Sony DRM Installed Even When EULA Declined

HikingStick writes "News.com is reporting that the Texas attorney general is expanding the allegations against Sony. It seems the software would install even if users declined the EULA. From the article: 'The Texas attorney general said on Wednesday that he added a new claim to a lawsuit charging Sony BMG Music Entertainment with violating the state's laws on deceptive trade practices by hiding 'spyware' on its compact discs ... The new charges brought by Abbott contend that MediaMax software used by Sony BMG to thwart illegal copying of music on CDs violated state laws because it was downloaded even if users rejected a license agreement.'"

Comments

Criminal Tresspass

[Renraku]

"Can I come into your house?"

"Nope."

"Ok."

Man turns around to find the stranger at the door has already moved his shit into his house. Does this not constitute tresspassing?

Re:Criminal Tresspass

[Alistar]

Yea, but you are not told what the software does until you run it. It would be more analagous to seeing girl guides at your door, you let them in, they offer to sell you cookies, you say you aren't interested and they leave a paint bomb in your lobby on their way out.

Re:Criminal Tresspass

[Qzukk]

Huh?

When I put the CD in the drive, I wanted to play some music, not install some software. It's YOUR analogy that's flawed.

How about this:

I run a bar and decide to get some live music, so I call up a group of musicians. A popular and very well known band, of course, I don't want to drive my patrons out. They tell me "sure, we'll come and play, just give us some money." So I send them a payment, and the day of the performance, they show up with a 50 page contract. "Just sign this and we'll be set". I look over it, and I see among it's provisions that they're going to firebomb the stage at the end of the show. I give them the contract back and tell them no.

Then they firebomb the stage.

Re:Criminal Tresspass

[vmerc]

Well, technically you could eat the cookies, or you could analyze the cookies and "reverse engineer" them to get the recipe. Really, if you decline the EULA, and the software installs, then what they are doing is giving you a free pass to do ANYTHING you want with the software. It becomes YOURS free and clear with all rights persuant with posession just like any other non-IP product. The installer was designed to give you the software with or without the contract, so it's your choice whether you want to bind yourself to it or not.

Re:Criminal Tresspass

[Anonymous Coward]

girl guides ... (who) ... leave a paint bomb in your lobby

Hmmmm. Girl guides who deserve a spanking.

A good, kinky start.

Tell us more.

Re:Criminal Tresspass

[dr_dank]

I run a bar and decide to get some live music, so I call up a group of musicians. A popular and very well known band, of course, I don't want to drive my patrons out. They tell me "sure, we'll come and play, just give us some money." So I send them a payment, and the day of the performance, they show up with a 50 page contract. "Just sign this and we'll be set". I look over it, and I see among it's provisions that they're going to firebomb the stage at the end of the show. I give them the contract back and tell them no.

Then they firebomb the stage.

Moral of the story: Don't hire Gwar to play at your bar.

Re:Criminal Tresspass

[dotgain]

Exactly. I don't see how, as a consumer, I'm supposed to think otherwise. I'm _supposed_ to buy Music CDs, not download them. That was fine when buying music CDs was easy. It no longer is, it's now easier for me to download songs than it is to buy a CD I know will work for me when I get home.

Great way to solve the problem, Sony.

Re:Criminal Tresspass

[lynx_user_abroad]

Put simply, the EULA is not asking "Can we install the software?".

I follow you this far. To my reading of it, you are correct. But there's another aspect to this many (perhaps even Sony's Lawyers) have missed.

One of the more common things which one would agree to when accepting a EULA is an agreement to assume any subsequent liability, indemnifying the other party (Sony, in this case) against liability for flaws in the product, and such. The idea being (to choose a farsical example) that before you install the Sony rootkit onto a CDROM-equipped heart/lung machine, you must agree to accept full responsibility for doing so. Sony has no way of knowing, beforehand, that you are planning to install it onto a heart/lung machine, and probably did not perform anything in the way of due dilligence to ensure it wouldn't bluescreen heart/lung machines accidentially. (How could they?) So instead they should issue a generic warning that there are certain circumstances where installing this software might not be a good idea, that it's your responsibility to ensure that installing the software (playing the music) won't have any bad consequences, and that if you choose to install it there anyway, they won't be responsible for anything bad that might happen. That's what the EULA is for; to protect them.

But apparently, Sony is installing software without first securing that all important get-out-of-liability-free EULA card first. I'm sure sopme Sony lawyers are having nightmares about this.

While it's unlikely anyone tried to install a Sony music CD onto a heart/lung machine, the liability is not limited to those circumstances.

If a doctor tried to play music on his laptop, and later a medical liability case hinges around how bad data got into a patients medical report, Sony could become a party to the lawsuit, because a reasonable claim could be made that the Sony rootkit allowed some hacker to make changes to the patient medical report (and cover his tracks), and the burden of proof might well be on Sony to prove a) that such an intrusion did not take place, and b) that the doctor did in-fact accept the EULA releiving Sony of responsibility. That's going to be a tough burder to meet.

Of course, I haven't read the EULA itself, so I'm just guessing at what it insulates Sony against.

I'd be very surprised if the "install anyway" aspect of this was approved by a lawyer; if it was, he'll probably lose his job. If it wasn't approved by a lawyer, the one who failed to get such approval may be losing their job. But one thing Sony really can't do (IMHO) is just call it a mistake, because that would be admitting negligence without even a fight.

This one is going to be interesting to follow. It's almost one of those cases where Sony might hope for a quick class-action settlement just so they can fall-back to a "we already settled all of our obligations under the class action lawsuit; your wrongful death lawsuit is moot, because we already sent you a "coupon for a free CD".

Re:Criminal Tresspass

[Khyber]

I'd tend to think that the "wanton destruction of your property" is a proper analogy, because that's EXACTLY what the DRM does to any computer running 98 or ME. Once you install, you're fucked. BSOD boot loop immediately.

Re:Criminal Tresspass

[lynx_user_abroad]

Or, to clarify:

If someone purchased a Sony rootkit music CD, and

If they put it into their computer, and

if they declined the EULA, and

if they did all that before they learned about the rootkit, then Sony just handed them a get-out-of-liability-free card for anything that happens on that computer from that point forward.

