News

Sony BMG Settles Suit over CD Rootkit Software

• By The Associated Press
• December 20, 2006

Not only did the program itself open up a security hole on computers, but attempts to remove the software by some customers also damaged the PCs.

The settlements, announced Tuesday, cover lawsuits over CDs loaded with one of two types of copy-protection software -- known as MediaMax or XCP.

Under the terms of the separate settlements, each state will receive $750,000 in civil penalties and costs.

In addition, Sony BMG agreed to reimburse consumers whose computers were damaged while trying to uninstall the XCP software. Customers in both states can file a claim with Sony BMG to receive refunds of up to $175.

State officials estimate some 450,000 compact discs carrying the XCP software were sold in California, while about 130,000 were sold in Texas.

Customers have 180 days to file claims, which must include a description of how their computer was harmed and documentation of repair expenses.

Some who used certain antispyware software to remove the programs installed by the Sony BMG CDs ended up with a glitch that disabled their CD-ROM drives.

As part of the settlements, Sony BMG also agreed not to distribute any compact discs loaded with any copy-protection software that hinders computer users from easily locating it or removing it from their computers.

The record company also agreed to improve its disclosure practices.

"Companies that want to load their CDs with software that limits the ability to copy music should fully inform consumers about it, not hide it, and make sure it doesn't inflict security vulnerabilities on computers," California Attorney General Bill Lockyer said in a statement. "To its credit, Sony BMG learned this lesson and has stopped the practices that led to this lawsuit."

According to the complaint filed by Lockyer, Sony BMG did not disclose in the outer packaging the presence of the software, which was loaded on consumers' computers without their knowledge or consent when they played the CDs on their computers.

The software also was stored in such a way that it could not be seen on the PC without taking special measures.

In a news conference Tuesday in Austin, Texas Attorney General Greg Abbot said the settlement sent a clear message.

"Texans deserve to be protected from harmful hidden software that threatens their privacy or the security of their computers," he said.

In a statement, Sony BMG said it was pleased to reach agreements with the two states.

Sony BMG began including MediaMax on some of its discs in August 2003 and introduced XCP in January 2005. Both programs limited the number of copies of a disc that a user can make.

But word began to spread on the Internet in late 2005 that the software on the CDs potentially could make computers vulnerable to hacking. Some suggested the company was using the technology to spy on consumers.

But the company maintained it did not use any of the software to collect personal data about the consumers without their consent -- an assertion backed up by an outside company commissioned by Sony BMG to audit its use of the copy-protection software.

Sony BMG ultimately recalled the discs with XCP in November 2005 and released a way to remove the files from users' computers. Some 4.7 million CDs on 52 Sony BMG titles had been made with the technology and 2.1 million had been sold.

Tuesday's settlements close out government probes into the matter by Texas and California. The company had previously settled a class-action case over the episode.

Sony BMG is a joint venture of Sony Corp. and Bertelsmann AG.