theo: DRM

The Observer pushes recording industry propoganda

Thu, 18 May 2006 14:21:53 GMT

During a quiet Sunday afternoon rest a couple of weeks ago I flicked through my dad's Observer, which contained an article explaining how it was illegal to copy your CDs onto your iPod, and that even though the recording industry hadn't sued anyone yet, doesn't mean it couldn't.

Unfortunately I haven't had the time yet to write a strongly worded letter with a nice big heading of Fair Use, to the law firm (Wiggin) who gave the details for the article, or the editor, for their blantant pushing of the recording industry's propoganda.

However much the recording industry tries to bully people into believing they have to buy music in every single format they need it in rather than just the once, it still won't make it true.

As long as you purchase a CD legally, you then have a license for fair use in whatever format you choose to listen in.

Read the full article.

RIAA makes it up as they go along

Thu, 18 May 2006 14:19:48 GMT

As we all know, the RIAA like to make the rules up as they go along with any excuse to treat their best customers as criminals.

Now they've decided that (even though they declared it was lawful to copy content from a CD you owned onto your PC and MP3 player, and that there was nothing wrong with personal video recorders) consumers who use XM satellite radio recorders are violating copyright laws.

See details at HHRC.

Sony DRM Roundup

Sun, 12 Feb 2006 16:38:21 GMT

This week I received details of a Class Action Settlement against Sony, and urge anyone who can take advantage of it to do so - Sony still claim they did nothing wrong! The email is included below.

First of all a quick roundup of some of the other news items from the past few weeks;

Class Action Settlement details

If You Bought, Received or Used a SONY BMG Music Entertainment CD Containing Either XCP or Media Max Content Protection Software, Your Rights May Be Affected By a Class Action Settlement, And You Should Download Updates For That Software.

What is this about?

A settlement has been proposed in a lawsuit brought against SONY BMG Music Entertainment, Inc., SunnComm International Inc., and First 4 Internet, Ltd. ("Defendants"). The lawsuit, In re SONY BMG CD Technologies Litigation, Case No. 1:05-cv-09575-NRB, is pending in the United States District Court for the Southern District of New York and relates to XCP and MediaMax content protection software installed on certain SONY BMG music CDs.

The Settlement resolves claims that the Defendants manufactured and sold CDs containing XCP and MediaMax software without adequately disclosing the limitations the software imposes on the use of the CDs and the security vulnerabilities it creates. The Defendants have denied that they did anything wrong.

Who Is Included, And What Does The Settlement Provide?

The settlement provides relief for persons who bought, received or used SONY BMG CDs with either XCP or MediaMax software. Under the settlement, any person in possession of an XCP CD can exchange it for a replacement CD, an MP3 download of the same album, and either (a) cash payment of $7.50 and one (1) free album download from a list of 200 albums, or (b) three (3) free album downloads from that list.

Purchasers of CDs containing MediaMax 5.0 software will receive a free MP3 download of the same album and one (1) additional free album download. Purchasers of CDs containing MediaMax 3.0 software will receive a free MP3 download of the same album.

The settlement also requires the Defendants to stop manufacturing SONY BMG CDs with XCP or MediaMax 3.0 and 5.0 software and, until 2008: (1) make available updates to fix all known security vulnerabilities caused by XCP and MediaMax software; (2) provide software programs to uninstall XCP and MediaMax software safely; (3) fix any future security vulnerabilities discovered in MediaMax and any other content protection software placed on SONY BMG CDs; (4) provide independent verification that personal information about users of SONY BMG CDs has not and will not be collected through XCP or MediaMax; (5) waive certain provisions of the end user license agreements for XCP and MediaMax software; and (6) ensure that any other content protection software will be clearly disclosed, independently tested and readily uninstalled.

At 9:15a.m. on May 22, 2006, the Court will hold a hearing at the United States District Court, Daniel Patrick Moynihan United States Courthouse, 500 Pearl Street, Courtroom 21A, New York, New York 10007-1312, to decide whether to approve the settlement and the class attorneys' fees and costs.

How Do I Participate In The Settlement?

If you bought or received a SONY BMG Music CD containing XCP or MediaMax software and want to receive the relief you may be eligible for under the settlement, you must submit an online claim form at www.sonybmgcdtechsettlement.com, or mail a claim form to:

SONY BMG CD Technologies Settlement
P.O. Box 1804, Faribault, MN 55021-1804

All claim forms must be submitted by December 31, 2006.

