DRM this, Sony! --CNet

By Molly Wood, section editor, CNET.com
Thursday, November 3, 2005


I hope this is the week that everyone in the world finds out what a root kit is. And I hope it's a week we look back on in amazement, as we consider just how far Sony was willing to go to criminalize consumers in its efforts to preserve control over its product. Because I believe this is the week that Sony effectively declared war on the consumer, announcing what most of us had already suspected: fair use is a joke in the movie and record industry, and the companies who control mass-market content will truly stop at nothing to protect their profits.

We're not gonna take it
But let me start at the beginning. On Monday, October 31, alert users discovered that Sony BMG is using copy-protected CDs to surreptitiously install its digital rights management technology onto PCs. You don't have to be ripping the CD, either--just playing it from your CD-ROM drive triggers the installation. The software installs itself as a root kit, which is a set of tools commonly used to make certain files and processes undetectable, and they're the favored tool of crackers who are, as Wikipedia puts it, attempting to "maintain access to a system for malicious purposes." In fact, root kits are often classified alongside Trojan horses. And Mark Russinovich, who created a root-kit detection utility and was one of the first to blog about the Sony intrusion, discovered another little gem when he tried to remove the DRM drivers. It broke his computer--disabling his CD drive.

So, let's make this a bit more explicit. You buy a CD. You put the CD into your PC in order to enjoy your music. Sony grabs this opportunity to sneak into your house like a virus and set up camp, and it leaves the backdoor open so that Sony or any other enterprising intruder can follow and have the run of the place. If you try to kick Sony out, it trashes the place. And what does this software do once it's on your PC? Well, here is (via David Berlind's excellent breakdown of the issue) what Amazon's CD listing page has to say on the subject:

"This product limits your ability to make multiple digital copies of its content, and you will not be able to play this disc or make copies onto devices not listed as compatible. Content/copy protected CDs should allow limited burning, as well as ripping into secure Windows Media Audio formats for playback with most compatible media players and portable devices. In rare cases, these CDs may not be compatible with computer CD-ROM players, DVD players, game consoles, or car CD stereos, and often are not transferable to other formats like MP3."

So it's not just the black hat tactics. The DRM itself is almost unbelievably restrictive, and some have suggested that the reasoning behind it is part of Sony's ongoing war over digital music supremacy with the decidedly more supreme Apple. Here's how Engadget summarizes a recent article from Variety: "The new copy protection scheme--which makes it difficult to rip CDs and listen to them with an iPod--is designed to put pressure on Apple to open the iPod to other music services, rather than making it dependent on the iTunes Music Store for downloads." I wish I could say that was a joke, but apparently, it's not. In fact, some of the artists involved didn't give permission to Sony to use the backdoor DRM technology, and want no part of it. Amazing.

Happily, and despite the use of scary words like root kit, this story hit the Web in a big way. The PR for Sony is, shall we say, not good. By Wednesday, November 2, Sony had announced that it would, in conjunction with the company that developed this bad black hat idea in the first place (First4Internet) release a patch to antivirus companies so that hackers wouldn't, hopefully, be able to take advantage of the backdoor they just opened on your property. So, that solved the most immediate concern, but the only thing the patch does is reveal the antipiracy software. Presumably, you'd suffer the same PC-crippling effects if you tried to remove it, and Sony continues to insist, despite plenty of evidence to the contrary, that its components weren't harmful in the first place. As for the insanely draconian copy protection--it's still cheerily intact.

No, we ain't gonna take it
This is an unacceptable development in digital rights enforcement. I don't know how to put this any more clearly. Don't get me wrong--we've long since crossed the line. It's utterly absurd that we accept paying for music that will play on only one or two digital audio players, at best. It's absolutely insane that anyone ever tried to put out a CD that couldn't be ripped to a PC at all. It's a complete joke that we're sitting around anticipating the day when TiVo comes along to tell us when we have to watch a recorded show, and that it will choose when a recorded show might be deleted. I can't even believe cell phone carriers think it's OK to cripple cell phone features in order to protect their own moneymaking propositions. And Hollywood's proposed new Analog Hole legislation, which would criminalize nearly every digital video activity you can think of, is another column unto itself, and it's going to be a long one.

But this--using the tactics of criminals to invade our PCs without our knowledge and to expose us to further attack, just so you can keep us from, say, burning a mix CD and giving it to our friends--this is beyond the pale. And as many news sources are beginning to point out, there's some reason to think it might also be illegal, under the U.S. Computer Fraud and Abuse Act.

