1.3m Pirate IPTV Users ‘Blacked Out’ During Euro 2024, Italian Police Claim

Italy's Guardia di Finanza has just outlined an anti-piracy investigation it links to Euro 2024. The operation led to searches targeting 13 pirate IPTV administrators, and 1.3 million pirate viewers reportedly had their screens "blacked out." The statement raises several important questions, but the decision to mention the "completely innovative way" the pirates obtained the content is not something usually discussed in public.
Italy’s Guardia di Finanza (GdF), a law enforcement agency operating under the Ministry of Economy and Finance, has often been the source of some of the country’s most dramatic pirate IPTV news.

With a key focus on financial crime, GdF appears to adopt a ‘follow-the-money’ approach. Over several years, GdF claims to have taken down dozens of IPTV providers and resellers, denied scores of millions access to pirate services, and redirected the whole country’s internet traffic to identify pirates.

‘Signal Transmission Obscured’ For Over 1.3 Million Users

A new announcement claims that fresh GdF action running alongside Euro 2024 is responsible for over 1.3 million IPTV pirates having their viewing “blacked out.” In football-crazy Italy, that’s a significant claim.

“The soldiers of the Provincial Command of the Guardia di Finanza of Milan, coordinated by the local Public Prosecutor’s Office, conducted an important investigation to combat the phenomenon of audiovisual piracy, the so-called ‘IPTV’,” the statement reads.

“In conjunction with the 2024 European Football Championships, the Fiamme Gialle carried out 14 local and IT searches throughout the national territory against 13 suspects, residing in various Italian regions and abroad.”

The IT specialists from the Fiamme Gialle unit have been credited with a number of successful anti-IPTV operations since 2022; 6,500 IPTV pirates identified after accessing a police honeypot, action against 545 Telegram channels, and a more recent operation targeting a provider in Italy, for example.

GdF continues by noting that 13 of the suspects are “accused of managing illegal distribution networks of the major television schedules protected by copyright, illegally decrypting and redistributing the contents of the most important global television players via unauthorized IPTV platforms, causing significant economic damage to legitimate broadcasters.”

No Mention of Any Arrests, No Mention of Equipment Seizures
While it’s certainly possible that this operation led to arrests, details like that are typically present in deterrent messages issued by the authorities, especially in tandem with an event like Euro 2024. Towards the end of the statement, GdF says the investigation “concluded with the identification of 13 people” suspected of various crimes. An operation last December was reported in similar fashion.

A critical eye further reveals other noteworthy details, such as the Fiamme Gialle carrying out “14 local and IT searches” against suspects “residing in various Italian regions and abroad.” Exactly what an “IT search” amounts to is unclear but, if any searches took place physically, there’s zero mention of any hardware seizures, which are usually detailed down to the last thumb drive.

Massive Pirate IPTV Blackout

The signal transmission was therefore obscured, preventing access to content for over 1.3 million users.” (GdF statement)

The most recent published study on IPTV consumption in Europe arrived in December 2023, so around 18 months ago. The Audiovisual Anti-Piracy Alliance (AAPA) estimated that 2.5% of the Italian public accessed illicit IPTV services, around 1.14 million people in total.

Given that these figures relate to consumption in 2021, to obtain an estimate on consumption today, let’s generously double 1.14 million to 2.28 million, and completely ignore Italy’s massive Piracy Shield IPTV blocking program launched this year.

That leads to the conclusion that over half of all pirate IPTV consumers in Italy (1.3 million) had their supply cut off sometime during the last 10 days, since this operation ran “in conjunction” with Euro 2024.

The GdF announcement on X/Twitter currently has around 3,500 views; four people have posted a comment, one of which is an ad for a pirate IPTV service. That seems to be at odds with the number of people said to have been denied access to pirate IPTV services.

Google Trends data suggests more people were interested in the most popular search terms last November; Piracy Shield was expected to launch then, but didn’t. There was no blocking until February 2024; that caused a spike in engagement, but even that dropped off quickly.

The red line depicting searches for IPTV is on the rise but the kind of apocalyptic event that sees half or more IPTV device users in the country having their service terminated would be a much steeper rise than that. The next few days will provide a clearer view of the data but at the time of writing, interest in ‘IPTV’ is roughly half the peak seen late August/early September 2023 in response to the passing of a new anti-piracy law.

“The investigations, conducted by a team of soldiers from the Economic-Financial Police Unit of Milan, highly qualified in combating computer crimes, coordinated by the local Public Prosecutor’s Office, arose from a complaint from SKY ITALIA,” the GdF statement continues.

The next few lines of detail are something rarely discussed in public, for reasons that will become immediately obvious.

The Suspects’ Operations Are ‘Completely Innovative’

“The suspects operated in a completely innovative way compared to the past, i.e. through the exfiltration of the decoding keys, necessary for the decryption and ‘unencrypted’ viewing of all the channels and television schedules of the main and most important broadcasters..” (GdF statement)

While pirates and others interested in encryption have no problem discussing the above in public, it’s interesting that the authorities and presumably Sky, which this directly affects, are mentioning this in public.

This is a reference to a major weakness in the security meant to protect content at Sky in Italy and other countries around Europe.

Mostly, but not exclusively, impacting the Widevine digital rights management (DRM) system owned by Google, a subscriber to legal IPTV services can extract encryption keys using certain software and ultimately obtain otherwise subscription services for free. Broadcasters have been aware of the problem for years and take action when tools appear in public, at least where they have the ability to take them down.

In respect of IPTV piracy, this raises two key issues. Firstly, while legal broadcasts are often obtained by capturing/recording video streams and rebroadcasting those to the public, this technique allows IPTV providers to capture a digital data stream directly from the source, i.e. the broadcasters’ content delivery networks (CDN).

A positive for broadcasters, in this scenario, is that since streams are rebroadcast from providers’ own servers, Italy’s Piracy Shield system is, in theory, capable of preventing any restreams reaching consumers.

A potentially more worrying issue is when people access this content directly, i.e. they use extracted keys to view the broadcasters’ streams directly from the broadcasters’ servers. If Piracy Shield attempted to block the source, not even legal customers would be able to access a service they actually pay for.

A positive for broadcasters in this scenario is a fairly high barrier to entry; the downside is that software and services to make this easier are becoming more accessible.

A self-hosted software package, to make one aspect of this process much more straightforward, has been attracting interest recently, but with the same and similar tools available via any web browser, it’s not difficult to see where this is headed.