Sony DRM Installed Even When EULA Declined

HikingStick writes "News.com is reporting that the Texas attorney general is expanding the allegations against Sony. It seems the software would install even if users declined the EULA. From the article: 'The Texas attorney general said on Wednesday that he added a new claim to a lawsuit charging Sony BMG Music Entertainment with violating the state's laws on deceptive trade practices by hiding 'spyware' on its compact discs ... The new charges brought by Abbott contend that MediaMax software used by Sony BMG to thwart illegal copying of music on CDs violated state laws because it was downloaded even if users rejected a license agreement.'"

Comments

Criminal Tresspass

[Renraku]

"Can I come into your house?"

"Nope."

"Ok."

Man turns around to find the stranger at the door has already moved his shit into his house. Does this not constitute tresspassing?

Re:Criminal Tresspass

[Qzukk]

Huh?

When I put the CD in the drive, I wanted to play some music, not install some software. It's YOUR analogy that's flawed.

How about this:

I run a bar and decide to get some live music, so I call up a group of musicians. A popular and very well known band, of course, I don't want to drive my patrons out. They tell me "sure, we'll come and play, just give us some money." So I send them a payment, and the day of the performance, they show up with a 50 page contract. "Just sign this and we'll be set". I look over it, and I see among it's provisions that they're going to firebomb the stage at the end of the show. I give them the contract back and tell them no.

Then they firebomb the stage.

Re:Criminal Tresspass

[dr_dank]

I run a bar and decide to get some live music, so I call up a group of musicians. A popular and very well known band, of course, I don't want to drive my patrons out. They tell me "sure, we'll come and play, just give us some money." So I send them a payment, and the day of the performance, they show up with a 50 page contract. "Just sign this and we'll be set". I look over it, and I see among it's provisions that they're going to firebomb the stage at the end of the show. I give them the contract back and tell them no.

Then they firebomb the stage.

Moral of the story: Don't hire Gwar to play at your bar.

Re:Criminal Tresspass

[lynx_user_abroad]

Put simply, the EULA is not asking "Can we install the software?".

I follow you this far. To my reading of it, you are correct. But there's another aspect to this many (perhaps even Sony's Lawyers) have missed.

One of the more common things which one would agree to when accepting a EULA is an agreement to assume any subsequent liability, indemnifying the other party (Sony, in this case) against liability for flaws in the product, and such. The idea being (to choose a farsical example) that before you install the Sony rootkit onto a CDROM-equipped heart/lung machine, you must agree to accept full responsibility for doing so. Sony has no way of knowing, beforehand, that you are planning to install it onto a heart/lung machine, and probably did not perform anything in the way of due dilligence to ensure it wouldn't bluescreen heart/lung machines accidentially. (How could they?) So instead they should issue a generic warning that there are certain circumstances where installing this software might not be a good idea, that it's your responsibility to ensure that installing the software (playing the music) won't have any bad consequences, and that if you choose to install it there anyway, they won't be responsible for anything bad that might happen. That's what the EULA is for; to protect them.

But apparently, Sony is installing software without first securing that all important get-out-of-liability-free EULA card first. I'm sure sopme Sony lawyers are having nightmares about this.

While it's unlikely anyone tried to install a Sony music CD onto a heart/lung machine, the liability is not limited to those circumstances.

If a doctor tried to play music on his laptop, and later a medical liability case hinges around how bad data got into a patients medical report, Sony could become a party to the lawsuit, because a reasonable claim could be made that the Sony rootkit allowed some hacker to make changes to the patient medical report (and cover his tracks), and the burden of proof might well be on Sony to prove a) that such an intrusion did not take place, and b) that the doctor did in-fact accept the EULA releiving Sony of responsibility. That's going to be a tough burder to meet.

Of course, I haven't read the EULA itself, so I'm just guessing at what it insulates Sony against.

