Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Security Sony Your Rights Online

A Legal Analysis of the Sony BMG Rootkit Debacle 227

Posted by kdawson
from the bad-ideas-just-keep-on-coming dept.
YIAAL writes "Two lawyers from the Berkeley Center for Law and Technology look at the Sony BMG Rootkit debacle: 'The Article first addresses the market-based rationales that likely influenced Sony BMG's deployment of these DRM systems and reveals that even the most charitable interpretation of Sony BMG's internal strategizing demonstrates a failure to adequately value security and privacy. After taking stock of the then-existing technological environment that both encouraged and enabled the distribution of these protection measures, the Article examines law, the third vector of influence on Sony BMG's decision to release flawed protection measures into the wild, and argues that existing doctrine in the fields of contract, intellectual property, and consumer protection law fails to adequately counter the technological and market forces that allowed a self-interested actor to inflict these harms on the public.' Yes, under 'even the most charitable interpretation' it was a lousy idea. The article also suggests some changes to the DMCA to protect consumers from this sort of intrusive, and security-undermining, technique in the future."
This discussion has been archived. No new comments can be posted.

A Legal Analysis of the Sony BMG Rootkit Debacle

Comments Filter:
  • Nothing like... (Score:5, Insightful)

    by ellenbee (978615) on Monday December 17, 2007 @01:29AM (#21723012)
    Good old greed..
    • by donaldm (919619)
      I suppose anything that uses DRM protection can be considered greed because this uses some form of stealth to stop so called unauthorised use.

      Actually I think you really need to define what a root-kit is http://en.wikipedia.org/wiki/Rootkit [wikipedia.org] (I particularly like the part about "non-hostile rootkits") and in the case of the Sony-BMG root-kit it all boiled down to DRM and greed if you like which actually installed hidden files which were difficult to find by "normal" means. Ok this was not a good thing but
      • Actually I think you really need to define what a root-kit is http://en.wikipedia.org/wiki/Rootkit [wikipedia.org] (I particularly like the part about "non-hostile rootkits")


        If somebody does something to my computer that is intended to be hidden from my knowledge and prevents me from doing something with my computer, I sure as hell consider it hostile.
  • ... of the morning, so I'll bite. I'll admit that I only got as far as reading the abstract, so sue me. I really don't see the need for a journal published paper to dissect the situation. Sony got caught up in the zeitgeist over Napster and how digital distribution was going to destroy their business model, just like how Hollywood freaked over the VCR. I think paranoia and utter indifference to the customer pretty much sums up the whole situation. Other than that, I don't see the need to dredge up a two-yea
    • Re: (Score:2, Interesting)

      by qzjul (944600)
      My immediate thoughts upon reading it were quite the opposite actually: Having a journal article written about this might make these issues more difficult for congress to ignore or dismiss as sensationalism; if they actually take note, those who are not already in the pockets of the recording industry may find it more difficult to follow those who are.

      Any piece of solid, credible research that demonstrates the reality of the situation is welcomed by me; eventually - if enough of these sorts of things are
  • Its a moral issue. (Score:5, Insightful)

    by Anonymous Coward on Monday December 17, 2007 @01:44AM (#21723066)
    This shouldn't be about laws, its a moral issue.

    Laws don't and should not be the only guiding factor in the actions of people or corporations. It is not the case that anything specifically prevented by law is allowed. A person or corporation should also be a good citizen, and there are things you just should not do, such as inflict root kits on other people's computers.

    The question then is; how did somebody at Sony arrive at the conclusion that they should try to protect their IP right in this manner?

    Waas this a comittee decision where moral judgement went out the window in a corporate meeting? Or are people at Sony severely lacking personal moral judgement?

    I would like to know.
    • by arivanov (12034) on Monday December 17, 2007 @02:17AM (#21723180) Homepage
      The problem is that morals are specifically off the society book nowdays. Standalone (without religios tint) morals and how society functions are not something kids study in school or at home. At best they get a version which was skewed and slanted through the prism of their family religion. At worst they do not get anything. The situation is same all over US, UK and most of Europe. The rest of the world closely follows.

