10 ms·

Sony to ban gamers from PSN unless they waive right sue over security breaches.

288 points by sambeau 15y ago

danssig 15y ago
This shouldn't even be legal. Since it probably is; I think these days most people are probably buying a PS3 for PSN so if users can no longer access it they should bring the device back and demand their money bag. If Sony gets away with this expect more companies to follow suit.
- andrewgodwin 15y ago
  I'm not even sure it is legal in the UK - we have laws against "unfair contracts" [1], and there are also some statutory consumer protections that can't be waived. Of course, this is about security breaches, and IANAL, but I'd say this doesn't stop all potential lawsuits. [1] http://www.oft.gov.uk/about-the-oft/legal-powers/legal/unfair-terms/guidance http://www.oft.gov.uk/about-the-oft/legal-powers/legal/unfai...
  - ugh 15y ago
    It’s complicated but I think many countries have pretty strong protections for consumers against unusual or unexpected clauses in contracts. I would be very surprised if this part of the terms would be enforceable, for example, in Germany.
    - gavinballard 15y ago
      The title of this article is somewhat misleading. A clause that prevented any right of action whatsoever would most likely be illegal in many countries (including, I think, all EU countries, the US and Australia/NZ). However, "binding arbitration" clauses which require parties to submit to alternative dispute resolution procedures before any legal action is taken are actually quite common (perhaps more common in Aus/NZ, the UK and the EU than in the US?). They're a common feature of mobile phone contracts, internet contracts, et cetera. Edit: I see this question has been given excellent treatment here: http://news.ycombinator.com/item?id=3001086 http://news.ycombinator.com/item?id=3001086
      - tnorthcutt 15y ago
        Binding arbitration clauses are quite common in the US, as well.
  - sneak 15y ago
    The only people qualified to determine whether a contract is fair or not are the parties that do or do not sign it.
    - dhimes 15y ago
      I completely disagree. Being able to determine whether or not a contract is fair depends on domain knowledge. In the US anyway, being able to sign a contract is no indicator of domain knowledge. It is dependent on age and, if you represent another entity, your status as an agent for that entity.
      - sneak 15y ago
        Agreed. However, even with that domain knowledge, an outside party cannot determine for one of the parties whether or not they find it "fair" or not. This is not the role of government. It's common knowledge that contracts require domain knowledge, and if you proceed without it, it's akin to riding a motorcycle without a helmet, eating foods fried in trans fats, or driving a car without a seatbelt. Oh, wait. Nevermind.
- roc 15y ago
  The SCOTUS recently affirmed that not only are such clauses legal, but that individual States cannot pass laws to forbid them. http://www.scotusblog.com/case-files/cases/att-mobility-v-concepcion/ http://www.scotusblog.com/case-files/cases/att-mobility-v-co...
  - deleted 15y ago
    [deleted]
  - dgallagher 15y ago
    If I read that correctly (not a lawyer), SCOTUS ruled that an agreement prohibiting class-action lawsuits is legal if both parties agreed to use individual-arbitration instead. So you can still sue them individually in court, or go through the arbitration process, to grieve a claim against them. My question is, how do you know the end-user agreed to that? You have no signature, video, or audio proof. PSN accounts generally remain logged-in, and it's possible someone other than you agreed to the EULA and upgraded your PS3's firmware, like a guest or roommate, without your knowledge or permission.
    - a3camero 15y ago
      It's really a spectrum of enforceability. It doesn't matter whether it's ironclad. The idea is to discourage suits and to have something to point to when people try to sue you. It may not work but it might help. There are many issues of enforceability and this is one of them (although do you find that argument very convincing? You'd need to be able to point to someone and have some reason for why it was them and not you in order to be convincing).
    - roc 15y ago
      The problem with arbitration is legal resource mismatch and sealed results. Each complainant would have to find, pay for and manage any suit or negotiation (bringing the likelihood of complaints escalating beyond the initial offer to near-zero). And even if a John Doe and his cousin-lawyer managed to dig up a smoking gun, no-one else would know about it. So each individual would go through the process ignorant of other results, while the Corporation builds experience and additional strategic advantage dealing with the situation over and over again. If you approach class-action lawsuits from the standpoint of "what good comes of it for the individual" there's not a big change and I've heard that we could expect more people (who put up with the process) would be more likely to get some award and that such an award is likely to be higher than what they'd get from a class-action suit. [1] But if you approach class-action lawsuits from the standpoint of "what punishment does the misbehaving corporation suffer", mandatory individual arbitration is a tragedy. [2] It's implausible for the legal investigation into the corporation to approach the same level and implausible for the net penalty to even remotely approach that of a class action suit. The corporation is already heavily favored in any legal battle and individual arbitration simply compounds that