AIS Is a Signal, Not a Source of Truth

The Automatic Identification System was designed for safety, not for security. It broadcasts a vessel's identity, position, course and speed so that ships and shore stations can avoid collisions and coordinate traffic. It does this on the honour system: the transponder reports whatever it is told to report.

That design assumption — that vessels want to be seen and want to be seen accurately — holds for the overwhelming majority of legitimate traffic. It breaks down precisely for the vessels an intelligence analyst most wants to understand.

Three ways AIS lies

When a vessel has a reason to obscure its activity, AIS offers three broad options, in increasing order of sophistication.

• —Going dark — switching the transponder off entirely, leaving a gap in the track. A gap is not proof of wrongdoing, but an unexplained gap in a sensitive area, at a sensitive time, is an indicator.
• —Spoofing position — transmitting a false location while physically being somewhere else. Fabricated tracks have been observed sitting alongside a berth or circling at sea while the real vessel was elsewhere.
• —Manipulating identity — broadcasting another vessel's MMSI or IMO number, reviving a decommissioned identity, or rotating through identities to break the link between a hull and its history.

Each of these is cheap, requires no special equipment beyond the transponder itself, and leaves the rest of the maritime picture looking superficially normal. A platform that treats the AIS feed as ground truth will faithfully render the lie.

What a claim is worth

The discipline that separates intelligence from tracking is simple to state and hard to operationalise: treat every AIS report as a claim, and assess the claim against independent evidence.

Most maritime systems show where vessels say they are. The harder question — and the useful one — is what the available evidence indicates they are doing.

Independent evidence comes from sources that do not depend on the vessel's cooperation. Synthetic aperture radar and optical satellite imagery can confirm or deny a vessel's presence regardless of what its transponder says. Signal-integrity context — whether the surrounding area is subject to GNSS jamming or spoofing — tells you whether a reported position can be trusted at all. Registry, ownership and sanctions data tell you whether the claimed identity is even coherent.

Correlation, not list-matching

The instinct to reduce this to a lookup — does this MMSI appear on a list? — is understandable and insufficient. Evasion is behavioural. The signals that matter are patterns over time: a gap that coincides with a ship-to-ship transfer location, an identity that changes shortly after a sanctions designation, a position that is physically impossible given the vessel's last confirmed location.

• —A single AIS gap is noise. A gap that aligns with darkness, a known transfer zone and a counterpart vessel doing the same thing is a signal.
• —A flag change is administrative. A flag change combined with a name change, an ownership restructure and a lapse in recognised insurance is a pattern.
• —An identity match against a watchlist is a starting point. The assessment is whether the behaviour around that identity is consistent with the designation.

Why this matters for decision makers

The cost of treating AIS as truth is not abstract. Port authorities, insurers, enforcement agencies and naval commands act on the maritime picture in front of them. If that picture is the unverified output of a transponder, the decision inherits the transponder's vulnerabilities — and the consequences are not always anticipated in advance.

Treating AIS as one signal among several does not make the system slower or more cautious for its own sake. It makes the output defensible. When a finding has consequences — operational, legal, regulatory or commercial — the question is never just what was concluded, but how the conclusion was reached.