The Xtream Codes IPTV in Spain Takedown is Complex and Confused
By Andy on September 19, 2019
The international law enforcement action against Xtream Codes and what appear to be several entities using its services is a complex affair. While some will argue that the IPTV management service was a neutral player offering no illicit content, it’s becoming ever more clear that the authorities are viewing things from an entirely different and sometimes confusing perspective.
As reported Wednesday, police in Italy and several other European countries coordinated to take down Xtream Codes, at least one IPTV provider, and more than twenty individuals and related equipment linked to the services.
The precise roles of all these people remain unclear. However, there can be little doubt that emphasis is being placed on the importance of the Xtream Codes management system which, according to law enforcement officials, lay at the very heart of the targeted criminal operation even though the software didn’t supply any content.
This very large operation involved police forces in Italy, the Netherlands, France and Bulgaria. It was coordinated across borders with the assistance of Eurojust, an EU agency that helps agencies from member states to co-operate in criminal matters Sky Italy Sky Uk are more likely to be behind this than the tax police Sky Tv can lose millions a year from piracy so will be on the polices back daily
Yesterday afternoon, a press conference took place to explain how the operation panned out, who it had targeted, and to detail various additional pieces of information. It began with Filippo Spiezia, National Member for Italy at Eurojust, explaining that hundreds of officers had been involved in the operation to dismantle the technological infrastructure of a “criminal IPTV network.”
Spiezia confirmed that 181 servers had been taken down and seized and more than 800,000 users (police reported 700,000 earlier yesterday) had been disconnected from the Xtream Codes service when it was taken down.
In what became a common theme throughout the conference with several participants, Spieza sometimes appeared to speak generally about the entire operation, which included the takedown of at least one actual IPTV provider, then sometimes in relation to Xtream Codes alone.
This ambiguity and lack of clarity appear to be causing confusion. For example, Reuters reported the following yesterday:
“The biggest illegal platform shut down on Wednesday, dubbed Xtream Codes, had around 50 millions users worldwide,” Reuters reported, citing Gianluca Berruti of the Italian tax police.
“It sold a bundled pay-TV service that included premium content from Comcast’s Sky Italia, Netflix, Mediaset, Dazn, for a monthly subscription of 12 euros,” it claimed Berruti added.
Again, ‘pirate’ IPTV sellers utilizing the Xtream Codes platform may have been doing just that but, at this stage, the second claim above doesn’t make sense or indeed add up. Fifty million users multiplied by 12 euros a month is a staggering amount of money that wasn’t supported by financial information provided later in the conference.
In common with all of those present at yesterday’s gathering, Filippo Spiezia expressed satisfaction at the success of the international operation, noting that cross-border cooperation had proved invaluable since the investigation began.
“During these months of work at Eurojust, we have adapted to the judicial needs of the Italian authorities….to the specific legal requirements of our new partners. This is the first example of an action conducted with these modalities,” he said.
“Thanks to this action we have sent out a very clear signal to criminals that even in this specific domain, even in this specific area which represents the most advanced form of criminality, we will [respond] to them.”
Vincenzo Piscitelli, Deputy Prosecutor in Naples, painted a picture of small offenses by end-users (pirate IPTV subscribers) fueling “huge illegal activities” behind the scenes.
“So this is why we really tried to hit these organizational structures at the heart and that was done through the investigation that was carried out by the public prosecutor’s office of Naples,” he said.
Next up was Valeria Sico, Public Prosecutor in Naples. Sico spoke quickly and through a translator, so that may account for what at times felt like confusing output. While clearly an expert in law, those looking for clear and specific technical details from the Prosecutor failed to receive them.
Some of what Sico said made sense but the fact that Xtream Codes isn’t normally understood to be an actual provider of illegal streams (although it is undoubtedly used by outsiders to manage them), it’s worth reproducing some of her words in full, to see how muddied this has become.
“There was software created by two citizens of Greek nationality. They have a company which had a legal seat in Bulgaria,” Sico said, confirming the information previously supplied by the Italian authorities.
“So this software enables the disclosure and the transmission of [pirate] TV signals through digital ways to different servers which were constructed by the organizations, by the host providers in the Netherlands and in France.
“Through these servers, the signal – the digital signal – was therefore sent to different IP addresses of final users and these people would then receive the [illegal] television signal in their homes.”
Again, it’s worth reiterating that Sico was speaking through a translator so some context and detail may have been lost but from there, the explanation didn’t really become any more clear.
“For the first time, having identified the company that was producing the software, we went directly to the company that was producing the software so they were enabling people to decrypt the signal,” she said.
“So this is why we also went right to the physical place where the disclosure [broadcast] of the signal would take place within these hosting provider companies in Holland and in France….the signal was broadcast to the company that had created the illegal signal – the software company – and then that was sent to the end-users.”
Again, this isn’t the broadly accepted function of the Xtream Codes system, unless the company itself was also involved in the provision of illicit streams. That claim has been the subject of speculation in the past 24 hours, perhaps based on the Reuters report.
Thankfully, Cybercrime Prosecutor Lodewijk Van Zwieten from the Netherlands kept things fairly simple in his prepared speech.
He began by noting that 93 servers had been taken down in one location in the Netherlands, all of which had targeted the Italian market. This seems to be a reference to equipment operated by the actual IPTV provider shown in the video published yesterday.
According to a chart published by the authorities and reproduced below, it was using the Xtream Codes management software, something which seems to have led the company’s software becoming embroiled in the investigation Iptv in Spain is getting harder for you all.