Not only has Texas AND California sued Sony over their ill-advised and outright stupid decision to include a rootkit with their CDs, but also Eliot Spitzer, New York’s Attorney General, has decided to go after Sony-BMG too.

As I predicted on November 21, sueing Sony-BMG is going to be a new sport for many US states. Sony BMG claims that they have recalled the CDs, but they are still everywhere. The unwashed masses who buy the bulk of these CDs haven’t figured it out yet, which is probably a good thing. However, they will eventually figure it out. Lots of other Blogs are advising everyone to boycott Sony BMG. I doubt that such an action will accomplish anything, but I guess it’s worth a try.

Business Week’s article on the subject is great. They mention Sony BMG’s silly plan for a “mail-in exchange campaign”. Not many details were given, but I can’t imagine that many people are going to bother mailing in the CDs and waiting the normal 4-6 weeks for anything. If they are not returning them to the stores already, they certainly won’t mail them in. This is a smoke-and-mirrors tactic at best, and downright dishonest in truth. Its like MIcrosoft giving coupons to people in California, or Microsoft “giving” software to schools. It does not really cost the company anything.

Even Homeland Security has spoken up, accusing Sony BMG of “undermining computer security”. Feh, that is light language. Of course, if almost all Windows users weren’t logged in as an Administrator equivalent, it wouldn’t be an issue. Paul Thurrott’s article discussed the Windows security model in comparison with OS X, and talks about where Windows Vista may be going. With OS X, and most other *NIX-based systems like Linux, users do not run as an administrator. They have access to administrator functions, but they must enter a password first, and each time they do. OS X goes a bit further with having roles. I really wish I could afford a nice Mac laptop. Sigh.

Sony BMG should be a little nervous about Spitzer already. He already made them pay a $10 million fine for “payola”. I know that the $10 million is nothing to them, but it proves that he can and will go after whoever he feels necessary. Texas is talking up a $100,000 fine per violation, which means per CD. With 5 million CDs containing the rootkit/malware/virus, and many of them showing up in Texas, the fine could be rather large.

I am really hoping for more than a slap on the wrist. I want all the labels to know that this behavior won’t be tolerated. I want this to resemble the US Tobacco settlement.