A scandal erupted in 2005 regarding
Sony BMG
Sony BMG Music Entertainment was an American record company owned as a 50–50 joint venture between Sony Corporation of America and Bertelsmann. The venture's successor, the revived Sony Music, is wholly owned by Sony, following their buyout o ...
's implementation of
copy protection
Copy protection, also known as content protection, copy prevention and copy restriction, describes measures to enforce copyright by preventing the reproduction of software, films, music, and other media.
Copy protection is most commonly found on ...
measures on about 22 million
CDs. When inserted into a
computer
A computer is a machine that can be programmed to Execution (computing), carry out sequences of arithmetic or logical operations (computation) automatically. Modern digital electronic computers can perform generic sets of operations known as C ...
, the CDs
installed one of two pieces of
software
Software is a set of computer programs and associated documentation and data. This is in contrast to hardware, from which the system is built and which actually performs the work.
At the lowest programming level, executable code consists ...
that provided a form of
digital rights management
Digital rights management (DRM) is the management of legal access to digital content. Various tools or technological protection measures (TPM) such as access control technologies can restrict the use of proprietary hardware and copyrighted works. ...
(DRM) by modifying the
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
to interfere with
CD copying. Neither program could easily be uninstalled, and they created
vulnerabilities
Vulnerability refers to "the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally."
A window of vulnerability (WOV) is a time frame within which defensive measures are diminished, com ...
that were exploited by unrelated
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...
. One of the programs would install and "
phone home
In computing, phoning home is a term often used to refer to the behavior of security systems that report network location, username, or other such data to another computer.
Phoning home may be useful for the proprietor in tracking a missing or st ...
" with reports on the user's
private
Private or privates may refer to:
Music
* " In Private", by Dusty Springfield from the 1990 album ''Reputation''
* Private (band), a Denmark-based band
* "Private" (Ryōko Hirosue song), from the 1999 album ''Private'', written and also recorde ...
listening habits, even if the user refused its
end-user license agreement
An end-user license agreement or EULA () is a legal contract between a software supplier and a customer or end-user, generally made available to the customer via a retailer acting as an intermediary. A EULA specifies in detail the rights and restr ...
(EULA), while the other was not mentioned in the EULA at all. Both programs contained code from several pieces of
copyleft
Copyleft is the legal technique of granting certain freedoms over copies of copyrighted works with the requirement that the same rights be preserved in derivative works. In this sense, ''freedoms'' refers to the use of the work for any purpose, ...
ed
free software
Free software or libre software is computer software distributed under terms that allow users to run the software for any purpose as well as to study, change, and distribute it and any adapted versions. Free software is a matter of liberty, no ...
in an apparent
infringement of copyright, and configured the operating system to hide the software's existence, leading to both programs being classified as
rootkit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exis ...
s.
Sony BMG initially denied that the rootkits were harmful. It then released an
uninstaller
An uninstaller, also called a deinstaller, is a variety of utility software designed to remove other software or parts of it from a computer. It is the opposite of an installer. Uninstallers are useful primarily when software components are install ...
for one of the programs that merely made the program's files visible while also installing additional software that could not be easily removed, collected an
email address
An email address identifies an email box to which messages are delivered. While early messaging systems used a variety of formats for addressing, today, email addresses follow a set of specific rules originally standardized by the Internet Engineer ...
from the user and introduced further security vulnerabilities.
Following public outcry, government investigations and
class-action lawsuit
A class action, also known as a class-action lawsuit, class suit, or representative action, is a type of lawsuit where one of the parties is a group of people who are represented collectively by a member or members of that group. The class action ...
s in 2005 and 2006, Sony BMG partially addressed the scandal with consumer settlements, a
recall
Recall may refer to:
* Recall (bugle call), a signal to stop
* Recall (information retrieval), a statistical measure
* ''ReCALL'' (journal), an academic journal about computer-assisted language learning
* Recall (memory)
* ''Recall'' (Overwatch ...
of about 10% of the affected CDs and the suspension of CD copy-protection efforts in early 2007.
Background
In August 2000, statements by
Sony Pictures Entertainment
Sony Pictures Entertainment Inc. (commonly known as Sony Pictures or SPE, and formerly known as Columbia Pictures Entertainment, Inc.) is an American diversified multinational mass media and entertainment studio conglomerate that produces, ac ...
