decoration decoration
Stories

GROKLAW
When you want to know more...
decoration
For layout only
Home
Archives
Site Map
Search
About Groklaw
Awards
Legal Research
Timelines
ApplevSamsung
ApplevSamsung p.2
ArchiveExplorer
Autozone
Bilski
Cases
Cast: Lawyers
Comes v. MS
Contracts/Documents
Courts
DRM
Gordon v MS
GPL
Grokdoc
HTML How To
IPI v RH
IV v. Google
Legal Docs
Lodsys
MS Litigations
MSvB&N
News Picks
Novell v. MS
Novell-MS Deal
ODF/OOXML
OOXML Appeals
OraclevGoogle
Patents
ProjectMonterey
Psystar
Quote Database
Red Hat v SCO
Salus Book
SCEA v Hotz
SCO Appeals
SCO Bankruptcy
SCO Financials
SCO Overview
SCO v IBM
SCO v Novell
SCO:Soup2Nuts
SCOsource
Sean Daly
Software Patents
Switch to Linux
Transcripts
Unix Books
Your contributions keep Groklaw going.
To donate to Groklaw 2.0:

Groklaw Gear

Click here to send an email to the editor of this weblog.


To read comments to this article, go here
EFF's Sony Complaint - as text
Wednesday, November 23 2005 @ 08:31 PM EST

Here's the California class action Complaint against Sony filed by EFF, as text, thanks to BilltheCat. This is not an official EFF transcript, of course, although they are certainly free to use it. Any mistakes belong to us at Groklaw. If you see any, let me know, and we'll aim for perfection.

It looks like this isn't the last of the lawsuits Sony is going to face, either. I hear on the grapevine that a law firm in Canada is researching the matter and looking for people who live there and who bought one of these CDs. I don't doubt there will be many more.

The EFF complaint asks that Sony BMG be required to fix the damage to victims' computers, and it says the EULA is unconscionable, listing specific things the Plaintiffs allege are unconscionable in the EULA that accompanies both XCP and MediaMax. When you read the list, I think you will agree it's hard to argue with EFF that this list is anything a reasonable man would agree to without duress, and as you read them, ask yourself: What do they have to do with copyright rights?

Here's the list:

104. Sony BMG has inserted several unconscionable provisions EULA that accompanies the XCP and MediaMax CDs. These provisions include:
a. Restrictions on the user's ability to use the digital content on the CD in the event that that consumer chose to leave the United States;

b. Restrictions on resale and transfer of the digital content on the CDs;

c. Restrictions on user's ability to use the digital content on the CDs at work;

d. Restrictions on user's ability to use and retain lawfully-made copies of the digital content on the CDs in the event that the original CD is stolen or lost;

e. Restrictions on user's ability to use the digital content on the CDs following a bankruptcy;

f. Conditioning the user's continued use of the digital content on the CDs on acceptance of all Sony BMG software updates;

g. A purported $5.00 limit on Sony BMG's entire liability to the purchaser of the CDs;

h. Restrictions on user's ability to examine and test his or her computer to understand and attempt to prevent the damage cause by the rootkit;

i. A reservation of rights by Sony BMG to use "technological "self-help" measures against the computers of users who desire to make use of the digital content on the CDs "at any time, without notice to [the user]."

j. Restrictions on the user's ability to seek redress in California courts, under California law, and the purchaser's ability to seek a trial by jury;

k. A disclaimer of all warranties, including implied warranties of merchantability, satisfactory quality, noninfringement, and fitness for any particular purpose.

It makes your blood boil to read this list, doesn't it? Forget for a minute all the secretive things they did to customers behind their backs and without notice or explanation. Look at what they told them to their face. This isn't enforcement of copyright rights. Copyright law doesn't forbid you to take a copyrighted book with you to Europe, for example, nor must you turn it in if you go bankrupt. What lawyer thought that one up? And why?

Note that there are several typos in the document, which is not surprising when you consider how quickly this was drawn up, so before you let me know of any corrections, can you please check the original first? Also, there are references to exhibits, and I'm working on them. I will put them here when ready, so you can swing back by later if you are particularly interested in the EULA.

While we are on the subject of the EFF, they have begun a campaign to support bloggers, which is a subject dear to my heart. They ask for financial support, so they can continue to do what they do, and there is a graphic you can place on your website directing the public's attention to the campaign. I have placed one on Groklaw. Here's a snip from EFF's website:

Here at EFF, we're fighting hard for bloggers' rights. We've created the Legal Guide for Bloggers, we're litigating the reporter's privilege for online journalists and we are working hard to defend bloggers' rights to free expression, political speech, and anonymity, just to name a few.

But we need your help to spread the word, grow our membership and keep fighting. So we're launching a special membership campaign specifically for bloggers. We've created a button for you to put in a permanent space on your blog that declares your support for bloggers' rights, and for the work EFF does to support them. The button links to our Bloggers' rights campaign, http://www.eff.org/bloggers/join/

Here's the Legal Guide for Bloggers and their How to Blog Safely. For an international flavor, try also Reporters Without Borders. They have a guidebook called Handbook for Bloggers and Cyber-Dissidents.

As you know, I believe strongly in the right of anonymous speech. And I'm familiar with unfair retaliation against bloggers. So I'm delighted that EFF views this as something vitally important and worth fighting for. Litigation is very expensive. Aren't you shocked to see how much SCO, for example, has paid in legal fees? Well, it's expensive for EFF to do it too.

*******************************

Robert S. Green (State Bar No. 136183)
Jenelle Welling (State Bar No. 209480)
Avin P. Sharma (State Bar No. 233328)
[address, phone, fax]

Cindy Cohn (State Bar No. 145997)
Fred von Lohmann (State Bar No. 192657)
Kurt Opsahl (State Bar No. 191303)
Corynne McSherry (State Bar No. 221504)
ELECTRONIC FRONTIER FOUNDATION
[address, phone, fax]

Reed R. Kathrein (State Bar No. 139304)
Shana Scarlett (State Bar No. 217895)
LERACH COUGHLIN STOIA GELLER
RUDMAN & ROBBINS LLP

[address, phone, fax]

Attorneys for Plaintiffs

_________________________________

SUPERIOR COURT OF THE STATE OF CALIFORNIA
COUNTY OF LOS ANGELES

ROBERT HULL, JOSEPH HALPIN and
EDWIN BONNER, on behalf of themselves
and all others similarly situated

Plaintiffs,

v.

SONY BMG MUSIC ENTERTAINMENT
CORP., SONY CORPORATION OF
AMERICA, and BERTELSMANN, INC.

Defendants.

