Missing link: High-tech and dogs – Investigations against streaming pirates
Illegal streaming is growing again. However, the time of investigators overwhelmed by technology is over – This also affects users. A look behind the scenes.
Paladin is the first mobile forensics laboratory to be used in Germany to combat cybercrime.
(Image: Polizei Oberfranken)
Streaming has overtaken traditional television reception. According to Bitkom, the proportion of people in Germany who stream videos over the internet is now 87 percent – and therefore one percentage point higher than TV viewers.
The flip side of the coin: 5.9 million Germans access illegal linear TV streams. This was the result of the TV piracy study conducted by the private television and radio association VAUNET in 2022. The number of illegal viewers has doubled since 2018.
In its report from May 2025, the British research firm Enders Analysis, which specializes in the creative industries, broadcasting, and digital exploitation models, explains that copyrighted content is being pirated "on an industrial scale": Films, series, TV shows and, above all, sporting events are streamed illegally over the internet.
Child pornography, fake stores, card sharing
The Bavarian Cybercrime Center (ZCB) wants to put a stop to this activity. The ZCB has carried out extensive searches in two cases since the beginning of the year, including the seizure of numerous servers. "Experience has shown that the evaluation of the seized data always takes some time," explains Senior Public Prosecutor Thomas Goger, Deputy Head of the ZCB, which is based at the Bamberg Public Prosecutor General's Office.
The ZCB has been existing since 2015. With 30 public prosecutors and a team of IT forensic experts, the Bamberg office, together with the central offices in Frankfurt, Cologne, and Karlsruhe, is one of the four major authorities combating cybercrime in Germany. Their areas of activity include child pornography, cybercrime in the narrower sense – hacker attacks and, for example, the illegal online trade in weapons or drugs – and economic cybercrime. The latter, in turn, is divided into three areas: fraudulent online trading platforms, fake stores, and copyright infringements, which include streaming piracy and card sharing.
Goger confirms: Streaming piracy has been on the rise again for around two years, he says. However, even he can only speculate as to the reasons. It could be due to rising subscription prices and for premium content such as soccer. In the case of sport, the rights are often distributed among various providers. The increasing availability of high bandwidths could also encourage the use of illegal streaming services.
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externes YouTube-Video (Google Ireland Limited) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (Google Ireland Limited) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
Highly complex technical investigations
The ZCB works in a high-tech world. "These are highly complex technical investigations," explains senior public prosecutor Goger. The networks of streaming pirates frequently extend across several countries, meaning that the ZCB has to apply for legal assistance. Cascading and anonymization techniques as well as payment transactions using cryptocurrencies make the ZCB's work more difficult. "If the perpetrators then also use mixing services, cryptocurrency investigations are very challenging," says Goger, providing an insight into the ZCB's work.
Investigating authorities only enter the so-called open phase when they are certain that they can convict as complete a network as possible. The police then search premises and seize hardware – from the server to the USB stick. The tactically best time to make investigations public may well be years of work at the ZCB. "It can then take some time before a judgement is reached," says Goger.
"Times of the overburdened state are over"
Nevertheless, Goger does not curse the technical development, even though ever cheaper mass storage and NAS systems are making it easier to set up and operate illegal streaming networks. User-friendly VPN tools make it easier for customers to use piracy services.
"Many perpetrators have not yet understood that the times when the state was helpless and overwhelmed in the face of such offenses are over," says Goger. "International cooperation also works much better than many offenders believe."
There are certainly still countries in which local investigating authorities request legal assistance in vain. But not every server used for illegal activities is located on a remote Caribbean island. Data centers in Europe with stable connections and high availability are also of interest to streaming pirates. The majority of TOR servers are located in German and Dutch data centres, for example.
Cat-and-mouse game
There is a cat-and-mouse game between investigating authorities and streaming pirates. The latter use their income primarily to constantly upgrade their technology to remain unrecognized. On the other hand, the authorities are arming themselves to arrest the perpetrators.