Spam gets sent to California? Sony pays the $10,000 fine.

Caught hacking into the CIA? Sony gets the free trip to gitmo.

Downloading kiddee porn? Not me, Mom. It's Sony's fault!

Let's take it one step farther...

Uploading Sony music onto P2P? Why don't you go cease-and-desist-yourself.

Now you understand just how far Sony has screwed this one up.

Re:Criminal Tresspass

[GlassUser]

Man turns around to find the stranger at the door has already moved his shit into his house. Does this not constitute tresspassing?

Not only, in Texas it's an invitation to kill them without further provocation.

If only it applied to computers too.

Re:Criminal Tresspass

[fucksl4shd0t]

A little offtopic, but when my last kid was born, the nurses had my wife hooked up to this machine to monitor things like, you know, heartrate, blood pressure, that sort of thing. I noticed from a distance that every now and then a dialog would appear and they'd click it, and the nurse even started swearing under her breath about it. So I circled behind her to find out what it was.

"Illegal Instruction: 0xffffffff" blah blah you know the rest

I told my wife about it. She said "Why the hell are they running windows in here? This stuff is important!"

I love my wife. :)

Can anyone here see a problem?

[dada21]

Let's look at the article:

'The Texas attorney general said on Wednesday that he added a new claim to a lawsuit charging Sony BMG Music Entertainment with violating the state's laws on deceptive trade practices by hiding 'spyware' on its compact discs

Oh, so the state was hurt, and they're the ones who have to go after Sony?

The way I see it, Sony breached a contract. This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit). You can hire a local attorney and move forward.

Wait, it is costly to sue a big company? Might that be due to the laws created in your state? Might that be due to the lawyers in control of the operation of the law?

No matter how often you lose, you will continue to lose. The system isn't by the People for the People any more. We're living in a country where the system is so powerful, only the powerful have rights. Let's ignore the state's concerns in this situation -- they're only going to find themselves stronger. They're going to fight Sony with millions of taxpayer dollars, and if they win, the taxpayers won't see a cent, but a bunch of state lawyers and Sony lawyers will be wealthier.

Step back. Look at the problem. The problem is that contract law is too complicated, and you can't fight a contract violation in court without a contract lawyer who likely is part of an organization that wrote the law. Ignore Sony, ignore all terribly written contracts. We need to get to the source of the problem and fix it. Let us return to the days when the law was simple to read, and simple to enforce. Let us return to the days when we could walk up to a court clerk, file a grievance and sue the people who violated the contract, just them and us.

Who is with me in asking for an amendment limiting all laws to one topic, 200 words or less, and only can pass with a signature of the President and a signature of a random person with a 3rd grade education who agrees that even they understand the law?

What Sony did was bad, but if contract law was written clearly and concisely, we'd have ways to defend ourselves cheaply and efficiently. The law is a mockery of justice today, and there is ZERO way for any individual or small group to win in the long run.

FYI, for other anarchocapitalists out there, my solution is true moderated arbitration mechanisms in a free market, not the law or the courts.

Re:Can anyone here see a problem?

[mlong]

The way I see it, Sony breached a contract. This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit). You can hire a local attorney and move forward.

However, since one clicked Disagree/Decline, then they did not enter into any contract. Yet Sony went and installed software anyway. That is trespass and thus the state should be involved since it was illegal activity.

Re:Can anyone here see a problem?

[AKAImBatman]

The way I see it, Sony breached a contract.

A contract is, by definition, a bilateral agreement. The EULA is a contract offer, and if it is declined, there is NO contract between Sony and the user. What that means is that Sony is forcing a unilateral agreement onto a user who does not have a contract with Sony. That's a criminal case, not a civil case.

Of course, I'm not a lawyer, so take my comment with a grain of salt. But that's my interpretation of it in a nutshell.

Re:Can anyone here see a problem?

[jebell]

While I generally agree with your sentiments regarding pre-existing civil remedies, state Attorneys General routinely file "consumer-protection" type of law suits against big companies in order to spare the consumers from having to litigate matters that would otherwise be too costly.

While some have criticized over-active Attorneys General, like New York's Eliot Spitzer, for being too litigious, I think this type of action has its place. It's definitely better than the standard class-action suit where the lawyers are made rich and the class members get a coupon for $5 off their next purchase of the product they complained about in the first place. I don't think the "state lawyers" get rich in this type of case, although there are instances (like the tobacco litigation) where the states hired outside lawyers to litigate this stuff.

Law has always been complicated, believe it or not. Else, why have we had lawyers for so long? At least for the last couple of hundred years, we've actually had laws that are written down in codes and case books.

Re:Can anyone here see a problem?

[GreyPoopon]

The way I see it, Sony breached a contract. This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit). You can hire a local attorney and move forward.

Just for the record, I agree with the rest of your post. However, this isn't a mere violation of contract. You see, a contract was never made. In this case, the user refused to "sign" the "contract" (although I'm not really agreeing that a EULA is a valid contract...). Despite the fact that the user did not enter into a contract, Sony still "trespassed" on their system. Honestly, this case could be prosecuted in a myriad of ways in a criminal court. It could be considered trespassing, vandalism, espionage, deceptive trade practices, and several more outlandish violations of the law.

Re:Can anyone here see a problem?

[twiddlingbits]

Correct, contracts have to be entered into bilaterally not unilaterally. It is a matter for the State as it is then Fraud to execute a contract not agreed to by both parties. Criminal prosecution IS the domain of the State. If the GP poster can think of a civil tort that was committed by Sony the sue them. Find a good lawyer who will get 40% of what you win and go for it. Or you could go to small claims court. If you win, just how do you think you will enforce the penalty?

Re:Can anyone here see a problem?

[dada21]

Just for the record, I agree with the rest of your post. However, this isn't a mere violation of contract. You see, a contract was never made. In this case, the user refused to "sign" the "contract" (although I'm not really agreeing that a EULA is a valid contract...). Despite the fact that the user did not enter into a contract, Sony still "trespassed" on their system. Honestly, this case could be prosecuted in a myriad of ways in a criminal court. It could be considered trespassing, vandalism, espionage, deceptive trade practices, and several more outlandish violations of the law.

I had about 5 similar replies, but I'll only reply to one (for now).

I believe, fully, that the contract between a consumer and a manufacturer should actually be created through the retail outlet. I'm not talking about a "de facto" type agreement that is binding always and every time. I mean a contract that basically stipulates that what I am buying will do no harm without warning me, unless I am at fault for using the item incorrectly. If it does, we have the retailer to go after.

I've spoken with 5 free market law groups (one being http://www.ij.org/ ) and from what I can tell, we should be suing the retailer, not Sony. The retailer has sold a product that was unsafe for the purchasing party, and the retailer should be responsible.

The reason? Retailers (I own 2 stores) should check their product before selling it -- IF the contract with the purchaser stipulates this. In a free market, I believe we'd see such stipulations. In a heavily regulated one, government has allowed everyone to be protected EXCEPT the consumer. In cses where the consumers are hurt in large numbers, they have almost no ability to find restitution.

Re:Can anyone here see a problem?

[node 3]

Oh, so the state was hurt, and they're the ones who have to go after Sony?

The State (in America) is us. It's We The People.

The way I see it, Sony breached a contract. This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit). You can hire a local attorney and move forward.

That worked so well with the Linux geeks who tried to return Windows per the OEM EULA.

Oh, wait. No, it didn't.

But it's worse than that. Let's assume you manage to design a low-cost way for individuals to sue a large corporation, how many people are actually going to sue Sony? Not many. So Sony will just eat the cost of a few lawsuits, and continue as usual.

Do you really expect people to sue over every little transgression? Do you have the time to be diligent over every EULA, every "implied" contract in your everyday life? Odds are you don't. That's what the State is for (in the US), to look after our collective interests. Doesn't always work out that way, but it does work out better than without the State. There are also Class Action suits, which are not necessarily brought on by a State, but are backed by the State, so the effect(collective power, backed by the State) is the same.

Who is with me in asking for an amendment limiting all laws to one topic, 200 words or less, and only can pass with a signature of the President and a signature of a random person with a 3rd grade education who agrees that even they understand the law?

Not I. Your post is more than 200 words. Do you think it's complex enough to cover questions like automobile operation? Building codes?

Laws can't be as simple as "thou shalt not kill", because sometimes thou shall kill. And sometimes different types of killing are met with differing levels of "shalt not".

The law is a mockery of justice today, and there is ZERO way for any individual or small group to win in the long run.

Under the current Republican House, Senate, and Presidency, that's become ever more true. They are systematically removing the rights of the people, and empowering the corporation. It's disgusting.

FYI, for other anarchocapitalists out there, my solution is true moderated arbitration mechanisms in a free market, not the law or the courts.

There is no such thing as the Free Market. Laws and Courts are required to prevent Capitalism from reverting to the Law of the Jungle.

Re:Can anyone here see a problem?

[thebdj]

Blaming retailers is a bit like shooting the messenger. Why should we have to go after the middle man when in reality the company who performed the harmful act was the distributor (in this case Sony)?

Based on your slightly thawed theory, if I purchased item X. Now it is possible that 1 out of every 1,000,000 has a defect that might be potentially harmful. So, if I am the unfortunate individual who gets that one and suffer serious injury the blame is on the retailer not the manufacturer? This makes no sense at all. You, as a retailer, cannot be responsible for testing every unit you sale and you would actually be more likely to get in trouble if people found out because they would say you are selling used merchandise as new.

Now, the case of Sony is a bit different; however, it should not be the responsibility of the retailer to police the manufacturers and none of the majors ones will do it, because they will probably be threatened with having their supply of future products cut off. My example is what happens when you start down the slippery slope by moving blame away from companies like Sony. If you seriously do believe this policy you mention, then please tell me what stores you own so we can have this conversation again after someone sues you for selling that harmful product.

Re:Can anyone here see a problem?

[dr_dank]

That is trespass and thus the state should be involved since it was illegal activity.

Might makes right. A cracker who sends trojans or rootkits may actually see fines or jailtime. A corporation who does the same thing is just protecting its IP or, if suitably backed into a corner, admit they made a mistake and continue doing the same crap with a different name. You'll never see a single indictment for wrongdoing at a large company for this.

Re:Can anyone here see a problem?

[Guppy06]

"Oh, so the state was hurt, and they're the ones who have to go after Sony?"

Ignoring for the moment the potential harm done to computers owned and operated by the state government, the state, as a republic, is required to represent the interests of the people.

"The way I see it, Sony breached a contract."

With whom? The people who declined?

"This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit"

So then you are in favor of Sony playing the odds. Unless enough individuals come forward and (successfully) sue Sony for this, Sony will see a net gain from their illicit efforts, and others will likely follow suit.

This is exactly the same mechanic that perpetuates spam. How's your inbox looking?

"The problem is that contract law is too complicated, and you can't fight a contract violation in court without a contract lawyer who likely is part of an organization that wrote the law."

Without law on what may or may not be included in a contract, what do you propose to do to keep contracts from being "too complicated?"

"Who is with me in asking for an amendment limiting all laws to one topic, 200 words or less,"

I challenege you to, in 200 words or less, write a law that defines murder in such a way that includes things like murder-for-hire, and differentiates it from accidental death, unless that death was through criminal negligence (and defining "criminal negligence"), differentiate between classifications of murder by how heinous they are (e. g. was there rape involved?), and specify different punishments for each classification while allowing the judge leeway for sentencing.

"my solution is true moderated arbitration mechanisms in a free market,"

So he who has the money to buy favorable arbitration wins?

Re:Can anyone here see a problem?

[Politburo]

Who is with me in asking for an amendment limiting all laws to one topic, 200 words or less, and only can pass with a signature of the President and a signature of a random person with a 3rd grade education who agrees that even they understand the law?

I smacked you yesterday about these ridiculously stupid legislative ideas.. and here you are again. The system in place has worked for 200+ years. That's practically an eternity in government terms (excluding Iceland).

