Sony DRM rootkit code (#19) EULA Sony DRM rootkit code (#19) EULA

The End User License Agreement (EULA) on Mark Russinovich's Sony BMG music CD stated that:

As soon as you have agreed to be bound by the terms and conditions of the EULA, this CD will automatically install a small proprietary software program (the “SOFTWARE”) onto YOUR COMPUTER. The SOFTWARE is intended to protect the audio files embodied on the CD, and it may also facilitate your use of the DIGITAL CONTENT. Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted. However, the SOFTWARE will not be used at any time to collect any personal information from you, whether stored on YOUR COMPUTER or otherwise.

Note that the EULA does not mention that the small proprietary software program is a rootkit, that it implements system call hooking of kernel APIs, that it actively scans running processes regardless of whether or not a CD is loaded, or that it transmits play information to Sony. It also does not mention that it is extremely difficult to uninstall.

Article 5. EXCLUSION OF WARRANTIES

YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT YOU ARE INSTALLING AND USING THE LICENSED MATERIALS AT YOUR OWN SOLE RISK. THE LICENSED MATERIALS ARE PROVIDED “AS IS” AND WITHOUT WARRANTY, TERM OR CONDITION OF ANY KIND, AND SONY BMG, ITS LICENSORS AND EACH OF THEIR LICENSEES, AFFILIATES AND AUTHORIZED REPRESENTATIVES (EACH, A “SONY BMG PARTY”) EXPRESSLY DISCLAIM ALL WARRANTIES, TERMS OR CONDITIONS. EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, NON-INFRINGEMENT AND FITNESS FOR A GENERAL OR PARTICULAR PURPOSE. ... SHOULD THE LICENSED MATERIALS PROVE TO BE DEFECTIVE, YOU (AND NOT THE SONY BMG PARTY CONCERNED) AGREE TO ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING, REPAIRS OR CORRECTIONS...

This simply says that it doesn't matter what Sony did, it doesn't violate any warranties. Merchantability and Quality are especially relevant here, as the Sony DRM arguably would violate both.

Article 6. LIMITATION OF LIABILITY

NO SONY BMG PARTY SHALL BE LIABLE FOR ANY LOSS OR DAMAGE, EITHER DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL OR OTHERWISE, ARISING OUT OF THE BREACH OF ANY EXPRESS OR IMPLIED WARRANTY, TERM OR CONDITION, BREACH OF CONTRACT, NEGLIGENCE, STRICT LIABILITY MISREPRESENTATION, FAILURE OF ANY REMEDY TO ACHIEVE ITS ESSENTIAL PURPOSE OR ANY OTHER LEGAL THEORY ARISING OUT OF, OR RELATED TO, THIS EULA OR YOUR USE OF ANY OF THE LICENSED MATERIALS (SUCH DAMAGES INCLUDE, BUT ARE NOT LIMITED TO, LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, LOSS OF USE OF THE PRODUCT OR ANY ASSOCIATED EQUIPMENT, DOWN TIME AND USER’S TIME), EVEN IF THE SONY BMG PARTY CONCERNED HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN ANY CASE, THE ENTIRE LIABILITY OF THE SONY BMG PARTIES, COLLECTIVELY, UNDER THE PROVISIONS OF THIS EULA SHALL BE LIMITED TO FIVE US DOLLARS (US $5.00)...

Don't bother suing Sony, because you won't get any damages, or if you do, they will be limited to $5.00 (less than half the retail value of the CDs).

Article 9. EXPIRATION AND TERMINATION

1. The rights granted to you hereunder to use the DIGITAL CONTENT are conditioned upon your continued possession of, and your continued right under a license from SONY BMG to use, the original CD product that you purchased. In the event that you no longer possess or have the right under such license to use the original CD product, your rights hereunder to use the DIGITAL CONTENT shall expire immediately, without notice from SONY BMG.

2. Without prejudice to any other rights SONY BMG or any SONY BMG PARTY may have hereunder, the term of this EULA shall terminate immediately, without notice from SONY BMG, and all rights you may have hereunder to use the LICENSED MATERIALS shall be immediately revoked, in the event that you: (i) fail to comply with any provision of this EULA, (ii) fail to install an update of the SOFTWARE that was previously provided to you by the SONY BMG PARTIES within the time specified, or (iii) file a voluntary petition or are subject to an involuntary petition under applicable bankruptcy laws, are declared insolvent, make an assignment for the benefit of creditors, or are served with a writ of attachment , writ of execution, garnishment or other legal process pertaining to any of your assets or property.

3. Upon the expiration or termination of this EULA, you shall immediately remove all of the LICENSED MATERIALS from your personal computer system and delete or destroy them, along with any related documentation (and any copies thereof) that you may have received or otherwise may possess....

Note a couple of things here. The EULA terminates when you get rid of the CD. No problem. But then you have to remove the software. Not so easy. Sony hasn't bothered to include an uninstall facility. Indeed, it hides itself from the system and doesn't bother to register with Windows so you can remove it via the normal Add/Remove Program control panel. Instead, you have to provide Sony a bunch of information before it will tell you how to uninstall the software - and better not try it yourself. Mark's CD drive disappeared when he tried it, and he is an expert. Most of aren't. Finally:

Article 10. GOVERNING LAW AND WAIVER OF TRIAL BY JURY

1. THE VALIDITY, INTERPRETATION AND LEGAL EFFECT OF THIS EULA SHALL BE GOVERNED BY, AND CONSTRUED IN ACCORDANCE WITH, THE LAWS OF THE STATE OF NEW YORK APPLICABLE TO CONTRACTS ENTERED INTO AND PERFORMED ENTIRELY WITHIN THE STATE OF NEW YORK (WITHOUT GIVING EFFECT TO ANY CONFLICT OF LAW PRINCIPLES UNDER NEW YORK LAW). THE NEW YORK COURTS (STATE AND FEDERAL), SHALL HAVE SOLE JURISDICTION OF ANY CONTROVERSIES REGARDING THIS AGREEMENT; ANY ACTION OR OTHER PROCEEDING WHICH INVOLVES SUCH A CONTROVERSY SHALL BE BROUGHT IN THOSE COURTS IN NEW YORK COUNTY AND NOT ELSEWHERE. THE PARTIES WAIVE ANY AND ALL OBJECTIONS TO VENUE IN THOSE COURTS AND HEREBY SUBMIT TO THE JURISDICTION OF THOSE COURTS.

2. YOU HEREBY WAIVE ALL RIGHTS AND/OR ENTITLEMENT TO TRIAL BY JURY IN CONNECTION WITH ANY DISPUTE THAT ARISES OUT OF OR RELATES IN ANY WAY TO THIS EULA OR THE SOFTWARE.

This means that if you sue, you have to do it in New York and can't get a jury trial. At least they didn't try to force arbitration.

All is not lost though. Most of this will be thrown out in many states. In Colorado, for example, an attempt to move venue is void in consumer transactions.

Additionally, my view is that it may be possible to attack (and presumably eliminate) the EULA through lack of actual consent, that it is an adhesion (or forced) contract, or that it fraudulently misleads as to the conduct of the DRM code.