I'd be very surprised if the "install anyway" aspect of this was approved by a lawyer; if it was, he'll probably lose his job. If it wasn't approved by a lawyer, the one who failed to get such approval may be losing their job. But one thing Sony really can't do (IMHO) is just call it a mistake, because that would be admitting negligence without even a fight.

This one is going to be interesting to follow. It's almost one of those cases where Sony might hope for a quick class-action settlement just so they can fall-back to a "we already settled all of our obligations under the class action lawsuit; your wrongful death lawsuit is moot, because we already sent you a "coupon for a free CD".

Re:Criminal Tresspass

[lynx_user_abroad]

Or, to clarify:

If someone purchased a Sony rootkit music CD, and

If they put it into their computer, and

if they declined the EULA, and

if they did all that before they learned about the rootkit, then Sony just handed them a get-out-of-liability-free card for anything that happens on that computer from that point forward.

Spam gets sent to California? Sony pays the $10,000 fine.

Caught hacking into the CIA? Sony gets the free trip to gitmo.

Downloading kiddee porn? Not me, Mom. It's Sony's fault!

Let's take it one step farther...

Uploading Sony music onto P2P? Why don't you go cease-and-desist-yourself.

Now you understand just how far Sony has screwed this one up.

Can anyone here see a problem?

[dada21]

Let's look at the article:

'The Texas attorney general said on Wednesday that he added a new claim to a lawsuit charging Sony BMG Music Entertainment with violating the state's laws on deceptive trade practices by hiding 'spyware' on its compact discs

Oh, so the state was hurt, and they're the ones who have to go after Sony?

The way I see it, Sony breached a contract. This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit). You can hire a local attorney and move forward.

Wait, it is costly to sue a big company? Might that be due to the laws created in your state? Might that be due to the lawyers in control of the operation of the law?

No matter how often you lose, you will continue to lose. The system isn't by the People for the People any more. We're living in a country where the system is so powerful, only the powerful have rights. Let's ignore the state's concerns in this situation -- they're only going to find themselves stronger. They're going to fight Sony with millions of taxpayer dollars, and if they win, the taxpayers won't see a cent, but a bunch of state lawyers and Sony lawyers will be wealthier.

Step back. Look at the problem. The problem is that contract law is too complicated, and you can't fight a contract violation in court without a contract lawyer who likely is part of an organization that wrote the law. Ignore Sony, ignore all terribly written contracts. We need to get to the source of the problem and fix it. Let us return to the days when the law was simple to read, and simple to enforce. Let us return to the days when we could walk up to a court clerk, file a grievance and sue the people who violated the contract, just them and us.

Who is with me in asking for an amendment limiting all laws to one topic, 200 words or less, and only can pass with a signature of the President and a signature of a random person with a 3rd grade education who agrees that even they understand the law?

What Sony did was bad, but if contract law was written clearly and concisely, we'd have ways to defend ourselves cheaply and efficiently. The law is a mockery of justice today, and there is ZERO way for any individual or small group to win in the long run.

FYI, for other anarchocapitalists out there, my solution is true moderated arbitration mechanisms in a free market, not the law or the courts.

Re:Can anyone here see a problem?

[mlong]

The way I see it, Sony breached a contract. This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit). You can hire a local attorney and move forward.

However, since one clicked Disagree/Decline, then they did not enter into any contract. Yet Sony went and installed software anyway. That is trespass and thus the state should be involved since it was illegal activity.

Re:Can anyone here see a problem?

[AKAImBatman]

The way I see it, Sony breached a contract.

A contract is, by definition, a bilateral agreement. The EULA is a contract offer, and if it is declined, there is NO contract between Sony and the user. What that means is that Sony is forcing a unilateral agreement onto a user who does not have a contract with Sony. That's a criminal case, not a civil case.

Of course, I'm not a lawyer, so take my comment with a grain of salt. But that's my interpretation of it in a nutshell.

Re:Can anyone here see a problem?

