Texas on Monday became the first state in the nation to sue Sony BMG Music Entertainment, alleging it secretly embedded compact discs with invisible "spyware" that leaves personal computers vulnerable to hackers.
Attorney General Greg Abbott said he filed the lawsuit under a new Texas state law forbidding such hidden tracking tools, and predicted tens of thousands of Texans might have been hurt by Sony's anti-piracy software.
Sony has said the tracking technology was designed to prevent unlimited copying and unauthorized distribution of music and does not track personal information about computer users, he noted.
But Abbott said his suspicions about its real purpose were heightened by his investigation's findings that the hidden technology remains active at all times.
Citing Sony BMG's Web site, he said the software was placed on 52 music titles by artists ranging from Celine Dion to Flatt & Scruggs.
"Sony has engaged in a technological version of cloak-and-dagger deceit against consumers by hiding secret files on their computers," Abbott said.
"Consumers who purchased a Sony CD thought they were buying music. Instead, they received spyware that can damage a computer, subject it to viruses and expose the consumer to possible identity crime."
Sony, responding to worldwide and mounting controversy over the tracking software known as XCP, recalled the affected albums Friday, but Abbott's investigators said they continued to find affected CDs in Texas stores on Monday.
The company had issued 4.7 million of the embedded CDs, and just over 2 million have been sold. Sony directs consumers with questions about the software and how to disable or eventually remove it to links at
www.sonybmg.com.
"While we don't comment on pending litigation, we are fully cooperating with the attorney general," said Sony BMG spokesman John McKay.
The CDs do not create problems if used in a compact disc player, said Abbott's spokesman Tom Kelley.
However, any consumer attempting to play the discs on a personal computer must first sign a user agreement, which Abbott said secretly installs the tracking software without the consumer's knowledge.
"The file it is implanting into your system is possibly going to damage the unit plus expose you to all kinds of hackers, viruses, ID theft ? you name it," Kelley said. "The consumer had no way of knowing whatsoever that this phantom file was being installed on their computer to gather information about them presumably."
Abbott's lawsuit seeks to determine what purposes Sony might have had in placing the software on computers, which affects Microsoft Windows folders, beyond merely tracking piracy violations.
The lawsuit as filed seeks $100,000 for each violation in damages to the state under the Consumer Protection Against Computer Spyware Act of 2005, a law filed by Sen. Judith Zaffirini, D-Laredo.
Abbott also plans to amend the lawsuit to seek damages for individual consumers under the Texas Deceptive Trade Practices Act, said Kelley.
"I think this is the tip of the iceberg. It is very scary and highly unethical," Zaffirini said.
At least one class-action lawsuit had been filed before Abbott's state action, and more could be in the offing, according to Billboard.com, which noted mounting allegations from computer security experts.
Sony, in its effort to alleviate any damage to consumers, said it has stopped manufacturing the embedded discs and has asked retailers to stop selling them. It also began an exchange program to replace the affected discs with non-affected ones and MP3 files of the album titles.
It is also working on revised and secure procedures to remove the XCP software from computers and otherwise updating customers on how to "uncloak" XCP components on hard drives to allow anti-virus software to block any viruses attempting to exploit it.
