UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF NEW YORKIn re SONY BMG CD TECHNOLOGIESLITIGATIONThis Document Relates To:
ALL ACTIONS.

x
:
:
:
:
:
:
:
x

Civil Action No. 1:05-cv-09575-NRB
CLASS ACTIONDECLARATION OF LARRY PONEMON IN
SUPPORT OF THE RICCIUTI CLASSREPRESENTATIVES’ MEMORANDUM OF
LAW IN SUPPORT OF MOTION FOR AN
AWARD OF ATTORNEYS’ FEES AND
REIMBURSEMENT OF EXPENSES

EXHIBIT B

Presents

National Spyware Study©

Conducted by Ponemon Institute, LLC
Report Issued May 17, 2005

This is a private and confidential document. Please do not quote without permission.

Private & Confidential Report

Page 2National Spyware Survey
Summary Report Prepared by Dr. Larry Ponemon, May 17, 2005

Sponsor: Unisys Corporation, Security Leadership Institute.
An overwhelming number of adult-aged Internet users believe they have had their computers
infected with spyware. Some report that in the past 12 months spyware-related problems havecost them approximately $50. If this cost is extrapolated to the entire population of Internet users,
the total monetary loss could reach hundreds of millions every year.
Despite the cost and other problems experienced as a result of spyware, a majority of Internet
users in this study don’t want any new anti-spyware laws passed that would prevent them fromdownloading free software such as music players, games or screen savers.
Sponsored by Unisys Corporation, the 2005 National Spyware Survey was conducted byPonemon Institute to learn what consumers know about spyware, how they believe spyware
differs from adware or researchware, how spyware has affected their computers and what they
think should be done to curtail this problem.
The Web-based survey was distributed to over 15,000 individuals who self-reported that they
have a dedicated laptop or desktop computer to spend at least one hour each day on the Internet.
In total, we received 1,944 usable responses. Please note that caution should be applied when
extrapolating sample results to the general population because of this specialized subject pool.
Internet Users Are Confused
An important finding from our research is that consumers have a hard time distinguishing
spyware from adware. As shown in Bar Chart 1, the survey asked respondents to indicate
whether they believed that the following statement is true or false.
“Both spyware and adware assist in gathering information about a person or organization andsends it to other interested parties. The difference is that you agree to download adware in
exchange for free software or other offers. Spyware is downloaded without your consent orawareness that it is on your computer collecting information about you.”
Bar Chart 1: Is the definition of spyware and adware correct?
70%

60%
51%
49%

50%

40%

30%

20%
Definition is True

Definition is False

Private & Confidential Report

Page 3

The above definition is considered correct; thus, a high false response suggests that respondents
failed to understand the basic differences between spyware and adware. As shown, 49% of
survey respondents believe the definition in the survey is not correct.
More than 84% of respondents believe they are victims of spyware and more than 42% admit tohaving “no idea” where it came from. Further, 61% did not recall giving their permission to
download adware and 97% did not recall giving permission to download spyware onto theirprimary computer. See Bar Chart 2.
Bar Chart 2: Do you remember giving permission to download adware or spyware?
97%

100%
80%
61%
60%
39%
40%
20%
3%
0%
Adw areSpyw areYes

No

It is interesting to note that when available most individuals admit that they do not read EULAs
because the language in the EULA is too complex and confusing. See Bar Chart 3.
Bar Chart 3: Do you read the EULA before downloading free software?
100%

87%

80%
60%
40%
20%

13%

0%
Yes

Yes

No

No

Bar Chart 4 provides a side-by-side comparison of respondent’s self-reporting reading
preferences for bank privacy notices, Web privacy policies, health care provider privacy policies
and EULAs. It shows that the percentage of those who do not read the EULA is comparable tothe percentages for not reading privacy notices and Web policies.

Private & Confidential Report

Page 4

Bar Chart 4: Comparison of EULA to other privacy-related policies
EULA for free
softw are13%

Privacy policy
from healthprovider12%

Privacy policy
from Web site

12%

Privacy noticefrom bank

19%

0%

5%

10%

15%

20%

Bar Chart 5 provides the percentage of self-reported spyware victims who experience (yes) or did
not experience (no) a monetary loss, productivity loss or serious inconvenience as a result of the
spyware infection.
Bar Chart 5: Spyware victims who report experiencing a monetary or productivity loss
100%
86%
80%

60%

40%

20%

14%

0%
Yes

Yes

No

No

Our results suggest that a majority of respondents do not understand the ad serving marketplace.
Accordingly, they do not know how “free” software programs earn profits for their suppliers. In
addition, they seem to want their cake and eat it too. Respondents believe free software should
be given with no strings attached such as the ability of the company to profile or track online
activities. For example, 48% reported that it is never acceptable to track their Internet activities.
SurveyAs part of the survey instrument review process, we sought input from a number of learned
sources including privacy advocates, ad software technologists and other experts.
The survey utilized a fixed cluster sampling frame. The target respondents were recruited basedon self-reported demographic criteria including familiarity with the Internet. Subjects were invited
to participate by e-mail.

