Systematic data analysis reveals false vessel tracks

Featured image for Bjorn Bergman's July 2021 false AIS post

From SkyTruth by Bjorn Bergman

Analysis of tracking data from Automatic Identification System broadcasts reveals vessel locations have been simulated for a number of ships, including military vessels.
This false information could compromise vessel safety, decrease confidence in a crucial collision avoidance system and potentially spark international conflict.

Over the years, data analysts working with Global Fishing Watch and SkyTruth have noticed a number of ship tracks coming up in impossible locations—in transit over Antarctica, circling in the Utah desert and elsewhere—and we have questioned whether these false positions resulted from faulty Automatic Identification System (AIS) transmitters, deliberate misuse of those transmitters, or from intentional third party interference.
AIS is the international system of vessel radio broadcasts used to identify vessel locations and help prevent collisions at sea.
We have learned how to interpret anomalies in AIS data and, even when the ship coordinates were wrong, we never had reason to doubt that these vessels were on the water broadcasting AIS.
In most cases, we are also able to identify the true position of the vessel.

Recently, I came across a new category of false AIS ship positions.
In past cases, we observed vessels on the water that were broadcasting positions that corresponded to an area other than the true location of the vessel.
In these new examples, however, AIS tracks were present where vessels appear not to have been actually broadcasting AIS at all.
Unlike some obviously false tracks appearing on land, these tracks appear extremely plausible—at first glance indistinguishable from real AIS positions.
This new type of simulated AIS tracks represents a significant threat to data integrity and underlines the need for vigilance when interpreting AIS data.

Simulated sailboat races: First large-scale case of falsification

I first noticed these false AIS tracks in groups of sailboats which appeared hundreds of miles out in the Atlantic Ocean even though shore-based AIS antennas appeared to receive their positions.
Since a typical range for a terrestrial antenna is at most about 60 miles, I knew something was wrong with these positions.
When I searched for more information on the identities of these vessels I found that they were featured on a website running simulated sailing races.
Whoever was setting up the races not only simulated realistic AIS positions for each of the participants, but then fed these made up positions into a public AIS site — sites like AISHub receive ship positions from contributors — so that the sailboat positions appeared on these sites alongside real vessel traffic.
While this false data would be unlikely to interfere with real-time navigation (the very high frequency radio broadcasts which relay AIS information between nearby vessels were not affected) the data gathered on these sites is passed on to other data providers and subscription services used for marine monitoring and analysis.
Made-up sailboats may seem harmless enough, but many professionals count on AIS as the most comprehensive and reliable data source for monitoring and analyzing activity at sea.
If these sailboat tracks could be so realistically faked, what about false data for more significant targets?

False AIS positions show tracks crossing the Atlantic Ocean from one of several simulated sailing races in 2019 and 2020.
Image copyright SkyTruth and Global Fishing Watch 2021.
AIS data courtesy of Global Fishing Watch/Orbcomm/Spire.

False tracks from military vessels

Our recent investigation into a second group of false AIS tracks has shown that these concerns were very much warranted.
I was alerted to this case when an article in Dagens Nyheter, a Swedish news outlet, was shared with me.
Nine Swedish Navy vessels appeared on AIS as if out on maneuvers.
In the news story, the Swedish Navy confirmed that these positions were false and mentioned additional false positions in the Baltic Sea, specifically near the Russian enclave of Kaliningrad.

Nine Swedish naval vessels appeared as if out on maneuvers on February 4 and 5, 2021 while navy officials confirmed that these AIS positions were false.
Image copyright SkyTruth and Global Fishing Watch 2021.
AIS data courtesy of Global Fishing Watch/Orbcomm/Spire.

Working with data from AIS providers Orbcomm and Spire, I was able to identify the nine Swedish naval vessels appearing south of Karlskrona with false positions on February 4 and 5, 2021.
Initially these false positions appeared indistinguishable from legitimate AIS broadcasts.
AIS follows a complex protocol allowing different vessels to coordinate and relay positions to one another.
The system actually exchanges an abundance of information beyond the basic location, course, speed and vessel identification which appear on the plotter of a nearby vessel.
I was able to take advantage of the full complexity of AIS communication to identify a pattern specific to the false simulated AIS positions.
From there, I wrote an automated computer query of our global AIS database to identify other vessels with this same pattern of AIS broadcast.

The results were alarming.
Nearly a hundred U.S. and European naval vessels had track segments with the same AIS pattern as the false tracks of the Swedish navy ships near Karlskrona.
Over the past few months I dug into this data using all available sources to confirm vessel locations and identities.
I confirmed false AIS positions for 15 navy vessels from seven countries, with many more vessels suspected of having fabricated positions.

