Sony BMG Settles Over CD DRM

aurispector writes "Sony BMG Music Entertainment will pay $1.5 million and kick in thousands more in customer refunds to settle lawsuits brought by California and Texas over music CDs that installed a hidden anti-piracy program on consumers' computers. The settlements, announced Tuesday, cover lawsuits over CDs loaded with one of two types of copy-protection software — known as MediaMax or XCP. Although it's great to see this as a victory for consumers, I can't help but wonder about the next wave of DRM schemes."

Comments

The Best Democracy Money Can Buy

[dada21]

Each State gets $750,000 -- customers will share "thousands more."

Nice. Real way to protect the consumer.

Re:The Best Democracy Money Can Buy

[cashman73]

Consumers won't get, "thousands more." From the article, "In addition, Sony BMG agreed to reimburse consumers whose computers were damaged while trying to uninstall the XCP software. Customers in both states can file a claim with Sony BMG to receive refunds of up to $175."

"Customers have 180 days to file claims, which must include a description of how their computer was harmed and documentation of repair expenses."

Granted, $175 is still a decent amount of money. So if you're computer was reasonably fscked, it would probably be a good idea to go through the paperwork. Unfortunately, Sony is probably betting that most people will probably decide it's not worth the hassle. Then, there's the fact that about half of the paperwork customers file will end up going to some overworked, incompetent paper-pusher office slave who will either take way too long to approve the request, or reject it for some bullsh*t reason,...

Re:The Best Democracy Money Can Buy

[jcr]

Granted, $175 is still a decent amount of money.

Nope. Sony got off very lightly here.

-jcr

Re:The Best Democracy Money Can Buy

[Sylver Dragon]

I'm wondering how vigorously the claims are checked. If it's mostly just a matter of filling in the applicable paperwork and waiting for it, I can see people just deciding to get free money and filing a claim, regardless of actual damage. Heck, it might be fun to figure out how/where to get the form, what needs to appear on it and get as many people as possible to send one in. Sort of 'slashdot' the system.

Re:The Best Democracy Money Can Buy

[Mex]

Sir, I am in Mexico and even here, 175 dollars is not "A decent amount of money".

Re:The Best Democracy Money Can Buy

[kimvette]

Especially considering that if $RandomSlashdotter hacked one of Sony's servers to install a rootkit and got caught, Sony would be seeking millions for that one single incident, plus jailtime.

Sony execs should be doing time over this.

And Thousands more

[ePhil_One]

So not only $1.5 Million in fines, but THOUSANDS more in refunds? So this could cost Sony a total of $1.503 Million dollars? I was going to invest in Sony stock until I noticed that lst little caveat, raising the punishment a potential two or 3 tenths of a percentage point.

Sony is Doomed.

Cheap DRM Research

[mandelbr0t]

Doesn't sound like Sony got particularly chastised here. If I were Sony, or any other company interested in inflicting DRM on my customers, I'd happily pay the fees that they're talking about here. Total cost is less than $10M, which is a drop in the bucket for a large, multi-national corporation. If they succeed in inflicting their DRM, they win by taking our rights away. If they lose, then they get some R & D done about how to do better next time. If this judgement were to mean anything to the consumer, there would have to be significant punitive damages as well (I'm thinking in the neighbourhood of $100M or more).

Either way, not much to see here. Big company does nasty things with DRM, gets caught, walks away with dignity and wallet intact.

mandelbr0t

Next Step

[Mateo_LeFou]

Is anyone going after the antivirus/antispyware companies whose offerings gave the rootkit a pass?

Re:Next Step

[Whiney Mac Fanboy]

Hmmmmn, while we should indeed go after the anti-virus vendors, I think the next step should be to ask why some sony exec isn't recieving jail time for deliberate malware distribution to millions of PCs.

Re:Next Step

[lightspawn]

Is anyone going after the antivirus/antispyware companies whose offerings gave the rootkit a pass?

How about the OS vendor that runs untrusted code off a CD without as much as bothering to inform the user?

