How many times have you seen little bits of tape over laptop cameras?  Ever wondered if someone was silently watching you from the little eye on top of your computer screen?  For some laptop renters a little past-due on their payments, that fear became a reality.  Unbeknownst to them, the company that provided the laptops had installed tracking software to help keep tabs on the location and use of the laptop in the event of non-payment.  In addition to location tracking, however, it also allowed the renting companies to log keystrokes, take screenshots, and, yes, even take photos with the laptop’s on-board webcam.

The software is called “PC Rental Agent,” and these enhanced spyware features were included in the software’s “Detective Mode.”  According to the FTC’s press release, by using these features the companies had obtained “user names and passwords for email accounts, social media websites, and financial institutions; Social Security numbers; medical records; private emails to doctors; bank and credit card statements; and webcam pictures of children, partially undressed individuals and intimate activities at home.”  The invasion of privacy does not stop there.  In addition, the software can make fake software registration windows appear, fooling users into providing personal contact information, presumably to register products like Windows.  That information, rather than registering software, is instead forwarded to the renting companies.

The FTC recently settled a complaint against the software firm that created “PC Rental Agent”, DesignWare, LLC, and it’s licensees.  The consent order, among other things, prohibits any of the named companies from using any monitoring technology related to the “Detective Mode” features and requires extensive disclosure of and ”affirmative consent” to geolocation tracking by the renter.  The consent order also requires that the software give the user a notification that the computer is being tracked when the geolocation software is active.

User tracking is nothing new.  In previous posts, we’ve detailed the FTC’s actions to prevent surreptitious user tracking through cookies, and this case appears to be in a similar vein.  With the rise of web-apps, hopefully the use of native tracking software will continue to be confined to niche industries like rent-to-own, but it again points to the dangers web technology presents to user privacy.  In the past, Congress has been unable to pass user privacy legislation, in large part because of the fast-changing nature of internet technology and the wide variety of generally-legitimate uses of user data.

The White House and others have asked congress to give the FTC enhanced oversight power, including the ability to level fines for first time offenses.  Additional proposals for online privacy protection have included creation of a “Internet User Bill of Rights” and creation of a federal “Do Not Track” registry (similar to the anti-telemarketing “Do Not Call” list).  The proposal currently picking up the most steam, and one recommended by the FTC in their Consumer Privacy Proposal, would give teeth to user’s decision not to be tracked.  Some of those proposals would give users a cause of action against companies that circumvent their desire not to be tracked.  DesignWare, for instance, despite the egregious breach of privacy, escaped without having to pay any penalties either to the FTC or to the users.  This case should emphasize that what’s at stake is far more than some creepily accurate advertisements, but that breaches of privacy present a far more tangible harm to users.

In other news, putting a little tape over your laptop camera may not be so silly after all.

Parker Hancock

 

Image Sources:

Federal Trade Commission Building - By Victoria Pickering

Fake Software Registration Page – Captured from the FTC Complaint against DesignWare

Tagged with:
 

3 Responses to FTC Settles Complaint Over Customer-Spying

  1. JL says:

    While this technology is troubling for all user demographics, I am really concerned about its impacts on children. Websites and service providers that covertly track children—even if solely for advertising purposes—have been slammed for exposing children to potential identity theft and even sexual predation (if private information ends up in the wrong hands). “Detective Mode” operations appear significantly more invasive than traditional cookie-based tracking. Hopefully the FTC will formally address these “enhanced spyware features” when it formally updates the Children’s Online Privacy Protection Rule.

  2. Hunter says:

    1. I’m glad to know I’m not totally crazy for having taped up my webcam.

    2. How do you think the FTC would have approached PC Rental Agent if it’s capabilities had been clearly and obviously disclosed in the rental agreements? Would there be any difference if it were mentioned in the standard jumbled, small print EULA disclosure?

  3. Ryan says:

    There was another lawsuit, which settled, regarding a school spying on its students. The private school in Philadelphia gave its students laptops with webcams. It apparently then suspended one student for an act he did in his bedroom, leading the students, and parents, to realize they were being spied on by the webcam on the computer.

    http://www.nbcphiladelphia.com/news/local/School-Spies-on-Students-at-Home-with-Webcams-Suit-84712852.html

    http://docs.justia.com/cases/federal/district-courts/pennsylvania/paedce/2:2010cv00665/347863/108/