Canadian ISPs Blocked Pirate IPTV & Logged Customer IP Addresses

When Canada's Federal Court issued an injunction compelling ISPs to block pirate IPTV services on behalf of NHL broadcasters, the judge ordered a report to ensure compliance with the order. This report offers considerable insight into the blocking process but also reveals how some of Canada's ISPs logged customers' connections and shared data on their attempts to access pirate IPTV services.

When the first pirate site blocking applications began to gather momentum in Europe, those concerned about where it all might lead spoke of slippery slopes and thin ends of wedges.

More than 15 years later, judges in dozens of countries have not only approved blocking injunctions that target static sites but are also happy to hand down flexible orders designed to rapidly counter new domains, proxies, and mirrors.

When pirate IPTV services hit the mainstream less than 10 years ago, the legal and technical challenges of blocking content quickly were considerable. But by carefully tapping in the wedge, showing patience, and not asking for too much at the wrong time, rightsholders can now block pirate IPTV services while judges are tucked up in bed.

Canada’s Blocking Fast Track
Canada’s Federal Court approved the country’s first IPTV blocking order in 2018, and the Federal Court of Appeal upheld it in May 2021.

Just two months later, the architects of the first order – Rogers, Bell, TVA, and others – filed a new application demanding faster, more flexible blocking. The Federal Court obliged and in 2022, Justice William F. Pentney handed down Canada’s first dynamic pirate IPTV blocking order, crafted to protect the NHL broadcasters’ revenues.

Justice Pentney also issued instructions for one or more experts to review the process to ensure compliance with the Court’s criteria for identifying ‘pirate’ IP addresses. Dates and times when the IP addresses were supposed to be blocked, and whether they actually were, for example. A report on general compliance was the overriding theme.

Report Satisfied Judge, New Injunction Awarded
Before Rogers, Bell, TVA, and the other plaintiffs were able to renew their injunction, the Court reviewed the experts’ report to ensure that its instructions had been followed. The report was produced by IP lawyer David Lipkus and Jon Wilkins, co-founder of Quadra Partners.

While both men have business connections with the plaintiffs, the Court saw no issues with their work, and ultimately renewed the injunction. The report’s key findings were as follows: (Note: FMTS is a reference to Friend MTS, an anti-piracy company heavily involved in live pirate IPTV blocking)

– Experts verified the criteria used by Friend MTS to select IP addresses for blocking
– ISPs used automated blocking, 9 out of 10 blocked 100% of the IP addresses tested
– No legitimate complaints from individuals or businesses related to blocking
– Data supports the assessment that availability of infringing content was reduced
– Blocking considered effective; delivered a measurable benefit for a low cost

The report itself wasn’t available when mentioned last year, but recently appeared on the docket at Canada’s Federal Court. It reveals how the review was conducted and how the data was verified, plus additional details that help paint a bigger picture on site-blocking measures when combined with existing information.

All About The Blocklist
FMTS provided the experts with a spreadsheet containing a confidential blocklist of 568 IP addresses and timestamps indicating when they were added to the blocklist. To verify the selection criteria, the experts used a randomized sample set of 181 IP addresses and were able to confirm that all 181 were added to the blocklist.

Perhaps the most interesting aspect here is that ancillary comments appear to add weight to the theory that IP addresses aren’t spotted ‘live’ and then immediately blocked; they’re on the blocklist before live games even begin.

IP addresses added to the blocklist are those determined by FMTS to be part of streaming infrastructure making the Copyrighted Content available without authorization during the NHL Live Game Windows, as well as during the Pre-Monitoring Period

What constitutes a ‘Live Game Window’ is not detailed in the report since this and similar information is considered highly confidential. However, data made available in other jurisdictions suggests that ‘windows’ go way beyond the competitive live action taking place ‘now’ on TV.

In orders issued to ISPs in other countries where FMTS blocks live football streams, “Match Periods” refer to other days in a given week where pirate IPTV services have already been observed illegally streaming matches owned by the same rights owner. It seems likely that ‘Live Game Window’ is the NHL equivalent.

Similarly, the ‘Pre-Monitoring Period’ is a block of time that precedes one or more ‘Match Periods’ in the same week as the current live match. Pirate IPTV services that show a) a subscription channel on which match footage is due to be broadcast or b) a sports-related subscription channel operated by a specified broadcaster, are eligible for IP address blocking.

