Music Industry Backlash Against Sony Rootkit

Foobar of Borg writes "The Associated Press describes how backlash from Sony's Rootkit CDs is causing problems for the music industry. The problem is two-fold: (1) the inherent technological problem of trying to prevent anyone from copying anything and (2) letting lawyers make technical decisions when (from the article) 'Lawyers don't have any better understanding of technology than a cow does algebra.'" More from the article: "'I think they've set back audio CD protection by years,' said Richard M. Smith, an Internet privacy and security consultant. 'Nobody will want to pull a Sony now.' Phil Leigh, analyst for Inside Digital Media, said the debacle shows just how reluctant the labels are to change their business model to reflect the distribution powers -- good and bad -- of the Internet. He believes that rather than adopting technological methods to try to stop unauthorized copying of music, record companies need to do more to remove the incentive for piracy."

Wait a minute

So the Sony rootkit is BAD?! This needs more coverage.

Re:Wait a minute

Exactly. If I hear "rootkit" one more time... heheh.

What I want to know is how two small time startups like First4Internet and SunnComm steal all the publicity from Macrovision.

Where is the analysis of CDS-300? Macrovision is the 800lb gorilla in this business, but nobody cares about them.

Re:Wait a minute

Well, one of the reasons why this blew up so bad was that the rootkit was poorly coded. Furthermore, so was the uninstall tool. Macrovision has a lot more resources than small time startups like First4. They can hire better coders, and they have better resources to do QA. So maybe Macrovisions stuff is still doing all the naughty bits, but they've hidden it better and it doesn't open up your computer like swiss cheese.

Re:Wait a minute

It looks like it was called sarcasm, sarcasm are normally an attempt at humor by exaggerating the devils advocate, to state the point of the opposite.

Trolls are people who are excessive negative in there posts, often try to personally attack others, or come up with the standard insults, (examples all Apple Users are Gay, or All Linux users are geeky little boys with no lives.) Sometime a troll can be sarcastic, but they should be paid attention differently.

Flamebait are posts that are meant to get people angry and talks about things that a number of people feel strongly about. (examples VI vs Emacs, OS X vs. Linux, Apples 1 button mouse, Politics, Abortion, Religious views) these are arguments that neither side will gain any more insight then they did before. Thus a normal waist of bandwidth and file space.

Redundant these are posts that that say the same thing as other posts and bring no new light onto the table.

Offtopic this is how this post should be moderated it is where the topic of conservation has targeted to much off the original topic. Or the post has nothing to do with the topic.

Over Rated these are posts that seem to moderated to high for their content. Often used to give an other message(s) more priority over the others. So the quick one liner the got first post that had a +5 funny and wasn't really that funny can be modded to a +4 funny and have all the insightful comments underneath it be read first.

Under Rated these are post you want to mod up but really don't know what topic it really fits in, or you want to keep the original moderation but you want it to have a higer score. Ex. if you see a Troll but you really like it and want everyone to see it you give it underrated and if more moderators do the same that is how you can have a Troll +5.

Funny this is where sarcasm goes, normally it is an attempt at humor.

Informative when good and correct information is given. Usually helps fill the missing gap in a story or comment.

Interesting when the user says sorting that causes interest in the posts, normally if you see a posts with a lot of replies to it then it should be considered interesting.

Insightful when more then average thought was put into the post which gives a Point of View not given by others or the Article.

I do not think it means what you think it means

I think you're confusing sarcasm and satire. Satire is often a reductio ad absurdum argument, showing the silliness of a particular hidebound point of view. Sarcasm is just being snarky.

Remove incentive?

"need to do more to remove the incentive for piracy".

Like say, making shit music that no-one would want to pirate? Ugh, too late :|

Re:Remove incentive?

After agreeing to a recall, Sony BMG said Friday it would let customers who have already purchased CDs to mail them back, postage free, for a replacement. Sony BMG also would send them a link to download digital versions of the tunes.

Remove incentive for piracy by providing digital version of music?
I wonder if it'll be a DRMed WMV.

/Hook a brother up with the link?

Re:Remove incentive?

They're unprotected MP3's [realtechnews.com].

Re:Remove incentive?

