In the Matter of: SONY BMG Music Entertainment. Respondent. This Assuranceof Voluntary Complianceor Discontinuance('oAssurance") is enteredinto by the AttorneysGeneral of the Statesof Alabama,Alaska, Arizona, Arkansas,Connecticut, Delawareo Florida,Idatro,Illinois, Indiana,Iow4 Kentucky,Louisian4 Maine, Maryland, Massachusetts, Michigan,Mississippi, Montana" Nebraska, Nevada, New Jersey,New Mexico,New york, North Carolina,North Dakota,Ohio, Oklahoma,Oregon, Pennsylvania, Rhode Island, South Dakota,Tennessee, Vermont, Virginia, Washington,West Virginia, Wisconsin,and Wyoming, and by the Attorney Generalfor the District of Columbia("the States"),acting pursuantto their respectiveconsumet protection statutes,r and SONY BMG Music Entertainment(.SONy I ALABAMA: AlabamaDeceptive Trade Practices Act, Ala. Codeg 8-19-1,et seq.;ALASKA: Unfair TradePractices and Consumer Protection Act, AS 45.50.471,-etseq.;ARIZbNA: Arizonaconsumer lrf{191, A.R.s. $ 44-1521et seq.;ARKANSAS: Ark. stat.Ann., g 4-gg- l0l et seq.;COIYNECTICUT: Conn.Gen. Stat. $ 42-110a,et seq.; DELAWARE: Consumer FraudAct,6 Del.C.$251l, et seq.;DISTRICT OF COLUMBI* Districrof Columbia ConsumerProtection Procedures Act, D.C. Code$ 28-3901et seq.; FLORIDA: Deceptiveand Unfair TradePractices Act, Fla. Stat.Ch. 501.201et seq.;IDAHO: IdahoConsumer protection Act, IdahoCode $ 48-601,et seq.;ILLINOIS: ConsumerFraud and Deceptive Business PracticesAct, 815ILcs 505/l et seq.;INDIANA: Ind.code Ann. $24-5-b-5-l;IowA: Iowa ConsumerFraud Act, Iowa Codesection714.16; KENTUCKY: ConsumerProtection Act, Ky. Rev. Stat.$$ 367.1l0 to 367.990;LOUISIANA: Unfair Tradepractices and Consumer ProtectionLaw,La. Rev. Stat.Ann. $$51:1401to 5|:1420;MAINE: MaineUnfair Trade PracticesAct, 5 M.R.S.A.sections 207 and209;MARYLANDI MarylandConsumer protection Act, Md. code Ann.,com. Law g 13-101,et seq.;MASSACHUSETiS: Massachusetts ConsumerProtection Act, G.L. c. 93A; MICHIGAN: MichiganConsumer protection Act, MCL 4,45.901et seq.;MISSNSIPPI: ConsumerProtection Act, Siction 75-24-1,et seq.,Mississippi CodeAnnotated of 1972;MONTANA: Unfair TradePractices and ConsumerProtection Aci, Mont.Code Ann. $$ 30-14-101to 30-14-142;NEBRASKA: Consumer Protection Act. Neb. 22357424v1 BMG"). SONY BMG understandsthat additionalStates may determineto enterinto this Assurance,and may do so by a processagreed to by SONY BMG, which requiresthat any such additionalState indicate its intentionto enterinto this Assuranceon or beforeJanuary 4,2007. I. BACKGROTTNI) l. SONY BMG, a joint ventureformed in2004 betweenSONY Corporationof America andBertelsmann AG, disfiibutes,markets, and sells audio compact discs ("CDs,,'as further definedbelow). 2. BetweenJanuary and November2005, SONY BMG distributed79 CD titles that containedone oftwo Windows-compatibleDigital RightsManagement (.DRM") software programs:(l) eXtendedCopy Protection ("XCP"), licensedto SONY BMG by First 4 Internet, Ltd., a U.K. company("First 4 Internef); or (2) Medialr4axVersion 5.0, licensed to SONY Rev. Stat.$$ 59-1601, et. seq.(Reissue 2004) and Neb. Rev. Stat.g 87-301,et seq.(Reissue 1999;Cum. Supp.2004;IYEVADA: TradeRegulation and Practicis Act, Nev. Rev. Stat.gg 41.600'593.360, et seq.;NEW JERSEY:New JerseyConsumer Fraud Act, N.J.S.A.56:8-i et seg.;NEW MEXICo: UnfairPractices Act, N.M. Stat.Ann. gg 57-12-lto 57-12-22;NEw YORK: N.Y. Gen.Bus. Law gg 349&3so andExecutive Law $ or(tz); NORTH CAROLINA: N.G.G.S.g 75-1.1,et seq.;NoRTH DAKOTA: N.n.c.c. gg5l-15-0t, et seq.; OHIOI OhioConsumer Sales Practices Act, R.C. 1345.01et seq.;OKLAHOMA: Oklatroma ConsumerProtection Act, l5 OS $751,et seq.;O'NEGON:Oregon Unlawful Tradepractices Act, OregonRevised Statutes 646.605, et seq.;PEIYNSYLVLwIA: PennsylvaniaUnfair Trade Practicesand Consumer Protection Law, 73 P.S. 201-1,et seq.;RIIODE fSLAXn: R.I. Gen. Law, $ 6-13.1'1,et seq.;SOUTH DAKOTA: DeceptiveTrade Practices and Consumer Protection,SDCL Ch.37'24;TENNESSEE: TenneiseeConsumer Protection Actof 1977, Tenn.Code Ann. Sec.47-18-101, et seg.; VERMONT: ConsumerFraud Act- 9 Vt. Stat.Annot. ch. 63; VIRGINIA: virginia consumerprotection Act, va. code gg sg.l-196,et seq.; WASHINGTON: Unfair BusinessPractices Consumer Protection Act, nCW 19.86ti.itq.; wEsT VIRGINIA: w.va. Code,$ 46A-6-101,et seq.;wlscoNslN: wis. Stat.Ann. gg TilYOMING: 100.18and 100.20; and Wyo.Stat. $ 40-12-101. 22357424v1 BMG by SunnCommInternational Inc., an Arizonacompany ("SunnComm"). DRM software, in this context,refers to computerprogftlms designed to limit the copiesor transfers,through the useof a computer,of the copyrightedmusic on a CD. The softwareat issuehas no effecton non-computer-basedplayers. 3. XCP andMediaMax version 5.0 andthe initial versionsof their associateduninstall programsrendered users' computersvulnerable to different securityexploits. 