Identifying Pirate Streams
According to the Canadian report, FMTS uses a proprietary technology that allows it to compare legitimate samples of existing NHL game footage with content being made available on pirate platforms.

“When matches are detected, the IP addresses of the source and associated streaming infrastructure are flagged for potential inclusion in the blocklist. Screenshots and video footage of the matched content are retained [and] were made available, along with thumbnail images of the identified content and the legitimate sample content it was found to match,” the experts note.

The report says that some of the 181 IP addresses in the sample were matched with multiple games in the Pre-Monitoring Period and NHL Live Game Windows, together generating 356 hits.

After reviewing thumbnail images, screenshots, and video captured from streams for each, the experts concluded that 178 IP addresses were valid matches, with the remaining three “unintentionally matched” against suspected pirated content. “FMTS immediately corrected the issue,” the report notes.

Limiting Overblocking, Handling Complaints
Blocking a large number of IP addresses over time is likely to lead to a small number of errors. At least statistically, an accuracy rate exceeding 99% is considered commendable in many fields, although not necessarily of comfort to those wrongfully blocked.

With that in mind, it was good to learn that FMTS carries out checks to ensure that, as far as it can, target IP addresses are unlikely to have any legitimate uses at the specified time. Interestingly, some of the ISPs also decided to mitigate potential overblocking using their own tools.

When carrying out connectivity tests to establish whether ‘pirate’ IP addresses were accessible via ISPs during the ‘NHL Live Game Windows’ of the NHL Finals, 77.51% of tests failed to reach the IP addresses in question. However, on 157 occasions, it was possible to reach ‘pirate’ IP addresses that should’ve been blocked.

“In an effort to reduce the potential for over-blocking, some of the ISPs blocked the IP addresses after there was a certain threshold of network traffic,” the report notes.

While that may be considered a plus, customers and privacy advocates may be less pleased with other details. ISPs used to champion themselves as oblivious ‘dumb pipes’ but are now required to block specified network locations when courts order them to do so.

Did the Federal Court ask the ISPs to monitor customer traffic? Because that’s what some did.

Some ISPs Monitored Demand For ‘Pirate’ IP Addresses
Monitoring customer activity and then disclosing that information to third parties sounds like a privacy disaster, not to mention a legal minefield. No ISPs are mentioned by name but for one reason or another, the information in the report is either disappointing for customers or disappointing for rightsholders.

One ISP reportedly had a logging system that tried to count the number of unique customer IP addresses that attempted to access ‘pirate’ IP addresses during NHL Live Game Windows. The counts varied from 109 IP addresses up to 300 IP addresses – 109 subscribers or potentially 300 – give or take. Unfortunately, the number never exceeded 300 because the system “was only capable of recording a maximum of 300” in the relevant periods.

One ISP counted 40,105 customer IP addresses, another 50,794, but showing that these customers were actually attempting to watch NHL content proved impossible.

“[A]lthough with respect to supply, a number of sites containing Infringing Copyrighted Content were effectively blocked, we lack empirical data to make any reasonable inferences with respect to the impact on the overall supply of Infringing Copyrighted Content,” the report notes.

“[W]ith respect to actual Canadian Internet user demand behavior (deterring and dissuading use of Infringing Copyrighted Content), we lack empirical data to make any reasonable inferences with respect to whether, even for those Internet users who may have attempted to access to a given site, the dynamic blocking approach here had any impact on the economic interests of Plaintiffs.”

No Legitimate Complaints About Blocking
While it was determined that no legitimate complaints were received relating to the injunction in general or over-blocking more specifically, some complaints were received. A Proton Mail email address was published on ISPs’ websites (1,2,3) specifically for that purpose and it went as well as could be expected.

“There was several vulgar emails from one individual that communicated displeasure with the issuance of the Order, generally. However, these were not relevant complaints,” the report notes.

“Additionally, an email was received from an IPTV service advertising ‘free iptv sport, news, kids channel [sic]’ along with a Whatsapp number and website address, and a second email relating to a spear phishing campaign.”

The report concludes with some recommendations, including a general suggestion that if ISPs scaled up their monitoring and provided a little more data on user activity, the plaintiffs would be in a better position to determine, in broad terms, if blocking is worthwhile and will make them more money.

Should there be any future requests for just a little more data, it seems unlikely that any will carry a wedge warning. Perhaps they should.