• PC World
• »Consumer Advice

Sony BMG Music Entertainment is hoping to put some of the heat behind it caused by security flaws made public in early November in the controversial copy-protection software the vendor was shipping on some of its CDs. Together with SunnComm International and First 4 Internet, Sony has tentatively agreed to a settlement in a nationwide class-action lawsuit about the security flaws, according to court documents released last week.

Lawsuits from consumers begun to fly in mid November after it was revealed that Sony had been installed copy protection software on some of its music CDs which could leave a purchaser's PC vulnerable to security attacks. The software, XCP (Extended Copy Protection), designed by First 4 Internet, was also very difficult to remove. After weeks of criticism, Sony announced plans to remove the CDs containing XCP and launched an exchange program so consumers could trade in their XCP CDs for discs without the copy-protection software.

The class-action lawsuits from around the U.S. were consolidated into a single case--Sony BMG CD Technologies Litigation--pending in the U.S. District Court for the Southern District of New York. At the same time, a number of U.S. states, including New York, have been looking into Sony's use of XCP, with the company already being sued by the Texas Attorney General.

Sony begun including the XCP software in some of its CDs in January 2005. The company has also been shipping CDs containing SunnComm's MediaMax content protection software since August 2003, according to the court documents. More than 15 million CDs are believed to contain XCP or MediaMax, the court documents state.

What Happens Next

If the proposed settlement is approved by the court, it would resolve the claims in the class-action lawsuit that Sony, SunnComm, and First 4 Internet engaged in deceptive conduct in designing, manufacturing and selling CDs containing XCP and MediaMax software without fully disclosing the limitations the software imposed on the use of the CDs and the security vulnerabilities the software creates, according to the court documents.

The proposed settlement would enable consumers who bought, received, or used a Sony CD loaded with XCP to exchange the disc for a replacement CD, an MP3 download of the same album, and either a cash payment of $7.50 and one free album download or three free album downloads. Consumers who have a CD containing MediaMax 5.0 will receive a free MP3 download of the same album and one additional free album download, while those with CDs containing MediaMax 3.0 software will receive a free MP3 download of that same album.

The proposed class action settlement also requires the three companies to stop manufacturing Sony BMG CDs with XCP or MediaMax 3.0 or 5.0 software and to make available updates to fix all known security vulnerabilities caused by the products. The companies would also provide software programs to uninstall XCP and MediaMax safely and agree to fix any future security vulnerabilities that may be discovered in MediaMax and any other content protection software installed on Sony BMG CDs, according to the court documents.

The companies also pledge to provide independent verification that personal information about users of Sony BMG CDs has not and will not be collected through XCP or MediaMax. They also will ensure that any other content protection software they may use in the future will be clearly disclosed, independently tested and readily uninstalled, according to the court documents.