The Privacy Issues

Computer Associates has discovered that the XCP 2 copy protection technology created by British company First 4 Internet includes spyware, enabling the collection of information relating to content played on individual window compatible players.

Tne purpose of this information is obviously statistical but such information can also be forwarded to a third party and updates to this spyware can also enable the collection of additional information.

The Security Risks

In order to install spyware on windows compatible computers without detection, XCP 2 utilises a Rootkit program that hides files on these machines, this act resulting in files that are not easily removed by the computer's owner.

Unfortunately, the installation of this trojan program also results in vulnerabilities to viruses and other malicious programs, some of which can impede or disable computers or result in information being forwarded to another, unauthorised party. This infromation could also include confidential financial information like social insurance numbers, credit card information, etc.

Other Complications

This program's incompatibility with some Apple based technology is generally known and published on the discs themselves but Computer Associates also reports that this technology also reduces the quality of recordings compressed in the Mp3 format by adding additional information to these files when these are created.

This compatibility issue results in the inability to copy music to iPods and portable music players that are not WMA compatible, not only from the Xp2 copy protected disc but from normal compact discs from the installation of this program and on.

Solutions

There are numerous solutions to this problem to consider :

Prevent the installation of the program :
• Disable Autorun Temporarily Prior To Inserting Disc - Hold your shift key down while inserting any XCP 2 copy protected disc. This will stop the XCP 2 program from loading and installing onto your computer but it must be done every time you insert XCP 2 copy producted discs.
• Disable Autorun Permanently - The following link contains instructions on how to disable autorun on your machine but this will also disable autorun for all discs, requiring individuals to use other methods to access the content of all discs : Microsoft Article ID 126025
• Don't use XCP 2 Copy Protected Discs in windows compatible computers

Possible Fixes If you've installed the program :
• Use of the Sony-BMG's rootkit removal tool after instalation - This will address the security risk by removing the rootkit program but will not address the privacy issues and other complications mentioned above. Sony-BMG XCP 2 Site
• Uninstallation of Sony-BMG's software - This will remove the majority of Sony-BMG's software from a computer but the process must be requested from the company and will result in an inability to play the material found on XCP 2 protected discs. Computer Associates reports that the uninstaller program issued by Sony-BMG fails to remove information relating to the program in a computer's registry and may also install additional spyware. Sony-BMG XCP 2 Site
• Removal with a third party program - Several software companies have updated their spyware and virus removal programs to help in the detection and removal of XCP 2's rootkit and more, including Computer Associates (PestPatrol Eliminates the Danger of Sony's Rootkit - Learn more about XCP.Sony.Rootkit), Panda Software, Stopzilla (STOPzilla! Anti-Spyware Software), Symantec (Removal Tool - Anti-Virus 2006) and Zonelabs (www.zonelabs.com). Update your software regularily !

Spotting the XCP 2 Copy Protected Discs

It appears that the XCP 2 copy protection was mostly limited to a few releases from several labels that were previously under Sony's banner (Columbia/Columbia Legacy, Epic/Epic Legacy), the other copy protected discs from the label having been released using another technology.

XCP 2 copy protected discs are also labeled in the following manner according to the Electronic Fronteer Foundation :

• A small label on the front, top left of the jewel case with the words "Content Protected"
• Boxed information on the back of the jewel case containing compatibility information and an URL to XCP information (ex. "? cp.sonybmg.com/xcp: README.HTML")

The following Canadian releases have been determined to have copy protection by Sony-BMG (list corrected 12/01/05) :

A Static Lullaby - Faso Latido Acceptance - Phantoms Amerie - Touch Art Blakey - Drum Suit Bob Brookmeyer - Bob Brookmeyer & Friends Buddy Jewell - Times Like These Burt Bacharach - At This Time Celine Dion - On Ne Change Pas Chayanne - Cautivo Dion - The Essential Dion Earl Scruggs - I Saw The Light With Some Help From My Friends Flatt & Scruggs - Foggy Mountain Jamboree George Jones - My Very Special Guests Gerry Mulligan - Jeru Horace Silver - Silver's Blue Jane Monheit - The Season Jon Randall - Walking Among The Living Life Of Agony - Broken Valley

Mary Mary - Mary Mary Patty Loveless - Dreamin' My Dreams Pete Seeger - The Essential Pete Seeger Ray Charles - Friendship Rosanne Cash - Interiors Rosanne Cash - King's Record Shop Rosanne Cash - Seven Year Ache Shel Silverstein - The Best Of Shel Silverstein Shelly Fairchild - Ride Switchfoot - Nothing Is Sound Teena Marie - Robbery The Bad Plus - Suspicious Activity? The Coral - The Invisible Invasion The Dead 60's - The Dead 60's Van Zant - Get Right With The Man Vivian Green - Vivian Neil Diamond - 12 Songs Ricky Martin - Life

In Closing

I personally believe the implementation of this software was a monumental blunder on the part of Sony-BMG. In an attempt to protect their interests, they've made all computers exposed to this software vulnerable, including businesses whose employees installed the program.

Having recommended Celine Dion's "On Ne Change Pas" on this site, I am very disappointed with Sony-BMG. Not only for the spyware and vulnerabilities, but for their surreptitious attempt to thwart our ability to make private copies of recordings we've purchased ; A priviledge Canadians are paying for every time they purchase a blank cassette, CD-R or CD-RW via the blank audio media levy.

In response to Sony-BMG's lackluster response to consumer complaints, I will no longer add copy protected discs to my recommended recordings list and will issue warnings for the very few discs that I have added to the list in the past.

Please contact me if you encounter copy protected discs on my recommended recordings list.

UPDATE - Sony-BMG has recalled XCP protected disc in Canada and the United States and have instituted an exchange program. Consumers who have purchased these disc may now exchange their XCP protected discs for normal compact discs with an additional option to obtain MP3s of the music found on these discs. Official information on the exchange program is available on Sony-BMG's XCP Exchange Program Site.

UPDATE - Sony-BMG has encountered Windows based security issues with their Mediamax copy protection. The fifth version of this software was included on twenty three discs sold in Canada and must be updated. A list of titles, the update and uninstall instructions can be found on Sony BMG's Official site

UPDATE - Sony-BMG had decided to phase copy protection out, beginning in 2008. They are the last major label to remove this DRM from recordings.