Sony settles with FTC on rootkit fracas

Company to disclose the limits it imposes on use of CDs, pay US$150 for each damaged system

More than two years after a security researcher first called attention to Sony BMG's use of a stealth program to enforce digital rights management on its music CDs , the company reached a deal with the U.S. Federal Trade Commission over the incident, the FTC announced on Tuesday .

In a deal that was approved by a 5-0 vote by the FTC, Sony agreed to clearly disclose limitations on consumers' use of its music CDs and promised not to collect information for marketing or install software without consumers consent, the FTC said. The company also agreed to reimburse consumers up to US$150 for computers damaged by the program, the FTC said.

The settlement marks an end to a long and embarrassing incident for the company, which began when Mark Russinovich, an expert on Windows security of WinTernals Software, now part of Microsoft, published the results of his investigation into a rootkit that had infiltrated his Windows machine.

Russinovich's research uncovered a stealth program, dubbed "XCP," distributed on CDs from Sony BMG that silently installed and concealed itself on the machines of customers who played the CD. The revelation and Sony's awkward response to it -- first denying that there was any problem with the XCP program, then making halting efforts to release programs to remove XCP -- set of a chorus of criticism on blogs and in the mainstream press.

Subsequent investigation revealed that the XCP program was poorly conceived, hastily written and could be used by hackers to conceal their own malicious programs on systems that had the XCP program installed.

Eventually, Sony posted a software removal program for the XCP and conducted a widescale recall of XCP enabled CDs. But the incident was a watershed, prompting discussions of the competing interests of copy protection by corporations and consumers' right to privacy.

In the consent agreement announced today, the FTC said that "the installation of software without consumer consent that exposed consumers' computers to security risks was unfair and violated federal law." Hiding the software and failing to provide a way to remove it were also violations of U.S. law, the FTC said.

The company will have to offer its removal program for another two years and will have to continue allowing customers to exchange CDs with the concealed software purchased before December 31, 2006. The company will also have to provide retailers with financial inducements to return XCP infected CDs and allow the FTC to continue to monitor its compliance with the consent decree.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Paul F. Roberts

Show Comments


Brother MFC-L3745CDW Colour Laser Multifunction

Learn more >




Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Jack Jeffries


As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr


The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?