AIS use by naval vessels

While the use of AIS is mandated for most large vessels on international voyages, military vessels have never been expected to broadcast their location.
Nevertheless, many warships broadcast AIS when making their position known presents no threat to the vessel or mission, such as during exercises, on innocent passages, in shipping lanes, or when entering or exiting port.
After two high-profile collisions occurred in 2017, U.S. Navy policy has shifted towards using AIS in areas of high vessel traffic.
However, even when using AIS, naval vessels do not typically broadcast specific identifiers such as name, call sign, or International Maritime Organization number.
Instead they appear with a generic designation such as Netherlands Warship.
Fortunately, it is also possible to identify and track vessels over time using the identification number tied to each vessel’s AIS broadcast, the Maritime Mobile Service Identity, or MMSI number.

This MMSI number is usually unique to a single vessel and typically doesn’t change unless the vessel is reflagged.
Most of the naval vessels I investigated did appear to use a particular MMSI number consistently even if the vessel only broadcast AIS occasionally.
The MMSI numbers used by different naval vessels are listed on sites like MarineTraffic or even Wikipedia.
But how can we really be sure that an MMSI number corresponds to a particular naval vessel? Naval vessels are frequently photographed, and it’s possible to get a sequence of port visits based on photos uploaded to sites like warshipcam.com.
This documented series of port visits can then be compared to the AIS track to confirm that an MMSI corresponds to a particular vessel.

Satellite imagery confirms false tracks

Once I was confident that there was some reliable AIS tracking information for naval vessels, I wanted to determine if the suspected false positions could be confirmed and isolated from the real AIS broadcasts.
How can we determine if an AIS broadcast is real, particularly if it’s out at sea where reported sightings of the vessel are unlikely? In fact we can do this very precisely by matching the AIS track to satellite imagery coinciding in time.
So if the vessel is really broadcasting its actual position, it will appear on a satellite image coinciding with its AIS track.

Two sources of open satellite imagery work very well for matching to AIS, Sentinel-1 (S1) synthetic aperture radar (SAR) and Sentinel-2 (S2) optical imagery from the European Space Agency (ESA).
S1 SAR is acquired with very high frequency over Europe — any given location is imaged approximately every other day and has the advantage of penetrating clouds.
Though rough seas can affect SAR, S1 reliably picks up vessels over 50 meters in length, like the naval vessels investigated here.
S2 optical imagery with 10-meter resolution is acquired less frequently and can be blocked by clouds but shows more detail.

I matched S1 and S2 imagery to tracks of 15 naval vessels with AIS patterns sharing characteristics identified in the false positions of the Swedish vessels near Karlskrona.
These 15 examples, which I was able to confirm with comparison to imagery, represent just a fraction of the nearly 100 naval vessels with suspected false AIS tracks identified by my algorithm between August 27, 2020 and July 15, 2021.
Most of the tracks appeared in the Baltic Sea or other northern European waters, but I have also found several recent examples in the Black Sea.
Ships with AIS matching the pattern of the Swedish vessels were nearly all naval vessels, and the AIS positions in the suspected false tracks were received only by terrestrial AIS antennas, not by satellite.
Typical of naval vessels, they used AIS intermittently and primarily when entering port or transiting through congested areas.
Many of the vessels had tracks that were a mix of normal, apparently legitimate, AIS positions and positions flagged as potentially false by my algorithm.

In each case in which my algorithm indicated the false AIS pattern, no corresponding vessel was visible on the satellite imagery.
I also checked for these same vessels during periods when they were broadcasting normal AIS tracks and in all instances a vessel could be seen on the satellite image matching the location indicated by the AIS broadcast.

I describe two examples below.

U.S. survey vessel USNS Bruce C. Heezen transiting into Baltic Sea, September 2020

AIS data shows this vessel transiting through the North Sea and entering the Baltic Sea between September 17 through 23, 2020.
However, the positions broadcast on those dates match the false AIS pattern, and I have additional evidence that this AIS track did not show the actual location of the vessel.

I matched the supposed vessel position on September 18 to radar imagery from ESA’s Sentinel-1 satellite.
No vessel is present, though the 100-meter Bruce Heezen is large enough that we would expect to have no difficulty in detecting it; in fact two much smaller Norwegian fishing trawlers are plainly visible nearby.

The false AIS track shows the vessel entering the Baltic Sea on September 23, 2020.
However we have what I believe is a real AIS position—one that does not follow the false AIS pattern—from the vessel on September 27 near the coast of Virginia prior to docking at Norfolk.
The vessel could not travel from the Baltic Sea to the U.S.
East Coast in only four days.

