- Subscribe to JETLaw
- Volume 15
- Volume 14
- Volume 13
- Volume 12
- Volume 11
- Volume 10
- Volume 9
- Volume 8
- Volume 7
- Volume 6
- Volume 5
- Volume 4
- Volume 3
- Volume 2
- Publish With JETLAW
How many times have you seen little bits of tape over laptop cameras? Ever wondered if someone was silently watching you from the little eye on top of your computer screen? For some laptop renters a little past-due on their payments, that fear became a reality. Unbeknownst to them, the company that provided the laptops had installed tracking software to help keep tabs on the location and use of the laptop in the event of non-payment. In addition to location tracking, however, it also allowed the renting companies to log keystrokes, take screenshots, and, yes, even take photos with the laptop’s on-board webcam.
The software is called “PC Rental Agent,” and these enhanced spyware features were included in the software’s “Detective Mode.” According to the FTC’s press release, by using these features the companies had obtained “user names and passwords for email accounts, social media websites, and financial institutions; Social Security numbers; medical records; private emails to doctors; bank and credit card statements; and webcam pictures of children, partially undressed individuals and intimate activities at home.” The invasion of privacy does not stop there. In addition, the software can make fake software registration windows appear, fooling users into providing personal contact information, presumably to register products like Windows. That information, rather than registering software, is instead forwarded to the renting companies.
The FTC recently settled a complaint against the software firm that created “PC Rental Agent”, DesignWare, LLC, and it’s licensees. The consent order, among other things, prohibits any of the named companies from using any monitoring technology related to the “Detective Mode” features and requires extensive disclosure of and ”affirmative consent” to geolocation tracking by the renter. The consent order also requires that the software give the user a notification that the computer is being tracked when the geolocation software is active.
User tracking is nothing new. In previous posts, we’ve detailed the FTC’s actions to prevent surreptitious user tracking through cookies, and this case appears to be in a similar vein. With the rise of web-apps, hopefully the use of native tracking software will continue to be confined to niche industries like rent-to-own, but it again points to the dangers web technology presents to user privacy. In the past, Congress has been unable to pass user privacy legislation, in large part because of the fast-changing nature of internet technology and the wide variety of generally-legitimate uses of user data.
The White House and others have asked congress to give the FTC enhanced oversight power, including the ability to level fines for first time offenses. Additional proposals for online privacy protection have included creation of a “Internet User Bill of Rights” and creation of a federal “Do Not Track” registry (similar to the anti-telemarketing “Do Not Call” list). The proposal currently picking up the most steam, and one recommended by the FTC in their Consumer Privacy Proposal, would give teeth to user’s decision not to be tracked. Some of those proposals would give users a cause of action against companies that circumvent their desire not to be tracked. DesignWare, for instance, despite the egregious breach of privacy, escaped without having to pay any penalties either to the FTC or to the users. This case should emphasize that what’s at stake is far more than some creepily accurate advertisements, but that breaches of privacy present a far more tangible harm to users.
In other news, putting a little tape over your laptop camera may not be so silly after all.
Federal Trade Commission Building - By Victoria Pickering
Fake Software Registration Page – Captured from the FTC Complaint against DesignWare