Like many, EFF was pleased when SonyBMG announced that it would stop production on its dangerous XCP CDs. Yet announcing a recall seems to be all that SonyBMG intends to do.

As holiday purchases kicked off over the past week, the damaging disks are still being sold in stores. Customers writing to SonyBMG to complain about the disks are still not being told that they can exchange their disks. Most importantly, SonyBMG has taken no steps to affirmatively notify the public other than a notice on their website (when was the last time you casually browsed the SonyBMG website?) and responding to press calls.

Surely SonyBMG has other means at their disposal to notify the over 2 million purchasers of XCP-loaded CDs that SonyBMG has sold them a defective product. How much did they spend promoting that Celine Dion disk anyway? EFF and others have already suggested that Sony notify customers using the "messaging system" capability of the XCP software, but Sony rejected that suggestion. There have been no ads, no information available at concerts, no notices posted at retail outlets, much less on sides of buses that routinely promote new albums. The websites of most of the affected artists contain no mention of the risks associated with the disks or the exchange program.

SonyBMG likes to say that these technologies represent only a "speedbump" to prevent casual piracy. Now that it turns out they loaded music CDs with a landmine instead of a speedbump, they need to take more aggressive steps to tell their customers that they can exchange their CDs before the viruses hit.