Maritime domain awareness: dark-vessel, AIS-spoofing & shadow-fleet detection

Vessels switch off or falsify their Automatic Identification System (AIS) to hide sanctions evasion, illegal fishing or loitering near cables. AI turns trajectory data into behaviour anomalies and cross-checks them against radar and optical satellite detections, so analysts see which ships are present but silent. The result is a ranked, evidence-backed watch list instead of manual chart reading.

Problem & value

• Today: authorities and compliance teams watch AIS pictures and port-state inspection lists. AIS is self-reported and can be switched off, spoofed (false positions, copied identities) or gapped near transfer zones. Coverage by satellite AIS is patchy, and manual review of thousands of gaps is infeasible.
• AI value: learned trajectory models separate ordinary gaps (poor coverage, equipment faults) from suspicious ones; vessel detection on SAR finds ships with no AIS match; graph analytics link identity changes, owners and flag hops.
• Why now: in January 2026 fourteen European coastal states warned that tankers without valid flag and documentation may be treated as stateless and seized, explicitly tying the problem to sanctions evasion [9]. Analysis of Global Fishing Watch data found AIS failures in the Baltic rose from a few hundred in 2022 to several thousand per year, with Russia-attributed ships showing long gaps far more often than European ones [2]. Commercial providers now add optical constellations to detect ships independent of AIS [3].
• No reliable public figure exists for detection precision across providers; always benchmark on your own area and period.

Variants

• Public authority (coast guard, navy, fisheries control): operates inside national/EU maritime surveillance; EMSA's integrated services (SafeSeaNet AIS, CleanSeaNet satellite radar) and the EU Common Information Sharing Environment (CISE) exchange data between authorities [4].
• Sanctions compliance (banks, traders, commodity buyers, P&I clubs): screen counterparties and cargo vessels; overlaps with ANOM-016.
• Maritime insurers and charterers: hull and cargo underwriting, voyage vetting.
• Illegal, unreported fishing (IUU) monitoring: fishing-effort and gap analysis, e.g. Global Fishing Watch.
• Critical undersea infrastructure protection: loitering and anchor-drag risk near cables and pipelines (Baltic, North Sea), operators and authorities.
• GNSS interference link: spoofing of position fixes is covered in ANOM-038; here the focus is the vessel's reported track.

How it works

1. AIS (terrestrial + satellite) ──► cleaning, de-duplication, track building SAR / optical / RF detections ──► vessel detection (CNN/transformer) ──┐ ▼ association: detection ↔ AIS track (probabilistic matching) ▼ behaviour features: gaps, speed/heading jumps, impossible positions, loitering, encounters (STS), port-call and draught changes, identity (MMSI/IMO/name) changes ▼ anomaly models (isolation forest / autoencoder / sequence models) + rules + graph risk ▼ risk score
2. analyst review (map + evidence)
3. tasking (tip-and-cue new imagery)
4. case / report

• Detection: object detectors on Sentinel-1 SAR (constant-false-alarm-rate classic detectors, now deep models) flag ships; those with no AIS within a time/space window are "dark".
• Spoofing detection: physics checks (speed over ground vs. position change), cross-checks with receiver geometry and with independent RF-geolocation, duplicated MMSI in two places.
• Entity resolution: graph and embedding methods link vessels renamed, re-flagged or using another ship's identity.
• Tip-and-cue: anomalies trigger tasking of higher-resolution imagery.
• LLM role: summarising evidence, adverse-media and registry lookups, drafting reports; never the detector.
• Human-in-the-loop: analysts confirm each case; any enforcement (boarding, listing, denial of cover) is a human decision.

Data preparation

Data include terrestrial and satellite AIS positions, vessel registries and ownership databases, port-call and sanctions lists, satellite imagery or SAR detections, and weather and route data. In an enterprise these arrive as vendor feeds or API subscriptions, in compliance spreadsheets, and in KYC or underwriting files; authorities add radar and intelligence sources.

Typical gaps: AIS gaps from coverage limits rather than intent, spoofed or duplicated identifiers (MMSI, IMO), inconsistent vessel names and ownership chains, unlabelled historic cases, and licensing limits on onward use of vendor data. Access rights for sensitive sources must be clear.

