Sony Settles With FTC Over Rootkits

The FTC has struck a deal with Sony punishing Sony for the rootkits it included on millions of CDs in 2005. The deal is exactly like the Texas and California settlements — $150 a rootkit. The settlement isn't final yet. There will be a 30-day public consultation. American citizens who read Slashdot might want to put in their two cents. Comments will be accepted through March 1 at: FTC, Office of the Secretary, Room H-135, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580 (snail mail only). Here is the FTC page announcing the settlement.

What about OS????/

I am an Aussie, this means nothing to anyone outside the USA, it would be good to see Sony pay US$150 to everyone they infected with their shite.

150? If by 150 you mean 150ml

How about 150ml of the Sony CEO's blood per rootkit. If they run out, then start taking blood from the rest of the executives in a hierarchical fashion.

Re:How About...

The CEO of Sony has gone on the record as saying he thinks online music sales are too expensive and should be close to the 25c mark.

What a great guy. Going on record saying what he sees as fit instead of actually running the company the way he sees fit.

Why are they even paying this man?

Drawing parallels

According to the FTC, the software also exposed consumers to significant security risks and was unreasonably difficult to uninstall.

Hmm. Perhaps they would fine Microsoft too, based on this exact reason? ;)

Save your reciept ?

Under the settlement, Sony BMG must allow consumers to exchange affected CDs bought before 31 December 2006, and reimburse them up to $150 (£76) to repair damage to their computers.

I understand why stores require reciepts to return stuff, but when it comes to CDs which are non-returnable once that plastic wrap is taken off, who the hell bothers to save the reciept ?
How are they going to know when the CD was purchased ?

how does this multiply out?

Is that $150 per cd "sold through" or $150 per customer who is aware of the lawsuit and actually files to get their cheque? Because I imagine those are entirely different numbers. Also, for those who would like to see Sony hurt worse for this, do remember that that this is more than enough. Any company pulling a stunt like that again will be ignorant, not unconcerned.

So when are desktop OS's going to come installed inside a secure virtual machine OS that is capable of detecting rootkits and possibly doing a little extra scanning on the side? That is long overdue.

Re:how does this multiply out?

Is that $150 per cd "sold through" or $150 per customer who is aware of the lawsuit and actually files to get their cheque? Because I imagine those are entirely different numbers.

I wonder how many people have these CDs and dont even realise that their CDs are or have been infected? This did make the mainstream media, but wasn't a huge story. I imagine there are thousands of people who still have no idea.

Wouldn't a better punishment be that Sony is made to stand up and publicize (using such mediums as MTV) the particular CDs that were infected and educate people as to how they can protect against malware. - It openly damages them to those who aren't aware about this (thereby acting as a deterant for anyone else thinking about doing somthing like this), informs the masses as to the lengths DRM goes to (generating more widespread disapproval for DRM) and helps to fight malware through educating the yoot.

Re:how does this multiply out?

How many people won't even know that they have been rooted?

This sounds like the perfect opportunity for one of those chain e-mail letters to be circulated. "Have you played any of these Sony CDs on your computer? If so you're entitled to $150. Pass this along to 5 other people or you will die tomorrow!"

Re:how does this multiply out?

Is that $150 per cd "sold through" or $150 per customer who is aware of the lawsuit and actually files to get their cheque?

It's not even that simple, FTFA [ftc.gov]:

As part of the settlement, Sony BMG will allow consumers to exchange CDs containing the concealed software purchased before December 31, 2006 for new CDs that are not content-protected, and will be required to reimburse consumers up to $150 to repair damage that resulted directly from consumers' attempts to remove the software installed without their consent. Sony BMG is required to publish notices on its Web site describing the exchange and repair reimbursement programs.

It's a reimbursement for costs incurred while trying to repair the damage done. I presume this means you would need a receipt from a vendor or service company that removed the rootkit for you. I doubt Sony will award the full $150 to you if you removed it yourself.