Private & Confidential Report

Page 5

Respondents were given the following basic instructions before starting the survey process.
Dear Respondent:
We would like to learn what you think about software known as spyware and adware that is
downloaded onto computers. Please take about 15 minutes to respond to the survey.
Please refer your answers to the computer desktop or laptop that you most frequently use for
personal activities such as browsing the Internet.
All responses will remain completely confidential and no personally identifiable information will becollected. Thank you for your prompt response.

Items on the survey form were randomized or rotated to mitigate order effects. All completed
returns were evaluated for consistency and internal reliability before including in our database.
SampleFollowing are the response statistics and geographic distribution across the United States. In
total, 2,218 adult-aged Internet users submitted survey results. Of these responses, 274 (1.8%)
were deemed to be inconsistent or unreliable. This resulted in 1,944 usable surveys.
Our final sample represents 12.6% of the sampling frame. Please note that this response rate islower than earlier Web-based studies completed by us. This is most likely due to a shorter thannormal holdout period. Our survey field work was captured within 10 days. Non-response bias iscurrently being investigated and will be reported in a future report.
The following Pie Chart shows that the two most heavily represented regions include theNortheast and Mid-Atlantic regions of the United States.
Frequency of Respondents by Major U.S. Region

Sample Characteristics
Sample frame
Total responses
Total rejections
Net responses

Total
15413
2218
274
1944

Pct %
100.0%
14.4%
1.8%
12.6%

Geographic regions
Northeast
Mid-Atlantic
Southeast
West/PacificSouthwest
Mid-West
Total

Freq
386
374
301
299
256
328
1944

Pct%
20%
19%
15%
15%
13%
17%
100%

329

358

237
333
265

Northeast

Mid-Atlantic

277

Southeast

West/PacificSouthwest

Mid-West

Private & Confidential Report

Page 6

As noted before, our sampling frame is a subset of a larger set of clusters. By design, oursample represented those adults who: (1) owned or had control over their own computer (desktop
or laptop) and (2) used the Internet one or more hour each day. Hence, care needs be taken
when trying to generalize and apply these findings to all Internet users in the United States.
Detailed Findings
The actual survey frequencies and percentage frequencies are reported in tabular format.
Following are the two control questions about the operating system and Internet browsers of the
respondent’s primary computer.
Q1. What is your computer’s operating systemthat you use most of the time for Internet
browsing or shopping activities?
Microsoft Windows
Others
Total

Freq
1,777
167
1944

Pct%
91%
9%
100%

Q2. What is the browser that you typically use toaccess the Internet?
Internet Explorer
Netscape
Firefox
Others
Total

Freq
1,746
73
71
54
1,944

Pct%
90%
4%
4%
3%
100%

A majority (57%) of respondents state that they do not share primary computer with family
members or friends.
Q3. Do you share your computer with others,
such as family members or friends?
Yes
No
Total

Freq
841
1,103
1,944

Pct%
43%
57%
100%

The following question served as a test of respondents’ understanding of the main differences
between spyware and adware. Because the definition provided within our instrument is generally
considered correct by learned sources, a high false response indicates that respondents fail tounderstand the basic issues and nuances of spyware versus adware. As shown, 49% believethat this definition is false.
Q4. Both spyware and adware assist in gathering information
about a person or organization and send it to other interested
parties. The difference is that you agree to download adware in
exchange for free software or other offers. Spyware isdownloaded without your consent or awareness that it is on
your computer collecting information about you.
I believe the above definition is true
I believe the above definition is false
Total

Freq
1000
943
1943

Pct%
51%
49%
100%

Private & Confidential Report

Page 7

The following two questions assess the respondents’ understanding of ad delivery from cookies
and adware downloads.
Q5A. Are you aware if the Internet or software on
your computer sends you ads such as pop-ups orbanners?
Yes
No
Total

Freq
1713
231
1944

Pct%
88%
12%
100%

Q5B. Are you aware if ad software on yourcomputer sends you ads such as pop-ups orbanners?
Yes
No
Total

Freq
881
1061
1942

Pct%
45%
55%
100%

Questions 6 A to D were completed by those respondents stating Yes in the above item.
The next question shows that many subjects do not understand what adware does.
Q6A. What does this adware do? Please check
only one response.
I have no idea what this software does.
The software captures personal information.
The software captures information about myonline activities.
The software captures information from myemails and other stored documents
Total

Freq
492
111

Pct%
56%
13%

203

23%

74
880

8%
100%

The following question shows that many respondents do not recall giving permission to theadware company prior to downloading desktop software.
Q6B. Do you recall giving permission to have thisad software downloaded onto your computer?
Yes
No
Total

Freq
345
536
881

Pct%
39%
61%
100%

The next question shows that many respondents believe that adware negatively affects their
computer’s performance or reliability (as indicated by Yes or Unsure response).
Q6C. Does this ad software negatively affect yourcomputer’s performance or reliability?
Yes
Unsure
No
Total

Freq
321
288
270
879

Pct%
37%
33%
31%
100%

Private & Confidential Report

Page 8The following question shows how respondents define the performance or reliability problems
inherent in adware. Over 88% of these subjects believe that adware slows down their computer
performance. Over 31% believe that adware collects data from stored files such as e-mails anddocuments.
Q6D. Please check those issues that you
experienced as a result of ad software.
It slows down my computer.
It modifies certain computer or browser settings.
It turns off certain computer security settings.
It collects emails, records and files on mycomputer’s storage devices.
It hijacks my computer, directing it to perform
activities outside of my control.

Freq
534
133
158

Tot%
88%
22%
26%

186

31%

45

7%

Over 90% of respondents report that they download free software from the Internet.
Q7A. Have you ever downloaded free softwarefrom the Internet?
Yes
No
Total

Freq
1745
197
1,942

Pct%
90%
10%
100%

Following is the distribution of software most likely to be downloaded on the Internet for free.
Notice that music file sharing programs are the most commonly downloaded free software
programs. Games and screen savers are also popular.
Q7B. What type of free software was it (please check all that
apply)?
Screen saver

Freq
755

Tot%
43%

Music file sharing such as Napster, Morpheus, and Grokster
Anti-spam or pop-up blocker
Games
Search toolbar
Ring tones on cellular phone
Free telephone or VoIP service
Spyware removal tool
Web accelerator

1056
354
977
347
128
78
319
244

61%
20%
56%
20%
7%
4%
18%
14%

The next question shows that 87% of subjects admit that they do not read the EULA prior toloading free software.
Q7C. Before you download free software programs from theInternet, do you generally read the legal terminology presented toyou prior to the download (also known as the End User License
Agreement or EULA)?
Yes (proceed to Q8)
No
Total

Freq
251
1693
1,944

Pct%
13%
87%
100%

Private & Confidential Report

Page 9The following question attempts to assess why respondents don’t read the EULA. As can beseen, the two most common reasons are that the document is too long and too complex.
Q7D. Why don’t you read the EULA?
It takes too long to read the EULA.
The EULA language is too complicated or isdifficult to understand.
I trust the software company so it is notnecessary to read the agreement.
I can get the information directly from thesoftware after downloading it.

Freq
1488

Tot%
88%

1314

78%

115

7%

203

12%

The next question tries to ascertain what Internet software and ad marketing companies can do toencourage a higher reading rate among those downloading free products. Respondents suggestthat the best way to improve readability is to make the EULA shorter and place it on one Web
page or screen that does not require a scrolling option.
Q7E. What could be done to encourage you toread the EULA before downloading free software(please check all that apply)?
Make the EULA easier to read.
Place a shorter EULA on one screen rather thanhaving to click to a separate document and thenscroll down.
Require the EULA to be printed prior to allowing
the free software from downloading.
Provide EULA highlights that provide warning
about serious risks to you.
Nothing can be done that will cause me to readthe EULA.

Freq
1213

Tot%
72%

1108

65%

513

30%

607

36%

455

27%

The following question provides the respondents’ opinion to key statements concerning adware,
spyware and free software. A lower average rank suggests that subjects tend to agree with thestatement. A higher average rank implies disagreement with the statement.
Q8. Place a number 1 to 5 next to each statement that best indicates youropinion about the statement presented below. Please use the following 1 to
5 scale to define your opinion about statements in Q8 and Q9.
I like having the ability to obtain free software on the Internet.
I like having access to free search engines on the Internet.
I don’t mind ad software on my computer if it does not collect information that
identifies me or my family.
I don’t mind ad software on my computer even if it collects information that
identifies me or my family.
I don’t mind ad software on my computer as long as I’m given advancewarning or notice before I download free software on the Internet.
I generally expect to get ad software on my computer every time I download
a free software product from the Internet.
I would be willing to pay a small price or fee for software that I received for
free, as long as this guarantees that I don’t get ad software as part of thedownload.

Average
Rank
2.03
2.36

Order
1
2

3.59

5

4.34

7

3.07

4

2.43

3

3.64

6

Private & Confidential Report

Page 10

As shown above, subjects like to obtain “free software” online (average rank=2.03). They don’t
want to pay, even a small amount, to prevent adware or spyware. Respondents do not wantadware to collect information that identifies them and their families (average rank=4.34).
The following question provides the respondents’ opinion to key statements concerning the needfor new regulations about spyware. As indicated by an average rank of 2.20, respondents do notwant anti-spyware regulations that limit their ability to get free software on the Internet. They are
uncertain (average rank of 3.06) about the need for new laws to regulate the Internet.
Q9. What do you think about government regulations that protect
consumers from spyware? Please place a number 1 to 5 next to eachstatement that best indicates what you think.
There is a need for a new law to prevent spyware from downloading
onto my computer, even if it prevents me from obtaining free software.
There is a need for a new law to prevent adware from downloading onto
my computer, even if it prevents me from obtaining free software.
There is no need for additional laws that regulate the Internet.
New anti-spyware laws should not prevent me from downloading free
software.

Average
Rank

Order

2.67

2

3.32
3.06

4
3

2.20

1

The next question provides a relative comparison of the respondents’ reading preferences for a
EULA in relation to three commonly encountered privacy policies. As shown, while a majority of
respondents admit to not reading the EULA, they also don’t read privacy notices or Web policies.
Q10. Place a 1=True or 2=False next to eachstatement to best indicate or reading preference.
I usually read the privacy notice provided by mybank or other financial service companies.
I usually read the privacy policy posted on myfavorite Web sites.
I usually read the privacy policy provided by myhealth care provider or physician.
I usually read the end user license agreements(EULA) provided by a software company.

True

Pct%

369

19%

236

12%

238

12%

249

13%

The following item attempts to assess respondents’ understanding of Internet economics
specifically regarding how free software companies earn a profit.
Q11. How do companies that download free software over the Internet
earn enough revenues to stay in business? Please check what you
believe to be best choice.
The free software company obtains a commission from the ad software
company for each successful download.
The free software company asks you to purchase upgrades or related
products.
The free software company charges a fee from end-users after a trial
period.
The software companies receive voluntary donations from end-users.
I have no idea.
Total

Freq

Pct%

348

18%

312

16%

341

18%

58
881
1940

3%
45%
100%

Private & Confidential Report

Page 11

As noted above, over 45% admit that they do not have any idea whatsoever. The pattern of
responses to Q11 suggests that subjects do not have a clear understanding of the Internet or adserving marketplace.
The next item ask respondents’ to state their belief regarding the role that anti-virus software or
pop-up blockers play in protecting them from spyware. Responses suggest that subjects do nothold a consistent view about how these solutions resolve the spyware problem.
Q12. Do you believe that anti-virus software or
pop-up blockers will protect you from spyware?
Yes
No
Total

Freq
893
1048
1941

Pct%
46%
54%
100%

The following question asks respondents to state their beliefs about being tracked when browsing
the Internet. Over 62% of subjects believe that they are tracked.
Q13A. Do you believe Internet advertisers,
publishers and other content providers currently
track your activities and movement across theInternet?
Yes
No
Total

Freq
1201
739
1940

Pct%
62%
38%
100%

The following table shows that 48% of subjects believe that it is never acceptable to have theiractivities tracked on the Internet.
Q13B. When is it acceptable to track your activities and movement
across the Internet?
To perform research that improves a company’s products orservices.
To conduct surveillance for national security purposes.
To send ads that provide offers that you might find interesting or
relevant.
To provide information or content that fits your interests, tastes andpreferences.
It is never acceptable to track my activities on the Internet.

Freq

Tot%

519
454

43%
38%

442

37%

501
579

42%
48%

The next several items report the respondents’ experiences with spyware. As shown, over 84%
of respondents believe that they have been the victim of spyware on their computer.
Q14A. Has your computer ever been infectedwith spyware?
Yes
No
Total

Freq
1630
309
1939

Pct%
84%
16%
100%

With respect to spyware victims, over 97% do not recall giving their permission to download
software onto their computer.

Private & Confidential Report

Q14B. Do you recall giving permission to
download the spyware software on yourcomputer?
Yes
No
Total

Page 12

Freq
56
1572
1628

Pct%
3%
97%
100%

The next table shows that over 42% of subjects have no clue as to how spyware was downloaded
onto their computer. Another 38% believe that this was the consequence of a free software
download.
Q14C. How did your computer become infectedwith spyware?
A friend or family member was using mycomputer.
I downloaded free software.
It downloaded automatically when I visited aparticular Web site.
It was already loaded when I bought mycomputer.
I have no idea.
Total

Freq

Pct%

85
621

5%
38%

134

8%

107
682
1629

7%
42%
100%

Over 43% of subjects became aware of spyware through security software alerts or anti-spyware
software. Over 32% of respondents just had a gut feel or instinct that their computer was infectedwith this illegal software.
Q14D. How did you find out that you had
spyware on your computer?
Warning from anti-virus or anti-spyware software
A computer expert told me
I just knew based on my computer’s performanceor reliability
Unsure
Total