CLASS ACTION COMPLAINT

JURY TRIAL DEMANDED

___________________________

Plaintiffs, by and through their attorneys, bring this action on behalf of themselves and all others similarly situated, and allege against Defendants as follows:

INTRODUCTION

1. By including a flawed and overreaching computer program in over 20 million music CDs sold to the general public, including California residents, Sony BMG has created serious security, privacy and consumer protection problems that have damaged Plaintiffs and thousands of other Califomians. At issue are two software technologies -- MediaMax and Extended Copy Protection, also known as XCP -- which defendant Sony BMG claims to have placed on the music CDs to restrict consumer use of the music on the CDs but which in truth do much more, including monitoring customer listening of the CDs and installing undisclosed and in some cases hidden files on users' computers that can expose users to malicious attacks by third parties, all without appropriate notice and consent from purchasers. The CDs also condition use of the music on unconscionable licensing terms. These, plus other problems caused by Sony BMG's inclusion of this software, are in violation of California law and public policy. After a series of embarrassing public revelations about security risks associated with the XCP software, including warnings issued by the United States Government, Microsoft and leading anti-virus companies, defendant Sony BMG has taken some steps to respond to the security risks created by the XCP technology. It has failed, however, to address security concerns raised by the MediaMax software or the consumer privacy and consumer fairness problems created by both technologies.

JURISDICTION AND VENUE

2. The jurisdiction of this Court arises under Code of Civil Procedure § 410.10 because Defendants conduct business in and sell a substantial number of audio compact discs in the State of California. This Court has subject matter jurisdiction over this Class and the representative action pursuant to Bus. & Prof. Code, § 17200, et seq. ("UCL"); Bus. & Prof. Code § 17500, et seq.; Civ. Code § 1750, et. seq.; Code of Civil Procedure § 382; and other provisions of the California Codes.

3. Venue is proper in this County pursuant to Code of Civil Procedure, § 395.5, Civil Code, § 1780(c), Bus. & Prof. Codes, §§ 17202 and 17203, because Sony BMG conducts substantial business within this County.

2

PARTIES

4. At all times mentioned herein. Plaintiff Robert Hull was, and still is, an individual and resident of Chatsworth, California.

5. At all times mentioned herein. Plaintiff Joseph Halpin was, and still is, an individual and resident of Sebastopol, California.

6. At all times mentioned herein, Plaintiff Edwin Bonner was, and still is, an individual and resident of La Jolla, California.

7. At all times mentioned herein, Defendant Sony BMG Music Entertainment ("Sony BMG"), is and at all relevant times was, a Delaware General Partnership, with its principal place of business in New York, New York. Sony BMG maintains an office in California.

8. Defendant Sony Corporation of America is the U.S. subsidiary of Sony Corporation, a multinational corporation based in Japan. At all times mentioned herein, Defendant Sony Corporation of America, is and at all relevant times was, a New York corporation, with its principal place of business in New York, New York.

9. Defendant Bertelsmann, Inc. is the U.S. subsidiary of Bertelsmann AG, a multinational corporation based in Germany. At all times mentioned herein, Defendant Bertelsmann, Inc., is a Delaware Corporation with its principal place of business in New York, New York.

FACTUAL ALLEGATIONS COMMON TO ALL CLAIMS

10. In August 2004, Sony Corporation merged its Sony Music Entertainment, Inc. with Bertelsmann AG's BMG to create a joint venture, Sony BMG. Sony Corporation of America and Bertelsmann AG are the parent companies, respectively, of Sony Music Entertainment and BMG.

11. Sony BMG is the world's second largest music company. Its labels include Arista Records, Columbia Records, Epic Records, J Records, Jive Records, LaFace Records, Legacy Recordings, Provident Music Group, RCA Records, RCA Victor Group, RLG - Nashville, SONY BMG Masterworks, Sony Music Nashville, Sony Urban Music, Sony Wonder, So So Def

3

Records, and Verity Records. Sony BMG manufactures, distributes, markets, and sells audio compact discs ("CDs").

12. In 2003, Sony BMG began to distribute CDs that contain software that Sony BMG refers to as Digital Rights Management ("DRM") to the public. This DRM software on the Sony BMG CDs includes MediaMax created by SunnComm ("MediaMax CDs") and Extended Copy Protection ("XCP") created by First4Intemet ("XCP CDs"). On information and belief, Sony BMG intended that most of its CDs sold in the United States would incorporate one of these technologies.

13. Sony BMG is the first company to commercially deploy XCP.

14. On information and belief, Sony BMG has been using versions of XCP since 2002 on prerelease CDs sent to radio stations and internal employees.

15. On information and belief, Sony BMG and BMG have been using MediaMax on some CDs since at least 2003. On information and belief, Sony BMG currently uses MediaMax 5 on its MediaMax CDs.

16. Since March 2005, Sony BMG has distributed at least 52 music titles with XCP software. On information and belief, Sony BMG has shipped at least 4.7 million CD's containing the XCP software, of which 2.1 million have been sold.

17. Sony BMG has also distributed many more music titles with MediaMax software -- including a number one hit CD last year by Velvet Revolver, entitled Contraband. On information and belief, Sony BMG has distributed at least 20 million CDs with MediaMax software.

18. In a November 11, 2005, MSNBC.com article, by Bob Sullivan, Sunncomm CEO Peter Jacobs states that MediaMax is "now on about 20 million Sony BMG music discs."

THE SUNNCOMM SOFTWARE IS UNDISCLOSED SPYWARE AND COMPROMISES SECURITY

19. The Anti-Spyware Coalition ("ASC") describes spyware as technologies deployed without appropriate user consent and/or implemented in ways that impair user control over: (1) material changes that affect a user's experience, privacy, or system security; (2) use of the

4

user's system resources, including what programs are installed on the user's computer; and/or (3) collection, use, and distribution of a user's personal or other sensitive information. Computer Associates defines spyware as "Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior." As discussed below, the MediaMax software used by Sony BMG on many of its CDs meets the ASC's definition of spyware.

20. MediaMax installs without meaningful consent or notification. When a MediaMax CD is inserted into a computer running Windows, MediaMax installs, prior to the appearance of the End User License Agreement ("EULA"), approximately eighteen files that consume approximately 15 MB on the user's hard drive. These files remain installed even if the user declines the EULA presented later. One of them, a kernel-level driver with the cryptic name "sbcphid," is both installed and launched. The "kernel" is the core of a computer operating system, which controls and secures access to the computer's basic operations.

21. This kernel-level driver is the heart of the MediaMax copy protection system. When it is running, it attempts to block CD ripping and copying applications from reading the audio tracks on MediaMax CDs. The software refrains from making one final change until after users accept the license—it does not set the driver to automatically run again every time Windows starts. Nevertheless, the code keeps running until the computer is restarted and remains on the hard disk indefinitely, even if the agreement is declined.

22. Only after these files are installed and at least one has launched does the software display a EULA, which the user may accept or decline, making it a contract of adhesion. Even if the EULA is declined, however, the software already installed prior to presentation of the EULA remains on the user's computer.

