Andrea Hirsch
Andrea Hirsch says the secret collection of privileged data from lawyers “is one of the highest levels of privacy breaches you can have.” (John Disney/Daily Report)

The email, addressed to Colorado lawyer Michael Peterson, appeared to be a routine—but confidential—exchange over a new client who was happy that Peterson was taking her case.

The client mentioned “several more bills that have popped up that need to be taken care of” and closed by saying, “I know you are crazy busy, thank you for everything.”

That email was among more than 4,700 screen shots captured between 2010 and 2011 by a spyware program that Peterson and another lawyer claim Atlanta-based Aaron’s Inc. installed on computers the lawyers rented and then purchased.

The lawyers have sued Aaron’s and an Aaron’s franchisee in federal court in Atlanta, contending that the rental companies violated their attorney-client privilege while secretly mining the computers for data.

“The predominant issues in this case are whether [the] defendants have violated the law by the unauthorized, inappropriate and undisclosed invasion of privacy … by virtue of the secret nature of the spying device and software,” the suit contends. Individual customers “may not be aware that they have been injured and are thus unable to prosecute individual claims or take appropriate steps to protect their personal information.”

Peterson and Matthew Lyons of Tulsa, Okla., each leased computers from Aaron’s franchisee Aspen Way Enterprises Inc. and later purchased the equipment. The surveillance was not disclosed to any customers who have rented, leased or bought computers through Aaron’s franchises, the suit says.

The attorneys are asking that the case be litigated as a class action on behalf of all of Aaron’s computer rental or lease-to-purchase customers. Attorney Andrea Hirsch of the Atlanta offices of Herman Gerel, one of a team of lawyers from three firms that represent Peterson and Lyon, told the Daily Report on Thursday that documents captured by the spyware included “the most private and sensitive information” that clients had discussed with the lawyers.

Other law firms representing potential class members include Levin, Fishbein, Sedran and Berman in Philadelphia and the Spence Law Firm in Wyoming.

“We thought the breach was particularly worrisome,” said Hirsch. “These were attorney-client privileged documents. As attorneys, we thought this is one of the highest levels of privacy breaches you can have.”

Litigation stemming from the spyware allegations is already pending against Aaron’s and a number of its franchise rental stores in the Western District of Pennsylvania and in another case filed in the Northern District of Georgia in Atlanta last April. Both of those suits are also seeking class action status on behalf of customers who rented or bought computer equipment with the embedded spyware.

In the Pennsylvania case, Aaron’s—represented by a team of attorneys from Atlanta’s Alston & Bird and Pennsylvania firm Knox, McLaughlin, Gornall & Sennett—persuaded a trial judge to block the suit from going forward as a class action. The U.S. Court of Appeals for the Third Circuit on June 19 agreed to hear an interlocutory appeal.

Aaron’s senior vice president and general counsel, Robert Kamerschen, could not be reached for comment Thursday. An Aaron’s spokeswoman said Friday that Aaron’s does not comment on pending or current litigation.

Hirsch, the Atlanta lawyer representing the latest plaintiffs, said Robinson and Lyons were unaware that Aaron’s had gained access to personal and firm information until she and her cocounsel contacted them at the direction of the judge presiding over the Pennsylvania case. Aaron’s, she said, “has refused to notify anyone they have been spied on or that their information has been compromised. … These attorneys were very upset when they learned about it.”

According to the customers’ suits, Aaron’s and its franchises since 2007 have spied on their computer rental and lease-to-purchase customers using a software program known as PC Rental Agent embedded in the computers.

Hirsch said that when customers were late paying their fees, company or franchise employees “would turn on this spyware and use it to collect on late payments. … The official line of the franchises is that they only used it when a computer was stolen. That’s not what happened in reality. They were using it a lot more than that.”

According to a complaint in the Pennsylvania litigation, an Aaron’s franchisee used the spyware in at least one case to photograph via the computer’s webcam a customer. Then an agent of the franchisee went to the customer’s home, telling him that he owed rental fees and that the agent had a photograph of Byrd taken by the webcam and a screen shot showing that he was playing Internet poker as proof that the customer had the computer in his custody and was still using it. The customer and his wife are now plaintiffs in the Pennsylvania litigation; they say he had bought the computer on a lease agreement and had paid the bill in full.

Hirsch estimated that Aaron’s has culled more than 500,000 images, emails, keystrokes and documents from computers either rented or bought by its customers via PC Rental Agent. The software, distributed by DesignerWare LLC, has a feature, “Detective Mode,” that will activate a computer’s webcam and capture video of Aaron’s customers or others who might use the computer. Once in that mode, Aaron’s and its franchisees could also capture computer screen shots, keystrokes and other data, which was then forwarded first to DesignerWare and then to Aaron’s in email transmissions as frequently as two minutes apart, according to the suit.

The Pennsylvania suit claims that computers in that mode have taken photos of children, individuals not fully clothed and computer users engaged in sexual activities within camera range of the computer and its webcam. All, according to the suits, constitute an invasion of privacy and computer trespass—a civil liability that is also a state crime.

PC Rental Agent is “generally undetectable” to a computer’s users, according to the lawyers’ suit. It also claims that when the software is installed, a computer’s factory-installed anti-virus software is deleted. The program also allows Aaron’s or its franchisees to remotely lock down a computer at will and that when a computer is locked down, any data in use at the time is destroyed, the suit says.

Beginning in 2011, according to that suit, Aspen Way employed a new version of PC Rental Agent that also allowed it to physically track its computer customer locations through Google Maps by programming the computers to log on to Wi-Fi hot spots, map those locations and then send the information along with the computer’s Internet provider address to DesignerWare.

According to the suit, the information frequently can pinpoint a computer’s location to a single building and, over time, can point to patterns in the movements of individual users.

The suit also said PC Rental Agent software has allowed Aaron’s and its franchisees to collect, transmit and store customers’ personal and financial information—including credit and debit card numbers, card expiration dates, security codes, PIN numbers, passwords, Social Security numbers, birth dates, the identities of children and the children’s personal and school records, tax returns, personal health information, employment records, bank account records, email addresses, login credentials, answers to security questions, and private communications with health care providers, therapists, attorneys and other confidants.

The suit also claims that the personal data Aaron’s has gathered from its customers via its computers has been circulated without encryption over the Internet and stored on numerous computers across the country.

It also contends that Aaron’s has chosen not to notify any customers of the existence of PC Rental Agent, its installation on computer equipment they rented or that the program’s detective mode may have been activated.

Another federal suit filed in Atlanta in April over Aaron’s spyware makes allegations virtually identical to those found in the lawyers’ complaint. In that case, Aaron’s franchisee SEI/Aaron’s acknowledged that although the software’s detective mode, when activated, is capable of collecting personal information from its computers, neither the company nor any of its franchisees abused or misused the information.

The company also admitted in its answer to the complaint that it had not informed its customers of the allegations about the uses and capabilities of PC Rental and “detective mode” on computers they either rented or bought from Aaron’s.

Hirsch said that after the Pennsylvania suit was filed, and the U.S. Federal Trade Commission began investigating Aaron’s, the company finally called a halt to its use of the software program. Last October, the FTC announced it had reached an agreement with Aaron’s that the company is barred from using monitoring technology to gather consumer information from its rental computers or to track the location of those computers without the express consent of its customers at the time of rental.

The company was also barred from installing or activating the spyware without a clear notification about the software program to its customers. Hirsch said that as a result of the ongoing litigation, “At least the consumers are being told that this software is being put on computers they are renting.”

But, she added, “There are still hundreds of people who have no idea they have been spied on.”