Latest news

Stay up-to-date with the latest Geollect news

What Happens When a Vessel Goes “AIS Dark”​?

What is AIS?

Automatic Identification System, or AIS, is a system introduced and utilised on vessels as a collision avoidance measure. If a vessel is located close to another, the AIS transponder onboard will send a ping of the vessel’s location, speed and heading. This will continue for as long as the AIS transponder remains on. Due to maritime safety legislation, the overwhelming majority of vessels nowadays have AIS transponders onboard. AIS as a system is relatively easy to manipulate as it was primarily introduced at the ground level for vessel-on-vessel collision avoidance at sea. It doesn’t have particularly complex security settings and can be manually edited or remotely manipulated. It is only with the advances of tech and access to information, that we can now effectively use it as a means of tracking vessels anywhere around the globe, from the comfort of an office or home. It is important to remember the system was never designed for this, so is easy for nefarious networks to tamper with. This data does have it’s uses though, to ensure sanctions compliance, investigate illegal fishing as well as a multitude of other purposes. However, the point remains that where possible, it should be corroborated due to ever developing techniques to circumvent and alter AIS positions. While some of these methods are complex and require careful preparation, others are more rudimentary in nature. The most common method employed by individuals seeking to circumvent vessel tracking is to simply switch off the AIS transponder. This is colloquially known as “going AIS dark”. 

No alt text provided for this image
The example above displays a Tuvalu flagged oil tanker having a suspicious AIS outage whilst operating near the Iranian coast. During this outage, it is highly likely that the tanker called at an Iranian port or conducted a transfer in Iranian waters to load oil. Once this is completed, we can see that the vessel begins recording AIS positions heading in the opposite direction out of the Persian Gulf. These gaps can be for a few hours, or as long as several months.
No alt text provided for this image
This example displays one of the vessels accused of transporting stolen Ukrainian grain to Syria. From this gap in May 2022, we can see that it is heading south near Syrian TTW (red zone), before going AIS dark for a period of 177 hours (7 days). This amount of time would have been ample to conduct a port call and offload cargo. Similar to the Iranian example, we see the vessel emerge back on AIS heading away from a suspect port.

How can we track a vessel when it goes “AIS dark”?

Depending on the length of AIS darkness, tracking a vessel with no AIS positions can be challenging. The longer the outage, the more possibilities there are for where it could have gone. However, there are a few avenues to explore which may yield results when tracking dark vessels. Using the two provided examples, it appears highly likely that each vessel intended to conduct a port call at a sanctioned country or conduct activity in that countries territorial waters during the AIS outage period. As a result, using satellite or open-source imagery, we can analyse these ports and identify any vessels in port which align with the dimensions and characteristics and increase confidence in the assessment that this is where it has gone. 

No alt text provided for this image
AIS outage shown alongside corresponding satellite imagery of Latakia port, showing a vessel matching the dimensions and characteristics in the same timeframe.

Using high-resolution satellite imagery, we can identify that during the period of AIS darkness in May, a vessel was identified at the port of Latakia unloading grain, that closely matches the dimensions and characteristics of the AIS dark vessel. Using a combination of data and imagery drastically increases the chance of successfully tracking a suspicious vessel.

Another data set which could be utilised to help find AIS dark vessels is open source imagery, although a caveat here is that we should always check the validity of these sources and corroborate with other sources where possible. Users online regularly post useful imagery and information relating to shipping, with dedicated accounts and user groups set up to track certain types of vessels or areas of interest. With the example below, users on twitter identified CCTV imagery of the vessel entering the port of Sevastopol whilst in another period of AIS darkness. This combination of imagery, open source information and AIS data provides a much better chance of understanding movements during AIS darkness, or any other attempts to obscure a vessel’s position. 

No alt text provided for this image
AIS outage shown alongside available open source port footage of Sevastopol port, showing a vessel matching the dimensions and characteristics in the same timeframe.

It is important to note that AIS data is not the only form of data emitted by a vessel which can be used to track position. A dataset which is becoming more and more commonplace is using radio frequency (RF) data emitted by a vessel. RF data from navigational radars or sat phones can be highly effective when looking for AIS dark vessels. The limitation of this is that, while RF tracking is becoming more common, it has not yet fully been incorporated into most maritime tracking platforms or commercially available avenues. Only a handful of companies currently offer RF tracking data alongside conventional AIS data. However, access is only increasing and Geollect have been working closely with their partner Spire to uncover insights from this data. Long Range Identification and Tracking (LRIT) data is another means of tracking vessels, but this also comes with limitations. The data is only routinely accessible for authorised parties and difficult to access commercially, not to mention that it can also be deactivated, altered or tampered by those with the correct knowledge.