Why do you think a rule or amendment limiting bill length will do anything? What cannot be done with one bill will simply be done with two, three, or a hundred. Germanity rules are way too difficult to enforce, especially when you get into spending bills.

Now, as to your ridiculous statement regarding a random person with a 3rd grade education.. how exactly does that method fit in with the idea of a Representative elected government? That's right, it doesn't, because it's a fucking stupid idea.

Re:Can anyone here see a problem?

[dada21]

Based on your slightly thawed theory, if I purchased item X. Now it is possible that 1 out of every 1,000,000 has a defect that might be potentially harmful. So, if I am the unfortunate individual who gets that one and suffer serious injury the blame is on the retailer not the manufacturer? This makes no sense at all. You, as a retailer, cannot be responsible for testing every unit you sale and you would actually be more likely to get in trouble if people found out because they would say you are selling used merchandise as new.

Actually, my retail stores sell paintball markers ("guns") and skateboards. We have a very strong liability insurance policy (300% more than standard) and we test EVERY ITEM. We sell our products for almost 15-20% more than more retailers and 25% more than online merchants. Our customers know we sell a quality product and back it up as safe.

Amazon doesn't want to see themselves liable for bad product, but if the retailer doesn't care, why should the manufacturer? If I, as a retailer, receive many bad products of the same SKU, I sue the manufacturer. I've sued 3 (or threatened to) and received due compensation. Other stores just took the loss. Retail is moving into the toilet because no one is accepting responsibility for what they carry and sell -- not the manufacturers, not the distributors, not the retailers.

Yes, I am more expensive, and yes, we care more. I also expect to outlast many dotcoms and retailers who only care for the ONE sale -- I want a lifetime of sales from my customers, and I will fight hard to get it.

I believe Sony IS responsible but so is the retailer for not setting a standard with their suppliers. I used to sell CDs to my customers but stopped -- not because of dwindling profits but because of dwindling quality. The minute I received punk rock CDs without the CD logo stamped on them, I knew the market was over. I didn't want to support badly made products.

Any retailer can buy liability insurance fairly cheaply. I think we pay maybe $5000 or $6000 a year for a multi-million dollar policy. Sony can also do the same. The insurers then can take the brunt of the reparations, and if a company has many claims, they'll lose the policy and they'll lose the ability to sell products. It seems to me that the free market solutions are better than the legal regulations and mandates.

Re:Can anyone here see a problem?

[Anonymous Coward]

>>A contract is, by definition, a bilateral agreement.

Just a slight aside, but California and Michigan courts have actually recognised unilateral contracts, even ones without consideration for the terms. Scares the crap out of me. Guess what states I never want to practice law in?

-- Third year law student

Re:Can anyone here see a problem?

[fermion]

The courts do not have time to fuckin' hear 10,000 cases every time some dipshit corporate sleazeoid does something stupid. It is simply a waste of taxpayers money. It has nothing to do with too many lawyers, or complex legal systems. It only has to do with shit for brains trying to manipulate current laws so they can engage in activities that any reasonble person would deem illegal.

Sony violated the laws of Texas. In fact they violate the law of reaon. There is no cause for every person in texas who was stupid and purchased a CD to sue Sony. That would make more money for the lawyers than anyone else. It is simpler for the State to bitch slap the idiots and tell them to behave. This way, the only way the lawyers make money is if Sony tries to pretend no laws were violated.

No matter how simple the laws are, the evil doers will get the bad lawyers to figure own how to meet the letter of the law, but not the spirit, and the good lawyers will defend us against those that prize currency over common decency.

Re:Can anyone here see a problem?

[AKAImBatman]

It's not a contract because clicking a button is not intent to contract. It's not a signature, it's not a handshake

It's a contract in the same way that ordering food in a restaurant is a verbal contract to exchange money for food.

Reasons why EULAs may be unenforcable contracts, however, include:

- They tend to be unilateral in nature.
- They attempt to impose restrictions AFTER the point of sale contract. (This is a legal no-no.)
- They are forced upon the customer, as the he has already paid for the software.
- There's no way to prove that the user actually accepted the license. (That's why the GPL has a fall-through clause that uses regular copyright law for protection.)
- It cannot be shown that customers actually understand the license before accepting it, meaning that the terms may be unenforcable.

Basically, there are a lot of problems with EULAs. The idea that they're not contracts, however, is not one of them.

Re:Can anyone here see a problem?

[cpt kangarooski]

This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit).

Why? Class actions are efficient. In this case, everyone would be alleging the same thing against the same defendant. It's far better to have that go to court once, rather than have everyone litigate the same thing, which wastes their time and money and clogs up the courts.

If you have a tortfeasor that harms a lot of people, but where the harm to any one person is slight, you still want to have them cure the harm they caused and to punish them so that they don't do this again in the future. This is not practical if everyone has to sue independently, since many people will not bother (and thus go uncured) and the tortfeasor will not be significantly deterred from doing it again. A class action is an efficient pooling of resources (even if each person harmed is only awarded $1, they only are paying 33 cents for the lawyer -- that's a good deal, really) and can actually deter future tortfeasors.

Wait, it is costly to sue a big company? Might that be due to the laws created in your state? Might that be due to the lawyers in control of the operation of the law?

No. It's costly because, in the interests of justice, you have to do a competent job proving that the company did something wrong. Most people do not know how to do this. Complaining that the system is complicated is as silly as complaining that people can't build moon rockets in their backyards -- some diciplines are inherently complicated. Actual justice is hard.

but a bunch of state lawyers ... will be wealthier.

State lawyers are just employees. They get a fixed salary like other state employees. It's sole practicioners and partners at firms that get shares of the damages. So if the state wins, the money probably ends up in the state's general fund.

The problem is that contract law is too complicated, and you can't fight a contract violation in court without a contract lawyer who likely is part of an organization that wrote the law.

All lawyers get trained in contracts, and since most lawyers deal with contracts no matter what else their specialties are, we all can generally deal with them. Also, most contract law is common law, and has been created by the courts in the US and England over the last thousand years or so. Most of the people who wrote contract law are long dead, and were never particularly organized.

