Sony settles with FTC on rootkit fracas

More than two years after a security researcher first called attention to Sony BMG's use of a stealth program to enforce digital rights management on its music CDs, the company reached a deal with the U.S. Federal Trade Commission over the incident, the FTC announced on Tuesday.

In a deal that was approved by a 5-0 vote by the FTC, Sony agreed to clearly disclose limitations on consumers' use of its music CDs and promised not to collect information for marketing or install software without consumers consent, the FTC said. The company also agreed to reimburse consumers up to $150 for computers damaged by the program, the FTC said.

The settlement marks an end to a long and embarrassing incident for the company, which began when Mark Russinovich, an expert on Windows security of WinTernals Software, now part of Microsoft, published the results of his investigation into a rootkit that had infiltrated his Windows machine.

Russinovich's research uncovered a stealth program, dubbed "XCP," distributed on CDs from Sony BMG that silently installed and concealed itself on the machines of customers who played the CD. The revelation and Sony's awkward response to it -- first denying that there was any problem with the XCP program, then making halting efforts to release programs to remove XCP -- set of a chorus of criticism on blogs and in the mainstream press.

Subsequent investigation revealed that the XCP program was poorly conceived, hastily written and could be used by hackers to conceal their own malicious programs on systems that had the XCP program installed.

Eventually, Sony posted a software removal program for the XCP and conducted a widescale recall of XCP enabled CDs. But the incident was a watershed, prompting discussions of the competing interests of copy protection by corporations and consumers' right to privacy.

In the consent agreement announced today, the FTC said that "the installation of software without consumer consent that exposed consumers' computers to security risks was unfair and violated federal law." Hiding the software and failing to provide a way to remove it were also violations of U.S. law, the FTC said.

The company will have to offer its removal program for another two years and will have to continue allowing customers to exchange CDs with the concealed software purchased before December 31, 2006. The company will also have to provide retailers with financial inducements to return XCP infected CDs and allow the FTC to continue to monitor its compliance with the consent decree.