Sony BMG in copy-protection controversy

You may have read recently about a row involving Sony BMG over their use of an audio copy-protection system which covertly hides files on your hard disk. While it looks as though Sony BMG could be in a little trouble, users of our audio copy-protection offering, key2audioXS, have nothing to fear.

What's the story?
Sony BMG used a copy-protection system called XCP (developed by a company called First4Internet) on a number of their audio CD releases. XCP (or Extended Copy Protection) is a Digital Rights Management (DRM) solution which is designed to control the playback of the audio tracks on a Windows PC, forcing you to use a particular player, rather than your preferred player - Windows Media Player, for example. In this way, the ability to copy and distribute tracks from the CD or convert to MP3 can be limited and controlled.

OK, so where's the controversy?
The problem is the way in which the XCP system takes control of your computer. In order to listen to the audio tracks on your Windows PC you have to agree to use the supplied player software. On installation of the player, files used by the XCP system are covertly installed deep inside the operating system, so altering your computer without your knowledge or permission.

Can't you just remove the files?
No, because even if you know the files are there, you can't find them as they've been 'cloaked' using a rootkit.

What is a rootkit?
It's a technology, usually used by malware, to hide files away from scanners and other security software. In this instance the rootkit is being used to hide the XCP files from detection and removal, and now that it has been discovered, it is expected that new viruses will be released that will exploit it.

Why could Sony BMG be in trouble?

Legal experts believe that by installing unauthorised software, the company is open to prosecution under the Computer Misuse Act.

Are key2audioXS copy protected CDs 'safe'?
Yes, the key2audioXS does not install any rootkit on the user's PC and therefore does not leave the computer open to damaging attacks from the internet.


See also:
> Search on BBC website for Sony BMG/XCP news items
> Mark Russinovich's blog on discovering the rootkit
> Sony BMG response to the XCP situation

November 2005