Let us return to the days when the law was simple to read

That's never been true, unless you want to go back to an eye for an eye. Law is inherently complex. There is no magical set of laws -- laws being rules for a good, stable, working society -- that is simple and will function. You're looking for a utopia, and those don't exist.

Re:Can anyone here see a problem?

[Firethorn]

Like the previous poster implied, it's a preponderance of the evidence thing. The fact that you put money down before ever seeing the EULA tends to make judges not like it. The fact that 80-90% of stores have a no refund policy on opened software makes the judges not like it even more.

It's the equivalent of making that 'super-fine print' illegal. The EULA isn't presented until the financial transaction has been completed. Therefore, it's null and void. The user has the right to use the software, having paid his money at the store for it. The software company isn't allowed to change the deal after the fact.

Re:Can anyone here see a problem?

[monkeydo]

I hope that as a third year law student, you recognize that unilateral contracts are actually very common.

"I will give you $5 if you mow my lawn," may be interepreted as a unilateral contract, where I am bound to give you $5 if you mow my lawn, but you are not obligated to anything.

Re:Can anyone here see a problem?

[AKAImBatman]

There is an implied contract, I'd say. Sony has contracted to sell you a CD containing music.

The key here is that you were sold music, not software. Software is not a feature of the music and was bundled without disclosure. This in itself may be illegal in some states. Now add to that fact that the software installs itself even after you decline to a contract offer for the software, and you have a recipe for legal disaster.

The rest of your comment is irrelevant. The software is not a feature of the music. Period.

Re:Can anyone here see a problem?

[ceejayoz]

No, that's a unilateral offer. An offer is not a contract. Acceptance by the offeree creates the bilateral oral contract.

Re:Can anyone here see a problem?

[arminw]

...There's no way to prove that the user actually accepted the license....

Even more importantly, there is no way to prove WHO clicked the mouse. There is no wy to prove that the person who clicked is even eligible to enter into a legally binding agreement. It might be a 12 year old kid.

Heh.

[jacobcaz]

By clicking "Agree" below, you agree to the terms of this EULA. By clicking "Decline" below, you agree to the terms of this EULA.

[ AGREE ] [ DECLINE ]

Feds dropping the ball?

[cez]

Shouldn't these charges also be mirrored by the feds seeing how Sony is an international company who's crossed state lines with malicious code?

Re:Feds dropping the ball?

[Raul654]

You are assuming that the DOJ is willing to go after corportations that audaciously break the law. They're too busy sending college students to prison for file sharing, modders for installing mod chips, 'etc. The administration clearly has a corporation-friendly agenda and has no intention of filing such a case.

Re:Feds dropping the ball?

[Lumpy]

you forget who owns the federal government

Sony,BMG,RIAA,MPAA big corperations all bought and paid for that shiny government we have here.

What you are asking is the same as asking an attack dog that is trying to eat your face to attack it's owner.

It is not going to happen.

While I'm pleased I suppose...

[Concern]

...this is a bit ridiculous on its face. Sure the spyware is illegal in about a dozen different ways (depending on your state) but... this all hinges on whether or not we accept or decline a EULA? How does that make sense?

That kind of reasoning by implication gives EULAs legitimacy which THEY DO NOT HAVE.

Since when under common law do we have such outrageously elaborate and suprising binding legal agreements by parties without equal representation?

Since when can agreement be given by pressing a mouse button or removing shrinkwrap?

The EULA itself is an ugly audacious legal fiction... this is why they needed UCITA to attempt to legitimize them after the fact.

Re:While I'm pleased I suppose...

[LexNaturalis]

I think it's just another straw in the pile. This just adds another charge against the company that they will have to defend themselves against. The other charges don't hinge on the EULA issue at all; the rootkit is still illegal. This is simply ANOTHER thing they are adding. So even if the rootkit is found to be legal, they can still be nailed with this charge.

From my law classes, my lawyer professors told me that a favorite trick of lawyers is to allege as many possible crimes/violations as possible so as to make the other side more likely to either plea bargain or settle as well as to raise the chances of successfully arguing at least ONE of the charges/torts.

(Disclaimer: IANAL, just had some law classes)

Re:While I'm pleased I suppose...

[TubeSteak]

Yes, in some cases the lawyers like to throw as many possible crimes at the defendant to make them cry uncle.

On the other hand, it isn't always a good idea.

If you have to go before a jury, you don't want them to have to sift through a dozen charges, some of which may be of marginal merit.

In this case, throw the book at them and it won't bother anyone, but in criminal cases involving a living breathing defendant, it isn't always the best idea.

It's only fair

[goombah99]

I click through EULAs because I dont think they have any legal weight. Sony in turn ignores my requests not to install since they don't think EULA's have any legal weight. In sshort the 'A' in EULA is not an agreement, meeting of minds, or a legal contract. I'm fine with that I guess. Those privacy rights were unenforcable anyhow so I lose nothing.

If only...

[Anonymous Coward]

Now if only the death penalty in Texas applied to corporations...

Re:If only...

[afidel]

Actually there is a legal remedy which is commonly refered to as the corporate death penalty. The specifics are a revocation of the companies charter and a forced disolution of its assets. It is very infrequently applied, especially in the last half century, which is probably a reason that you see so much white collar crime, there is little or no penalty for it, either to the individual or the company.

Indie Music

[jhouserizer]

Sure am glad I've only purchased indie cd's in the last few years! Apparently not only do the big companies cram crappy music down your ears, but they also cram crappy software into your computer.

I have to ask.......

[stunt_penguin]

Is anyone surprised?

*Wind howling*
*Dogs barking in the distance*
*Tumbleweed passes*
*Chuch bell tolls in the next town*

No I didn't think so either.

This is probably hurting Sony in sales from nerds

[EvilMonkeySlayer]

For example, I was planning on buying a new widescreen tv and a psp, but because of the rootkit etc I decided against a Sony tv and i'm probably going to buy either a Nintendo DS or the GPX2.

I wonder, if Sony has lost any sales because of this. Just how much in cash it has cost them?