advantage. And PR damage done from having said bad behavior exposed to the market at large is no longer a concern. In short: the penalty for misbehavior is massively reduced. As to "how do you know the end-user agreed to that": click-through EULAs have also been upheld by US courts for some time. Though I don't believe the SCOTUS has addressed them directly just yet. [1] I've read that multiple studies have found arbitration as having a higher and more frequent payout rate for complainants than class action lawsuits. I won't vouch for that position, but I don't take issue with it, as those results are largely irrelevant from my viewpoint. [2] Yes, there is a ton of progress that could be made on the question of how that penalty gets distributed. But I believe it's far more important to address that issue on its own than to effectively end class-action suits.
- wastedbrains 15y ago
  Seriously any agreement that waives the right to sue, is very likely to not be held up in a court of law.
- miratom 15y ago
  This really isn't any different than any credit card application. The arbitration clause is buried in the fine print of those as well.
mathgladiator 15y ago
This is so bullshit! Basically, leaves non-security-aware people out in the cold. Instead of trying to champion good security practices and locking down their shit, they are saying "this is a glory hole, buyer beware" in a document that no one reads. Sigh
- brador 15y ago
  Why use a Ps3 when Xbox has the same titles and a serious security team?
  - younata 15y ago
    Because Microsoft is teh suxxors! </sarcasm>
  - qx24b 15y ago
    The reason I bought a ps3 instead of an xbox was because of the exclusive titles (mainly mgs4).
  - sbochins 15y ago
    Xbox doesn't have the uncharted games, metal gear solid, demon souls, etc.
  - elliottcarlson 15y ago
    Some people prefer the PS3 - I do. No fanboyism etc, I just have been a loyal Playstation user since the start and have every one of the consoles - and there are major issues I have with the Xbox line - but those are my personal opinions. It sucks that Sony has been mismanaging all of this and definitely took shortcuts in inappropriate places - and instead of improving on those issues they are just making things worth with bad PR. I hope they can change that in the future, as I would still be purchasing a PS4 when that became available - unless they really don't get a clue and make things even worse.
    - brador 15y ago
      "loyal playstation user". Why? I mean, I hear this all the time with banks. Customers come in expecting an amazing mortgage rate with their shitty credit scores because they've always been a "loyal customer". We have to try to explain that loyalty has little value to the bank, other than lifetime value, which is already factored into the pricing. For the playstation/xbox, go where the fun is. Don't support a company out of misplaced "loyalty" because in the end, it just slows free market progression.
francescolaffi 15y ago
ansy comment here http://news.ycombinator.com/item?id=3000383 http://news.ycombinator.com/item?id=3000383 is clearer then both articles in my opinion.
HannibalLecter 15y ago
Who cares? They have such a bad reputation with security that only a fool would give them usable info. What's left? Downtime? Don't play their games or use their network if you don't like it. They lose in the end not you. Identity theft? You're stupid if that happened to you. (used the same password for PSN as home email, bank info... etc, gave them your credit card and didn't cancel it immediately...) What's left to possibly sue about?
username3 15y ago
That means we can sue over prior security breaches?
- burgerbrain 15y ago
  You can sue your neighbors nonexistent cat for assassinating Elvis.
gentle 15y ago
I'm sure this makes perfect sense to their legal department, but it's yet another reason why I'll never buy another Sony product.
- marshray 15y ago
  I actually feel a little bit bad for the Japanese on this point. One can imagine them wanting to expand out of designing and manufacturing great value televisions and hi-fi components, coming to America to see how to do business here, and falling in with a pack of LA entertainment industry lawyers who steer them down the path to moral ruin. I'm sure it didn't actually happen that way, but it's funny how it fits the observed behavior if you look at it a certain way. It's not like people would be any happier with them if they'd kept exactly the same set of business practices as goes on in Japan.
Gring 15y ago
As an answer, Sony headquarters should be enclosed in a huge airtight balloon and only let breathing air in if they agree to stop fucking people.
- john-n 15y ago
  Useful contribution to the discussion.
onosendai 15y ago
They're essentially confirming that their systems continue to be insecure and guaranteeing that your personal information will be leaked to third parties again in the future. Thanks for the clarification Sony.
- dasil003 15y ago
  Yes. I understand that lawyers in a big corporation have a big responsibility to minimize liability because it measures in the billions. In this case they totally failed to take into account the direct damage this will do to their brand perception. If the press decides to pursue this, it's going to hurt them badly.
  - cageface 15y ago
    Sony doesn't seem to have much of a brand left to protect. Since the root kit debacle it's just been one thing after another. They seem actively customer-hostile.
    - dasil003 15y ago
      Brand per se has been dragged through the mud, but Playstation is still a very valuable property, particularly in Europe. Frankly they have a lot to lose with this nonsense.
