White Paper Technical Document for IP Delivery of Entertainment Content

Sky Italia Srl Via Monte Penice, 7 20138 Milan - Italy

White Paper

Technical Document for IP Delivery of Entertainment Content

Sky Italia Confidential 2012

This is an unpublished work the copyright in which vests in Sky Italia. All rights are reserved. The information contained herein is property of Sky Italia and no part may be reproduced or used except as authorized by contract or other written permission. The copyright and the foregoing restriction on reproduction and use extend to all media in which the information may be embodied.

White Paper Version A.01

Table of Contents Page

1. Introduction 3

1.1 Sky “anywhere” : Platform of Portable End User Devices 4 1.2 Sky “anytime” : Non-linear Services 4

2. Delivery Infrastructure 4

2.1 Means of Transmission of Video and Audio Signals 4 2.2 Receiving Devices 7 2.3 Resolution 8 2.4 Content Protection on Outputs 8 2.5 Transfer of Content from End User Device to End User Device 8

3. Delivery to Other End User Devices 8

3.1 DRM Platform Specifics 8 3.2 Content Encoding 10 3.3 Content Delivery Network 10 3.4 Geoblocking 10 3.5 Video / Audio Bite Rate Profiles 11 3.6 Other End User Devices Output Protection 11

4. Delivery to Set Top Boxes 12

4.1 STB Conditional Access Platform Specifics 12 4.2 FUSION Overview 12 4.3 Content Encoding 13 4.4 Content Delivery Network 13 4.5 Geoblocking 14 4.6 Progressive Download Bit Rate Profiles 14 4.7 STB Output Protection 14

5. Facility Security 14

6. Technical Contacts 16

APPENDIX A Acronyms and Abbreviations 17 APPENDIX B STB Technical Specifications 18

Page 2 of 20 Sky Italia Confidential February 2012

This document is the intellectual property of Sky Italia and contains confidential information. All reproduction and communication to third parties is strictly prohibited without prior written consent from Sky Italia

White Paper Version A.01

1. Introduction

The way people consume content is changing due to new habits and technological innovation.

More and more people do not organize their leisure time around fixed programming schedules. Further, thanks to new transmission technologies and devices, distribution of the same digital content to multiple end user devices via different transmission means is now widely available.

In consequence, while Sky has been serving its subscribers predominantly via satellite and DSL redistribution of programming to Set Top Boxes, Sky has recently launched linear and non-linear programming services via new means of delivery (e.g., IP streaming and downloading) intended to be received by new consumer receiving devices (e.g., portable End User Devices (including tablets and smart phones), personal computers and game consoles).

The purpose of these extensions is to strengthen the Sky core proposition of providing high quality television services to its new and existing consumer base and to accommodate emerging consumer behaviours.

Sky customers shall enjoy their favorite contents on non- traditional devices with more interactivity and robust security

Page 3 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

1.1 Sky “anywhere” : Platform of Portable End User Devices

Sky is offering those subscribers seeking to access content in a more flexible manner the possibility to view Sky controlled programming anywhere on a linear and non-linear basis. As of its launch, the service currently branded “Sky Go” is available through :

“Sky Go“ website : A website based access to linear and non-linear services, targeting receiving devices such as personal computers, game consoles, connected TVs, but also portable End User Devices such as tablets and smart phones; and

“Sky Go“ application : An application based access to linear and non-linear services, targeting receiving devices such as iPad and similar tablets as well as smart phones and other portable End User Devices.

1.2 Sky “anytime” : Non-linear Services

Sky is offering those subscribers seeking to access content in a more time-flexible manner the possibility to view Sky controlled programming anytime on a non-linear basis. At launch, the service currently branded “Sky On Demand” will be made available both via the platform of portable End User Devices as described above through either :

“Sky On Demand” website : A website based access to non-linear services, targeting receiving devices such as personal computers, game consoles, connected TVs, but also portable End User Devices such as tablets and smart phones; and

“Sky On Demand” application : An application based access to non-linear services targeting receiving devices such as iPad and similar tablets as well as smart phones and other portable End User Devices; and to Set Top Boxes through :

“Sky On Demand” STB EPG application : An EPG based access to non-linear services, targeting PVR Set Top Boxes for the purpose of DTH delivery of content on a push basis and IP delivery on a pull basis.