23. The MediaMax CDs' EULA states: "As soon as you have agreed to be bound by the terms and conditions of the EULA, this CD will automatically install a small proprietary software program (the "SOFTWARE") onto YOUR COMPUTER. The SOFTWARE is intended to protect the audio files embodied on the CD, and it may also facilitate your use of the DIGITAL CONTENT. Once installed, the SOFTWARE will reside on YOUR COMPUTER

5

until removed or deleted." This statement is not true, since by the time this message is displayed, over eighteen files are already installed and, as noted above, those files remain on the hard disk indefinitely, even if the agreement is declined. Attached hereto as Exhibit A and incorporated herein by reference is a true and correct copy of the MediaMax EULA.

24. Sony BMG's MediaMax CD EULA states that "[T]he SOFTWARE will not be used at any time to collect any personal information from you, whether stored on YOUR COMPUTER or otherwise."

25. If purchasers seek more information about the software that has been installed on their computer, they are directed to the SunnComm Sony BMG customer care website, which falsely tells users that "No information is ever collected about you or your computer without you consenting" and also states: "Is any personal information collected from my computer during the digital key delivery process? No, during the digital key delivery process, no information is ever collected about you or your computer."

26. Despite the representations to the contrary in the EULA and the SunnComm website, and without notification or consent of the user, the MediaMax software "phones home" to SunnComm every time a user plays a protected CD. The software causes the computer to connect to a Sony BMG and/or SunnComm server via the internet. The MediaMax software conveys a unique code that identifies the album to which the user is listening. The request also contains standard HTTP headers from which can be used to determine what operating system the user is running and what version of the Internet Explorer web browser the user has.

27. On information and belief, prior versions of the MediaMax software still used on some Sony BMG CDs contact Sony BMG and/or SunnComm to obtain "digital keys" that permitted the CDs to be copied.

28. The SunnComm Sony BMG customer care website also does not have a visible privacy policy.

29. The Media Max software connects to an online service at http ://license. sunncomm2 .corn/, which does not have a visible privacy policy.

30. The MediaMax software opens a web page from a Sony BMG and/or SunnComm

6

server and sends a 32-character identifier through an HTTP request. On information and belief, this is a unique code that tells Sony BMG and/or SunnComm to which album the user is listening. The request also contains standard HTTP headers that can be used to determine the user's operating system.

31. The server to which the MediaMax software connects returns an HTTP response to the MediaMax software. On information and belief, this response is intended to facilitate the placement of dynamic, interactive advertisements that can be changed at any time by Sony BMG and/or SunnComm.

32. The MediaMax software also transmits the user's computer's Internet Protocol or "IP" address to servers controlled by Sony BMG or its agents, without receiving permission from the computer user. No two IP addresses are alike and IP addresses provide the means to determine information about the person who used the particular IP address. Users are assigned an IP address by their Internet service provider or system administrator. Many users are issued frequently changing "dynamic" IP addresses that make it difficult to track them individually, but others have fixed, "static" addresses that can permit Sony BMG to ascertain their identities and associate listening habits with particular individuals across many different CDs containing the Sunncomm software.

33. The Sunncomm MediaMax support website (http://tickets.sunncomm.com/selfhelp/), also misleadingly states, "Please note that MediaMax was designed to manage and safeguard the copyrights of specified artists' CDs while giving you an enhanced visual and listening experience. It does not interfere with or impact any of the normal operations and/or functions of your computer." (emphasis in the original). As described above, this statement is false.

34. Sony BMG fails to disclose, prior to purchase, that users running the MediaMax CDs on Windows-based computers could have filed downloaded and stored on their computers without their consent, and failed to disclose that the software would transmit information about user, including monitoring whenever users listen to the CDs, without notification to or consent of the users.

7

SUNNCOMM'S MEDIAMAX UNINSTALLER CREATED A GREATER SECURITY
RISK AND VIOLATED USER'S PRIVACY

35. On information and belief, none of the MediaMax CDs from Sony BMG contains an uninstaller.

36. Upon request, SunnComm will provide an internet-based uninstaller for the MediaMax software. On information and belief, SunnComm provides this uninstaller only after repeated requests that require the disclosure of personally identifying information.

37. The uninstaller suffers from a design flaw. When a user visits the SunnComm uninstaller web page, the user is prompted to accept a small software component—an ActiveX control called "AxWebRemoveCtrl" created by SunnComm.

38. This ActiveX control is designed so that any web page can ask it to download and executing code from an arbitrary website location or URL.

39. If a user visits a malicious website, the site can use the flawed ActiveX control to download, install, and run malicious or dangerous software code on the user's computer without the user's knowledge or consent. Such code could severely damage a user's computer, including but not limited to erasing a user's hard disk.

40. The uninstaller fails to remove the vulnerable ActiveX control from the user's computer following completion of the uninstallation process.

41. Sony BMG fails to disclose the security risks created by the MediaMax software and the MediaMax uninstaller, and their potential harm to a user's computer.

42. Therefore, users who hope to prevent and/or limit security and privacy risks must rely on the research and publication efforts of independent security experts and consumer advocates.

43. On information and belief, the MediaMax software causes additional damage to users' computers.

8

THE XCP SOFTWARE IS UNDISCLOSED SPYWARE AND COMPROMISES SECURITY

44. Sony BMG's actions and omissions with respect to the MediaMax software are part of a pattern of corporate failure to investigate, address, and disclose the security and privacy risks associated with its inclusion of so-called DRM software on music CDs.

45. Similar and, in some respects, more serious risks have been identified in CDs loaded with another Sony BMG technology. Extended Copy Protection, or XCP. As with the MediaMax software, these risks have been disclosed by independent researchers and consumer advocates, rather than Sony BMG.

46. The software on a Sony BMG XCP CD is designed to operate only on Windows-based computers that run Windows 98SE/NT/2000/XP.

47. When a computer user places the Sony BMG XCP CD in a Windows based computer, the software is designed such that the user is first required to agree to a EULA. According to the EULA, a user cannot utilize the audio files or the digital content of the CD on the computer unless the user agrees to the EULA making it a contract of adhesion. Attached hereto as Exhibit B and incorporated herein by reference is a true and correct copy of the XCP EULA.

48. The user is then told that the XCP software automatically installs player software into the user's computer that will allow the user to play, save and copy the audio files on the CD.

49. According to the EULA, the software automatically installed by the XCP CD is intended to protect the "digital content" embodied on the XCP CD. Digital content appears to include audio files converted into digital music files as well as unspecified other "already existing digital content."

50. While the user is led to believe that Sony BMG's XCP software is installing the player software into the user's computer, it is actually installing software as a "rootkit" into the user's hard drive. The Sony BMG XCP software also installs a CD drive filter driver that intercepts calls to the computer's CD drive.