He-he! Brilliantly put. Talking to the youth who download music illegally these days, that is the very reason they don't care to actually pay for their music - they think it's cool to listen to, but not worth the money to pay for. Watching the movie The Last Waltz about The Band's final performance the other day, it really brought home the value for money proposition with music: There you had six or seven brilliant musicians giving it their all and producing some amazing stuff. With modern music you get one or two "producers" in a little room with a computer and some Cubase plugins churning out canned cut-and-paste samples. Or at best a group of "plastic-punk" rockers such as Green Day slapping together a bunch of generic power chords with not the slightest hint of musical challenge. Sorry, I can do that myself for free...

hmm anti-lawyer FUD

'Lawyers don't have any better understanding of technology than a cow does algebra.'

Is that right? [lessig.org]

Re:hmm anti-lawyer FUD

In general they don't, even though Mr. Lessig is an example of the opposite. How many Lessigs are there out there? It's not FUD even though there is one counter example, you don't have to take everything litteraly.

Re:hmm anti-lawyer FUD

'Lawyers don't have any better understanding of technology than a cow does algebra.'

Is that right? [Please see parent comment for link]

That's why I like to avoid absolute statements and generalizations: all it takes is one case to refute, even though the statement may be accurate for the majority and there may only be one or two cases that can refute it. It's like what they say about congressmen: the dishonest 534 make the rest look bad.

Still, wouldn't it be cool to discover that one supersmart cow? And kill it? And eat it and learn algebra? Mmmmmmm!

Re:hmm anti-lawyer FUD

The problem with lawyers is that 99% of them give the rest a bad name.

You think you have problems!

"Sony, in fact, tried discs that contained data near the perimeter of the CD instructing a computer's hard drive not to look for audio tracks."

Man, that's nothing... I remember when that Kid Rock CD instructed my hard drive to score some weed and a couple of hookers! Try explaining that to your wife!

Re:hmm anti-lawyer FUD

As an attorney I can tell you that lawyers tend to have a better grasp of technology than many other professional groups that I come in contact with. You have to be pretty smart to get into law school these days and that generally translates into a better understanding of current technology.
Furthermore, I doubt that Sony's rootkit scheme was unconditionally approved by legal. Lawyers tend to be very conservative when giving advice. I can't imagine any competent lawyer giving the green light to this type of thing given the patchwork of laws regulating and potentially impacting the legality of this scheme and that's just within the US, nevermind internationally. Companies, especially large companies like Sony, are not run by attorneys; they're run by professional managers. It's not uncommon for managers to end run legal or simply ignore legal advice when it's not what they want to hear.

use the attention

Now we just need to use this to draw attention to other things that "people don't understand, so why should they care?", like the broadcast flag, and other overly restrictive DRM technologies.

Re:use the attention

I think your heart is in the right place, but I don't think diluting the message will be effective.

In talking with a few non-technical family members, part of the reason that this rootkit business is making headway with non-techy folks is because it is clear, in non-technical terms, that their music cd is "breaking" their computer. That computer that they find so damn incomprehensible, the one that they don't feel they have the expertise necessary to diagnose and fix.

Now they have a reason to blame their random computer slowness and its abberant behaviour on a big corporate monolith, (despite the fact that their computer probably contracted malware from elsewhere, seeing as they can't be bothered to patch it), and in having an identifiable target, they now want blood.

On one hand, I wish nothing but bad karma for Sony for putting a rootkit on people's machines. On the other, Sony is being made a scapegoat for the relative complexity of maintaining a secure and clean system.

Re:use the attention

On the other, Sony is being made a scapegoat for the relative complexity of maintaining a secure and clean system.

You're right that computers are poorly designed when it comes to maintainability, but Sony deserve all the bad karma they are getting. They have a long history of abusing the trust of their customers, including installing spyware as standard on their Vaio computers. http://www.winpatrol.com/db/freesample/tgcmd.html [winpatrol.com]

If the RIAA ran other industries....

We'd be paying $1500.00 for a coast to coast airline ticket.

There'd be no interstate trucking industry. All freight would go by rail and canal.

All television would be black and white. There'd be no VCR's (let alone PVR's!).

All radio would be AM.

Telephones would all be dial. Long distance calls would be $2.50/minute.

We'd all still be using slide rules.