To save some clicking

[kawika]

This is the original blog that revealed the SunnComm DRM installed despite the user declining the EULA. Whereas the XCP DRM could hide behind the EULA excuse, I don't see how SunnComm has any legal fig leaf here (though IANAL).

Supposedly there is about ten times more SunnComm DRM in the wild than XCP DRM, so maybe Sony felt they couldn't sacrifice holiday sales despite the legal exposure.

Lawsuit

[Council]

Sony is complaining that although they declined the offer to be sued, the Texas AG is still pursuing the case.

Not a Virus?

[DeanFox]

FTA: "The creator of the copy-protection software, a British company called First 4 Internet, said the cloaking mechanism was not a risk. The company's team has worked regularly with big antivirus companies to ensure the safety of its software, and to make sure it is not picked up as a virus, he said."

First of all, I would like to know who these "big antivirus" companies are so I can stop using their product (assuming I might be). That or to make sure I never use or recommend them to others'.

We are in trouble when antivirus companies are in backroom negotiations with virus makers, I assume for profit, not to detect one virus in favor of another.

How can I trust they haven't negotiated other backroom deals with virus/spyware writers that let other viruses and spyware on my machine?

I want to know who these "anti" virus companies are!

Re:EULAs are stupid...

[AKAImBatman]

UT, if you don't agree, the software doesn't install and you can't return the software to the store.

That's news to me. Most EULAs I've read on shrink wrapped software state that you can return the software for a full refund if you don't agree with the terms and conditions. If the store won't accept the return due to some stupid policy, then contact the software maker directly for your refund.

Does this ever end?

[SmallOak]

Each time I think I Sony could not have made this any worst, something like this comes up. I fully expect to hear that if you run the software backwards it says something satanic.

Well, that depends...

[Concern]

If it were me who tried to install spyware on people's PC's using music CDs, the answer would be yes.

On the other hand, if it were a wealthy multinational corporation who did so, the answer would be... perhaps we can find a discrete settlement to avoid any discomfort to our most valued citizens.

EULA makes no difference

[FreeBSD evangelist]

I have an RCA Victor (one of Sony/BMG's brands) with MediaMax. It absolutely installs software on your computer, even =before= the EULA response box pops up.

Corporate Anarchy

[Beerden]

We live in the age of Corporate Anarchy. A Corporation has had, in the past, essentially the same rights as an individual human. Now, however, individual rights have been taken away, yet the Corporation is free to do what it pleases. Corporations like SONY feel they are above the law, and are now testing to see how far they can go. After Corporate Anarchy comes Corporate Rule. I would not shed a tear if the Individuals were to blow up Corporate buildings, clean out Corporate bank accounts, and fight in a [very bloody] Revolution against Government and Corporation (war against Facism, in other words). Civil war, if you could call it that, but more like the French Revolution. I think there is no other way around it, because History shows us that it will happen.

Re:Corporate Anarchy

[Qzukk]

Corporations have become the shield from behind which evil people act with impunity.

The corporate veil needs to end. If a human made the decision to force software to install on my computer then that human needs to be held personally liable for it.

Until people are held liable for their actions, evil people will continue to act freely.

Re:Corporate Anarchy

[mattsucks]

Tyler? Is that you?

You KNOW you just broke the first two rules, right?

Re:Corporate Anarchy

[retro128]

Let me repeat: its a human that made the decision to do evil, not the corporation itself.

Yes. But the problem is that the human doing the evil is rarely held accountable for it because it's done under the cloak of the corporation. In a large corporation it's very easy to cover up who made what decisions. India's case against Union Carbide went nowhere. Though they issued an arrest warrant for its CEO Warren Anderson and unsuccessfully tried to extradite him, I wonder if they could prove that he had any knowledge of what was going on in Bhopal? In the meantime, Dow Chemical purchased Union Carbide and to this day fights over the matter of taking responsibility for the incident. Putting away the CEOs of Enron, Adelphia, et al is the exception, not the rule, and that's only because investors lost an assload of cash. But the deaths of 14,000 second world brown people. Who gives a crap?

It's even funnier than this...

[Concern]

Imagine if you order a box of catfood to be delivered that's worth about $10. And then the next day a crowd of 15 attorneys in suits arrive at your door with a 20 page contract, and the box. They won't give you the catfood until you agree to their "license." You can either call your own attorneys, if you have any, and spend several weeks evaluating their contract at the cost of several thousand dollars of your own money, or, they say, you can simply agree to the contract by blinking your eyes.

It turns out that there were worms in the catfood and now your cat is incredibly sick. Amazingly, the attorneys did this on purpose. If you take her to the vet, it will cost you hundreds of dollars to cure her. You don't remember blinking, but they swear you did.

The government has sent an angry letter to the catfood guys, but no one looks like they have any intention of paying your vet bill - or even sending your cat a get well card.

In response to the government, the catfood people announce they've "solved" the problem, because they've agreed to temporarily stop shipping worms in catfood. However, they're still shipping spiders, ants, and leeches - and they have "big plans" to expand the practice.

You don't know exactly how long your cat has left to live, but after watching all this, you get the feeling its days are numbered one way or another.

Re:It's even funnier than this...

[Kelz]

No no its even funnier! Since this is current music, the catfood was actually poison!

Re:It's even funnier than this...

[eyeball]

Epilogue: lawyers organize a multi-billion dollar class action lawsuit against the cat food company. They get the billions of dollars, and you get a coupon for more cat food.

Re:"Cancel" != "Decline EULA"

[10101001 10101001]

Yes and no. You see, there's state and federal laws against computer trespassing. This means that if there's any legitimate use for an EULA, it's to basically indemnify the company by making it clear that the user intentionally installed software. This means that if software is installed regardless, there's a valid basis for computer trespassing--note, this is true if one manages to bypass the EULA, as well. Computer trespassing laws are generally very vague and badly written, so only something like an EULA really will protect an entity from prosecution under them. At least in this case, were someone was specifically presented the EULA and did not agree to it while software is installed anyways, there's no way to somehow misinterpret the letter or the spirit of the law to not take it as computer trespassing, unlike with intentionally bypassing or hacking an EULA to install software without agreeing to it.

