Canadian customers who bought CDs that included a hidden copy-protection program that opened their computers to hackers and viruses have won compensation from Sony BMG.

An Ontario court approved a settlement deal Thursday that has the music giant offering $8.40, a replacement CD and free downloads of selected CDs to hundreds of thousands of customers who bought the affected discs.

Details on eligibility and benefits are on the Sony BMG website. Those seeking compensation must fill out a form at the site or download the form and mail it to a Sony BMG administrator.

The settlement, which applies to all affected customers in Canada except those in Quebec and British Columbia, is similar to one reached in the United States earlier this year, said lawyer Harvey Strosberg, who represented customers in the Ontario class action.

"This was a case that was always about behavioural modification and I think that this was a good result for the Canadian public," Strosberg told the Canadian Press, noting that Sony BMG promised not to use the offending software and that any future anti-piracy programs would be vetted for possible privacy infractions.

Those promises are only in effect until the end of December 2007.

Sony 'delighted'

"Hopefully … the real benefit of this whole process will be that [Sony] will change their behaviour in the future," said Philippa Lawson, executive director of the Canadian Internet Policy and Public Interest Clinic (CIPPIC).

Strosberg suspected the same terms would be extended to proposed settlements in two class-action lawsuits filed in Quebec and British Columbia. Settlement approval hearings have been scheduled for Sept. 28 in Montreal and Sept. 29 in Victoria.

A statement issued by Sony BMG said simply that the company was "delighted" the Ontario Superior Court settlement had been approved.

Dozens of lawsuits emerged in Canada and the United States after it was revealed that Sony BMG sold millions of copy-protected CDs worldwide that contained software known as XCP and MediaMax, which effectively acted as spyware.

The copy protection software, called Extended Copy Protection or XCP, is installed when the CD is put into a computer. The program uses a technique called a rootkit to hide the fact that it is running, making it more difficult to disable.

Security experts say the fact that the Sony program was hidden wasn't itself harmful.

Behind cloak 

However, the program remains active on the computer even when the CD isn't being played and at least one computer virus has been written to hide behind the same cloak.

The technology was also able to read and transmit IP addresses, thereby identifying the user and sending personal information back to Sony BMG, said Lawson.

The music company could then use that information to go after illegal file-sharers in Canada, said Lawson, whose group monitors policy and law-making on issues arising out of new technologies.

Thursday's settlement included promises by Sony BMG to destroy any personal information gathered through the software, said Strosberg.

The settlement didn't include certain provisions that were part of the class-action settlements in the U.S., Lawson said.

"Sony refused to agree to put in the more specific protections that we wanted them to put in that do exist in the U.S.," said Lawson, such as putting labels on CDs that contain copy protection and requiring a plain-language user licence agreement that is displayed before any software is installed.

CIPPIC filed complaints Thursday with the federal competition bureau and several consumer protection agencies accusing the music giant of violating privacy and consumer rights.

Blog revelation 

The complaint said Sony was seeking to exclude IP addresses from its promise not to collect personal information.

About 80,000 music CDs encoded with XCP were sold in Canada, while roughly 1.4 million CDs sold contained MediaMax. The CDs included selected music by artists including Ray Charles, Kasabian, Sloan, Alicia Keys and Roseanne Cash.

Sony BMG began encoding XCP into music CDs sold worldwide in March 2005, and MediaMax software in 2003.

Details of the rootkit copy protection scheme were revealed on a programmer's blog in October 2005.

Mark Russinovich found an unexplained process running on his Windows computer after he played a recently purchased Sony BMG CD.

Two days after it was discovered, Sony released a free update to its software that "removes the cloaking technology component," but not the copy protection.

Prominent suppliers of anti-virus programs, including Computer Associates and Microsoft, included XCP in their definitions for malicious software.

With files from the Canadian Press