Freq
706
157

Pct%
43%
10%

520
246
1629

32%
15%
100%

About 35% of subjects state that they could not remove the spyware. Another 22% stated thatthey used an anti-spyware (or security software tool) to remove this illegal software. Only 21%
state that they used un-install utilities to remove the spyware from their computer system.
Q14E. How did you remove the spyware on yourcomputer?
I uninstalled the software
I used anti-spyware software
I hired a computer expert
I could not remove the spyware software
I did not try to remove the spyware software
Total

Freq
341
354
154
568
211
1628

Pct%
21%
22%
9%
35%
13%
100%

For those who performed a un-install procedure to get rid of the spyware from their computer
system, over 36% report that this was not difficult to do.

Private & Confidential Report

Q14F. How difficult was the un-installing task foryou?
Very difficult
DifficultModerately difficult
Not difficult
Easy
Total

Page 13

Freq
51
67
86
123
13
340

Pct%
15%
20%
25%
36%
4%
100%

The next items attempt to determine the approximate monetary loss and productivity (time) loss
resulting from spyware over the past 12 months. As shown, over 86% of those who report having
been infected with spyware believe they have experienced a monetary loss, a productivity loss orsome other inconveniences.
Q15A. Has spyware on your desktop or laptop
caused you to suffer a monetary loss, a
productivity loss or inconvenience?
Yes
No
Total

Freq
1401
229
1630

Pct%
86%
14%
100%

The following table shows that the most common form of loss resulting from spyware infection isa decline in productivity (as reported by about 87% of respondents). Over 26% of subjects statedthat they purchased security solutions to respond to spyware threats. Another 14% stated thatthey hired computer consultants to repair system.
Q15B. What best describes this negative impact(check all that applies)?
Purchased anti-spyware or anti-virus software.
Hired a computer pro to fix my desktop or laptop.
Replaced my computer with new hardware.
Could not use previously downloaded software.
Experienced productivity losses.
Purchased additional protection services from my
ISP or DSL provider.
Leakage of my personal information without
consent or knowledge.
Monetary damages resulting from criminal
activity.

Freq
371
200
28
475
1214

Pct%
26%
14%
2%
34%
87%

128

9%

51

4%

10

1%

The next question shows that about 85% of respondents did not experience any monetary (out of
pocket) losses resulting from spyware infection. On average, for the 205 subjects (15%) in thisstudy who did experience a monetary loss, the average amount of the loss is $49.70 (based on
extrapolation from the table below) over the past 12 month period.

Private & Confidential Report

Page 14

Q15C. Approximately, what is the monetary or outof-pocket loss over the past 12 months as a result of
having spyware on your computer? Please checkthe range that is closet to the total loss experienced.
No Monetary Loss
Between $0 and $10
Between $10 and $20
Between $20 and $50
Between $50 and $100
Between $100 and $200
Over $200

Freq
1190
23
66
60
31
12
13

Pct%
85%
2%
5%
4%
2%
1%
1%

Total
Number of people with self-reported monetary loss

1395
205

100%
15%

Average
Cost
5
15
35
75
150
220
Average

Ext
Cost
115
990
2,100
2,325
1,800
2,860
$49.7

The next question shows that the vast majority of respondents report that they spent time to deal
with their spyware infection. For the 1,066 subjects (76%) who reported some time loss, theaverage amount of time spent is approximately 1.6 hours per person over the past 12 month
period.
Q15D. Approximately, how much time did you spend
over the past 12 months as a result of having to deal
with spyware on your computer? Please check therange that is closet to the total time spent by you.
No time
Between 0 and 60 minutes
Between 1 to 5 hours
Between 5 to 10 hours
Between 10 to 50 hours
Between 50 to 100 hours
Over 100 hours

Freq
336
899
123
19
15
7
3

Pct%
24%
64%
9%
1%
1%
0%
0%

Total
Number of people who self-reported time loss

1402
1066

100%
76%

Avg
Time
1
3
8
30
75
120

Ext
Time

Average

1.6 Hrs

450
308
143
450
525
360

Recommendations
As we have noted, the respondents in our study spend a significant time on the Internet. Despite
their experience, 56% of respondents have no idea what adware does and only 23% believe thatit captures information about their online activities. This confusion is further exacerbated by theexistence of “bad apples” populating the ad network space.
Privacy advocate groups, government and politicians are very interested in this issue. However,the solution to the spyware problem might not be in new laws. Instead companies in the ad
network space should consider becoming proactive in helping consumers gain more control overtheir online experience. This can include obtaining consumers’ affirmative consent to thecollection and use of their data, giving consumers clear and conspicuous notice about the
network’s collection and use of consumers’ information and making the privacy policy and EULA
easy to find, read and understand.
In addition to controls over “bad apples,” our results suggest the need for consumer outreach toraise awareness and understanding about the risks associated with “free” software.

Private & Confidential Report

Page 15

Ponemon Institute, LLC
Advancing Responsible Information Management
Ponemon Institute is dedicated to independent research and education that advances responsible
information and privacy management practices within business and government. Our mission is
to conduct high quality, empirical studies on critical issues affecting the management and securityof sensitive information about people and organizations.
As a member of the Council of American Survey Research Organizations (CASRO), we
uphold strict data confidentiality, privacy and ethical research standards. We do not collect any
personally identifiable information from individuals (or company identifiable information in ourbusiness research). Furthermore, we have strict quality standards to ensure that subjects are notasked extraneous, irrelevant or improper questions.

If you have questions or comments about this research report or you would like to obtain
additional copies of the document (including permission to quote or reuse this report), pleasecontact by letter, phone call or email:Ponemon Institute, LLC
Attn: Research Department
212 River Street
Elk Rapids, Michigan 49629
231.599.2920
research@ponemon.org

EXHIBIT A

212 River Street, Elk Rapids, Michigan 49629

About Dr. Larry Ponemon
Dr. Lawrence A. Ponemon is the Chairman and Founder of the Ponemon Institute, a research“think tank” dedicated to advancing privacy and data protection practices. Dr. Ponemon isconsidered a pioneer in privacy auditing and the Responsible Information Management or RIM
framework.
Ponemon Institute conducts independent research, educates leaders from the private and public
sectors and verifies the privacy and data protection practices of organizations in a various
industries. In addition to Institute activities, Dr. Ponemon is an adjunct professor for information
ethics and privacy at Carnegie Mellon University’s CIO Institute and is faculty of CyLab. He
serves on the Unisys Corporation’s Security Leadership Institute Board and the IBM Privacy
Management Council.
Dr. Ponemon is a member of the National Board of Advisors of the Eller College of Business andPublic Administration, University of Arizona. He serves on the Government Policy Advisory
Committee and Co-Chair of the Internet Task Force for the Council of American Survey andResearch Organizations (CASRO).
Dr. Ponemon consults with leading multinational organizations on global privacy management
programs. He has extensive knowledge of regulatory frameworks for managing privacy and data
security including financial services, health care, pharmaceutical, telecom and Internet. Dr.
Ponemon was appointed to the Advisory Committee for Privacy for the United States Federal
Trade Commission. He was also an appointed to two California State task forces on privacy anddata security laws. Dr. Ponemon currently serves as a privacy advisor to the United States
Transportation Security Administration and Department of Homeland Security.
Dr. Ponemon was a senior partner of PricewaterhouseCoopers (where he founded the firm’s
global compliance risk management group). Prior to joining Price Waterhouse as a partner, Dr.
Ponemon served as the National Director of Business Ethics Services for KPMG Peat Marwick,
and was appointed Executive Director of the KPMG Business Ethics Institute.
Dr. Ponemon has held chaired (tenured) faculty positions at Babson College, Bentley College and
SUNY Binghamton. He published numerous articles and learned books. He has presented morethan 500 keynote speeches or learned presentations at national or international conferences on
privacy, data protection, information security, corporate governance, and responsible information
management. Dr. Ponemon is an active member of the International Association of Privacy
Professionals, serving as founding member of the Certified Information Privacy Professional(CIPP) Advisory Board.
Dr. Ponemon is column editor for Computerworld, CSO Magazine, CMO Magazine, BNA andother leading publications. He is a frequent commentator on privacy and business ethics for CNN,
Fox News, CBS, CNBC, MSNBC, The Wall Street Journal, New York Times, Washington Post,
USA Today, Financial Times, Business 2.0, Newsweek, Business Week, U.S. News & World
Report, CIO Magazine, Industry Standard, Boston Globe, InfoWorld, InformationWeek, Forbes,
Fortune, CFO Magazine, Red Herring, Dow Jones News and others.
Dr. Ponemon earned his Ph.D. at Union College in Schenectady, New York. He has a Master’s
degree from Harvard University, Cambridge, Massachusetts, and attended the doctoral programin system sciences at Carnegie Mellon University, Pittsburgh, Pennsylvania. Dr. Ponemon earned
his Bachelors with Highest Distinction from the University of Arizona, Tucson, Arizona. He is a
Certified Public Accountant (active license in Texas).
Dr. Ponemon is married and has two sons. He is a U.S. Navy, Vietnam War era veteran,receiving an honorable discharge.

Private & Confidential Document Dated 1/13/2006

Page 1

I, LARRY PONEMON, declare as follows:1.

I am the chairman and founder of Ponemon Institute, a “think tank” dedicated toadvancing responsible information and privacy management practices in business and government.
The Ponemon Institute conducts independent research, educates leaders from the private and public
sectors, and verifies the privacy and data protection practices of organizations. Attached hereto as
Exhibit A is a true and correct copy of my résumé. I have personal knowledge of the matters statedherein and, if called upon, I could and would competently testify thereto.
2.

I am considered a leading international expert on privacy auditing and responsible

information management. I have extensive experience in auditing self-regulatory frameworks fordata protection and privacy compliance in the United States, Canada, the European Union, Hong
Kong and other nations.
3.

I was appointed to the Advisory Committee on online privacy and security by theUnited States Federal Trade Commission. I also serve on various state privacy commissions
including the California State Privacy Task Force and other initiatives.
4.

I was asked to provide an estimate of the potential cost impact that Web-users may

have experienced as a result of Sony BMG’s download of digital rights management (DRM)
software products known as XCP or Media Max 5.0.1 For purposes of my analysis, these two
software technologies are referred to as spyware because the Web-user was unlikely to know, control
or uninstall these software products, and they create the opportunity for the user’s desktop or laptop
computer to suffer malfunctions including security threats.

1

MediaMax 3.0 was omitted from my analysis because this DRM software product does notappear to open a door to potential malfunctions or security threats.

-1-

5.

My analysis of the spyware cost impact for consumers is based on sample researchfindings from a national study released in May 2005.2 Research methods in this study utilized asurvey instrument. Adult-aged individuals throughout the United States provided information about
their spyware experience.
6.

One set of survey questions dealt with the monetary cost and time-related effort

associated with respondents’ spyware experience. The research did not attempt to collect proof of
expenses or other pieces of evidence concerning each individual’s time-related efforts. All
responses were self-reported within the survey instrument.
7.

I believe that there are inherent limitations to survey research that need to be carefully

considered before drawing inferences from sample findings to the present case. The following items
are specific limitations that are germane to most perception-capture surveys:(a)Non-response bias: The current findings are based on a sample of survey

returns. We sent surveys to a representative sample of individuals, resulting in a large number ofreturned responses. Despite non-response tests, it is always possible that individuals who did notparticipate are substantially different in terms of underlying experience or beliefs than those whocompleted the instrument.
(b)

Sampling bias: Because sampling frames were derived from mail lists, thequality of results is influenced by the accuracy of contact information and the degree to which thelist is representative of individuals who are informed about current events. We also acknowledge
that the results may be biased by media coverage at the time of the study.

2

National Spyware Study, Ponemon Institute Report, May 17, 2005. A true and correct copyof this study is attached hereto as Exhibit B.

-2-

(c)

Self-report bias: The quality of survey research is based on the integrity ofconfidential responses received from subjects.

While certain checks and balances can beincorporated into the survey process, there is always the possibility that subjects did not adequately
describe their beliefs or perceptions regarding spyware.
8.

The sample of results reference 1,630 respondents – all of whom indicating that theyexperienced some form of spyware infection (including adware and malware) on their computer
sometime over a 12 month time period.3
Has spyware on your desktop or laptop caused
you to suffer a monetary loss, a productivity loss
or inconvenience?
Yes
No
Total
9.

Frequency
1,401
229
1,630

Total
Percentage
86%
14%
100%

The analysis shows that 1,401 respondents (86%) stated that spyware has caused themto suffer a monetary loss, a productivity loss or inconvenience. A second analysis required these
1,401 respondents to list their nature of negative experiences.
10.

The following table provides a distribution of responses in ascending order ofimportance based on the frequency of responses. Please note that the percentage of total responses
sums to more than 100% because respondents could check more that one item. The largest negative
impact (87%) concerns the respondents’ lost productivity as a result of spyware infection. The
second most significant impact (34%) concerns respondents’ inability to use previously downloaded
software as a result of spyware infection.

3

In this study, 87% of respondents said that they do not read the End User License Agreement
or EULA prior to downloading software.

-3-

What best describes this negative impact?
(Check all that apply.)
Experienced productivity losses.
Could not use previously downloaded software.
Purchased anti-spyware or anti-virus software.
Hired a computer pro to fix my desktop or laptop.
Purchased additional protection services from my ISP
or DSL provider.
Leakage of my personal information without consent
or knowledge.
Replaced my computer with new hardware.
Monetary damages resulting from criminal activity or
related abuses.
11.

1,214
475
371
200

Total
Percentage
87%
34%
26%
14%

128

9%

51
28

4%
2%

10

1%

Frequency

The third analysis asked respondents to state an approximate monetary or out-of-

pocket cost impact incurred over the past year. They were also given an opportunity to state “nomonetary loss.” In total, 205 respondents (15%) report a monetary loss as a result of spyware. The
remaining 1,190 (85%) did not report a monetary loss.
12.