What Are My Other Options?

If you bought, received or used a SONY BMG Music CD containing XCP or MediaMax software, and you do not want to be legally bound by the settlement or receive a replacement CD, cash, free downloads or other relief, you must exclude yourself by May 1, 2006. If you do not exclude yourself, certain of your claims against the Defendants that were or could have been asserted in the lawsuit will be released, meaning you may not be able to sue the Defendants for those claims.

To view the detailed legal Notice of Proposed Class Action Settlement, Motion for Attorneys' Fees and Settlement Fairness Hearing and to download the software updates, visit www.sonybmgcdtechsettlement.com.

You may obtain further information by contacting the claims administrator at the address above or by calling toll free 1-800-242-7610.

Sony offers class-action settlement

Mon, 02 Jan 2006 20:31:58 GMT

Mark Russinovich, who is helping Scott Kamber bring a class-action suit against Sony for the screw ups around their XCP copy-protection, explains how Sony have filed a proposed settlement.

See Sony Settles for the full story.

Sony's Thomas Hesse allowed out of his box again

Fri, 16 Dec 2005 12:25:25 GMT

In a recent BBC interview with Sony's head of global digital business, Thomas Hesse, he states that now "Even if the issue is only a slight one, at Sony BMG we are very clear that any software security issues are taken with the utmost seriousness".

This is a very different story to his amazing comment back at the beginning of november that "Most people don't even know what a rootkit is, so why should they care about it", having already ignored the problem for over a month. Obviously "utmost seriousness" does not include stopping the source of the problem in the SunnComm case by recalling the dodgy CDs.

It's good to see that they have at least noticed that they screwed up and that they are going to "diligently re-evaluate" how they protect music on CDs (which I guess must mean it's hit their bottom line). But from the quotes and comments in the article, it's obvious Sony are un-repentant about treating everyone as a criminal; instead of apologising for causing such big problems for paying customers, he just says "The key point to remember is that copyright infringement is a huge issue".

More Sony DRM Woes

Mon, 12 Dec 2005 17:03:39 GMT

Will it never end?

Last week came the news that Sony's other copy protection software (which already installed software regardless of whether you agreed to the license) had security holes in it. And unsuprisingly the patch they released didn't resolve the problem. And unsuprisingly they are currently still selling CDs with the buggy software on.

Alex Halderman has more info on the patches from Sony and is looking at how well the uninstaller works too. See MediaMax Bug Found; Patch Issued; Patch Suffers from Same Bug for the full details.

Sony dribbles

Wed, 30 Nov 2005 14:01:23 GMT

As the Sony story starts to hit more of a back burner some interesting stuff is coming out now;

Boing Boing are reporting newsgroup messages from F4i programmers begging for code here and here, including offering cash for code to save F4i the legwork of figuring things out properly.
More from Alex Halderman on the SunnComm installer that installs software before the license agreement suggesting that if you say no to the license, the next time you put the CD in, even more software is installed.
And more detail on where F-Secure fit in to all this explaining how they reported the rootkit problem to Sony and F4i a whole month before the situation blew up in their faces.

Update: Mark Russinovich's latest blog entry - Premature Victory Declaration? - discusses things a bit more, including the pending lawsuits. (plus a FoxTrot comic to make you smile)

Sony finally notify customers about XCP uninstaller bugs

Fri, 25 Nov 2005 18:37:48 GMT

Almost two weeks after Matti Nikki found security holes in the XCP rootkit uninstaller, Sony have got round to sending out emails to warn people about the problem. Having forced paying customers to jump through hoops to get to the uninstaller, at least Sony do have some contact information to warn people about this problem.

The way they suggest to remove the uninstaller is:

Using Windows Explorer, go to %SystemRoot%\Downloaded Program Files\
Locate CodeSupport
Right click on the file and select Remove from the pop-up window
The file is now removed from you computer system

The email goes on to say: "We are in the process of providing an updated version of the uninstaller program for the XCP content protection software". So basically, 10 days after acknowledging the problem on their website, they still haven't got round to providing a new uninstaller.

It just goes to show how concerned they really are about the security of their customer's computers. But of course, anyone who wants to buy a CD from Sony must be criminal anyway, so why would they be bothered about sorting the mess out.