2. Delivery Infrastructure

2.1 Means of Transmission of Video and Audio Signals

Historically, Sky provided television services to Set Top Boxes via DTH and DSL lines. Going forward, Sky will also be transmitting programming (in linear and non-linear modes of delivery) to users using multiple types of receiving devices via other delivery means through Closed Access Internet.

Page 4 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

For the purpose of this document :

“Closed Access Internet” shall mean a means of distribution via Internet using a registration process and geo-blocking, limiting access to those viewers who are entitled (by virtue of contract and/or registration process) to receive a content service;

“Internet” shall mean a non-proprietary network (i.e., accessible on a worldwide basis and open to the general public) that is based on a global IP address and that connects computers or similar receiving devices that communicate using a common IP protocol allowing bi-directional access for originating and receiving data, independently from whether the signal is supplied via DTH, DTT, cable, Mobile Wireless or WiFi delivery;

“Mobile Wireless” shall mean any form of wireless distribution using mobile telephony/telecommunications data networks, including the Wireless Application Protocol, 2.5G(GPRS), 2.75G(EDGE), 3G(UMTS), 3.5G(HSDPA), 4G(LTE), DVB-H, DMB, UMA/GAN, IWLAN or successor Mobile Wireless technologies;

“Progressive Download” shall mean transmission of content (on a push or pull basis), whether upon the relevant end user request or not, to an End User Device by means of download techniques that allow for a complete copy of such content to be delivered to and stored on such End User Device as a consequence of such process and such content may be retained on such device subject to any applicable contractual restrictions;

“Streaming” shall mean the transmission of content for contemporaneous rendering whereby no permanent storage of content occurs at or in the End User Device as a consequence of such process (provided, however, that Buffering of content will occur).

System block diagram of material processing and delivery for “anytime” and “anywhere” services :

Page 5 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

The material processing and delivery happens all together within SKY. The platform architecture is composed of the following principal subsystems :

MMA (Media Management Area) content acquisition and Playout Signal Encoding / Transcoding System Encryption System Conditional Access System and Digital Rights Management System unified HeadEnd Scheduling System Content Management System Content Delivery Network Billing System Business Intelligence System Client Player and Apps

The Video/Audio encoding is H.264/ (ac3 or AAC). The media streaming communication protocol is NDS Http based proprietary adaptive bit rate protocol for all the connected devices like PC/Mac, tablets and smart phones. The media streaming communication protocol is NDS Progressive Download for the STBs Conditional Access System, and Digital Rights Management System are provided by NDS.

The signal processing for the linear channels for “Sky Go” services for all the connected devices is as follows :

All the assets are inserted in the scheduling system Pilat IBMS with all the editorial and rights details information Pilat submits the ingestion of the material and Playout scheduling for the linear channels The Playout result feeds the Encoder/Packaging (H.264, HLS), Encryption (AES 128 in accordance with NDS DRM) and Delivery on the CDN (AKAMAI or similar) The Client can access the channels he has the rights for, directly from the CDN The Client, after authentication, obtains the license to access the content by NDS unified HeadEnd based on the business rules defined on Subscription Management System The client uses the proprietary Player or Application for playing the content

The signal processing for the VOD materials for Sky On Demand for the STBs and all the connected devices is as follows :

Non-Linear Schedule defined by Pilat On Demand module feeds the TXT Polymedia CMS VOD Catalogue system; it provides information about editorial, content and VOD Rights The CMS workflow feeds the VOD Asset ingestion that is archived in the MMA storage The CMS workflow submits the Transcoding/Packaging (H264, HLS), Encryption (AES 128 in accordance with NDS DRM policy) and Delivery on the CDN (AKAMAI and Level 3) The CMS produces VOD Catalogue with the editorial information and business policy associated to the assets

