Sony Rootkit Settlement Approved
A New York Judge on Monday approved a class action settlement regarding Sony BMG Music Entertainment use of harmful copy protection software that included a rootkit. Customers who purchased or received a CD after August 1, 2003 with the XCP or MediaMax software are entitled to a claim.
Lawsuits were filed last November in New York and other states by Girard Gibs and Kamber & Associates. The cases claimed that Sony's digital rights management, which attempts to stop computer users from copying a CD's audio tracks to a hard drive, is invasive and damaging to computer systems.
Sony employed technology from First 4 Internet (F4I) that uses a "rootkit" to hide the DRM and prevent its removal. Shortly thereafter, it was discovered that Sony's other copy protection software, SunnComm MediaMax, also poses a security risk and installs without a user's permission.
Under the terms of the final settlement, Sony has agreed to stop manufacturing CDs with XCP and MediaMax DRM, provide replacement discs, and make cash payments to affected customers.
Sony had already launched a program to replace XCP affected CDs with "clean" DRM-free copies and enable customers to download MP3 versions from its Web site. As part of the settlement, the company will offer a choice of two incentive packages to ensure XCP CDs are removed from the market.
"Incentive #1" will provide customers with a cash payment of $7.50 and a free download of one album from a list of more than 200 titles. "Incentive #2" removes the cash payment but allows for downloads of three albums.
The downloads will be handled using a promotion code with three major music download services, of which one will be Apple's iTunes. Promotion codes will be valid for six months. Owners of MediaMax CDs, meanwhile, will be offered MP3 versions of the music and one free album download.
In order to be eligible, an individual must return the XCP laden CD to Sony, or provide the company with a receipt showing the return or exchange of the CD at a retailer after November 14. A claim form will be required, as will verification that XCP was uninstalled or updated.
The Electronic Frontier Foundation, which took part in the settlement process, urged consumers to file claims and send a message to Sony and other manufacturers about such DRM.
In addition to the customer remedies, Sony has agreed not to manufacture or distribute CDs with the XCP software until 2008, and will no longer manufacture MediaMax 3.0 or MediaMax 5.0 CDs. Unlike albums with XCP, MediaMax CDs currently in circulation will not be recalled.
If Sony decides to ship CDs with new copy protection software before 2008, it must ensure the DRM will not be installed without proper consent, make an uninstaller readily available to customers, and ensure it will not create known security vulnerabilities.
In a statement, Sony BMG said it was "pleased that the court today granted final approval of the class action settlement of the consolidated cases concerning XCP and MediaMax."