The Electronic Frontier Foundation (EFF) has filed a lawsuit against Sony BMG demanding that the record label repair the damage done by anti-piracy technology bundled on millions of its audio CDs. 

As well as the XCP technology, which for the past weeks has been at the centre of a storm of controversy, the lawsuit also targets SunnComm's MediaMax software that the music giant has included on more than 20 million CDs. Another two million CDs were shipped with XCP. 

The not-for-profit EFF is a consumer advocacy group that aims to strike a balance between civil liberties and new technologies. The group has been a vocal opponent of Sony's use of XCP digital rights management technology.

Sony BMG has come under heavy fire from consumers, security experts and consumer advocates in recent weeks for its anti-piracy initiative.

The software seeks to regulate how consumers use the CD on a Windows computer by installing special software.

But the application has been heavily criticised for its poor security and for installing a cloaking feature that can easily be exploited by worms and other malware. It is also very hard to remove and could damage the user's system.

While XCP has raised the most security concerns, both XCP and MediaMax are illegally installed on the user's computer and do not include an easy way to remove the application, the EFF alleged.

The developers have made it unnecessarily complicated to obtain removal tools, according to the privacy group, and the tools in both cases included security vulnerabilities which put users at risk.

"Music fans should not have to install potentially dangerous, privacy-intrusive software on their computers just to listen to music which they have legitimately purchased," said EFF legal director Cindy Cohn.

"Regular CDs have a proven track record; no one has been exposed to viruses or spyware by playing a regular audio CD on a computer. Why should legitimate customers be guinea pigs for Sony BMG's experiments?"

The music firm is already facing lawsuits in California, New York and Italy over the XCP technology.

Texas Attorney General Gregg Abbott said on Monday that the record label had violated a local anti-spyware law because it failed to notify users of the cloaking software. Abbott has pressed charges seeking civil penalties of $100,000 for each violation.

It is not clear how many of Sony BMG's CDs have been distributed in the state of Texas. One security expert has estimated that worldwide more than half a million PCs have been infected.

The Texas case is the first instance of a government entity going after the record label.