Lawsuit criticizes Sony CD software

A District resident acting as a “private attorney general” this week filed a lawsuit against Sony BMG Entertainment, charging the company sold CDs infected with “spyware” and that Sony’s attempts to curb the damage have created even greater risks for consumers.

The suit was filed by the law firm of Finkelstein, Thompson & Loughran Monday in D.C. Superior Court under a provision in the District’s Consumer Protection and Procedures Act that allows a resident to act as a private attorney general to seek relief on behalf of D.C. residents.

“By surreptitiously encoding its CDs with [Extended Copy Protection] and MediaMax software for the purported purpose of securing its intellectual property, Sony has endangered the security of personal information for computer users throughout the District of Columbia,” according to the suit filed on behalf of resident Nicholas Xanthakos.

The XCP software, created by the British firm First 4 Internet Ltd., is a content-protection technology that limits the number of copies to three that a consumer can make after buying a CD.

About 5 million copies of the CDs, by various artists from Ray Charles to Switchfoot, have been shipped and more than 2 million were sold, according to a Sony BMG spokesman.

A public telephone listing for Mr. Xanthakos could not be found, but Donald Enright, a partner at the Finkelstein, Thompson & Loughran, said the suit has two main goals: to stop further sales of the “spyware-laden CDs” in the District and to seek compensation for affected city residents. He added that the full extent of the harm is difficult to ascertain because “we still don’t know all the ways these software add-ons can be exploited by hackers.”

The lawsuit follows two others filed earlier last month: One by Texas Attorney General Greg Abbott that allows for up to $100,000 in damages for each violation under a state spyware law, and another in California by the Electronic Frontier Foundation, a nonprofit digital rights group.

The suits say the XCP is “spyware” because it was hidden from consumers, alters the Microsoft Corp. Windows operating system, transmits details about what music the PC is playing, and could be exploited by a hacker seeking to plant malicious code.

Sony released a software patch early last month to “uncloak” the program and has agreed to pull all discs containing XCP software off store shelves. Consumers who bought affected CDs can get information about free replacements at www.sonybmg.com.

Sony has not agreed to recall the approximately 20 million CDs that have been encoded with MediaMax software by SunnComm Technologies Inc. of Phoenix which has also been named in the lawsuits.

A spokesman said Sony is dedicated to making things right, but declined to comment on the lawsuits. More legal challenges may be on the way.

“We are looking into the matter,” Brad Maione, a spokesman for New York Attorney General Elliot Spitzer, said yesterday.

The suits will slow other music providers’ anti-piracy efforts because of the widely publicized reaction and the potential involvement of numerous states’ attorneys general, said Phil Leigh, senior analyst at Inside Digital Media Inc. in Tampa, Fla.

“I think it will make [the music industry] more cautious about moving ahead,” Mr. Leigh said.

“It will make them re-evaluate whether this is even really a good idea,” because consumers will not buy CDs they can’t put on their IPods and that requires them to first download the songs to their computers.