Untrusted Streams: Illegal IPTV, Organised Crime and the Emerging Threat to Nordic Security and Democratic Resilience
Prepared for Nordic Content Protection
Prepared by Professor Paul Watters OAM and Associate Professor Joel Scanlan
September 2026
A few highlights from the report
1. Illegal IPTV has become a parallel, untrusted media infrastructure
More than 1.5 million Nordic households had access to illegal IPTV in spring 2025. At this scale, illegal IPTV sits outside normal regulatory, editorial and security controls while sustaining criminal revenue and exposing consumers and devices to measurable cyber risks.
2. Cybersecurity and organised-crime harms are already established
Illegal IPTV ecosystems support professional criminal businesses built around subscriptions, resellers, cross-border infrastructure and concealed payments. At the same time, associated sites, applications and devices expose users to malware, fraud, credential theft, tracking, botnets and residential-proxy abuse.
3. The distribution layer creates an emerging national-resilience risk
Pirate services can reproduce trusted Nordic broadcasters while controlling the unauthorised copy received by viewers. During elections, military crises, cyber incidents or emergencies, altered broadcasts, false warnings, synthetic presenters, subtitles or overlays could create confusion and delay correction without compromising the lawful broadcaster itself.
4. The emerging threat warrants targeted intervention
The relevant audience reach, technical capability, hostile intent and manipulation techniques already exist, although not every illegal IPTV service represents a national-security threat. The report assesses the overall concern as High Risk and recommends reducing demand, enabling rapid blocking, disrupting enabling infrastructure and incorporating high-risk IPTV ecosystems into cybersecurity, organised-crime and national-resilience assessments.