      Sigh... As usually Heinlein "Starship Troopers" is probably right. We need "History and Moral Philosophy" lessons in school. Though there is noone to teach them in the current generation.
      • by rucs_hack (784150)
        Sigh... As usually Heinlein "Starship Troopers" is probably right. We need "History and Moral Philosophy" lessons in school. Though there is noone to teach them in the current generation.

        Quite probably, but his main point, which that lesson was supposed to back up, was granting of franchise only on completion of public service. You'd never get that one through.

        As much as I like that story, and its one of my all time favorite books, it starts with the premise that returning soldiers would essentially take ov
        • by BlueStrat (756137) on Monday December 17, 2007 @05:19AM (#21723656)
          As much as I like that story, and its one of my all time favorite books, it starts with the premise that returning soldiers would essentially take over the world and everything would be wonderful thereafter. History has shown quite clearly that every time this occurs things go badly.

          Except that they don't become "Citizens" until *after* they have served, and are no longer in the military. History has indeed shown that when the military takes over the government, then yes, bad things happen. But that's not the system that was described. It was civilians who had *previously* served in the military. Even today, one of the qualifications that many people look for in their elected leaders is previous military service.

          History has shown that when citizens are ignorant of history, the means by which they both first gained and retain their freedoms, and by which their country remains free from attack, very bad things happen. Pearl Harbor happened because Japan saw that America after WW1 had shrunk their military to a fraction of its' previous strength, and the citizens and most of the government had a policy of isolationism and retreat from world conflict. Japan failed to take into account the American peoples' outrage and anger, and the sleeping industrial might America could bring to bear.

          The surest way to get robbed in a big city is to look and act like a victim. The surest way to start a war is to appear conquerable to other nations with acceptable losses. That's precisely what the people who advocate unilateral disarmament, and also those who preach disengagement when targeted by terrorists, fail to understand.

          As to the Sony/BMG rootkit incident, as long as the punishment for getting caught in bad corporate behavior is acceptable, expect to see such behavior repeated.

          Cheers!

          Strat
          • Minor correction (Score:5, Insightful)

            by Nursie (632944) on Monday December 17, 2007 @05:42AM (#21723730)
            "Even today, one of the qualifications that many people look for in their elected leaders is previous military service."

            "Even today, one of the qualifications that many people IN THE USA look for in their elected leaders is previous military service."

            The US has a weird, hyper-patriotic society that a lot of Europeans find bizarre, brainwashing and militaristic.

            And only giving the franchise to people who have previously served in the military? Screw you! What gives you the right to decide that? What gives those citizens the right to decide how everyone else gets to live? Nothing whatsoever.
            • by mangu (126918)

              And only giving the franchise to people who have previously served in the military? Screw you! What gives you the right to decide that? What gives those citizens the right to decide how everyone else gets to live?

              If you do not feel ready to stand up to the bullies, then what are you complaining about? Either *you* decide how you get to live or someone else will. Ethics will only survive if there are enough people ready to defend basic principles, even by force if necessary.

              The simple fact is that if you are

              • by Nursie (632944)
                Ah, right, so if I don't join the military I'm not interested in my rights. Gotcha.

                Because I couldn't possibly care about my right to choose my own battles, rather than become the tool of a.... tool like George Bush.

                No, I will not fight for the state. The state will never be aligned with every individual and the individual should never be subsumed into the state if he wants a say.
            • And only giving the franchise to people who have previously served in the military? Screw you! What gives you the right to decide that? What gives those citizens the right to decide how everyone else gets to live? Nothing whatsoever.

              You haven't read the book, have you? The rationale is explained there.

              First, military service is not the only way of getting a franchise, there are other ways, although military service would be the most common way. People incapable of fighting would get their chance too.

              The ide

              • by Nursie (632944)
                "The rationale behind that is people willing to risk their life for others would value the well being of society above theirs, so they would be great leaders that protect society instead of filling their own pockets with cash or abusing their power for their own benefit."

                Yes, makes perfect sense.

                Did you know Robert Mugabe was a military hero in Zimbabwe before turning into today's repressive dictator?
                And that many dictators come from military backgrounds and are propped up by military support?

