s charges, the allegations alone introduce the specter that private businesses that leased computers to financially strapped Americans licensed themselves to go into the spy business, effectively snooping on potentially hundreds of thousands of people and creating a condition under which data could be harvested to track their public movements.
Software installed on the computers gave the rental companies the ability to take remote screen shots, log keystrokes and, in some instances, use the computer’s installed webcam to snap photos not only of customers, but also of visitors in their homes, the FTC said.
“An agreement to rent a computer doesn’t give a company license to access consumers’ private emails, bank account information, and medical records, or, even worse, webcam photos of people in the privacy of their own homes,” said FTC Chairman Jon Leibowitz.
Some of the firms that put themselves in the spy business were “franchisees of Aaron’s, ColorTyme, and Premier Rental Purchase,” the FTC said.
Named in a series of FTC complaints are software firm DesignerWare LLC and its principals, Timothy Kelly and Ronald P. Koller; Aspen Way Enterprises Inc.; Watershed Development Corp.; Showplace Inc., d/b/a Showplace Rent-to-Own; J.A.G. Rents LLC, d/b/a ColorTyme; Red Zone Inc., d/b/a ColorTyme; B. Stamper Enterprises Inc., d/b/a Premier Rental Purchase; and C.A.L.M. Ventures Inc., d/b/a Premier Rental Purchase.
From an FTC statement today (italics added):
DesignerWare’s software contained a “kill switch” the rent-to-own stores could use to disable a computer if it was stolen, or if the renter failed to make timely payments. DesignerWare also had an add-on program known as “Detective Mode” that purportedly helped rent-to-own stores locate rented computers and collect late payments. DesignerWare’s software also collected data that allowed the rent-to-own operators to secretly track the location of rented computers, and thus the computers’ users.
When Detective Mode was activated, the software could log key strokes, capture screen shots and take photographs using a computer’s webcam, the FTC alleged. It also presented a fake software program registration screen that tricked consumers into providing their personal contact information.
Detailed allegations are laid out in the various complaints — and those details might be enough to make Americans’ skin crawl.
“Data gathered by DesignerWare and provided to rent-to-own stores using Detective Mode revealed private and confidential details about computer users, such as user names and passwords for email accounts, social media websites, and financial institutions; Social Security numbers; medical records; private emails to doctors; bank and credit card statements; and webcam pictures of children, partially undressed individuals, and intimate activities at home,” the FTC said.
Customers even were tracked while away from their homes, the FTC charged. From the complaint against DesignerWare (italics/bolding added):
16. Since at least September 2011, on every computer that has a wireless card
installed, PC Rental Agent automatically logs the WiFi hotspots that the wireless card either sees or uses to connect to the Internet. When a computer connects to DesignerWare’s servers, it reports the WiFi hotspot location information along with the computer’s IP address.
17. DesignerWare cross-references the information logged by a rented computer to PC Rental Agent with a publicly available list of WiFi hotspots’ physical locations and provides its licensees with street addresses for the particular WiFi hotspots viewed or accessed by the computer. The information derived from WiFi hotspot contacts can frequently pinpoint a computer’s location to a single building, and, when aggregated, can track the movements and patterns of individual computer users over time. DesignerWare provides its licensees with this location information for the ten most recent reporting cycles. DesignerWare recommends that rent-to-own stores only use this data in connection with recovering stolen property, but it does not monitor, restrict, or otherwise limit its licensees’ access to such location information.
18. DesignerWare applied its location tracking upgrade of PC Rental Agent to every computer on which PC Rental Agent was installed, without obtaining consent from, or providing notice to, the computers’ renters. After the September 2011 upgrade, in numerous instances PC Rental Agent has been installed on rented computers without the computer renter’s knowledge or consent. Thus, consumers using those computers on which PC Rental Agent is installed – who may or may not be the computers’ renters, and who may or may not be current in their lease payments – do not know that their physical location can be identified from the WiFi hotspots that their computers encounter. Nor do they know that employees of the rent-to-own stores from which their computers are rented can monitor their physical locations and the patterns of their movements.
The software also gave the rental companies the ability to dupe people into filling out a form when a “fake registration window” appeared on the computer screens, the FTC charged.
Customers, according to the FTC complaint against Watershed, for example, saw a screen that claimed their computer did not contain an “activated” copy of Microsoft Windows.
“No actual software is registered as a result of a consumer providing the requested information,” the FTC charged. “Instead, Detective Mode captures the information entered in the prompt boxes and sends the data to Watershed. In numerous instances, Watershed has used this information to find, require payment for, or repossess a computer.”
Read the FTC’s extraordinary statement and see links to the complaints by clicking here.