What's on that music CD, anyway?

Bob Sullivan Technology correspondent • Profile • E-mail

WASHINGTON - There might be more on your music CDs than you think. 

Lurking on some music disks is the recording industry's latest attempt to stem the tide of music piracy -- software that limits the number of times music CDs can be copied.

The special software has been in use for some time on select CDs.  But last week, a security researcher unmasked one such program clumsily hidden on some music fans’ computers after they listened to CDs produced by Sony BMG, the world's second largest music label. 

Sony BMG has taken a pounding ever since: From bloggers, security firms, class-action lawyers threatening lawsuits, even international digital rights organizations. Online gamers figured out a way to use the software's unique cloaking technology to cheat each other; computer hackers released viruses that attacked PCs, hiding behind the software.

Finally, on Friday, Sony announced it would suspend production of CDs with the technology.

But the disclosure and the controversy have opened anew some basic questions: Whose PC is it? Whose music is it?  And it reminded music lovers and computer experts that the recording industry isn't stopping the piracy fight with successful shutdowns of file-swapping sites like Grokster.  The battle is hitting close to home.

The dust-up
Nine months ago, Sony began deploying copy-limiting software on about 20 albums. Anyone who dropped one of these CDs into a PC was forced to install a special music player to hear the tunes. But with that software came another program designed to silently watch the user for illicit CD copying.  The program, produced by UK firm First 4 Internet Ltd., went unnoticed for months -- in part because it employed a special cloaking technology that made it invisible to most users. 

But Internet security specialist Mark Russinovich outed the software while inspecting a recent CD purchase, Get Right with the Man by Van Zant.  Russinovich says Sony’s software was sneaky, and it was being installed without consumers' knowledge. The program secretly consumes processor time, and thanks to its constant anti-piracy vigilance, it even prevents a computer from entering power-saving “sleep” mode.

“It was totally hidden,” Russinovich said.  “You are paying a price, but you don't know it.”

What's worse, Russinovich found that the method First 4 Internet used to hide the program could also be used by hackers to hide other programs on PCs.  The computer security world erupted with complaints; Sony backtracked a bit, announcing it would release a fix for the program that un-cloaked it.  But what about users who just don't want the software on their PCs?  They have to fill out an "application" to uninstall it, according to First 4 CEO Mathew Gilliat-Smith.

Computer Associates Consumers who want to remove First 4 Internet's copy protection software must first provide some personal information.

And removing the software has consequences, including preventing a user from playing the CD on their PC.

“This is totally unacceptable. It’s crossing the line of what companies should do,” said Richard Smith, a computer security expert.  “Most people who buy an audio CD would never dream they’re getting software like this.”

The Electronic Frontier Foundation published a list of the affected music CD's on its Web site. Titles include Neil Diamond's 12 Songs and Celine Dion's On ne Change Pas.

Internet bloggers and computer security firms quickly piled on, attacking Sony’s program and  response.  But digital rights expert Eric Goldman, who says he has mixed feelings about copy protection software, says Sony may have been treated a bit unfairly. 

“Some of the public beating of Sony can be attributed to pent-up frustration with digital rights management,” he said.  People who don’t like CD copy-limiting software are using this incident as their big opportunity, he said.

Is all copy protection bad?
And, after all, First 4 software is hardly the first copy-limiting program in use. In fact, it's a bit player among Sony BMG albums.  Similar copy-limiting software authored by Arizona-based SunnComm Technologies Inc. called MediaMax came loaded on a No. 1 hit album last year by Velvet Revolver, ironically titled Contraband.

That software is now on about 20 million Sony BMG music discs, said SunnComm CEO Peter Jacobs.  Most can be copied 3 or 4 times before the software stops the consumer, he said.

Jacobs says people just have to get used to music CDs behaving like software CDs.  Consumers now expect to enter some kind of key or serial number when installing software.  These prevent a consumer from stealing by passing the CD around to friends.  Music CD copy protection programs have a similar effect.

As with software, Jacobs argued, music fans don’t own the music they buy, they merely have purchased a license to use it.

“You agree to a set of conditions (when you buy it),” he said.  “There’s a sticker on the outside of the CD that says it's copy protected, and comes with some limitations on how many times it can be copied."

While the tools might not be perfect, they are a step in the attempt to at least slow down would-be music pirates, said Sony’s John McKay. 

"There are incredibly high levels of music piracy," McKay said.  "Sony has created a series of speedbumps to piracy."

Even Sony's detractors say the company has a right to try to reign in piracy.  Princeton University doctoral candidate J. Alex Halderman published a paper two years ago with trivial instructions – essentially, holding down the shift key while inserting the CD -- for defeating an earlier SunnComm anti-copying program.  SunnComm threatened to sue him but eventually backed off.

But Halderman concedes companies like Sony are in a tough spot.

“I am very sympathetic to the desire not to have copyrights infringed,” he said.  “But in this case, the solution they are trying to apply is creating new problems.”

MORE FROM SECURITY

Security Section Front

Facebook to overhaul privacy structure Avoid flirty patients on Facebook, doctors told ‘Black screen of death’ for some Windows users Red Tape: Will piracy crackdown bring iPod border checks? Internet activists push for greater democracy EU assembly adopts Internet, phone user rights 'Mr. Right' grifts widow's $50K in Web scam U.K. cops arrest people ‘just for the DNA’ Virus attacks ‘jail broken’ iPhones China attacks ‘biased’ U.S. cyber-spying report Security Section Front   Add Security headlines to your news reader: