The Radio and Television Commission of Lithuania ( LRTK ), the Baltic country’s media watchdog, has been one of Europe’s most active anti-piracy enforcers.

In recent years, it blocked hundreds of domains and thousands of IP addresses, fined users without going to court, and froze bank accounts tied to pirate operations.

Next month, LRTK will share some of its hard learned lessons in Geneva. At a meeting of the World Intellectual Property Organization’s Advisory Committee on Enforcement (ACE), LRTK’s Andrius Katinas will describe the Lithuanian approach as a template for other countries.

According to the contribution, which is publicly shared in advance of the June meeting, copyright enforcement in Lithuania is no longer just about copyright. It is “a method of hybrid warfare,” which can also counter Russian disinformation and safeguard the privacy of citizens.

Russian Disinfo as a “Hybrid Threat”

The hybrid-threat framing rests on two separate claims, which both are unrelated to copyright infringement. The first is that pirate IPTV services can, willingly or not, be used as distribution channels for Russian propaganda.

LRTK explains that many of the IPTV services it monitors operate from hostile countries and retransmit Russian state channels, which are sanctioned and formally banned by the European Union.

“Those channels include EU-sanctioned outlets that not only spread propaganda and disinformation, but also broadcast numerous national channels and live sports without the consent of the rights holders.”

“In blocking broadcasts because of copyright infringement, the Commission also blocks access to hostile information (and vice versa), which is a method of hybrid warfare,” LRTK’s abstract of the upcoming presentation reads.

As a direct neighbor of Russia, Lithuania has been very active in taking down Russian disinformation. In addition to blocking numerous sites and services, LRTK also fined hosting provider UAB Melbikomas €10,000 for breaching EU sanctions by hosting more than 50 sports channels.

Filmai.in and other Privacy Threats

Pirate site blocking can also serve another purpose, as it prevents potential security breaches. Lithuania has experience with this, as user data of the popular local pirate site Filmai leaked online, including 645,000 email addresses, usernames, and plain text passwords.

This breach happened more than 5 years ago, and blocking the site does not remove the leaked data from the darknet. However, it may help to limit the fallout of future breaches at Filmai or other pirate sites.

These privacy issues are a serious concern, LRTK notes, stressing that pirate sites generally don’t have the best security.

Leaked credentials end up on the dark web, with LRTK suggesting that they can be picked up by hostile-state cyber groups for use in operations against state institutions and strategic companies. And since credentials of government officials have also been found in the Filmai leak, state security might become an issue.

“It has even been found that Government officials had registered on the Filmai website using official email addresses, creating security concerns, such as the potential for unauthorized access to State institutions, the signing of documents, or responding to residents’ inquiries,” LRTK writes.

Filmai is blocked now, and one of the administrators of the site was convicted in 2023 . However, the site itself remains online and, according to Similarweb , it remains among the top 100 visited sites in the country.

The Lithuanian Model

LRTK explains that it has broad experience with fighting piracy threats, using a wide variety of OSINT skills. It specifically mentions tools such as domaintools.com, oxylabs.io, epieos.com, Wireshark, and SimilarWeb, which help to identify perpetrators or monitor for illegal activities.

In recent years, the watchdog has blocked more than 400 domains and 7,000 IP addresses. In addition, it imposed fines in over 250 cases since 2023.

Much of this blocking system is centralized and automated. When LRTK identifies a new site, or a mirror of a previously blocked site, a blocking instruction is sent to all Internet service providers. Within twenty minutes, the domain or IP is blocked across the country.

LRTK has also frozen bank accounts linked to pirate operations, delisted URLs from Google Search, removed advertisements from pirate sites, and suspended illegal IPTV apps from Google Play and the Apple App Store.

The Dutch Export Problem

According to the presentation, Lithuania’s experience can “serve as a model for other national authorities and rights holders”. While that may be true, a Dutch example should show that blocklists should not be copied blindly.

In December 2025, the Dutch ISP trade association NLconnect tried to help ISPs by compiling a master blocklist, to comply with the EU’s ban on Russian disinformation. Because the Dutch government did not provide guidance, it compiled a reference blocklist of 797 domains, using blocklists from regulators in Germany, Austria, Estonia, Finland, and Lithuania.

As we reported at the time , this effort resulted in some unexpected blocks. Dutch users of Ziggo lost access to ShareChat, India’s largest homegrown social media platform with hundreds of millions of users. The same applied to Odysee.com, online radio aggregators Streema and Viaway, and various pirate IPTV domains including IPTV-home.net, Ottclub.tv, and Limehd.tv.

Most of those domains traced back to a single source: LRTK’s blocklist.

Responding to the issue, the Dutch regulator ACM informed us in December that it does not monitor the actual execution or the content of the sanctions list. However, after ISPs started to complain as well, ACM formally investigated the matter, concluding that LRTK’s blocklist is too broad for the Netherlands.

As reported by Tweakers in February, ACM eventually concluded that the Lithuanian list had been compiled under both the EU sanctions regulation and a broader Lithuanian national law banning Russian-financed television content.

This means that the Lithuanian list is not usable outside Lithuania, and NLconnect dropped the entire Lithuanian source list, shrinking their reference list from 797 domains to 335.

The Dutch overblocking example can’t be blamed on Lithuania, but it shows that when it comes to cross-border blocking efforts, caution is warranted. In any case, it is clear that blindly copying third-party blocklists is not the best approach.

—

The WIPO contribution, “Combating Digital Piracy: Strategic Enforcement through DNS/IP Blocking and OSINT Tools,” is available here (pdf) .

From: TF , for the latest news on copyright battles, piracy and more.