What other methods are used to obscure a vessel’s AIS Position?

While deliberate periods of AIS darkness remain a common method used to conduct suspicious activity, other methods have been observed and are becoming more commonplace. One of the more complex methods used is commonly referred to as GNSS manipulation or “AIS spoofing”. This involves using additional equipment to manipulate a vessel’s transmitted positions, either by merged readings in the exact same position, or going as far as to manufacture completely fabricated transits. It is worth noting that periods of manipulation may also involve periods of AIS darkness, as each method is not exclusive and is often used in conjunction with the other. 

No alt text provided for this image
The above examples display two of the more obvious attempts at manipulating AIS positions. If a vessel is at anchor and not moving, you would expect to see a circle or semi circle pattern with slight changes in speed as the wind and waves affect the vessel pivoting around the weight of the anchor cable. With the manipulated positions, the vessel is consistently recording the exact same speed with no variation whatsoever. Like with periods of AIS darkness, there is no limit to how long or how short these manipulated positions can be.
No alt text provided for this image
The example above identifies two examples of a vessel’s AIS position whilst at anchor. The left example is from a legitimate anchor position, with the example on the right being a spoofed position.

We can immediately see that the legitimate anchor position has subsequent AIS points in a natural flow, as the wind and currents slowly pivot the vessel. The spoofed position however has no natural effects present, with AIS points seemingly plotted on different sides of the anchor position. Another way to differentiate between the two is to examine the recorded speed during this time. The example on the left was recording a variation anywhere between 0.1-0.5 knots, which is due to the vessel movement being dictated by environmental elements. The example on the right however recorded exactly 11 knots the entire time. This provides us with the best example that the position was manipulated, as a vessel at anchor would not be registering 11 knots.

While many examples of AIS manipulation are easily identifiable, other instances appear far more legitimate and require additional analysis to verify. The example below was from a vessel accused of loading sanctioned oil via a ship-to-ship (STS) transfer with another vessel. Around the time the vessel was supposed to conduct a port call and load oil, it was identified on AIS transiting past Singapore. 

No alt text provided for this image
The image above shows a manipulated AIS track that was not legitimate

At first glance the AIS track of the vessel looks legitimate. There is occasional course adjustments and the area of transit is not overtly suspicious. However, after examining the speed we begin to see signs that the positions are manipulated. The recorded speed for several days show almost no change or variation. A vessel’s speed is always going to be affected to an extent by environmental elements such as wind or current, even just by 0.1 of a knot, so a recording of no variations whatsoever is extremely unlikely. Before the 22nd March we can see that there is a degree of variation with the speed, however, after the 22nd March, the speed recorded becomes constant for days at a time.

No alt text provided for this image
Speed chart showing recorded speed for several days with no change or variation indicated by red boxes

To further investigate if the vessel in question was spoofing its AIS position, satellite imagery of the area was used to try and uncover any vessel in the recorded AIS position. From the capture below we can see that there is no signature identifiable within the lat/long associated to the AIS position. As a result, we can assess that the vessel in question was almost certainly manipulating its AIS position during this time. 

No alt text provided for this image
Sentinel-1 SAR data showing a capture at the same lat/long as the registered AIS position at the same time. No vessel signature is present Credit: European Union, contains modified Copernicus Sentinel Data

Final thoughts & looking to the future

As long as vessels continue to be tracked by AIS positions, certain groups and individuals will continue to implement measures to obscure data related to their activities. Due to the ease of access and frequency this activity occurs, going “AIS dark” will likely remain as the most used tool to obscure a vessel’s position. Fortunately, this can be countered in a number of ways, some of which are explored above. Additional data sets such as satellite and open source imagery can aid with identifying vessel positions during shorter periods of AIS darkness. For longer periods of AIS darkness, these data sets can still be useful, but will need to be augmented with additional data to corroborate. In these longer periods of AIS darkness, the more accessible data investigated to corroborate is absolutely key. A data agnostic approach is vital to find and explore new and emerging datasets to answer varied problem sets – taking no single source or answer at face value!