High Court court orders ordering ISPs to block certain websites that are deemed infringing have been around for around a decade in the UK.
Obtained by companies in the entertainment industry, mainly in the film, television and music sector, traditional orders are directed to websites of torrent platforms, streaming and file hosting, and ISPs take measures to prevent subscribers from accessing to them by ordinary means.
More recently, sports companies such as The Premier League, Matchroom Boxing, and Queensbury Promotions have obtained mandates to block live sports streaming from unlicensed streaming providers, primarily IPTV services.
While the goals of these injunctions are very similar, blocking pirated IPTV broadcasts is a more complex matter, as the targeted servers and systems are less static than traditional websites. However, the anti-piracy vendors involved in these projects enjoy a level of success, but how they actually achieve it is largely a mystery.
Today we can reveal an interesting aspect that has been hinted before but never fully explored: the cooperation of at least one of the major UK ISPs.
Court documents provide a general background
Already in 2017, there were indications that despite being charged in blocking injunctive relief, one or more ISPs actively assisted applicants from sports companies in their quest to block pirated broadcasts in the UK.
Then two years ago reported on comments conducted by Friend MTS, a UK-based anti-piracy company working with the Premier League and ISPs, which also confirmed a level of ISP cooperation.
However, the limited information available as part of a blocking warrant obtained by UEFA in 2020 put even more meat on the bones, suggesting that Sky had been monitor subscriber traffic access pirated servers.
Code Name: RedBeard
In recent weeks, an anonymous source shared a small trove of information related to the systems used to find, positively identify, and ultimately block pirate flows at ISPs. According to the documents, the Premier League work-related module is codenamed 'RedBeard'.
The activity seems to start during the week soccer games or PPV events take place. A set of scripts from the Friend MTS anti-piracy company is tasked with producing lists of IP addresses that are suspected of being connected to copyright infringement. These addresses are subsequently turned over to Amazon S3 buckets and ISPs use the data to block access to infringing video footage, the documents say.
During the actual event scan, content is compared manually or by fingerprinting, with IP addresses extracted from DNS information related to host names in URLs of media, load balancers, and servers hosting Electronic Program Guides (EPGs). ), all of which are used by unlicensed IPTV services.
Confirmed: Sky is providing traffic data to help IPTV blocking
So the big question is how the Premier League anti-piracy partner discovers the initial server IP addresses that it subsequently submits for ISP blocking.
According to the documents reviewed by TF, the information comes from three sources: regular monitoring by the anti-piracy company (identifying IP addresses and their / 24 range), manually entered IP addresses (IP addresses and ports), and a third , potentially more intriguing. source: the ISPs themselves.
"ISPs provide lists of Top Talker IP addresses, these are the IP addresses they see on their network that many consumers are getting a lot of bandwidth from," reveals one of the documents.
โIP addresses are the upload IP address that hosts information from which ISP clients are downloading information. They are not the IP addresses of the ISP customer's home Internet connections. "
The document disclosing this information is not dated, but other documents in the batch reference dates in 2021. At the time of publication, the document indicates that the ISP's cooperation is currently limited to Sky Broadband only. TorrentFreak asked Friend MTS if that's still the case or if more ISPs are now involved.
"While the details of our content protection technology commitments to our customers are strictly confidential, we can confirm that neither Sky nor any other ISP provides Friend MTS with any customer data, and they never have," said a spokesperson.
It appears that instead of monitoring clients' IP addresses, Sky is compiling data on the IP addresses that subscribers extract the most data from during (and potentially before) match or event hours. Then Sky uploads the highest traffic IP addresses along with the port on which the traffic is transmitted to the S3 bucket mentioned above, every five minutes. Then the anti-piracy company accesses it and, every five minutes, extracts the IP, the bandwidth rate and the port number on which the bandwidth is located.
At the time of publication of the document, Sky's 'Top Talker' threshold for the Premier League's 'RedBeard' module was 100 Mbps. IP address information provided by the ISP that exceeds this limit appears to have a reference crossed by IP address and port number with data obtained during the game week scan in Friend MTS. It is then processed accordingly.
Heaven today, more ISP tomorrow?
While the docs indicate that ISPs (plural) provide lists of 'Top Talker' IP addresses, from what we can see, only Sky is cooperating at the moment. However, the Premier League is also seeking the cooperation of additional ISPs. Obviously, this would be useful to identify potential 'pirated' servers and infrastructure so that they can be tested and subject to blocking, where appropriate.
In short, it appears that Sky subscribers are not being directly monitored per se, but the servers they get the most bandwidth from are being noticed by Sky and that data is being forwarded for anti-piracy measures. This means that the hacking habits of Sky subscribers directly provide information to support the blocking efforts of Premier League, Matchroom Boxing and Queensbury Promotions.
It remains a question whether that will affect the attitudes of IPTV providers towards Sky customers in the future.