There would be no foreign cars in the U.S.

There would be no sources of alternative energy (wiond, solar, etc.) whatsoever.

And on and on. The RIAA wants to maintain the status quo at any cost. They have had ten years to adapt and have resisted at every turn. They all likely believe in Landrew (save us, save us, Landrew!).

They are pathetic.

Re:If the RIAA ran other industries....

We'd all still be using slide rules

Forget your slide rule.
/.'ers are hardcore
Real men use the abacus to do math.

Slide-Rule using pansy.

This rootkit will be remembered...

...as the first and probably only rootkit wich has done something good.

Debacle with good results?

Actually, this might be a debacle with positive consequences. Not that it was a big secret or anything, but this fiasco is making it very clear how the paying customers feel about having their rights stripped away by secret technical countermeasures. However, all of this is linked together, and all of it goes back to the root of the evil. In this specific case, the evil of having copyright law controlled by publishers whose only interest in profit maximization. Remember that the REAL justification for copyright monopolies was to benefit society by encouraging creativity. The mechanism was supposed to work for the benefit of the creators. No mention of publishers in the American Constitution, though they've been dictating the terms of copyright laws for decades.

Perhaps it is too much to hope for, but it is certainly clear that the current system is completely out of whack. Perhaps it will collapse now and America can start considering why this was supposed to be a good idea in the first place. It's way past time to whack Mickey Mouse.

On the other hand, perhaps it doesn't matter. If you believe that the free exchange of creative ideas is a thing that benefits society, and that this encourages growth and development of a healthy society, then you must conclude it confers competitive advantage. Therefore, the societies that do better at encouraging creativity will eventually overwhelm the others--and nothing the **AA can do will stop that inevitable transition.

Re:Debacle with good results?

Actually, you can thank Mark Russinovich (who exposed the Sony malware) for immediately branding it with the proper term "rootkit." The press picked up on this evil-sounding term before Sony flacks had a chance to spin it as something benign-sounding.

Cows, algebra, and slashdot

By that standard, "coders and technologists know about as much about the economics and public policy implications of intellectual property laws as cows know algebra."

It doesn't seem to stop every self proclaimed expert here from spouting off their particular pet theory that coiincidentally justifies their eMule use, nevertheless.

Re:Cows, algebra, and slashdot

Oh wait - did I say atom bomb? I meant p2p services / cryptography / intellectual property / etc. In that case, the attitude seems to be "f*** that, it's mine - i can do what I want, and if they try to stop me i'll ( build unstoppable v2 / ignore them / claim that they are all corrupt overpaid idiots / etc. }" Of course, p2p is not an atom bomb, but it does have many policy and law implications.

If everybody and their mother could download atom bombs from the Internet (I don't mean the blueprints, but complete with U238/plutonium, high-precision high-performance explosives to initiate fission and detonator) we'd all be in deep shit. I talk to my friends on IRC (P2P), I maintain my parent's Linux box via OpenSSH (encryption), IP is being broadcasted to my house 24/7 by TV and radio. To be honest, I don't really feel having an atom bomb would improve my quality of life. Taking away tools and services that I already make use of is something completely different.

The cat is already out of the bag. You can not turn back time. I don't know how many ways there are to say this, but if they want to introduce a DRM-Internet less capable than Arpanet, a PVR less capable than VHS/Betamax combined or an encryption so weak as to not be trustable, I won't accept it. I alone don't have any right to execute policy. But we, the people do have the right to execute policy. The government is nothing but an organization put in place by the people to serve the people. That is the fundament of democracy. By that I don't mean that each and everyone can go do whatever the fuck they like and ignore the law. But if we collectively use P2P and encryption and IP in a given way, I say that we hold that authority and not those we have elected to serve us. When the government starts to represent a will of its own that is not the one of the people, it is they that are in the wrong and us that are in the right.

You mean...

'...record companies need to do more to remove the incentive for piracy.'

Which brings up the method, again, of how the 'Dead dealt with bootlegging, by inviting bootleggers to give it thier best shot - This meant more publicity for the band, which led to more sales.

