A proposed SonyBMG settlement

Just before the end of 2005, word got out that SonyBMG had put together a proposed settlement in of of the class-action suits spawned by its ill-advised copy protection measures. The EFF promptly signed on to the settlement as well. The full text is available in PDF format; the following is a summary.

The ostensible plaintiffs in this action - SonyBMG customers who installed the DRM software found on SonyBMG discs - don't get a whole lot directly. The settlement allows for XCP victims to get a non-DRM version of their discs, to download MP3 copies of the songs on the discs, the right to download one album "from a list of more than 200 titles," and the option of (1) three more album downloads or (2) a check for $7.50. People who bought MediaMax-protected discs only get one album download.

That is not a whole lot of compensation for somebody whose computer has been compromised by SonyBMG's malware. It rather differs from the hard line taken by the recording studios against those deemed to be "pirates." This result is not particularly surprising, however; class-action suits are rarely about the interests of the people named as plaintiffs. Nonetheless, there are provisions of this settlement which will benefit those plaintiffs - and many others as well. They include:

• SonyBMG agrees to immediately recall all CDs containing the XCP software. In theory, this recall has already happened, but there have been numerous reports of XCP discs remaining on store shelves.

• The company will also stop manufacturing CDs with the MediaMax DRM software - for at least two years. MediaMax is not quite as bad as XCP, but it still has "phone home" capabilities and can open up a system to security problems.

• SonyBMG will provide uninstallers for XCP and MediaMax, and a security update for MediaMax as well.

• Numerous behavioral changes are called for; SonyBMG agrees not to install software without a positive agreement, to make uninstallers available, to describe the functionality of software to the user "in plain English," to, refrain from collecting data on users, to issue patches for security problems, and to "obtain comments" on its EULAs and potential security vulnerabilities in its future DRM software. These constraints only apply through 2007, however.

Together, these terms comprise a set of rules that music distributors might be expected to play by in the future. On the good side, they call for explicit information on what DRM software does, limitations on phoning home, the availability of uninstallers, and some attention to security issues. That's a start, and more than was available before.

On the other hand, this settlement fails to address fundamental questions, such as whether it is right to force people to install software to listen to music they have purchased. Limitations on fair use, including making backup copies or putting music on a portable player, are not addressed. This settlement makes it clear that DRM software does not have complete freedom on the user's computer, but it in no way questions the correctness of that software in the first place. The entertainment industry remains free to make its DRM regime is restrictive as it likes, as long as it does not step on users' toes in other ways.

In other words, SonyBMG's original purpose for XCP - keeping its customers from putting music onto their iPods - has not been addressed. The company is free to attempt to impose the same restrictions in the future. The people behind the suit can claim a win, and the lawyers will certainly get their (currently unspecified) cut. The court will likely approve the settlement, but SonyBMG is not out of the woods yet. Various other lawsuits are still outstanding, including one in Texas which alleges spyware violations.

Why the EFF signed on to this agreement is not entirely clear; perhaps declaring victory was more important trying to fight the larger battle. It would have been nice if this case could have been used to attack the assumptions and goals behind DRM in general, rather than being satisfied with the creation of a basic DRM code of conduct. That is a battle which will have to be fought another day.

---

(Log in to post comments)