U.S. senior vice president Steve Heckler foreshadowed the events of late 2005. Heckler told attendees at the
Americas Conference on Information Systems
The Americas Conference on Information Systems (AMCIS) is an annual conference for information systems and information technology academics and professionals sponsored by the Association for Information Systems. AMCIS is widely considered to be o ...
: "The industry will take whatever steps it needs to protect itself and protect its
revenue stream
A revenue stream is a source (or category of sources) of revenue of a company, other organization, or regional or national economy.
In business, a revenue stream is generally made up of either recurring revenue, transaction-based revenue, project ...
s ... It will not lose that revenue stream, no matter what ... Sony is going to take aggressive steps to stop this. We will develop technology that transcends the individual user. We will firewall
Napster
Napster was a peer-to-peer file sharing application. It originally launched on June 1, 1999, with an emphasis on digital audio file distribution. Audio songs shared on the service were typically encoded in the MP3 format. It was founded by Shawn ...
at source – we will block it at your cable company. We will block it at your phone company. We will block it at your
ISP
An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. ISPs can be organized in various forms, such as commercial, community-owned, non-profit, or otherwise private ...
. We will firewall it at your PC ... These strategies are being aggressively pursued because there is simply too much at stake."
In Europe, BMG created a minor scandal in 2001 when it released
Natalie Imbruglia
Natalie Jane Imbruglia ( , ; born 4 February 1975) is an Australian singer and actress. In the early 1990s, she played Beth Brennan in the Australian soap opera '' Neighbours''. Three years after leaving the programme, she began a singing car ...
's second album ''
White Lilies Island
''White Lilies Island'' is the second studio album by Australian singer Natalie Imbruglia released by RCA Records in the United Kingdom on 5 November 2001. The name of this album comes from the location of Imbruglia's home in Windsor, on a peni ...
'' without warning labels stating that the CD contained copy protection.
The CDs were eventually replaced.
[ BMG and Sony both released copy-protected versions of certain releases in certain markets in late 2001,] and a late 2002 report indicated that all BMG CDs sold in Europe would contain some form of copy protection.
Copy-protection software
The two pieces of copy-protection software at issue in the 2005–2007 scandal were included on over 22 million CDs marketed by Sony BMG, the record company formed by the 2004 merger
Mergers and acquisitions (M&A) are business transactions in which the ownership of companies, other business organizations, or their operating units are transferred to or consolidated with another company or business organization. As an aspect ...
of Sony and BMG's recorded music divisions. About two million of those CDs,[ spanning 52 titles, contained First 4 Internet (F4I)'s ]Extended Copy Protection
Extended Copy Protection (XCP) is a computer software, software package developed by the British company First 4 Internet (which on 20 November 2006, changed its name to Fortium Technologies Ltd) and sold as a copy protection or digital rights man ...
(XCP), which was installed on Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
systems after the user accepted the EULA, which made no mention of the software. The remaining 20 million CDs,[ spanning 50 titles, contained SunnComm's ]MediaMax CD-3
MediaMax CD-3 is a software package created by SunnComm which was sold as a form of copy protection for compact discs. It was used by the record label RCA Records/ BMG, and targets both Microsoft Windows and Mac OS X. Elected officials and comp ...
, which was installed on either Microsoft Windows or Mac OS X
macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac (computer), Mac computers. Within the market of ...
systems after the user was presented with the EULA, regardless of whether the user accepted it. However, Mac OS X prompted the user for confirmation when the software attempted to modify the OS, whereas Windows did not.
XCP rootkit
The scandal erupted on October 31, 2005 when Winternals
Windows Sysinternals is a website that offers technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment. Originally, the Sysinternals website (formerly known as ntinternals) was created in 19 ...
(later acquired by Microsoft Corporation
Microsoft Corporation is an American multinational corporation, multinational technology company, technology corporation producing Software, computer software, consumer electronics, personal computers, and related services headquartered at th ...
) researcher Mark Russinovich
Mark Eugene Russinovich (born December 22, 1966) is a Spanish-born American software engineer and author who serves as CTO of Microsoft Azure. He was a cofounder of software producers Winternals before it was acquired by Microsoft in 2006.
