No.15 2021/2022 - Sanctions - Recent Deceptive Practices

AIS manipulation

Considerable emphasis is placed by UN reports and the US and UK maritime advisories [3] on the need to monitor the AIS transmissions of vessels as part of a properly implemented compliance framework.

However, AIS technology and its associated hardware and software were not designed for this purpose; the purpose of AIS was to identify ships in coastal areas and minimise the risk of a collision. Since its function was to promote safety, it was not designed to prevent the signal it transmits from being manipulated and it remains lawful to switch the transmission off in the interests of vessel safety and security. [4]

The ability to manipulate or simply turn off the signal leaves AIS vulnerable to exploitation by those breaking sanctions. Although AIS transponders have built-in security features to prevent them from transmitting falsified data, these features are inconsistent across manufacturers and can be circumvented. Depending on the model, the encoded details can be changed using passcodes that are not always well-protected.

In addition to directly tampering with the transmitter, a user can also purchase multiple AIS transponders and so create multiple digital AIS identities from a single vessel. Identity tampering and vessels disguising themselves physically and digitally is increasingly common.

Current techniques include:

1. Switching off the AIS.

Whilst switching off of an AIS transponder is permitted in certain circumstances by SOLAS, vessels engaged in sanctions breaking can also switch off their transponders to hide their position and movements. This practice remains common for less sophisticated sanction breakers who rely on legitimate excuses as to why a Master might choose to turn off the AIS transmitter and the fact that even a properly transmitted signal might not always be received.

Members engaging in STS operations are therefore advised to monitor the providing vessel’s AIS updates for gaps in transmission records. This can be achieved through an AIS monitoring platform or service provided by commercial companies where additional context and algorithms are used to assess whether an unlawful activity may have occurred during gaps in AIS transmission.

In simple cases, operators may attempt to evade sanctions by switching off AIS transponders when, for example, entering the Gulf of Oman and switching it back on after loading or conducting an STS of a sanctioned cargo. More sophisticated entities may create false journeys prior to switching off AIS, to disguise a vessel’s true course.

2. GPS/GNSS manipulation (position spoofing).

Some sanctions breakers now falsify the position a vessel broadcasts via its AIS, to disguise the true location of the vessel.

The most rudimentary instances of GPS/GNSS (global navigation satellite system) spoofing simply produce repeat AIS updates in a single location. More sophisticated examples can produce very realistic signals and can only be identified through comparison with additional independent data such as satellite imagery, physical sighting of the vessel, or synthetic aperture radar (SAR) tracks. The IG is concerned that there is an increasing use of GPS/GNSS spoofing to hide the true location of vessels breaking sanctions.

Members may wish to partner with an AIS monitoring platform expert capable of assessing the datasets needed to validate a vessel’s true location.

False Documents

The creation of false vessel and cargo documentation is used to deceive parties and states as to the origin of the cargo and is often seen alongside AIS manipulation. False cargo documentation will routinely misdescribe the origin or characteristics of the cargo and reference the false name and / or identity of the sanctions breaking vessel.

As part of the false identity selected for the documentation there may be a false flag. Several Flags Registries that have specific advantages for sanctions evasion are used for this. Specifically, these registries provide no easy means of communication, making it difficult to verify details. Some of the false Flag Registries may either not exist or be closed to foreign vessels. Another warning sign is vessels changing flags frequently within a short period of time, so called "flag hopping”.

A further tactic observed is the use of complex business structures, including shell companies and/or multiple levels of ownership and management, to disguise the involvement of sanctioned parties in the operation of a vessel. Frequent changes to the ownership of a vessel, or the vessel’s management, may also be a warning sign that something is amiss. Instances of vessels being bought, performing only one voyage from a high risk area then being transferred to new owners just after completion of each voyage has been observed and may the involvement of parties systematically engaging in sanctioned trade operating the vessels.

Verifying false documentation is extremely challenging requiring checks and corroboration from several sources – for example do the port lists show that a vessel actually called at the port within the timeframe that it purported to load the cargo? Members may wish to check with a trusted local shipping agent in that port.