Rent-to-own laptops were spying on users

The US Federal Trade Commission (FTC) has settled a case with several computer rent-to-own companies and a software maker over their use of a program which spied on as many as 420,000 users of the computers. The terms of the settlement will ban the companies from using monitoring software, deceiving customers into giving up information or using geo-location to track users. "The FTC orders today will put an end to their cyber spying" said Jon Leobowitz, FTC Chairman.

The software for rental companies from DesignerWare included a "Detective Mode", a spyware application that, according to the FTC's complaint, could activate the webcam of a laptop and take pictures and log keystrokes of user activity. The software also regularly presented a fake registration screen designed to trick users into entering personal information. The data from this application was then transmitted to DesignerWare where it was then passed on to the rent-to-own companies.

DesignerWare sold the service, which included a "kill switch" to disable the machine, to be activated if a computer was stolen or a renter was late making payments. But the data gathered also contained user names and passwords for email accounts, social media web sites and financial institutions, said the FTC. The complaint also noted that social security numbers, private email with doctors, bank and credit card statements, and web cam pictures of "children, partially undressed individuals and intimate activities at home" were collected. The complaint against DesignerWare said that its licensing and enabling of "Detective Mode" was providing the rent-to-own companies with the means to break the law.

The FTC is limited in its actions, telling Wired, "We don't have criminal authority. We only have civil authority" and, as this was a first violation of the FTC act, it cannot impose fines on the companies. Instead, the companies will be monitored by the FTC for compliance with the ban on using the software, or, in the case of DesignerWare, licensing it, for the next 20 years. The FTC can refer criminal activity to the police authorities, but has a policy of not disclosing whether it has done so.

(djwm)