                Mr Heinlein h
                • Would you consider fighting forest fires? Working as a Nurses Aid in ghetto clinics? Riding in ambulances that service ghetto areas? There are many areas of service that would qualify...
              • by bentcd (690786)

                The idea is that in order to be a citizen you need to risk your life defending your species. The usual way is fighting, but might be testing drugs, or equipment, or exploration, etc. The rationale behind that is people willing to risk their life for others would value the well being of society above theirs, so they would be great leaders that protect society (...)
                Or else they just have an endorphine addiction.
            • And only giving the franchise to people who have previously served in the military? Screw you! What gives you the right to decide that? What gives those citizens the right to decide how everyone else gets to live? Nothing whatsoever.

              In theory, democratic legitimacy grants those citizens the authority to prompt everyone for military service. In the case of the US, our constitution would need to be rewritten to award citizenship after service, but nothing prevents forced participation in the military (save p

              • by Nursie (632944)
                The thing that gets me is that you're no longer describing a free society. You're describing one in which you need to perform certain duties before you can have a voice. And if we're talking about military service (which you're not doing exclusively) then the very point of it is to change people and break down their differences and opinions and subsume them to the chain of authority.

                I have no problem with anyone who considers service to their society a moral duty. But make it a legal one and you're crossing
                • Re: (Score:3, Insightful)

                  by coolGuyZak (844482)
                  Well, my ideas don't preclude you from voicing an opinion during service, albeit I realize that's how our military works at present. I hadn't thought of that particular ramification, though. I'll have to ponder it for a while.

                  But make it a legal one and you're crossing the line to something other than participatory democracy and the right of man to self determination, IMHO.

                  In my opinion, democracy is not participatory, it is not something you should choose to do. Participatory democracy falls to apathy, an

                  • by Nursie (632944)
                    Oh indubitably you'd end up with a nicer city. You'd also end up with people trying to buy their way out of it, or around it. You'd end up with folks refusing. Lots of very indignant people refusing to take part as they don't see why they owe anything to the rest of those a**holes out there.

                    And I'd have some sympathy with them. I work hard and pay my taxes. My time is worth more to me, to the economy and to the tax office when it's invested in what I'm most skilled at. Why should I not pay others to clean m
          • Re: (Score:3, Interesting)

            by elrous0 (869638) *
            I'm sorry, but I grew up a military brat. Most of the soldiers that I knew, both active and retired, were close-minded, mean-spirited dolts too damn stupid for college and in too much trouble for any other job. Sorry if that sounds harsh, but it's the truth. The term "G.I." was all but a curse word among civilians where I grew up (around Army bases). I know I'm supposed to be all like "our brave, noble, men and women in uniform" and all that, but it's nothing like that in real life living around those peopl
        • by lareader (1191563) on Monday December 17, 2007 @05:29AM (#21723686)
          Just a minor thing on Starship Troopers:
          Not all the people who volunteered for public service ended up as soldiers - they simply ended up doing what their society thought it needed and they had the ability to do.

          Heinlein actually wrote a bit about the "world" of Starship Troopers in Expanding Universe (in a retrospective on his literary career).
          At the time when the events in the book take place, quite a lot of people were needed as soldiers - but due to the way we people are wired (with tight-nit social groups as soldiers), soldiers were usually the last to stop serving in public and thus the last to actually get to vote.
          Yes, you didn't get the franchise until *after* you've stopped serving in that world.

          I do agree that the premise is shaky - but the idea of not giving everyone franchise just because they were 18 years old and alive was one of the ideas Heinlein was toying with in that book.
          Of course, he argued that clearly the founders of US of A never intended everyone to get the franchise either - his criterion were simply a bit more merit-based.

          In Expanding Universe he did mention that the idea of having stable people with a stake in maintaining a working society as a rather good idea, and goes on arguing for removing the franchise from men and giving it to women who have born children, as they have a personal reason for being interested in having a society that works... and makes a rather convincing argument of it.