Sony's falling CD sales

Wed, 23 Nov 2005 11:52:39 GMT

Business Week reports that "along with lawyers, prosecutors, and furious fans, artists are joining the backlash against the label for slipping a hidden, anti-theft program into users' computers".

Having kept an eye on Van Zant's sales rank on Amazon, they dropped from 887 to 1,392 overnight and continued on down to 25,802 within a matter of days.

Apparently the threats of keeping away from Sony products are being followed through; perhaps hitting Sony's bottom line might actually make them think twice about treating customers as criminals, but as things stand I can't see them stopping. They still aren't apologising, and are still determined to show how right they are to use whatever forms of copy protection they fancy now and in the future.

For the full article, see: Sony's Escalating "Spyware" Fiasco.

Sony DRM/SunnComm - Security Hole in Uninstaller

Fri, 18 Nov 2005 10:36:18 GMT

Well it won't suprise anyone to learn that Sony's "other" copy-protection provider SunnComm isn't bothered about providing secure software either. In this case at least it's only the uninstaller and not the main program that causes the problems; altho the main program does install major components without user agreement.

For more, along with a tool to check if you have the problem and remove it, see: Not Again! Uninstaller for Other Sony DRM Also Opens Huge Security Hole.

For a list of SunnComm protected CDs, see SunnComm's contact page and open up "The CD in Question" dropdown.

Sony roundup

Thu, 17 Nov 2005 15:20:23 GMT

Boing-Boing have posted a round-up of their Sony stories: Sony rootkit roundup, part II.

Not suprisingly, Sony have now contradicted earlier statements - their repeated quote that only 20 titles were affected, and that only 2.1 million CDs had been sold have now been shown to be completely false. The actual number of affected CDs is 52... And if that only converts to 2.1 million sales then Sony's artists would be very unhappy!

See CD’s Containing XCP Content Protection Technology for the full list of the affected CDs.

EMI copy-protection / Gorillaz

Thu, 17 Nov 2005 14:54:49 GMT

Following my problems with EMI's copy-protection on KT Tunstall's 'Eye to the Telescope' (resolved by phoning EMI and requesting a non-copy-protected version), I got round to trying to rip Gorillaz, Demon Days expecting to have the same problems.

Amazingly, WMP ripped it without any trouble at all. The Gorillaz CD has the same copy-protect logo as KT Tunstall and yet the software on it does nothing. So have there already been a number of versions of EMI's CD format this year, or is it just not very effective?

Sony moving in right direction

Wed, 16 Nov 2005 14:50:20 GMT

Mark Russinovich has an update on what is going on with Sony at the moment, entitled Victory!.

The main points being;

Sony BMG's main website now includes a prominent link on its front page to information about XCP.
Sony will offer consumers that have purchased the spyware-laden CD’s, replacement unprotected versions.
Sony has finally withdrawn the spyware-like uninstall-request process, and promises the imminent release of a stand-alone uninstaller.

On the down-side;

Sony haven’t admitted any wrongdoing, only that the software was a security concern
There’s no statement on Sony’s site or their press releases regarding future policy

He wraps up with some very good points too:
"Attention now needs to turn to the broader issues that go beyond DRM to software in general. They include acceptable behavior of commercial software, from both legal and ethical standpoints, and appropriate disclosure of software behavior. We’ve been living in a world of hazy laws surrounding EULAs and ideally this case will lead to more clearly defined laws and standard judicial principles."

Sony finally swaps copy-protected CDs

Tue, 15 Nov 2005 14:35:38 GMT

The messages coming out of Sony today are a bit confused: Sony to pull controversial CDs, offer swap.

Basically they are saying that they will pull current XCP protected CDs from store shelves, and are also offering to swap CDs that have already been bought for non-copy-protected ones. There is no mention in the article about how to get this replacement.

In addition, they are vowing (along with EMI and Universal) to use copy protection throughout 2006 regardless of how much backlash they get.

I am a little confused by the following quote tho, which talks about the number of affected CDs;

According to this press release from mid-June, "Some 2 million of the CDs using the First4Internet protection have been sold since March in the United States."
And now in November, "Sony says more than 20 titles have been released with the XCP copy-protection software, and of those CDs, over 4 million have been manufactured, and 2.1 million sold."

