Guardia di Finanza's Tutto Chiaro operation
Italian financial police, operating under the Ministry of Economy and Finance, executed a wide-ranging enforcement action called "Tutto Chiaro" that targeted a piracy ecosystem built around an app named CINEMAGOAL. The action included 100 searches across Italy and involved 200 financial police officers. Authorities described the investigation as in a preliminary phase while seized material is analyzed to identify all involved parties and quantify illegal profits.
CINEMAGOAL's technical method for stealing streaming access
Investigators say CINEMAGOAL did not operate like a traditional IPTV provider that rebroadcasts pirated streams. Instead, the CINEMAGOAL app authenticated directly to legitimate streaming platforms using valid decryption and authentication codes. The system used virtual machines in Italy to capture valid authentication/decryption codes from legitimate subscriptions every three minutes and redistributed those codes to customers. Those legitimate subscriptions had been opened using false identification data on Sky, DAZN, Netflix, Disney+, and Spotify, according to Guardia di Finanza.
That architecture produced two operational effects emphasized by investigators: users streamed content directly from the legitimate services—yielding higher-quality playback than a pirate re-stream—and customers' real IP addresses were masked because access did not involve a connection directly attributable to a single IP. Authorities said the system therefore both evaded platform security blocks and reduced the chance that users could be "intercepted" by platform control systems.
Cross-border seizures: servers, source code, and decoding functions
Police forces, coordinated by Eurojust, seized CINEMAGOAL servers in France and Germany. Those servers allegedly contained the app’s source code and functions used to decode protected streams. In Italy, the Guardia di Finanza seized materials during searches that investigators said could help identify involved individuals and calculate illegal profits. The international reach of the seizures underscores that investigators targeted both the app infrastructure and the backend components that enabled the decoding and redistribution of valid credentials.
Scale, revenue model, and estimated damages
CINEMAGOAL sold access through a network of more than 70 resellers offering annual subscriptions priced between €40 and €130. Payments were routed through cryptocurrency or to foreign bank accounts and accounts registered under fake names. Guardia di Finanza stated that operators of CINEMAGOAL likely made millions of euros from audiovisual piracy, unauthorized computer access, and computer fraud, and that the ecosystem has caused an estimated €300 million in unpaid subscription revenues over the period of operation.
Authorities have already identified many subscribers and issued penalties to the first 1,000 of them, with fines ranging from €154 to €5,000. The investigation remains ongoing as seized data are analyzed to identify additional end users, resellers, and the full extent of profits and damages.
What this means for end users, streaming platforms, and investigators
- End users: Investigators have identified many subscribers and begun issuing fines; the first 1,000 received penalties between €154 and €5,000. The operation highlights that installing a stealth app does not shield consumers from detection or financial liability when criminal infrastructure is seized and analyzed.
- Streaming platforms: CINEMAGOAL’s approach—using valid decryption codes taken from legitimate subscriptions opened with false identities—demonstrates a form of abuse that can defeat standard blocks by relying on bona fide platform sessions rather than re-streaming. Platforms will confront technical and investigative challenges in tracing such misuse to its origin.
- Investigators and cross‑border enforcement: The Eurojust-coordinated seizures in France and Germany, plus 100 searches in Italy and 200 officers deployed, illustrate a multinational enforcement posture aimed at dismantling both app front ends and backend infrastructure, including source code and decoding logic.
During the same law enforcement action, authorities also identified and dismantled an IPTV service known as "pezzotto." As the Guardia di Finanza continues to analyze seized materials, the case will determine how many additional subscribers, resellers, and servers were involved and what financial penalties and criminal charges may follow. The next steps will be forensic analysis of the seized source code, financial tracking of payments routed through cryptocurrency and foreign accounts, and further identification of the falsified subscriptions that fed the system.
