Copy-protection software that would to do the impossible: make CDs that couldn't be repeatedly copied.

Britain's First 4 Internet landed meetings with the four major record labels, trying to sell software called XCP. The concept was that consumers could burn one copy and one copy only, defeating the rampant piracy that the industry says costs it billions in lost revenue.

Each label signed up. EMI, Warner Music and Universal employed the company only for trials, using a limited form of XCP that scrambled the CD for pre-release promotional copies sent to critics.

Sony BMG, the world's second-largest label, decided to go one step further, releasing more than 50 consumer titles with the strictest form of copy protection ever used by the music industry. The move backfired after a computer researcher blogged about his discovery of potentially grave problems: Hidden files on the CD made PCs susceptible to viruses if the disc was played on a computer. (Related item: Sony CDs that have XCP protection)

A two-week firestorm ensued, with class-action consumer lawsuits and online calls for boycotts of Sony. Microsoft, anti-virus companies and even the Bush administration weighed in. Sony, which at first denied there was a problem, began to realize the extent of the damage and started taking steps to fix things.

Last Friday, Sony said it would stop manufacturing these CDs. On Monday, it told USA TODAY it would recall them altogether. Sony is asking retailers to pull the titles off their shelves and wait for clean replacement copies, which might not arrive in stores until next Friday, leaving some artists off the shelves temporarily for the all-important Thanksgiving shopping weekend.

"I could understand Sony's reticence if we were talking about a big-ticket item, like a computer," says crisis management expert Robin Cohn, the author of The PR Crisis Bible. "But a $15 CD? That's nothing. Sony should have been able to handle this in two days. Instead, the story just kept on going and going."

Merger fallout

How did one of the world's most loved media companies, part of the technologically innovative Sony Corp., find itself caught in the crossfire? Sony has declined to comment on details of its agreement with First 4 Internet, which also has declined to comment.

How Sony responded Critics have blasted Sony for its response to the furor over its copy-protected CDs. Here's a timeline: March: Sony releases its first 10 copy-protected CD titles with XCP anti-copying software. Oct. 31: Blogger Mark Russinovich writes of his discovery that these Sony CDs, when played in a computer, contain a hidden file, called a "rootkit," that is susceptible to viruses. Nov. 1: Sony's website posts a downloadable patch to make the "rootkit" no longer hidden. The company stands behind its CDs and says only 20 titles have XCP software but won't say which ones. Nov. 8: Anti-virus companies begin criticizing XCP as spyware and working on fixes to clean up computers. Nov. 11: Sony says it will stop manufacturing CDs with XCP software but won't recall the affected titles. Monday: Sony says it will recall the titles but releases no details. Tuesday: The 20 XCP titles grow to 49. Wednesday: Sony posts a list of 53 affected CDs on its website, offers exchanges to the public and says it "will make further details of this program available shortly."

But start by looking at the merger of two record labels, the executives in charge of them and what massive staffing cuts can do to an organization.

In 2003, former NBC News president Andy Lack, who had no prior music experience, was recruited to run Sony Music — home to some of the biggest icons in music, including Bob Dylan, Bruce Springsteen, Barbra Streisand, the Dixie Chicks and Johnny Cash.

The following year, he arranged a merger with Bertelsmann's BMG, which is based in Germany and home to RCA and Arista Records (Elvis Presley, Santana, Dave Matthews Band, Alicia Keys).

Lack's Sony bosses were not keen on the merger, but he convinced them. "I said, 'I won't put us into a merger where we don't maintain control,' " Lack told USA TODAY earlier this year. "That sold them."

Lack cut 25% of Sony BMG's workforce, slashing nearly 2,000 staffers. He prided himself on bringing an outsider's viewpoint to an insular business, associates say. "Andy came in with a fresh perspective that was sorely needed," says Wayne Rosso, the CEO of MashBoxx, a start-up digital music company.

Meanwhile, there were changes at the top at Sony Corp., whose Walkman music player had been eclipsed in the cool department by Apple's iconic iPod.

Sir Howard Stringer, Lack's former boss from when he once worked at CBS, was named CEO of Sony, the first westerner to hold the title. In September, Stringer cut 10,000 jobs from the Sony payroll.