Ea ...
posted to his blog
A blog (a truncation of "weblog") is a discussion or informational website published on the World Wide Web consisting of discrete, often informal diary-style text entries (posts). Posts are typically displayed in reverse chronological order ...
a detailed description and technical analysis of F4I's XCP software that he determined had been recently installed on his computer by a Sony BMG music CD. Russinovich compared the software to a rootkit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exis ...
because of its surreptitious installation and efforts to hide its existence. He noted that the EULA
An end-user license agreement or EULA () is a legal contract between a software supplier and a customer or end-user, generally made available to the customer via a retailer acting as an intermediary. A EULA specifies in detail the rights and restr ...
does not mention the software, and he charged that the software is illegitimate and that digital rights management
Digital rights management (DRM) is the management of legal access to digital content. Various tools or technological protection measures (TPM) such as access control technologies can restrict the use of proprietary hardware and copyrighted works. ...
had "gone too far".
Anti-virus firm F-Secure
F-Secure Corporation is a global cyber security and privacy company, which has its headquarters in Helsinki, Finland.
The company has offices in Denmark, Finland, France, Germany, India, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Sweden, ...
concurred: "Although the software isn't directly malicious, the used rootkit hiding techniques are exactly the same used by malicious software
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, ...
to hide. The DRM software will cause many similar false alarms with all AV software that detect rootkits. ... Thus it is very inappropriate for commercial software to use these techniques." After public pressure, Symantec and other anti-virus vendors included detection for the rootkit in their products as well, and Microsoft announced that it would include detection and removal capabilities in its security patches.
Russinovich discovered numerous problems with XCP:
* It creates security holes that can be exploited by malicious software such as worms Worms may refer to:
*Worm, an invertebrate animal with a tube-like body and no limbs
Places
*Worms, Germany, a city
**Worms (electoral district)
*Worms, Nebraska, U.S.
*Worms im Veltlintal, the German name for Bormio, Italy
Arts and entertainme ...
or viruses
A virus is a submicroscopic infectious agent that replicates only inside the living cells of an organism. Viruses infect all life forms, from animals and plants to microorganisms, including bacteria and archaea.
Since Dmitri Ivanovsky's 1 ...
.
* It constantly runs in the background and excessively consumes system resources, slowing down the user's computer, regardless of whether a protected CD is playing.
* It employs unsafe procedures to start and stop, which could lead to system crashes.
* It has no uninstaller
An uninstaller, also called a deinstaller, is a variety of utility software designed to remove other software or parts of it from a computer. It is the opposite of an installer. Uninstallers are useful primarily when software components are install ...
, and is installed in such a way that inexpert attempts to uninstall it can cause the operating system to fail to recognize existing drives.
Soon after Russinovich's first post, several trojans
Trojan or Trojans may refer to:
* Of or from the ancient city of Troy
* Trojan language, the language of the historical Trojans
Arts and entertainment Music
* ''Les Troyens'' ('The Trojans'), an opera by Berlioz, premiered part 1863, part 1890 ...
and worms exploiting XCP's security holes appeared. Some even used the vulnerabilities to cheat in online games.
Sony BMG quickly released software to remove the rootkit component of XCP from affected Microsoft Windows computers, but after Russinovich analyzed the utility, he reported in his blog that it only exacerbated the security problems and raised further concerns about privacy. Russinovich noted that the removal program merely unmasked the hidden files installed by the rootkit but did not actually remove the rootkit. He also reported that it installed additional software that could not be uninstalled. In order to download the uninstaller, he found that it was necessary to provide an e-mail address (which the Sony BMG Privacy Policy implied was added to various bulk e-mail lists) and to install an ActiveX control
ActiveX is a deprecated software framework created by Microsoft that adapts its earlier Component Object Model (COM) and Object Linking and Embedding (OLE) technologies for content downloaded from a network, particularly from the World Wide Web. ...
containing backdoor
A back door is a door in the rear of a building. Back door may also refer to:
Arts and media
* Back Door (jazz trio), a British group
* Porta dos Fundos (literally “Back Door” in Portuguese) Brazilian comedy YouTube channel.
* Works so title ...
methods (marked as "safe for scripting" and thus prone to exploits). Microsoft later issued a killbit
Killbit is a security feature in web browsers based on Microsoft's Trident engine (such as Internet Explorer) and other ActiveX containers that respect the killbit (such as Microsoft Office). A killbit instructs an ActiveX control container neve ...
for the ActiveX control.
On November 18, 2005, Sony BMG provided a "new and improved" removal tool to remove the rootkit component of XCP from affected Microsoft Windows computers.
