An Open Letter to Sony-BMG

To: Andrew Lack, CEO of Sony-BMG
Cc: Rolf Schmidt-Holtz, Chairman of the Board, Sony-BMG
Cc: Howard Stringer, CEO of Sony Entertainment
Cc: Gunter Thielen, CEO of Bertelsmann AG

Dear Mr. Lack,

The Electronic Frontier Foundation (EFF) has viewed with growing concern the revelations regarding the XCP Content Protection Software and the SunnComm MediaMax software that your company has chosen to include on at least two dozen of your music CD releases. We are also concerned by your company's limited response to the concerns of your customers and the computer security community.

As has been documented by independent researcher Mark Russinovich and many others, the XCP software appears to have been designed to have many of the qualities of a "rootkit." It was written with the intent of concealing its presence and operation from the owner of the computer, and once installed, elements of the software run continuously -- even when no Sony-BMG music CD is in use. It provides no clear uninstallation option. Additionally, without notifying users, the software appears to contact a remote machine under your control. The MediaMax software is somewhat different, but similarly has no true uninstall option and an undisclosed ongoing communication from the usersí computer to SunnComm.

You must be aware that the discovery of this software has shocked and angered your customers. Software that deceives the owner of the computer it runs upon and opens that computer up to attacks by third parties may be expected to come from malicious cyber-attacks; it is certainly not expected nor acceptable to be distributed and sold to paying customers by a major music company. Accordingly, EFF welcomes your company's decision to temporarily halt manufacturing CDs with XCP and to reexamine "all aspects" of your "content protection initiative."

But if you truly intend to undo the harm you have caused, your company should immediately and publicly commit to the following additional measures:

We look forward to hearing that you are in the process of implementing these measures by 9:00am PST on Friday, November 18, 2005.

Sincerely,

Electronic Frontier Foundation