> AIS can only be turned off in rare circumstances
This is SOLAS convention which has no enforcement offshore. Within the navigable waters of the US and up to 12 miles offshore, there is enforcement [1]. But elsewhere, there are plenty of reasons to turn AIS off [2].
The US Navy generally operates with AIS off, although they've started to broadcast AIS reports in high traffic areas [3]. Private boats can turn AIS off at will in international waters [4]. It's also possible to spoof AIS reports [6]. Then there's avoiding piracy in Gulf of Aden or Strait of Malacca.
I am personally aware of many commercial vessels that turn off their AIS to avoid leaking information to local government and competitors. My experience is limited to the U.S. Atlantic and Gulf coasts and the Caribbean.
Ok that is pretty amazing. I followed the link to the repo of tools and it’s crazy that not only can you use automation to track and identify ships but also look up their cargo manifests.
The visualization is beautiful but the time scale is too large and the maps too zoomed in to identify much in the way of patterns.
"Unlike ADS-B in a plane, AIS can only be turned off in rare circumstances."
AIS can and does get turned off all the time. Different countries have different laws on this, so you will see very different patterns on where AIS goes dark. Sometimes vessels will turn off their AIS as soon as they leave some EEZ for international waters, sometimes they just turn it off if there's little risk of getting caught. As the article says, AIS is primarily used for safety measures - and is what it was designed for. But most developed countries have since started to use AIS for maritime surveillance, and have in the later years codified in laws / regulated how vessels of certain size must use their AIS transponders. VMS, which has a much greater capability in sending out data (catch logs, for example), has become more and more common.
It is also difficult to know whether or not a ship deliberately turns off its AIS transponder, or if it is in an area with poor coverage. AIS data is collected via satellites and land based antennas - some data providers also provide signal strength to give a clue. When presenting AIS data in court, we never, ever say that a vessel has turn off their AIS transponders - only present the data and some probabilities.
Bogus AIS tracks is a massive, massive problem. I frequently analyze areas where as much as 100% of the "traffic" turns out to be junk. They _can_ be pretty easy to filter out if there is some pattern of randomness, and a lot of the junk is just that - the AIS messages are just scattered uniformly around the globe, leading to impossible speeds. 99% of junk tracks are either registered as Chinese, or some micro-nations with little to no maritime activity.
Spoofing is also a problem. In my work, we've been analyzing the Russian tanker movement closely for a couple of years now, and some of the spoofing has been really sloppy - so sloppy that the public quickly noticed. This is my favorite, because it was so low effort: https://gcaptain.com/blink-and-youll-miss-it-russia-deploys-...
(if you look at the data, you'll see that they just spoofed the AIS messages with a constant speed for two week straight, going through the exact same positions multiple times).
With that said, the average of the data gives you nice patterns. There's a ton of variance due to all the fake data, missing data, faulty data, etc. - so in a day-to-day job a lot of your work is to figure out whether or not the dataset is a valid one.
I'm trying to understand what bogus AIS tracks means - are you saying these are AIS messages injected into the network somehow, or actual AIS radio signals that somehow ended up transmitted from the wrong place?
I'm assuming the former, which sounds more like an authentication problem?
Let's perform a search for vessels that have been inside some search box / geometry in the past 72 hours. In this case I'll do a search south of Africa. The search area looks like this:
1) As you can see from the list with vessels, some of the rows only have a MMSI number - nothing more. A MMSI number is not static/constant, whereas an IMO number is - think of the IMO number as the VIN number of a vessels, it will following the ship from build to scrapping.
So a big problem is that we're not just looking at one track, but every AIS message that has that MMSI number associated. And generating those can be trivial.
Anyone with some AIS transponder can send out AIS messages with some MMSI number can achieve that
2) Because these AIS messages are being spammed at random, they will still appear in geometry / area searches. Usually just as one point / message, but you still have to filter them out.
Now, with that said, junk like that is easier to spot - because they usually do not have much more data than some MMSI, and maybe a flag state.
Nice, thanks for sharing such a complete example. So I take it there isn't really any kind of verification of AIS message validity. I suppose that would be difficult to do, so it makes sense that AIS would be easy to spam.
What's the motivation for the bogus data? Just adding noise to obscure real vessel activity?
