US Piracy Report


By David Lawson, Editor Of American Hacker


While equipment manufacturer General Instrument claims that the Videocipher II data stream was shut off over a year ago, it is still being used for some services. These include regional sports networks including various feeds from Home Sports Entertainment, Sports Channel, ADC, Pacific Sports Network, and Sunshine, AMC, Nick E, Life E&W, WWOR, MTV, Discovery E&W, VH1, CMTV, ESPN E&W, CNN W, TBS W, WGN, CNBC W, TNT W, TNN W, USA E&W, CHN, A&E W, Youth (Canadian). These services are still being transmitted in VCII mode because not all cable companies have installed VCII PLUS decoders at their headends.

The working keys for these channels change every few days and they are subject to an on-going ECM (electronic countermeasure) program so audio is not always available for all channels.

There is software available on BBS's which allows users to receive audio and video on these channels. Authorized seed keys are necessary. The net effect is to clone the VCII to the decoder which is really using those keys. EPROM chips loaded with working keys are available for about $50 and they work until GI extracts the keys from them and shuts them off. The most practical way to obtain audio and video for these services is by connecting a modem to the VCII decoder. Every few days the user can push a button on his remote control to download the latest keys.

This method has been abandoned by most individual users, because the long distance charges, hardware upgrades, and aggravation is not worth the cost. There are some satellite dealers who still use the system for their customers.

Many of those who still use their VCII boards, employ them to obtain video-only on PLUS encoded adult channels. There are several available, ranging from softcore to XXX. They include Adam & Eve, Cupid, Exxxtasy, LVTN, Network 1, Playboy, Spice 1, Spice 2, and TV Erotica , Video-only chips are available and EPROM files are available on many BBS's.

Some individuals pirate the 10 TVN PPV movie services on T3 on an 029 PLUS board by taking a "snapshot" of the RAM at the start of the month. They watch all the movies they want to during the month, and then at the end of the month they reload the data captured at the start of the month. When the unit is polled for PPV purchases it shows none so they are not billed. There is a period of approximately 10 days at the end of the cycle when no movies are watched. Many individuals misuse the Surewrit 9 test device for this purpose. We have a file on the BBS called Plusmap.txt for those interested in studying further.

DSS

According to RCA, the receiver must be connected to a phone line. Where the deluxe system is installed, they say each receiver must be connected to the same phone line via the 1200 baud modem. (The unit also has a 19,200 modem). The phone line is not used to transmit authorization data to keep the receiver running. The receiver calls out monthly to report what pay-per-view movies have been ordered. It is also used to verify the location where the system is installed.

Some individuals install the units at remote cottages or RV's where there is no phone. In this case, DirecTV has a backup system so individuals without phones may order PPV events manually by calling their 800 number. There is a $2 charge in addition to the cost of the movie for this service.

As long as the unit is not connected to a phone line, the system operators have no idea where it is, so it could be in Canada, Mexico or the Caribbean. Some U.S. individuals who wish to obtain local blacked out sporting events use a billing address different from where the unit is installed, for this purpose. It is still necessary to purchase the NFL, NHL, NBA, etc. package and the unit must be connected to a phone line.

Mail drops usually advertise under Mail Boxes or Telephone Answering Services.

Those who purchase a deluxe system including a second receiver, obtain a programming discount for the second receiver. The primary receiver pays full price and DirecTV charges $1.95 extra and USSB charges $1 per month for programming received on the second receiver. The second receiver receives whatever programming is subscribed to on the primary receiver.

Some dealers split systems. They place the primary receiver in a friendly location. The secondary receiver is typically sold to a Canadian. The dealer charges the full price for programming but only has to pay $1.95 plus $1. This can amount to a profit of $60 per month, every month per customer and is more profitable than VCII piracy was for many of them. We have heard that some installers have been requested to connect both receivers to the single phone line during authorization and that they have done that before splitting them up. We have also heard that some individuals have told DirecTV during the authorization process that the primary receiver would be located at their residence and the secondary would be located at a remote cottage and they have received the discount but they are not able to order PPV on the secondary receiver. Some individuals are selling a unit which intercepts the 800 number the receiver is programmed to dial and routes the call to a U.S. number where the 800 number call is then placed. These units will be necessary this fall when the football season begins, at least for those who don't have a pirate smartcard.

The dialers being sold now cost $125 and Canadian consumers who purchase them are unaware that hundreds of their calls are being routed through the same US phone number. It is only a matter of time before this system is shut down. Advanced Technologies will soon market a system which allows the user to set up his own network. Another company is developing a system which allows the user to manually enter the phone number being used. The only other problems we have heard regarding this type of gray market piracy is when foreigners have ordered PPV events while having the receiver connected to a phone line. In some cases they have received mail messages to their dishes requesting that they contact DirecTV to verify that their systems are in the U.S. Then they have been told that if DirecTV receives calls from a foreign area code their programming will be discontinued. Some do not order PPV events for this reason and others order manually.

The major news which occurred just before we went to press is that the RCA system has just been hacked. According to reliable sources a nearly six month effort on the part of a U.S.-European coalition has lead to the compromise of the system. Current plans involve the issue of 4 tiers of pirate cards. The Blue card will offer only basic programming and will cost approximately $150. The next level card will include the subscription movie channels, the next level card will also include the sports channels together with packages like the NFL etc. The Gold card will be a global access card which will allow access to all services and will include a limit of $500 in PPV programming. Note that the pirates are now limiting the amount of PPV events their customers will receive. To prevent the pirate card from being pirated it will employ a kill routine so that once it is inserted into the card slot in the receiver it may not be removed without dumping the memory.

It will be necessary for those who engage in this type of piracy to mail in their existing cards or otherwise supply their unit ID in order to provide necessary information. Each pirate card will be unique to a specific receiver. Programming will be done in Canada where it will ostensibly not be illegal, at least for now. Three Canadian companies will essentially have franchises and will receive the necessary hardware/software.

Release of the cards is expected around April, depending on two factors. The developers want to wait for the release of the series 10 Videocrypt cards in Europe. At this time the 09 series pirate cards are being heavily ECM'd and a new release is imminent. One company supplies the encryption algorithms for both U.S. and European cards. The U.S. card is based on the 09 series card in Europe. U.S. developers don't want their card reversed and counter ECM'd in the 10 series so they choose to wait. They also want an installed base of about 800,000 systems to make it more costly for system operators to issue a new series of cards. They have said in interviews that it costs them up to $35/card if they have to issue a new series because of a breach of security.

In the past, we have sometimes been able to alert our readers several months in advance to events which would transpire. When we have done that, some entrepreneurs would immediately offer products which did in fact not yet exist. This is March 11, 1995 and there is no pirate card for the RCA system available anywhere at this time nor will there be in the very near future. We will be allowed to see the system somewhere offshore and we will report our findings. Do not send money to anyone. We will have more DBS news next time together with more discussion of the issues involved. Do not send money to anyone.

© 1995 American Hacker