          I can heartily recommend Expanding Universe if you are interested in what Heinlein said he was thinking when writing.
          As with all things written down, of course, you must consider the source - but I got a lot of amusement out of his writings, and like his meritocratic views personally.
          The book "Requiem" is also a good read, if a trifle sad at times - but it did contain his speeches at a few scifi conventions which I hadn't read - highly interesting for a person not born until the last years of the Red Scare.

          (Sorry for pushing Heinlein, but I really liked those books and they represent a very enlightening perspective on what Heinlein professed to believe.)
          • by rucs_hack (784150)
            Ooh, I had no idea he wrote further on the Starship troopers universe. I'll get with the buying right away.

            Thanks for that one.
        • Re: (Score:3, Insightful)

          by vtcodger (957785)
          ***Quite probably, but his main point, which that lesson was supposed to back up, was granting of franchise only on completion of public service. You'd never get that one through.***

          Eh, why not? The US political system accepts more peculiar stuff than that every year -- DMCA, prohibition, NAFTA, the War on Drugs, Guantanamo. A few TV ads; a couple of movies; an all out offensive on the talk shows; (and a grandfather clause for the current crop of reprobates). I think it'd be an easy sell.

          ***As much

          • by rucs_hack (784150)
            Actually, history pretty much neutral on the subject. Military men are not necessarily either authoritarian or pro-war. Witness Carter (he's an Annapolis graduate and served 7 years on active duty) or Colin Powell who seems to have been the only guy in the top rank of the Bush administration who tried to head off the Iraq fiasco. Not that military men are necessarily the best men to put in charge. Some -- Washington, Eisenhower -- did pretty well. Some didn't.

            All those men you speak of were elected, and the
        • by dpilot (134227)
          It's also worth mentioning that of the 2001 Bush administration, the only higher-up who had front-rank military service was Sec'y of State Colin Powell, and though he eventually went along with the "slam-dunk" arguments for invading Iraq, he was also the only higher-up who dragged his feet on the issue. Other members of the Bush administration generally served in the National Guard or had other means of draft deferment. In the 60's and 70's, even though the US had many times more soldiers in Viet Nam, the
      • by kmac06 (608921)
        Let me get this straight...rather than the family instilling values in their children, you think it should be the responsibility of the GOVERNMENT RUN SCHOOLS to teach people morality?

        Maybe we should just skip this step, and go straight to government reeducation centers.
    • Most companies, like most people, will take what they can. Only the law limits what most companies/people would take. Is it morally right that some have so much, and continue to take, while some have so little and seem to have less each day? It should not be like that, but it is.

    • by phalse phace (454635) on Monday December 17, 2007 @02:38AM (#21723248)
      "The question then is; how did somebody at Sony arrive at the conclusion that they should try to protect their IP right in this manner?"

      Seems like when it comes to protecting their a$$e$, they don't care about morals. Anything goes. It's sad to say, but it all comes down to the all mighty dollar for these companies/corporations.

      Then again, I'm a cynic.
    • by Tim C (15259)
      Laws are there to make immoral and amoral people act according to the moral will of society.

      In other words, laws enforce society's idea of moral behaviour.
    • by Karellen (104380)
      It's one of the reasons I run Linux -

      "Let's put it this way: if you need to ask a lawyer whether what you do is "right" or not, you are morally corrupt. Let's not go there. We don't base our morality on law."

        -- Linus Torvalds
    • by Frater 219 (1455) on Monday December 17, 2007 @05:42AM (#21723728) Journal

      The question then is; how did somebody at Sony arrive at the conclusion that they should try to protect their IP right in this manner?

      This is probably not best discussed in terms of "protecting IP rights" but rather in terms of:

      1. Individual decision-makers in the organization trying to protect their own personal interests (cover your ass, look busy, do something!);
      2. An interest in seizing control (squatting, adverse possession, invasion) of the user's desktop, in order to use that as a foothold to greater control over the medium;
      3. High-pressure and deceptive sales tactics by the spyware makers.

      Someone at Sony was charged with "doing something" and "making the piracy problem go away". They were desperate. They also wanted something to show for their efforts, namely, an ability to exercise power on user desktops. (Recall, the copyright terrorists have long wanted "self-help" capabilities that amount to sabotaging users' property at will.)