Legal and financial problems
Product recall
On November 15, 2005 vnunet.com announced that Sony BMG was backing out of its copy-protection software, recalling unsold CDs from all stores and allowing consumers to exchange affected CDs for versions without the software. The Electronic Frontier Foundation
The Electronic Frontier Foundation (EFF) is an international non-profit digital rights group based in San Francisco, California. The foundation was formed on 10 July 1990 by John Gilmore, John Perry Barlow and Mitch Kapor to promote Internet ci ...
compiled a partial list of CDs with XCP. Sony BMG maintained that "there were no security risks associated with the anti-piracy technology" despite numerous virus and malware reports. On November 16, 2005, US-CERT
The United States Computer Emergency Readiness Team (US-CERT) is an organization within the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Specifically, US-CERT is a branch of the Office of C ...
, part of the United States Department of Homeland Security
The United States Department of Homeland Security (DHS) is the Federal government of the United States, U.S. United States federal executive departments, federal executive department responsible for public security, roughly comparable to the I ...
, issued an advisory on XCP DRM. It said that XCP uses rootkit technology to hide certain files from the user and that the technique is a security threat to users. They also said that one of the uninstallation options provided by Sony BMG introduces further vulnerabilities. US-CERT advised: "Do not install software from sources that you do not expect to contain software, such as an audio CD."
Sony BMG announced that it had instructed retailers to remove any unsold music discs containing the software from their shelves. Internet-security expert Dan Kaminsky
Daniel Kaminsky (February 7, 1979 – April 23, 2021) was an American computer security researcher. He was a co-founder and chief scientist of WhiteOps, a computer security company. He previously worked for Cisco, Avaya, and IOActive, where h ...
estimated that XCP was in use on more than 500,000 networks.
CDs with XCP technology can be identified by the letters "XCP" printed on the back cover of the jewel case
Optical disc packaging is the packaging that accompanies CDs, DVDs, and other formats of optical discs. Most packaging is rigid or semi-rigid and designed to protect the media from scratches and other types of exposure damage.
Jewel case
A ...
for the CD according to SonyBMG's XCP FAQ.
On November 18, 2005, Reuters
Reuters ( ) is a news agency owned by Thomson Reuters Corporation. It employs around 2,500 journalists and 600 photojournalists in about 200 locations worldwide. Reuters is one of the largest news agencies in the world.
The agency was estab ...
reported that Sony BMG would exchange affected unsecure CDs for new unprotected discs as well as unprotected MP3 files. As a part of the swap program, consumers could mail their XCP-protected CDs to Sony BMG and receive an unprotected disc via return mail.
On November 29, investigators for New York attorney general Eliot Spitzer
Eliot Laurence Spitzer (born June 10, 1959) is an American politician and attorney. A member of the Democratic Party (United States), Democratic Party, he was the 54th governor of New York from 2007 until his resignation in 2008.
Spitzer was b ...
found that, despite the recall of November 15, Sony BMG CDs with XCP were still for sale at some New York City music retail outlets. Spitzer said: "It is unacceptable that more than three weeks after this serious vulnerability was revealed, these same CDs are still on shelves, during the busiest shopping days of the year, ndI strongly urge all retailers to heed the warnings issued about these products, pull them from distribution immediately, and ship them back to Sony."
The next day, Massachusetts attorney general Tom Reilly announced that Sony BMG CDs with XCP were still available in Boston
Boston (), officially the City of Boston, is the state capital and most populous city of the Commonwealth of Massachusetts, as well as the cultural and financial center of the New England region of the United States. It is the 24th- mo ...
despite the Sony BMG recall of November 15. He advised consumers not to purchase the Sony BMG CDs with XCP and said that he was conducting an investigation of Sony BMG.
Sony BMG's website offered consumers a link to "Class Action Settlement Information Regarding XCP And MediaMax Content Protection" with online claim filing and links to software updates and uninstallers. The deadline for submitting a claim was June 30, 2007. The website offered an explanation of the events as well as a list of all affected CDs.
Texas state action
On November 21, 2005, Texas attorney general Greg Abbott
Gregory Wayne Abbott (born November 13, 1957) is an American politician, attorney, and former jurist serving as the 48th governor of Texas since 2015. A member of the Republican Party (United States), Republican Party, he served as the 50th Tex ...
sued Sony BMG. The suit was the first filed by a U.S. state and was also the first filed under the state's 2005 spyware law. It alleged that the company surreptitiously installed the spyware on millions of CDs.
