Perspective: Sony BMG faces the music

Sony BMG Music Entertainment, feeling the legal heat over the copy-protection software in millions of its music CDs, last week was sued in both Texas and California.

By exploiting a hole in the copy protection code, virus writers could modify an old Trojan horse to take advantage of the powerful, though inadvertent, shielding provided by the Sony software. Sony eventually announced that, as part of a review of its digital rights management strategy, it would suspend production of CDs that contain this particular copy-protection technology.

Too late to avoid the legal blowback. In Texas, the attorney general is seeking $100,000 for each alleged violation of the state's "Consumer Protection Against Computer Spyware Act." The California lawsuit is a class action that seeks compensatory damages, disgorgement of profits and punitive damages.

The Electronic Frontier Foundation, which is co-counsel in the California case, says that Sony BMG caused damage by virtue of the First4Internet XCP software and the SunnComm Technologies MediaMax tool included in more than 24 million of Sony's music CDs.

According to the EFF, the software was developed in such a way as to conceal its presence and operation.

The XCP and SunnComm technologies were unwittingly installed by millions of music customers when they used the Sony CDs in their Windows-based computers. Researchers found that the XCP technology was designed to include many of the qualities of a "rootkit." According to the EFF, the software was developed to conceal its presence and operation from the computer's owner. Once installed, the code degraded system performance, opened new security vulnerabilities, and installed updates through an Internet connection to Sony BMG's servers, EFF alleges.

The nature of a rootkit makes it extremely difficult to remove. That often leaves reformatting the computer's hard drive as the only solution. When Sony BMG offered a program to uninstall the XCP software, the installer reportedly opened even more security vulnerabilities in users' machines.

EFF argues that the MediaMax software installed on more than 20 million CDs is similarly problematic. It apparently installs files on the users' computers even if they click "no" on the End User License Agreement, and it allegedly does not include a means to fully uninstall the program.

In addition, EFF says the software transmits data about users to SunnComm through an Internet connection whenever purchasers listen to CDs, allowing the tracking of listening habits--even though the license states that the software will not be used to collect personal information.

When users repeatedly requested an uninstaller for the MediaMax software, EFF maintains that they were eventually provided one, but only after they had provided more personal information. The group also asserts that security researchers have determined that SunnComm's uninstaller creates significant security risks for users, as the XCP uninstaller did.

Satisfaction shortfall
EFF has expressed satisfaction that Sony BMG has taken steps in acknowledging the security risks caused by the CDs with XCP software, including a recall of the infected discs. However, the group maintains the measures still fall short of what Sony needs to do to fix the problems caused to customers. "Sony BMG has failed entirely to respond to concerns about MediaMax, which affects over 20 million CDs--10 times the number of CDs as the XCP software," EFF declared.

Unless plaintiffs' attorneys are satisfied by remedial and other steps taken by Sony BMG, the litigation will proceed. Of course, Sony BMG will be entitled to its day in court, and it will be allowed to present any available defenses to seek to excuse its conduct.

Biography
Eric J. Sinrod is a partner in the San Francisco office of Duane Morris. His focus includes information technology and intellectual-property disputes. To receive his weekly columns, send an e-mail to [e-mail] with "Subscribe" in the subject line. This column is prepared and published for informational purposes only, and it should not be construed as legal advice. The views expressed in this column are those of the author and do not necessarily reflect the views of the author's law firm or its individual partners.

More Perspectives

Sony

Sony is doomed. Flat out.

[Christopher Hall]

Wishful Thinking

To the tech community, sure, Sony has lost a lot of credibility. But the fact that everyone seems to overlook is that the majority of the public simply doesn't care.

Whether you believe it or not, this changes the game very little.

[thedreaming]

Doubt that

Sony is too big of a company to be killed by something so simple. Even with the class action suits currently againts them and the few trojan/worms that use their software to hide from antivirus programs, they will prevail.

I just hope they get the message. They have the right to protect their intellectual property, but they just don't have the right to touch my computer.