The term Spoofing is broadly applied to the deliberate transmission of false or misleading data over the Automatic Identification System (AIS) to disguise a vessel's true identity, location, or movements. This can include multiple facets such as altering a vessel’s static messages or using multiple MMSI’s simultaneously or successively to make tracking more difficult.

It’s important to note that not all instances of AIS manipulation are intentional or nefarious in nature. AIS signals can often be unintentionally spoofed through faulty GPS signals, software and installation errors, or signal interference. This is on top of the natural limitations of AIS signals, which can be impaired by signal propagation conditions, sea state, the height of the transmitting and receiving antenna and the strength of the vessel transmitter.

Trying to differentiate between intentional and unintentional ‘spoofing’ can be difficult, so it’s worth considering the contextual factors in every situation before jumping to conclusions. Some of these factors could include AIS coverage (the best and worst reception areas for each AIS provider), traffic congestion, known technical glitches, IMO specifications for AIS, perceived threats, and the geo-political considerations for any given region.

The following examples provide insight into some different types of AIS spoofing (including unintentional) that can be identified using Starboard, and some key features that can assist in the analysis of direct and contextual factors.

Operation TS 2023 was a collaborative exercise focused on emerging technology and tools to help combat illegal smuggling at sea with Starboard Maritime Intelligence, S&P Global Market Intelligence, Spire Maritime, and Planet. It identified instances of spoofing, and provided insight into the methods that can be used to investigate them in Starboard. Some key features discussed in the Youtube series included the case study of OFAC Sanctioned vessel Balita (IMO: 9176773) and IUU-listed vessel Riwa (9017666) which highlighted some effective techniques.

Watch the full Youtube series here

One of the easier ways of spotting potential AIS spoofing in Starboard is by using Map Layers → Vessel Layers → Speed for selected vessels. This allows you to visualise a vessel’s changes in speed over the course of its journey to identify potential anomalies. In the case of OFAC Sanctioned vessel Balita, there was an instance of possible spoofing found where its track had an unusually consistent speed and heading for several days, in an area known for oil smuggling.

Try it out: Drag the time slider across while watching the speed and heading remain static.

By pasting the vessel’s IMO into the Search Bar, it also becomes apparent that there have been a higher than normal range of name, flag, and other changes to the vessel’s AIS details, likely in an attempt to obfuscate its true identity.

The same technique can be used for the IUU-listed vessel Riwa, by pasting its IMO (or other AIS features) into the search bar to see a range of possibly-fake identities. Some key indicators of potential identity spoofing can include the use of Paris MoU blacklisted flags (using unregistered MMSI’s of flags with poor registry and compliance controls), using AIS details that are not IMO-registered (name, IMO, MMSI, callsign, flag), and assuming several different AIS identities in quick succession.

Try it out: Search on the Riwa’s IMO to discover all of the alternate AIS entities, including MoU black flags, and non-IMO registered names, MMSIs, etc.

Watch the full video here and read more about these types of vessel risk indicators here.

Another common method of identifying spoofing using the Starboard platform is through imagery analysis. Starboard can ingest and fuse a variety of satellite imagery types with AIS and other geo-spatial data, to help analysts spot AIS signals that don’t have a physical vessel attributed. Some common types of satellite imagery used for identifying spoofing include Electro Optical (EO) and Synthetic Aperture Radar (SAR). Selecting a satellite imagery in Starboard and identifying AIS signals without a vessel image underneath can be an effective way of identifying potential spoofing. Make sure to turn on your Satellite data in Starboard by going to Map Layers and ticking the relevant boxes (pictured below).

In the following image, two AIS signals were found without a corresponding SAR image (coloured boxes), indicating possible spoofing. One of the selected vessels is also listed in the UANI Ghost Armada list, potentially indicating an intent for illegal oil transfer.

Try it out on your organisation’s satellite imagery collections. If your organisation doesn’t have satellite imagery available, contact us for some demo data or watch the Operation TS video here.

Another more obvious example of spoofing can be found by simply looking for vessels which appear to be travelling or congregating on land. The example below shows a group of vessels on land, which have been selected and isolated by clicking ‘hide other vessels’. The Vessel list (under ‘Analysis results) is then used to sort the suspicious group by categories. This can be useful to find patterns or trends that can help to formulate future filter sets in Starboard to proactively identify suspicious vessels in your area of interest. It’s worth noting here that large spoofing events such as the example shown below may be a result of external GPS jamming rather than individual spoofing. This should be considered in your contextual analysis before determining whether to categorise the activity as vessel-based or actor-based spoofing. There are also some known technical glitches that cause vessels to appear on land, and these are often unbeknownst to the captain. An example of this outlined further on in this article.

Try it out: Open the Vessel list panel, and sort by categories such as Risk indicators, Previous port, or Journey categories – To search for common trends or characteristics in suspicious vessels.

A more advanced method of identifying spoofing in Starboard can be through the use of the Map Layer → Vessel layers → AIS data points for selected vessels. This layer shows each of the individual AIS data points per selected vessel track, coloured by receiver source (satellite, terrestrial, or vessel). It can be enhanced by also ticking the Full resolution AIS data layer as well, but this can only be used for up to 3 selected vessels, up to 7 days (due to the load on the system by introducing thousands of extra data points).

The following example of potential spoofing was detected in Starboard by combining the ‘AIS data points for selected vessels’ with the ‘Speed for selected vessels layer’ (the same Speed layer detailed in earlier examples). By looking at these layers together, we can see a consistent ping-rate of AIS data points captured by terrestrial-based receivers (green dots) while the vessel is travelling on its forward journey. On its return journey via the same track, the AIS data points are very sparse, and only from vessel-based AIS sources (blue dots) which are often missing the speed and heading metadata as well. This could indicate AIS spoofing.

Try it out: Look at how the AIS data points, speed, and heading change on the return journey, compared to its forward journey over the same track.

Further on in this vessel’s spoofed track out of the Persian Gulf, it stops and anchors in a manner that appears ‘too perfect’. When moving the time slider back and forth in Starboard, the vessel appears to move in a perfect circle, which is inconsistent with the anchoring patterns observed of nearby vessels who appear to be impacted by ocean conditions (applying contextual analysis). Turning on the AIS data points helps to differentiate the spoofed AIS signals from the interpolated tracks (solid lines connecting the points), allowing for more fine-grained analysis.

Watch the full video here.

Another example of this type of ‘perfect anchor’ spoofing is shown below.

Try it out: Move the time slider back and forth to show the perfect regularity of this vessel’s anchoring pattern when compared to other vessels at anchor in the area which appear to be affected by drift and currents.

Using the AIS data points for selected vessels layer can also be an effective method of spotting unintentional spoofing - in other words technical glitches that alter the nature of regular AIS transmissions, often without the awareness of the captain. The example below shows multiple vessel tracks which at first glance appear to be spoofing, but when considered in context, is more likely to be a technical fault of the AIS satellite or on-board transponders. By switching on the AIS data points layer, it becomes apparent that only the satellite-based sources are behaving abnormally, whereas the terrestrial and vessel-based sources show a very normal fishing vessel track off the coast of Australia. It’s likely that the communication between the transponder and the satellite receiver is incorrectly transposing legitimate fishing vessel locations from the Australian coast into the high seas.

Try it out: Follow the tracks of the fishing vessels to see the signal bounce between Australia and the high seas, as the vessel conducts its routine fishing activities.