Legal Woes Mount for Sony BMG Because Of Its CD Software

Sony BMG Music Entertainment (Sony BMG) is feeling some recent legal heat with respect to software it included in millions of music CDs. Last week alone, Sony BMG was sued in Texas and in California.

The case in Texas has been brought by the State's Attorney General and seeks $100,000 for each and every alleged violation of Texas's Consumer Protection Against Computer Spyware Act. The California case is a class action that seeks compensatory damages, disgorgement of profits, and punitive damages.

Background

According to the Electronic Frontier Foundation (EFF), co-counsel in the California case, Sony BMG has damaged consumers by including First4Internet XCP (XCP) and SunnComm MediaMax software in more than 24 millon music CDs.

As EFF more specifically describes , XCP and SunnComm were installed on the computers of millions of unknowing music customers when they used their CDs on machines that run the Windows operating system. Researchers have shown that the XCP technology was designed to have many of the qualities of a "rootkit," according to EFF. Indeed, EFF maintains that "it was written with the intent of concealing its presence and operation from the owner of the computer, and once installed, it degrades the performance of the machine, opens new security vulnerabilities, and installs updates through an Internet connection to Sony BMG's servers."

The nature of a rootkit makes it extremely difficult to remove, as described by EFF, often leaving reformatting the computer's hard drive as the only solution. When Sony BMG offered a program to uninstall the XCP software, EFF asserts that researchers found that the installer itself opened even more security vulnerabilities in users' machines.

EFF argues that the MediaMax software installed on over 20 million CDs "has different, but similarly troubling problems." It apparently installs files on the users' computers even if they click "no" on the End User License Agreement (EULA), and it allegedly does not include a means to fully uninstall the program. The software transmits data about users to SunnComm through an Internet connection whenever purchasers listen to CDs, alleges EFF, allowing the tracking of listening habits -- even though the EULA states that the software will not be used to collect personal information.

According to EFF, when users repeatedly requested an uninstaller for the MediaMax software, SunnComm eventually provided one, but only after they had provided more personally identifying information. EFF also asserts that security researchers have determined that SunnComm's uninstaller creates significant security risks for users, as the XCP uninstaller did.

The Texas Lawsuit

The case of The State of Texas v. Sony BMG Music Entertainment LLC was filed by the Attorney General of Texas under Texas's Consumer Protection Against Computer Spyware Act. The case was filed in Travis County, and in addition to seeking $100,000 in civil penalties for each statutory violation, the Attorney General seeks an injunction barring further alleged statutory violations.

The California Lawsuit

The case of Robert Hull v. Sony BMG Music Entertainment Corp. was filed by EFF and two law firms on November 21 for alleged violations of California law. The case is pending in Los Angeles Superior Court. Not only does the lawsuit seek compensatory and punitive damages, but it also seeks various forms of notifications and refunds to consumers.

Next Steps

EFF has stated that it is "pleased that Sony BMG has taken steps in acknowledging the security risks caused by the XCP CDs, including a recall of the infected discs." However, according to EFF, "these measures still fall short of what the company needs to do to fix the problems caused to customers by XCP, and Sony BMG has failed entirely to respond to concerns about MediaMax, which affects over 20 million CDs -- ten times the number of CDs as the XCP software."

Unless and until plaintiffs' attorneys, such as EFF, and governmental attorneys, such as the Texas Attorney General, are satisfied by remedial and other steps taken by Sony BMG, the litigation against Sony BMG will proceed. Sony BMG will be entitled to its day in court, and it will be allowed to present any available defenses to try to either demonstrate that these cases are without merit, or that excuse its conduct.