Re:Next Step

[mrchaotica]

No kidding -- and you know what the worst part is? If it had been an individual doing this, he would have gotten the jail time! But since it's a big corporation responsible, they get the best "justice" money can buy.

Anybody know the names of the dumbass judges/prosecutors that approved this? I, for one, would like to help them realize just how asinine this settlement is by bitching them out!

Re:Next Step

[xrobertcmx]

It could be worse. It could be like the Verizon Wireless coupon settlement that was just approved. $15.00 off your bill or a qualifying Verizon Wireless service. Customers no longer with Verizon Wireless must sign up for a Verizon Wireless plan to use the coupon. Tell me who approved that?

Re:Next Step

[xrobertcmx]

Sheepish Acceptance on whose part? Not mine. All it did for me was convince me that when my contract with Cingular was up I wouldn't be going back to Verizon Wireless. I am one of those people with a regretable tendancy to bookmark the FCC complaint form and use it when I can't get proper service.

Re:Next Step

[Afecks]

how to disable autorun

3rd party program prompts before executing unknown code/drivers, prevents hooks, etc

If Microsoft adds this stuff by default they are being anti-competitive. If they don't then they are selling an insecure OS. Basically they are damned if they do, damned if they don't. Windows has plenty of leaks but there are plenty of ways to plug them. The days of relying on Windows to include everything for you should have ended in 2001.

Re:Next Step

[putaro]

The "limited liability" applies to *shareholders*, not to corporations as a whole or to corporate officers. Limited liability simply means that shareholders are only liable for the amount that they invested in the company, nothing more. It doesn't place corporations above the law or limit the amount of damages that can be levied against them. What it means is that if a company is bankrupted by a liability you can't then move on to the shareholders and say "Hey, you owned a piece of this company that owes me money and therefore you own me more money". This is in contrast to a structure like a sole proprietorship where you, as the owner/operator of the company are also liable for all of its debts with no limit to that liability.

And by "thousands more" they mean...

[rob1980]

Thousands of unsold copies of some long-forgotten Mariah Carey album.

SparkArt?

[hotrodman]

After having dealt with some of these people, I'd say the next wave is coming from a little company called SparkArt. They also get into 'Viral Marketing'. SA deals with Sony as well, so this little company would be one to keep an eye on in the future......

Re:Tagged Peanuts

[ScrewMaster]

Legally questionable, ethically suspect, morally bankrupt.

This is sad.

[urbanradar]

Everyone saw it coming, but it's still sad. If I broke into your house and got caught, I would never get away with simply having to replace the broken lock and saying I'm sorry. But when Sony violate their customers' rights as gravely as they did, they get away with paying what amounts to little more than a token fee.

Re:This is sad.

[bazorg]

Now all we can do is have the Slashdot effect move outside the borders of teh intarweb. eveytime you see someone considering buying something from Sony, spread some FUD aloud so all shoppers hear you.

Trusted Computing

[HAL9000_mirror]

"Although it's great to see this as a victory for consumers, I can't help but wonder about the next wave of DRM schemes."
With any disrupting technology, one can use it for "safer" computing or "treacherous" computing (remember P2P?!). It almost looks like entertainment industry is waiting to embrace this (one once it matures) and use it treacherously. BTW, my research area is trusted computing and I believe this technology is the first step towards safer computing. It is so very un-scientific to blindly disregard any technology at inception. All in all, you want it or not, corporations are going to push it into your home PC very soon...

Not the DRM, the rootkit.

[jcr]

iTunes, RealPlayer and several other apps prove that it's possible to implement DRM without buggering the host OS. Sony's not in trouble for using DRM, they're int trouble for installing a rootkit.

-jcr

Re:Not the DRM, the rootkit.

[Lux]

Right. Only they're not in trouble.

Fair Compensation

[Alyred]

So, let's see. When Sony thinks that someone has "pirated" music, they sue them for, what, $1,500 per song, yet illegally invade people's computers and privacy and get off with a hundred dollars or so per person?

Where's the justice in that?

Why?

