By Ted Rose, Operational Security, Service Provider Video Software and Solutions, Cisco

Many (if not most!) service providers identify illegal streaming as the next big threat to their business. The problem is that in the multi-faceted, continuously expanding landscape of illegal streaming, it's hard to define the enemy and even more difficult to choose the most effective response.

With this as the third in our IBC series about digital piracy trends, we'll take an inside look at streaming piracy operations, and discuss the efficacy of piracy prevention methods in use today - in particular, takedown notices and site-blocking.

Illegal Streaming Operating Models

Clearly, illegal streaming is not a small problem. Multiple available methods allow many different segments of the population to participate - be it the old, the young, the technically savvy, those with expendable income, and those with nothing but a cheap device and an Internet connection. Based on what we're seeing, many such demographic groupings are taking regular and full advantage of such illegal offerings - in some cases without even realizing that they are not using a legitimate service.

Different streaming piracy models have emerged, some offered for free and some as paid services to consumers. As it turns out, and it probably doesn't come as any great surprise: The vast majority of the illegal streaming activity is for pure commercial gain. Even the "free" websites usually aren't there to be free - they exist as part of a money-making ecosystem.

Four main models account for most of the illegal streaming of live content found on the Internet to date:

• Direct web streaming is a growing operating model for illegal streaming, attracting millions of viewers. As part of a study done by Zubair Rafique and others from Stony Brook University (2015), 23,000 related streaming webpages were identified, corresponding to 5,685 different domains. In the immediate future, we anticipate that direct web streaming - sites offering free, Flash-based broadcasts of live streams - will continue to be the most popular method of viewing illegal streams (at least for the general public).

• P2P (peer-to-peer) streaming is another model, similar to P2P file sharing. P2P streaming networks are limitless in size, with each user adding system capacity by way of bandwidth, storage space and CPU power. In fact, audiences of over 30,000 viewers have been observed on selected streams on a regular basis. The quality of streamed content on P2P networks is usually noticeably higher. On the other hand, they do require download of P2P clients, which may explain why direct web streaming is used more commonly.
• Closed streaming networks are subscription-based IPTV networks offered as full services with complete channel lineups, sometimes requiring a hardware device installed in the subscriber's premises that is either provided by the pirate or purchased separately by the subscriber. Subscribers of these networks don't have to suffer through countless ads as they do with open Internet streaming. Many of these closed networks offer HD quality video.

• Open source streaming clients are software-based clients that offer users a centralized interface for live channels and VOD content. The most popular example of this is Kodi. Kodi is a completely free and open source media player which is available on multiple operating systems and hardware platforms. While Kodi offers no illegal streaming content, it allows third parties to create addons; as a result, a vast quantity of pirated live channels and VOD content (movies and TV episodes) are available.

In short, pirates are continually expanding and exploring new ways of streaming content illegally over the Internet. With the scope and sophistication of such operations only expected to continue to grow, media and service provider businesses need to adapt the anti-piracy measures they use.

Current Anti-Piracy Measures for Illegal Streaming

Takedown notices have been used by copyright owners to fight piracy of their content assets for many years. The takedown notice grew out of the Digital Millennium Copyright Act ("DMCA"), in 1998. DMCA-backed takedown notices remain a popular tool to this day.

But are they working? Their sheer volume could suggest otherwise.

Consider: In 2013, copyright owners issued notices concerning more than 6.5 million infringing files, on more than 30,000 sites, every month. That comes out to more than 78 million notices per year. Over a 6-month period in 2013, the Motion Picture Association of America sent notices to search engines for approximately 12 million files, and notices to site operators for over 13 million files. Google reportedly receives more than 10 million takedown requests a week. It goes on and on, with little impact on the desired result.

Anti-piracy firms all make use of takedown notices to combat streaming piracy. However, there are several problems with the takedown notice approach, particularly as it applies to illegal video streaming. Here's the short list:

1. Takedown notices and removal requests are highly ineffective for live content (like sporting events), which last for a matter of hours. Unless infringing streams are removed during the event (which is rare), the efficacy is zero.

2. Many of the sites that host, index or support illegal video streaming are covered under the DMCA's "safe harbor" rules. As a result, sites like Google and YouTube (among many others), which actually act as gateways to infringing content, can't be touched as long as they can prove that they're playing by the rules.

"Playing by the rules" means responding expeditiously when notified by copyright owners of infringement. It follows that "expeditious" is undefined in the law, and different entities respond with different degrees of urgency. YouTube has an automated mechanism to respond, for instance, and can handle requests almost immediately. Others can take more than a day, and still be covered under safe harbor.

3. Some content delivery networks (CDNs) used to distribute live streams claim to respond to takedown notices, but this is questionable, at best. The effectiveness of the process is entirely dependent on the good will of the CDN. This is especially true of the many CDNs operating in geographic regions untouchable by DMCA-related legal actions.

4. While Google is responsive to takedown notices, its processes may actually enable users to find these sites in a more effective way. That's because when Google removes links, it adds a result at the bottom of its results page, informing users that a site was removed from the search results due to a DMCA complaint. One can click and view the complaint, which, of course, contains the actual URL of the website - and the desirable content - that was removed from the results. In addition, Google does not de-rank sites that are notorious for pirated material. Pirated material still ranks highly on Google, and is the source - particularly for newcomers to the world of illegal streaming - for finding illegal streams.

5. Not all takedown requests result in actual takedowns. For example, Twitter reports that of the 14,694 removal requests they received in the first half of 2015 (not including requests related to Vine and Periscope), material was removed in only 67% of the cases. This is because they "carefully review each report received" and follow up with the requestor, as appropriate. That methodology helps to manage issues of false positives, like competitively-motivated and false copyright infringement complaints (it happens.) But the necessity for human involvement in such a takedown process slows it down, which makes it an unattractive option for knocking down live streaming piracy.

Beyond takedowns, another mechanism used to fight illegal streaming is site blocking. However, site blocking is not an option in all parts of the world. Nonetheless, the efficacy of site blocking can be studied in those regions where it has been used for some time. The United Kingdom started blocking copyright infringing sites more than 4 years ago; studies have shown a definite impact on the amount of traffic to blocked sites.

To wit: According to a study from March 2015, on average, blocked sites in the U.K. lose 73.2% of their Amazon Alexa-estimated usage, following the site block. However, the studies don't address whether or not site blocking, as a policy, produced an overall decrease in streaming piracy. Even in regions where site blocking is a legal option, limitations and obstacles exist that can make it a less-than-ideal anti-piracy tool. Disputes can erupt, for instance, between operators and ISPs, about who should cover which costs. Other questions emerge about how mirror sites, proxies, and VPNs should be handled. Should only domains be blocked, or IP addresses as well? And so on.

Now What?

In reality, and especially when it comes to illegal streaming of live events, takedown notices and site blocking are really only partial solutions, and far from 100% effective. Streaming sites are resilient and pirates are motivated (both ideologically and financially) to recover as quickly as possible.

In our opinion, both take down notices and site blockings need to be supplemented with education and awareness -and new technological prevention mechanisms. Some service providers are already beginning to use termination technology that "kills" the stream of the infringing video source, but such efforts are nascent.

• Read Part One of our Security for Video blog series here
• Read Part Two of the series here