For the 205 respondents who report a monetary loss, I extrapolated an average costburden based on the median value for each one of six cost categories in the instrument (shown
below).
13.

For the highest cost category (over $200), I utilized a conservative median value of$220 (or 110% the category minimum).

-4-

Approximately, what is the monetaryor out-of-pocket loss over the past 12
months as a result of having spyware
on your computer? Please check therange that is closet to the total loss
experienced.
No Monetary Loss
Between $0 and $10
Between $10 and $20
Between $20 and $50
Between $50 and $100
Between $100 and $200
Over $200
Total
Number of people with self-reportedmonetary loss
14.

Frequency

1,190
23
66
60
31
12
13
1,395
205

MedianCost inRange

Calculation

85%
2%
5
5%
15
4%
35
2%
75
1%
50
1%
220
100% Average

0.1
0.7
1.5
1.7
1.3
2.1
7.3

Total
Percentage

15%

The summation of all median values multiplied by the percentage frequency of

responses in each cost category is the basis of a $7.3 point estimate for an overall monetary cost
impact. This extrapolated cost burden is a value that applies to all 1,395 respondents, and not justthose 205 people (15%) that reported a monetary loss. Hence, the extrapolated per capital cost is$1.07 (defined as $7.3 multiplied by 15%).
15.

The fourth analysis asked respondents to state an approximate time impact incurred

over the past year. They were also given an opportunity to state “no time” loss. A total of 1,066
respondents (76%) report time losses as a result of spyware. The remaining 336 (24%) did notreport a time loss.
16.

For the 1,066 respondents who report a time loss, we extrapolate an average timeburden based on the median value for each one of six time range categories in the instrument (shown
below). For the highest time category (over 100 hours), we utilized a conservative median value of
120 hours (or 120% the category minimum).

-5-

Approximately, how much time did
you spend over the past 12 months
as a result of having to deal withspyware on your computer? Pleasecheck the range that is closet to thetotal time spent by you.
No time
Between 0 and 60 minutes
Between 1 to 5 hours
Between 5 to 10 hours
Between 10 to 50 hours
Between 50 to 100 hours
Over 100 hours
Total
Number of people who selfreported time loss
17.

Average
Time
Percentage

Calculation

336
899
123
19
15
7
3
1,402

24.0%
64.1%
0.5
8.8%
2.5
1.4%
7.5
1.1%
30.0
0.5%
75.0
0.2%
120.0
100.0% Average

0.32
0.22
0.10
0.32
0.37
0.26
1.59

1,066

76.0%

Frequency Percentage

The summation of all median values multiplied by the percentage frequency of

responses in each time category is the basis of a 1.59 hour point estimate for an overall time impact.
This extrapolated time burden is a value that applies to all 1,402 respondents, and not just those
1,066 people (76%) that reported a time loss. Hence, the extrapolated per capital time burden is 1.21
hours (defined as 1.59 hours multiplied by 76%).
18.

For purposes of a very conservative estimate for the value of lost time in responding

to spyware infection on a desktop or laptop computer, I used the US minimum wage as of March 1,
2006 at $5.15 per hour. Assuming this hourly pay rate, the average extrapolated time-related cost
impact of spyware is $6.24 (defined as 1.21 hours multiplied by $5.15 minimum wage hourly rate).
19.

Drawing upon the above calculated values derived from sample data, I made thefollowing inferences about the total cost impact on Web users that downloaded XCP and Media Max
5.0. Please note that I am basing this analysis on the following factors:(a)Sample results can be used to approximate the two plaintiff classes withrespect to the end-user spyware experience.

-6-

(b)

XCP and Media Max 5.0 unleash spyware, causing approximately the samepotential for malfunction and security threats for the end-user.
(c)

One year, on average, is the approximate time impact for an individual in oneof the two plaintiff classes.
(d)

The approximate plaintiff class totals for XCP and Media Max 5.0 are

3 million and 4.2 million people, respectively.
(e)

Of all CD purchasers, I assume that approximately 20% actually loaded theirCDs onto their desktop or laptop computers. Hence, the number of XCP users that experienced a
spyware infection is estimated at 600,000 individuals (3 million CD purchasers multiplied by 20%).
The number of Media Max 5.0 users that experienced spyware is estimated at 840,000 individuals(4.2 million CD purchasers multiplied by 20%).
20.

The following table reports the extrapolated total cost impact (expressed in U.S.

million dollars) for two plaintiff classes:
SONY BMG DRM
software categories
XCP
Media Max 5.0
Total

Million Monetary
Time cost
Web
cost($Million)
users ($Million)
0.60
0.64
3.74
0.84
0.90
5.24
1.44
1.54
8.99

-7-

Estimated
Cost Impact($Million)
4.39
6.14
10.53