Preparation steps: inventory feeds and licences (PREP-001, PREP-005), deduplicate and resolve vessel identities, restructure compliance spreadsheets into tidy tables (PREP-011), define case categories such as gap, spoofing, ship-to-ship transfer (PREP-019), harvest labels from past investigations (PREP-020) and build evaluation sets with analysts (PREP-018). Tools: Python, geospatial databases such as PostGIS, entity-resolution libraries.

Rough share of effort: about 50 percent, dominated by entity resolution and licensing. See also DATA-003 and GUIDE-003.

Implementation paths

Which path for whom

• Enterprise (insurers, shipping and trading companies): Path A, because mature maritime-intelligence products with global AIS and satellite data exist and the feed cannot be rebuilt cheaply.
• Public (coast guards, authorities, ministries): Path B on sovereign EU or German cloud, combining licensed AIS feeds with own analytics and classified or restricted data kept in controlled environments.
• Developer: Path C, as open-source geospatial and graph tooling plus licensed or public AIS data allow building own detectors, though HW3 is needed at scale.

Path A — Buy (off-the-shelf)

• Maritime analytics platforms: Windward (Maritime AI), Kpler (MarineTraffic, with Airbus optical detection [3]), Spire Maritime, S&P Global Sea-web, Lloyd's List Intelligence, Pole Star (UK), Orbital EOS and Unseenlabs (France, RF detection; EU), ICEYE and Capella (SAR data), Airbus and Planet (optical), HawkEye 360 (RF geolocation), Starboard Maritime Intelligence. EU authorities typically obtain EMSA services at no cost [4].
• Choose A when: you are a compliance, insurance or authority team without remote-sensing engineers; check data licence, area coverage, evidence export and GDPR terms (see below).

Path B — Build on cloud APIs

• Data APIs: Global Fishing Watch APIs (events: gaps, encounters, loitering, port visits; vessel identity) for non-commercial use [5]; Copernicus Data Space for Sentinel-1/2 (EU); commercial AIS/SAR APIs from vendors above.
• Compute: EU-region cloud for anomaly pipelines; LLMs (Claude, Mistral, GPT, Gemini) for analyst copilots and report drafting with structured outputs.
• Choose B when: you have data engineers and need custom rules or integration with internal case management.

Path C — Self-host (open source)

• Stack: Apache Kafka/Flink or Spark for AIS streams, PostGIS or Apache Sedona, DuckDB/Parquet; scikit-learn/PyOD for anomaly models, PyTorch for sequence models; SNAP/ESA toolboxes and Sentinel-1 data for SAR; Neo4j or Memgraph for ownership graphs.
• Detection models: open solutions from the xView3 maritime detection challenge (SAR, dark-vessel focus) [6] and open object detectors (YOLO-family, DETR) fine-tuned on SAR; open data from Global Fishing Watch.
• Hardware: HW3 for SAR scene inference and sequence models; HW1 for AIS-only rules.
• Effort: a specialist team of several months.

Path D — Custom training

Worthwhile for agencies with own labelled detections and confirmed incidents: fine-tune SAR vessel detectors per sensor, train trajectory sequence models per sea area. Needs thousands of verified events; labels are scarce, so semi-supervised and synthetic-spoofing augmentation are typical.

State of the art (2026)

• Multi-sensor fusion (AIS + SAR + optical + RF) is the standard approach; the xView3 benchmark showed deep models detecting dark vessels in SAR at scale [6].
• Trajectory foundation models and self-supervised sequence models improve gap and spoofing classification over rule-only approaches.
• Commercial constellations (SAR and sub-2 m optical) shorten revisit times; tip-and-cue is operational at leading providers [3].
• Limits: SAR struggles with small or wooden vessels, rough sea and coastal clutter; revisit gaps mean a vessel can slip between passes; legitimate AIS gaps are frequent (satellite coverage holes, equipment faults, security reasons); regional GNSS jamming creates false spoofing alerts; labelled ground truth is scarce, so reported accuracies are hard to compare. Risk scores must be treated as leads, not proof.

Shared resources & combinations

• Imagery pipeline: shares remote-sensing and detection stacks with VIS-021 and VIS-051 (HW3 inference serving).
• Anomaly toolkit: time-series/trajectory models shared with ANOM-005 and ANOM-011.
• Combine with: ANOM-016 (sanctions and ownership screening of flagged vessels), ANOM-038 (GNSS spoofing as confounder), ANOM-011 (supplier and logistics risk), graph analytics for ownership networks.