9

51. A rootkit is used to hide login, processes, files, and logs and may include software to intercept data from terminals, network connections, CD drives, and keyboards. A rootkit is invisible to the operating system and antivirus and security software, and is frequently used by unauthorized third-parties, after gaining access to a computer system, to hide their activities.

52. Specifically, the Sony BMG rootkit is a system filter driver which intercepts all calls for process, directory or registry listings, and then modifies what information is visible to the operating system in order to hide every file, process, or registry key beginning with the characters "$sys$."

53. Unbeknownst to users, once the rootkit is installed by the software on a Sony BMG CD, the rootkit degrades the performance of the user's computer.

54. In a November 1, 2005, eweek.com article by Paul Roberts, computer security analyst Mark Russinovich states that the rootkit files interact with the Windows operating system at a very low level and fail to account for certain conditions that could cause the files to overwrite areas of memory, crashing applications that use that memory, or even crashing the entire Windows operating system. On information and belief, this article correctly illustrates some of the damage the rootkit could do.

55. The rootkit causes significant and cumulative injury to a user's computer. Specifically, the rootkit can interfere with the computer's CD drive, file copying software, and media players. The rootkit also uses up system memory that would otherwise be available.

56. On or around November 4, 2005, on National Public Radio's "Morning Edition" program, Thomas Hesse, President of Sony BMG's global digital business division, when asked about the XCP controversy, responded "Most people, I think, don't even know what a rootkit is, so why should they care about it?" In the same program, Mr. Hesse also denied that Sony BMG's software communicated with Sony BMG, saying "No information ever gets gathered about the users' behavior, no information ever gets communicated back to the user, this is purely about restricting the ability to bum MP3 files in an unprotected manner."

57. Sony BMG failed to disclose that the XCP software, in the rootkit, automatically connects the user's computer via the internet to a server owned or operated by Sony BMG or its

10

affiliates, without the user's consent. Once a user's computer is connected to the Sony BMG website, the software sends an identification code associated with each XCP CD that is played on that computer to the Sony BMG website. The Sony BMG server then automatically checks for updates to the album art and lyrics for that album. This process uses the bandwidth that would otherwise be available to the user's computer for other tasks.

58. As with the MediaMax software, this network connection provides Sony BMG with the ability to record each time a CD with XCP software is played and the IP address of the computer playing it, without receiving permission from the computer user. As discussed above, no two IP addresses are alike and IP addresses provide the means to determine information about the person who used the particular IP address. Sony BMG does not disclose the possibility of this use of DRM software in its packaging, the installation process, or its EULA. Instead the EULA states, "the SOFTWARE will not be used at any time to collect any personal information from you, whether stored on YOUR COMPUTER or otherwise."

59. The Anti-Spyware Coalition and computer security firm Computer Associates identify Sony BMG's XCP software as "Spyware."

60. Sony BMG's XCP software meets the ASC standards for spyware because the rootkit is placed on the computer without the user's consent and it changes the user's system security because the rootkit makes the user's computer more vulnerable to other types of malware.

61. Computer Associates has classified the Sony BMG XCP rootkit as a form of spyware known as a "Trojan," noting that the "XCP Sony Rootkit modifies you[r] operating system at a low level, represents a large threat to both corporate and consumer users system integrity." Computer Associates also has noted that "[t]he Rootkit functionality hides files and enables hackers and other spyware to hide files with impunity."

62. Computer Associates has categorized Sony BMG's "Media Player" as spyware, noting that "When launched from the CD, Music Player sends information back to Sony BMG, indicating which album is being played."

63. Once the rootkit is on a user's computer, it creates an undisclosed risk of security

11

breach to that computer because other malicious software, such as computer viruses, worms, and spyware that enter the computer could exploit the software concealed by the rootkit.

64. Malicious software coders have discovered that they can effectively render their programs invisible by using names for computer files similar to ones cloaked by the Sony BMG technology. On information and belief, several malicious programs that exploit the XCP technology's ability to avoid detection have already been distributed over the internet. Further, as stated above, XCP software transmits information about the user's computer, IP address, and listening habits.

65. On or around November 12, 2005, Microsoft, Inc., the maker of the Windows operating system stated that "Rootkits have a clearly negative impact on not only the security, but also the reliability and performance of their systems" and Microsoft's Anti-Malware Engineering Team informed consumers that "in order to help protect our customers we will add a detection and removal signature for the rootkit component of the XCP software."

66. The nature of a rootkit makes it extremely difficult for a computer user to remove, often leaving reformatting the entire hard drive as the only solution. Reformatting a hard drive requires backing up all data on the hard drive, as reformatting a hard drive deletes all data on the hard drive. The user is then required to re-install the operating system and all applicable programs and drivers. This process can take many hours and is beyond the technical capabilities of many users. Sony BMG's XCP CD EULA and install process do not disclose nor does the CDs' software prompt users with information about the rootkit or the need to reformat the hard drive in order to remove it.

67. In response to the public outcry about the deceptive nature of Sony BMG XCP CDs, Sony BMG made available a software patch. The patch was only available on the Sony BMG support site (http://cp.sonybmg.com/xcp/english/home.html). The patch does not remove the software or allow the user to remove the software. The software patch merely makes the software visible to system tools and antivirus software while installing an additional 3.5 MB of updated versions of the software into the user's computer. Additionally, the patch contains a design flaw that could cause a computer to crash as it is installed.

12

68. Sony BMG failed to disclose that if a user attempts to disable the software it will likely disable the audio CD driver on the computer, rendering the user's CD drive inoperable. If the rootkit is removed manually, the Sony BMG software's changes to the user's system will render the user's CD drive non-functional. According to computer security firm Computer Associates, "[reconfiguring the CD-ROM driver to a functioning state will be beyond the ability of the average home user."

69. Computer Associates categorized Sony BMG's patch as a "Trojan" and noted that the Sony BMG software, even when patched with Sony BMG's update, continues to "represent a threat to the user's control over their system ...."

70. The United States Computer Emergency Readiness Team (US-CERT), part of the Department of Homeland Security that is charged with the task of "protecting the nation's Internet infrastructure" by coordinating "defense against and responses to cyber attacks across the nation" has stated that the XCP rootkit "can pose a security threat" and that "one of the uninstallation options provided by Sony BMG also introduces vulnerabilities to a system."

71. Installation of a rootkit on a computer undermines the security of that computer.

72. Installation of a rootkit on a computer causes impairment to the integrity or availability of data, a program, a system or information.

73. The software installed by Sony BMG includes a set of computer instructions that are designed to modify, damage, destroy, record, and/or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information.

