Sony BMG faces two lawsuits over anti-piracy software

AUSTIN, Texas — Sony BMG Music Entertainment's troubles over anti-piracy technology on music CDs deepened Monday as the Texas attorney general and a California digital-rights group said they were suing the company under new state anti-spyware laws.

The Texas lawsuit said the so-called XCP technology that Sony BMG had quietly included on more than 50 CD titles leaves computers vulnerable to hackers. The technology restricted to three the number of times a single disc could be copied.

The company agreed to recall the discs last week after a storm of criticism.

The Electronic Frontier Foundation filed suit in Los Angeles, saying Sony BMG needs to further publicize the recall and compensate consumers for costs associated with removing the software, an onerous process.

When XCP-enabled discs are loaded into a computer — a necessary step for transferring music to Apple Computer's iPods and other portable music players — the CD installs a program that restricts copying and makes it extremely inconvenient to transfer songs into the format used by iPods. Critics say consumers aren't adequately told what the program actually does.

Security researchers say XCP is spyware because it secretly transmits details about what music the PC is playing. Manual attempts to remove the software, which works only on Windows PCs, can disable the PC's optical drive.

Texas Attorney General Greg Abbott accused Sony BMG of surreptitiously installing spyware because XCP masks files that it installs. This "cloaking" component can leave computers vulnerable to viruses and other security problems, he said, echoing the findings of computer-security researchers.

"People buy these CDs to listen to music," Abbott said. "What they don't bargain for is the computer invasion that is unleashed by Sony BMG."

Sony has rejected the description of its technology as spyware. Officials for the label would not comment Monday, saying the company does not discuss pending litigation.

Sony BMG's Web site offers information on the XCP technology, the CDs that use it and ways consumers can mail them back, postage-free, for a replacement.

The company initially rejected the uproar over XCP as technobabble. But after security experts discovered the technology opened gaping security holes in users' computers — as did the method Sony BMG offered for removing XCP — the company agreed last week to recall the discs.

Associated Press reporter Anick Jesdanun in New York contributed to this story.