Unlike its neighboring Nordic countries, Sweden has decided not to effectively outlaw the purchasing of illegal internet protocol television (IPTV) which unlawfully distributes audio-visual content. Only in Sweden—a country with roughly ten million inhabitants—600,000 users provide continued capital inflow of an estimated 45M USD per annum to organized crime groups (OCGs). There are more IPTV users in Sweden than inhabitants of Gothenburg, its second largest city.

On November 2nd 2021 in the small southern Swedish city of Bromölla the prosecution charged an individual who is suspected of running an IPTV reseller with more than 40.000 users. Even if prosecuted, he might just be one out of 1200+ IPTV resellers in Sweden servicing nearly 9% of the Swedish population.

Ironically, due to novel Blockchain-based analytics and crypto forensics connected to it, IPTV transactions can be traced back to serious crimes like human trafficking or arms dealing. As certain cryptocurrency wallets are connected to compliant financial institutions, as described here, investigation on the Blockchain allows for connecting transactions with user identity and potentially seizing of funds.

Due to the lack of legislative progress in Sweden as a result of shortage of adequate funds for law enforcement for combating illegal IPTV subscriptions (link to a courtcase B6674-20), as well as the complexity in combating cross-border transactions, this illicit business continues to grow into a low-risk, high-profit criminal activity.

Despite the IPTV razzia, the signal recovered

Synergies created by the merger of teams of economic and financial experts under the new European Financial and Economic Crime Centre resulted in a razzia in which the police stormed the servers of an illegal streaming service in Spain in the summer of 2020. They shut down 50 resellers and 40,000 channels; 2 million paying subscribers had their signals turned off.

Other distributors connected with  illicit Spanish distributor made services available on three continents, generating more than €15 million in profit, of which nearly five million have been seized. Despite arresting 11 suspects as part of a coordinated razzia by Europol and Eurojust, shortly afterwards, the criminal network had managed to redirect the funds and to turn on the streaming signal again to its subscribers. The fall of the Spanish OCG has been an important but small victory for anti-piracy organizations, however the fact that the signal was able to return quickly displays deficiencies in dealing with the problem, e.g. focusing on suspects instead of technology.

IPTV distributes illicit, mostly international audio-visual content to individual subscribers. In order to access IPTV, potential customers are being asked to purchase a receiver hardware for around 100 USD, on top of a monthly subscription of 30–120 USD, for which subscribers get 20,000 to 380,000 channels and streaming services.

Initially, the crime victims appear to be the relatively wealthy television industry and streaming services that miss out on video-on-demand payments from individual customers who would otherwise rent or buy a movie online.

Interviewed members of law enforcement have stated that even though details should not be shared in the article to not disclose investigations tactics, the connection to transnational organized crimes, including child abuse, arms trading, and drug shipments, remains evident.

This contradicts a general perception connecting illegal IPTV to be a synonym for “crime with limited consequences.”

According to the latest report from the Intellectual Property Office of the European Union from 2019 in Sweden, 600,000 users aged 16-74 buy their services from illegal providers. The country has been defined as the “Countries most affected by online illegal IPTV are the Netherlands and Sweden, where almost 9 % of the population is estimated to access unauthorised IPTV”

Investigators anticipate that this number has grown in double digits due to the Covid19 pandemic and the resulting increase of offering. As of today, there are more than 1200 websites offering illegal IPTV services for Nordic customers. Some frontends have been so professionally designed, offering instant payment methods and 24/7 customer service, that users might be unaware that their purchases fuel criminal activities.

A total of 1200 resellers connect to a handful of suppliers

Nearly all of the 1200+ websites can be linked to a handful of so-called “decoders,” which are transnational criminal organizations that handle the transcoding and streaming infrastructure, while generating the majority of the illegally generated revenue. Decoders are criminal organizations which have the technical capacity to steal and record the signal directly from geostationary (TV signal) satellites. They decrypt satellite signals, record the visual of every possible television provider, and stream it via the internet in real-time via their criminal network, which includes resellers transmitting to millions of receivers that are connected to paying customers of the illegal services.

“The effects of hundreds of thousands of customers transferring funds on a monthly basis to organized crime groups is being underestimated. Due to their tremendous and continuous incoming flow of funds, those organizations support everything from human trafficking to arms trafficking. Even though the cooperation with law enforcement has been progressive, it seems that lawmakers in Sweden haven’t placed focus on following other Nordic countries and banning the purchase of IPTVs. Unfortunate promises to change those laws have not materialized for years, which is pretty discouraging.”

—Anders Braf , CEO Nordic Content Protection Agency 

The 1200+ resellers which are offering services to Nordic customers act mostly as front-end B2C middle-men that act as money mules. They usually store or provide little-to-no hardware but provide commercial as well as advanced technical support to the users.

The decoders have mastered the concept of profit-sharing with resellers to perfection. Subscriber > Reseller > Decoder

In a drop shipping-like business model, “decoders” connect individuals who would like to join their criminal network as a new reseller, often in less than a couple of hours. Drop shipping is a type of fulfilment method in which the reseller doesn’t keep the actual product in the warehouse. Instead, with each purchase of an IPTV subscription the reseller provides a direct connection to the decrypted satellite signal provided by  the decoder. In this way the reseller handles the payments and customer service but not the TV signal or hardware directly.

To become an illicit reseller only requires a domain, an email account, simple website and some sort of customer service access to master customer interactions. When a user places an order, the reseller notifies the decoder to either ship a hardware box or to electronically turn on the signal. Users receive a login and a password and are notified when their subscription is about to start or expire.

