AIS: going dark, spoofing, and why a gap is not proof

What AIS is actually for

The Automatic Identification System is a VHF radio broadcast that lets ships see each other. A transponder repeats the vessel’s identity, position, course and speed every few seconds so that a watch officer, or a shore station, knows what is nearby. It exists because collisions kill people.

It was never designed as an enforcement tool. Three consequences follow, and most reporting errors about “dark” ships come from ignoring them.

The data is self-reported. The transponder broadcasts what it is told to broadcast. There is no authentication, no signature and no external verification in the protocol.

The signal is not always received. Terrestrial receivers reach perhaps forty nautical miles. Satellites cover the rest, imperfectly: in busy areas, many transmissions collide and are lost, and coverage over some ocean regions is thinner than others.

What you see is a reconstruction. Commercial platforms stitch terrestrial and satellite feeds together and interpolate. A neat line across an ocean is a drawing, not a recording.

What the rules require

SOLAS requires AIS on most ships above 300 gross tons on international voyages, and requires it to be operated at all times. There is an exception: where international agreements or standards provide for protecting navigational information, and where the master judges that continued operation would compromise the ship’s safety, it may be switched off. The decision is supposed to be recorded.

That exception is real and it matters. Ships in piracy-prone waters have legitimately gone quiet for years. Reading every gap as evasion is wrong on the law and wrong on the sea.

The three behaviours people conflate

Going dark means the transponder stops broadcasting. Causes range from equipment failure and power problems, through coverage limits, to a deliberate switch-off.

Spoofing means broadcasting false data. That can be a fabricated position, or the identity of another vessel entirely. Spoofing is qualitatively different from going dark: it is an affirmative false statement, and it is much harder to explain innocently.

Identity confusion is the quiet one. The MMSI is assigned by the flag state and changes with the flag. Two vessels can end up broadcasting the same identity through error rather than intent, and a hull that has just reflagged may broadcast an identity that does not match any current record.

Why gaps are not proof

An analyst sees an absence of data. An absence has many causes, and the evidential value depends entirely on ruling them out. What raises a gap above noise is a pattern: repeated disappearances, of unusual length, in areas associated with transfers at sea, by a vessel that has other risk indicators around it.

That is why official advisories describe transponder gaps as an indicator to investigate rather than a finding. The 2020 joint US advisory lists them among deceptive practices while recommending that industry ask for an explanation and keep the answer. The Price Cap Coalition advisories take the same approach.

The IMO’s shadow-fleet resolution treats manipulation of transponders as a safety problem first: a ship that is invisible to other ships is a hazard to them, whatever the cargo.

What this site does and does not do

There are no positions on this site. No tracks, no last-known location, no map of where a tanker is now.

That is a deliberate choice. Publishing a live or recent position for a specific hull helps two audiences equally: people trying to enforce sanctions, and people trying to intercept, board or attack a vessel with a crew aboard. The sanctions record is the useful, non-operational half of the picture, and it is the half this site keeps.

If behaviour signals are added later they will be aggregate and historical, drawn from a permitted API, with the caveats in this article attached to them.

For journalists

Three questions before publishing anything based on a gap.

Where did the data come from, and does that provider distinguish “no signal received” from “vessel switched off”? Most cannot.

How long is the gap relative to the vessel’s normal pattern and the coverage in that area? A day in the middle of the Indian Ocean is different from a day off Rotterdam.

Is there a second source? Imagery, port records, a cargo document or a physical sighting turns an absence into a fact.

The linked advisories are the safest ground to stand on: they let you write that a practice is one an authority has identified as a risk indicator, which is true, rather than that a specific gap proves a specific breach, which usually is not.