Sony aims at pirates - and hits users

While the Sony digital consent form mentions the DRM application, it does not specifically mention a rootkit, says Jason Schultz, a staff attorney at the Electronic Frontier Foundation, a digital rights advocacy group. Rootkits are most often pernicious, designed to protect a program from being detected by conventional antivirus programs. In fact, New York-based management software company Computer Associates classifies the Sony rootkit as a Trojan "pest," a piece of software with a hidden intent.

But as far as Sony and First 4 Internet are concerned, the controversy is much ado about nothing.

"I think this whole issue is about intent," says Mr. Gilliat-Smith. "There's no question there was no intent to create a hypothetical security breach here. We've reacted very quickly to provide a solution." Meanwhile, armies of Internet denizens have been poring over Sony's DRM code and heaping disdain on it.

"[The DRM software] hides with generic file names, and then monitors your activity - in terms of what you type on your keyboard, what e-mails you send, websites you look at, websites you run and what windows you have open on your screen," Mr. Schultz claims. The program uses this information to keep track of how many times a user has replicated a Sony media track. The protected CDs cannot be copied more than three times. After that, the program prohibits any further duplication.

"To some extent, it also 'phones home' to Sony over the Internet and uploads some of this information about your activity to them," Schultz continues, "potentially even identifying information such as your name, e-mail address and location on the Internet."

As it turns out, the way the antipiracy software is designed makes it easy to defeat. Just hold down the "shift" key when you insert a CD to play it.

"The reality is that this isn't going to stop any kind of so-called piracy," says Schultz. "All this technology does is inhibit you from making the same kind of personal, fair-use music you've always made. The real pirates are going to easily circumvent this technology. The bootleggers won't even blink."

In response to a flood of criticism, Sony and First 4 Internet reacted with information-age speed. The software patch was up and running on the Web by Nov. 2. But the patch serves only to locate the hidden software. Bloggers and computer experts are still steamed: The patch does nothing to help the user remove the rootkit, they say, and may in fact aggravate the problem.

For his part, Russinovich wonders why Sony wasn't more careful in the first place. He cites a National Public Radio interview with Sony's president of Global Digital Business, Thomas Hesse, in which he said that "most people, I think, don't even know what a rootkit is, so why should they care about it?"

"That quote nicely summarizes the problem," Russinovich says.

Page: 1 | 2