74. On information and belief, the XCP software causes additional damage to users' computers.

SONY BMG'S FIRST XCP UNINSTALLER CREATED A GREATER SECURITY RISK AND VIOLATED USER'S PRIVACY

75. On information and belief, the only way for typical users to safely uninstall the software is to obtain an uninstaller from Sony BMG. Until approximately November 15, 2005,

13

in order to obtain an uninstaller from Sony BMG, a user was required to navigate an extensive request process and disclose more personal information to Sony BMG. First, the user was required to go to the Sony BMG support website and fill out a form stating: a country where the CD was purchased; the artist's name; the album title; the store name; and the user's e-mail address. After submitting the form, the user was directed to a website which states that the user that the user will receive an e-mail with a "Case ID." Next, the user received an e-mail that directed the user to install the patch and then visit another website if the user still wanted to uninstall the DRM software.

76. This further website, available until November 15, 2005, required the user to install ActiveX control software. The user was then required to enter the Case ID and fill in the reasons for the request. Once the user submitted this information, the user receives an email that notifies the user that a customer service representative would email the uninstall instructions to the user within a business day. The user then received an e-mail with a link to a confidentiality notice, which had to be accepted before software could be uninstalled.

77. Sony BMG states that the information collected by Sony BMG before providing the uninstaller is subject to its Privacy Policy, http://www.sonybmg.com/privacypolicy.html. The Sony BMG Privacy Policy states, inter alia, that Sony BMG "may share the information we collect from you with our affiliates or send you e-mail promotions and special offers from reputable third parties in whose products and services we think you may have an interest. We may also share your information with reputable third-parties who may contact you directly."

78. On information and belief, if the Sony BMG software was uninstalled using the uninstaller available until November 15, 2005, the user was no longer able to receive the full use and value of the XCP CD on his or her computer. Therefore, Sony BMG required the user to either accept the malicious software or lose the full use and value of the XCP CD. Sony BMG did not disclose this fact to users prior to purchase.

79. The Sony BMG software could not be uninstalled if the user proceeded to the link from a different computer than the one on which the user installed the ActiveX control software. If the user is not at that same computer he or she will receive an error message. The

14

uninstall link contains the Case ID in the address, so when the user proceeds to the uninstall link, the ActiveX control software sends the sends a Sony BMG website an encrypted block of data. This encrypted data is a signature that is tied to the hardware configuration of the user's computer.

80. On information and belief, the ActiveX uninstaller leaves behind numerous software methods that can be exploited by others.

81. The ActiveX uninstaller also exposes a user's computer to additional risks by enabling malicious third parties to download and install over the internet because but the ActiveX uninstaller fails to restrict such access only to Sony BMG or First4Intemet. Such malicious code could severely damage a user's computer, including but not limited to erasing a user's hard disk.

82. Sony BMG does not cause the ActiveX control to be removed from user's computers following completion of the installation process.

83. On information and belief, the uninstallation can cause further damage to users' computers, including but not limited to, causing a user's Windows operating system to crash.

84. On or around November 15, 2005, Sony BMG posted the following message on its website: "We currently are working on a new tool to uninstall First4Intemet XCP software. In the meantime, we have temporarily suspended distribution of the existing uninstall tool for this software. We encourage you to return to this site over the next few days. Thank you for your patience and understanding." Sony BMG failed to disclose the problems associated with the old uninstaller. As of the filing of this complaint, no new uninstaller has been made available.

85. On information and belief, the software released by Sony BMG to resolve the flaws in the XCP software can cause further damage to users' computers.

SONY BMG HAS MADE MATERIAL MISREPRESENTATIONS AND OMISSIONS REGARDING THE SOFTWARE IT HAS INCLUDED ON MUSIC CDS

86. In addition to the material misrepresentations and omissions set forth above, Sony BMG has made numerous additional misrepresentations and omissions of material facts.

87. On information and belief, the XCP and MediaMax CDs are disseminated wit

15

identical EULAs.

88. Sony BMG's EULAs state that the MediaMax and XCP software installed on a user's computer will not be used to collect any personal information. As set forth above, this is untrue.

89. Sony BMG's EULAs state that the MediaMax and XCP software will remain on the user's computer until it is removed or deleted. Neither the MediaMax nor the XCP software allows a user to use the standard "add/remove program" function on the Windows operating system to remove the program. Sony BMG's MediaMax and XCP CDs and its software fail to provide information about how to remove the program or even how to contact Sony BMG to resolve any problems with the program.

90. The EULAs disclose that the MediaMax and XCP drivers try to "protect the audio files embodied on the CD." However, the drivers also attempt to restrict access to any other CD that uses MediaMax or XCP technology. Therefore, users need only agree to installation on one album for the software to affect users' ability to use many other titles.

91. Sony BMG uses its website to advertise and promote the sale of its CDs. On its website, until November 15, 2005, Sony BMG falsely denied that its software is spyware and that it posed a security risk. Sony BMG also made the false claim that the software does not collect any personal information nor is it designed to be intrusive to the user's computer system.

92. On or around November 8, 2005, Sony BMG publicly and falsely stated, on the http://cp.sonybmg.com/xcp website, that the XCP software's rootkit "component is not malicious and does not compromise security."

93. The above website directs users to another site, http://updates.xcp-aurora.com/, where users can obtain a software update to remove the rootkit component of the XCP technology. As of the filing of this complaint, the website states that the cloaking component "is not malicious and does not compromise security."

94. On its support website (http://cp.sonybmg.com/xcp/english/home.html). Sony BMG stated, until approximately November 16, 2005, that its XCP software simply acts to prevent unlimited copying and ripping from discs featuring the technology. Sony BMG created

16

the false impression that the only effect of software included on CDs would be to restrict the ability to create copies of CDs or the quantity of CDs that a user can copy.

95. On or around November 16, 2005, Sony BMG announced, on the http://cp.sonybmg.com/xcp website, that it shared the security concerns of consumers regarding the XCP discs, and offered to exchange new CDs for CDs with XCP software. Sony BMG did not indicate the nature or extent of the security risks associated with the XCP software. Sony BMG also affirmed that the XCP software was not a "monitoring technology."

96. Sony BMG uses its website to advertise and promote the sale of its CDs. On its website, until November 15, 2005, Sony BMG falsely denied that its software is spyware and that it posed a security risk. Sony BMG also made the false claim that the software does not collect any personal information nor is it designed to be intrusive to the user's computer system. Sony BMG has failed to make efforts to publicize the flaws in its XCP software and uninstaller, apart from statements on its websites and statements to the press. Therefore, many XCP CD purchasers are unaware of the security and other risks caused by the software.

97. Sony BMG has failed to publicly disclose or address the risks associated with MediaMax software and its uninstaller. Therefore, many MediaMax CD purchasers are unaware of the security and other risks caused by the software.

98. As set forth above, the MediaMax CD EULA and the SunnComm Sony BMG support website misleadingly represent that the software will not be used to collect personal information about the user without his or her permission.

99. As set forth above, the MediaMax CD EULA and the SunnComm Sony BMG support website falsely represent that MediaMax software will not be installed if the user declines the EULA.