Similarly, the entire AIS tracking system needs a layer of authentication. I ran an AIS station for several years that fed data to Marinetraffic, and I could have stuffed whatever data I wanted into their database with no apparent restrictions or checks.
Some people just want to see the world burn. Vandals and trolls basically. IIRC there have been multiple incidents of people spoofing genitalia shaped tracks (on top of an even larger multitude of actual pilots steering air and water craft to draw genitalia). Easy enough to do, all you need is a transmitter (which are getting very cheap these days thankfully) and something that can output a stream of fake GPS positions in NMEA format on a serial port.
Others run broken or misconfigured equipment and either don't know, don't care or do it intentionally with plausible deniability (Chinese ships in non-China waters stealing fish are a huge problem [1]).
At least a lot of the dumbasses and breakages can actually be filtered - AIS Class A transmitters on large ships can reach up to 100km, AIS Class B transmitters (everyone else) about 40km, ADS-B on aircraft about 500km. That means even as a solo operator of an AIS/ADS receiver, you can safely discard anything more than these distances away from your coordinates, it's likely garbage, just like stuff that moves at impossible speeds - you won't get a boat at more than 100 km/h, a small prop aircraft like a Cessna at more than 500 km/h (unless it's nose-dive crashing), or a civilian airliner at more than 1.200 km/h.
> AIS can only be turned off in rare circumstances
This is SOLAS convention which has no enforcement offshore. Within the navigable waters of the US and up to 12 miles offshore, there is enforcement [1]. But elsewhere, there are plenty of reasons to turn AIS off [2].
The US Navy generally operates with AIS off, although they've started to broadcast AIS reports in high traffic areas [3]. Private boats can turn AIS off at will in international waters [4]. It's also possible to spoof AIS reports [6]. Then there's avoiding piracy in Gulf of Aden or Strait of Malacca.
[1] https://www.marinelink.com/news/us-coast-guard-alarmed-marin...
[2] https://www.darkshipping.com/post/ais-off-dark-shipping
[3] https://news.usni.org/2017/09/19/deadly-collisions-navy-will...
[4] https://www.theguardian.com/world/2022/may/28/revealed-russi...
[5] https://archive.is/5lvTC
I am personally aware of many commercial vessels that turn off their AIS to avoid leaking information to local government and competitors. My experience is limited to the U.S. Atlantic and Gulf coasts and the Caribbean.
It's very eery to sail through a 100 strong fleet of chinese squid ships and seeing them all turn off their AIS as they see you approaching.
Huh, that doesn't really make a lot of sense to me. Why turn them off after being sighted? Because AIS tags aren't matching reality perhaps?
where did that happen?
Ok that is pretty amazing. I followed the link to the repo of tools and it’s crazy that not only can you use automation to track and identify ships but also look up their cargo manifests.
The visualization is beautiful but the time scale is too large and the maps too zoomed in to identify much in the way of patterns.
I work in this field. Some notes here
"Unlike ADS-B in a plane, AIS can only be turned off in rare circumstances."
AIS can and does get turned off all the time. Different countries have different laws on this, so you will see very different patterns on where AIS goes dark. Sometimes vessels will turn off their AIS as soon as they leave some EEZ for international waters, sometimes they just turn it off if there's little risk of getting caught. As the article says, AIS is primarily used for safety measures - and is what it was designed for. But most developed countries have since started to use AIS for maritime surveillance, and have in the later years codified in laws / regulated how vessels of certain size must use their AIS transponders. VMS, which has a much greater capability in sending out data (catch logs, for example), has become more and more common.
It is also difficult to know whether or not a ship deliberately turns off its AIS transponder, or if it is in an area with poor coverage. AIS data is collected via satellites and land based antennas - some data providers also provide signal strength to give a clue. When presenting AIS data in court, we never, ever say that a vessel has turn off their AIS transponders - only present the data and some probabilities.
Bogus AIS tracks is a massive, massive problem. I frequently analyze areas where as much as 100% of the "traffic" turns out to be junk. They _can_ be pretty easy to filter out if there is some pattern of randomness, and a lot of the junk is just that - the AIS messages are just scattered uniformly around the globe, leading to impossible speeds. 99% of junk tracks are either registered as Chinese, or some micro-nations with little to no maritime activity.
Spoofing is also a problem. In my work, we've been analyzing the Russian tanker movement closely for a couple of years now, and some of the spoofing has been really sloppy - so sloppy that the public quickly noticed. This is my favorite, because it was so low effort: https://gcaptain.com/blink-and-youll-miss-it-russia-deploys-...