- alexandros 15y ago
  Would you guarantee that any system you build/manage will be safe?
  - onosendai 15y ago
    I'm a sysadmin actually. No one can give that guarantee, but when I apply for a job I sure as hell don't put in the contract that I'm not liable for any security breaches that might occur. If I leave an outdated version of SSH open to the internet, allow root login, password authentication, and set it to 'p4ssw0rd', then I'd fully expect to suffer some consequences.
tekacs 15y ago
Temporary solution: don't buy anything (i.e. give them credit card details) or store anything important (i.e. re-use a password) on PSN... Yes, I know, we all miss DLC...
- deleted 15y ago
  [deleted]
- oacgnol 15y ago
  Unforunately, if the "temporary solution" is to essentially stop using (and paying for) the service, then something is very wrong.
- wanorris 15y ago
  There are always gift cards if you want DLC. And really, if you use anonymous gift cards (or no payment information), you have the option to not even give them your real personal information, never mind your financial information. That way there's literally nothing to steal other than the account itself.
jonnathanson 15y ago
Yet another instance of the triumph of short-term CYAism over long-term customer strategy.
funkah 15y ago
Since the start, the only piece of info I've had in there is a mailinator address and a password I don't use anywhere else. They can get breached all day for all I care.
cryptoz 15y ago
The solution to this is simple and has been clear for years: stop doing business with Sony.
- ggchappell 15y ago
  It amazes me how little this seems to be grasped. Or even if people don't want to cut off Sony entirely, they could still think, "Ah, this is from Sony. That's a black mark. Do the positives really outweigh this negative?" But apparently few people do think this way. Therefore, to those who wonder why Sony doesn't quit all this nonsense with rootkits and DRM and privacy violations, etc., etc., the answer is, because it doesn't hurt them. People still do business with them anyway. (Kinda makes you wonder about all the "you must treat your customers well" articles you see on here.)
  - throwaway32 15y ago
    The gaming industry and the politics that surround it are some of the most toxic relationships I've ever seen. I dont think its a stretch to draw comparison between the relationship between and addict and a dealer.
    - DeanCollinsLCC 15y ago
      I'd like to know if you can return to Sony your PS3 AND all the game titles you've purchased for a full refund as they want to change the terms "after" you've purchased
- Natsu 15y ago
  I made that exact choice starting with the rootkit fiasco. Every bit of news I have seen since then has further validated that choice as a wise decision. And more than once, I have physically put a product back on the shelf when I realized it was made by Sony, so it is costing them business, at least from me. I estimate that my decision has cost them at least $2,000 so far, most of that being when I went for non-Sony TVs.
  - 15y ago
zalthor 15y ago
Wow. So let me get this straight. I can start a service, that people pay money to use. I also tell them that their credit card / personal information may not be secure and if they want to use the service that they already paid for, they have to accept that I am not liable for its security and if (when) this information does get stolen, I can give them a coupon and get way with it? Please tell me I'm wrong. This can't be legal.
wavephorm 15y ago
I thought this was always the case, basically everywhere. This is what EULA's are for.
artursapek 15y ago
This is the first news I've read of Sony reacting in any way to those hacks. Great press for them. Hopefully they're not storing these waivers in plaintext.
voidnothings 15y ago
They don't give a damn.
robert_nsu 15y ago
I'm not an expert in these matters, but I am interested to see how this will be interpreted under Louisiana's redhibition laws.
ltamake 15y ago
Wait, can't a EULA be invalidated if it's deemed too extraneous? I remember something about that happening in a Microsoft case...
falcolas 15y ago
You can opt out of the arbitration clause by sending a snail-mail notification of your choice to Sony. From the associated Ars Technica article[1]: IF YOU DO NOT WISH TO BE BOUND BY THE BINDING ARBITRATION AND CLASS ACTION WAIVER IN THIS SECTION 15, YOU MUST NOTIFY SNEI IN WRITING WITHIN 30 DAYS OF THE DATE THAT YOU ACCEPT THIS AGREEMENT. YOUR WRITTEN NOTIFICATION MUST BE MAILED TO 6080 CENTER DRIVE, 10TH FLOOR, LOS ANGELES, CA 90045, ATTN: LEGAL DEPARTMENT/ARBITRATION AND MUST INCLUDE: (1) YOUR NAME, (2) YOUR ADDRESS, (3) YOUR PSN ACCOUNT NUMBER, IF YOU HAVE ONE, AND (4) A CLEAR STATEMENT THAT YOU DO NOT WISH TO RESOLVE DISPUTES WITH ANY SONY ENTITY THROUGH ARBITRATION. [1] http://arstechnica.com/gaming/news/2011/09/mandatory-ps3-update-removes-right-to-join-in-a-class-action-lawsuit.ars http://arstechnica.com/gaming/news/2011/09/mandatory-ps3-upd...
- Maakuth 15y ago
  Do you actually mean this kind of bullshit is legally sound in the US? Whoah. IANAL, but in Europe most of the EULA clauses are considered invalid due to consumer protection code and this sort of thing definitely would fall in to that category.
  - falcolas 15y ago
    Other folks in this thread have gone into more detail, but the courts have indicated that EULAs with arbitration clauses are typically considered legal.
    - archangel_one 15y ago
