Sony's latest high-tech product: Music CDs equipped with spyware

It's not enough to have to worry about evil-genius 15-year-old hackers in Hackensack or renegade Romanian criminal gangs that want to bore their way into your computer to steal your data, money and identity, or to turn your innocent little Dell desktop into a zombie drone that sends out millions of spam e-mails for cheap knockoff Viagra.

Now you've got to worry about Sony, one of the most respected names in technology, sneaking something called a "rootkit" onto your computer when you play one of its music CDs. According to blogger Mark Russinovich, rootkits "are cloaking technologies that hide files, Registry keys, and other system objects from diagnostic and security software, and they are usually employed by malware attempting to keep their implementation hidden."

In less-techie terms, Sony essentially employed a tool of malicious hacking to try to keep CD buyers from copying its music onto extra CDs or iPods. But the rootkit did much more - including opening CD-users' computers to other harmful spyware that might be impossible to detect with ordinary methods, and getting Sony into a whale of a public-relations pickle.

Last month, Russinovich detailed the mess in a blog entry. On Wednesday, Russinovich declared victory in his blog: almost total capitulation by Sony, including the recall of the offending CDs. (If those accounts are too technical, here's a good overview of the story from USA Today columnist Andrew Kantor.)

I've never been convinced by the argument that information, music, or anything else people create or assemble through their labors, "just wants to be free." As a professional writer, I believe creative work has value, and I know that much of it would never be created but for mechanisms of compensating the writers or artists. I'd hate to return to an era when artists required individual wealthy patrons to survive.

But increasingly, I find myself rooting against others - Sony, for one - who make the same argument. Computers and the Internet are extraordinary tools for creativity - for creating, distributing and, yes, sharing creative products. If I buy its music, what right should Sony have to stop me from listening to it on my iPod? For that matter, why isn't its secretly installing a rootkit on my computer a crime?

The ultimate consumer tool: A key to getting a human being on the phone

OK, I may have just discovered the single most useful consumer tool ever conceived: a Web site from Paul English, co-founder of Kayak.com, that shows you how to cheat your way to a person when you're stuck in the voice-mail hell of businesses' "interactive voice response" systems.

I can't vouch for it completely, but if it works even a fraction of the time, I may swear it's the best thing since sliced bread, and not be joking. But I just verified that it helped me get through to a live human being at 1-800-CHASE24. Check it out: www.paulenglish.com.

More on credit freezes - and what to do if you live in Pennsylvania or another state that doesn't require them

If you want to get control over who has access to your credit report, a credit freeze is the answer. But so far, only 12 states require them - and some limit the right to a freeze to people who are already victims of identity theft.

In Pennsylvania, House Bill 1243 and Senate Bill 180 each would establish some rights to a freeze. They're better than nothing, but neither goes far enough to address the huge problem our credit-reporting system has created: Easy access to "instant" or "pre-approved" credit has led to the free flow of our credit reports, without our knowledge or permission. As many an identity-theft victim has learned belatedly, the same easy access you enjoy to instant credit in the checkout line at Home Depot or Circuit City can also allow a thief to open a new account in your name. A freeze would prevent that, because the thief would need more than the information available in your wallet or even on a stolen credit report - he'd need a secret PIN code that you would use each time you wanted to authorize a business to see your report.

New Jersey's law, which goes into effect Jan. 1, isn't perfect, but it's easily the nation's best so far. It allows any resident to establish a freeze - no need to wait till you've been a victim. It allows the freeze to be requested by phone or Internet, instead of only by certified mail. Though it initially gives the Big Three credit-reporting agencies up to three business days to temporarily lift a freeze - something you'd want to do when applying for credit, signing up for a new cell-phone service, or anything else that involves a credit check - it sets year-by-year goals for faster service. By January 2009, a consumer will be able to electronically authorize a report's release within five minutes, and to authorize its release within an hour by phone. And it allows the credit bureaus to charge just $5 apiece to lift the freeze, and nothing to establish it. By contrast, the Pennsylvania Senate Bill allows each to charge $10 to establish a freeze (except if you're already a victim, or over 62 years old) and $8 to lift it.

As far as I'm concerned, any charge for this service is too high a charge. Lenders and the credit bureaus have developed a financially beneficial system: To control their risk and generate new business, lenders already pay for our credit information - as they will any time we authorize a frozen report's release. If it costs more to run a system that doesn't do collateral damage to consumers, there's an easy solution: Raise the price to lenders.

