SINGAPORE – Football fans attempting to get their English Premier League (EPL) fix through illegal streaming sites are up to almost four times more likely to encounter a cyber threat and become exposed to online scams, according to a new study.

Android TV boxes that offer apps to give illegal access to a variety of films and TV series have also been found to host malware.

These findings are part of a study commissioned by the EPL and published on the Social Science Research Network by Professor Paul Watters, chief executive of Cyberstronomy, a Melbourne-based cyber-security assurance firm.

Titled Scams, Cyber Threats And Illicit Sports Streaming In Singapore, the report by Prof Watters, who holds professorships in criminology and security studies at Macquarie University, and cyber security at La Trobe University, examined both illegal sports streaming sites and illegal streaming devices in December 2023.

Prof Watters, who examined the top 25 illegal sports streaming sites here, said every one in two advertisements on illegal sports streaming websites is likely to be high-risk, containing either malware or redirecting to scam websites.

The illegal streaming websites can also be used by cyber criminals to steal personal information through fake login pages. In some cases, these may even prompt users to download malicious software before they are allowed to access a stream.

Compared with 25 legitimate websites popular with Internet users in Singapore, the illegal ones were found to be 3½ times more likely to have a feature associated with online scams. The legitimate websites in the study include Google, YouTube and Reddit.

The study detailed how a streaming site had required users to click on a link to install Adobe Flash Player, a multimedia viewing program discontinued on Dec 31, 2020. Clicking on the link would lead to installation of malware that could be used to steal one’s credentials.

Out of the 25 illegal sports streaming websites examined, 19 are still accessible today.

Mr Kevin Plumb, general counsel for the EPL, said: “We want fans to understand that pirated content is not free; users may not pay a subscription, but they could pay by unwittingly giving access to their personal data or credit card details, or by exposing their family to risky content.”

Prof Watters also tested three popular models of illegal streaming devices – the SVI Cloud, Ubox and EVPad.

These are commonly known as Android TV boxes as they are either preloaded with apps to access unauthorised content, or come with instructions to install such apps. The Android boxes can be plugged directly to the TV to allow viewers to watch streamed content on their TV screens.

The SVI Cloud, Ubox and EVPad featured 116 such apps in total, said Prof Watters.

About 44 per cent of the apps, or 51 of them, were found to contain malware. But the bigger concern is that the Android TV boxes could form botnets, which are networks of compromised devices that can be controlled by criminals to perform malicious tasks, he said.

The three Android TV boxes that Prof Watters tested are still on sale on e-commerce platforms Lazada and Shopee for more than $200. This is despite their sale being outlawed in Singapore since November 2021, after amendments to the law.

Under the amended Copyright Act, those found guilty of making, dealing, importing, distributing or offering devices or services to access works without the authority of copyright owners face a fine of up to $100,000, a jail term of up to five years, or both. Companies found guilty of doing so can be fined up to $200,000.

In October 2019, the EPL and other rights holders won a landmark case after a 22-month court battle that ended with local retail firm Synnex Trading being fined $160,800 over the sale of Android TV boxes.

A raid conducted in October 2022 led to the arrest of four women and 13 men for their suspected involvement in the sale of illegal streaming devices. More than 2,500 Android TV boxes were seized at several retail shops at Sim Lim Square. The Straits Times understands that the EPL has not gone after fans for accessing illegal streams.

Since the EPL opened its Singapore office in 2019, it has blocked nearly 450 domains across websites, apps and illegal streaming devices here that offer free streams of English football’s top flight.

A study on online piracy conducted by research firm YouGov in 2022 found that more than one-third of viewers in Singapore tapped illegal sources instead of paying for content. Similarly, more than one-third of viewers in Indonesia accessed illegal streams. Piracy rates in China and India were among the highest, at 55 per cent and 51 per cent respectively.

Mr James Walton, sports business group leader at Deloitte Asia Pacific, said that fans in Singapore might not have considered the potential scam risks of using illegal streams to be a significant issue.

The lack of criminal cases involving end users streaming content illegally might have also rendered the consequences an afterthought, he said.

In addition, the high cost of subscription in Singapore might have driven fans to illegal channels, said Mr Walton. Consumers here currently have to pay $40.74 a month to get EPL content, but existing StarHub customers pay $25.46 a month. Comparatively, Malaysian broadcaster Astro charges RM99.99 (S$28) a month for a comprehensive sports package that includes the EPL, Formula 1 and Ultimate Fighting Championship.

StarHub, which holds the exclusive rights to air the EPL in Singapore, did not disclose how much it paid for its six-year partnership that began in 2022. However, in 2007, it reportedly forked out $250 million for a three-year contract, before Singtel paid $400 million for the rights from 2010 to 2013.

But lowering the fees could change fans’ behaviour, said Mr Walton. “Realistically, the tipping point would come only at around half of the current pricing or lower.”