      Even in a case like this where it is introduced after the fact? ie. the customers have already paid hundreds of dollars for their PS3 and games etc, and are later told they have to give up more rights if they want to keep using it. That seems worse to me than just the presence of this clause.
      - dhimes 15y ago
        This is a very bothersome arrangement that is popping up all over: changing the contract after it's signed. Consider mobile phones, for instance: You have entered a two-year agreement with AT&T because of the iPhone. Then Apple changes its terms-of-service. Suppose you don't agree? You can stop using the phone, but you are still bound to your AT&T contract.
psychopaf 15y ago
Sony took this from the Guide "How to write abusive and unfair contracts". Seriously, it will be interesting to see how the class action lawyers will deal with this: I'm not sure the judge will like that kind of shadow manoeuvering, where the consumers see nothing coming.
Pynkrabbit 15y ago
The work around to this would be to not put any valuable Personally Identifiable Information on Sony's network. You can use a proxy credit card number. Set up an email address that is not connected to any of your other accounts and use a unique password. That way if your data gets compromised you wont really lose anything... But basically they are saying that they are not willing to put their reputation and money behind their own business which makes you wonder....
daimyoyo 15y ago
Thank you, Sony for yet again reminding me why I refuse to spend any money on your products.
tlrobinson 15y ago
I hope there's some way PS3 owners can sue Sony for forcing them to waive their right to sue them.
Yhippa 15y ago
The average customer will subconsciously weigh the cost of enjoyment from using the PSN against the opportunity cost of a security breach to them. After making that calculation most will choose to waive their rights.
ansy 15y ago
These are my comments from an earlier thread on this story: IANAL, but arbitration clauses are standard in contracts[1] at least in the United States. Arbitration is generally seen as preferred because suing people in court is actually very expensive for the plaintiff, the defendant, and the court system. In Sony's favor, Sony excluded small claims. So for pretty much everyone this arbitration clause is meaningless. The limit for small claims is in the thousands of dollars depending on state [2]. The circumstances where Sony would be liable for more than a few thousand to a single consumer would have to be pretty extraordinary. And yes, this includes losses due to identity theft. Although the expenses due to fraud can be high, the out of pocket damages to the individual are generally very low. As of 2006 the average out of pocket expenses were about $422 and on a downward trend [3]. Keep in mind that the federal government limits liability for credit card fraud to only $50 in the United States [4]. And most credit card companies actually limit the liability to $0. The actual costs of fraud end up getting absorbed by businesses as the financial institutions try to unwind the transactions as best it can. Also in Sony's favor, Sony did not choose to use the arbitration clause to set an onerous jurisdiction. Sony could have said all arbitration needed to take place in a specific city in the middle of nowhere. Sony didn't even pick the location of its headquarters; you can pick any jurisdiction. Most arbitration clauses I've seen set a jurisdiction that favors the contract writer, so I'd say this puts Sony in a decent light for not doing the same. Likewise, Sony does not cap damages awarded through arbitration. It could have easily set the maximum damages to some amount that would make arbitration a non-starter compared to small claims. If you really wanted to find fault with Sony's particular arbitration clause, it would be that neither side can appeal the decision of the arbitration panel to a higher court. But keep in mind this cuts both ways, and it really isn't unusual. It is even endorsed in the United States. I should also note that arbitration clauses can be voided if the panel can be proven to be biased. So this isn't necessarily a license for Sony to circumvent the law, at least against a well funded opponent. And anyone with the balls to sue Sony for any serious amount of money would be a well funded opponent. NB. I understand arbitration clauses such as this may not be legal in some countries such as Germany. Whether that is good or bad I can't say. I'm sure the Germans thought it was good, though. [1] http://en.wikipedia.org/wiki/Arbitration_clause http://en.wikipedia.org/wiki/Arbitration_clause [2] http://www.nolo.com/legal-encyclopedia/small-claims-suits-how-much-30031.html http://www.nolo.com/legal-encyclopedia/small-claims-suits-ho... [3] http://www.bbbonline.org/idtheft/safetyquiz.asp http://www.bbbonline.org/idtheft/safetyquiz.asp [4] http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm
hammock 15y ago
Devil's advocate here. Given that one (among others) of the motivations to hack Sony is to harm them in the press and financially, is it possible that forbidding gamers from class-action suing - and therefore eliminating the possibility Sony would be fucked over by a large settlement - could REDUCE the incentive for hackers to break Sony?
- danssig 15y ago
  Why would this reduce anything? If anything I would expect this sort of customer bullying to get them targeted even more. After all, if customers have their credit card info stolen, get robbed and then can't even sue Sony for incompetence then that should make them less likely to spend money with Sony, no?
gorger 15y ago
Thank you for capitulating to the hackers Sony! You know you're second class now...