(if you look at the data, you'll see that they just spoofed the AIS messages with a constant speed for two week straight, going through the exact same positions multiple times).
With that said, the average of the data gives you nice patterns. There's a ton of variance due to all the fake data, missing data, faulty data, etc. - so in a day-to-day job a lot of your work is to figure out whether or not the dataset is a valid one.
Another possible example are the ‘Shanghai Crop circles’ [1], but these are attributed to gps jamming, why not ais jamming?
[1] https://gpspatron.com/gps-spoofing-circles-in-china/
Thanks for sharing!
I'm trying to understand what bogus AIS tracks means - are you saying these are AIS messages injected into the network somehow, or actual AIS radio signals that somehow ended up transmitted from the wrong place?
I'm assuming the former, which sounds more like an authentication problem?
Sure, I'll give you a scenario.
Let's perform a search for vessels that have been inside some search box / geometry in the past 72 hours. In this case I'll do a search south of Africa. The search area looks like this:
https://i.imgur.com/z2LTC7k.png
Which will return the following list of vessels:
https://i.imgur.com/cKm1YlO.png
And if you plot the tracks for that area, there won't be much:
https://i.imgur.com/Max72J4.png
Now, let's save the ships (by MMSI number), and search where those ships have been in the past 72 hours?
Here's the resulting tracks:
https://i.imgur.com/SqS8GH9.png
---
So, what happened here?
1) As you can see from the list with vessels, some of the rows only have a MMSI number - nothing more. A MMSI number is not static/constant, whereas an IMO number is - think of the IMO number as the VIN number of a vessels, it will following the ship from build to scrapping.
So a big problem is that we're not just looking at one track, but every AIS message that has that MMSI number associated. And generating those can be trivial.
Anyone with some AIS transponder can send out AIS messages with some MMSI number can achieve that
2) Because these AIS messages are being spammed at random, they will still appear in geometry / area searches. Usually just as one point / message, but you still have to filter them out.
Now, with that said, junk like that is easier to spot - because they usually do not have much more data than some MMSI, and maybe a flag state.
Nice, thanks for sharing such a complete example. So I take it there isn't really any kind of verification of AIS message validity. I suppose that would be difficult to do, so it makes sense that AIS would be easy to spam.
Indeed, here's a good and short article on the topic:
https://globalfishingwatch.org/data/spoofing-one-identity-sh...
Global Fishing Watch is one of the orgs that publish good and accessible stuff on this very topic.
What's the motivation for the bogus data? Just adding noise to obscure real vessel activity?
Similarly, the entire AIS tracking system needs a layer of authentication. I ran an AIS station for several years that fed data to Marinetraffic, and I could have stuffed whatever data I wanted into their database with no apparent restrictions or checks.
Some do not want their competitors to know where they are. Some vessels are fishing in illegal waters or violating sanctions.
> What's the motivation for the bogus data?
Some people just want to see the world burn. Vandals and trolls basically. IIRC there have been multiple incidents of people spoofing genitalia shaped tracks (on top of an even larger multitude of actual pilots steering air and water craft to draw genitalia). Easy enough to do, all you need is a transmitter (which are getting very cheap these days thankfully) and something that can output a stream of fake GPS positions in NMEA format on a serial port.
Others run broken or misconfigured equipment and either don't know, don't care or do it intentionally with plausible deniability (Chinese ships in non-China waters stealing fish are a huge problem [1]).
At least a lot of the dumbasses and breakages can actually be filtered - AIS Class A transmitters on large ships can reach up to 100km, AIS Class B transmitters (everyone else) about 40km, ADS-B on aircraft about 500km. That means even as a solo operator of an AIS/ADS receiver, you can safely discard anything more than these distances away from your coordinates, it's likely garbage, just like stuff that moves at impossible speeds - you won't get a boat at more than 100 km/h, a small prop aircraft like a Cessna at more than 500 km/h (unless it's nose-dive crashing), or a civilian airliner at more than 1.200 km/h.
[1] https://www.seaaroundus.org/industrial-fleets-operating-indi...
data: https://hub.marinecadastre.gov/pages/vesseltraffic
wish those images had individual captions instead of us needing to do work to figure out which image goes to witch caption