So either they have only sold 100,000 copies in the last 4 months (i.e. 5% of sales between March & mid-June), or they're making things up yet again.

Is this just another Sony tactic to hope the problem can be swept under the carpet by lying to the press? I guess we await the next episode...

Sony (F4i) Uninstaller is error prone too

Mon, 14 Nov 2005 12:04:57 GMT

In Mark Russinovich's latest blog entry this morning: Sony: No More Rootkit - For Now, he includes details from Matti Nikki about bugs in the ActiveX control that Sony force you to install if you want to remove their software.

"the First 4 Internet control contains scriptable methods that can be activated without the user’s knowledge or consent. Matti Nikki's site demonstrates how he can reboot your system using one of the methods."

So now once you've removed the threat from Sony's rootkit, this ActiveX control from F4i will still languish on your system as another threat.

Sony suspends copy-protection / Microsoft removes it

Sun, 13 Nov 2005 18:11:46 GMT

eWeek report that Sony Suspends 'Rootkit' DRM Technology.

Sony BMG Music Entertainment has succumbed to mounting criticism, announcing plans to stop production of music CDs that use their copy-protection technology from First 4 Internet (F4i) called XCP.

"The company said Friday that it is temporarily suspending manufacture of CDs with XCP, which use malicious "rootkit" techniques to evade detection on Windows systems. The company will also re-examine its copy protection initiative to make sure it has balanced ease of use for consumers with security, according to an e-mail statement."

Well at least this is something, but Sony are still holding out on making the uninstallation available to all affected users. Anyone without an internet connection on the affected PC is provided with nothing from Sony to help them. In addition, unless you are willing to install yet more software from F4i, Sony will not let you anywhere near the uninstallation details.

Luckily for all Windows users, Microsoft Antispyware (Windows Defender) and the December version of the Malicious Software Removal Tool will include a signature to allow removal of the rootkit component of F4i's buggy software. See the Microsoft Anti-malware team's blog for more.

Update: Even though Sony have stopped producing CDs with copy-protection from F4i, they are still using copy-protection from SunnComm which according to Alex Halderman, "behaves in several ways that are characteristic of spyware", including installing a kernel-level driver and other software, regardless of whether you agree to sony's license agreement. For more, see Sony Shipping Spyware from SunnComm, Too.

Sony DRM Press Release

Fri, 11 Nov 2005 20:01:08 GMT

I thought I'd have a quick peek into the past press releases of First 4 Internet (F4i). The laughable thing about all of this is that all SonyBMG are apparently looking to do is to stop people making copies of the whole disk...

"The primary goal is not to prevent copies of the songs from ending up on illicit, peer-to-peer file-trading networks, which the industry blames for million of dollars in lost sales.

"Instead, it aims to dissuade people from burning unlimited CD copies in what is sometimes called 'schoolyard piracy'."

From: F4i, 16-June-2005 [Original]

The stupid thing is that even from the outset with this copy protection technology SonyBMG and F4i were blatantly trying to mislead the press and public alike.

And by the looks of that article, if 2 million copies had been sold between March and June, there must be at least 5 million affected disks out there, and probably the number is actually somewhere between 10 and 20 million by now.

And still, even though virus writers have now released software to take advantage of F4i's bad coding, they are still refusing to give any public uninstallation instructions. The only way to get those is via a carefully guarded website, and so if you don't have internet access then basically Sony are sticking two fingers up at you and leaving you to rot.

Sony DRM lawsuits begin

Fri, 11 Nov 2005 16:43:15 GMT

After wondering what would happen in terms of lawsuits against Sony BMG; the BBC are reporting that they are now facing three lawsuits over their copy-protection software.

For the full article on the BBC website, see 'Sony sued over copy-protected CDs'.

Update: And now it seems the inevitable has happened: Virus Writers Take Advantage Of Sony's Rootkit

Sony DRM Saga continues...

Thu, 10 Nov 2005 15:11:19 GMT

Following on from what was happening in the Sony DRM saga a few days ago, Mark Russinovich has continued with some more follow-ups which make interesting reading;

There's also a follow-up by e-Week which includes Microsoft's current response to the whole thing: Microsoft 'Concerned' by Sony DRM. Hopefully Windows Defender (Microsoft Antispyware) will eventually offer to remove it, especially with Mark showing just how easy it was to find bugs in Sony's rootkit and cause it to crash the whole system.