Meanwhile, RIAA wants $750 per song...

Isn't that a little unfair?

Not bad

The terms of the settlement actually seem pretty good for the consumer. You can claim up to 10 times the price of a CD for damages, you can exchange existing CDs for unencumbered ones, and Sony has to deal with the embarrassment of advertising this fiasco on its website. And more importantly, this will hopefully send enough of a message to other DRM providers and users to make them pause before throwing more malware into their products.

The only thing I'd like to see added onto there is a clause requiring Sony to pay the legal defense fees of anyone sued by the RIAA. I can dream.

By that rationale...

From TFA

The US regulator said the anti-piracy software wrongly limited the devices on which music could be played to those made by Sony or Microsoft.

Hmmm... no mention whether Vista or other Microsoft operating systems will come under fire of the same arguement.

Send the repair bill in

Maybe some folkes can send the invoices for lost time and consultancy hours spent on fixing their systems.

I'm sure that will be just a bit over $150...

If someone in their basement pulled the exact.....

....same thing, their asses would be in the slammer in no time. Sony souldn't be treated any different. This was a computer crime, plain and simple.

Re:If someone in their basement pulled the exact..

Yes, but Sony is a company and this is the USA.

All the rights of an individual with hardly any of the responsibilities.

How much per song can the RIAA get away with?

I want THAT, per song on the CD that contains the rootkit...

Karem

So if I'm reading the settlement site correctly...

Without a receipt for repair services the most that you can qualify for is $25 dollars, at their discretion.

If you removed the unlawful hack yourself, no matter how much pain and suffering it caused, there is every probability that they will compensate you exactly nothing.

(I mean nothing but the opportunity to exchange your defective CD for a slightly less defective one or a DRM-laden download.)

I think the kicker is that this is one of those fancy federal consent-decrees -- like the one that was used to "break" the Microsoft monopoly way back when. They agree not to be such meanies and in exchange, they receive total immunity from prosecution on any related federal charges and all state laws that conflict with the federal decision are automatically superseded.

I'm so glad that the feds are looking out for me. With punishment like that, Sony surely KNOWS they've been naughty. It's certain that they won't do anything like THAT again.

Claim form help?

The claim form you need to fill out for recompensation is at this link [sonybmg.com].

One of the questions is as follows:

7. Briefly describe the type of harm / damage / problem you experienced and the steps that you
took in response:

What kinds of problems, other than the pain of removing it, did people have? Was any actual damage done? Did anyone's computer get taken over? I'm just curious what a valid response would be to this, for when I fill out the form.

Understatement of the year...

According to the FTC, the software also exposed consumers to significant security risks and was unreasonably difficult to uninstall.

Huh? "Reasonably difficult"? This damned thing broke Russinovich's [technet.com] machine, and he had to use several utilities he developed himself to get rid of it by looking deeper into the Windows OS than I think Microsoft ever intended (or wanted) anyone to look. How many /. denizens would have looked for this little gem using named pipes [wikipedia.org] to communicate?

"Difficult to uninstall"? Right...

I Chooose a Better Punishment

I'll never buy something from Sony again until they change their anti-consumer practices.

Two cents

American citizens who read Slashdot might want to put in their two cents.

No, thats all wrong. Sony is supposed to pay out...

Wonder who really gets to pay...

What's the betting that cost of this gets passed onto artists as deductions from royalties ?

Artist monthly statement:

Sales: $$$
Gross royalties (tiny%): $
Deductions:

      [ blah blah blah ] $$
      DRM legal costs $$
      [new this month]

Net Royalties: -$$$

[NB: you won't have to pay us because we're nice like that, we'll just carry it forward]

I have an idea for compensation

How about a free PS3 instead? Oh wait, that would just introduce more Sony problems into our lives. Whoops.

Damn them anyway!

