Skip to main content

Brazil Combats Fake Streams and Russian Hackers With ‘Operation Anti-Doping’

Brazilian officials shut down 84 stream-boosting sites in Brazil in 2021 and found ties to Russian-speaking "mirror sites" that were creating the fake streams.

RIO DE JANEIRO —In 2016, Richard Encinas, a São Paulo state prosecutor, led investigations into organized crime that culminated in a raid of a clandestine warehouse and the seizure of millions of pirated DVDs and CDs that took more than seven trucks to transport. But the transition from physical recorded music to digital streaming has happened at breakneck speed in Brazil, ushering in a booming illegal trade in artificially boosted audio and video streams. So two years later, Encinas traveled with a group of colleagues to London to learn how to better combat cybercrime, including new challenges emerging in the music industry.


Now Encinas — who heads the Center for Investigations of Cyber Crimes in the São Paulo public prosecutor’s office, known in Brazil as Cyber Gaeco — has made the pivot to digital, helping launch the music industry’s most-sweeping effort to root out fake-stream operations, dubbed Operation Anti-Doping.

Working with Pro-Música, Brazil’s trade organization for record labels and IFPI affiliate, and its six-person anti-piracy arm, Apdif, Cyber Gaeco shut down 84 stream-boosting sites in Brazil in 2021, primarily using cease-and-desist notices and threats of court orders. The sites shopped fake streams, allowing artists or their representatives to buy bot-generated “plays” to boost their songs’ stream counts.

This was the first time in Brazil that fake streams have been prosecuted as a crime. Prosecutors charged it constituted embezzlement and illicit gain, thus violating Brazil’s Consumer Defense Code. The probe also revealed the international scope of the problem: While the sites were based in Brazil, the actual stream-boosting activity was conducted in Russia via mirror sites, in particular a site called Just Another Panel, says Paulo Rosa, Pro-Música’s president. “No company in Brazil has the technology to make these fake streams,” Rosa says. “This technology comes from websites hosted in Russia.”

While fraudsters are often criminals seeking to enrich themselves with ill-gotten royalties from fake songs or even fake playlists, some artists are also tapping artificial streams to create “fake velocity” that push the songs onto important DSP playlists and help them go viral, says Morgan Hayduk, founder and co-CEO of Beatdapp, a Vancouver-based tracking system that authenticates streams for DSPs. “What you really care about is generating velocity,” he says, “fooling the algorithm into thinking there’s a critical mass of people behind this track.”

Rather than spend time trying to track down and prosecute individual fraudsters, which can take years and yield uncertain results, the Brazilians have focused on shutting down blocks of sites indefinitely and transferring the web domains to Apdif. “What’s the point of arresting these guys?” says Encinas. “Our focus is to protect legal [streaming]” and for “the crime to stop.”

In Germany , the other major music market where IFPI has overseen efforts to combat fake streams, music associations took a similar approach in 2020 and 2021 when they used court injunctions and other legal tactics to shut down nine sites. There, the associations used competition law to argue that streaming manipulation was fraudulent and deceptive, and unfair to the music business.

Cyber Gaeco also took down 15 sites operating in Brazil that were selling ad-supported services to illegally download video streams from YouTube by defeating the company’s security measures. Of the operators of those sites, 14 were Russians and one was American, Encinas says.

Russian hackers provide technical support to Brazilian hackers, the prosecutor says. Their assistance in creating fraudulent streams is difficult to stop because the Russian government has been lenient on Russian hackers attacking foreign companies and individuals, so long as they have not operated in Russia. (Hackers often disguise their location with tools like VPNs.) “I am unaware of the collaboration of the Russian government with any government of any country in the world,” Encinas says.

The IFPI confirmed to Billboard that “a large number of streaming manipulation sites seem to be the ‘resellers’ of services operated by third parties,” though “it is often difficult to identify the method of manipulation or the countries in which the operators of these services are based.” Just Another Panel, the IFPI added, “is a name that often appears in connection with reseller sites offering artificial plays and other manipulation activities.” (Just Another Panel has never operated in Russia and is unknown among Russian users and cyber experts.)

The only way to stop illegal Russia-based sites from operating in Brazil, Encinas says, is by blocking access to Brazil’s cyber territory. Prosecutors have used court orders in those cases to force Brazilian internet service providers to forbid Brazilian IP addresses from accessing Russian sites, he says.

Hayduk says the industry should go one step farther than recent law-enforcement actions. He advocates creating “foundational platform security” for the DSPs where neutral, third-party arbiters (like his own service) would monitor transactional-level streaming data to weed out suspicious streams – a strategy already used in financial services, e-commerce and digital advertising. “The question is, as an industry, can we collectively get smarter and catch [fake stream proprietors] faster and make the economic incentive less powerful because we’re just better at catching them?” Hayduk asks. (Spotify declined to comment on Hayduk’s suggestion.)

While Rosa and Encinas say their ongoing efforts have rooted out 90% of the fake-stream operators in Brazil (only one of the 84 has resumed operations), the incentives to defraud the streaming market haven’t changed. Since 2016 Brazil’s streaming revenues have grown by double digits each year, says Rosa. Brazil was Latin America’s fastest-growing major market in 2020, with revenues increasing by 24.5%, driven by a boost in streaming revenues of 37.1% that put them at $306.4 million in total (11th in the world), the IFPI said in its “Global Music Report.”

Brazilian music executives point out that the fake streams coincide with social media growth and a winner-take-all political environment in Brazil, which saw right-wing populist Jair Bolsonaro elected president in 2018 despite claims that included linking COVID-19 vaccines and AIDS . Brazil had 150 million social media users in 2021, up 10 million (7.1%) from 2020, for a penetration of 70.3% of its total population (the U.S. was at 72.3%), according to DataReportal, a digital trends research site.

“I see this as another tool that has been brought into the social media environment,” says Rosa. “Fake streams came about in this ecosystem. It has more to do with ‘look here’s another chance to do some marketing.’ Artists want to create artificial success.”

Additional Reporting by Micah Singleton and Vladimir Kozlov