      Spyware must have seemed like a perfect solution: it doesn't just "do something" about the pirates, it accomplishes a long-standing goal of seizing greater control of the medium. It is not at all about "IP rights"; it's about power -- in this case, about ripping power out of the users' hands.

      • by inviolet (797804)

        Spyware must have seemed like a perfect solution: it doesn't just "do something" about the pirates, it accomplishes a long-standing goal of seizing greater control of the medium. It is not at all about "IP rights"; it's about power -- in this case, about ripping power out of the users' hands.

        There are only three basic goals that humans pursue:

        • pride,
        • power (aka money), and
        • pussy

        And deep down in our genes, the first two are little more than a means to the third. ('Novelty' may be in there too, but proba

    • Laws don't and should not be the only guiding factor in the actions of people or corporations.

      Heh, reminds me of a sign I saw in a Wal-Mart. "Buying tobacco for minors: It's not just wrong, it's illegal." As if being wrong isn't a good enough reason not to do it?

    • by Hatta (162192)
      It *is* about laws. Computer hacking is illegal. It's also about the failure of our government to enforce those laws.
  • Precedent. (Score:5, Interesting)

    by Raindance (680694) * <`johnsonmx' `at' `gmail.com'> on Monday December 17, 2007 @01:49AM (#21723078) Homepage Journal
    It was a push on legal norms. The recording industry has done it before, and more successfully.

    A quote from Lessig's Free Culture:

    After Vivendi purchased MP3.com, Vivendi turned around and filed a malpractice lawsuit against the lawyers who had advised it that they had a good faith claim that the service they wanted to offer would be considered legal under copyright law. This lawsuit alleged that it should have been obvious that the courts would find this behavior illegal; therefore, this lawsuit sought to punish any lawyer who had dared to suggest that the law was less restrictive than the labels demanded.


    Legal norms are not just about judicial precedent.
  • Auto-run is evil (Score:5, Insightful)

    by 0123456 (636235) on Monday December 17, 2007 @01:51AM (#21723082)
    Of course this would be a non-issue if Windows didn't automatically run software when you put a CD in the drive; this is just another reason why auto-run is an insanely bad idea.
    • Re:Auto-run is evil (Score:4, Informative)

      by RuBLed (995686) on Monday December 17, 2007 @02:10AM (#21723154)
      say bye bye to autorun.inf...

      One quick trick prevents Autorun attacks [windowssecrets.com]
    • by z0idberg (888892)
      Autoplay have fuck all to do with it.

      To play the music on your PC you have to run the player software that is on the CD.

      So if you want to play music through your PC, whether autorun runs it or you run it you end up rooted. Autorun gets you rooted quicker, but even if autorun was never invented the issue still exists.
      • The entire reason you need the software to play this music is because when you first inserted the CD, it installed itself and made sure of that.

        So if you had autorun/autoplay completely disabled, you could run, say, Windows CD Player, and play it without running any software off the disc.

        Or you could boot Linux and just play it.
  • by zappepcs (820751) on Monday December 17, 2007 @01:51AM (#21723084) Journal
    Can we please get an Icon that has a foot and a handgun?
  • the market-based rationales that likely influenced Sony BMG's deployment of these DRM systems and reveals that even the most charitable interpretation of Sony BMG's internal strategizing demonstrates a failure to adequately value security and privacy. After taking stock of the then-existing technological environment that both encouraged and enabled the distribution of these protection measures, the Article examines law, the third vector of influence on Sony BMG's decision to release flawed protection measur
  • by Simonetta (207550) on Monday December 17, 2007 @01:57AM (#21723100)
    ...the market-based rationales that likely influenced Sony BMG's deployment of these DRM systems...
      That's pretty simple. They thought that there was a vast network of 13-year-old superhackers that were going to destroy the company by sharing files of music recordings. Then some schmuck (names? anyone who knows?) in the firmware special projects department told some marketing manager that he knew how to keep 13-year-old superhackers from copying music from CDs by simply adding a little piece of code. ...demonstrates a failure to adequately value security and privacy.
      The only security and privacy that they care about is their own. These concepts don't exist for people who are not executives in the company. Especially customers.