The daily combating of IPTV crime in Sweden remains rather gloomy. With nine(!) dedicated officers, there are five times more IPTV resellers than there are members of the Swedish police force working in the National Operations Department (NOA), which deals with intellectual property crime (IPC) on the national level. Furthermore, IPC includes several types of violations e.g  trademark violations, literary or artistic works violations. With the low number of law enforcement agents, illegal IPTVs are not purely their area of focus.

Most of IPC in the internet age requires expertise in various  areas often including  Blockchain. Investigators interviewed for this article underline that IPC  investigations can often not be performed at local police stations and usually happen, or rather get stuck, on a national level, where a continued shortage of officers often hinders the processing of increasing amounts of evidence. Despite their high morale, competence and goodwill, the critically understaffed Swedish police force is simply unable to cope with the increasing number of incoming police reports and their increasing complexity.

With the legislators unwilling to take action, the hope to act has been placed on the television industry, which takes an official stand against IPTV, as IP-related crime affects, for example, video-on-demand business and profit margins. The question is how effective national actions of “taking a stance against IPTV” really are.

The Swedish television industry finances two main anti-piracy organizations. One of them is the Nordic Content Protection Agency (NCP), which employs private investigators and comprises exclusively of former law enforcement agents. It was established in 2016 and is stated to be the leading anti-piracy organization working for the television industry in the Nordic countries. The NCP collects evidence, prepares police reports, raises public awareness and educates current members of law enforcement within their areas of  responsibilities.

The second organization  is the Swedish Rights Alliance (Swedish: Rättighetsalliansen), previously known as the “Swedish Anti Piracy Office,” (Antipiratbyrån), known for bringing down the infamous Pirate Bay. Both NCP and Rattghetsalliansen address the same area of responsibilities but they are financed by different  members of the Television Industry.

The problem gets very visible when looking behind shiny websites to see how much manpower they have at their disposal to combat IPC crimes on daily basis. According to its website,  Rattghetsalliansen consists of only two employees: one investigator and one lawyer. The NCP employs multiple investigators, but only one of them oversees Sweden.

So, despite the high-sounding commitment claimed by the Television industry, both of the anti-piracy organizations employ only one (!) investigator for each Nordic country. With only two investigators paid by private industry per country, a quick calculation reveals that every investigator must oversee more than 300,000 users and at least 600 resellers.

Even with the extensive experience and advanced technical skills it is obvious that two investigators can only do so much. It is worth noting that, despite the limited resources, it was the NCP that provided valid intelligence for the police raid in Spain and multiple pending investigations cannot be released publicly).

The reason why Sweden, unlike other Nordic countries, has not fully outlawed buying IPTVs remains uncertain. Currently users can be only punished for purchasing IPTV when they are willingly aware that this is an illicit activity. Using such a provision in law, is against a common approach that ‘ignorance of the law is no defense’. Using this logic would make a prosecution of any crime impossible as every suspect would claim  to be unaware to avoid punishment.

To date, there have been only a few IPTV prosecutions in the country. However, in a recent ruling (Case number: B 16831-17), selling or reselling IPTVs was considered illegal, while purchasing them remains fully legal as long as the buyer does not own any decoding equipment. Despite numerous attempts, four prosecutors declined to comment on why the purchasing of IPTVs has not been outlawed, the number of cases that have been brought to trial, or any statistics related to the success rate of former IPTV cases.

The proliferation of IPTV services crosses paths  with Blockchain investigators, as some resellers try to motivate their users to pay for the service via cryptocurrency wallets.

With the increasing traceability of cryptocurrencies, as described in previous articles, leading Blockchain-focused analytical tools offer the possibility of marking cryptocurrency wallets connected with a particular illicit activity through a process that allows flagging, monitoring and blocking transactions.

For readers who are newbies to Blockchain investigations, several groups of cryptocurrency wallets are being marked by commercial providers such as darknet, high-risk, p2p exchanges etc.As of today, the leading provider of Blockchain analytical software, Chainalysis, confirmed that it does not cluster IPTV sellers or resellers yet. Others, like the Finnish Valega Chain, which is more hyper localized, have introduced such a warning-system that allows cryptocurrency brokers to stop transactions, freeze their funds or seize funds before a transaction connected to IPC is being processed by a broker. Cryptocurrency transactions which have been accused of fueling IPC might represent a vital component of bringing the IPTV  providers to justice.

Without more structured help from other leading Blockchain-analytical-tools, the virtual asset service providers (VASPs) have to use their skills and a risk-based approach to fight IPC resellers. This is a fight that they are not legally required to take, and which might be impossible to facilitate with 1200+ websites accepting all types of payments. However with a knowledge of what the funds finance, and how intellectual property crime by illegal IPTV services tie into money laundering and terrorism financing, it is considered a battle worth fighting.

With limited support from legislators, despite existing AML laws, little support from Blockchain analytical tools, only a handful of officers, and a private industry that does the bare minimum to claim that they take a stand against IPTV in Sweden, it is an uneven fight.

Criminals searching for a high profit, low risk, and unsolvable crime that  lawmakers decided to spend as little taxpayer money on as possible, might find illegal IPTV as coming as close as it comes to perfect cybercrime.

Within the next 30 days, it is expected that 600,000 Swedish users will transfer their monthly subscription fee to one of the many illegal IPTV providers, resulting in a transaction of roughly 45M USD. This amount, even if diminished by commission charged by resellers, is enough to purchase 85,000 Glock 19,9mm pistols, which cost 500 USD each, plus shipping to a designated location around the globe. Judging on the amount of the little amount of the taxpayers money that is being spent in Sweden on combating IPTV crime, it seems that little amount of people worry, where those pistols might end up.

Read more here.