Re:Let me get this straight

[WidescreenFreak]

Seems to me someone could easily reverse engineer (remember not to agree to any silly Eula) and build an equivalent piece of software that can bypass any DRM attempt.

Um ... the Shift key has existed on keyboards since the typewriter as far as I know, and Windows has stopped the autorun when holding down Shift for quite some time. It's prevented all auto-installing DRM that I've ever run across from installing itself on my PC.

I've also been able to avoid DRM on my system by not using or installing anything that I know has DRM associated with it, like Media Player and iTunes. CDex, WinAmp, and the Shift key are the Three Amigos for just about every audio CD out there.

So, I don't know what you're going on about. The technology has been available for a while. :P

Copyright infringment!

[Zebadias]

What I want to know - when is someone going to go after Sony for the infringment of the GPL! That is the greater offence in my mind!

List of Effected CD's

[dbucowboy]

I found this online, it's a list of CD's that have the DRM... don't remember where and I don't know if it's totally accurate but I think it serves as a good list of CD's to be suspicious of. Foo Fighters - In Your Honour Van Zant - Get Right with the Man Ricky Martin - Life Sarah McLachlan - Bloom Remix Album Celine Dion - On Ne Change Pas Neil Diamond - 12 Songs Natasha Bedingfield - Unwritten Kings of Leon - Aha Shake Heartbreak Santana - All That I Am Chris Botti - To Love Again Switchfoot - Nothing Is Sound Patty Loveless - Dreamin' My Dreams Montgomery Gentry - Something To Be Proud Of: The Best of 1999-2005 Mary Mary - Mary Mary My Morning Jacket - Z David Gray - Life In Slow Motion Bob Brookmeyer - Bob Brookmeyer & Friends Shelly Fairchild - Ride Kasabian - Kasbian Pete Seeger - The Essential Pete Seeger The Bad Plus - Suspicious Activity Elkland - Golden Susie Suh - Susie Suh Buddy Jewel - Times Like These Chayanne - Cautivo A Static Lullaby - Faso Latido Our Lady Peace - Healthy In Paranoid Times The Coral - The Invisible Invasion Dexter Gordon - Manhattan Symphonie Acceptance - Phantoms Dion - The Essential Dion The Dead 60s - The Dead 60s Goapele - Change It All Los Lonely Boys - TBD Life of Agony - Broken Valley George Jones - My Very Special Guests Horace Silver - Silver's Blue Amici Forever - Defined Ahmed Jamal - The Legendary Okeh and Epic Recordings Anna Nalick - Wreck of the Day Hitch - Soundtrack Charlotte Martin - On Your Shore Vivian Green - Vivian Raheem DeVaughn - The Love Experience Amerie - Touch Nivea - Complicated Mario - Turning Point G3 - Live In Tokyo

Re:Sony and DMCA - Don't forget

[Nom du Keyboard]

remviong software that degrade's the computer's security.

And Performance. Don't forget this thing can end up running continuously consumung both memory and cpu cycles.

Sony pwnage

[Mulletproof]

"'The Texas attorney general said on Wednesday that he added a new claim to a lawsuit charging Sony BMG Music Entertainment with violating the state's laws on deceptive trade practices by hiding 'spyware' on its compact discs"

Anybody else making the connection between this DRM tactic and those of the PSP, where Sony has plans to continuously update the DRM of the PSP with every new game release whether you like it or not. I'm sensing a disturbing trend- actually, it's been going on for quite some time now -in Sony's insistance on reguulating the hardware you already own contrary to your wishes.

Thankfully, their foothold on the PC industry is far less pervasive than it is in the console industry.

Senior Vice President of Software Development

[Anonymous Coward]

New York, NY - December 22, 2005 -- Sony Corporation of America announced today that Tim Schaaff has been appointed to the newly-created position of Senior Vice President of Software Development, effective immediately. Mr. Schaaff reports to Keiji Kimura, EVP and Officer in Charge of Technology Strategy of Sony Corporation.

http://www.sony.com/SCA/press/051222.shtml

Hmm someone get fired?

Don't look at the cat!

[mmell]

For right now, it's not dead.

installing after decline != illegal

[v1]

The EULA is a way for the company to get you to agree to certain terms (usually surrendering certain rights) in exchange for getting the software. If the software installs even when you click DISAGREE, all that means is you are getting the software (for better or worse, as the case may be) without having agreed to surrender the righs listed in the EULA. (the EULA is NOT for your protection, it's to protect the manufacturer from YOU)

NOW, one standard subset of the rights you surrender when agreeing with the EULA basically says you agree that the software is "as-is", "not fit for any particular purpose", etc. Basically you agree not to sue the manufacturer for any ill-effects caused by the software, even if the effects are known or the manufacturer was grossly neglegent in their design. Oftentimes these provisions are actually illegal or legally unenforceable though, but they basically stuff anything in there they can think of that makes them feel warm and fuzzy that they are bulletproof.

So this does not represent an illegal act, but rather it opens up the software distributor to numerous legal liabilities that the EULA would otherwise have afforded them some protection from. Given the extremely nasty nature of the software it installs, this should make a perfect target for lawsuits, since by installing the software without getting an agreement to the EULA, they have essentially taken off all their legal armor and stand naked before the courts.

I don't know if the installer basically behaves the same for the agree button as it does for the disagree, but from the article it rather souds that way. That being the case, it would be extremely difficult for Sony to prove that anyone agreed to the EULA. (normally the fact that the software got installed indicates you agreed, but not in this case) That means anyone that ran the installer has an opportunity to file a lawsuit based on harm received from their software, since Sony has no proof you agreed to their terms. (agreed to not sue them)

Re:"Cancel" != "Decline EULA"

[AKAImBatman]

An important point to take note of in this case is that the user doesn't intend to install software. The software automatically begins installing when the user places a music CD in his drive. Since the user did not purchase the CD for software, did not agree to have the software installed, and STILL doesn't get to listen the music he PAID FOR, the state is more than correct in prosecuting the pants off of Sony for fraud.

More Like Senior Scapegoat

[thepropain]

Sounds to me more like Sony didn't have a finger-pointing target, so they created one.