Sony's rootkit (which my teenaged daughter installed; damn it I had autoplay shut off for a reason!!!) cost me the price of an SB Audigy since I couldn't find sound chip drivers, and XP since my video card mfg didn't have Win 98 drivers for download. Around $200 plus an afternoon of my time; reinstalling W98, then going to Circut City and installing XP (three fucking times - it didn't like my CD burning software and had a popup on boot saying XP had disabled it, but XP wouldn't let me uninstall it because it had disabled it. Then it updated my networking drivers which disabled the internet. Great product that XP).

After being yelled at for ruining my computer, she broke the CD and threw it away, and I've lost the receipts for the SB and XP.

I think a more fair settlement would have been to just have Sony give $500 to every man, woman, and child on the planet, and have its CEO spend as much time in a US federal assrape prison as anybody who would have done this to Sony's corporate computers would have, after being caned in Singapore. Then when he was released from US prison, have the Chinese execute him and bill his family for the bullet.

If you work for Sony in any capacity at all, I hate your fucking guts. Please die and take your God damned company with you.

Sorry for the rant.

How much they should actually pay

Sony BMG should have to pay each infected person the amount of money that it would take to replace their infected system plus the money they lost from not being able to pull all of their data out of the fire. For the average user, this malware probably made their computer totally unsalvagable, so this seems reasonable.

Grrrr Rrrrr Aaah-Oogah!!!

(Subject Title is from the Dilbert Desk Calander for 1/28/2007)

So it took them this much longer to achieve exactly the same settlement, lawyers billing their time all along the way. That's government in action for you.

Blame engineers, not just CEOs

Lots of people talk about blaming the CEOs for this type of behavior. But as a programmer, I think of the people who actually implemented this. Somewhere, there is some employee or contractor who wrote a rootkit for Sony. Maybe a few people. And somebody was paid to make an ISO image containing music tracks and a rootkit. I would love to know what they thought when he made that ISO image. Did he call his boss and say "Hey! There's a rootkit on here!" or not? How about the team of testers who had to compromise their machines and verify what information was sent back? Did any of them think that maybe this wasn't such a good idea?

There are a lot of people responsible for this type of thing. Is corporate-group-think so powerful that these people didn't even realize what they were doing was wrong? Or did they hold their tongues out of fear? Or were they malicious?

I'm just happy to know that

I'm just happy to know that even though I never bought one of the millions of CDs that included this rootkit, at the end of the day, sony loses $130 for every CD sold with it. Honestly I think it should be more, but between that, the battery recalls, blue-ray, the shoddy PS3 sales, I think it's time for new management in Sony and they really need to turn themselves around as a company. In my mind right now, they are worse than Microsoft.

Sony can make a profit from this

slashdot reported that 40% of all music consumers have pirated music http://slashdot.org/article.pl?sid=05/06/21/223825 6&from=rss [slashdot.org]

people who had the rootkit are music consumers (since they bought the cds) therefore 40% of the affected people have pirated music

now sony only has to sue EVERYONE who claims his 150$
because of the first and second statement, sony will win twice in every five cases (those two have at least 1 pirated song, so they have to pay at least 700$) which means:

for paying 5 times 150$ (5*150$=750$) they get at least 2*700$=1400$ which means
SONY GETS A PROFIT



yes, I love math :-)

So does this mean...

That if I get caught planting rootkits on peoples' computers that it's only going to cost me $150 per offense, with no jail time?

Some Sony executives should be serving time. Isn't planting a rootkit on someone's machine a felony in the US?

Re:Vaginas for Jesus: Nice real nice, REMOVE IT

This kind of shit shouldn't be just marked 'offtopic', it's spam and spam should be deleted. This goes also for the first post idiots and the goatse boys.

These are part of the answer why most internet publicists don't allow the public to comment the news. Which is a shame since some readers do have something interesting to say.

Re:individual doing this would go to jail

Because avoiding jail time is expensive, and how many individuals have deeper pockets than even an average sized corporation?

Sad, but true.