The Bosphorus & Dardanelles Straits have been a geopolitically and strategically critical feature for millennia; a narrow maritime corridor connecting the Mediterranean to the Black Sea, whilst also dividing the landmass of Europe and Asia. 

The command of this waterway has always been a marked strategic advantage to whomever has possession of it, as it allows the control of movement across both land and sea, denying freedom of manoeuvre to adversaries.

While there has been much discussion on the scenarios in which Turkey or NATO could block this waterway in times of conflict, a less discussed factor of significance has become apparent since the war in Ukraine escalated in February 2022 – the advantage of using the canalising effects of the straits to monitor shipping, most notably, as a means of identifying vessels possibly associated with Russian illicit maritime activity – specifically the theft of Ukrainian grain.

Thus, ship spotters aiming to detect illicit maritime activity, such as the Twitter user Yörük Işık (and associated website The Bosphorus Observer), benefit from the necessity of these vessels to navigate through the straits, offering an excellent window of opportunity to capture geolocated, time stamped, high resolution images of the vessels as they pass through the straits. The subsequent posts on blogs and social media offer significant benefit to the open source intelligence community in helping to understand the wider context of the networks and associated deceptive maritime practices involved.

To give a recent example, on 22 March 2023, Yörük Işık posted several high resolution images of the bulk container MIKHAIL NENASHEV transiting through the Bosphorus from the Black Sea towards the Mediterranean (as seen in the post here). Likewise, the MATROS KOSHKA can be seen in a recent post from 26 March transiting back towards Sevastopol from Tartus, Syria, as seen here. Geollect have previously investigated both the MIKHAIL NENASHEV and the MATROS KOSHKA as part of a small fleet of Russian flagged dry bulk carriers involved in the transport of stolen Ukrainian grain. The vessels are operated by Crane Marine Contractor LLC, who are in turn owned by United Shipbuilding Company, the latter a heavily sanctioned major player in the Russian naval ship building and maritime industry (Geollect’s full report can be found here – Cereal Theft: An Investigation into Russian grain thieves). 

Therefore, the photographic capture of the MIKHAIL NENASHEV  seemingly continuing the same illicit tradecraft (and the highly likely continued facilitation of Ukraine grain theft) gave immediate cause to reassess its recent movements, which, at a quick glance at its AIS data, show all the indicators and warnings of continued illicit practices. Most notably, this included commencing Automatic Identification Systems (AIS)  darkness shortly before and after entering within 100 nautical miles of Crimea and similar deceptive practices as it approached Syrian territorial waters. Immediately from one photo, there is sufficient evidence of suspicious activity to warrant a full investigation, which in turn could lead to actionable intelligence for the purpose of sanctions, showing the impact a well situated ship spotter can have. 

Another interesting example of intelligence value coming from Yörük Işık is in the case of the recently renamed MATROS SHEVCHENKO, a dry bulk carrier now flying Russian colours. The good work of Yörük Işık in getting a photographic capture of the vessel again in the Bosphorus on 18 March (as shown here) heading towards Crimea reveals three things:

1. The vessel at the time of capture has physically changed its name, which many of the open source databases at the time hadn’t all registered and/or updated. From this alone, it leads the investigator to assume it has changed ownership as well, as this is common practice. 
2. It is following the same course as other vessels associated with the theft of Ukrainian grain. Therefore, the investigator should inspect the AIS data from the vessel and satellite imagery to look for indicators and warnings of deceptive shipping practices and illicit trade. 
3. It is a geolocated image within a rough time window from a source which has proven reliable in the past. From this, the investigator can take a recent reference image and a baseline point of confidence to do speed/distance/time calculation should the vessel later show deceptive shipping practices.

From these leads, a quick check did indeed reveal much of interest. The vessel changed its name from the MARIA GS to the MATROS SHEVCHENKO just after 1115 UTC on 28 January 2023 at Aliaga anchorage, Turkey. Under the MARIA GS, there were no obvious indicators and warnings of recent illicit/nefarious activity, yet as soon as the vessel changed names to MATROS SHEVCHENKO it immediately began to adopt deceptive shipping practices in common with tradecraft showed by other grain theft vessels, which would suggest it is highly likely that the vessel has changed ownership to a nefarious operator and a realistic possibility of a new crew being brought onboard to conduct these illicit practices. On further investigation, it appears highly likely that the MATROS SHEVCHENKO is now owned by Crane Marine Contractor LLC, whom have been heavily implicated in the movement of stolen Ukrainian grain as highlighted by Geollect’s report (linked above).

While one ship spotter may enable an investigation into a vessel of interest to begin by identifying it in the Bosphorus, another might close the loop by providing time-stamped geolocated photographic evidence of an illicit vessel in a contentious area. In this case, the twitter user @Kattyfun1 was able to identify the MATROS SHEVCHENKO leaving Sevastopol having loaded grain at Avlita – Sevastopol’s main grain distribution point and associated with the loading point of stolen Ukrainian grain – on 16 March 2023 at 1100 UTC.

This was at a time when it was AIS dark (as it had been dark since 11 March upon approaching Crimea): Clearly, the vessel was attempting to conceal its movements and where/what it was taking on as  cargo – a clear indication of an illicit actor engaging in deceptive shipping practices and illicit activity. 

Therefore, ship spotters play a vital role in detecting vessels of interest as part of illicit networks. By sharing their findings online, often with their own insightful analysis & deductions, this opens up the opportunity for collaboration amongst the OSINT community. Private companies like Geollect can use these geolocated images alongside data derived insights to help understand a wider context of deceptive shipping tradecraft and illicit networks via link analysis. The reliability of a geolocated image of the vessel can be used to provide an up to date baseline of the image, which in turn can be used to help companies like Geollect detect the vessel using satellite imagery during times when it has gone AIS dark at its end destination. 

Thus, ship spotters have an important role to play in the ongoing effort to detect vessels involved in the illicit maritime trade.