The record companies just won't let go. They want the model that puts them in control. Pricing control where they get to say which track sells for what amount, giving them leverage over the artist - bundleing, where trash tracks have to be purchased, whether the consumer wants them or not - consumer habit tracking, where they get first dibs on mining all that data...it goes on and on. The record companies just need to die, it's that simple.

In Sony's case, I guess this one can be laid at the feet of the lawyers, but hey, they've got their own business model to protect, and we all know where that one leads.

Why not just let the artists be in control for a while. Let the $$$ grabbers sell peanuts and t-shirts while the consumer enjoys decent music for a change.

US Patent no. 62265781337

A cow doing algebra

Dir sirs,
The suggested apparatus is a sentient, grass-eating organism ("Cow"), that has or will be taught complex mathematical operations ("Algebra"), with or without the aid of various computational devices.

I intend to patent this "invention" and then go on and "licence" it to all cattle grows in the planet, which will have to pay or face my formidable legal team. In fact, I have already hired an "Intellectual property" law firm, who has assured me that I am loosing $5.6B every day - literally being stolen out of my pocket, and the plates of my children, by greedy farmers who will not respect the foundations of our economy.

Moreover, said lawyers have promised me that the USPTO and the courts will share their (my) view that every cow grazing grass is in fact performing complex calculations, probably for some foreign power like Iraq, or worse, Europe.

All the best,
Edgar Bronfman.

It Is Official

The dangerous factor was a "rootkit," a feature cloaking the files on users' computers that reported back to Sony BMG about how music was played and transferred.

Sony Rootkit = Feature
You heard it here first

Plans Deferred

Sony BMG would not comment on whether it plans to explore digital rights management techniques that are less intrusive than XCP.

Translation: Sony BMG needs to research how to make their next crippling system-level crack more undetectable before they try this exact same crap again. They don't give a second thought b0rk1ng their customer's computers, but they absolutely hate getting caught.

Umm... Copyright?

under the current system when something falls out of copyright (yes it happens every day, even to Elvis!) it enters the public domain and if free for all. Because DRM systems are attempting to be 'impossible' to crack there's a good change that when DRMed music falls out of copyright it will not enter the public domain. So using DRM is basically like saying bye bye to existing copyright laws.

the boycott begins to pay off.

I've been on a active boycott of record-companies since 1997. Two reasons. Sony closed a local CD-factory, claiming that 'piracy' was the reason. The production-equipment was shipped to Romania (or such) so I guess selling the CD's wasn't the problem, but they found a nice way to justify moving to a country with lower wages. (please keep in mind that most of you barely had the equipment to burn CD's or the bandwidth to exchange MP3's)

The other reason was that most companies abandoned recruiting local talent. All we get in our shops is American R&B, all we see on TV is American Gangsta Crap. There is a shitload of bands out their, but none of the big labels will see or hear them. Ilse de Lange might be the last you've heard from the Netherlands.

Haven't bought a single CD since, except directly from the hands of the musician.

What About The Artists?

I'm surprised that we've not heard more from the artists themselves on this front. You'd think that those whose CDs were clandestinely infiltrated by this technology would have opinions. After all these people make thie money directly from the sales of those CD's too and you can pretty well bet that not a one of them was told about or consulted in advance of the decision to rootkit these cds.

I'm curious to know if on top of Sony's problems a rash of lawsuits will be filed by attorneys representing artists that either had their work defiled by the rootkits or those that want out of their contracts because Sony's miserable judgment will result in substantially reduced sales for any artist on a Sony label.

Anyone know about this or have an opinion?

Stitch

"There is no "I" in B-O-R-G"

Cut prices, allow personal copying.

He believes that rather than adopting technological methods to try to stop unauthorized copying of music, record companies need to do more to remove the incentive for piracy."

Translation: cut prices, allow personal copying w/o restrictions.

right..

So someone put the fear of God into a company and now they're all running away going "NOT ME TOO! I'M NICE!" Well it's about fucking time.

Companies get away with murder, they tried to step on peoples feet again and they stepped on a very pissed off geeks feet and are now paying the price. If we had this uproar against all bullshit policies maybe the world would be a better place. But no, we're in a world of submissive consumers who won't say boo to a goose incase of a lawsuit.

Why not trade?

I beleve that P2P DLing of copyright works without permittion is wrong, but the record companies make it harfer to "just say no!" every day.

