NEW YORK — Sony BMG Music Entertainment on Wednesday recalled compact discs with hidden copyright-protection software because of concerns about security risks the CDs may create on computers.

Customers can exchange any disc with the copyright-protection software, called XCP, for a replacement copy without it, Sony BMG said on its Web site. Once installed on a computer, XCP software can enable the monitoring of a user’s activity and make the machine vulnerable to viruses.

Sony BMG has about 2.1 million such discs. The recall comes as record companies enter their strongest sales period ahead of the holiday season.

“It’s a big mistake. They shouldn’t have done it,” said Phil Leigh, an analyst at Inside Digital Media Inc. in Tampa. “They were so concerned about piracy that they were not careful about how they would control it. They shot themselves in the foot.”

Installed on about 50 recordings distributed by Sony BMG, XCP was designed to prevent illegal duplication by limiting the number of copies that could be made once a title is installed on a personal computer. However, the technology also can be used to monitor the users’ online activity and make PCs vulnerable to computer viruses.

It started when security researcher Mark Russinovich first posted to his blog that Sony’s music CDs surreptitiously installed digital rights management software based on a “rootkit”–a hacking tool widely considered to be spyware. Following that, bloggers of all stripes, from seasoned security experts to aggrieved consumers, vented about the record company’s unethical and possibly illegal behavior.

“It seems crystal clear that but for the citizen journalists, Sony never would have done anything about this,” says Fred von Lohmann, senior intellectual property attorney for the Electronic Frontier Foundation, a cyber liberties advocacy group that has been vocal in its condemnation of Sony and may eventually file a a lawsuit against Sony, in addition to three that have already been filed. “It’s plain to me that it was Sony’s intent to brush the story under the rug and forget about it.”

Thomas Hesse, Sony BMG’s Global Digital Business President, attempted to do just that by dismissing the online protests. “Most people, I think, don’t even know what a rootkit is, so why should they care about it?” he said in a November 4 interview on National Public Radio’s Morning Edition. He added, “The software is designed to protect our CDs from unauthorized copying and ripping.”

Blog search site Technorati.com shows well over a hundred blog postings ridiculing this particular quote, each of which may have been linked to by other blogs.

The same might be said for Sony BMG. The company no doubt believes in content protection technology. The trouble is few of its customers do. Either Sony’s customers don’t know what they’re missing or the company is selling something no one wants.