Sony settles with FTC on rootkit fracas

30.01.2007
More than two years after a security researcher first called attention to Sony BMG's , the company reached a deal with the U.S. Federal Trade Commission over the incident, the .

In a deal that was approved by a 5-0 vote by the FTC, Sony agreed to clearly disclose limitations on consumers' use of its music CDs and promised not to collect information for marketing or install software without consumers consent, the FTC said. The company also agreed to reimburse consumers up to US$150 for computers damaged by the program, the FTC said.

The settlement marks an end to a long and embarrassing incident for the company, which began when Mark Russinovich, an expert on Windows security of WinTernals Software, now , published the results of his investigation into .

Russinovich's research uncovered a stealth program, dubbed "XCP," distributed on CDs from Sony BMG that silently installed and concealed itself on the machines of customers who played the CD. The revelation and Sony's awkward response to it -- first denying that there was any problem with the XCP program, then making halting efforts to release programs to remove XCP -- set of a chorus of criticism on blogs and in the mainstream press.

Subsequent investigation revealed that the XCP program was poorly conceived, hastily written and .

Eventually, Sony posted a software removal program for the XCP and . But the incident was a watershed, prompting discussions of the competing interests of copy protection by corporations and consumers' right to privacy.