[ArcherB]

Why did the states take the settlement? There is no way that Sony could have won this. TX and CA should have rode it out!

1.5 Mil? Someone got paid

[BlueCoder]

60 million would be an insult. They spend more than that on ad campagnes. 1.5 million? That's like a paper cut. On the low side it should have been 200 million to settle. There is some serious corruption going on.

I Bet It's A Big Deal Internally

[sweatyboatman]

they certainly could continue putting rootkits on their CDs, but they're not in the business of giving money away. These companies are big, but the different divisions (and sub-divisions) all keep records of profits and losses. This is going to show up in a big way.

I can see the meeting now:

Muckety Muck: Last quarter your unit had profits of $1.5mil. But this quarter you have a loss of $.5mil. Care to explain?
Sony Music Exec: Well we put this DRM on our CDs and got sued and settled for $2mil.
Muckety Muck: I see. Did the DRM reduce piracy? Or increase sales?
Sony Music Exec: Well... we can't tell if it reduced piracy. And, ahem, sales kinda collapsed after people found out we were getting sued for it.
Muckety Muck: That might just qualify for the dumbest business decision this year! No bonus for you and I'm taking away your parking space.

so while for Sony it's not a big deal, you can bet that the people that made the decision to rootkit their CDs are scrambling to save their careers.

Re:I Bet It's A Big Deal Internally

[NeutronCowboy]

Personally, I see the exchange happening a little differently...

Muckety Muck: Last quarter your unit had profits of $1.5mil. But this quarter you have a loss of $.5mil. Care to explain?
Weasely Sony Music Exec: Pirates! Yes, Pirates! With swords and parrots! Our DRM just wasn't strong enough to hold them off. But if you give us another 2 million dollars, we have this surefire thing that is guaranteed to work!
Muckety Muck: You sound full of confidence, so you must be right. Here's another 2 million dollars.
\Weasely Sony Music Exec already working on how to use that money to gild his Gulfstream

I see very little scrambling that will be done by Execs. At most I see some fingerslapping for the poor guy who implemented it.

Re:I Bet It's A Big Deal Internally

[asuffield]

You forget that the whole thing happened months ago. The exchange would go more like this:

Muckety Muck: Last quarter your unit had profits of $1.5mil. But this quarter you have a loss of $.5mil. Care to explain?
Weasely Sony Music Exec: My predecessor was trying to prevent piracy, but chose a flawed product to do it. It could have cost us tens of millions, but I managed to get it down to $2m. Also, if you give us another 10 million dollars, we have this surefire thing that is guaranteed to work!
Muckety Muck: You sound full of confidence, so you must be right. Here's another 2 million dollars, and a bonus for saving the company money.

These kind of decisions are always made by people who intend to have been promoted into another division by the time the lawsuits roll around.

Slashdot editors brainwashed or what?

[raap]

This story report is horrible! First it's the Sony rootkit. Name it as such. Not some "DRM" bullshit. Second: "victory for consumers" ? This is wrong on so many levels, I don't believe it. We are customers, not consumers. And no, it's not a victory, not at all. Sony did commit thousands of computer crimes for purely financial interests and got a slap on the wrist. Kevin Mitnick would be in Jail for 3000 years for this. And if my information is correct, the settlement states explicitly, that Sony does not recognize any guilt. Sorry for this rant. But how can such a misleading article be on the front page?

Re:That's it?

[Anonymous Coward]

Sony, with $15.7 billion quarterly revenue?

1) Don't confuse revenue with profits. Its entirely possible to lose money with $15 billion in revenue. Recall the Dot Com mantra "We lose $1 on every item we sell, but make it up with volume!" 2) Don't confues the conglomeration of companies and divisions that is Sony with the Record group. If the Music group is not profitable, the will be sold or dismantled to folks who think they can make money on the product 3) Fines like this come right out of profits and cash, they hurt a lot, especially in an industry that is struggling to turn a profit (because of bad business decisions, piracy, or government mind control rays, whatever),

What about criminal charges?

[zentigger]

If I hacked into thousands of computers and installed a root kit without permission, I'm pretty sure I would be facing enough jail-time to seriously stretch my sphincter. In Texas, I bet that would probably be enough to get the chair! Someone should be going to jail for this kinda crap, and Sony should have their corporate charter dismissed and the assets seized. (corporate death sentence)

Re:What about criminal charges?

[mpcooke3]

Now, now, don't try and make out that the law would somehow treat you "differently" to Sony.

All you would need to do is become part or a cartel that engages in international price fixing, rip off millions of music lovers and thousands of artists, hire hundreds of lawyers and lobbyists and you too will get a decent legal defence.

Re:What about criminal charges?

[Ender Ryan]

Someone should be going to jail for this kinda crap, and Sony should have their corporate charter dismissed and the assets seized.

You know, I "hate" a lot of companies. In particular, I "hate" Microsoft -- although I only truly hate companies guilty of more egregious crimes. Not because they are the "most evil" company in the world, but simply because they interfere with my career, harass me at work, and have done a lot of damage in my industry(IMHO).

Still... MS corporate execs perjured themselves in court on a regular basis, to the detriment of the entire American public, throughout their whole anti-trust trial, and I never called for the disbandment of their entire company and the seizing of all their assets(how the parent got modded up... some mods must be demented). Do I think some of the top execs at MS deserve to do some time? Maybe. I believe they deserve a fair shake in court if it came to that.

Anyway, my point is this: many of you participating in this 2 minute hate, like the parent poster, are being absolutely fucking ridiculous.

That said, I do consider the "rootkit" to be criminal, and I do indeed think criminal charges should be considered. One must take into consideration, however, the "rootkit" was not developed by any division of Sony, and we cannot rush to conclusions that any of the Sony execs you folks are calling for immediate pound-me-in-the-ass sentences for had any idea what it was exactly they were doing.

Riiight. I'm sure a few other people care about being reasonable and objective... But let the furor will continue unabated.

Now go ahead. Call me a "fanboi" again.

Re:What about criminal charges?

[hey!]

That said, I do consider the "rootkit" to be criminal, and I do indeed think criminal charges should be considered. One must take into consideration, however, the "rootkit" was not developed by any division of Sony, and we cannot rush to conclusions that any of the Sony execs you folks are calling for immediate pound-me-in-the-ass sentences for had any idea what it was exactly they were doing.

If there is any uncertainty, a proper criminal investigation would eliminate it. There surely must be correspondence between Sony and the developer, including detailed product specifications.

There's a kernel of truth in what you say though. This kind of thing happens all the time in business, because normal people aren't inclined to examine their actions ethically. They go by what "sounds right", which is why the industry is so keen on the term "piracy".

If rootkit vendor had used the colloquial (but inaccurate) term "computer virus" to describe their product, Sony execs might well have been mortified. However, if the vendor described the actual operation of a rootkit in the context of reducing copyright infringement, carefully using neutral terminology, it is quite possible that the execs would see nothing illegal or immoral about it. Quite the contrary, since they were protecting their own legal and ethical rights, it might have seemed like a morally good thing to do.

Which is no excuse. You can't say "Gee, I guess I didn't think the consequences through very carefully," when you torch your neighbors house.

Meanwhile in a secret Sony Research Lab...

[vivin]

Sony Suit: Well guys, looks like our DRM scheme tanked. But $1.5 is nothing. Muahaha. That's lunch money for me. What new stuff do you have?
Researcher John: Well, we got this thing where we can put in subliminal messages into the music that our customers buy. Stuff like "P2P and Piracy rapes your mom!" or "Buy more sucky and/or mediocre music!" or "Mike is a fag!"
Researcher Mike: Shut up John!
Sony Suit: Oh that's good stuff! Anything else?
Researcher John: Well, Mike has another idea.
Researched Mike: (holds up cute puppy) We can threaten to kill this cute puppy if they pirate stuff!
Sony Suit: EXCELLENT! (pets cute puppy) Woo's a cute puppy-wuppy! Woo's gonna die to pwotect our intewests!! Oooohh!! Sooo cute! Yesyouare!! Yesyouare!!