The whole fact that Sony aren't allowing users to uninstall without jumping through hoops just smacks of Blair syndrome.

Sony respects you...

Sat, 05 Nov 2005 08:18:43 GMT

Following on from the Sony's copy protection madness, comes an interesting podcast from NPR (see link below).

So far Sony have shown a lack of understanding by providing a "fix" that just removes the fact that the files are hidden (in rootkit fashion), and still not giving a public way to uninstall the software.

NPR have put together a small piece which includes a quote from Thomas Hesser, president of Sony/BMG's Global Digital Business saying: "Most people don't even know what a rootkit is, so why should they care about it".

This guy is president of the Digital Business side of Sony and he doesn't even understand why people are upset about the issue. The podcast goes on with a lawyer suggesting that the EULA included with the software makes no reference to the rootkit and is potentially illegal, so I guess we'll have to see what happens on that side of things.

>> Podcast: Sony Music CDs Under Fire from Privacy Advocates

Update: There's a discussion of the legal side on ZDNet: Sony DRM rootkit 'legal in the UK'

Update 2: More info about the alleged "fix" from Sony: Maybe Sony's Strategy Is To Convince You To Never Use A CD In A Computer

Copy Protection / DRM - Sony, EMI & Universal

Tue, 01 Nov 2005 15:53:48 GMT

Copy Protection from Sony

Just picked up on Mark Russinovich's latest over at SysInternals - Sony, Rootkits and Digital Rights Management Gone Too Far.

It definately makes for an interesting and slightly worrying read in that music companies feel they have a right to use these sorts of tactics to "protect" themselves. I get the impression this could backfire in a big way whether Sony were aware of the implications of using such a piece of software or not.

Update: It appears some Universal Music CDs are using the same copy protection as Sony.

Update 2: Sony have now given their response - Sony to patch copy-protected CD - basically they are just unhiding the files involved with the rootkit, but still giving no public way to uninstall the software. If you want to remove it, you have to contact Sony directly.

EMI's Copy Protection

Having recently been affected by EMI's current copy protection on KT Tunstall's "Eye to the Telescope", which completely stopped me from the "fair use" of ripping it to my MP3 player, but was quite willing to let me duplicate the CD to sell on the local market, I was very interested to see what EMI thought of Sony's issue.

I have to say that I was impressed that you can just phone up EMI and discuss their copy protection with them. It's also good to hear that they have no plans to use anything like this in the next version of their copy protection, but have been listening to the problems people are having with their current version. The idea with ripping being that they will allow you to rip DRM'd WMA files when they start delivering CDs using the new version.

This has cheered me up a lot as I was starting to think that the big music companies were just trying to screw more money out of me by forcing me to buy a downloadable version separately if I wanted to use it in that way. This was really annoying me as EMI do have some good artists on their books, and the only way I could see to have a copy of their music in the format I wanted was to start downloading "illegally". (Is it really illegal if you already own the CD?)

By the sounds of it I won't have to completely give up on EMI's artists now, but we'll have to wait and see if Sony respond to the article and explain what their plans are.

Update 3: During my latest conversation with them, they offered to send me a non-copy-protected version of KT Tunstall's, Eye To The Telescope which arrived the next morning, so it looks like if you're willing to phone them up and make a fuss, then they will try and keep you sweet.

Unlike Sony who refuse to even produce a non-copy-protected version of CDs which use the XCP copy-protection...

Copy Protection and Online Retailers

Probably one of the biggest problems with all these new copy protection formats is the hassle it causes online retailers. I usually buy my music from one of CD-WOW, Play or Amazon.co.uk depending on where it's cheapest at the time; if I can't use the new format then it is them, not the record company, who have to take the cost of setting up a return.

The problem is that even though the copy protected CDs are of a different format to a standard CD (and so are not allowed to display the Philips CD logo), the retailers currently have no way of displaying this difference (altho I notice Amazon.com sometimes do in the CD title).

So where is all this going?

I guess that copy protection is here to stay for the foreseable future, even though it only blocks the standard person from "fair use", and does nothing to stop illegal copying.

The main thing I don't understand is what record companies have to gain by continuing down the copy protection route; it just causes confusion and upset for their customers and does nothing for their sales. Is it really all down to their pride and not wanting to admit they were wrong all along?