[jebell]

While I generally agree with your sentiments regarding pre-existing civil remedies, state Attorneys General routinely file "consumer-protection" type of law suits against big companies in order to spare the consumers from having to litigate matters that would otherwise be too costly.

While some have criticized over-active Attorneys General, like New York's Eliot Spitzer, for being too litigious, I think this type of action has its place. It's definitely better than the standard class-action suit where the lawyers are made rich and the class members get a coupon for $5 off their next purchase of the product they complained about in the first place. I don't think the "state lawyers" get rich in this type of case, although there are instances (like the tobacco litigation) where the states hired outside lawyers to litigate this stuff.

Law has always been complicated, believe it or not. Else, why have we had lawyers for so long? At least for the last couple of hundred years, we've actually had laws that are written down in codes and case books.

Re:Can anyone here see a problem?

[twiddlingbits]

Correct, contracts have to be entered into bilaterally not unilaterally. It is a matter for the State as it is then Fraud to execute a contract not agreed to by both parties. Criminal prosecution IS the domain of the State. If the GP poster can think of a civil tort that was committed by Sony the sue them. Find a good lawyer who will get 40% of what you win and go for it. Or you could go to small claims court. If you win, just how do you think you will enforce the penalty?

Re:Can anyone here see a problem?

[node 3]

Oh, so the state was hurt, and they're the ones who have to go after Sony?

The State (in America) is us. It's We The People.

The way I see it, Sony breached a contract. This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit). You can hire a local attorney and move forward.

That worked so well with the Linux geeks who tried to return Windows per the OEM EULA.

Oh, wait. No, it didn't.

But it's worse than that. Let's assume you manage to design a low-cost way for individuals to sue a large corporation, how many people are actually going to sue Sony? Not many. So Sony will just eat the cost of a few lawsuits, and continue as usual.

Do you really expect people to sue over every little transgression? Do you have the time to be diligent over every EULA, every "implied" contract in your everyday life? Odds are you don't. That's what the State is for (in the US), to look after our collective interests. Doesn't always work out that way, but it does work out better than without the State. There are also Class Action suits, which are not necessarily brought on by a State, but are backed by the State, so the effect(collective power, backed by the State) is the same.

Who is with me in asking for an amendment limiting all laws to one topic, 200 words or less, and only can pass with a signature of the President and a signature of a random person with a 3rd grade education who agrees that even they understand the law?

Not I. Your post is more than 200 words. Do you think it's complex enough to cover questions like automobile operation? Building codes?

Laws can't be as simple as "thou shalt not kill", because sometimes thou shall kill. And sometimes different types of killing are met with differing levels of "shalt not".

The law is a mockery of justice today, and there is ZERO way for any individual or small group to win in the long run.

Under the current Republican House, Senate, and Presidency, that's become ever more true. They are systematically removing the rights of the people, and empowering the corporation. It's disgusting.

FYI, for other anarchocapitalists out there, my solution is true moderated arbitration mechanisms in a free market, not the law or the courts.

There is no such thing as the Free Market. Laws and Courts are required to prevent Capitalism from reverting to the Law of the Jungle.

Re:Can anyone here see a problem?

[dr_dank]

That is trespass and thus the state should be involved since it was illegal activity.

Might makes right. A cracker who sends trojans or rootkits may actually see fines or jailtime. A corporation who does the same thing is just protecting its IP or, if suitably backed into a corner, admit they made a mistake and continue doing the same crap with a different name. You'll never see a single indictment for wrongdoing at a large company for this.

Re:Can anyone here see a problem?

[AKAImBatman]

It's not a contract because clicking a button is not intent to contract. It's not a signature, it's not a handshake

It's a contract in the same way that ordering food in a restaurant is a verbal contract to exchange money for food.

Reasons why EULAs may be unenforcable contracts, however, include:

- They tend to be unilateral in nature.
- They attempt to impose restrictions AFTER the point of sale contract. (This is a legal no-no.)
- They are forced upon the customer, as the he has already paid for the software.
- There's no way to prove that the user actually accepted the license. (That's why the GPL has a fall-through clause that uses regular copyright law for protection.)
- It cannot be shown that customers actually understand the license before accepting it, meaning that the terms may be unenforcable.