Page 6 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

The Catalog is published on the web by Sky through NDS unified HeadEnd or other applications The Client can access the content he has the rights for, directly from the CDN The Client, after the authentication, obtains the license to access the content by NDS unified HeadEnd based on the business rules defined on Subscription Management System The client uses the proprietary Player or Application for playing the content. 2.2 Receiving Devices

2.2.1 Sky is now and will be delivering content to Set Top Boxes and Other End User Devices (collectively “End User Devices”) which are supplied, approved for supply or otherwise simply authorized via conditional access by Sky and that are :

(i) Set Top Boxes utilizing industry-standard conditional access systems (“CAS”) (e.g., NDS Videoguard, Nagra, Microsoft MediaRoom, Fastweb, Verimatrix VCAS and Widevine or an equivalent or better CAS). Set Top Boxes will include Set Top Boxes that are or may be connected to an external module that is attached by a physical connector or via the end user’s in-home (e.g. CAT5, PLC, WiFi) network to the Set Top Box. A permitted external module will be one that is authorized by Sky and is designed to enable storage and PVR functionality of NDS Videoguard-encrypted content (“Optional External Module”);

(ii) other devices running NDS media players and DRM or other industry standard media player and DRM including but not limited to, PCs/MAC’, game consoles, connected TVs and Apple IOS, Android, Blackberry and Windows based smart phones and tablets (“Other End User Devices”).

2.2.2 Each End User Device shall, directly or via the residing content protection system, be associated with an end user or, if applicable, an authorized end user account. End User Devices will be periodically re-authorised by Sky using a commercially reasonable conditional access or DRM protocol.

2.2.3 At launch, per end user account, Sky will enable or authorize access by Other End User Devices to three instances of playback of any combination of services (i.e., linear channels, SVOD/TVOD/PPV services) at any one time, whilst concurrent access for TVOD/PPV services is currently limited to two concurrent streams at any one time. In addition, with regard to each end user account and at any one time, playback will not be authenticated or enabled by more than five Other End User Devices. Per user domain there might be one or more end user accounts, subject to the number of subscriptions registered per each such domain.

2.2.4 The reproduction of content to enable end user initiated storage on an End User Device (e.g., a recordable STB, including an Optional External Module connected thereto or an Other End User Device with storage capacity) is possible whenever secure, encrypted storage is available.

Page 7 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

Such device must not specifically enable auto deletion or skipping of commercial advertisements or promotions incorporated with any content, provided that it is acknowledged that the foregoing shall not prevent end users from themselves utilizing fast forward or rewind functions of any such device.

2.3 Resolution

Sky will deliver content to End User Devices in resolutions of SD and HD, and in 3D format, where 3D materials are available. With respect to HD, applicable End User Devices shall be required to comply with specific content protection conditions.

2.4 Content Protection on Outputs

Where applicable to the relevant device, output protection will ensure that the relevant copy protection settings and signals are applied for the appropriate category of content according to the terms of the applicable license agreement.

While STBs are under Sky’s control, the Other End User Devices are available on the market and their function and control will not be under Sky’s control. SD and HD content will be delivered to all receiving devices unless different rules for content delivery are agreed on a case by case basis.

2.5 Transfer of Content from End User Device to End User Device

Content may be Streamed from one End User Device to another (e.g., via WiFi). Sky shall ensure that an appropriate CAS or DRM system, including encryption where applicable, is used in connection with such Streaming.

3. Delivery to Other End User Devices

Linear services will be delivered via Streaming, i.e., by means of transmission of content for contemporaneous rendering. To the extent temporary storage or caching of content is technically required to enable reception or functionality on an End User Device such as pause, rewind and fast forward (“Buffering”), such Buffering shall be authorized.