We're not gonna take it...anymore
Companies: You will never get the increasingly technology-aware, mass media-consuming populace to support your right to copy protection or digital rights management unless they are on your side. And because we are increasingly technology aware, your ever-increasing assault on not only our fair use but also our common sense will virtually guarantee that we use our God-given ingenuity to find a way around whatever bizarre restrictions you see fit to impose. Why? Not because we're dying to break the law, but because you have sold us a crappy product, and, fundamentally, because it is not our responsibility to protect your profits.

What's the solution? In the near term, for us, it's not to buy any Sony CDs, and maybe not any Sony anything. In the longer term, it's to start agitating for a rewrite of copyright law in the manner so eloquently suggested recently by Walt Mossberg of the Wall Street Journal. He suggests copyright law with actual teeth that can chomp on massive-scale piracy, but with broad exemptions for personal use, because excessive DRM is hampering innovation and alienating consumers. I couldn't put it any better. And companies? Sony? Are you really going to tell us that overhauling these outmoded rules is harder and more destructive than suing retirees over honest mistakes made by their 12-year-old grandsons? This is the path you're going to choose?

I'm truly sorry that there are, out there in the world, mass-production piracy operations that are digging into your bottom line, but you know what? I'm not one of them. Neither are most of the people who will be laboring under the nasty little flags, Trojan horses, and FairPlay/Plays For Sure doublespeak that you see fit to slap on the stuff we legitimately purchased.

And you know who's not going to labor under those restrictions? You know who's not even going to notice? The mass-production piracy operations, that's who. You know it, and I know it. So why are you engaged in this nickel-and-dime, small-time thrust-and-parry with me and my friends? Trust me, you're not going to make back the money by dropping viruses onto my PC, because my almighty dollar and I are going elsewhere--and you're probably not going to like where I end up.

Technology will march on. Technology is the reason we're in this fix in the first place, and technology will keep on giving us solutions to whatever irritating, invasive, and potentially illegal roadblocks you keep throwing in our path. And damned if we and our almighty dollars, no matter how long it takes, don't eventually win these little wars.

LOTS of embedded links in the source article.

Thanks Molly. This is a very good rant!

One comment for any Digital RESTRICTION MANAGEMENT "scheme":

Practice safe computing -- use LINUX.

I think I'll make the switch this weekend. I'm fed up with Windows, just because it supports all kinds of crap like this. And since Micro$oft is going along with this kind of stuff in their products, I'll refuse to also support them.

Stuff like this doesn't happen under Linux. And if it did, it wouldn't take much work to fix the system so it won't happen again (just modify the source and recompile).

I'm also not going to be buying ANY Sony products for a good long while, to go along with my boycott of anything involving RIAA companies.

Back in the day, I bought a Sony Walkman. To make tapes for it I bought a Sony cassette recorder. I added on a small pair of Sony speakers. When compact discs came along I bought a Sony CD player. In my kitchen there is a Sony radio under the cupboard. In the bedroom there's a Sony clock radio. The living room has a Sony VCR. At work I have a Sony disc player.

I've always liked buying Sony because you could depend on them, and they have been around a long time. You think I'm going to buy anything else with the name "Sony" on it any time soon?

Thank you your excellent site. I read all the time and have learned a lot, but have never felt the need to post, until now.

"I believe this is the week that Sony effectively declared war on the consumer"

Molly has just emerged from a five-year coma...

"it leaves the backdoor open so that Sony or any other enterprising intruder can follow"

The back door was already open. That's how Sony got in. That's how EVERYONE gets in. Blame Microsoft for that part.

"using the tactics of criminals"
Another news flash.

The problem is that if they don't know how upset we are, they'll just keep doing it. If they don't know people aren't buying their products because of what they did, it won't stop them.

I just sent the following message to Sony's music website at http://www.sonymusic.com/about/feedback.cgi

Just thought I'd drop you a note. I was just wondering how you guys could treat YOUR customers who purchase YOUR products like they were common criminals.

I will NOT buy ANY Sony product until the rootkit fiasco YOU guys brought upon yourself is finished in a satisfactory manner. This will either involve (a) You, ON YOUR OWN, replacing ANY so-called "copy-protected" CDs with legitimate ones that ANYBODY can use on ANY device designed to play audio CDs, or (b) Waiting until however many lawsuits you lose force you to do the same.

(And if it comes down to option B, then I will NEVER purchase any of your products again and urge others to do the same.)

Welcome doc-dX! Feel free to speak your mind here anytime!