100. The MediaMax EULA fails to disclose other important details about what the uninstaller does, including but not limited to the security risks it poses to users' computers.

101. According to Sony BMG, the purpose of the software is to restrict the ability to create copies of CDs or the quantity of CDs that a user can copy. The MediaMax and XCP software goes far beyond copyright protection, however. For example, the software makes it

17

extremely difficult for a consumer with a PC to transfer their music to an Apple Corporation-manufactured iPod but easy to transfer to other portable digital music players, such as those sold by Sony. Sony BMG asks iPod owners who have XCP CDs to complain to Apple about the inability to play Sony BMG protected music on an iPod. The MediaMax support website also asks iPod owners who have MediaMax CDs to complain to Apple about the inability to play Sony BMG protected music on an iPod. To the extent that this is intended to advantage Sony BMG or its partners in the portable digital music player market, this advantage comes at the expense of consumers.

SONY BMG'S EULAS CONTAIN NUMEROUS UNCONSCIONABLE AND UNREASONABLE PROVISIONS

102. Plaintiffs incorporate the allegations set forth above by references, as if set forth fully herein.

103. On information and belief, the XCP and MediaMax CDs are disseminated with identical EULAs.

104. Sony BMG has inserted several unconscionable provisions EULA that accompanies the XCP and MediaMax CDs. These provisions include:

a. Restrictions on the user's ability to use the digital content on the CD in the event that that consumer chose to leave the United States;

b. Restrictions on resale and transfer of the digital content on the CDs;

c. Restrictions on user's ability to use the digital content on the CDs at work;

d. Restrictions on user's ability to use and retain lawfully-made copies of the digital content on the CDs in the event that the original CD is stolen or lost;

e. Restrictions on user's ability to use the digital content on the CDs following a bankruptcy;

f. Conditioning the user's continued use of the digital content on the CDs on acceptance of all Sony BMG software updates;

g. A purported $5.00 limit on Sony BMG's entire liability to the purchaser of the CDs;

h. Restrictions on user's ability to examine and test his or her computer to understand and attempt to prevent the damage cause by the rootkit;

18

i. A reservation of rights by Sony BMG to use "technological "self-help" measures against the computers of users who desire to make use of the digital content on the CDs "at any time, without notice to [the user]."

j. Restrictions on the user's ability to seek redress in California courts, under California law, and the purchaser's ability to seek a trial by jury;

k. A disclaimer of all warranties, including implied warranties of merchantability, satisfactory quality, noninfringement, and fitness for any particular purpose.

SONY BMG'S SOFTWARE IS A COMPUTER CONTAMINANT

105. Sony BMG has introduced a computer contaminant, in violation of California Penal Code Section 502, into the Plaintiffs' and the Class' computers, computer systems or computer networks.

106. Sony BMG software includes a set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network.

107. Sony BMG software transmits information about which CDs the user is playing through the Internet.

108. Sony BMG knowingly introduced the software into a computer, computer system, or computer network.

109. The Plaintiffs and the Class do not intend for the Sony BMG software to transmit information about which CDs the user is playing through the Internet.

110. The Plaintiffs and the Class did not give permission for the Sony BMG software to transmit information about which CDs the user is playing through the Internet.

111. Sony BMG has intentionally accessed a computer without authorization or exceeded authorized access, and thereby obtained information from computers owned by Plaintiffs and the Class; and accessed such computers without authorization, and as a result of

19

such conduct, recklessly caused damage.

112. Sony BMG knowingly caused the transmission of a program, information, code, or command, and as a result of such conduct, intentionally caused damage without authorization, to computers owned by Plaintiffs and the Class.

113. Sony BMG intentionally accessed computers owned by Plaintiffs and the Class without authorization.

114. Sony BMG knowingly and with intent to defraud, accessed computers owned by Plaintiffs and the Class without authorization, or exceeded authorized access. Sony BMG's conduct furthered the fraud and allowed Sony BMG to obtain information of value.

115. By engaging in the above-described acts, Sony BMG knowingly, intentionally and/or recklessly caused damage.

116. By engaging in the above-described acts, Sony BMG caused damage.

117. By engaging the above described acts, Sony BMG has caused or attempted to cause a threat to public health or safety,

118. It is important to public safety not to defeat or undermine the security measures on computers.

119. Keeping the Internet infrastructure functioning is important to public safety.

SONY BMG HAS CAUSED DAMAGE TO CONSUMERS AND THE PUBLIC

120. On or around November 16, 2005, Sony BMG issued a public statement announcing that it would recall XCP CDs and allow customers to exchange the XCP CDs for CDs that would not contain any DRM.

121. As of the filing of this Complaint, Sony BMG has not offered to refund the purchase price of the XCP CDs.

122. As of the filing of this complaint. Sony BMG has not offered to recall, replace, or refund the purchase price of MediaMax CDs.

123. As of the filing of this complaint. Sony BMG has not compensated or offered to compensate consumers for the damage it has caused to their computers.

124. Through the actions set forth above. Sony BMG has damaged its customers,

20

including Plaintiffs and Class members, to an extent to be determined at trial, caused them actual injury, and caused them to lose money and property.

125. Investigation into the scope and extent of the effects and damage caused by Sony BMG's software is ongoing. Plaintiffs, on behalf of themselves and the Class, reserve the right to amend these allegations as new information is discovered.

CLASS ACTION ALLEGATIONS

126. Plaintiffs bring this action on behalf of themselves and all others similarly situated, in both a representative capacity and as a class action pursuant to California Code of Civil Procedure section 382 and California Civil Code section 1781. Plaintiffs seek to represent the following class: All California residents who purchased an audio compact disc distributed by Sony BMG, which contains XCP or MediaMax software. Not included within the class definition are Defendants and its affiliates. Additionally, solely for the purposes of the Consumer Legal Remedies Act, California Civil Code Section 1750, et seq., the class does not include business entities. In the alternative, to the grounds for class certification set forth below. Plaintiffs may seek an injunctive relief class based on the fact that Sony BMG has acted or refused to act on grounds generally applicable to the class and California consumers, thereby making appropriate final injunctive relief and declaratory relief with respect to the Class and California consumers as a whole.

127. This action has been brought and may properly be maintained as a class action, pursuant to the provisions of the California Code of Civil Procedure Section 382 and California Civil Code Section 1781.

128. Numerosity of the Class - - Code Civ. Proc., § 382; Civ. Code, § 1781 (b)(l): Members of the Class are so numerous that their individual joinder is impracticable. The precise numbers of members of the Class and their addresses are unknown to the Plaintiffs. Plaintiffs estimate the Class to consist of hundreds of thousands of members. The precise number of persons in the Class and their identities and addresses may be ascertained from Defendants' records. Members of the Class may be notified of the pendency of this action by mail,

21

supplemented (if deemed necessary or appropriate by the Court) by published notice.