"All the changes help explain the screw-up, but they don't excuse it," says Richard Doherty, an independent analyst with the Envisioneering Group. "The Sony engineers we talk to (about the infected CDs) are just as shocked as everyone else. One hand did not know what the other hand was doing."

The piracy war

Ever since 1999, when a college student found a way to trade music files online easily and for free with the original Napster, the music industry has spiraled, trying to catch up to technological change.

At first, the industry fought by trying to sue music file-sharing companies out of existence. The record labels have won several important legal victories but still have not won the war. More people than ever are using file-sharing software, trading more than 1 billion songs monthly.

Lack came to Sony determined to change things. "Technology, such as the iPod, is a friend to the music industry," he told USA TODAY earlier this year.

Instead of fighting with file-sharing companies, he became their friend. He made overtures to Napster founder Shawn Fanning and Rosso, the outspoken former president of Grokster. With his encouragement, both have started services that promise to legitimize file sharing: Rosso's MashBoxx and Fanning's Snocap.

It was BMG that started flirting with copy protection on a bigger scale than other labels. Piracy is said to be worse in Germany, and executives became convinced that CD-burning was a much bigger issue than file sharing.

BMG began releasing copy-protected CDs in 2002 internationally from several artists, including Natalie Imbruglia. Under Lack's leadership, in June 2004, it became the first major label to issue a copy-protected CD in the USA, an album by the band Velvet Revolver.

The disc used a form of copy-protection that is less restrictive than XCP. It incurred no consumer backlash, and opened at No. 1 on Billboard's list in its first week of release.

A 200-CD PC

Sony executives have been criticized through the years for not talking to colleagues across divisions. That seems to be the case between Sony BMG Music and Sony's computer arm, Vaio.

Sony BMG wants to discourage CD-burning. Sony Vaio, on the other hand, recently released a new $2,100 PC with a 200-CD changer, the VGX-XL1. Load up 200 blank CDs in the tray, and the computer "will be set to automatically and sequentially copy all of your content in one single session," Sony says in its promotional material.

Doherty, the Envisioneering analyst, says he visited Sony this week for a meeting with top executives, and in terms of the CD crisis, "they're not sweating, which really surprises me, because I know I sure would be."

Doherty, who specializes in consumer behavior research, works with a team that surveys consumers about their habits and concerns. "I can tell you that (consumers) are very concerned and looking for a faster response from Sony BMG," he says. "It will be a long time before they put a Sony BMG CD into the CD tray."

Sony's response has been that the infected CD issue wasn't its fault. On its website, the company says the software "was provided to us by a third-party vendor."

First 4 Internet, based in Oxfordshire, and founded in 1999, also produces porn-filtering software. The company didn't return phone calls Thursday.

"Sony should have taken full responsibility right off the bat," says Cohn. "This is about the people affected, and you want to show them you're doing everything you can to solve this problem."

She contrasts Sony's response to Johnson & Johnson's Tylenol-tampering scare of 1982, when the company swiftly removed all product from shelves in response to reports of possible deaths.

"Companies need to respond immediately when something happens," she says. "If they don't, the story just keeps on going."

Sony says it's still committed to copy-protection and defends its handling of the XCP situation. "We are committed to doing whatever it takes to make this right," says Sony BMG spokesman John McKay.

Two lawyers have filed class-action lawsuits against Sony BMG, accusing the giant of computer fraud, on behalf of 15 consumers who purchased XCP discs by Neil Diamond, Switchfoot and Van Zant, among others.

Yes, Sony has addressed the situation, "but the question is how do they do the remediation," says Scott Kamber, an attorney who filed one of the lawsuits.

He paints an image of one XCP disc in a public library system, being listened to by hundreds, if not thousands of consumers on their laptops, via headphones, and infecting every one of their machines. "These CDs are like ticking time bombs," he says. "Sony has a real obligation to get these discs out of circulation."

The irony, Doherty says, is that Sony could have easily nipped this in the bud.

"Howard Stringer should have appeared on TV and said, 'I'm sorry, we don't know how this happened, but it won't happen again.' "