Non-linear services will be delivered by means of adaptive Streaming techniques or via Progressive Download.

3.1 DRM Platform Specifics

Upon launch, Sky will implement NDS’s VideoGuard Connect DRM on Other End User Devices.

Page 8 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

In addition, on Other End User Devices running on an open platform such as, without limitation, PC/Mac’, Apple IOS, Android, Blackberry and Windows based smart phones and tablets, NDS VideoGuard Connect DRM implements a “moving target” based security software mechanism. This mechanism establishes a unique cryptographic identity on each individual device. This identity, among other features provides a device authentication infrastructure.

NDS VideoGuard Connect DRM contains separate moving target implementation techniques :

SDLL used on Intel based CPUs (PC/MAC) DNX used on mobile phone and tablet Other devices to be confirmed from time to time (game consoles, connected TVs, et. al.)

Since every device has a unique identifier (imposed by the DRM server at the activation time) and it is uniquely authenticated, the DRM server is able to track multiple instances of such unique identifier should they appear in the network.

Content in the DRM system is encrypted using AES block cipher and 128 encryption keys. The key rotation periods are configurable and use generally at least two keys per content asset in single asset delivery mode (i.e., in respect of transactional VOD (TVOD)) and one hour rotation in linear channel mode. The content encryption keys are sent to a device as part of the content license. This license is individually encrypted for a specific instance of a moving target element on each device. The encryption algorithms used for key encryption are AES, XTEA and SHA1 based proprietary stream cipher.

The usage rules are also part of the content license and they are coupled with the encryption keys using cryptographic signature mechanism based on a unique “secret” of the moving target element. If this signature is compromised the license request will be rejected and decryption of the content key will not be possible by the end user.

As mentioned above, NDS VideoGuard Connect DRM solution is based on the moving target concept whereby each device receives an individualization code responsible for all the security related operations such as authentication, license (keys) handling and content crypto- processing. In addition, these moving target elements contain generic obfuscation, anti- debugging and entire DRM software integrity validation functionality.

In the NDS VideoGuard Connect DRM system (on any device type) content is always re-encrypted before storage on any external media. Therefore the encryption keys that are used for content delivery protection (network and CDN) are never stored locally on the client side. The unique local keys are securely stored as part of the license coupled with the usage rules as mentioned above.

Keys are only present inside the moving target element, which means that they never appear in the same place or form in the device memory.

Page 9 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

Where applicable, and specific to each platform, DRM client utilizes platform capabilities to control outputs during the playback process.

NDS VideoGuard Connect DRM system has a built-in proactive renewability mechanism, whereby each moving target element is replaced periodically regardless of piracy status. The periods are configurable and set between one week and a few months depending on the type of the moving target element.

In addition, the system contains version upgrade enforcement mechanism whereby content acquisition and consumption is not possible without a full DRM renewal cycle.

All devices in the NDS VideoGuard Connect DRM system have software integrity validation mechanisms. These mechanisms always start inside the moving target element (or hardware protected secure boot loader on the embedded platforms) and provide a root of the chain of trust for the validation of the rest of the components.

All devices in the same domain in the NDS VideoGuard Connect DRM system are capable to authenticate each other and establish a secure local communication. Content licenses can be securely transferred from one device to another. The content itself is already re-encrypted into a unique local key(s). Each device will enforce the same set of rules and will be able to validate license signatures.

Content recording permission is controlled by the content license. The operator sets these permissions in accordance with the content distribution rights. The DRM client always conforms to the usage rules from the license.

3.2 Content Encoding

The content encoding format at the launch of service will be H.264 delivered in HTTP Streaming or Progressive Download.

3.3 Content Delivery Network

Video Services will be delivered OTT via Content Delivery Network (CDN). Sky will use third party global CDN service providers, at the launch of service AKAMAI and Level 3.

3.4 Geoblocking

Geoblocking and connection type business rules will be checked by Sky’s Global CDN and/or through the Quova geofiltering service.