4. In 2003,Bertelsmann Music Group,a predecessorto SONY BMG, begandistributing CDsthat includeda DRM progftlmcalled MediaMax version 3.0, which alsowas licensed to SONY BMG by SunnComm. XCP 5. In April2005, SONY BMG beganselling the first of 52 titles that includedXCP on the CDs.2Approximately 5 million SONY BMG CDsthat containedXCP wereshipped to retail, and,of these,consumers purchased approximately 3 million. TheseCDs canbe played on computetswith CD-ROM drives as well as on stereosor other non-computer-baseddevices with CD playingcapabilities. 6. SONY BMG usedXCP to protectits intellectualproperfy and that of artistsand "casual songwritersfrom wtrat is known in the industryas piracy"- the copyingof CDs by consumerswho then distributephysical copies to othersor makethe audio files availableto othersvia peer-to-peerfile-sharing networks. XCP preventsusers from making unlimited digital copiesof a CD andcontrols the meansby which the musiccan be playedon a Windows-based 2 The list of XCP CD titles is availableat http: //www. sonybmgcdtechsettl em ent. com/pdfsD( cpritl es.pdf. 22357424v1 computer.In an effort to preventconsumers from avoidingor disablingthese contol fimctions, "cloak," First 4 Internetdesigned XCP to hide,or a numberof the program'sfiles and operations.XCP is ableto do this by meansof a driver. A driver is a specifictype of computer software,typically developedto allow interactionbetween the operatingsystem and hardware devicessuch as CD-ROMs. The driverused in XCP, calledo'aries.sys," prevents users from "$sys$" viewing files thatbegin with the prefix tluoughstandard Windows graphic tools suchas Windows Exploreror AddlRemovePrograms. 7. Becauseof First 4 Internetdesign measures, XCP createsa securityvulnerability on Windows-basedcomputers on which the softwareis installedby creatingthe possibility that maliciouscode, such as viruses, worrns, or Trojans,may usethe prefix $sys$to hide from the consumerand from securitysoftware. 8. Consumersattempting to removeXCP from their computersrunning Windows operating "AddlRemove systemcould not do so using the standard Program"applet in the Windows ControlPanel. Sophisticatedusers may havebeen able to locateXCP on their computersand attemptto removeit manually. RemovingXCP manuallycan result in the disablingof the CD- ROM drive, which would preventthe consumerfrom listeningto, or using, any CD on their computeruntil additionalremedial measures are taken. In addition,certain third-party anti-virus and anti-spywaresoftware attempted to removeXCP from consumers'systems, which in certain instancesalso resulted in disablingthe CD-ROMdrive. 9. SONY BMG did not providean XCP uninstallerprogram on the CDs containingthe XCp DRM software.Initially, SONY BMG requiredconsumers to obtainan XCP uninstallerby email. SONY BMG requiredthese consumers to provideinformation including the CD title, 22357424v1 locationpurchased, and email addressfor the consumer.After a consumerprovided this information,SONY BMG providedthe consumerwith a uniquelink to downloadthe uninstaller. This link couldonly work for that particularconsumer. 10. The originalXCP uninstaller,designed by First 4 Internet,created an additionalsecurity vulnerability. Oncethe uninstallerpatch was executed on a computerit createdthe possibility that a consumerwho inadvertentlyvisited a maliciouswebsite (i.e., a sitedesigned to forcethe installationof virusesor othermalicious code) could inadvertently download, install, and run additionalprograms without the consumer'sknowledge or consent. I l. SinceDecember 4,2005, SONY BMG hasprovided through its websitea new uninstaller for XCP that can be downloadedfrom the Internet,for free, without the consumerproviding any personalinformation. This uninstallerhas been tested and confirmedto be safeand effective. 12. In November2005, SONY BMG instituteda recallprogram for all CDs containingXCp. This program,which remainsongoing, allows consumers to refurnXCP CDs,and receive replacementCDs without copyprotection, at no charge.The recallprogram also provides financialincentives for retailersto returnunsold XCP CDs to SONY BMG. In addition,SONY BMG voluntarilyceased shipping XCP CDs from warehousestock to retailers,and destroyed unsoldwarehouse stock of CDswith XCP. DespiteSONY BMG's efforts,approximately 3 million of theseCDs have not beenretumed. 22357424v1 MediaMax 5.0 13. SONY BMG releasedCDs containingMediaMax 5.0 beginningin May 2005. A total of 27 titleswere produced with the MediaMar 5.0 software.6.9 million CDs containingMedialvlax 5.0 weredistributed by SONY BMG.3 14. MediaMaxsoftware presents consumers with an End UserLicense Agreement (*EULA") at the time the MediaMaxCD is first placedin a computer.But, becauseof SunCommdesign measures,MediaMax 5.0 installsseveral