Re:Let me get this straight

[dreamer-of-rules]

The Shift key theoretically works, but doesn't always. I've held down the key, then inserted the CD, waited ten seconds, and then let go, and sometimes the CD still starts the autorun program. How long are you supposed to hold down the shift key? There's no popup or message saying that you can let go now (although there is a message asking if I am physically disabled..)

To fix this security and UI flaw, I've disabled autorun on our company systems, which breaks certain other features..

OS X does not autorun. It can, based on the content, start iTunes or iPhoto or something, but it will not automatically run programs from the CD. Which is wonderful. (On OS X, Sony has to beg the user to install the DRM manually-- what a difference!)

Wrong disaster

[SeanDuggan]

First of all, very amusing use of bold text.

Remember this is almost a bait and switch, the people bought a Celine Deon album and got the DRM disaster along with it.
Right. They were looking for a musical disaster, not a computer based one...

EULA must stand for

[MECC]

EULA: End User Loses Always

I've asked this before and I'll ask this again:

[merc]

When will we see CRIMINAL charges brought against Sony?

Speaking of Conspiracy Theories

[TooOldForIT]

John McCormick makes some interesting observations at the following Tech Republic link:

http://techrepublic.com.com/5100-1009_11-5991769.h tml?tag=nl.e101

Quoting from his article:

---- Begin Quote ---
"The latest Sony debacle shows once again that you can't be too paranoid. A month ago, I personally would have never given a second thought to playing a new brand-name music CD in an office computer--now I wouldn't even duplicate one for personal backup.

And isn't that interesting? Could it be that Sony planned this whole thing just to stop people from making backups of their favorite CDs by scaring them out of even putting CDs in their PCs?

Even those users who only made backups and ignored DRM threats will now be extremely cautious about putting any Sony CD in their PC. Could there be something even more sinister to this story than mere incompetence?"
--- End of Quote ---

Hmmmm....... sort of makes one think, eh?

This whole situation with DRM, RIAA, big record companies is really starting to bug me. I just happen to believe that if I pay good money for a CD, a vinyl record, or any piece of music, that I should be allowed to convert it and play it on whatever technology is available to me, as long as I don't give it away to everyone else in the world!

Using the Shift to prevent autorun

[WidescreenFreak]

The Shift key theoretically works, but doesn't always. I've held down the key, then inserted the CD, waited ten seconds, and then let go, and sometimes the CD still starts the autorun program. How long are you supposed to hold down the shift key?

What has worked flawlessly for me is this: hold the shift key down while the disc is spinning up. After the light goes out, you need to wait until there is a second blip on the activity LED. It's that second blip that actually indicated that the system is searching the disc for an autorun.inf file. If I release the Shift before that second blip, the autorun kicks in - every time. If I wait for about one or two seconds after that second blip, the autorun is stopped.

How long this takes seems to be determined by how easily your disc is read by the drive. I have one system with two DVD writers, one old, one new. A CD-R on the old one can take upwards of 30 seconds for it to be recognized and searched for the autorun file. The new drive takes about 10 seconds. In either case, waiting until after the second activity light to release the Shift prevent the autorun.

Just my two one-hundreths of a dollar. Convert to your currency as apporpriate.

illegal copying? Excuse me?

[Guspaz]

I take issue with this comment: "used by Sony BMG to thwart illegal copying of music on CDs"

Since when was it illegal to copy a music CD to put it on ones iPod? Doing so with regular music CDs doesn't violate the DMCA since there is no protection circumvention or reverse engineering going on, so this SHOULD still be legal in the US.

Of course, IANAA (I Am Not An American), so I may have it wrong.

If I agree then I have not agreed

[cpuffer_hammer]

If I do not agree to the EULA and the software is installed anyway. Then I have not agreed to not reverse engineer it and a lot of other things? Copyright still applies but non of the EULA terms that go byond Copyright.

Would this not be RICO-worthy, then?

[Khyber]

After all, this is a tactic commonly used by racketeers. We give you a contract, you don't agree to it, and we act like you agreed to it anyways, and either demand/extort money/info from you, or we tear your shit up. In this case, Sony just tears your shit up.

The RIAA will rush to defend Sony

[WCMI92]

Why?

Because anyone who would "decline" a EULA is obviously a PIRATE and thus, Sony was justified in pushing their malware through anyway ;)

It's an argument only a SCO lawyer could make, but the RIAA seems full of them :)

FUCK SONY.

[millennial]

When my dad discovered he had the Sony DRM on his computer, he asked me to remove it. Knowing that using Sony's tool to do so would simply open more security holes (turning on automatic program installation in IE, for one), I decided to go through and remove it manually.

After uninstalling the services, deleting the hidden $sys$ files, and removing the related registry entries, my parents' computer refuses to boot. I get a very uninforative BSOD. If I go into Safe Mode, the boot process halts after loading mup.sys (thus telling me the problem is with the next driver, whatever that is), then gives me a BSOD. They have an HP Pavilion, which came with an on-disk recovery tool. Unfortunately, all that is is the Windows Recovery Console, like the one on the installation CD. The CD we do not own, because HP did not give us one. Yes, that's right - we paid for a Windows license, and received no form of installation utility whatsoever.

Before I could even GET to the Recovery Console, I had another problem to figure out. When I tried to boot it, I got the good ol' "NTLDR is compressed" error. I checked - it was not compressed.

To boot into the Recovery Console, I had to boot BartPE, copy the NTLDR file from the Windows partition to the recovery partition, and reboot.

I've done everything I can think of to fix this. I've reset the BIOS and CMOS, cleared the ESCD, disconnected every piece of hardware other than hard drive, processor, and memory, changed various settings in the BIOS... to no avail.

Now we had to pay $24 for HP to ship us a recovery CD so we can get the damn machine working again. Not only that, but everything I've read on the Web says that reinstalling XP does not fix this issue, and that it's hardware-related.

Before this problem showed up, I couldn't burn CDs at all. Before the DRM was installed, I had no trouble doing this. I'm beginning to wonder if the DRM altered my burner's firmware.

Here's a big fuck you to Sony, and a slightly smaller one to HP. You are completely inept.