Understanding a vessel’s true journey: using AIS Position Validation to expose illegal trade

Following up on our investigation into the Uncovering of 8 billion dollars worth of spoofed oil exports using Spire Maritime’s AIS Position Validation, we bring you the story of another ship that engaged in Automatic Identification System (AIS) manipulation, and validate the theories and suspicions raised by Geollect using our AIS Position Validation solution.

AIS Position Validation is proving to be an invaluable source of data when it comes to AIS anomaly detection, in other words, uncovering vessels spoofing their location, detecting potential data manipulation or deception. The strength of AIS Position Validation is that it independently calculates a vessel’s location at the time of the AIS transmission, even if AIS messages do not include valid GPS data. This allows for the calculated position from the satellite data to be compared to the reported, and in some cases, fixed or out of footprint, positions contained within the AIS messages received from a vessel. In this case study we will be doing exactly that.

The need for validating AIS positions – the problem of illegal oil exports

There are many reasons why ships would resort to manipulating their AIS data, misreport and spoof their true location and as such undermining AIS data integrity. We can never be sure of the true intentions of such ships but AIS Position Validation can help us piece together the reasons behind AIS anomalies.

One of the common spoofing patterns revolves around the export of sanctioned oil. Vessels engaging in these illicit practices will feel the need of spoofing their location in an attempt for these illegal activities to go unnoticed. This case study, however, will piece together the real voyage on which the DELIVER embarked and comparing it with what it wants the world to believe.

Matching historical and validated AIS positions up until January 2023

The DELIVER started its journey in Ningbo, China, and sailed across the Indian Ocean and passed by the Cape of Good Hope. Validated AIS Position events then show the DELIVER sailing north along the western coast of Africa, to a location west of Angola and the Democratic Republic of the Congo. Up until this stage of the journey there is no reason to believe, from a data validation point of view, that there is any kind of suspicious activity going on, with AIS Position Validation events matching the AIS reported route of the ship.

The DELIVER’s route up to January 25th 2023

Note how the green dots on the image above form a consistent route; this is a representation of validated events on AIS Position Validation, meaning the ship’s reported position is consistent with the AIS Position Validation calculation. We can also see the chronological evolution of events below:

Emerging GPS spoofing patterns along the coast of western Africa

Geollect tracked the DELIVER, using Spire Maritime AIS data, from the 25th January onwards, looking at the reported AIS positions of the vessel, off the coast of West Africa. The suspicion, however, is that these reported AIS positions were spoofed. Reasons to believe the spoofed nature of the vessels location are the multiple identifying characteristics of manipulated AIS positions within this period, such as immediate directional changes, back and forth transits and constant speeds with little to no variation. As with other vessels engaged in location spoofing, the DELIVER starts emitting relatively static AIS positions once it has reached these waters, which seems a common location for reported positions associated with spoofing behavior.

AIS history and speed of the DELIVER, from January 25th to June 21st 2023

The AIS Position Validation calculated positions for this vessel – a total of 887 anomaly events for the 25th January 2023 to the 21st June 2023 period – tell a different story, and are far from being static. Instead of staying in the western African coast, the DELIVER’s calculated route crosses the Atlantic Ocean, all the way to the northern edge of the South American continent, more precisely to the Venezuela Exclusive Economic Zone (EEZ), where the first calculated positions seem to date between the 16th and 20th of February.

Furthermore, the data shows that there are no ‘validated’ positions for this entire period, meaning that the suspicious reported positions emitted by the vessel do not correspond with its real location. The ship’s reported positions stay relatively stable around the West Coast of Africa until the 21st of June.

AIS Position Validation events for the DELIVER, from January to July 2023. Small dots indicate reported positions, and large ones indicate the calculated position. Both are linked by a red stroke to show the correspondence between them.

Geollect went beyond just looking at the reported positions for the ship, and looked at Synthetic Aperture Radar (SAR) imagery at the ship’s reported positions in multiple moments during the 6 months while it was supposed to be in the west coast of Africa, to add further proof to the theory that the ship was not where it was reporting to be; it was unable to identify the ship in any imagery captured:

AIS history of the DELIVER, from January 25th to June 21st 2023, alongside corresponding satellite imagery highlighting its absence from its reported position. Source: Geollect assessment

More signs of AIS position spoofing arise

Geollect’s investigation shows that on the 21st of June the reported positions of the DELIVER began to change. Instead of emitting stable positions, west of Angola and the Democratic Republic of the Congo, these started showing a move to the West, representing a crossing of the Atlantic Ocean. Eventually these reported positions moved towards the Gulf of Mexico, with the trajectory staying clear of the South American continent. During this reported voyage, the vessel recorded exact speeds with little to no variation, another indicator of manipulated AIS positions.

The DELIVER’s reported route and speed from July 2023’s onwards. Image source: Geollect assessement

Once again, AIS Position Validation data contradicts the reported data. Despite the reported AIS positions by the vessel itself, Spire Maritime’s satellite-based solution continues to place the positions mostly inside the Venezuelan EEZ. As during the earlier stages of the vessel’s voyage, there are no validated events during this period, only anomalous events, and this until the ship approaches the American continent.

On July 17th, the ship reports being in the Gulf of Mexico, more precisely in the Bay of Campeche, North of the Mexican city of Coatzacoalcos, a position which it is still reporting at the time of writing (August 30th 2023), and which aligns with the investigation done by Geollect. Despite a reduction of the rate of position anomaly events triggered in Position Validation (59 in total for the period after July 17th), these events are the sole ones being triggered, and still place the ship in the Venezuelan EEZ.

The DELIVER’s reported route (green) vs calculated events (red), from July onwards

Validating a likely theory using AIS Position Validation

Only relying on reported AIS positions reported by a vessel leaves the door open for uncertainties and doubt, and makes it harder to pick between possible theories.

The Geollect report raised the suspicions around the vessel’s journey and, without AIS Position Validation, led to the emission of possible theories of what the vessel might have done while spoofing their location: heading to the sanctioned waters of Venezuela, loading oil before transferring it to a second ship or another port, or engaging in Ship to Ship (STS) transfers around the Cape Verde or Canary Islands, where an increase in tankers conducting STS transfers has been seen, facilitating the movement of Russian oil to Asia.

But using AIS Position Validation it is now possible to prove what the actual journey of the ship was, using the calculated position data of the DELIVER – engaging in the trade of sanctioned Venezuelan oil, following the pattern of other ships spoofing their AIS data to conceal their real location and escape sanctions. This is a behavior exhibited by the DELIVER from January 2023 onwards which can only be reliably validated using AIS Position Validation.