Basically, there are a lot of problems with EULAs. The idea that they're not contracts, however, is not one of them.

Re:Can anyone here see a problem?

[cpt kangarooski]

This is easily resolved in court, and anyone who had their contract breached by Sony should go ahead and file an independent lawsuit (not a class action lawsuit).

Why? Class actions are efficient. In this case, everyone would be alleging the same thing against the same defendant. It's far better to have that go to court once, rather than have everyone litigate the same thing, which wastes their time and money and clogs up the courts.

If you have a tortfeasor that harms a lot of people, but where the harm to any one person is slight, you still want to have them cure the harm they caused and to punish them so that they don't do this again in the future. This is not practical if everyone has to sue independently, since many people will not bother (and thus go uncured) and the tortfeasor will not be significantly deterred from doing it again. A class action is an efficient pooling of resources (even if each person harmed is only awarded $1, they only are paying 33 cents for the lawyer -- that's a good deal, really) and can actually deter future tortfeasors.

Wait, it is costly to sue a big company? Might that be due to the laws created in your state? Might that be due to the lawyers in control of the operation of the law?

No. It's costly because, in the interests of justice, you have to do a competent job proving that the company did something wrong. Most people do not know how to do this. Complaining that the system is complicated is as silly as complaining that people can't build moon rockets in their backyards -- some diciplines are inherently complicated. Actual justice is hard.

but a bunch of state lawyers ... will be wealthier.

State lawyers are just employees. They get a fixed salary like other state employees. It's sole practicioners and partners at firms that get shares of the damages. So if the state wins, the money probably ends up in the state's general fund.

The problem is that contract law is too complicated, and you can't fight a contract violation in court without a contract lawyer who likely is part of an organization that wrote the law.

All lawyers get trained in contracts, and since most lawyers deal with contracts no matter what else their specialties are, we all can generally deal with them. Also, most contract law is common law, and has been created by the courts in the US and England over the last thousand years or so. Most of the people who wrote contract law are long dead, and were never particularly organized.

Let us return to the days when the law was simple to read

That's never been true, unless you want to go back to an eye for an eye. Law is inherently complex. There is no magical set of laws -- laws being rules for a good, stable, working society -- that is simple and will function. You're looking for a utopia, and those don't exist.

Re:Can anyone here see a problem?

[AKAImBatman]

There is an implied contract, I'd say. Sony has contracted to sell you a CD containing music.

The key here is that you were sold music, not software. Software is not a feature of the music and was bundled without disclosure. This in itself may be illegal in some states. Now add to that fact that the software installs itself even after you decline to a contract offer for the software, and you have a recipe for legal disaster.

The rest of your comment is irrelevant. The software is not a feature of the music. Period.

Heh.

[jacobcaz]

By clicking "Agree" below, you agree to the terms of this EULA. By clicking "Decline" below, you agree to the terms of this EULA.

[ AGREE ] [ DECLINE ]

Feds dropping the ball?

[cez]

Shouldn't these charges also be mirrored by the feds seeing how Sony is an international company who's crossed state lines with malicious code?

While I'm pleased I suppose...

[Concern]

...this is a bit ridiculous on its face. Sure the spyware is illegal in about a dozen different ways (depending on your state) but... this all hinges on whether or not we accept or decline a EULA? How does that make sense?

That kind of reasoning by implication gives EULAs legitimacy which THEY DO NOT HAVE.

Since when under common law do we have such outrageously elaborate and suprising binding legal agreements by parties without equal representation?

Since when can agreement be given by pressing a mouse button or removing shrinkwrap?

The EULA itself is an ugly audacious legal fiction... this is why they needed UCITA to attempt to legitimize them after the fact.

Re:While I'm pleased I suppose...