Page 10 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

3.5 Video / Audio Bit Rate Profiles

The services of Sky “anywhere” are delivered in an Adaptive Bit Rate format and the compression codec is H.264 with the NDS file format. The video for Other End User Devices will be delivered in SD and HD unless different rules for content delivery are agreed on a case by case basis. The output profiles in the Adaptive Bit Rate format will be consistent with the following examples but are permitted to be changed depending on user experience feedback :

Bit Rate Resolution Aspect Ratio 40k1 N/A N/A 350k 240*136 16/9 600k 480*270 16/9 1100k 720*404 16/9 1600k 720*404 16/9 1900k 720*404 16/9 2600k 720*404 16/9 4000k2 1920*1080 16/9 1Only Audio Level 2HD Resolution

3.6 Other End User Devices Output Protection

Where applicable to the relevant device, output protection will ensure that the relevant copy protection settings and signals are applied for the appropriate category of content and specific rules may be agreed on a case by case basis.

SD and HD content will be delivered to all receiving devices unless different rules for content delivery are agreed on a case by case basis.

PC / Mac Apple IOS Android Service Type (HD/SD) SD/HD (where SD/HD (where SD/HD (where applicable) applicable) applicable) Video Outputs Computer screen Apple adaptor to HW dependent and HDMI with TV HDCP Output Protection CGMS-A and HDCP Outputs disabled CGMS-A and HDCP where applicable where applicable DRM/CA NDS DRM NDS DRM NDS DRM Streaming HTTP ABR HTTP ABR HTTP ABR

Page 11 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

4. Delivery to Set Top Boxes

Sky will provide certain services including linear channels and non-linear services, by IP delivery to Set Top Boxes running NDS FUSION middleware starting from June 2012 (see Appendix B for FUSION STB specifications).

4.1 STB Conditional Access Platform Specifics

The Conditional Access Systems used for distribution to Set Top Boxes uniquely identifies and authorizes Set Top Boxes via the SmartCard using NDS security mechanisms (or such other systems, as the case may be).

The various components of the DTH signal for linear transmission and VOD content delivered on a push basis are scrambled in compliance with the “DVB Common Scrambling Algorithm” and relevant Conditional Access data (in terms of EMM and ECM, properly generated, encrypted and multiplexed with all the other components therefore creating the complete multiplexed signal, in Transport Stream format, ready for modulation and uplink with a crypto period of 10s (subject to change)).

The various components of the VOD content delivered on a pull basis are pre-encrypted offline using the CSA algorithm based on random keys, generating a file with indexing information. Another file, containing RSA encrypted control words, is generated and used to create OECM (Offer ECM) based upon the offer made against this physical instance of the asset. EMM are received by SmartCard over satellite.

All Digital HD output will be protected by HDCP and other compressed digital outputs (Ethernet port and USB) are not currently used for Video distribution, but if in future such other outputs are used, the video stream will be protected by the CAS.

Hard-disk equipped Set Top Boxes will provide PVR services to Sky subscribers. The content is protected on the device disk by re-encryption, using a unique ID for each single SmartCard.

The “Sky On Demand” service on FUSION Set Top Boxes will implement a Progressive Download system that will be protected by NDS VideoGuard Conditional Access. The Conditional Access implementation is similar to that already in place for the current DTH platform.

4.2 FUSION Overview

FUSION is a component based middleware provided by NDS, capable of supporting application engines and APIs for the development of EPGs and iTV apps, namely NDS’ Proprietary Core VM Engine.

Page 12 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

The FUSION middleware provides services such as access to the broadcast schedule (channels, events, etc.), access to the PVR catalogue and functions (booking, listing recordings, playback) and enables access to online services such as VOD catalogues. It runs on top of the Common Driver Interface (CDI) driver layer.

The FUSION middleware provides the foundation for services to be provided by Progressive Download (PDL).