Millions of consumers are harmed, and the rest of us put at risk, by the system these guys have established. We shouldn't have to pay to fix it.

More buzz about buzz

Yesterday's column about Tremor, Procter & Gamble's secretive word-of-mouth marketing venture that has enlisted a quarter-million influential teens as a volunteer force of "buzz" marketers, drew this response from Maryann Devine, director of marketing and public relations at Philadelphia's Academy of Vocal Arts:


Dear Jeff:

Have you seen the Word of Mouth Marketing Association’s Code of Ethics, which puts transparency among its chief points? My own opinion is that word-of-mouth marketing, whether between teens or adults, only works if the buzz is honest and the product is fantastic. Anyone who deceptively promotes an item to their friends and acquaintances will soon lose credibility - and therefore lose value to the company who recruited him in the first place. Although I'm sure the stats are different for teens (for whom instant messaging and text messaging are extremely important), WOMMA's research says that 80% of word of mouth happens face-to-face, not via the Internet as many assume. By the way, I’m not a member of WOMMA.

In fact, I was curious about how word-of-mouth marketing firms work, so I signed up a year or so ago to participate in a couple of Bzzagent’s campaigns. Sure, I got a free book out of the deal, but it was so awful that I would never recommend it to my colleagues. No one tried to coerce me into talking positively about what I felt was a poor offering. (It was Return on Customer, by the way.) Bzzagent is upfront about only talking up what you love, and not hiding your part in the campaign.

On the other hand, my husband and his friends carefully planned their attendance of the movie Serenity for opening weekend – not because they had to be among the first to see it, but because they’re keenly aware of how opening weekend box office revenue affects a sequel’s prospects, and they’re all serious fans of the canceled series, Firefly, that spawned the movie.
They also planned to see it again in that first week, for the same reasons. I understand there was a word-of-mouth campaign for Serenity, but my husband didn’t know about it till after the fact, when I mentioned it to him. He and his friends do that on their own, for films they care about. I’ll bet if Tremor or Bzzagent had given them some other ideas, they’d have been happy to put them into action.

The point is, people are doing this anyway, and they’re savvier about the effects of their actions and influence than you might guess. This is not to say that deceptive marketers don't exist, but people will always buzz about great stuff. And buzz that is suspect is worthless to everyone, including Tremor.

Sincerely,

Maryann

My (slightly edited) reply:

Dear Maryann -

Thanks for the thoughtful note. My 14-year-old makes much the same point, albeit with a lot less sophistication, about buzz only working if the products are worth praising.

Yes, I've seen the WOMMA code of ethics, and interviewed a couple of the association's top officials. I'm still skeptical, though, in part because Tremor is not a WOMMA member, and the worst "stealth" marketing may come from nonmembers. But beyond that, I'm skeptical because I can't escape the idea that this involves more man-behind-the-curtain manipulation than most of us expect from traditional marketing.

PR people are always hoping to influence "word of mouth" or "viral" spreading of positive opinion about their clients or their products. At some level, that's your main goal, isn't it? Sure, you want mass or niche media to cover what you do, but ultimately, you must want positive opinion to spread as far as people can carry it.

The question is what levers you're able and willing to pull. Some word-of-mouth techniques are hard to criticize -- Andy Sernovitz of WOMMA told me about campaigns such as Krispy Kreme's selling donuts at a discount to nonprofits, to spread positive feelings about the company, and a software company's decision to sponsor user groups so that customers could share feedback (and even criticism) of its products, and feel good about the company's willingness to promote such useful discussion.

My concern is with the campaigns that aren't so obvious and visible. Your story about "Serenity" suggests a plausible example. I've got no problem with savvy fans taking it upon themselves to see the film quickly and repeatedly because they want it to succeed and encourage a sequel. I've got no problem with their trying to spread the word to other fans via e-mail or on the Web - probably the only real way individuals could have a chance at much impact with films that open on thousands of screens around the country.

But I don't like the idea that marketers, watching that organic behavior, might then be scheming about how to manipulate it - say, by systematically identifying a quarter-million "connector" filmgoers and sending them all sneak-preview or first-weekend passes. A decent film marketed that way might surpass much better films in those crucial early measures. Come to think of it, the studios are probably doing that right now. Maybe that's why so much shlock is so successful - as well as why we'll never know.

But I agree that this isn't a black-and-white issue. Thanks for sharing an insider's perspective.

Best,

Jeff