British Aircraft carrier HMS Queen Elizabeth on the Irish coast with accompanying flotilla of British, Dutch, and Belgian warships, September 2020

AIS from September 17, 2020, shows a surprising international naval flotilla accompanying the British aircraft carrier HMS Queen Elizabeth about 20 miles out from the coast of Ireland.
In addition to the 283-meter Queen Elizabeth, AIS shows the British HMS Duncan (152 meters) and HMS Albion (176 meters) as well as the Dutch HNLMS Rotterdam (163 meters), the HNLMS Johan de Witt (176 meters) and the Belgian BNS Leopold I (122 meters).
This flotilla of massive warships should have made quite a striking picture on Sentinel-2 satellite imagery.
However, the image coinciding with the AIS transit dates, seen below, shows none of the six naval vessels.
Furthermore, several publicly posted photos and news articles show that these vessels were in port elsewhere at the time.

False AIS tracks of six naval vessels from the United Kingdom, the Netherlands, and Belgium overlayed on a S2 satellite image of the same day, revealing that none of the vessels were actually present at the time of S2 image acquisition.
Expected locations for each vessel based on AIS are marked with an X.
Image copyright SkyTruth and Global Fishing Watch 2021.
AIS data courtesy of Global Fishing Watch/Orbcomm/Spire.

Likely wider pattern of AIS falsification for naval vessels

I believe that these confirmed cases of false location data reflect a wider pattern of AIS falsification for naval vessels.
In many cases, the times of AIS track segments matching the false position pattern did not coincide with S1 or S2 imagery so we could not confirm whether a vessel was present.
However, some of the tracks are very unlikely.
For instance, positions from one U.S.
vessel, the destroyer USS Roosevelt, appear four nautical miles within Russian territorial waters near Kaliningrad.
While not illegal, entry by a U.S. warship into Russian territorial waters would likely have provoked a reaction and news coverage, similar to the major confrontation that resulted from the recent transit of the British destroyer HMS Defender through the territorial waters around Russian-occupied Crimea.

AIS positions from the USS Roosevelt showed the false data pattern specifically on November 26, 2020.
On that day the vessel appears to enter four nautical miles within the Russian territorial sea.
Because of the short duration, no imagery was available to compare with the track.
Image copyright SkyTruth and Global Fishing Watch 2021.
AIS data courtesy of Global Fishing Watch/Orbcomm/Spire.

Source of false AIS data

These examples show the wide scope and potential seriousness of the false naval vessel positions in AIS tracking data.
It’s unclear how the false positions get combined with real data from terrestrial AIS antennas, though one can hypothesize that they could be produced by an AIS simulator program similar to that used to produce the tracks in the simulated sailing races.
While I initially thought the false data might be entering the data feed from a single terrestrial AIS station, it appears that false AIS positions were reported at a number of different terrestrial stations.

Some of these terrestrial stations appear to be picking up AIS positions when vessels are too far away.
For example, a suspected false position near Kiel, Germany was picked up by a receiver in Gdynia, Poland more than 300 miles away and outside of normal terrestrial antenna range.
However in other cases, false positions were picked up by nearby receivers.
Further information linking individual AIS positions to particular receiving antennas could allow us to understand more about where the positions are coming from.

Possible motives for data falsification

It’s clear that considerable care was taken to produce plausible tracks.
For example, false AIS segments mostly appear only in those locations where naval vessels would be expected to broadcast AIS (near port and in other congested areas).
Confirmed and suspected false AIS segments show incursions by 11 North Atlantic Treaty Organization (NATO) and NATO allied warships into Russian territorial waters near Kaliningrad and Murmansk as well as within the disputed territorial waters around Crimea in the Black Sea.
Suspected false tracks from June 2021 also show two Russian warships entering the territorial waters of Ukraine and Poland.
Other false AIS tracks are more subtle.
These could be a test of the ability to produce and pass off realistic false vessel positions or simply intended to create distrust and confusion among those using tracking information from public AIS sites.

Serious potential consequences of AIS falsification demonstrated by spoofing of naval vessels in the Black Sea

A recent incident in the Black Sea shows how uncomfortably close we are to a scenario where a false AIS track is used to show an aggressive action by a naval vessel that did not really occur.
From June 18 to 19, 2021, the British destroyer HMS Defender and Dutch frigate HNLMS Evertsen could be seen at dock in Odessa, Ukraine.
However, on those same dates, AIS showed the vessels leaving port and going to a naval base in Sevastopol in Russian-occupied Crimea.
Again, these false AIS positions showed a distinct pattern similar to what was seen in the Baltic, allowing them to be clearly distinguished from the vessel’s real AIS broadcasts.
False AIS tracks such as these could be used to create a false narrative or even justification for an attack on a vessel or other military action.