[LexNaturalis]

I think it's just another straw in the pile. This just adds another charge against the company that they will have to defend themselves against. The other charges don't hinge on the EULA issue at all; the rootkit is still illegal. This is simply ANOTHER thing they are adding. So even if the rootkit is found to be legal, they can still be nailed with this charge.

From my law classes, my lawyer professors told me that a favorite trick of lawyers is to allege as many possible crimes/violations as possible so as to make the other side more likely to either plea bargain or settle as well as to raise the chances of successfully arguing at least ONE of the charges/torts.

(Disclaimer: IANAL, just had some law classes)

It's only fair

[goombah99]

I click through EULAs because I dont think they have any legal weight. Sony in turn ignores my requests not to install since they don't think EULA's have any legal weight. In sshort the 'A' in EULA is not an agreement, meeting of minds, or a legal contract. I'm fine with that I guess. Those privacy rights were unenforcable anyhow so I lose nothing.

If only...

[Anonymous Coward]

Now if only the death penalty in Texas applied to corporations...

Indie Music

[jhouserizer]

Sure am glad I've only purchased indie cd's in the last few years! Apparently not only do the big companies cram crappy music down your ears, but they also cram crappy software into your computer.

This is probably hurting Sony in sales from nerds

[EvilMonkeySlayer]

For example, I was planning on buying a new widescreen tv and a psp, but because of the rootkit etc I decided against a Sony tv and i'm probably going to buy either a Nintendo DS or the GPX2.

I wonder, if Sony has lost any sales because of this. Just how much in cash it has cost them?

To save some clicking

[kawika]

This is the original blog that revealed the SunnComm DRM installed despite the user declining the EULA. Whereas the XCP DRM could hide behind the EULA excuse, I don't see how SunnComm has any legal fig leaf here (though IANAL).

Supposedly there is about ten times more SunnComm DRM in the wild than XCP DRM, so maybe Sony felt they couldn't sacrifice holiday sales despite the legal exposure.

Lawsuit

[Council]

Sony is complaining that although they declined the offer to be sued, the Texas AG is still pursuing the case.

Not a Virus?

[DeanFox]

FTA: "The creator of the copy-protection software, a British company called First 4 Internet, said the cloaking mechanism was not a risk. The company's team has worked regularly with big antivirus companies to ensure the safety of its software, and to make sure it is not picked up as a virus, he said."

First of all, I would like to know who these "big antivirus" companies are so I can stop using their product (assuming I might be). That or to make sure I never use or recommend them to others'.

We are in trouble when antivirus companies are in backroom negotiations with virus makers, I assume for profit, not to detect one virus in favor of another.

How can I trust they haven't negotiated other backroom deals with virus/spyware writers that let other viruses and spyware on my machine?

I want to know who these "anti" virus companies are!

Well, that depends...

[Concern]

If it were me who tried to install spyware on people's PC's using music CDs, the answer would be yes.

On the other hand, if it were a wealthy multinational corporation who did so, the answer would be... perhaps we can find a discrete settlement to avoid any discomfort to our most valued citizens.

EULA makes no difference

[FreeBSD evangelist]

I have an RCA Victor (one of Sony/BMG's brands) with MediaMax. It absolutely installs software on your computer, even =before= the EULA response box pops up.

Corporate Anarchy

[Beerden]

We live in the age of Corporate Anarchy. A Corporation has had, in the past, essentially the same rights as an individual human. Now, however, individual rights have been taken away, yet the Corporation is free to do what it pleases. Corporations like SONY feel they are above the law, and are now testing to see how far they can go. After Corporate Anarchy comes Corporate Rule. I would not shed a tear if the Individuals were to blow up Corporate buildings, clean out Corporate bank accounts, and fight in a [very bloody] Revolution against Government and Corporation (war against Facism, in other words). Civil war, if you could call it that, but more like the French Revolution. I think there is no other way around it, because History shows us that it will happen.