    ... then-existing technological environment that both encouraged and enabled the distribution of these protection measures...
      "Since we own the music on the disk that is placed into a computer CD drive, we, by the simple and obvious extension of corporate logic, thereby own the computer and all of the data inside it." If you want to become a corporate executive, you need to start thinking like one. ... flawed protection measures...
      If it keeps ordinary people from copying stupid pop songs from our CDs, then it is not flawed. If it destroys or corrupts the data on user's PC, we don't care. Serves them right as they are supposed to only be listening to CDs on a real Sony CD player. After all, we invented the CD so we can set the terms on its use. ... contract, intellectual property, and consumer protection law... ...is whatever the hell Sony's legal department says it is. And we have many, many millions of dollars, euro, UK pounds, or yen to prove it. Without the cash, talk is trash.

    ... Yes, under 'even the most charitable interpretation' it was a lousy idea...
    Next year's rootkit software will work. And the first thing that it will do is send your name and address to our lawyer's office who will prepare a standardized form charging you with theft of intellectual property (which is some illiterate junkie thug under Sony corporate contract moaning 'baby, baby, baby' over and over). Our bot software will then serve this to anyone who puts a Sony music CD into any device with internet access (unless, of course, the device is a $999 Sony model DRM-XKE CD player with hi-def 2-inch LCD screen and wireless internet access). After all, we invented the CD so we can set the terms on its use.

    suggests some changes to the DMCA ...
        The only changes that our legal department will allow the US politicians to pass will be ones that increase the criminal penalties for possession of music. This will happen when Sony completes its corporate merger with Wackenhut and CCA and completes the vast network of corporate prisons being built in distant lands. These will be needed to hold the vast number of unemployed former American college students who not only illegally listened to music, but also fell behind on their student loan payments.
    • by mpe (36238) on Monday December 17, 2007 @03:30AM (#21723376)
      The only security and privacy that they care about is their own. These concepts don't exist for people who are not executives in the company. Especially customers.

      Add "copyrights" to the list. Since there are several cases showing how little the "entertainments" industry cares about other people's copyrights.

      The only changes that our legal department will allow the US politicians to pass will be ones that increase the criminal penalties for possession of music.

      Unless someone can get the changes sneaked past. e.g. something tacked onto the end on an anti-terrorism bill :)
      • by Sique (173459)

        The only security and privacy that they care about is their own. These concepts don't exist for people who are not executives in the company. Especially customers.

        Add "copyrights" to the list. Since there are several cases showing how little the "entertainments" industry cares about other people's copyrights.

        The Sony BMC Rootkit was actually one of those examples. First4Internet used GPLed code and didn't publish the source for their product, and neither did Sony BMC which distributed First4Internet's modifications.

        So Sony BMC was infringing on someone else's copyright there.

  • Unfortunately, due to scaling problems, any sufficiently large and diverse corporation will have components that exhibit behavior that are detrimental to other components, or even the whole. While this can be reduced and discouraged, I do not believe it can be completely solved - something will always manage to slip its way through the cracks.

    Sony has a huge image problem (especially among the geek elite) due to this effect, and due to the fact that its goals do not seem to align with the geeks of Slash
    • by otomo_1001 (22925) on Monday December 17, 2007 @02:12AM (#21723160)
      And now meet what I like to call handcuffs.

      An easy solution to this problem, and it would only take a few instances, would be to seize all assets of the company in question and begin prosecution. If corporations are damn near treated like real humans, then let them see the other side of the coin. Make every failure in process hurt them where it matters, I guarantee we won't have this happen again. Or we end up with less corporations willing to "risk" product release in the US.