PDL is a method of delivering on-demand video content to a Set Top Box equipped with a hard- disk (i.e., DVR) while ensuring a quality of service similar to that of streaming VOD. PDL uses the available network bandwidth to deliver file-based content to the Set Top Box hard-disk. The consumer can begin viewing the video as soon as the disk has cached enough content to avoid interruptions, while the download continues in the background.

The FUSION middleware provides the foundation for future services like Optional External Module and Shared Planner, hereafter briefly described.

Optional External Module :

The Optional External Module allows the subscriber to create or expand the capacity of a PVR so that a content can be stored on either the internal or external disk.

The Optional External Module can only be used in connection with the PVR, and NDS VideoGuard Conditional Access protects its content providing the same level of security available for content stored on the internal disk.

Shared Planner :

Shared planner is a home networking feature that allows a FUSION STB to connect via an in-home network (e.g., WiFi) to other FUSION STB to view and play content in another room.

4.3 Content Encoding

As for Other End User Devices, the content encoding format at the launch of service will be H.264 delivered in Progressive Download Variable Bit Rate.

4.4 Content Delivery Network

As for Other End User Devices, Video Services will be delivered OTT via Content Delivery Network (CDN). Sky will use third party global CDN service providers, at the launch of service AKAMAI and Level 3.

Page 13 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

4.5 Geoblocking

As for Other End User Devices, geoblocking and connection type business rules will be checked by Sky’s Global CDN and/or through the Quova geofiltering service.

4.6 Progressive Download Bit Rate Profiles

The video distribution for Progressive Download will be at a variable Bit Rate and will be consistent with the following examples but are permitted to be changed depending on user experience feedback :

Bit Rate Resolution Aspect Ratio SD 1500Kb average 720x576 16/9 HD 5000Kb average 1920x1080 16/9

4.7 STB Output Protection

Set Top Boxes have CGMS/A analog copy protection solutions available on all analog video outputs for which these solutions are defined and such solutions may be applicable to certain categories of content as agreed on a case by case basis.

Content rendered at an HD resolution via any digital output shall be protected applying (a) HDCP over DVI, HDMI, or DisplayPort; or (b) NDS CAS over USB or Ethernet (according to their applicable specifications). In the event the application of the foregoing output protection technologies cannot be confirmed by Sky, only a constrained image of such content (i.e., SD resolution) may be rendered via such digital outputs (or such content may be rendered, in SD format, via analog, pursuant to the applicable requirements herein for such analog output).

Content shall not be rendered in HD resolution on any component analog video outputs. HD resolution content may be down converted (or “down-res”) to SD resolution and thereafter rendered on component analog video outputs.

5. Facility Security

Below an outline of the security parameters applied to Sky’s physical facilities, also applicable to all IP delivery processes.

Entry/Exit Points : • Content/production areas are segregated and access is allowed on a need-to-know basis • Access into rooms where media players are present is limited and controlled

Page 14 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

Visitor Entry/Exit : • All technical facilities are access controlled • All visitors are identified by security control room before access is granted • Visitor badges are distinguishable from company personnel badges by colour coded policy • Company policies foresee that all visitors must be escorted by company personnel • Visitors cannot be left alone in content/production areas

Identification : • All company personnel and long-term third party personnel have a personal badge with name and photo identification. The badge must be visible at all times and specific controls are performed by security personnel • Personnel is trained to immediately report lost or stolen photo ID access badges • A telephone number is available 24/7 to report lost or stolen photo ID (Security Control Room)

Perimeter Security : • Perimeter access is restricted through the use of walls or fences • Entry and Exit points are supervised 24/7 by security guards • All perimeter is monitored through TVCC systems, supervised by the Security Control Room 24/7 • Intrusion detection sensors alarms are placed in the facility perimeter

Emergency Protocol : • All production facilities and related security systems in place are protected by UPS and diesel power generators • UPS and power generators are tested on a monthly basis, all tests are tracked and recorded • Power generators can supply power for five days leveraging existing fuel and for a longer time if fuel is refilled • Doors allow individuals to exit the facility during power outages and require positive authentication to enter

