The global enforcement of maritime sanctions on petroleum exports, illicit armaments, and illicit commodities has sparked an unprecedented expansion of the so-called “Dark Fleet”—a sprawling armada of aging, flag-hopping, and uninsured supertankers operating beneath the threshold of international maritime transparency.

To conceal their voyages between sanctioned loading terminals in Russia, Iran, and Venezuela and importing refineries across Asia, these vessels systematically weaponize maritime electronics. They execute transponder blackouts, transmit synthetic spoofed coordinates generated by GPS circle generators, and conduct hazardous offshore Ship-to-Ship (STS) crude transfers in international waters.

Investigative researchers can pierce this veil of deception by cross-referencing radio telemetry with orbital radar observations. This field guide provides an end-to-end investigative framework for detecting Automatic Identification System (AIS) manipulation, calculating true vessel trajectories, and corroborating clandestine transfers using Synthetic Aperture Radar (SAR) and multispectral satellite sensors.

1. The Anatomy of Marine AIS Broadcasts

The Automatic Identification System (AIS) is an autonomous, continuous broadcast system mandated under the International Maritime Organization’s (IMO) SOLAS Convention (Regulation 19) for all commercial vessels over 300 gross tonnage.

                           MARITIME AIS FREQUENCY BANDS
                                        │
           ┌────────────────────────────┴────────────────────────────┐
           ▼                                                         ▼
     AIS 1 (161.975 MHz)                                       AIS 2 (162.025 MHz)
  • Marine VHF Channel 87B                                  • Marine VHF Channel 88B
  • Time Division Multiple Access (TDMA)                    • Line-of-Sight (~20–40 NM)
  • Satellite-AIS (S-AIS) Orbital Relay                     • Terrestrial-AIS (T-AIS) Coast Guard

Static vs. Dynamic AIS Packets

AIS transmissions operate via discrete burst packets containing two categories of intelligence:

1. Static Data (Transmitted Every 6 Minutes):
2. IMO Number: A permanent 7-digit identifier assigned to the vessel hull that remains unchanged throughout the ship’s lifespan, regardless of changes in flag, ownership, or ship name.
3. MMSI (Maritime Mobile Service Identity): A 9-digit digital callsign assigned by the current flag state administration.
4. Vessel Name, Dimensions, and Draught: Self-reported by the ship’s navigational bridge crew.
5. Dynamic Data (Transmitted Every 2 to 10 Seconds while Underway):
6. Latitude and Longitude derived from the bridge GPS/GNSS receiver.
7. Speed Over Ground (SOG) and Course Over Ground (COG).
8. Rate of Turn (ROT) and True Heading.
9. Navigational Status (e.g., Underway Using Engine, At Anchor, Not Under Command).

2. Common Evasion Tactics: From Transponder Gaps to Digital Spoofing

Dark fleet operators employ three escalating tiers of electronic obfuscation:

┌─────────────────────────┬─────────────────────────┬─────────────────────────┐
│     TIER 1: GAPS        │    TIER 2: IDENTITY     │    TIER 3: SPOOFING     │
│  Complete transponder   │  Cloning IMO/MMSI of    │  Synthesizing fake GPS  │
│  blackout during high-  │  legitimate ships or    │  coordinates in holding │
│  risk loading windows.  │  scrapped dry bulker.   │  areas (crop circles).  │
└─────────────────────────┴─────────────────────────┴─────────────────────────┘

The “Going Dark” Protocol

The most basic maneuver is turning off the AIS transponder switch before entering sensitive maritime exclusion zones or entering loading anchorages (e.g., Novorossiysk, Bandar Abbas, or Jose Terminal). The vessel vanishes from commercial marine tracking interfaces (MarineTraffic, VesselFinder) for 72 to 120 hours, subsequently re-emerging hundreds of miles away with an altered draught reading.

Digital Identity Swapping and Ghost Hulls

To evade vessel blacklists, operators purchase scrapped or inactive vessels and reprogram an active tanker’s AIS transponder with the identity of the scrapped ship. Two vessels may temporarily cruise in close proximity while one assumes the digital identity of the other, effectively cloaking the illicit ship’s movements.

GPS Coordinate Spoofing and “Crop Circles”

Modern sanctions evasion relies heavily on synthetic GNSS injection. Using commercial marine navigation spoofers, crew members feed fake NMEA 0183 GPS coordinate sentences directly into the AIS transponder. * The transponder broadcasts valid AIS packets indicating the ship is idling or drifting at anchor in safe international waters (e.g., off the coast of Greece or Fujairah). * In reality, the physical ship is 800 nautical miles away, loading millions of barrels of crude oil at a sanctioned berth. * The Spoofing Tell: Synthetically generated coordinates frequently exhibit unnatural mathematical precision—such as perfectly circular drift loops, mathematically impossible right-angle course corrections, or ground speeds that remain fixed down to three decimal places despite ocean tidal currents.

3. Detecting Manipulations: The Technical Methodology

Investigators expose AIS manipulation through physical consistency auditing and satellite cross-verification.