129. Existence and Predominance of Common Questions of Fact and Law - - Code Civ. Proc. § 382; Civ. Code, § 1781(b)(2): Common questions of law and fact exist as to all members of the Class. These questions predominate over the questions affecting only individual members of the Class. These common legal and factual questions include whether:

a. Sony BMG engaged in deceptive business practice in connection with the sale and advertising of the XCP and MediaMax CDs;

b. Sony BMG, directly or by implication, advertises or represents that the XCP and MediaMax CDs have characteristics they do not have;

c. Whether Sony BMG attempts to cause consumers to waive provisions of the CLRA in violation of the express terms of the statute;

d. Whether some or all of the terms of the EULA are unconscionable;

e. Whether the MediaMax software installs on consumers' computers without authorization;

f. Whether the MediaMax and XCP software exceed the authorizations given by consumers;

g. Whether the communications by the MediaMax and XCP software over the internet are disclosed and necessary uses of the copy protection software.

130. Typicality - - Code Civ. Proc., § 382; Civ. Code § 1781(b)(3): Plaintiffs' claims are typical of the claims of the members of the Class because Plaintiffs purchased a CD distributed by Defendants, and Plaintiffs were required to agree to the EULA, which did notify Plaintiffs of the true nature of the software that the CD was to install on Plaintiffs' computer.

131. Adequacy - - Code Civ. Proc., § 382; Civ. Code § 1781(b)(4): Plaintiffs are adequate representatives of the Class because their interests do not conflict with the interests of the members of the Class they seek to represent. Plaintiffs have retained counsel competent and experienced in complex class action litigation and Plaintiffs intend to prosecute this action vigorously. The interests of members of the Class will be fairly and adequately protected by Plaintiffs and their counsel.

22

132.Superiority - Code Civ. Proc., § 382: A class action is superior to other available means for the fair and efficient adjudication of the claims of Plaintiffs and members of the Class. The damages suffered by each individual Class member may be relatively small, especially given the burden and expense of individual prosecution of the complex and extensive litigation necessitated by Defendants' conduct. Furthermore, it would be virtually impossible for the Class members, on an individual basis, to obtain effective redress for the wrongs done to them. Moreover, even if Class members themselves could afford such individual litigation, the court system could not. Individualized litigation presents a potential for inconsistent or contradictory judgments. Individualized litigation increases the delay and expense to all parties and the court system presented by the complex legal issues of the case. By contrast, the class action device presents far fewer management difficulties, and provides the benefits of a single adjudication, economy of scale, and comprehensive supervision by a single court.

FIRST CLAIM FOR RELIEF
(Violation of Consumer Legal Remedies Act)

133. Plaintiffs incorporate the allegations set forth above by references, as if set forth fully herein.

134. The Consumer Legal Remedies Act (CLRA), California Civil Code sections 1750 et seq, applies to Sony BMG's actions and conduct because such actions and conduct pertain to transactions that were intended to result and/or resulted in the sale or lease of goods or services to consumers.

135. Plaintiffs and each member of the class are "consumers" within the meaning of Civil Code Section 1761(d).

136. The Sony BMG products that are the subject of this litigation are "goods" within the meaning of Civil Code section 1761 (a).

137. Sony BMG has engaged in deceptive practices, unlawful methods of competition and/or unfair acts as defined by Civ. Code §1770, to the detriment of Plaintiffs and the Class. Plaintiffs and members of the Class have suffered harm as a proximate result of the violations of law and wrongful conduct of Defendant alleged herein.

23

138. Sony BMG intentionally and unlawfully perpetrated harm upon Plaintiffs and the Class by the above described acts.

139. In violation of Civil Code section 1770(5), Sony BMG has represented that its CDs have characteristics, uses or benefits which they do not have.

140. In violation of Civil Code section 1770(a)(9), Sony BMG has advertised its CDs with intent not to sell them as advertised.

141. In violation of Civil Code section 1770(a)(14), Sony BMG has represented that the purchase and/or use of its XCP and MediaMax CDs confers or involves rights, remedies, or obligations which it does not have or involve, or which are prohibited by law.

142. In violation of Civil Code section 1770(a)(19), Sony BMG has inserted several unconscionable provisions into the end-user license agreement (EULA) that accompanies the XCP and MediaMax CDs.

143. Sony BMG concealed material information regarding the XCP and MediaMax CDs from Plaintiffs and other class members, including but not limited to the existence of the rootkit program and its effects on users' computers and the lack of a reasonable way to uninstall the software in the event of security or privacy violations.

144. Users, including Plaintiffs and class members, routinely rely on this type of information in making music purchase decisions. Had Sony BMG disclosed this material information. Plaintiffs and other class members would not have purchased the XCP and MediaMax CDs.

145. Plaintiffs and other class members relied on this material information to their detriment.

146. Sony BMG's deceptive acts and omissions and unfair business practices occurred in the course of selling a consumer product and violate Civil Code section 1770(a).

147. As a direct and proximate result of Sony BMG's violations of the CLRA, Plaintiffs and other class members have suffered harm.

148. Sony BMG's policies and practices are unlawful, unethical, oppressive, fraudulent and malicious. The gravity of the harm to all consumers from Sony BMG's policies and

24

practices far outweighs any purported utility those policies and practices have.

149. Pursuant to Civil Code section 1780(a), Plaintiffs seek an order enjoining Defendant from engaging in the methods, acts or practices alleged herein, including an order enjoining the defendant from continuing to sell and market XCP and MediaMax CDs and continuing to disclaim the risks of using such CDs.

150. Pursuant to Civil Code section 1782, on November 14, 2005, Plaintiffs notified Sony BMG of its commission of unlawful acts under Civil Code section 1770, specifying the particular violations, and demanded that Sony BMG rectify its illegal acts within 30 days. The demand letter requested that Sony BMG compensate consumers for computer problems related to the XCP and MediaMax software.

151. On November 18, 2005, Sony BMG responded. In its response, Sony BMG did not agree to provide compensation or to discuss a process for assessing claims. Therefore, Plaintiffs and the Class also request (a) actual damages; (b) restitution of money to Plaintiffs and Class members; (c) punitive damages; (d) attorneys' fees and costs; and (e) other relief that this Court deems proper.

SECOND CLAIM FOR RELIEF
(Violation of California Business and Professions Code Section 17200)

152. Plaintiffs incorporate the allegations set forth above by references, as if set forth fully herein.

153. Plaintiffs and the Class have suffered injury in fact and lost money or property as a result of such unfair competition. Such injuries and losses include, but are not limited to, computer damage, time and effort spent identifying and attempting to remove the damaging software, loss of use of the ability to listen to the music on the CDs, and the purchase price of the CDs.