In the recent past, the successes of the investigating authorities have been increasing. "They clearly show that the prioritization of piracy cases by German law enforcement authorities is becoming increasingly important," a spokeswoman for pay-TV provider Sky told heise online.
High-tech and dogs
The "Paladin" mobile forensics laboratory from the Upper Franconia police headquarters was used in the searches of nine properties in two Bavarian districts as well as in Munich and Hamburg at the beginning of June 2025. It is the first vehicle of its kind, equipped with an almost complete forensics laboratory, to be used in Germany to secure and analyze digital data on site.
Ideally, the police will catch the streaming pirates in front of the open computer. Rarely, but increasingly often, live backups are made on the running computer, for example, to identify tokens via memory images that can be used for further investigations. "Often, we also work with data carrier sniffer dogs," adds Goger. These dogs are trained to find digital data carriers of all kinds.
As the investigating authorities never know whether they have fully identified an illegal piracy network, on-site data security plays a key role. "There is always a residual risk that there is still someone somewhere who is carrying out a kill switch," says Goger. Time is a key factor, especially when seizing cryptocurrencies, as the officers do not know who holds the private key to the wallet. "After all, we don't want to watch as the coins on the blockchain continue to be transferred," says Goger.
"Everyone must expect legal proceedings"
The ZCB is taking action against the operators of illegal streaming networks and resellers. "Possibly also against larger customers who, for example, supply their sports betting studios with illegal streaming services," adds Goger. However, end users of illegal streaming services should not breathe a sigh of relief. "We hand over all of these proceedings to the local public prosecutor's offices," explains Goger. "We certainly won't be shooting at sparrows with a cannon, but everyone must expect corresponding investigation proceedings."
Users are also facing trouble from another side. "Sky expressly supports the actions of the law enforcement authorities and, in many cases, is itself filing criminal charges against users of illegal content," explains the pay-TV provider's spokesperson. She points out that illegal streaming is not a victimless offence. "It is known from various studies that the harmful effects of illegal streaming offers on the creative industry are considerable – from the loss of jobs to lost tax revenues," the spokesperson continued.
The VAUNET TV piracy study puts the economic damage in Germany caused by illegal streams of linear TV channels at around 1.1 billion euros. If upstream and downstream markets such as TV production, the telecommunications/IT industry, gastronomy and the advertising industry are included, the total damage increases to EUR 1.8 billion.
Videos by heise
Cooperation with investigating authorities
In order to minimize the damage, rights holders and rights exploiters such as Sky are in contact with the law enforcement authorities. By the time the cases reach the ZCB, pay-TV and streaming providers and rights holders such as the major Hollywood studios or the German Football League (DFL) have already made some advance payments.
Sky systematically analyzes illegal content on the internet, from traditional IPTV to social media platforms, forums, and commercial streaming portals. The pay-TV provider forwards the information it gathers on criminal practices to the law enforcement authorities and provides them with technical and legal expertise.
However, there is no institutionalized cooperation between the providers and the law enforcement authorities. "After all, we are not there to enforce private rights, and we also have to act in a competitively neutral manner," explains Goger.
Data retention solution?
Even though highly equipped central offices such as the ZCB are successfully combating cybercrime, there are points that would make his work easier for Chief Public Prosecutor Goger. The lack of IPv4 addresses means that such addresses are assigned dynamically or multiple times using network address translation – The latter especially in mobile communications. "There is no technical need to use these techniques for IPv6 as well," criticizes Goger, pointing out that there are also dynamic IPv6 addresses, for example.
Goger would like to see the emotionally charged debate about data retention objectified. He is cautiously optimistic that there could be a solution that satisfies all sides, especially as the German government has announced a reform of cybercriminal law in the coalition agreement.
"The fact that we are usually no longer able to assign IP addresses to a connection owner after just a few days is a real problem in the fight against cybercrime," says Goger. This also has nothing to do with the threat of total surveillance by the state. "I'm not lying in wait online all over the internet and waiting for your IP address to come round."
(nen)