I want high quality, which the online music stores do not provide (128k WMA and AAC SUCK for a serious music fan with even marginaly good equipment)

I want the ability to easily copy the music! I should be able to rip it to MP3 ort ogg for listening on a HTPC or iPod, or Dell DJ or an mp3 cell phone...

Now as I shop for CDs I will always wonder in the back of my mind, "does t6his have spy/scumware? a virus? a rootkit? what does "enhanced" mean? would I be safer DLing a 320k MP3 from (insert P2P of choice here)?"

Sony encouraging piracy?

"... rather than adopting technological methods to try to stop unauthorized copying of music, record companies need to do more to remove the incentive for piracy."

I do find it rather ironic that I was, not five minutes ago, looking for an Oasis song (forgive me, its stuck in my head) on iTunes music store to purchase legally only to find out they are published by Sony-BMG who, in their infinite wisdom, have declined to be involved with the Australian iTunes music store [zdnet.com.au].

Given their current predilication for sticking DRM crap on CDs and the fact I only want one or two specific tracks, no sale for you. Good going Sony. What's a possible customer meant to do if you insist on treating us like (potential) criminals?

Issues that remain:

Issues that remain:

Attacking customer computers seems to be the kind of thing that is part of the Sony corporate culture. There has been no apology [userfriendly.org], and Sony management makes statements giving the impression they will do it again if they think they can without bad publicity.

A music retail store spokesman said that Sony's attack became public just before Christmas. Customers can easily choose some other gift now that they are scared about computer attacks. Sony's attack has hurt the entire music industry, not just Sony. Also, the damage will continue after Christmas.

Few people are technically knowledgeable. The Sony CDs will be causing problems for many years, as they are traded or sold to thrift stores.

The number of computers already corrupted is probably far larger than the 500,000 quoted in articles about the Sony attack. That number is just the number of Domain Name Servers that show evidence that a computer has tried to contact the Sony phone home address. The average server would almost certainly service more than one corrupted computer.

One kind of attack has received attention. However, Sony apparently sells other CDs with other software that may also have negative consequences for Sony customers.

Following Microsoft's lead years ago, some businesses treat all their customers as crooks so that they can stop a few.

My stuff about the Sony's rootkit

I've written some pages about Sony's XCP DRM system.

Summary about the DRM, what it does, and what its problems are: http://hack.fi/~muzzy/sony-drm/info.html [hack.fi]

You can also find my research and opinions about the issue linked from there. Please send mail if you have anything to add or any corrections to my content.

Increased security awareness

Actually the "Sony Rootkit" incident has increased the public awareness of computer security. How many non technically inclined people knew about "rootkit" prior to this?

To a certain extent, this incident has increased the public awareness of computer security, which is a good thing.

Even Grandma knows what a rootkit is...

It has already started at work. As the resident geek in the department, I already have explained many times about the Sony DRM and the XCP rootkit. With Thanksgiving holidays coming up and get-togethers with the relatives, I figure I should just hand out a little pamphlet. I would like to be a fly on the wall inside the Sony corporate offices as they look for some mid-level managers to can over this. I would also like to read some of their heated and panicked internal correspondence as they try to do damage control. Someone is going to get torched publicly for this by Sony's legal team. I have looked to see if any class-action lawsuits have been filed, but I am now aware of any, yet.

Oppression to reclaim unserved demands ... stupid!

He believes that rather than adopting technological methods to try to stop unauthorized copying of music, record companies need to do more to remove the incentive for piracy."

Yes, as always, innovation (of products, price, distribution and markets) to match actual demands is almost certainly superior to oppression and enforcing old entrenched business models by law ... but why is noone listening? Do they all need to live through oppression on their own to get a clue?

Another backlash to come

I think the biggest backlash to come is versus the security companies.

Where the hell where they ?

I personnaly uninstalled Norton Security from my computer as it's now clear that they can not protect me from emerging threats.

The threats of today are not the threats of tomorrow and security firms have to adjust in consequences.

Threats of today : Companies hiding stuff in your computer and correlation between companies. Think Windows Vista.

Threats of tomorrow : Don't ask security firms

Linux/Mac is not an alternative to this shit if you like to play the latest games.