Effort, cost & KPIs

• Path A: weeks to onboard; subscription pricing driven by area, data feeds and seats.
• Path B: 3–6 months; cost driven by satellite data licences and storage.
• Path C/D: 6–12+ months with specialists; imagery acquisition dominates cost.
• KPIs: precision of alerts confirmed by analysts, share of dark detections resolved, time from gap to alert, coverage/revisit time of watch areas, false-alarm rate per analyst-hour, number of cases leading to action.

People & change

Involve management for the risk appetite and sanctions policy, the compliance or operations lead as owner, analysts as end users, IT and IT security for feeds and restricted environments, legal and compliance for sanctions law, contractual and liability questions, and data providers (suppliers) for licences. The DPO is needed if crew or owner data are processed; vessel tracks alone are usually not personal data, but natural-person owners and crews are, so check legal basis and sign an AVV (Art. 28 GDPR).

Works council: no in the typical case, since the system analyses vessels, not employees' behaviour. If analysts' work is logged and evaluated individually, §87(1) no. 6 BetrVG would apply, and §90(1) no. 3 still requires timely information where work processes change. Authorities involve the staff council (Personalrat) where relevant.

Concerns: false positives can lead to wrongful accusations, blocked cargo or reputational damage. A flagged vessel is a lead, not proof: analysts review evidence, document decisions, and only authorised staff act. Pilot with one trade lane or one analyst team. Support AI literacy (Art. 4 AI Act) on gaps versus spoofing. See GUIDE-008, GUIDE-009 and GUIDE-014.

Risks, regulation & compliance

• EU AI Act: classification depends on the user. Pure commercial vessel screening is typically minimal risk. Use by law-enforcement or border-control authorities can fall under Annex III high-risk categories (e.g. migration/border management, law enforcement) with Art. 26 deployer duties; AI systems for military, defence and national-security purposes are excluded from scope (Art. 2(3)) [7]. No Art. 5 prohibition applies to vessel-behaviour analytics, but do not extend the system to biometric identification of crew or social-scoring-like profiling of persons, which Art. 5 restricts or prohibits.
• GDPR: vessel data is mostly not personal, but owner, master and crew names, sole-trader owners and leisure-boat MMSI can identify people; apply purpose limitation, minimisation and DPIA where individuals are profiled. Authority use may be under the Law Enforcement Directive (EU) 2016/680.
• Sanctions law: listing decisions rest on legal processes, not on model scores; false positives can harm innocent operators (wrongful denial of service).
• Dual use/export: high-resolution imagery and RF data may be export- or licence-controlled; observe licence terms.
• Mitigations: human review, evidence logs, documented thresholds, bias checks by flag/region, red-team tests for adversarial spoofing, no operational targeting detail in shared reports.

Getting started

1. Define the area of interest, the decision (screening, enforcement lead, underwriting) and acceptable false-alarm rate.
2. Pilot two Path A vendors on a historical period with known incidents (e.g. a Baltic corridor) and compare precision.
3. Prototype with open data: Global Fishing Watch gap events plus Sentinel-1 scenes [5].
4. Add entity resolution and sanctions screening (ANOM-016); define analyst workflow and evidence format.
5. Run a DPIA and, for authorities, an AI Act classification check before go-live.

Sources

1. heise online — Russian shadow fleet: AIS manipulation has doubled — https://www.heise.de/en/news/Russian-shadow-fleet-AIS-manipulation-has-doubled-11109330.html
2. Aalto University Waterways project note on AIS failures in the Baltic — https://waterways-stn.aalto.fi/?p=6098
3. gCaptain — Kpler expands dark fleet tracking with Airbus satellite deal — https://gcaptain.com/kpler-expands-dark-fleet-tracking-with-airbus-satellite-deal/
4. EMSA — maritime services FAQ (SafeSeaNet, CleanSeaNet, CISE) — https://www.emsa.europa.eu/csn-menu/csn-faq/172.html?start=20
5. Global Fishing Watch — APIs and data — https://globalfishingwatch.org/our-apis/
6. xView3 — dark vessel detection challenge — https://iuu.xview.us/
7. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
8. ESA Safer Maritime Services — https://business.esa.int/projects/sms
9. gCaptain — European nations issue warning to Russia-linked shadow fleet (joint statement of 14 states, 26 Jan 2026) — https://gcaptain.com/european-nations-issue-warning-to-russia-linked-shadow-fleet/