154. Sony BMG has engaged in unfair, unlawful and fraudulent business practices as set forth above.

155. By engaging in the above-described acts and practices. Sony BMG has committed

25

one or more unfair business practices within the meaning of Bus. & Prof. Code §17200, et seq. Specifically, Sony BMG's business practices offend the public policies set forth in California Constitution Art. 1, section 1; Civil Code sections 1750 et seq (Consumer Legal Remedies Act); Business and Professions Code section 22947 (Consumer Protection Against Computer Spyware Act); Business and Professions Code section 17500 et seq.; Business and Professions Code sections 22575-579 (Online Privacy Protection Act); and California Penal Code section 502.

156. Sony BMG's above-described deceptive and misleading acts and practices have and/or are likely to deceive Plaintiffs and other Class members.

157. Sony BMG's acts and practices are also unlawful because they violate Civil Code sections 1750 et seq (Consumer Legal Remedies Act); Business and Professions Code section 22947 (Consumer Protection Against Computer Spyware Act); and California Penal Code section 502.

158. Specifically, Sony BMG marketed and sold the XCP and MediaMax CDs in defective condition and deceptively failed to disclose their defects as described above; advertised its XCP and MediaMax CDs with intent not to sell them as advertised; represented that the purchase and/or use of its XCP and MediaMax CDs confers or involves rights, remedies, or obligations which it does not have or involve, or which are prohibited by law; inserted several unconscionable provisions into the EULA that accompanies the XCP and MediaMax CDs infected with the XCP and MediaMax software; took control and modified the settings of user's computers, collected personally identifiable information about users, tracked users as they listen to the CDs and attempted to prevent users from blocking or disabling the XCP and MediaMax software; violated the implied covenant of good faith and fair dealing; and failed to comply with the implied warranty of merchantability.

159. Plaintiffs and the Class have suffered injury in fact and have lost money or property as a result of such unfair competition.

160. Plaintiffs, on behalf of themselves and on behalf of the Class, seek an order of this Court awarding restitution, disgorgement, injunctive relief and all other relief allowed under §17200, et seq.

26

THIRD CLAIM FOR RELIEF
(Breach of Implied Covenant of Good Faith and Fair Dealing)

161. Plaintiffs incorporate the allegations set forth above by references, as if set forth fully herein.

162. California law implies a covenant of good faith and fair dealing in all contracts between parties entered into in the State of California.

163. By engaging in above-described acts and practices, Sony BMG has violated the implied covenant of good faith and fair dealing in the consumer's purchase of the XCP and MediaMax CDs.

164. By engaging in the above-described acts and practices. Sony BMG has caused Plaintiffs and the Class to suffer damages in an amount to be determined at trial.

FOURTH CLAIM FOR RELIEF
(False or Misleading Statements)

165. Plaintiffs incorporate the allegations set forth above by references, as if set forth fully herein.

166. Through its advertising practices, promotional materials, packaging, EULA, public statements, and other acts and practices described herein. Sony BMG has made untrue and misleading statements and omitted material facts in violation of California Business and Professions Code §§17500, et seq.

167. The misrepresentations, omissions and other misleading conduct described herein concerning the XCP and MediaMax CDs were "likely to deceive." These misrepresentations and omissions continue to this date.

168. Sony BMG knows or should know that these misrepresentations and omissions concerning the XCP and MediaMax CDs are false and misleading.

169. Plaintiffs and the Class were actually deceived by the misrepresentations and omissions.

170. Plaintiffs and the Class relied on these misrepresentations and omissions to their

27

detriment.

171. Plaintiffs and the Class have been harmed. Plaintiffs, on behalf of themselves and on behalf of the Class seek restitution, disgorgement, injunctive relief and all other relief allowable under §17500, et seq.

PRAYER FOR RELIEF

172. For compensatory damages in an amount to be proven at trial.

173. For restitution and disgorgement of profits realized as a result of the unlawful conduct of defendants.

174. For any treble and/or punitive damages to the extent permitted by law.

175. For equitable relief, including but not limited to, requiring Sony BMG to:

a) Notify consumers, through widespread publicity, of the potential security and other risks associated with the XCP and MediaMax technology, to allow consumers to make informed decisions regarding their use of those CDs. The notification process should include issuing a public statement describing the risks associated with both XCP and MediaMax software and listing every Sony BMG CD, DVD or other product that contains MediaMax software. In addition, Sony BMG must use the banner communication system incorporated in its software to advise consumers that refunds and uninstall software is available. The notifications much be reasonably calculated to reach all consumers who have purchased the products.

b) Cooperate fully with any interested manufacturer of anti-virus, anti-spyware, or similar computer security tools, and with security researchers, to facilitate the identification and complete removal of both XCP and MediaMax software from the computers of those infected. Among other actions, Sony BMG should publicly waive any claims it may have against such vendors or researchers under the

28

EULA, the Digital Millennium Copyright Act (DMCA) and any similar laws.

c) Refund the purchase price of the CDs containing XCP technology for those consumers who prefer a refund to a replacement CD.

d) Refund the purchase price of the CDs containing MediaMax technology or, at the consumer's election, provide a replacement CD that does not contain the MediaMax technology. For those consumers who choose to retain CDs containing the MediaMax technology, develop and make widely available a software update that will allow consumers to easily uninstall the technology without losing the ability to play the CD on their computers, without causing further damage to their computers, and without revealing any personally identifying information.

e) To avoid future abuses, prior to releasing any future product containing technology with similar functions, thoroughly test the software to determine the existence of any security risks or other possible damages the technology might cause to any user's computer AND certify in a statement included in the packaging of every CD containing the technology that the product does not contain any concealed software such as the XCP rootkit, does not electronically communicate with Sony BMG or any other party nor initiate the download of any software update or other data without informed consent of the consumer immediately prior to each communication, can be uninstalled without any need to contact and/or disclose personal information to Sony BMG or its affiliates and agents, does not present any security risks to any consumer's computer, and will not damage or reduce the functionality of the consumer's computer in any way.

29

176. For the award to Plaintiffs of their attorneys' fees and other costs of suit.

177. For such other and further relief as the Court deems just and equitable.

DATED: November 21, 2005

> GREEN WELLING LLP

By: Robert S. Greens

Jenelle Welling
Avin P. Sharma
[address, phone, fax]

Cindy Cohn
Fred von Lohmann
Kurt Opsahl
Corynne McSherry
ELECTRONIC FRONTIER FOUNDATION
[address, phone, fax]

Reed R. Kathrein
Shanna Scarlett
LERACH COUGHLIN STOIA GELLER RUDMAN & ROBBINS LLP
[address, phone, fax]

Lawrence E. Feldman
LAWRENCE E. FELDMAN & ASSOCIATES
[address, phone, fax]

Attorneys for Plaintiffs

30


  View Printable Version


Groklaw © Copyright 2003-2013 Pamela Jones.
All trademarks and copyrights on this page are owned by their respective owners.
Comments are owned by the individual posters.

PJ's articles are licensed under a Creative Commons License. ( Details )