Actual (yellow) and spoofed (red) AIS positions for the HMS Defender.
A false transit from Odessa, Ukraine, to Sevastopol in Russian-occupied Crimea can be seen on June 18 and 19, 2021.
A few days later (June 23, 2021) the vessel really did leave Odessa, transiting through the contested waters around Crimea (yellow track).
A gap appears where the vessel did not broadcast AIS continuously.
Image copyright SkyTruth and Global Fishing Watch 2021.
AIS data courtesy of Global Fishing Watch/Orbcomm/Spire.

Although this attempt at disinformation was easily refuted by witnesses and a live webcam in Odessa, a far more delicate situation unfolded a few days later when the HMS Defender really did leave Odessa and transit through Russian claimed waters.
The HMS Defender broadcast AIS during the transit past Crimea that showed the vessel entering disputed territorial waters that extend 12 nautical miles from shore.
The vessel entered only about 1.8 nautical miles inside territorial waters and maintained a normal transit course under “innocent passage.” Russian forces claim to have responded with warning shots and dropping live bombs in the path of the vessel.
The HMS Defender proceeded normally, exiting the waters around Crimea and continuing to Georgia.

The situation could have been worse had the HMS Defender not been broadcasting AIS.
In that case, a false AIS track could easily have shown the HMS Defender closer to shore or engaging in threatening maneuvers.
In fact it is likely that the HMS Defender was using AIS to demonstrate “innocent passage,” which permits a foreign warship to pass through territorial waters “continuously and expeditiously” and without any military events such as flying of helicopters or weapon training.

The potential dangers of misinformation stemming from false data was further demonstrated by AIS tracks in the Black Sea that showed incursions into territorial waters, or into the disputed waters around Crimea—both of which are unlikely to have taken place without coverage in the news.
These include an apparent passage of the Kerch Strait by the USS Laboon even though Russia has closed the strait to warships and an apparent incursion by a Russian warship into Ukraine’s territorial waters near Odessa.

A number of AIS vessel tracks have recently appeared in the Black Sea which the algorithm identifies as matching the pattern of false positions previously identified in the Baltic Sea.
The locations of these tracks within territorial waters makes it unlikely that the vessels could have been present without causing an international incident and news coverage.
The Russian warship Pavel Derzhavin (green) appears to enter Ukraine’s territorial sea on June 20, 2021 near Odessa.
The Italian ITS Virginio Fasan (orange) appears to make a transit through disputed waters around Crimea on July 2, 2021.
AIS showed two other tracks along with the Virginio Fasan—the Bulgarian BGS Bodri and the British HMS Trent.
AIS tracks from the Bodri and Trent also matched the false data pattern.
On June 17, 2021 the United States USS Laboon (red) made an apparent transit north through the Kerch Strait.
This strait has been closed to foreign warships by Russia.
Image copyright SkyTruth and Global Fishing Watch 2021.
AIS data courtesy of Global Fishing Watch/Orbcomm/Spire.

Systematic data analysis can safeguard AIS data integrity

AIS has been a game changer by offering the most comprehensive and detailed data set on activity at sea and enabling better information for marine conservation, vessel tracking and maritime security.

Over the past few years major strides have been made in automating the classification of AIS tracks to detect particular activities like rendezvous at sea or distinct movement patterns used by different types of fishing gear.
Likewise, by collating and linking in information from established vessel registries, it has been possible to establish clear identities for many vessels with incomplete or inconsistent identification on AIS who may be seeking to obscure their identity for illicit reasons.
Additionally, AIS providers are adding safeguards to their systems and analysts are increasingly adept at recognizing anomalies and accounting for them.

Fortunately, these false tracks could be readily identified with the same systematic data analysis tools which have made it possible to pull increasingly detailed information from the global AIS dataset to inform researchers about activity at sea.

The openness and accessibility of AIS has made possible innovative uses of the data.
But this accessibility also makes the system vulnerable to manipulation which, if not detected, could support false narratives about vessel movements that cause confusion and potentially could even spark an international incident.

Ultimately, AIS is a critical collision-avoidance system relied upon by thousands of mariners, and while these manipulations don’t directly compromise on-the-water collision avoidance, they may compromise trust in the AIS system.
Data from AIS has also become a critical source for applications monitoring the environmental effects of activity at sea.
The false vessel tracks we’ve uncovered make clear the need for implementing effective tools and strategies to safeguard AIS reliability.

Links :

• GeoGarage blog : AIS Mystery: 12 ships appear to cross ... / Understanding GPS spoofing in shipping ...  / Ghost ships, crop circles, and soft gold: A ... / Mass GPS spoofing attack in Black Sea? / Chinese GPS spoofing circles could hide ...