Soon after, the site \u2013 which in the main facilitated access to MLB, NBA, NFL, and NHL content \u2013 disappeared and began redirecting to ACE. We can confirm that a settlement was reached but since both sides are honoring their agreement, no further details are available.<\/p>\n
For HeHeStreams\u2019 operator, who founded the site in 2016\/17, felt the shutdown marked the end of an era from which he could move on but that wasn\u2019t to be the case. A separate criminal investigation representing a different set of rightsholders was already underway, one that doesn\u2019t come with the option of a civil settlement.<\/p>\n
HeHeStreams Operator Charged With Numerous Crimes<\/h2>\n
Joshua Streit, better known online as Josh Brody, was named yesterday as the operator of HeHeStreams. According to the Department of Justice, Streit has been charged with numerous crimes including computer systems intrusions at Major League Baseball and the illegally streaming of content from MLB, NBA, NFL and NHL to the public, for profit. He was also charged with attempting to extort $150,000 from MLB.<\/p>\n
Before diving into those details, an explanation of HeHeStreams\u2019 operations is in order.<\/p>\n
HeHeStreams Was a Special Type of IPTV Service<\/h2>\n
The majority of traditional IPTV suppliers facilitate access to pirated streams by offering them from their own servers. This is a model that burns through lots of bandwidth and is seen as a necessary cost of doing business. What HeHeStreams managed to do is eliminate these costs almost completely by not utilizing pirated streams at all.<\/p>\n
Instead, it found a way to connect HeHeStreams users to genuine streams offered by the sports broadcasters. This had obvious upsides \u2013 no more massive streaming server bills and since official streams rarely break down or buffer, a bunch of happy customers.<\/p>\n
\u201cStreit obtained the copyrighted content by gaining unauthorized access to the websites for those sports leagues via misappropriated login credentials from legitimate users of those websites. One of the victim sports leagues sustained losses of approximately $3 million due to Streit\u2019s conduct,\u201d the DoJ notes.<\/p>\n
This method of using official streams to supply \u2018pirate\u2019 customers was alluded to in our\u00a0interview with Akamai<\/a>\u00a0earlier this year. A pair of DISH lawsuits against\u00a0SportsBay<\/a>\u00a0and\u00a0Nitro IPTV<\/a>\u00a0also illustrate the same problem, one that broadcasters need to fix.<\/p>\n Quite why these gaping loopholes aren\u2019t being closed isn\u2019t clear but what we do know is that disclosing such vulnerabilities can go horribly wrong.<\/p>\n Back in the summer, TorrentFreak sought comment from Joshua Streit on the ACE\/MPA settlement deal. After he declined, the discussion shifted to the apparent loopholes at DISH-owned Sling TV referenced in their lawsuits, ones that fail to prevent non-customers from piggybacking onto legal streams.<\/p>\n How these are exploited went unexplained but without mentioning any services in particular, Streit indicated that he had been trying to share knowledge of serious vulnerabilities with one (or more) providers. He expressed some frustration at their apparent reluctance to work together. We later got the impression that things had improved but that was clearly not the case.<\/p>\n According to the criminal complaint filed by the US Government, around March 2021 Streit emailed an MLB employee noting that he\u2019d previously disclosed a network vulnerability but was disappointed by the company\u2019s response. \u201cThe lack of gratitude is frankly shocking,\u201d he reportedly wrote.<\/p>\n Streit later sent another email noting that he\u2019d reported yet more vulnerabilities to the company over a particular weekend and he had two reporters who cover MLB matters interested in the story. An unnamed MLB executive then contacted Streit by phone and reportedly found him \u201cupset\u201d by MLB\u2019s failure to acknowledge his efforts.<\/p>\n Streit allegedly informed the MLB executive that he expected to be financially compensated for the work he\u2019d done but was told that while MLB has no bug bounty program, the company \u201cappreciated\u201d his disclosures. Streit responded that bug bounty programs are useful for cooperation and according to the complaint, added that it would be bad for MLB if the media found out about the vulnerability.<\/p>\n After a gap of several months, Streit allegedly emailed MLB again in the hope that the earlier discussions could be continued. The MLB executive replied, informing Streit that \u201cpeople here are concerned about this as unauthorized access to our systems\u201d but then went on to ask Streit what kind of money he was expecting. $150,000, apparently.<\/p>\n <\/p>\n Serious vulnerabilities can return big bug bounties and there is no question this vulnerability is serious. The complaint against Streit says that an analysis conducted by just one of the sports leagues reveals losses of almost $3m to the HeHeStreams operation alone. And herein lies the problem.<\/p>\n It\u2019s not known if MLB would\u2019ve been more responsive to a neutral third-party discloser but at least as far as FBI Special Agent Joshua Williams is concerned, Streit\u2019s overall conduct means that his request for payment amounted to extortion.<\/p>\n \u201c[I] believe that\u2026although the defendant approached MLB in the guise of being helpful to MLB, his simultaneous intrusion into MLB accounts and illegal streaming of MLB content on the illicit streaming website indicates that Streit acted knowingly and with the intent to extort MLB,\u201d Agent Williams writes.<\/p>\n As per the Department of Justice, 30-year-old Streit from Minnesota is charged with:<\/p>\n One count of knowingly accessing a protected computer in furtherance of a criminal act and for purposes of commercial advantage and private financial gain, which carries a maximum sentence of five years in prison.<\/p>\n One count of knowingly accessing a protected computer in furtherance of fraud, which carries a maximum sentence of five years in prison.<\/p>\n One count of wire fraud, which carries a maximum sentence of 20 years in prison and one count of illicit digital transmission, which carries a maximum sentence of five years in prison. He also faces one count of sending interstate threats with the intent to extort, which carries a maximum sentence of two years in prison.<\/p>\n Of immediate interest here is the reference to \u201cillicit digital transmission\u201d. This terminology is used in the\u00a0Protecting Lawful Streaming Act<\/a>\u00a0(PLSA), a law that made certain streaming conduct a felony. It was\u00a0signed into law<\/a>\u00a0last December and as far as we\u2019re aware, hasn\u2019t been used until now.<\/p>\n The criminal complaint can be found\u00a0here<\/a>\u00a0(pdf)<\/em><\/p>\n Source: \u00a0Bug Bounty Or Criminal Extortion?<\/h2>\n
![\"streit-bug](\"https:\/\/torrentfreak.com\/images\/streit-bug-bounty.png\")
<\/a><\/center> <\/p>\nPotentially Serious Prison Time<\/h2>\n
![\"TorrentFreak\"](\"http:\/\/worldjusticenews.com\/news\/wp-content\/uploads\/2016\/11\/torrentfreak.png\")
<\/a> TorrentFreak.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"