On December 21, 2005, Abbott added new allegations to the lawsuit, claiming that MediaMax violated the state's spyware and deceptive trade practices laws because the MediaMax software would be installed on a computer even if the user declined the license agreement authorizing the action. Abbott stated: "We keep discovering additional methods Sony used to deceive Texas consumers who thought they were simply buying music", and "Thousands of Texans are now potential victims of this deceptive game Sony played with consumers for its own purposes." In addition to violations of the Consumer Protection Against Computer Spyware Act of 2005, which allowed for civil penalties of $100,000 for each violation of the law, the alleged violations added in the updated lawsuit carried maximum penalties of $20,000 per violation. Sony was ordered to pay $750,000 in legal fees to Texas, accept customer returns of affected CDs, place a conspicuous detailed notice on its homepage, make "keyword buys" to alert consumers by advertising with Google, Yahoo! and MSN, pay up to $150 per damaged computer and agree to other remedies. Sony BMG also had to agree that it would not bring any claim that the legal settlement in any way constitutes the approval of the court.
New York and California class-action suits
Class-action suit
A class action, also known as a class-action lawsuit, class suit, or representative action, is a type of lawsuit where one of the parties is a group of people who are represented collectively by a member or members of that group. The class action ...
s were filed against Sony BMG in New York and California.
On December 30, 2005, the ''New York Times
''The New York Times'' (''the Times'', ''NYT'', or the Gray Lady) is a daily newspaper based in New York City with a worldwide readership reported in 2020 to comprise a declining 840,000 paid print subscribers, and a growing 6 million paid d ...
'' reported that Sony BMG
Sony BMG Music Entertainment was an American record company owned as a 50–50 joint venture between Sony Corporation of America and Bertelsmann. The venture's successor, the revived Sony Music, is wholly owned by Sony, following their buyout o ...
had reached a tentative settlement of the lawsuits, proposing two ways of compensating consumers who had purchased the affected CDs. According to the proposed settlement, those who had purchased an XCP CD would be paid $7.50 per purchased recording and provided the opportunity to download either a free album or three additional albums from a limited list of recordings if they elected to forgo the cash incentive. District judge Naomi Reice Buchwald entered an order tentatively approving the settlement on January 6, 2006.
The settlement was designed to compensate those whose computers were infected but were not otherwise damaged. Those who had incurred damages not addressed in the class-action suit were free to opt out of the settlement and pursue their own litigation.
A fairness hearing was held on May 22, 2006 in New York. Claims were required to be submitted by December 31, 2006. Class members who wished to be excluded from the settlement were required to have filed before May 1, 2006. Those who remained in the settlement could attend the fairness hearing at their own expense and speak on their own behalf or be represented by an attorney.
Other actions
In Italy, (an association similar to EFF
EFF or eff may refer to:
Politics
* Economic Freedom Fighters, a South African communist political party
* Economic Freedom Fund, an American political organization
* Election Fighting Fund, a British suffragist organization supporting the ear ...
) also reported the rootkit to the Financial Police, asking for an investigation under various computer crime allegations, along with a technical analysis of the rootkit.
The U.S. Department of Justice
The United States Department of Justice (DOJ), also known as the Justice Department, is a federal executive department of the United States government tasked with the enforcement of federal law and administration of justice in the United State ...
made no comment on whether it would take any criminal action against Sony. However, Stewart Baker of the Department of Homeland Security
The United States Department of Homeland Security (DHS) is the U.S. federal executive department responsible for public security, roughly comparable to the interior or home ministries of other countries. Its stated missions involve anti-terr ...
publicly admonished Sony, stating, "it's your intellectual property—it's not your computer."
On November 21, the EFF announced that it was also pursuing a lawsuit over both XCP and the SunnComm MediaMax DRM technology. The EFF lawsuit also involved issues concerning the Sony BMG end-user license agreement
An end-user license agreement or EULA () is a legal contract between a software supplier and a customer or end-user, generally made available to the customer via a retailer acting as an intermediary. A EULA specifies in detail the rights and restr ...
.
It was reported on December 24, 2005 that Florida attorney general Charlie Crist
Charles Joseph Crist Jr. (; born July 24, 1956) is an American attorney and politician who served as the 44th governor of Florida from 2007 to 2011 and as the U.S. representative for from 2017 to 2022. Crist has been a member of the Democratic ...
was investigating Sony BMG spyware.
