the Sony Quandry

[Ice Czar]

http://www.theinquirer.net/?article=27826

based on the assumption that Sony has indeed violated copyright with its rootkit\DRM

Sony as you well know is a card carrying member of the RIAA, an organisation that stands up to the letter of the law on copyrights, and is known for suing anyone who crosses them, from 12 year olds in welfare funded families to octogenarians. It is the epitome of all things it believes to be right and profitable for its members. In fact, it loves to wave damages of several thousand dollars per alleged copyright infringement. Good for them I say, it sets one hell of a precedent.

That is where the nightmare begins. If Sony did indeed distribute millions, some say tens of millions of copies of someone else's copyrighted material, that is bad. The fact that it sold those copies for a profit surely puts it into a whole other class of 'wrongness' than mere distribution, right? At the very least, this has got to be behaviour at least as infringing as distribution over a P2P network.

So, what is a company to do? It sets a precedent of a few thousand dollars per 'wrong', and now it has millions of Lexan disks of wrong on the books, and an auditable paper trail. This, if you use their own numbers could add up to billions of dollars owed to the Lame crew and the others alleged to have their virtual toes stepped on.

So, this is where the community can step up to the plate and end this silliness once and for all. If the allegations against Sony are true, it has set precedent after precedent that it owes a lot of people billions. If those people are smart, they can ask Sony to decide exactly the worth of each copyright infringement, and pay up that much.

Ask for a written, court approved document stating that a single infringement is worth X dollars per infringement. If Sony wants to set that number at $1 per copy, that's fine, write out a cheque for seven or eight figures and be done with it. The problem is, it has just cut the legs out from any future RIAA enforcement efforts.

If Sony wants to take the proverbial RIAA hard line, I am sure the Lame crew would love a few billion dollars. If you use the numbers that Sony likes to bandy about, around $150K per infringement, you have a settlement worth more than the entire Sony Corporation. Lame-Sony has a certain ring to it, don't you think?

 

[flynlr]

if they can sue the ass off of sony there is a god

 

[Ice Czar]

http://www.sda-asia.com/sda/news/psecom,id,5271,nodeid,1,_language,Singapore.html

"Multiple software components on the CD have references to the LAME open source MP3 code," wrote Finnish software developer Matti Nikki. Others, such as the security software firm Saber Security in Bochum, Germany, have confirmed that the program contains LAME code.

LAME is licensed under the Lesser GNU Public License (LGPL) which requires that any program that tightly integrates its code into its executable must acknowledge this use and release the full source code to their program. If the code was simply used as a linked library, the LGPL would have allowed closed source software to use it, but apparently the code usage was much more deep and thus violated the LGPL rules, which are less restrictive than the general GPL.

 

[Ice Czar]

http://www.sysinternals.com/Blog/

There are several pending class action lawsuits, likely more to come, and its my expectation that a U.S. government agency will eventually announce a formal investigation. The Federal Trade Commission is the one most likely to take up the case and if so, some of its recent actions (< link to below) against spyware vendors may have set promising precedents.

http://www.securityfocus.com/columnists/369

Recent developments

On November 10, 2005, the FTC filed a lawsuit in federal court in Los Angeles against Enternet Media and others. It was your typical anti-spyware lawsuit - you know, the program was installed without the user's knowledge, added dozens of other programs, captured personal information, was impossible to remove - yadda yadda yadda. This fact was considered to constitute a fraudulent and deceptive trade practice by the FTC. What is interesting in the complaint is the fact that the FTC argues that the terms of Enternet Media's End User License Agreement are not enforceable noting that, "Although the EM defendants do have a EULA, they do not require, let alone encourage, consumers to review it prior to downloading and installing the EM code. The EM defendants' installation boxes, when clicked on, automatically install the EM code, with no requirement that a consumer agree to terms and conditions."

The FTC complaint goes on to note that "[n]or can a consumer, having installed the EM code, reasonably avoid its effects by uninstalling or removing it. In most cases, the EM defendants' own instructions do not remove all of the EM code, and the EM code does not appear in the Add/Remove feature of the Windows operating system. Often, all or some of the EM code remains on consumers' computers even after repeated attempts to uninstall the code." This, among other things, according to the FTC, constituted a deceptive representation about the software.

Sony stands in the spotlight
Of course, no large and reputable company would act this way. Enter the Sony BMG fiasco. As reported in Security Focus Sony made thousands of music CD's with embedded digital rights management code. People thought they were buying a music CD with some sort of copy protection. What they were actually doing was licensing software subject to an End User License Agreement. The terms of the EULA, like those of the spyware distributor cited by the FTC, were not visible simply by playing the music, at least not on regular CD player. The EULA provided that "this CD will automatically install a small proprietary software program (the "SOFTWARE") onto YOUR COMPUTER" but did not describe what the software did, where it was installed, or how to get rid of it. The EULA also provided that your right to listen to the music existed only for as long as you retained possession of the purchased (or more accurately, licensed) CD, that you could only make copies of the CD on personal home computers that you owned (theoretically, leased or borrowed computers were out), that you could not export the software (hence play the music) outside the country, that you agreed to install any updates to the software (sound like spyware?) and that Sony's liability to you was capped at five bucks - irrespective of what the software does. Other fun provisions of the EULA as noted by the Electronic Frontier Foundation include the fact that your right to listen to the music terminates if you file for bankruptcy, that you can't transfer the music on your computer, even with the original CD, and that you can't change, alter, or make derivative works from the music on your computer - all things you ordinarily could do under copyright law.