288 points by sambeau 15y ago

This shouldn't even be legal. Since it probably is; I think these days most people are probably buying a PS3 for PSN so if users can no longer access it they should bring the device back and demand their money bag. If Sony gets away with this expect more companies to follow suit.

andrewgodwin 15y ago
I'm not even sure it is legal in the UK - we have laws against "unfair contracts" [1], and there are also some statutory consumer protections that can't be waived. Of course, this is about security breaches, and IANAL, but I'd say this doesn't stop all potential lawsuits. [1] http://www.oft.gov.uk/about-the-oft/legal-powers/legal/unfair-terms/guidance http://www.oft.gov.uk/about-the-oft/legal-powers/legal/unfai...
- ugh 15y ago
  It’s complicated but I think many countries have pretty strong protections for consumers against unusual or unexpected clauses in contracts. I would be very surprised if this part of the terms would be enforceable, for example, in Germany.
  - gavinballard 15y ago
    The title of this article is somewhat misleading. A clause that prevented any right of action whatsoever would most likely be illegal in many countries (including, I think, all EU countries, the US and Australia/NZ). However, "binding arbitration" clauses which require parties to submit to alternative dispute resolution procedures before any legal action is taken are actually quite common (perhaps more common in Aus/NZ, the UK and the EU than in the US?). They're a common feature of mobile phone contracts, internet contracts, et cetera. Edit: I see this question has been given excellent treatment here: http://news.ycombinator.com/item?id=3001086 http://news.ycombinator.com/item?id=3001086
    - tnorthcutt 15y ago
      Binding arbitration clauses are quite common in the US, as well.
- sneak 15y ago
  The only people qualified to determine whether a contract is fair or not are the parties that do or do not sign it.
  - dhimes 15y ago
    I completely disagree. Being able to determine whether or not a contract is fair depends on domain knowledge. In the US anyway, being able to sign a contract is no indicator of domain knowledge. It is dependent on age and, if you represent another entity, your status as an agent for that entity.
    - sneak 15y ago
      Agreed. However, even with that domain knowledge, an outside party cannot determine for one of the parties whether or not they find it "fair" or not. This is not the role of government. It's common knowledge that contracts require domain knowledge, and if you proceed without it, it's akin to riding a motorcycle without a helmet, eating foods fried in trans fats, or driving a car without a seatbelt. Oh, wait. Nevermind.
roc 15y ago
The SCOTUS recently affirmed that not only are such clauses legal, but that individual States cannot pass laws to forbid them. http://www.scotusblog.com/case-files/cases/att-mobility-v-concepcion/ http://www.scotusblog.com/case-files/cases/att-mobility-v-co...
- deleted 15y ago
  [deleted]
- dgallagher 15y ago
  If I read that correctly (not a lawyer), SCOTUS ruled that an agreement prohibiting class-action lawsuits is legal if both parties agreed to use individual-arbitration instead. So you can still sue them individually in court, or go through the arbitration process, to grieve a claim against them. My question is, how do you know the end-user agreed to that? You have no signature, video, or audio proof. PSN accounts generally remain logged-in, and it's possible someone other than you agreed to the EULA and upgraded your PS3's firmware, like a guest or roommate, without your knowledge or permission.
  - a3camero 15y ago
    It's really a spectrum of enforceability. It doesn't matter whether it's ironclad. The idea is to discourage suits and to have something to point to when people try to sue you. It may not work but it might help. There are many issues of enforceability and this is one of them (although do you find that argument very convincing? You'd need to be able to point to someone and have some reason for why it was them and not you in order to be convincing).
  - roc 15y ago
    The problem with arbitration is legal resource mismatch and sealed results. Each complainant would have to find, pay for and manage any suit or negotiation (bringing the likelihood of complaints escalating beyond the initial offer to near-zero). And even if a John Doe and his cousin-lawyer managed to dig up a smoking gun, no-one else would know about it. So each individual would go through the process ignorant of other results, while the Corporation builds experience and additional strategic advantage dealing with the situation over and over again. If you approach class-action lawsuits from the standpoint of "what good comes of it for the individual" there's not a big change and I've heard that we could expect more people (who put up with the process) would be more likely to get some award and that such an award is likely to be higher than what they'd get from a class-action suit. [1] But if you approach class-action lawsuits from the standpoint of "what punishment does the misbehaving corporation suffer", mandatory individual arbitration is a tragedy. [2] It's implausible for the legal investigation into the corporation to approach the same level and implausible for the net penalty to even remotely approach that of a class action suit. The corporation is already heavily favored in any legal battle and individual arbitration simply compounds that advantage. And PR damage done from having said bad behavior exposed to the market at large is no longer a concern. In short: the penalty for misbehavior is massively reduced. As to "how do you know the end-user agreed to that": click-through EULAs have also been upheld by US courts for some time. Though I don't believe the SCOTUS has addressed them directly just yet. [1] I've read that multiple studies have found arbitration as having a higher and more frequent payout rate for complainants than class action lawsuits. I won't vouch for that position, but I don't take issue with it, as those results are largely irrelevant from my viewpoint. [2] Yes, there is a ton of progress that could be made on the question of how that penalty gets distributed. But I believe it's far more important to address that issue on its own than to effectively end class-action suits.
wastedbrains 15y ago
Seriously any agreement that waives the right to sue, is very likely to not be held up in a court of law.
miratom 15y ago
This really isn't any different than any credit card application. The arbitration clause is buried in the fine print of those as well.