On January 30, 2007, the U.S. Federal Trade Commission
The Federal Trade Commission (FTC) is an independent agency of the United States government whose principal mission is the enforcement of civil (non-criminal) antitrust law and the promotion of consumer protection. The FTC shares jurisdiction ov ...
(FTC) announced a settlement with Sony BMG on charges that the CD copy protection had violated federal law—Section 5(a) of the Federal Trade Commission Act
The Federal Trade Commission Act of 1914 was a United States federal law which established the Federal Trade Commission. The Act was signed into law by US President Woodrow Wilson in 1914 and outlaws unfair methods of competition and unfair acts ...
, 15 USC 45(a)—by engaging in unfair and deceptive business practices. The settlement required Sony BMG to reimburse consumers up to $150 to repair damage that resulted directly from its attempts to remove the software installed without their consent.[ The settlement also required them to provide clear and prominent disclosure on the packaging of future CDs of any limits on copying or restrictions on the use of playback devices, and the company was prohibited from installing content-protection software without obtaining consumers' authorization.][ FTC chairwoman ]Deborah Platt Majoras
Deborah Platt Majoras is the former chair of the Federal Trade Commission, appointed May 11, 2004, by President George W. Bush and sworn in on August 16, 2004. President Bush had announced his intention to appoint her to the position on July 30, ...
added: "Installations of secret software that create security risks are intrusive and unlawful. Consumers' computers belong to them, and companies must adequately disclose unexpected limitations on the customer use of their products so consumers can make informed decisions regarding whether to purchase and install that content."
Copyright infringement
Researchers found that Sony BMG and the makers of XCP also apparently infringed copyright by failing to adhere to the licensing requirements of various pieces of free and open-source software
Free and open-source software (FOSS) is a term used to refer to groups of software consisting of both free software and open-source software where anyone is freely licensed to use, copy, study, and change the software in any way, and the source ...
that was used in the program, including the LAME
Lame or LAME may refer to:
Music
* "Lame" (song) by Unwritten Law
* ''Lame'' (album) by Iame
People
* Ibrahim Lame (born 1953), Nigerian educator and politician
* Jennifer Lame (), American film editor
* Quintín Lame (1880–1967), Colombian ...
MP3
MP3 (formally MPEG-1 Audio Layer III or MPEG-2 Audio Layer III) is a coding format for digital audio developed largely by the Fraunhofer Society in Germany, with support from other digital scientists in the United States and elsewhere. Origin ...
encoder, mpglib, FAAC
FAAC or Freeware Advanced Audio Coder is a software project which includes the AAC encoder FAAC and decoder FAAD2. It supports MPEG-2 AAC as well as MPEG-4 AAC. It supports several MPEG-4 Audio object types (LC, Main, LTP for encoding and S ...
, id3lib, mpg123
mpg123 is a free and open-source audio player. It supports MPEG audio formats, including MP3.
As a console application, it has no graphical user interface.
mpg123's Assembly code is optimized with SIMD instructions to improve the performance ...
and the VLC media player
VLC media player (previously the VideoLAN Client and commonly known as simply VLC) is a free and open-source, portable, cross-platform media player software and streaming media server developed by the VideoLAN project. VLC is available for desk ...
.
In January 2006, the developers of LAME posted an open letter stating that they expected "appropriate action" by Sony BMG, but that the developers had no plans to investigate or take action over the apparent violation of LAME's source-code license.
Company and press reports
Russinovich's report was discussed on popular blogs almost immediately following its release.
NPR
National Public Radio (NPR, stylized in all lowercase) is an American privately and state funded nonprofit media organization headquartered in Washington, D.C., with its NPR West headquarters in Culver City, California. It differs from other ...
was one of the first major news outlets to report on the scandal on November 4, 2005. Thomas Hesse, Sony BMG's president of global digital business, said: "Most people, I think, don't even know what a rootkit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exis ...
is, so why should they care about it?"
In a November 7, 2005 article, vnunet.com summarized Russinovich's findings and urged consumers to temporarily avoid purchasing Sony BMG music CDs. The following day, ''The Boston Globe
''The Boston Globe'' is an American daily newspaper founded and based in Boston, Massachusetts. The newspaper has won a total of 27 Pulitzer Prizes, and has a total circulation of close to 300,000 print and digital subscribers. ''The Boston Glob ...
'' classified the software as spyware
Spyware (a portmanteau for spying software) is software with malicious behaviour that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their privac ...