the rest of the article is well worth the read but closes with

Finally, the Sony case represents a disturbing trend among owners of intellectual property. This is the tendency to misuse copyright law to obtain other non-copyright rights, and to severely limit copyright rights of users. Copyright law grants the owner of the copyright a "bundle or rights" to control - for an increasingly long period of time - how the work is displayed, reproduced, performed, etc. It also allows the public to make certain uses of the work, either by express or implied contract, or under the doctrine of "fair use." So things like "private performances" of copyrighted works are permitted under copyright law.

Issues with copyright law and DRM

The problem is, to obtain access to the copyrighted work these days, you tend to have to agree to a EULA. Ellen Barkin's character Beth told Daniel Stern's "Shrevie" in the movie Diner, "I just want to listen to the music." You can't just do that anymore. You have to sign a contract before you can listen. The contract purports to limit your right to make fair uses of the copyrighted works. For example, both the software game mod chip cases and the Michael Lynn dispute with Cisco revolve around terms of EULAs which purport to limit users' rights to reverse engineer software they have purchased and licensed. Lexmark and Chamberlin went one step further, using the terms of EULAs to attempt DMCA prosecutions of those who refilled ink cartridges or created cloned garage door openers. Increasingly, copyright owners are increasing their "bundle of rights" under contract, having you agree to this practice through a click through EULA, and then attempting to enforce these "rights" not under breach of contract law, but under copyright law itself.

The law recognizes a concept called a "misuse" of a patent. That is, I get a patent to a process or technology, and under what purports to be a license, I get you to agree not to compete with me - an antitrust violation. Patents and copyrights are intended to protect legitimate intellectual property rights of creators - not to bludgeon the unsuspecting consumer.

Increasingly, commercial software is looking like malicious code - both in what it does and how it does it. At the same time, authors of malicious code are taking a cue from the commercial software developers, and writing long "click wrap" contracts which purport to inform the user of the damage done by, and limit the remedies for, the malicious code. For now, courts should require all intellectual property providers to provide clear and conspicuous notice about what the limitations of the use of the IP are, and what the software will do. Contract provisions that extend the rights of IP holders beyond that in copyright law, and which consequently limit the rights of IP users should be looked on dubiously.

 

[XOR != OR]

I hate to be the cynical one of the bunch, but the best anybody can hope to see from this is a few bucks to people who bought the infected CDs.

No, wait, that's not right: The best anybody can hope to see is the lawyers, making billions off the judgement. The second best would be the couple bucks to the people that bought the infected CDs.

First, the law won't apply to sony as it would to a 13 year old who downloaded a few songs from emule ( or whatever ).

Second, sony didn't write this package, so they can claim complete ignorance as to what they were distributing, and get away with it. The company that actually sold them the software could get sued into next year, but they'll fold at the first sign of trouble, and go setup shop elsewhere. Also, it's doubtful they actually have billions to distribute.

If everybody really wants to do something: Stop buying stuff from Sony. Encourage others to do the same, using this and other fun facts. The more people that are outraged by Sony's actions, the less people that will give them money.

And that means no buying the PSP, or the games. Or music from their artists. Well, 'artists'. I don't allow the term to be used for dressed up monkeys.

 

[Ice Czar]

Id say the best that could be hoped for is that the public at large becomes aware of the issues of DRM, their rights under copyright law, the security issues of rootkits

and complain to their representatives

any way you stack it Sony have shot themselves in the foot
set their "cause" back a few years
and made the public that much more aware what they have been giving up regarding their rights

hurt them in the pocketbook enough and its strange how corporations pay attention

 

[RanceJustice]

I'm with XOR here - I've stopped buying sony products. I hope others will follow suit. Right now, Sony is at the top of my "evil company" list. I just hope that this little incident will prompt them to remove some of the draconian copy protection from the upcoming Blu-Ray spec and PS3. I remember when sony was on the OTHER side of this copyright debate! I'd like nothing more for them to go back to selling top of the line electronics at reasonable prices, without all kinds of DRM and propriatary crap built in.

 

[mngl1500]

Texas is going after Sony now

http://www.usatoday.com/tech/news/computersecurity/2005-11-21-texas-sony-suit_x.htm

 

[djnes]

If everybody really wants to do something: Stop buying stuff from Sony. Encourage others to do the same, using this and other fun facts. The more people that are outraged by Sony's actions, the less people that will give them money.

And that means no buying the PSP, or the games. Or music from their artists. Well, 'artists'. I don't allow the term to be used for dressed up monkeys.

I couldn't agree more. Aside from the fact many of their digtal camcorder / home entertainment products are not what they used to be, this is just the final reason to stop buying Sony crap.