mathgladiator 15y ago

This is so bullshit! Basically, leaves non-security-aware people out in the cold. Instead of trying to champion good security practices and locking down their shit, they are saying "this is a glory hole, buyer beware" in a document that no one reads. Sigh

brador 15y ago
Why use a Ps3 when Xbox has the same titles and a serious security team?
- younata 15y ago
  Because Microsoft is teh suxxors! </sarcasm>
- qx24b 15y ago
  The reason I bought a ps3 instead of an xbox was because of the exclusive titles (mainly mgs4).
- sbochins 15y ago
  Xbox doesn't have the uncharted games, metal gear solid, demon souls, etc.
- elliottcarlson 15y ago
  Some people prefer the PS3 - I do. No fanboyism etc, I just have been a loyal Playstation user since the start and have every one of the consoles - and there are major issues I have with the Xbox line - but those are my personal opinions. It sucks that Sony has been mismanaging all of this and definitely took shortcuts in inappropriate places - and instead of improving on those issues they are just making things worth with bad PR. I hope they can change that in the future, as I would still be purchasing a PS4 when that became available - unless they really don't get a clue and make things even worse.
  - brador 15y ago
    "loyal playstation user". Why? I mean, I hear this all the time with banks. Customers come in expecting an amazing mortgage rate with their shitty credit scores because they've always been a "loyal customer". We have to try to explain that loyalty has little value to the bank, other than lifetime value, which is already factored into the pricing. For the playstation/xbox, go where the fun is. Don't support a company out of misplaced "loyalty" because in the end, it just slows free market progression.

francescolaffi 15y ago

ansy comment here http://news.ycombinator.com/item?id=3000383 http://news.ycombinator.com/item?id=3000383 is clearer then both articles in my opinion.

HannibalLecter 15y ago

Who cares? They have such a bad reputation with security that only a fool would give them usable info. What's left? Downtime? Don't play their games or use their network if you don't like it. They lose in the end not you. Identity theft? You're stupid if that happened to you. (used the same password for PSN as home email, bank info... etc, gave them your credit card and didn't cancel it immediately...) What's left to possibly sue about?

username3 15y ago

That means we can sue over prior security breaches?

burgerbrain 15y ago
You can sue your neighbors nonexistent cat for assassinating Elvis.

gentle 15y ago

I'm sure this makes perfect sense to their legal department, but it's yet another reason why I'll never buy another Sony product.

marshray 15y ago
I actually feel a little bit bad for the Japanese on this point. One can imagine them wanting to expand out of designing and manufacturing great value televisions and hi-fi components, coming to America to see how to do business here, and falling in with a pack of LA entertainment industry lawyers who steer them down the path to moral ruin. I'm sure it didn't actually happen that way, but it's funny how it fits the observed behavior if you look at it a certain way. It's not like people would be any happier with them if they'd kept exactly the same set of business practices as goes on in Japan.

Gring 15y ago

As an answer, Sony headquarters should be enclosed in a huge airtight balloon and only let breathing air in if they agree to stop fucking people.

john-n 15y ago
Useful contribution to the discussion.

onosendai 15y ago

They're essentially confirming that their systems continue to be insecure and guaranteeing that your personal information will be leaked to third parties again in the future. Thanks for the clarification Sony.

dasil003 15y ago
Yes. I understand that lawyers in a big corporation have a big responsibility to minimize liability because it measures in the billions. In this case they totally failed to take into account the direct damage this will do to their brand perception. If the press decides to pursue this, it's going to hurt them badly.
- cageface 15y ago
  Sony doesn't seem to have much of a brand left to protect. Since the root kit debacle it's just been one thing after another. They seem actively customer-hostile.
  - dasil003 15y ago
    Brand per se has been dragged through the mud, but Playstation is still a very valuable property, particularly in Europe. Frankly they have a lot to lose with this nonsense.
alexandros 15y ago
Would you guarantee that any system you build/manage will be safe?
- onosendai 15y ago
  I'm a sysadmin actually. No one can give that guarantee, but when I apply for a job I sure as hell don't put in the contract that I'm not liable for any security breaches that might occur. If I leave an outdated version of SSH open to the internet, allow root login, password authentication, and set it to 'p4ssw0rd', then I'd fully expect to suffer some consequences.