Alarms : • Every entrance is equipped with alarms connected to the security control room • A Corporate emergency and escalation procedure is in place and it takes care of automatic massive notification in case of emergency (also on weekends and after business hours) • Alarms can be armed and disarmed through the Security Control Room operators, after personal login to the Building Management System • A user attestation is performed on a semi-annual basis • The Building Management System is tested on a semi-annual basis Page 15 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

• All technical rooms (i.e., data centers, MMA, content storage systems) have access- controlled doors managed through the Building Management System supervised by Security Control Room 24/7

Authorization : • A process to manage facility access exits and is managed by Facility Management/Security Department • For any access controlled room has been defined : – A list of people who can grant or revoke access – An access request form – A process to assure a semi-annual user access attestation

Electronic Access : • All technical areas access control are based on an electronic access control system • All access events are logged and archived in the Building Management System • Electronic system administration is fully owned by Security Department • Access is granted on a need to know basis (standard behaviours or specific access rules)

Cameras : • A CCTV system records all facility Entry/Exit points and restricted areas • CCTV system is supervised 24/7 by Security Control Room personnel • Physical access to CCTV equipment is restricted, according to any other technical room • The web console for IP-based CCTV systems is restricted and operates on a dedicated VLAN • CCTV records are retained for 24h, according to the Italian Data Protection Law

Logging and Monitoring : • All security events are logged and monitored for review.

6. Technical Contacts

The Sky Technical Contacts are:

Paola Formenti - Director of Technology Email: [email protected] Tel.: +39 023 0801 7674

Massimo Bertolotti - Head of Innovation and Platform Engineering Email: [email protected] Tel.: +39 023 0801 7022

Page 16 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

APPENDIX A Acronyms and Abbreviations This appendix lists the acronyms and abbreviations used in this document :

ABR Adaptive Bit Rate AES Advanced Encryption Standard API Application Program Interface CAS Conditional Access System CCI Copy Control Information CDN Content Delivery Network CPU Central Processing Unit DNX Domain Name Exchange DRM Digital Rights Management DTCP Digital Trasmission Content Protection DTH Direct To Home DVI Digital Visual Interface DVR Digital Video Recorder ECM Entitlement Control Message EMM Entitlement Management Message EPG Electronic Program Guide HD High Definition HDCP High-bandwidth Digital Content Protection HDMI High Definition Multimedia Interface IP Internet Protocol IPTV Internet Protocol Television OTT Over The Top PDL Progressive Download PPV Pay Per View PTV Pay Subscription Television PVR Personal Video Recorder SD Standard Definiton SDLL Secure DLL STB Set Top Box SVOD Subscription Video On Demand TVOD Transactional Video On Demand USB Universal Serial Bus VCR Video Cassette Recording VOD Video On Demand WiFi Wireless Fidelity

Page 17 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

APPENDIX B STB Technical Specifications FUSION STB - HD PVR High Level Specification, as at February 2012, subject to change :

Specifications Notes Main Manufacturer Samsung, BskyB, Pace System On Chip Broadcom 2 DVB-S2 Tuners/Demods: - Input frequency range: 950MHz to 2150MHz - DVB-S/DVB-S2 normative broadcast modes - 13/18V control, 22kHz for LB/HB selection up to 400mA current (short protected) Tuner/Demod - DiSeqC 1.0 signaling and tone burst commands - SatCR support (EN50494 satellite signal distribution over single coaxial cable) - Single Cable Routing via FSK modem communications to the LNBs 4MB (NOR Flash) BootLoader Flash Flash Mem 256MB (SLC NAND Flash), System Flash RAM SDRAM (DDR)256MB NVRAM 32KB Emulated in Flash Internal eSATA 2.0, 3.5” or 2.5” size, capacity up to 2 HDD Terabyte The STB shall be compliant with regulation n° EC Low-Power stand- 1275/2008 of the 17th December 2008 standby/off by mode Compliant with state of the art version of Energy “Voluntary Industry Agreement to improve the consumption energy consumption of Complex Set Top Boxes” Software & CA/Security NDS Video Guard Content NDS Fusion for Sky Italia, based on CDI profile for M/Ware Protection Sky Italia RTOS Linux NDS HD EPG for Sky IT – Main Functionality: Personal Planner – a personal planner contains details of all program reminders which have been set by the subscriber PPV – it is possible to purchase content on a PPV basis. This content can be purchased using the electronic program guide or via the EPG customer call centre Parental Control – parental control is possible by means of a private PIN. Live content which exceeds the subscriber’s chosen parental rating threshold cannot be played without access to the PIN TV Guide with mini TV – the TV Guide Page 18 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