Don't be so critical

[DietCoke]

I mean, they did agree to pay $1.5 Milllllion dollars!

Now please excuse me, I need to count the 15 pennies that I'm now entitled to.

Fuck Sony.

Completely unacceptable!

[gweihir]

First they should be criminally liable. What they did is computer-sabotage for commercial gain. Only prison-time is acceptable.

Second, they should have to pay everybody the cost of professional cleanup. I would say that is at least $150 per customer hit, probably more.

I think they got out of thi extremely cheap. Not acceptable for clearly criminal behaviour.

Re:Completely unacceptable!

[gweihir]

As an aside... they are offering $175 to each person who complains to them about the rootkit... or fills out their form...

Ok, that is reasonable. But that they can get out of this without any criminal liability is just not ritght. In what way are they different from a common hacker, except that they commited the crime far more often, for commercial gain and in a conspiracy?

Re:Just boycott these companies.

[NeutronCowboy]

Holy crap, batman - someone completely missed the point of a boycott. Note: you boycott a company if you decide that you are not going to buy their products regardless of their intrinsic merit. So yes, you boycott a company even if they release the best rear-projection TV ever, or if it comes with the kitchen sink and does your laundry, too. Finally - can I point out that you just placed watching TV on a nice TV set above having principles and following through with them?

Wow.

Re:They still have these DRM CDs for sale in Mexic

[xeno314]

You realize that this isn't the same DRM/Rootkit that is in controversy (XCP) here, right? (That's specifically noted in the Wikipedia article you cite.)

Oops 13 other states.

[headkase]

My bad.

sony will likely pay nothing

[Trailer Trash]

I would pretty much bet that they'll charge this whole thing against the cd sales of the artists that had this crap on their cds, effectively costing sony nothing. Remember that this is a company that still makes artists pay for "breakage" on iTunes sales.

Re:1.5 Mil? Someone got paid

[Anonymous McCartneyf]

So? People on the wrong side of copyright lawsuits, inc. the ones Sony files, are likely to pay more than a quarter of their yearly income to the RIAA.

Re:1.5 Mil? Someone got paid

[Chowderbags]

And I'm sure that a copyright infringement suit would end up costing most people a lot more than 112% of their net income for a 3 month period.

But it's really much worse, because any individual who did what Sony did could be convicted under the Computer Fraud and Abuse Act, and sent to jail for up to a decade. Instead, Sony has to give up what, 10% of their profits over a 3 month period? Less than 3% of their yearly profit (give or take)? How is that justice?

Re:DRM = Digital Restrictions Management

[15Bit]

No, it is Digital Rights Management. Its just not YOUR "rights" they're managing...

Re:DRM = Digital Restrictions Management

[Faylone]

I guess it still fits, it's mutilating our rights after all.

Re:My solution to prevent being a victim...

[Yetihehe]

Or buy as many PS3 as you can and convince your friends to buy one. PS3 is worth more than it costs, so Sony is paying for every PS3.

Re:1.5 Mil? Someone got paid

[slughead]

So? People on the wrong side of copyright lawsuits, inc. the ones Sony files, are likely to pay more than a quarter of their yearly income to the RIAA.

The average individual law suit was for $2000 or so. You're telling me most people (who own computers and presumably have broadband access) make less than $2000/quarter ($8000/year)?

People seem to think that corporations are evil, faceless, and have infinite amounts of money.

When a corporation is sued for a large sum of money, people lose jobs and it's almost never the ones who deserve it.

If you were to take $200 million from Sony BMG, which has been seeing declining sales almost constant since 1998 or so, you'd be putting hundreds of people out of work.

As another poster said, the people in the company who were responsible for the rootkit have probably either been fired, disciplined, embarrassed, or penalized in some other way. At any rate, Sony wont be doing it again.

As for the consumer, getting up to $180 for a computer virus is a pretty good deal. It may not "punish" them in the way us bloodthirsty Americans would want to see, but makes up for what they did wrong. When all is said and done, this really was just an inconvenience.