Folks, I linked to SysInternals' page where Mark Russinovich first broke this story in our friends and partners link over on the left.

VERY IMPORTANT READ THIS:

Sony's "Rootkit Technology" DRM
Transcript of Episode #12

http://www.grc.com/sn/SN-012.htm

I realize that you folks don't have any control over the specific ads that show on the borders of this site, but I thought I would point out what I find to be incredible irony. As I've been browsing the "Evil Sony" articles today, the banner ad on the left side of the screen has been switching from "Get a Free Sony PSP" to "Over 90% of all PCs are infected with Spyware and Adware."

I'd laugh if I didn't have this overwhelming urge to cry. What is becoming of our world...or has it always been like this and I've just been too wrapped up in myself to notice...?

"Over 90% of all PCs are infected with Spyware and Adware" has been there forever.

As for the world, yeah, it's always been like this.

"The back door was already open. That's how Sony got in. That's how EVERYONE gets in. Blame Microsoft for that part."

Also, Microsoft back doors are not now, nor have they ever been, accidental.
I have always felt ( no I have no proof )
that Microsoft security "holes" were actually Pay-for-Access backdoors, available to the highest bidder. The hacking community is actually doing everyone a favor ( well, sort of ) by finding, and puching through them.
I would not be surprised to eventually learn the First4Internet actually has some sort of .. permission .. from Microsoft to make that Rootkit.

Yes, I am paranoid.
Doesn't mean they're not out to get me.

"The problem is that if they don't know how upset we are, they'll just keep doing it. If they don't know people aren't buying their products because of what they did, it won't stop them."

From their response to this, I don't think they CARE how upset we are.
See how they are trying to change the law stop ANY form of copying ?
It doesn't matter if we're pissed.
They'll just get the law changed.

And I get this. Force-installing software is just as bad as going into somebody else's home and altering their furnature without their permission. Heck, it's just as bad as vandalizing somebody else's property.

Excellent find TrueAudio! Thanks!

Leo LaPorte ROCKS!

Wait, didn't Congress outlaw self-installing software? Don't you have to agree to something installing on your computer?

Since Sony is going out of their way to stop me from listening to and enjoying their music products in the way I see fit, I'm only too happy to oblige them by not purchasing any of their products. Thanks Sony for making it an easy choice.

I think its legal if you inform the user and have them authorise the installation - even if you bury the notice somewhere deep inside a very long click-through licence written in legalese that would give most people a headache.

It seems that some people are at least hearing these type of posts....

The number one download at M$ seems to be the anti-spyware beta...Too bad it won't help this thing, but I love the fact that it's being seen as spyware by these folks.

And, for some unlucky users, I can almost hear their cussing moans as they undergo the process of reformatting their hard drives.

Well, I don't take delight in people's plight; but I don't mind admitting I'm secretly glad Sony screwed up. Perhaps this is part of what's needed to draw widespread public attention to the whole nefarious DRM crap. We can hope.
However, in the long run, it's always going to about what contributed-to-legislators do or don't do, I know.
(commencing facial sneer of cynicism)

I agree - it was mentioned on the BBC website. But not in broadcast news. Still, its getting closer now. It made non-technical news sources. Just needs a slightly bigger DRM scandle...

Rich Menta of MP3NewsWire thinks that
Sony might be in violation of the US
Computer Fraud And Abuse Act with their
rootkit DRM.: http://p2pnet.net/story/6865

Also, doing a search on Google for
CONTENT/COPY PROTECTED CD at
Amazon.com comes up with some 24,000
hits there. Some may be duplications,
though.

The original 'CD' that started all this mess,
by Van Zant, has gotten some 120 or so
negative reviews, most for the Sony rootkit
DRM. Some have even suggested that
the artist dump Sony (or better yet any
RIAA label).

I long ago chose to boycott Sony/BMG and
all RIAA music, but more recently, with
this DRM rootkit controversy and an
earlier bit about Sony putting a self
destruct mechanism in the Blu-Ray DVD
standard so that if an unauthorized disc
(by their standards!) were put into the
player, it would send a signal that would
overwrite the player's firmware, breaking
it. So now I'm boycotting ANYTHING Sony.

It might be illegal. If not, it should be. But what does it matter? Sony has friends in high places, and outside of the techie community this is an unknown issue. The government certinly isn't going to do anything. Perhaps if a user who lost valuable data due to this program were to sue the required publicity would be produced.

Who want's to get involved with a class action on this!!! Lets get em!!!