tekacs 15y ago

Temporary solution: don't buy anything (i.e. give them credit card details) or store anything important (i.e. re-use a password) on PSN... Yes, I know, we all miss DLC...

deleted 15y ago
[deleted]
oacgnol 15y ago
Unforunately, if the "temporary solution" is to essentially stop using (and paying for) the service, then something is very wrong.
wanorris 15y ago
There are always gift cards if you want DLC. And really, if you use anonymous gift cards (or no payment information), you have the option to not even give them your real personal information, never mind your financial information. That way there's literally nothing to steal other than the account itself.

jonnathanson 15y ago

Yet another instance of the triumph of short-term CYAism over long-term customer strategy.

funkah 15y ago

Since the start, the only piece of info I've had in there is a mailinator address and a password I don't use anywhere else. They can get breached all day for all I care.

cryptoz 15y ago

The solution to this is simple and has been clear for years: stop doing business with Sony.

ggchappell 15y ago
It amazes me how little this seems to be grasped. Or even if people don't want to cut off Sony entirely, they could still think, "Ah, this is from Sony. That's a black mark. Do the positives really outweigh this negative?" But apparently few people do think this way. Therefore, to those who wonder why Sony doesn't quit all this nonsense with rootkits and DRM and privacy violations, etc., etc., the answer is, because it doesn't hurt them. People still do business with them anyway. (Kinda makes you wonder about all the "you must treat your customers well" articles you see on here.)
- throwaway32 15y ago
  The gaming industry and the politics that surround it are some of the most toxic relationships I've ever seen. I dont think its a stretch to draw comparison between the relationship between and addict and a dealer.
  - DeanCollinsLCC 15y ago
    I'd like to know if you can return to Sony your PS3 AND all the game titles you've purchased for a full refund as they want to change the terms "after" you've purchased
Natsu 15y ago
I made that exact choice starting with the rootkit fiasco. Every bit of news I have seen since then has further validated that choice as a wise decision. And more than once, I have physically put a product back on the shelf when I realized it was made by Sony, so it is costing them business, at least from me. I estimate that my decision has cost them at least $2,000 so far, most of that being when I went for non-Sony TVs.
- 15y ago

zalthor 15y ago

Wow. So let me get this straight. I can start a service, that people pay money to use. I also tell them that their credit card / personal information may not be secure and if they want to use the service that they already paid for, they have to accept that I am not liable for its security and if (when) this information does get stolen, I can give them a coupon and get way with it? Please tell me I'm wrong. This can't be legal.

wavephorm 15y ago

I thought this was always the case, basically everywhere. This is what EULA's are for.

artursapek 15y ago

This is the first news I've read of Sony reacting in any way to those hacks. Great press for them. Hopefully they're not storing these waivers in plaintext.

voidnothings 15y ago

They don't give a damn.

robert_nsu 15y ago

I'm not an expert in these matters, but I am interested to see how this will be interpreted under Louisiana's redhibition laws.

ltamake 15y ago

Wait, can't a EULA be invalidated if it's deemed too extraneous? I remember something about that happening in a Microsoft case...

falcolas 15y ago

You can opt out of the arbitration clause by sending a snail-mail notification of your choice to Sony. From the associated Ars Technica article[1]: IF YOU DO NOT WISH TO BE BOUND BY THE BINDING ARBITRATION AND CLASS ACTION WAIVER IN THIS SECTION 15, YOU MUST NOTIFY SNEI IN WRITING WITHIN 30 DAYS OF THE DATE THAT YOU ACCEPT THIS AGREEMENT. YOUR WRITTEN NOTIFICATION MUST BE MAILED TO 6080 CENTER DRIVE, 10TH FLOOR, LOS ANGELES, CA 90045, ATTN: LEGAL DEPARTMENT/ARBITRATION AND MUST INCLUDE: (1) YOUR NAME, (2) YOUR ADDRESS, (3) YOUR PSN ACCOUNT NUMBER, IF YOU HAVE ONE, AND (4) A CLEAR STATEMENT THAT YOU DO NOT WISH TO RESOLVE DISPUTES WITH ANY SONY ENTITY THROUGH ARBITRATION. [1] http://arstechnica.com/gaming/news/2011/09/mandatory-ps3-update-removes-right-to-join-in-a-class-action-lawsuit.ars http://arstechnica.com/gaming/news/2011/09/mandatory-ps3-upd...

