Uncovering 8 billion dollars worth of spoofed oil exports using Spire Maritime’s AIS Position Validation

One of the foremost use cases of this unparalleled data set is detecting position spoofing. We used this data to uncover the story of sanctioned Venezuelan oil being shipped to the Far East through a smokescreen of falsely reported tracks and destinations to deceive authorities.

What is AIS position spoofing?

Spoofing is a technique in which a vessel indicates being in a certain position, but actually reporting from somewhere else. In simple terms this means that the vessel is not at the location it is reporting to be at. Broadly speaking, this is done by manipulating the GPS information that is part of the AIS positional messages this ship transmits, allowing the ship to effectively deceive anyone looking at the vessel’s behavior, including movements and reported destinations, while possibly engaging in illegal activities such as the illicit trade.

By using a combination of state-of-the-art techniques, Spire Maritime’s new offering, AIS Position Validation, has the capability of detecting situations in which a vessel is spoofing its location. Being able to flag these anomaly events and calculate an alternative position, it effectively provides far greater transparency over the actual route and destination of the vessel.

How is spoofing being used to bypass oil sanctions?

One of the typical spoofing patterns revolves around the export of sanctioned oil – more specifically, regarding sanctions imposed by the United States, Western Europe, and its allies on the South American country of Venezuela. The goal of this embargo is to protect the western financial system to be complicit in the corruption surrounding the Venezuela government and establishment, and the related impoverishment of the Venezuelan people. Despite these sanctions, petrostate Venezuela, where the government is highly dependent on the income from fossil fuels, has retained oil-trading partners in China, Cuba, Iran, and Russia.

Using Spire Maritime’s AIS Position Validation, we found around 50 individual tankers which, in the last 8 months, had estimated validation position events that placed them in the Venezuelan EEZ (Exclusive Economic Zone), instead of the locations they were reporting in their AIS messages. Typically, these ships will spoof their locations from the moment they start crossing the Atlantic Ocean from east to west, on their way to Venezuela. Only to return to a non-spoofed behavior when crossing the Atlantic Ocean in the opposite direction and sailing eastwards by the Cape of Good Hope. At that point their reported position through AIS messages aligns with the validated, real position. More on that later.

Comparison between the reported route (green line) and the AIS Position Validation data. Red dot pairs indicate position anomalies, with the larger dots being the calculated position based on AIS Position Validation data.

When looking at the reported AIS historical tracks of those tankers alone, it would be difficult to understand the real chain of events, let alone uncover the falsehood of the reported data emitted by the vessel. The reported positions of these vessels show a consistent track, going mostly to offshore areas that are known for oil exports, as is the case for the Cabinda exclave in Angola, the coast of Lomé in Togo or Brazilian offshore platforms like the Guanabara FPSO (Floating production storage and offloading facility).

When it comes to the reported positions for those 50 tankers, Cabinda accounts for 64% of the spoofing events. It is not surprising that tankers who spoof their location and destination use Cabinda as a deceiving destination of choice. Cabinda is located on the Atlantic Ocean in Western Africa, just north of the DR Congo. Adjacent to its coast are some of the largest offshore oil fields in the world and around 87% of Angolan exports are oil based.

Furthermore, China is Angola’s biggest trade partner and export destination. So, using Cabinda as a spoofed destination of choice is not illogical to bypass imposed embargoes on other nations such as Venezuela and keeping up the smokescreen.

Combining Historical AIS with AIS Position Validation to tell the story

Not only do the spoofed events of these tankers tell a different story from the real journey and route these vessels took, but also other reported AIS information by the vessel is used to cover up their behavior. When analyzing their historical reported AIS using our Historical Vessel APIs, one can see that these ships will communicate intermediate destinations like “CAPE TOWN” in South Africa, before overwhelmingly communicating spoofed destinations like “CABINDA” in Angola or “LOMÉ” in Togo, or even less defined ones like “FOR ORDERS”.

This is also applicable for the final destinations of the oil they are carrying; we used Spire Maritime’s Historical AIS to look at the routes undertaken after spoofing events were detected, and what the final destination of these vessels’ voyage would be; this revealed most journeys ending in either China or Malaysia.

China has been a longstanding trading partner of Venezuela and the sanctions imposed by the United States proved to be problematic for China as the United States warned that any entity still trading with Venezuela’s government could find itself subject to sanctions themselves. This resulted in top Chinese state oil buyer CNPC halting purchases of Venezuelan oil since August 2019. Private Chinese traders, however, have been filling the gap and have been proven to be willing buyers of Venezuelan oil. In some cases, this oil gets blended and re-certified as Malaysian following transshipments in Malaysian waters.

This correlates with the most common destinations for these ships, which seem to be ports like Qingdao, Yantai or Rizhao in China; or Malaysian ports like Malacca. Once entering these ports, Historical AIS data shows that the draught information of those ships change, indicating a probable unloading of the cargo onboard – in this case, crude oil in varying quantities.

How much oil has been carried by these detected vessels?

Looking at the Vessel Characteristics of the 50 individual vessels in question, we find most of them being Very Large Crude Carriers (VLCC). Those VLCCs, with a length of some 330 metres, have on average a deadweight tonnage capacity of 280,000. The other type of vessel represented is the Suezmax tanker, with a deadweight tonnage capacity between 120,000 and 160,000.

Altogether, this group of ships has a total deadweight of 13 million tons which, if we look at the individual voyages either completed or still ongoing by these vessels to Venezuelan ports, correlates to a total potential capacity of 108 million barrels of crude oil. At the time of this article being written, the price of a barrel of crude oil is roughly $79.5 – which leads us potentially to over $8 billion USD in sanctioned oil value that has been, or is being shipped from Venezuela to China and Malaysia.

Furthermore, the average amount of total ships detected engaging in similar spoofing activities has been steadily growing over this course of time.

Validating AIS positions – a unique data solution

AIS Position Validation goes beyond location spoofing. Using advanced RF signal-based vessel detection, AIS Position Validation independently calculates a vessel’s location at the time of the AIS transmission (even if AIS messages do not include valid GPS data). Use cases for AIS Position Validation includes amongst others, vessel owners and operators, insurers, government and government agencies, and voyage regulatory and risk assessment companies.