      As it stands companies can seemingly get away with whatever they want to protect their business model.
      • by philipgar (595691)
        I think someone should be in handcuffs over this. At least a much more sever punishment. i don't agree that all of Sony should be split up or bankrupted over this, but the people who let this through at the top should have some serious punishments. I know if I installed rootkits on Sony's computers, and then logged remotely into them, and got caught, I'd likely be charged with computer crimes (or whatever the proper term is), and sent to jail for a couple years. Why if a major company does the same thi
  • Law (Score:3, Insightful)

    by Archangel Michael (180766) on Monday December 17, 2007 @02:01AM (#21723114) Journal
    "The article also suggests some changes to the DMCA to protect consumers from this sort of intrusive, and security-undermining, technique in the future."

    How about this, when an industry pushes legislative half assed measures and gets them passed in to law, they forfeit normal protections afforded every other group out there.

    In this case DMCA law prohibits the consumer from doing all sorts of things, in an effort to protect a particular industry. Since Sony installed, without permission, software that effectively broke computers, they'd held to a HIGHER standard than any other organization.

    In this case the law should have revoked the corporate charter surrendered all assets to the government. Since the Corporation is a "legal" entity, the same as a person, the government should treat it exactly like a person caught doing the same thing.

    My $.02
    • by Hatta (162192)
      We shouldn't need another law in this case. We already have laws against computer hacking. If any individual had done what Sony did, they would have gone to jail for a long, long time. Yet Sony doesn't even get a slap on the wrist.

      What we really need is a way to prevent this kind of selective enforcement of the law. Perhaps the failure of the government to prosecute a clear cut case of computer hacking should serve as a defense in future cases of computer hacking. If Sony can get away with putting a t
  • Why is a legal solution needed? Clearly, the whole incident worked out very badly for Sony-BMG. Any company can see this example and determine that this kind of software should not be used.

    I don't hit my hand with a hammer, even though no law that restrains me from doing it. Is there a role for government in keeping folks from hitting their hand with a hammer?
    • by Nursie (632944)
      Yeah, what with them filing for bankruptcy and pretty much giving stuff away just to get some cash flow as the general public decided to completely boycott...

      Oh, wait, that's not what happened at all. Here's what happened - outside of a few geeks and a couple of other unlucky folks nobody cared. And even of those that did care, only a few geeks still do. Everyone else either didn't hear about it, didn't understand it, didn't care about it, or forgot. That's the way of the world.
      • by Kohath (38547)
        Yeah, what with them filing for bankruptcy and pretty much giving stuff away just to get some cash flow as the general public decided to completely boycott...

        So every last person who worked for Sony BMG should have lost their job? And every investor in Sony BMG should have lost their entire investment?

        You must believe in the death penalty for every crime then too.

        ...outside of a few geeks and a couple of other unlucky folks nobody cared...

        It seems like most people cared in approximate proportion to the am

        • by PolyDwarf (156355)
          It seems like most people cared in approximate proportion to the amount of damage caused -- not much. And some people cared because they hate various people or entities for whatever reason and they want their chosen enemies destroyed. You seem to be in the second group.

          So, with that logic, no personal crime should have punishment, because the vast majority of people don't care about it. Why would I care if someone's car got carjacked in Minneapolis, when I'm in Phoenix?

          And yet, there are punishments for th
          • by Kohath (38547)
            Why would I care if someone's car got carjacked in Minneapolis, when I'm in Phoenix?

            Why should you? What makes it any of your business? I'm sure the folks in Minneapolis can take care of their own problems without your input. Not everything is about you.

            And those punishments are sometimes strict enough to cause that person to not do it again.

            In this case, it was. There's no benefit in doing this again. There was no benefit in doing it the first time. And there are some hefty consequences. So no one w
  • by Boycott BMG (1147385) on Monday December 17, 2007 @03:45AM (#21723410) Journal
    The rootkit was put on those CDs by Sony/BMG, which is a separate entity that is 50/50 owned by Sony and Bertelsmann (BMG stands for Bertelsmann Music Group). Furthermore, the people at the top, who make all of the important decisions are all from the BMG side. So, if either company is more to blame, it is Bertelsmann. Does this mean you should boycott Bertelsmann? It does seem a bit silly to boycott Random House (major book publisher and Bertelsmann subsidiary) over what happened to some music CDs, and yet that is what some are doing w.r.t. Sony Vaio, Sony cameras, etc. My suggestion would be to boycott the product that Sony/BMG puts out-their music CDs.
    • by AlXtreme (223728)