Maakuth 15y ago
Do you actually mean this kind of bullshit is legally sound in the US? Whoah. IANAL, but in Europe most of the EULA clauses are considered invalid due to consumer protection code and this sort of thing definitely would fall in to that category.
- falcolas 15y ago
  Other folks in this thread have gone into more detail, but the courts have indicated that EULAs with arbitration clauses are typically considered legal.
  - archangel_one 15y ago
    Even in a case like this where it is introduced after the fact? ie. the customers have already paid hundreds of dollars for their PS3 and games etc, and are later told they have to give up more rights if they want to keep using it. That seems worse to me than just the presence of this clause.
    - dhimes 15y ago
      This is a very bothersome arrangement that is popping up all over: changing the contract after it's signed. Consider mobile phones, for instance: You have entered a two-year agreement with AT&T because of the iPhone. Then Apple changes its terms-of-service. Suppose you don't agree? You can stop using the phone, but you are still bound to your AT&T contract.

psychopaf 15y ago

Sony took this from the Guide "How to write abusive and unfair contracts". Seriously, it will be interesting to see how the class action lawyers will deal with this: I'm not sure the judge will like that kind of shadow manoeuvering, where the consumers see nothing coming.

Pynkrabbit 15y ago

The work around to this would be to not put any valuable Personally Identifiable Information on Sony's network. You can use a proxy credit card number. Set up an email address that is not connected to any of your other accounts and use a unique password. That way if your data gets compromised you wont really lose anything... But basically they are saying that they are not willing to put their reputation and money behind their own business which makes you wonder....

daimyoyo 15y ago

Thank you, Sony for yet again reminding me why I refuse to spend any money on your products.

tlrobinson 15y ago

I hope there's some way PS3 owners can sue Sony for forcing them to waive their right to sue them.

Yhippa 15y ago

The average customer will subconsciously weigh the cost of enjoyment from using the PSN against the opportunity cost of a security breach to them. After making that calculation most will choose to waive their rights.

ansy 15y ago

These are my comments from an earlier thread on this story: IANAL, but arbitration clauses are standard in contracts[1] at least in the United States. Arbitration is generally seen as preferred because suing people in court is actually very expensive for the plaintiff, the defendant, and the court system. In Sony's favor, Sony excluded small claims. So for pretty much everyone this arbitration clause is meaningless. The limit for small claims is in the thousands of dollars depending on state [2]. The circumstances where Sony would be liable for more than a few thousand to a single consumer would have to be pretty extraordinary. And yes, this includes losses due to identity theft. Although the expenses due to fraud can be high, the out of pocket damages to the individual are generally very low. As of 2006 the average out of pocket expenses were about $422 and on a downward trend [3]. Keep in mind that the federal government limits liability for credit card fraud to only $50 in the United States [4]. And most credit card companies actually limit the liability to $0. The actual costs of fraud end up getting absorbed by businesses as the financial institutions try to unwind the transactions as best it can. Also in Sony's favor, Sony did not choose to use the arbitration clause to set an onerous jurisdiction. Sony could have said all arbitration needed to take place in a specific city in the middle of nowhere. Sony didn't even pick the location of its headquarters; you can pick any jurisdiction. Most arbitration clauses I've seen set a jurisdiction that favors the contract writer, so I'd say this puts Sony in a decent light for not doing the same. Likewise, Sony does not cap damages awarded through arbitration. It could have easily set the maximum damages to some amount that would make arbitration a non-starter compared to small claims. If you really wanted to find fault with Sony's particular arbitration clause, it would be that neither side can appeal the decision of the arbitration panel to a higher court. But keep in mind this cuts both ways, and it really isn't unusual. It is even endorsed in the United States. I should also note that arbitration clauses can be voided if the panel can be proven to be biased. So this isn't necessarily a license for Sony to circumvent the law, at least against a well funded opponent. And anyone with the balls to sue Sony for any serious amount of money would be a well funded opponent. NB. I understand arbitration clauses such as this may not be legal in some countries such as Germany. Whether that is good or bad I can't say. I'm sure the Germans thought it was good, though. [1] http://en.wikipedia.org/wiki/Arbitration_clause http://en.wikipedia.org/wiki/Arbitration_clause [2] http://www.nolo.com/legal-encyclopedia/small-claims-suits-how-much-30031.html http://www.nolo.com/legal-encyclopedia/small-claims-suits-ho... [3] http://www.bbbonline.org/idtheft/safetyquiz.asp http://www.bbbonline.org/idtheft/safetyquiz.asp [4] http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm

hammock 15y ago

Devil's advocate here. Given that one (among others) of the motivations to hack Sony is to harm them in the press and financially, is it possible that forbidding gamers from class-action suing - and therefore eliminating the possibility Sony would be fucked over by a large settlement - could REDUCE the incentive for hackers to break Sony?

danssig 15y ago
Why would this reduce anything? If anything I would expect this sort of customer bullying to get them targeted even more. After all, if customers have their credit card info stolen, get robbed and then can't even sue Sony for incompetence then that should make them less likely to spend money with Sony, no?

gorger 15y ago

Thank you for capitulating to the hackers Sony! You know you're second class now...