There’s an undeniable rise in the number of people illegally streaming pay TV. In recent years, there have been many reports of police actions and criminal prosecutions of pirates and the many businesses that support them. The challenge when reading and compiling such reports is quantifying the overall scope of the situation.

The global, multi-lingual, anti-piracy team at Cisco has spent decades monitoring the activities of hackers and pirates to gauge current and future threats. In recent years, we have added analytics components to quantify the scale of those threats, and the nature of the illicit streaming ecosystem worldwide. In this new series of blog posts on anti-piracy, we’ll present some insights from our knowledge of this space and our recent findings regarding the crisis facing broadcasters everywhere.

Unlicensed streams of live television generally break down into two types: ‘free’ or ‘open’ networks, and ‘closed’ networks. The open ones are freely available to anyone who knows (or can find) the site online and generally provide a poor user-experience, supported by flashing banner adverts and the occasional unwanted malware infection.

Closed networks are far bigger operations because everyone watching has paid to do so. Whether they’ve bought one of the many Android boxes sold online and on high streets around the world that come with preinstalled subscriptions, or whether they’ve simply paid for an account and are streaming it to their existing computing devices at home, these networks give a better experience than the “free” services…. until they’re raided by police in whatever country they’re based and the end-users have to find another provider.

One product that bridges the two types of networks (open and closed) is the frequently discussed “Kodi Boxes”. These are sometimes sold barebones, ready for people to install ‘add-ons’ for viewing open networks, and sometimes sold pre-configured with access to closed networks for a predefined amount of time e.g. a one-year subscription.

There are many online forums where people discuss ways to watch paid-for content without paying full-price to the rights holders and broadcasters. We typically see justifications for these practices based on cost and convenience. Also on these sites are organizations offering streaming services. These services vary greatly in size but the internet is a great equalizer – the end user is typically unaware of whether they’re paying for a service run by a teenager on a home PC, or a 15-person company with racks of servers and multiple satellite installations.

Consequently, the volume of trading done by these services ranges enormously too. For example:

• One operation had “tens of thousands” of customers: In August 2016, a raid in the UK of a streaming operation resulted in the seizure of approximately 30 servers and 15 satellite dishes providing content from many broadcasters worldwide. The head of the UK’s Police Intellectual Property Unit described the outfit as “a significant and highly resourced operation to distribute pirated television on an industrial scale to tens of thousands of people across the globe.” (Source)

• One operation had 70,000 customers: According to court papers during the investigation into a network in Malmö, Sweden in September 2016, there were 70,000 customers of this service.

• Another had 100,000 customers: In December 2011, the “Australian arm” of a global piracy group was raided on intelligence generated by a private investigator hired by a Chinese broadcaster. Police estimated that the shop “L&D LED Signs” was “part of a global piracy operation worth A$150 million a year and with 100,000 customers” (Source)

• A very large organization claims 170,000 subscribers: On the site of RAPIDIPTV they openly boast of having 170,000 subscribers. Even if it’s an inflated number, it’s an indicator of the potential size of this group.

Cisco’s anti-piracy team is highly active wherever piracy is discussed and conducted. From our experience, we know that those are examples of large players in this industry.

To get a greater understanding of the bigger picture, it’s worth analyzing one of the main places where live streaming servers are advertised: forums. Our investigations have shown that:

• Servers which have only been recently launched can be expected to have hundreds of subscribers
• Well-established servers might have 5,000-10,000 subscribers
• The most significant players (as shown above) might have tens of thousands of subscribers

We sampled one of the most active online forums for streaming services and saw 285 servers advertised. It’s not unusual to see them promoting their services openly like this for many years:

Conservatively, it’s fair to assess that for these 285 servers, there’s an average of 1,000 viewers per server in this highly competitive environment. When we extrapolate from the forum described above, we can conclude that this single forum can easily reach 285,000 viewers. An average forum has offerings of hundreds of servers and each one has thousands of customers. So, with hundreds of popular forums worldwide and thousands of customers per site, the global scale of the problem is clearly visible to those of us visiting the forums and maintaining statistics.

This series of blog posts will continue to highlight the findings of our ongoing research.

What do you think about the rise in illegal streaming of Pay TV? If you feel strongly about any of the topics raised in this piece (or ones we’ve left out!), use the comment box below to share your thoughts with us.

For more on our piracy intelligence research findings, please see these related blog posts:

• Same Pirates, New Means: From Card Sharing to Content Sharing
• Crack-down on video streaming-piracy on the rise
• A Few Words on Streaming Piracy Operations… and the Limitations of Current Anti-Piracy Measures