Sony CDs can’t use ‘rootkits’
David Canton – for the London Free Press – June 24, 2006
Sony BMG has been under fire as a result of the manufacture and sale of CDs containing digital rights management (DRM) software. A lawsuit over that software was recently settled.
The DRM software at the centre of the controversy automatically installed itself as a “rootkit” on the computers of CD users when the CD was loaded into the computer.
There are two main areas of contention with the Sony DRM software. The presence of a rootkit can make a computer more vulnerable to third-party attack by things such as viruses and spyware. And DRM software can be used to collect information about computer use and transmit it back to Sony BMG.
Several lawsuits were filed in the U.S. against the record label as a result of the rootkit. Several New York cases were consolidated into one proceeding.
A settlement was tentatively reached last December but required the approval of a federal judge. That approval was recently granted. The agreement applies to anyone who bought, received or used CDs containing DRM software after August 1, 2003.
In the wake of the controversy, Sony BMG had already implemented a variety of steps to address concerns about the DRM technology.
The company stopped producing CDs containing the contentious software and removed CDs from store shelves. Sony BMG also issued a recall of millions of CDs and offered free MP3 downloads in exchange. Sony BMG claimed that the DRM software was never used to gather personal information.
Several of the terms of the settlement will require Sony BMG to continue to implement the plan that is already in action. For instance, Sony BMG has agreed to continue its stop on production of CDs containing the software at issue.
In addition, the settlement requires that the company continue to offer replacement CDs or free MP3 downloads.
The settlement also contemplates the release of new copy protection software by Sony BMG.
According to the terms of the agreement, the company must have any new software reviewed by an independent security expert before it can be released.
In addition, Sony BMG must disclose the existence of any copy protection software to CD users by including a short written description of the software on the CD.
Just as the settlement was receiving court approval in the U.S., Canadian class actions were being launched against the Canadian branch of Sony BMG. Actions have recently been initiated in Ontario and British Columbia, joining the action that was commenced in Quebec last November.
The new claims and the American settlement will likely bring more attention to this issue.
Canada’s privacy community, a vocal opponent of DRM technology, is also making an effort to cast more light on this concern.
A group of privacy advocates recently released a background paper outlining the dangers posed by DRM technologies to the privacy interests of Canadians.
The group asserts that DRM software can be used to circumvent privacy protections. The ability of DRM technology to collect detailed information about the computer use habits of individuals is cause for alarm, according to the group.
The paper and explanatory letter were sent to the Canadian heritage and status of women minister and the minister of industry in an attempt to draw attention to the threat posed by DRMs.
The purpose of the letter was to raise awareness regarding the issues surrounding DRMs and to make a plea for privacy to be a consideration throughout the copyright reform process. The letter and paper are available at www.intellectualprivacy.ca.