, and Computer Associates' Security Management unit VP Steve Curry confirmed that the rootkit communicates personal information from consumers' computers (the CD being played and the user's IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
) to Sony BMG. The methods used by the software to avoid detection were likened to those used by data thieves.
On November 8, 2005, Computer Associates
CA Technologies, formerly known as CA, Inc. and Computer Associates International, Inc., is an American multinational corporation headquartered in New York City. It is primarily known for its business-to-business (B2B) software with a product po ...
classified Sony BMG's software as spyware and provided tools for its removal. Russinovich said: "This is a step they should have taken immediately."
The first virus to exploit Sony BMG's stealth technology to make malicious files invisible to both the user and antivirus programs surfaced on November 10, 2005. One day later, ''Yahoo! News
Yahoo! News is a news website that originated as an internet-based news aggregator by Yahoo!. The site was created by a Yahoo! software engineer named Brad Clawsie in August 1996. Articles originally came from news services such as the Associate ...
'' announced that Sony BMG had suspended further distribution of the controversial technology.
ZDNet News
ZDNET is a business technology news website owned and operated by Red Ventures.
The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication.
Hist ...
wrote: "The latest risk is from an uninstaller program distributed by SunnComm Technologies, a company that provides copy protection on other Sony BMG releases." The uninstall program obeys commands sent to it allowing others "to take control of PCs where the uninstaller has been used."
On December 6, 2005, Sony BMG revealed that 5.7 million CDs spanning 27 titles were shipped with MediaMax 5 software. The company announced the availability of a new software patch to prevent a potential security breach in consumers' computers.
Sony BMG in Australia issued a press release indicating that no Sony BMG titles manufactured in Australia contained copy protection.
See also
* Defective by Design
Defective by Design (DBD) is an anti-DRM initiative by the Free Software Foundation. Digital rights management (DRM) technology restricts users' ability to freely use their purchased movies, music, literature, software, and hardware in ways the ...
* List of compact discs sold with Extended Copy Protection
The following compact discs, sold by Sony BMG Music Entertainment, Sony BMG, were shipped with the computer software known as Extended Copy Protection (XCP). As a result, any Microsoft Windows computer that has been used to play these CDs is likel ...
* List of compact discs sold with MediaMax CD-3
The following compact discs were sold with a software package for copy-protection known as MediaMax CD-3, created by SunnComm and used by the record label RCA Records
RCA Records is an American record label currently owned by Sony Music E ...
References
Sources
"Sony Music CDs Under Fire from Privacy Advocates"
National Public Radio
National Public Radio (NPR, stylized in all lowercase) is an American privately and state funded nonprofit media organization headquartered in Washington, D.C., with its NPR West headquarters in Culver City, California. It differs from other n ...
, 2005-11-04
* Bergstein, Brian (2005-11-18)
"Copy protection an experiment in progress"
''Seattlepi.com''.
* Halderman, J. Alex, and Felten, Edward
"Lessons from the Sony CD DRM Episode"
(PDF
Portable Document Format (PDF), standardized as ISO 32000, is a file format developed by Adobe in 1992 to present documents, including text formatting and images, in a manner independent of application software, hardware, and operating systems. ...
format), ''Center for Information Technology Policy,'' Department of Computer Science, Princeton University, 2006-02-14.
* Wikinews: Sony's DRM protected CDs install Windows rootkits
* Gartner
Sony BMG DRM a Public-Relations and Technology Failure
- 2005-11-12 MP3 Newswire Founded in 1998, the same year as MP3.com, MP3 Newswire is the oldest active news site devoted to digital media technology. Notable for its series of essays that chronicled the rise of digital music and the Internet’s acrimonious relationship with ...
article
External links
Academic article examining the market, legal, and technological factors that motivated Sony BMG's DRM strategy
SonySuit.Com - Tracking The Sony BMG XCP and SunComm Lawsuits
''Boing Boing.''
In-depth analysis and references
Groklaw
''Groklaw'' is a website that covered legal news of interest to the free and open source software community. Started as a law blog on May 16, 2003 by paralegal Pamela Jones (''"PJ"''), it covered issues such as the SCO-Linux lawsuits, the EU ...
Revisiting Sony BMG Rootkit Scandal 10 years later
{{DEFAULTSORT:Sony Bmg Cd Copy Protection Scandal
2005 scandals
Digital rights management
Sony
Corporate scandals
Business ethics cases
Corporate crime
Rootkits
Windows trojans
Compact Disc and DVD copy protection