BLUF

Geollect has identified several incidences of what almost certainly looks like deliberate wide-scale spoofing of vessels’ Automatic Identification Systems (AIS) data in the vicinity of Iran. These incidents have occurred in the last three months, all of which involve complex patterns and up to 60 ships involved. Geollect is currently monitoring and conducting further research
into this situation.

What is happening?

From the 26th of April to the 8th of June 2023, Geollect identified a substantial number of vessels in the Persian Gulf whose AIS transponders were almost certainly being spoofed. These vessels were identified recording positions over Bandar Abbas City, the International Airport and over central Tehran. Some of these vessels were identified as recording speeds of over 50 knots. In all of these locations, multiple vessels had recorded AIS positions at high speed in patterns which were almost certainly created as a result of AIS spoofing. Analysis is currently ongoing to determine any areas of interest near these locations.

What is the context?

Iran & Iranian-associated actors have frequently demonstrated their willingness to manipulate GPS and AIS positions, both in the maritime and air domain. While it is uncertain at this time who is behind the manipulation, it is not without precedent: In January 2022, a similar pattern of AIS manipulation was identified at an airport near Tehran. During this incident in 2022, over 50 ships were involved in the AIS manipulation.

Why does this matter?

AIS data is used to prevent accidents at sea and track vessels in order to protect the safety of life at sea. Manipulating this data increases the risk to life and vessels at sea and is a reckless act. The Persian Gulf has frequently seen incidents of both maritime and air positional data manipulation, often as a means of facilitating the illicit trade of sanctioned oil, as well as incidents of vessels being boarded by Iranian forces. Understanding where each ship is, becomes particularly important within
this context.

Geollect will continue to monitor the situation. For more information, please get in touch at
info@geollect.com