contains details of all programs in the Sky bouquet for up to 7 days in advance. A mini TV shows the currently tuned video Installations - support of the following installation configurations : o 1 Universal LNB o SMATV o Sky Italia Single Cable Reception (SCR) for SDU o Ready for Sky Italia SCR/MDU (FSK) DTT section – integrated FTA DTT channel line-up and 7-day EPG Based on NDS secure download specs, both in SW DNL Foreground and Background Interactive services, based on NDS K2VM Interactive technology, are supported Smart Card Compliant to NDS specs Copy Protection Digital : HDCP Analog : CGMS-A (CGMS-A by setting copy protection bits in the SCART video output line 23 WSS) Front Panel 9 keys : 4 arrow keys (left, right, etc.) with double function for DVR features OK Front Keys ESC Guida TV Stand-By/On DVR (to switch to 2nd arrow key functions) 6 LEDs : Stand-by/On IR LEDs Mail message Ethernet Play Rec Ring-spinner LED for trick-modes signaling to Ring-spinner LED viewers External Ports 1 Smart Card slot compliant with ISO7816 -1,2,3 NDS Smart Card slots electrical approved TV Scart only : TV Scart providing video PAL-CVBS, video SCART RGB, video Y/C, audio L+R output signals. TV Scart including Pin 8 control to signalize

Page 19 of 20 Sky Italia Confidential February 2012

White Paper Version A.01

16:9 vs 4:3 aspect ratio and pin 16 control for CVBS and RGB signaling TOSLINK optical digital audio connector and RCA SPDIF Phono electrical digital audio connector Audio RCA Left and Right RCA Phono connectors HDMI Up to version 1.3a Up to 3 x USB 2.0 Type A receptacle (480Mb/s) USB 2.0 @500mA full power 10/100Mb RJ45 Ethernet port (including LEDs to Ethernet indicate network connection) in accord with IEEE802.3 Sat RF in 2 IEC 169-24 Female Input Internal 4pin in-line plug interface, BARB Audience Research compatible Power Supply External, 12V, 40W Compliance with 278/2009/EC for no-load PSU condition electric power consumption and average active efficiency of external power supply” Video and Audio Broadcast: Video Formats 1080i@50, 720p@50, 576p@50, 576i@50 Simultaneous Video Scaling at Scart Port of HDTV Video Conversion formats down to SDTV formats. Video Scaling Pan & Scan, LetterBox, PillarBox Video Output At least 1920x1080, 1280x720, 720x576, 704x576, Formats 544x576, 480x576, 352x576, 352x288 MPEG2 MP@ML, MPEG2 MP@HL,H264 up to [email protected], MPEG still images, Jpeg still images, 3D in Video Decoding Frame Compatible Mode (1080i50 sbs or 720p50 tab) MPEG1 L1&L2, MPEG4 AAC-LC & AAC-HE, Dolby Digital (AC3), Enhanced Dolby Digital (E-AC3) Audio Decoding Stereo down-mix of AC3 streams to analog and digital audio outputs Output of AC-3 streams via HDMI and S/PDIF

Page 20 of 20 Sky Italia Confidential February 2012