The Lasting Impact of Sony's Rootkit

[David Farber <dave () farber net>]

-------- Original Message --------
Subject:        The Lasting Impact of Sony's Rootkit
Date:   Mon, 21 Nov 2005 07:37:14 -0500
From:   Michael Geist <mgeist () pobox com>
To:     dave () farber net
References:     <437E264B.5000705 () farber net>



Dave,

You've features a lot of commentary on the Sony rootkit story.  If 
you're interested in a bit more, my column today recaps developments 
from the past three weeks and focuses on the lasting impact of the 
case.

I note that the incident has alerted millions of consumers to the 
potential misuse of TPMs as well as to the need for consumer 
protections from such systems.  While policy makers have raced to 
provide legal protections for TPMs, the real need is to protect 
against the misuse of this technology.

The Sony case provides a vivid illustration of how TPMs can create 
real security and privacy risks.  The U.S. Computer Emergency 
Response Team advised users that they should not "install software 
from sources that you do not expect to contain software, such as an 
audio CD."  Moreover, Stewart Baker, the U.S. Department of Homeland 
Security' s assistant secretary of policy, admonished the music 
industry, reminding them that "it's very important to remember that 
it's your intellectual property - it's not your computer. And in the 
pursuit of protection of intellectual property, it's important not to 
defeat or undermine the security measures that people need to adopt 
in these days."

Baker's comments point, as well, to another issue that has been 
percolating for some time, namely that TPMs not only put users' 
property at risk, but they also limit use of lawfully-acquired 
personal property.

Justice Ian Binnie of the Supreme Court of Canada raised this concern 
in the Theberge copyright case several years ago when he noted that 
"once an authorized copy of a work is sold to a member of the public, 
it is generally for the purchaser, not the author, to determine what 
happens to it."

The Australian High Court expressed similar sentiments in the Sony v. 
Stevens decision issued last month.  It rejected Sony's attempt to 
block the use of "mod chips", utilized by video game players to 
unlock games with TPMs purchased outside the country, emphasizing 
that "the right of the individual to enjoy lawfully acquired private 
property (a CD ROM game or a PlayStation console purchased in another 
region of the world or possibly to make a backup copy of the CD ROM) 
would ordinarily be a right inherent in Australian law upon the 
acquisition of such a chattel."

The incident should also galvanize Canadian regulators and political 
leaders.  The Privacy Commissioner of Canada should use her audit 
powers to investigate other potentially invasive uses of TPMs, while 
the Competition Bureau should consider whether Sony violated 
deceptive practice legislation.  Moreover, Industry Minister David 
Emerson and Canadian Heritage Liza Frulla should reconsider their 
proposal to protect TPMs, which has the effect of protecting spyware, 
undermining consumer confidence, and ultimately reducing the sales of 
Canadian musical artists.

I conclude by arguing that with consumer backlash against deceptive 
music CDs and licensing agreements, policy maker worries about the 
privacy and security implications of TPMs, and the courts' concern 
for personal property rights, the Sony rootkit case is destined to 
resonate long after the dangerous CDs disappear from store shelves.

Toronto Star version at
<http://geistsonyrootkit.notlong.com>

Freely available version at
<http://www.michaelgeist.ca/index.php?option=com_content&task=view&id=1015>

Best,

MG

--
**********************************************************************
Professor Michael A. Geist
Canada Research Chair in Internet and E-commerce Law
University of Ottawa, Faculty of Law
57 Louis Pasteur St., Ottawa, Ontario, K1N 6N5
Tel: 613-562-5800, x3319     Fax: 613-562-5124
mgeist () pobox com              http://www.michaelgeist.ca




-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/