Police Tracked Traffic of All National ISPs to Catch Pirate IPTV Users

Over the past two decades, pirate sites and services frequented by millions of users have been shut down following legal action. No longer useful for spreading files, many were repurposed to spread fear.

In the wake of Hollywood’s 2005 win at the U.S. Supreme Court, the website of file-sharing service Grokster was transformed into a personalized warning. Anyone visiting the site saw their own IP address alongside a message claiming it had been logged. “Don’t think you can’t get caught. You are not anonymous,” the message added.

Variations on this theme have since appeared on dozens of platforms, most famously via an MPA campaign that declared “You can click but you can’t hide.” These messages were designed to instill fear and uncertainty but didn’t lead to any notable action against those who viewed them. Until now, at least.

Italy’s War on IPTV Pirates Hits The Streets

Most top-tier copyright holders avoid targeting consumer-level pirates, mainly because the optics aren’t great. No matter how carefully targets are chosen, suing someone’s grandma is terrible PR and even when things go smoothly, results are limited.

Today’s general consensus is that hitting site operators is much more effective but whenever the opportunity appears, undermining user confidence should be part of the strategy. Italian police have been following the same model by shutting down pirate IPTV services (1,2,3) and warning users they’re up next.

No Bluff: Police Tracked IPTV Subscribers

Letters recently sent to homes in Italy reveal that police were not bluffing. A copy letter obtained by Iilsole24ore identifies the send as the Nucleo Speciale Tutela Privacy e Frodi Tecnologiche, a Guardia di Finanza unit specializing in IT-related crime. It refers to an anti-IPTV police operation in May.

The operation targeted around 500 pirate IPTV resources including websites and Telegram channels. At the time, police also reported that 310+ pieces of IPTV infrastructure, including primary and balancing servers distributing illegal streams, were taken offline.

Police also claimed that a tracking system made it possible to identify the users of the pirate streams. The letter suggests extraordinary and potentially unprecedented tactics.

“Italy’s ISPs Redirected National Traffic”

The letters state that Italian authorities were able to track the IPTV users by “arranging for the redirection of all Internet service providers’ national connections” so that subscribers placed their orders on a police-controlled server configured to record their activity.

In comments to Iilsole24ore, Gian Luca Berruti, head of investigations at the Guardia di Finanza, describes the operation as “decisive” in the fight against cybercrime. Currently deployed to Italy’s National Cybersecurity Agency, Berruti references “innovative investigative techniques” supported by “new technological tools.”

Technical details are not being made public, but it’s claimed that IPTV users were tracked by “tracing of all connections to pirate sites (IPs) combined, in real-time,” and “cross-referencing telematic information with that derived from the payment mechanisms used.”

The police operation in May was codenamed Operazione:Dottor Pezzotto. A Telegram channel with exactly the same branding suffered a traffic collapse at exactly the same time.

IPTV Subscribers Must Pay a Fine

Finding out exactly what techniques the police used in May will take time but at face value seem more suited to terrorists than people looking for cheap streams. The fine amounts are baffling too, especially given the extraordinary effort to track IPTV users down.

The letters refer to an administrative copyright infringement fine of just 154 euros or “in case of recidivism” a total of 1,032 euros. However, if people pay their fines within 60 days, the amounts are reduced to 51 euros and 344 euros respectively.

“It is important to raise awareness of all citizens, especially young people, on this issue and make them understand that financing this business means financing organized crime. We must protect the healthy economy and companies that respect the rules,” Berruti says.

Around 1,600 people are believed to have been targeted in this first wave of letters but according to Andrea Duillo, CEO of Sky Italia, this is just the start.

“These first fines show that it is doubly dangerous to use pirated services, because not only do you hand over your personal data to criminal organizations, but you also commit an offense for which you are fined and prosecuted,” Duillo concludes.

A redacted copy of the letter can be found here (pdf)