It's even funnier than this...

[Concern]

Imagine if you order a box of catfood to be delivered that's worth about $10. And then the next day a crowd of 15 attorneys in suits arrive at your door with a 20 page contract, and the box. They won't give you the catfood until you agree to their "license." You can either call your own attorneys, if you have any, and spend several weeks evaluating their contract at the cost of several thousand dollars of your own money, or, they say, you can simply agree to the contract by blinking your eyes.

It turns out that there were worms in the catfood and now your cat is incredibly sick. Amazingly, the attorneys did this on purpose. If you take her to the vet, it will cost you hundreds of dollars to cure her. You don't remember blinking, but they swear you did.

The government has sent an angry letter to the catfood guys, but no one looks like they have any intention of paying your vet bill - or even sending your cat a get well card.

In response to the government, the catfood people announce they've "solved" the problem, because they've agreed to temporarily stop shipping worms in catfood. However, they're still shipping spiders, ants, and leeches - and they have "big plans" to expand the practice.

You don't know exactly how long your cat has left to live, but after watching all this, you get the feeling its days are numbered one way or another.

Re:It's even funnier than this...

[Kelz]

No no its even funnier! Since this is current music, the catfood was actually poison!

Re:It's even funnier than this...

[eyeball]

Epilogue: lawyers organize a multi-billion dollar class action lawsuit against the cat food company. They get the billions of dollars, and you get a coupon for more cat food.

Re:"Cancel" != "Decline EULA"

[10101001 10101001]

Yes and no. You see, there's state and federal laws against computer trespassing. This means that if there's any legitimate use for an EULA, it's to basically indemnify the company by making it clear that the user intentionally installed software. This means that if software is installed regardless, there's a valid basis for computer trespassing--note, this is true if one manages to bypass the EULA, as well. Computer trespassing laws are generally very vague and badly written, so only something like an EULA really will protect an entity from prosecution under them. At least in this case, were someone was specifically presented the EULA and did not agree to it while software is installed anyways, there's no way to somehow misinterpret the letter or the spirit of the law to not take it as computer trespassing, unlike with intentionally bypassing or hacking an EULA to install software without agreeing to it.

Wrong disaster

[SeanDuggan]

First of all, very amusing use of bold text.

Remember this is almost a bait and switch, the people bought a Celine Deon album and got the DRM disaster along with it.
Right. They were looking for a musical disaster, not a computer based one...

Speaking of Conspiracy Theories

[TooOldForIT]

John McCormick makes some interesting observations at the following Tech Republic link:

http://techrepublic.com.com/5100-1009_11-5991769.h tml?tag=nl.e101

Quoting from his article:

---- Begin Quote ---
"The latest Sony debacle shows once again that you can't be too paranoid. A month ago, I personally would have never given a second thought to playing a new brand-name music CD in an office computer--now I wouldn't even duplicate one for personal backup.

And isn't that interesting? Could it be that Sony planned this whole thing just to stop people from making backups of their favorite CDs by scaring them out of even putting CDs in their PCs?

Even those users who only made backups and ignored DRM threats will now be extremely cautious about putting any Sony CD in their PC. Could there be something even more sinister to this story than mere incompetence?"
--- End of Quote ---

Hmmmm....... sort of makes one think, eh?

This whole situation with DRM, RIAA, big record companies is really starting to bug me. I just happen to believe that if I pay good money for a CD, a vinyl record, or any piece of music, that I should be allowed to convert it and play it on whatever technology is available to me, as long as I don't give it away to everyone else in the world!

illegal copying? Excuse me?

[Guspaz]

I take issue with this comment: "used by Sony BMG to thwart illegal copying of music on CDs"

Since when was it illegal to copy a music CD to put it on ones iPod? Doing so with regular music CDs doesn't violate the DMCA since there is no protection circumvention or reverse engineering going on, so this SHOULD still be legal in the US.

Of course, IANAA (I Am Not An American), so I may have it wrong.