A method for identifying, from among network-connected devices, a device (15, 152, 153) likely associated with a theft of distributed content, the method comprising: obtaining (311, 641) content, the content comprising a plurality of videos that have been distributed from a device of the network-connected devices and treating the plurality of videos as a single long video; identifying (217, 417, 643) anti-collusion codes in the plurality of videos; calculating (313, 511, 649) an aggregated probability across the long video using the anti-collision codes identified in the plurality of videos; determining that the device of the network-connected devices is likely associated with the theft of distributed content upon determining that: the aggregated probability exceeds (315, 513) a first predetermined threshold, or the aggregated probability equals to or is below the first predetermined threshold and exceeds a second predetermined threshold, and at least some of the plurality of videos include at least one common characteristic, the common characteristic being one of a content encoder used to encode the at least some of the plurality of videos in the obtained content, a website for hosting the at least some of the plurality of videos in the obtained content, or a private network for distributing the at least some of the plurality of videos in the obtained content. obtaining (311, 641) content, the content comprising a plurality of videos that have been distributed from a device of the network-connected devices and treating the plurality of videos as a single long video; identifying (217, 417, 643) anti-collusion codes in the plurality of videos; calculating (313, 511, 649) an aggregated probability across the long video using the anti-collision codes identified in the plurality of videos; determining that the device of the network-connected devices is likely associated with the theft of distributed content upon determining that: the aggregated probability exceeds (315, 513) a first predetermined threshold, or the aggregated probability equals to or is below the first predetermined threshold and exceeds a second predetermined threshold, and at least some of the plurality of videos include at least one common characteristic, the common characteristic being one of a content encoder used to encode the at least some of the plurality of videos in the obtained content, a website for hosting the at least some of the plurality of videos in the obtained content, or a private network for distributing the at least some of the plurality of videos in the obtained content. the aggregated probability exceeds (315, 513) a first predetermined threshold, or the aggregated probability equals to or is below the first predetermined threshold and exceeds a second predetermined threshold, and at least some of the plurality of videos include at least one common characteristic, the common characteristic being one of a content encoder used to encode the at least some of the plurality of videos in the obtained content, a website for hosting the at least some of the plurality of videos in the obtained content, or a private network for distributing the at least some of the plurality of videos in the obtained content.