As part of the Using Satellite Data for Analysis in Starboard series, this article explains how analysts can identify and investigate AIS spoofing within the Starboard platform by introducing some basic methods of analysis and integration with satellite data.

The term Spoofing is broadly applied to the deliberate transmission of false or misleading data over the Automatic Identification System (AIS) to disguise a vessel's true identity, location, or movements. This can include multiple facets such as altering a vessel’s static messages or using multiple MMSI’s simultaneously or successively to make tracking more difficult.

A zombie vessel uses scrapped vessel IMOs to hide its real identity.

Not all instances of AIS manipulation are intentional or malicious. Apparent spoofing can result from faulty GPS signals, software or installation errors, signal interference, and the inherent limitations of AIS, including variable coverage, propagation conditions, sea state, antenna height, and transmitter strength.

Because distinguishing intentional spoofing from technical or environmental anomalies is often challenging, analysts should assess each case in context, considering factors such as AIS coverage gaps, traffic density, known technical issues, IMO specifications, perceived threat levels, and regional geopolitical conditions.

The following examples provide insight into some different types of AIS spoofing (intentional and unintentional) that can be identified using Starboard, and some key platform features that can assist in the analysis of direct and contextual factors.

Operation TS 2023 was a collaborative exercise focused on emerging technology and tools to help combat sanctioned oil smuggling at sea with Starboard Maritime Intelligence, S&P Global Market Intelligence, Spire Maritime, and Planet. It identified instances of spoofing, and provided insight into the methods that can be used to investigate them in Starboard. Some key features discussed in the Youtube series included the case study of OFAC Sanctioned vessel Balita (IMO: 9176773) and IUU-listed vessel Riwa (9017666) which highlighted some effective techniques.

Watch the full Youtube series here

One of the more straightforward methods for identifying potential AIS spoofing in Starboard is to apply Speed for selected vessels in your Map Layers menu. This visualisation highlights changes in a vessel’s speed over time, making it easier to detect anomalous behaviour. In the case of the OFAC-sanctioned vessel Balita, analysts observed a period of unusually consistent speed and heading lasting several days within a region known for oil smuggling, indicating possible AIS manipulation.

Try it out: Drag the time slider across while watching the speed and heading remain static.

To further assess whether this behaviour was isolated or part of a broader pattern, analysts can also examine the vessel’s AIS identity history. By pasting the vessel’s IMO into the Search Bar, the results make it clear that there has been a higher-than-normal frequency of name, flag, and other AIS identity changes—likely reflecting attempts to obscure the vessel’s true identity.

This approach can also be applied to other high-risk vessels, such as the IUU-listed vessel Riwa. By entering its IMO (or other AIS identifiers) into the Search Bar, analysts can uncover a history of multiple, potentially false vessel identities. Common indicators of identity spoofing include the the transition from well-regarded flags to Paris MoU blacklisted flags (often associated with unregistered MMSIs and weak registry controls), AIS details that do not correspond to IMO-registered information, and the rapid adoption of multiple AIS identities over a short period.

Try it out: Search on the Riwa’s IMO to discover all of the alternate AIS entities, including MoU black flags, and non-IMO registered names, MMSIs, etc.

Another common method of identifying spoofing using the Starboard platform is through satellite imagery analysis. Common types of satellite imagery used for identifying spoofing include Electro Optical (EO) and Synthetic Aperture Radar (SAR).

In the following example, two AIS signals were found without a corresponding SAR image (coloured boxes), indicating possible spoofing. One of the selected vessels is also listed in the UANI Ghost Armada list, potentially indicating an intent for sanctioned oil transfers.

Watch the full Operation TS video.

One of the clearest indicators of AIS spoofing is vessels that appear to be travelling or clustered on land. This is a red flag that requires no specialist training to spot, but still demands broader context to determine whether the cause is deliberate spoofing, external GPS jamming, or some other technical feature. Analysts should also be aware that basemaps vary in how inland waterways are represented, so switching to Basemap style - Satellite (in your Map Layers) can help confirm the true nature of the environment and rule out legitimate water features.

Try it out: See these vessel congregating on land. Is this spoofing or jamming?

A more advanced method of identifying spoofing in Starboard can be through the use of the AIS data points for selected vessels. This layer shows each of the individual AIS data transmission points for a selected vessel track, coloured by receiver source (satellite, terrestrial, or vessel). It can also be enhanced by ticking the Full resolution AIS data layer as well.

The following example of potential spoofing was detected in Starboard by combining two map layers, AIS data points for selected vessels and Speed for selected vessels. By looking at these layers together, we see a consistent ping-rate of AIS data points captured by terrestrial-based receivers (green dots) while the vessel is travelling on its forward journey. On its return journey via the same track, the AIS data points are very sparse, and only from vessel-based AIS sources (blue dots) which are often missing the speed and heading metadata as well. This could indicate AIS spoofing for the return journey.

Try it out: Look at how the AIS data points, speed, and heading change on the return journey, compared to its forward journey over the same track.

Further to this, the vessel's return journey ends at anchor, in a manner that appears ‘too perfect’. When moving the time slider back and forth in Starboard, the vessel appears to move in a perfect circle, which is inconsistent with the anchoring patterns observed of nearby vessels who appear to be impacted by oceanic conditions (applying contextual analysis). Watch the full video here.

Try it out: Move the time slider back and forth to show the perfect regularity of this vessel’s anchoring pattern when compared to other vessels at anchor in the area which appear to be affected by drift and currents.

Using the AIS data points for selected vessels layer can also be an effective method of spotting unintentional spoofing - in other words technical glitches that alter the nature of regular AIS transmissions, often without the awareness of the captain.

The example below shows multiple vessel tracks which at first glance appear to be spoofing, but when considered in context, is more likely to be a technical fault of the AIS satellite or on-board transponders. By switching on the AIS data points layer, it becomes apparent that only the satellite-based sources are behaving abnormally, whereas the terrestrial and vessel-based sources show a very normal fishing vessel track off the coast of Australia. It’s likely that the communication between the transponder and the satellite receiver is incorrectly transposing legitimate fishing vessel locations from the Australian coast into the high seas.

Try it out: Follow the tracks of the fishing vessels to see the signal bounce between Australia and the high seas, as the vessel conducts its routine fishing activities.