      It does seem a bit silly to boycott Random House (major book publisher and Bertelsmann subsidiary) over what happened to some music CDs

      Why does that seem silly? I say boycott both Sony and Bertelsmann, and all their subsidiaries. Give a clear signal to those in charge that you don't want to put up with BS like this: vote with your money and shop somewhere else.
    • Does this mean you should boycott Bertelsmann? It does seem a bit silly to boycott Random House (major book publisher and Bertelsmann subsidiary) over what happened to some music CDs, and yet that is what some are doing w.r.t. Sony Vaio, Sony cameras, etc.


      Or maybe that's just what's needed. A bit of collateral damage to cause corporations to tell other corporations to lay off the bad moves. Because so far just having a bunch of customers doing it hasn't worked.

    • The rootkit was put on those CDs by Sony/BMG, which is a separate entity that is 50/50 owned by Sony and Bertelsmann (BMG stands for Bertelsmann Music Group).

      I was going to mod you down, but here goes.

      Even though Sony/BMG is a separate entity it still has the Sony name. It's in their to make sure their name does not get sullied. It's not our job to find out exactly which part belongs to whom.

      Also why do corporations not investigate which aspect of a person failed to pay their credit card bill. I'm talking about universal default here (not the best example though). They don't care. As long as your name appears somewhere you are in trouble

  • by golodh (893453) on Monday December 17, 2007 @05:38AM (#21723712)
    This article really was a pleasure to read (although it took me most of a day).

    Not just because of the conclusions ("Part III examines potential market-based rationales that influenced Sony BMG's deployment of these DRM systems and reveals that even the most charitable interpretation of Sony BMG's internal strategizing demonstrates a failure to adequately value security and privacy.") but also because of the rant-free and very lucid and illuminating analysis of the factors involved.

    To me, the best part was: "After taking stock of the then-existing technological environment that both encouraged and enabled the distribution of these protection measures in Part IV, we examine law, the third vector of influence on Sony BMG's decision to release flawed protection measures into the wild, in Part V. We argue that existing doctrine in the fields of contract, intellectual property, and consumer protection law fails to adequately counter the technological and market forces that allowed a self-interested actor to inflict such harms on the public.".

    Those who have hopes for political action to amend the current crop of laws may be interested to read: "Finally in Part VI, we present two recommendations aimed at reducing the likelihood of companies deploying protection measures with known security vulnerabilities in the consumer marketplace. First, we suggest that Congress should alter the Digital Millennium Copyright Act (DMCA) by creating permanent exemptions from its anti-circumvention and anti trafficking provisions in order to enable security research and the dissemination of tools to remove harmful protection measures. Second, we offer promising ways to leverage insights from the field of human computer interaction security (HCI-Sec) to develop a stronger framework for user control over the security and privacy aspects of computers."

  • Pigs will be ice skating in hell before that happens...

  • by TTURabble (1164837)
    The way I see it, my computer is my property much like my house is also my property. They both have "doors" to the outside world, but that doesn't mean that anyone can just walk in and have a beer. I guess my favorite analogy is buying a new TV. What if you went out and bought a new TV that had a hidden camera in it, but you didn't know about the hidden camera, and it was broadcasting a signal to anyone who wanted to watch. Would you keep the TV? Would you litigate against the company that made the TV? Th
  • The Sony/BMG EULA - set as haunting choral plainchant [wired.com].

    One of my favourite examples of "transformative" fair use ever.

  • No, really, read the paper before you mod me off-topic — page 1180 (24th of PDF [ssrn.com]):

    SunnComm, the company that delivered MediaMax, offered even more cause for concern. The company began as a provider of Elvis impersonation services. After a change in management following a false press release announcing a non-existent $25 million production deal with Warner Brothers, the company purchased a 3.5" floppy disk factory in 2001, displaying a disturbing dearth of technological savvy. After two employees an

Some people carve careers, others chisel them.

Working...