Government

Attorney General Abbott Brings First Enforcement Action In Nation Against Sony BMG For Spyware Violations

Attorney General Abbott Brings First Enforcement Action In Nation Against Sony BMG For Spyware Violations

By Greg Abbott, Attorney General of Texas

December 3, 2005

AUSTIN - Texas Attorney General Greg Abbott today sued Sony BMG Music Entertainment as the first state in the nation to bring legal action against SONY for illegal “spyware.” The suit is also the first filed under the state’s spyware law of 2005.

It alleges the company surreptitiously installed the spyware on millions of compact music discs (CDs) that consumers inserted into their computers when they play the CDs, which can compromise the systems.

The Attorney General’s lawsuit alleges the New York-based company violated a new Texas law protecting consumers from the hidden spyware. The company accomplished this by using new technology on certain music CDs to install files onto consumers’ computers that hide other files installed by Sony. This secret “cloaking” component is installed without the knowledge of consumers and can cause their computers to become vulnerable to computer viruses and other forms of attack.

“Sony has engaged in a technological version of cloak and dagger deceit against consumers by hiding secret files on their computers,” said Attorney General Abbott. “Consumers who purchased a Sony CD thought they were buying music. Instead, they received spyware that can damage a computer, subject it to viruses and expose the consumer to possible identity crime.”

Sony insists on its Web site that it has recalled all affected CDs. However, Attorney General’s investigators were able to purchase numerous titles at Austin retail stores as recently as Sunday evening.

According to Sony’s Web site, the company recently distributed millions of CDs across the nation on 52 CDs by various artists. These CDs contained embedded files used for copy protection – or XCP technology. The files prompt consumers to enter into a user agreement to install Sony’s audio player. By opting into the agreement, which Sony represents is the only way a consumer can listen to these CDs on a computer, the consumer is unaware that Sony secretly installs files into the computer’s Microsoft Windows folders. Consumers are unable to detect and remove these files.

Sony BMG claims on its Web site that this XCP technology merely prevents unlimited copying, is otherwise passive and does not gather personal information about a computer user.

However, the Attorney General’s investigation into this technology revealed that it remains hidden and active at all times after installation, even when Sony’s media player is inactive, prompting concerns about its true purpose.

The Attorney General’s lawsuit also alleges that a phantom file is installed to conceal the XCP files from the user, thus making it difficult for the user to remove the files from his or her computer.
Moreover, recent news accounts allege that newly created viruses that exploit this phantom file have been spreading. A user unfamiliar with installation – and removal – of this technology may be vulnerable to new security risks and possibly identity theft.

Because of alleged violations of the Consumer Protection Against Computer Spyware Act of 2005, the Attorney General is seeking civil penalties of $100,000 for each violation of the law, attorneys’ fees and investigative costs.

For more information, visit the Attorney General’s Web site at www.oag.state.tx.us or call (800) 252-8011.