[AIS TRACK REPORT] ─────► [PHYSICAL IMPOSSIBILITY AUDIT] ─────► [RADAR SATELLITE AUDIT]
                                 • Draught change vs. cargo       • Sentinel-1 SAR pass
                                 • Speed > 35 knots               • Wake & length match
                                 • Perfect geometric drift

Step 1: The Draught Discrepancy Test

The single most reliable indicator of illicit crude loading during an AIS blackout is the vessel’s draught metric (the vertical distance between the waterline and the bottom of the hull):

$$\Delta \text{Draught} = \text{Draught}{\text{exit}} - \text{Draught}$$}

• Ballast Condition (Empty): A Very Large Crude Carrier (VLCC) riding empty in ballast typically draws between 8.5 to 11.0 meters of water. Its hull sits high above the water, exposing its red anti-fouling hull paint.
• Laden Condition (Full): When fully loaded with 2 million barrels of crude oil, the vessel sinks into the water column, increasing its draught to 20.5 to 22.0 meters.
• If a tanker enters a 5-day transponder dark zone with a reported draught of 9.2 meters and re-emerges broadcasting 21.4 meters, it physically loaded approximately 300,000 metric tons of cargo while “invisible.”

Step 2: Algorithmic Anomaly Detection

Auditing raw AIS CSV dumps with Python allows investigators to flag impossible navigational physics:

import pandas as pd
import numpy as np

def calculate_haversine(lat1, lon1, lat2, lon2):
    R = 6371.0 # Earth radius in kilometers
    dlat = np.radians(lat2 - lat1)
    dlon = np.radians(lon2 - lon1)
    a = np.sin(dlat/2)**2 + np.cos(np.radians(lat1)) * np.cos(np.radians(lat2)) * np.sin(dlon/2)**2
    return 2 * R * np.arcsin(np.sqrt(a))

def flag_impossible_speed(df):
    """Flags AIS transmissions where calculated velocity exceeds ship capabilities."""
    df['time'] = pd.to_datetime(df['timestamp'])
    df = df.sort_values('time')

    df['dist_km'] = calculate_haversine(df['lat'].shift(), df['lon'].shift(), df['lat'], df['lon'])
    df['hours'] = (df['time'] - df['time'].shift()).dt.total_seconds() / 3600.0
    df['calc_knots'] = (df['dist_km'] / df['hours']) * 0.539957 # KM/H to Knots

    # Commercial oil supertankers cannot physically exceed 18 knots
    anomalies = df[df['calc_knots'] > 22.0]
    return anomalies[['timestamp', 'mmsi', 'calc_knots', 'lat', 'lon']]

4. Uncovering Ship-to-Ship (STS) Transfers via Radar & Optics

Because supertankers carrying illicit oil are barred from offloading at regulated ports, they transfer cargo to intermediary vessels via offshore Ship-to-Ship (STS) transfers. These operations occur in remote maritime economic zones—such as the Gulf of Laconia, off the coast of Ceuta, or east of Singapore.

Corroborating Transfers with Synthetic Aperture Radar (SAR)

Unlike optical satellites, Sentinel-1 C-Band Synthetic Aperture Radar (SAR) penetrates cloud cover, fog, and nighttime darkness.

       SENTINEL-1 SAR ORBITAL RADAR BEAM
                     │
         ┌───────────┴───────────┐
         ▼                       ▼
    OPEN SEA WATER         METAL SHIP HULL
   Radar waves scatter    Corner reflection back
   away into space        directly to satellite
   [DARK PIXELS]          [EXTREMELY BRIGHT PIXELS]

1. Double Bright Return: When two supertankers moor alongside each other for an STS transfer, their massive steel hulls create a distinctive double-length or parallel rectangular radar echo.
2. Oil Slick / Wake Forensics: The turbulence of mooring tugs and continuous pumping generates calm surface tension zones or minor sheen slicks visible on SAR backscatter intensity images.
3. Ghost Verification: Compare the physical SAR bright-target coordinate against the global terrestrial AIS database for that exact timestamp. If Sentinel-1 detects two 300-meter vessels moored side-by-side, but AIS records show zero or only one ship broadcasting, an illicit ghost transfer is actively occurring.

Optical High-Resolution Corroboration

Once SAR coordinates confirm the location: * Task or search PlanetScope (3m resolution) or Sentinel-2 L2A (10m resolution) imagery. * Measure physical vessel dimensions (Length Overall, Beam) using optical measurement tools to confirm the ship class matches the suspected tanker hull. * Identify the presence of containment booms, pneumatic Yokohama fenders, and industrial cargo hose lines running across the decks between the two vessels.

5. Building the Evidentiary Chain for Sanctions Documentation

To present maritime tracking findings to regulatory bodies (OFAC, European Commission), insurance syndicates, or investigative publishers, researchers must compile an unassailable dossier:

1. Full IMO Registry Track: Historical ownership genealogy, documenting shell company ownership transfers, flags of convenience (e.g., Cook Islands, Gabon, Palau), and classification society changes.
2. Raw AIS NMEA Message Stream: Unedited receiver packet logs showing the exact millisecond timestamps of transponder termination and re-engagement.
3. Orbital Evidence Overlay: Georeferenced Sentinel-1 SAR and Sentinel-2 optical imagery tiles displaying the vessel at the unannounced coordinate with scale bars and metadata timestamps.
4. Hydraulic Draught Calculations: Mathematical proof of cargo mass intake based on waterline displacement curves.

By integrating open radio surveillance with orbital remote sensing, open-source researchers ensure that the oceans cannot be used as an unregulated corridor for illicit state enterprise.