Major Online Services Help Identify Pirate Streaming Site Operators

An interesting lawsuit filed in a Texas court during the summer last year saw DISH Network and Sling TV partner up to sue the people behind SportsBay.org, SportsBay.tv, Live-NBA.stream, and Freefeds.com.

Unlike lawsuits against regular pirate IPTV providers, the platforms were alleged to have circumvented the DRM technologies deployed by Sling TV’s streaming system (Widevine, Fairplay, and PlayReady) in order to provide their users with Sling programming, directly from Sling’s servers, for free.

DISH provided considerable detail on how the operation worked while alleging willful violations of the DMCA’s anti-circumvention provisions and claiming considerable sums in damages.

Sometime in September 2021, all of the sites went offline and still haven’t resurfaced, leaving millions of users high and dry. The reasons for the disappearances haven’t been confirmed but DISH had been granted permission to subpoena a number of major service providers to further its case.

Subpoenas Target Major Online Service Providers

The targets of the subpoenas included domain registrar Namecheap (plus domain protection service WhoisGuard), Tucows, Cloudflare, Digital Ocean, Google, Facebook, Instagram and Twitter.

Namecheap was asked to hand over information related to Namecheap or WhoisGuard accounts associated with sportsbay.org, live-nba.stream, freefeds.com, and the IP address 198.54.117.210, from May 2018 through August 3, 2020.

This included documents sufficient to identify the full name and contact information (including street addresses, web addresses, email addresses and telephone numbers) for the person that registered each account, plus documents submitted in order to create or make changes to each account. The subpoena also requested the handover of detailed payment information.

A similar subpoena requesting almost the same information was filed with domain company Tucows and another with Cloudflare, the latter also containing a demand to identify the names of the hosting companies connected with the four domains.

Highlighting a specific server IP address (159.65.35.50), a subpoena sent to Digital Ocean requested the handover of contact, payment and user IP address information, plus all communications sent or received to the accounts.

Google was sent a demand to hand over information related to a specific Google Analytics account including names, addresses and contact records, plus all IP address logs and communications sent to or received from related accounts. Facebook, Instagram and Twitter were ordered to hand over all identifying information they hold on the sites’ social media accounts and it appears other providers were required to hand over information too.

Subpoenas Enable Plaintiffs to Name Defendants

With DISH and Sling apparently leaving no stone unturned, it seemed almost inevitable that one or more of the subpoenas would lead to the identities of one or more of the previously unnamed defendants. That now appears to be the case.

In a first amended complaint filed this week, the plaintiffs identify two men – Juan Barcan and Juan Nahuel Pereyra, both residents of Argentina.

“Defendant Juan Barcan is an individual residing in Buenos Aires, Argentina that owned and operated the Live-nba.stream, Freefeds.com, Sportsbay.org, and Sportsbay.tv domains and websites,” the complaint reads

“Barcan used his PayPal account to make payments to domain registrar Namecheap and GitHub for the Sportsbay Websites. Barcan operated the Sportsbay Websites with CloudFlare, GitHub, and Google accounts.”

“Defendant Juan Nahuel Pereyra is an individual residing in Buenos Aires, Argentina that owned and operated the Live-nba.stream, Freefeds.com, Sportsbay.org, and Sportsbay.tv domains and websites,” it continues.

“Pereyra used his PayPal account to make payments to domain registrar Namecheap for the Sportsbay Websites. Pereyra operated the Sportsbay Websites with CloudFlare and Google accounts.”

The amended complaint further notes that all of the ‘SportsBay websites’ had similarities among their domain registrars and service providers, and each deployed Cloudflare as a reverse proxy, pass-through security service. According to the plaintiffs, all four domains used the same Google Analytics ID (UA-187547947) which is also referenced on a number of other defunct streaming portals not mentioned in the complaint.

Finally, after repeating their calls for damages, DISH and Sling also call for a permanent injunction to prevent the defendants from infringing their rights moving forward, including by circumventing DRM or any other technological protection measures that control access to Sling programming.

The amended complaint can be found here (pdf)