New Pirate IPTV Crackdown, Déjà Vu, and the Resilience of Organized Crime

Italy generates more headlines concerning boots-on-the-ground anti-piracy operations than any other country in Europe.

If we consider volume of events, no other member state comes anywhere close. If the claimed number of subscribers of every service allegedly shut down in the last decade were added together, the whole of Europe combined couldn’t mount a credible challenge.

Yet, the larger the subscriber numbers, the more difficult it becomes to find a credible scenario that not only accommodates them, but also acknowledges the credibility of the rest of the data. The same pattern has continued for the past decade, but thanks to a new announcement reporting on a large network targeted recently, the fog begins to clear.

The New ‘Maxi Operation’

Italian law enforcement doesn’t always coordinate their announcements, which can lead to more than one press release on the same topic. In this case an announcement from the State Police (1) is less colorful than the variant published by the Postal Police (2).

“As a result of a complex investigation coordinated by the District Prosecutor’s Office in Catania, the State Police carried out an arrest warrant issued by the Judge of Preliminary Investigation (GIP) of the Tribunale del Capoluogo of Catania against eight people, some of whom are residents abroad, who are being investigated for crimes of organized crime aimed at the illicit diffusion of pay-TV broadcasts, unauthorized access to a computer system and computer fraud,” the statement reads.

Those targeted are alleged members of an organized criminal group, responsible for the illegal distribution of live TV and on-demand content owned by Sky, DAZN, Mediaset, Netflix and Amazon Prime. Police state that the estimated monthly profits generated by the illegal IPTV operation run to “millions of euros” and in an unusual move, go on to name the ‘pirate’ brands involved.

“These are the acronyms of illegal IPTV, some of which recall the names of well-known legal platforms: ‘NOWTV’, ‘UNITY’, ‘PLAYTV’, ‘PLATINUM’, ‘M&S’, ‘ENJOY’, ‘MOMY’, ‘HERMES’, ‘LUCKYSTREAMING’, ‘SKYNET’ and ‘GOLDRAKE’.”

The Alleged Roles of Those Arrested

Investigators say the people targeted are unusually important.

Based on the evidence collected, they are considered “a kind of top management for the Italian illegal streaming market, which not only promoted and directed the criminal association (for which the investigation is proceeding), but also decided on subscription costs, service suspension, and distribution methods for devices, coordinating individual operators across the national territory.”

In a short video posted to YouTube, the following diagram appears for just a couple of seconds; it appears to show eight people, details of their roles, and presumably a graphical representation of their network.

“To carry out their illicit activity, the organization exploited a complex technical infrastructure that involved the use of numerous rented servers hosted by foreign hosting companies, whose management was entrusted to associates with specific IT expertise.”

Hoping to evade investigators, the arrested suspects reportedly relied on encrypted messengers and false identities, which were used to register telephone lines, obtain credit cards, TV subscriptions and server rentals.

Police then provide a short recap on the money allegedly being made, followed by a very large, attention-grabbing number.

In this context and when specifically highlighted, the 900,000 subscriber suggestion is obviously ambiguous. However, when repeated elsewhere as part of a conversation, more often than not it’s presented as fact, despite making no real sense.

For how long the service was monitored isn’t revealed but €10 per month multiplied by the implied number of subscribers is €9 million in monthly revenue. If we take the hint and assume that represents 70% of the local IPTV piracy market, Italy must have in the region of 1.285 million pirate subscribers overall, together spending €12.85 million per month or €154.2 million per year.

Given the number reported, did all of those subscribers have their access blocked following a single operation in June 2024? That seems unlikely.

The latest statement concerning the most recent operation does not claim that the pirate IPTV network allegedly controlled by the suspects was blocked or shut down.

Quite a few publications report that the network was dismantled, but none provide a source for the claim. As the example below shows, further distortion isn’t out of the question either.

Information accuracy loop of doom….

Whether Sky has additional details isn’t clear but its report states that the operation dismantled the “summit of the illegal market” and confirmed that the suspects are being held under house arrest.

Big Operations, Big Numbers

So, if the big numbers are even close to being authentic, 70% of the entire illegal market may already be in peril. That should be a cause for celebration but in general terms, that doesn’t seem to be the case.

Stefano Azzi, CEO of Dazn Italia, thanked the authorities for their hard work but said the volume of piracy involved “only covers a fraction of the total.” On the other hand, he welcomed the possibility that there are “900,000 users potentially affected and potentially identifiable,” a nod towards suing them, perhaps?

Overall, it’s almost impossible to make full sense of even the most basic facts released to the public, let alone have an opinion on progress. Looking back on earlier reports quickly descends into yet more déjà vu but does help to explain why many aspects of various operations tend to look the same.

This Sounds Familiar

The latest announcement revealed that the arrested suspects are residents of Catania, Syracuse, Rome, Brescia, and unnamed foreign countries. Police say they were identified through analysis of seized devices and “financial flows” reviewed as part of an operation dating back to November 2022.

A notable feature of that 2022 operation is that it also targeted locations in Catania, Syracuse, Rome, and Brescia, just like the recent one. The size of the piracy network targeted looks familiar too, as does its claimed share of the pirate market.

At an awards ceremony in October 2023, the Audiovisual Anti-Piracy Alliance (AAPA) recognized Italy’s anti-piracy work under the banner Operation Gotha, which had targeted the ‘900K user’ network the previous year.

“The commendation for Italy for Operation Gotha involved 70 searches and seizures in 23 provinces of our country, dismantling a huge pirate IPTV network serving over 900k users, with profits estimated at 10 million euros,” the announcement reads.

Then in December 2023, an operation with a very similar appearance took place in familiar circumstances, targeting people similarly intent on avoiding the authorities, using the exact same techniques reported in the latest operation.

“In order to evade investigations, the suspects made use of encrypted messaging applications, fictitious identities and false documents; the latter were also used for the registration of telephone accounts, credit cards, television subscriptions and server rental,” the Postal Police reported.

Operation Gotha and Operation Gotha 2

We can only assume that whoever named Operation Gotha and Operation Gotha 2 was fully aware of an infamous operation with an identical name. It, too, had similar aims of dealing a decisive blow to aspects of organized crime in Italy and by some accounts it very nearly did.

The fact that its IPTV namesake in 2022 (Operation Gotha), was a continuation of Operation Blackout a year earlier, is certainly noteworthy. To protect content owned by Sky, DAZN, Mediaset, and Netflix, that operation targeted a pyramid-based network controlling an estimated 80 percent of the illegal IPTV flow into Italy, generating around 15 million euros per month. The numbers are slightly different, the similarities are difficult to ignore.

Xtream Codes – 700,000 Users

Keep going and the pirate IPTV trail leads all the way back to the 2019 shutdown of Xtream Codes and other IPTV platforms. That reportedly led to the disruption of 700,000 users.

Soon after dozens of articles appeared in Italian media claiming to identify the alleged kingpin behind the majority of pirate IPTV supply in Italy. He was arrested a year later but what happened after that is unclear.

A number of reports claim that the Camorra became interested in his business, presumably due to the money allegedly on offer. Other reports suggest that he may have become a victim of extortion. As for the collapse of pirate IPTV in Italy and elsewhere in Europe, it recovered remarkably quickly.

Overall, it would be tempting to conclude that for the last six years the same network has been targeted again and again, which would go some way to explaining the similarities between operations. Ultimately, the only certainty is the complexity of the enforcement landscape in Italy.

The judicial authorities, law enforcement agencies, and all major rightsholders appear to be doing whatever they can in what can only be described as an extremely challenging environment; damage inflicted seems temporary and due to the profit involved, always likely to be repaired.