The maritime world is likely entering an unprecedented period of deceptive shipping practices by tanker operators seeking to avoid sanctions. The recent announcement of a price cap on Russian crude—and a new ban on Western companies insuring Russian cargoes—sets the stage for an increase in clandestine activities by ocean vessels, The Financial Times explains. Not only does this intentional deception provide cover for possibly illegal activity: The misuse of Automated Identification System (AIS) collision avoidance signals jeopardizes safety at sea by ratcheting up the risk of collisions, oil spills, and other serious accidents.

Over the past year work by the research team at Global Fishing Watch (GFW), an international nonprofit organization dedicated to advancing ocean governance through increased transparency of human activity at sea, has found position falsification by tankers carrying Venezuelan crude. (GFW supported the work outlined in this report.) Previous investigations by SkyTruth also have documented cases of manipulation of AIS positions.

A few months ago the GFW research team started investigating the unusual track of a tanker operating in the Black Sea and the Mediterranean. It would prove to be the first detection ever of a Russian-flagged tanker broadcasting false coordinates—and it may be the first of many.

Analysis of the broadcast AIS positions from the tanker KAPITAN SCHEMILKIN since the beginning of 2022—and correlation with satellite imagery—identifies two distinct periods when the vessel was broadcasting false positions. Identification of the false positions is based on the vessel being repeatedly not detected by satellite radar imagery at the times and locations suggested by its AIS broadcasts, as well as a reported AIS track that does not reflect the movement of a real vessel.

We have reconstructed the true movements of the tanker with high confidence thanks to some surprising behavior: The tanker continued to broadcast its real destinations (Malta and Northern Cyprus) and estimated times of arrival (ETA) while simultaneously broadcasting false coordinate positions. Additionally, the tanker could be picked out at these broadcast destination locations with Planet imagery, including weeks at an anchorage offshore of Malta and likely fuel delivery on August 19 and 20 at the Teknecik Power Plant in Northern Cyprus. The sighting in Cyprus occurred at a time when local press was alleging irregularities and manipulation related to persistent power outages and the renewal of contract for supplying the power plant.

Detection of False AIS Positions

The KAPITAN SCHEMILKIN, a 138m tanker, is required by International Maritime Organization (IMO) regulations to continuously broadcast its position via AIS. A tanker of this size is also quite distinct on satellite radar imagery acquired by the European Space Agency’s Sentinel-1 (S1) satellites. In European waters, S1 imagery is captured with high revisit frequency—the time interval between images of the same location—here typically every 2–5 days. Global Fishing Watch recently completed the processing of the S1 image archive to extract all vessel positions appearing in these radar images. Automated correlation of AIS positions and S1-detected vessel locations serves as a new and powerful tool for verifying that vessels are broadcasting real positions. This is particularly true for large vessels like the KAPITAN SCHEMILKIN, which we estimate would be detected on a S1 radar image more than 95% of the time.

When we ran an automated correlation of AIS from the KAPITAN SCHEMILKIN and S1 scenes we found that the tanker should have appeared in 36 S1 scenes from January–August 2022; however, the tanker appears in only 28 of the scenes. The vessel is missing in seven scenes from June 6–July 12, 2022 and from one scene on August 21, 2022.

Sentinel-1 scenes were examined individually to confirm that the tanker was not missing due to any problem with imagery (other nearby vessels of similar size were appearing normally). We also checked additional optical imagery sources, which confirmed the pattern seen with S1: the tanker disappears for a long period in June and July and for a shorter period later in August.

Looking in more detail at the broadcast AIS track around these periods, we can see precisely when the vessel begins to broadcast false positions, based on several broadcast characteristics not consistent with transmission of real AIS positions.

We assess that false AIS positions were broadcast during the time ranges below:

In both cases, the vessel broadcast positions showing a transit to an area of Greek waters where the vessel can then be seen making irregular circles at low speed. Circling patterns have been previously documented with false AIS tracks; however, whoever was responsible for this track made some efforts to make it look realistic. For example, the circles do not exactly repeat and there is greater variation in speed.

Evidence for real vessel locations

1. Satellite reception footprints. We can roughly estimate a vessel’s true location based on the intersection of the reception footprints of the satellites picking up the AIS positions. Analyses of the receiving satellite locations during the May 28–July 12 spoofing period showed that the vessel was further west in the Mediterranean than indicated by AIS.

2. Locations of vessels of similar size not matched to an AIS broadcast. A query of the GFW database for vessels of similar size—which were detected by Sentinel-1 but were not broadcasting AIS—identified 17 vessel detections in this region during the time range of the false positions. By reviewing the locations individually and checking optical imagery from Planet, we discovered one case of a vessel matching the characteristics of the KAPITAN SCHEMILKIN east of Malta.

However, it would be speculative to confirm the ship’s identity and locations based solely on the measured vessel length and visual characteristics apparent on Planet imagery.

3. Broadcast destinations and ETAs from AIS. Surprisingly, as the vessel broadcast false coordinate positions, they continued to update the destination and ETA fields of their AIS broadcast with accurate information. For example, while broadcasting circling positions southwest of Greece the tanker updated its destination to Valletta (capital of Malta) and then Outer Port Limits Malta (OPL MT) with an ETA of 5300800 (May 30 at 8:00 UTC). We identified a vessel matching the tanker’s characteristics on Planet imagery at an anchorage site west of Malta between June 8–July 9, 2022. The likely location of the tanker earlier in June has not yet been determined. It is possible they anchored elsewhere or went to a dock somewhere in Malta.

Similarly, later in August while the vessel was broadcasting circling positions east of Crete, someone on the tanker updated its destination to TECNECIK with an ETA of 8180000 and then 8191200 (Aug 19, 2022 at 12:00 UTC). A vessel matching the characteristics of the tanker can be seen at the Teknecik power plant in Northern Cyprus on August 19 and 20.

We were surprised that the vessel would both be broadcasting false coordinate positions and updating a destination field that apparently gave away its real location. It is possible that different crew members—who were not in communication—took these steps separately.The KAPITAN SCHEMILKIN appears at the mooring site for the Teknecik power plant on August 19, 2022. This is likely shortly after the vessel arrived. A tug (SONDUREN 10) appears beside the tanker and can be identified with AIS.High-resolution imagery from Maxar shows more details of this mooring position with a tanker at this location in 2020. Note the two fixed positions that the tanker is tied up to which are also faintly visible in the Planet image. This is an established location for offshore fuel delivery and not just an anchorage.

Likely real vessel positions, based on Planet imagery during the times when the tanker broadcast false positions, are listed below. Planet imagery alone does not provide enough detail to definitively identify the vessel; however, the tanker’s own broadcast destinations—coupled with the fact that the vessel appearing on imagery was not associated with an AIS broadcast (at least not one at the position where the vessel appears)—supports the conclusion that these were the real locations of the KAPITAN SCHEMILKIN.

The false location data broadcast by the KAPITAN SCHEMILKIN shows the critical importance of developing robust automated systems for detecting and flagging the deceptive use of AIS. As the world reacts with horror to the war in Ukraine, governments have taken decisive action to try and limit the sale of crude oil financing the war. However, these measures will be ineffective if AIS falsification goes undetected.

Fortunately, we have demonstrated that false positions can be readily detected with data methods currently available. We hope that increased automation of these methods will soon mean that any vessel falsifying their position will only end up shining a spotlight on their illegal activity.