Learning from Sony

Sony BMG recently settled lawsuits brought by the attorneys general of Texas and California over copy protection software embedded in certain Sony BMG music CDs. As has been widely reported, key legal issues raised by the attorneys general centered around the fact that the anti-piracy software was not disclosed, and contained features other than those strictly necessary to defeat piracy. Other claims were made based on statutes limiting computer intrusion .

The Sony BMG debacle offers great lessons for hosting companies. Because hosting companies control the channel between customer and vendor, they face requests to engage in activities that are either not disclosed, or opaque to the customer. Often the solution to any "legal issues" raised by these activities, is to create a click wrap contract that, while disclosing the activity, does so in such a convoluted or legalistic way, that a reasonable person would be unable to understand what they were agreeing to. Indeed, one of the defenses raised by Sony BMG, was the fact that consumers had expressly agreed to the installation of the copy protection root kit. Hosting companies would be well advised to think carefully about marketing and other business scenarios that involve distributing software, or selling information, to third parties when the third party seeks to disguise its participation in the transaction.

The second important lesson in this is the continued vitality of federal and state statutes governing computer transactions. In addition to the federal "computer fraud and abuse act" linked above, Sony BMG ran afoul of the thicket of state statutes that have been enacted to curtail computer fraud, spyware and unfair business practices. While these statutes differ slightly from state-to-state, all have the same general goal: preventing companies from engaging in acts that are unconscionable, misrepresent the purpose of a transaction, or are simply misleading. Hosting companies embarking on new and innovative product launches, would be well advised to review state statutes governing consumer protection, and distribution of malicious software, prior to going live.

Regardless of the fact that Sony BMG settled this matter, hosting companies have been given a good idea of the kinds of legal actions that may be brought against them for the release of defective software and failure to adequately disclose the true nature of their activities.