AIS Location Fabrication and Spoofing Detection
Vessels transmitting false AIS positions can be exposed by cross-referencing declared coordinates against independent SAR detections, optical imagery and Doppler-derived velocities. Where the physics disagrees with the broadcast, the broadcast is wrong.
Sensors
- Sentinel-1 SAR (C-band, ESA): 5 m x 20 m ground range resolution in Interferometric Wide Swath mode, 250 km swath, 6-day repeat at the equator (1-3 days at higher latitudes with both satellites). Detects vessel hull backscatter and wake independently of AIS. Doppler centroid anomaly provides a velocity estimate for moving targets, giving a second independent check on declared speed.
- Planet SuperDove optical (3 m, 8-band): Nominally daily revisit at most latitudes. At 3 m resolution, vessel hull returns, bow waves and shadow geometry can be used to estimate heading and approximate speed, independent of any transmitted data. Cloud cover is a hard limit: optical confirmation fails under overcast conditions.
- Spire spaceborne AIS: Spire operates over 100 satellites carrying AIS receivers, providing global message collection with typical latency under 20 minutes. The raw message log records the exact time each position report was received, which can be compared against the timestamp embedded in the message itself to flag clock manipulation or replay attacks.
- Orbcomm spaceborne AIS: A complementary spaceborne AIS constellation providing additional message-collection geometry. Cross-referencing reception times and signal strengths between Spire and Orbcomm receivers can reveal whether a message originated from the declared position or from a geographically inconsistent transmitter location.
What fabrication looks like from orbit
AIS location fabrication is not the same as a vessel going dark. The vessel keeps transmitting. It broadcasts a plausible MMSI, a plausible course, a plausible speed. The intention is to appear cooperative while actually being somewhere else entirely. This is the harder problem: a ship that is silent raises immediate suspicion; a ship that is loudly present in the wrong ocean does not, at first glance.
The tell is geometric. A Sentinel-1 pass over the declared position finds nothing. Or it finds the vessel, but the hull return sits 40 kilometres from the broadcast coordinates, with a wake pointing in a direction inconsistent with the declared heading. Or the Doppler centroid shift, which encodes the component of vessel velocity along the radar line of sight, implies a speed of 4 knots when the AIS log claims 12. Each of these is a separate, independent physical measurement. They do not care what the transponder says.
The geometry of a lie: offset, heading and speed as three separate tests
Position offset is the most direct test. If a SAR detection places a vessel at coordinates A and the contemporaneous AIS broadcast places it at coordinates B, the offset distance is a hard number. Sentinel-1's positional accuracy in IW mode is better than 10 m after precise orbit determination, so offsets beyond a few hundred metres are not noise. Offsets of tens of kilometres, which have been documented in open-source analyses of sanctioned tanker fleets, are unambiguous.
Heading inconsistency is subtler but often more damning. A vessel's wake in SAR or optical imagery is a directional arrow. If the declared AIS course-over-ground is 045 degrees and the wake points at 210 degrees, no calibration error explains that. Shadow geometry in high-resolution optical imagery provides a corroborating heading estimate when solar elevation angle is known.
Speed is the third axis. Sentinel-1 Doppler centroid analysis can resolve along-track vessel velocity to within roughly 1 to 2 knots for vessels of moderate radar cross-section, a method documented in peer-reviewed literature and used operationally by several maritime surveillance programmes. A vessel claiming 14 knots while the Doppler signature implies it is stationary is not suffering from a GPS glitch.
Spaceborne AIS as a forensic timestamp, not just a position log
Most analysts treat spaceborne AIS as a position feed. For spoofing detection, the message metadata matters as much as the coordinates. Each AIS message carries an internal timestamp. Spire and Orbcomm satellites record the time of reception independently. If a message claims to have been sent at 14:32:00 UTC but was received at 14:31:47 UTC, something is wrong with the clock or the message is a replay of an earlier transmission.
Reception geometry adds another layer. AIS signals propagate at the speed of light. A satellite at a known orbital position receives a signal from a ground transmitter with a propagation delay that is a function of slant range. If the declared position implies a propagation delay of 3.2 milliseconds but the measured delay is 4.8 milliseconds, the transmitter is not where it claims to be. This technique, a form of time-difference-of-arrival analysis, requires precise satellite ephemeris and careful calibration, but the physics is not in dispute.
One honest caveat: spaceborne AIS in congested waters suffers from message collision, where simultaneous transmissions from many vessels corrupt each other. Detection completeness in the South China Sea or the Strait of Malacca is lower than in open ocean. Spoofing analysis in high-density areas benefits from multiple collection passes and cross-referencing against SAR to compensate.
What the method cannot do
SAR revisit is not continuous. Sentinel-1 passes over a given point every 6 days at the equator, improving to 1 to 3 days at higher latitudes with both satellites active. A vessel that fabricates its position for a 12-hour window and then reverts to honest reporting may never be caught by a single SAR overpass. Persistent monitoring requires tasking commercial SAR constellations, which carry their own cost and scheduling constraints.
Cloud cover does not affect SAR, but it eliminates optical corroboration entirely. In the Inter-Tropical Convergence Zone, Planet SuperDove confirmation may be unavailable for days at a time. The analysis then rests on SAR alone, which is still powerful but loses the heading and wake-colour information that optical imagery provides.
Sophisticated fabrication can construct tracks that are internally consistent over time, with realistic accelerations, port calls at plausible intervals and AIS messages timed to avoid known SAR overpass windows. Defeating this requires either higher SAR revisit than Sentinel-1 alone provides, or probabilistic anomaly scoring across a vessel's full historical track, flagging statistical implausibilities in port-call sequences and speed distributions.
From detection to evidence: what an analyst actually delivers
A spoofing flag is not an accusation. The deliverable is a structured inconsistency report: the declared position, the observed position, the offset distance, the method of detection, the satellite pass time, the orbital geometry and an uncertainty estimate. Each element is traceable to a publicly documented sensor specification or a published analytical method. That structure matters enormously if the output is going to support a sanctions referral, an insurance investigation or a flag-state notification.
Satellize's analytics work follows this structure. The Sentinel-1 and Planet data are open or commercially licensed; the methods are published; the uncertainty is stated. The same discipline that shapes the Tonga crop-estimation programme, where a wrong number has real consequences for a government's food-security planning, applies here. A fabrication detection that cannot survive scrutiny is worse than no detection at all.
For clients who need ongoing surveillance of a specific fleet or trade route, the output is typically a weekly inconsistency log with a GIS layer of flagged detections, supplemented by alert messages when a high-confidence offset event occurs within 24 hours of a SAR pass. The archive depth for Sentinel-1 runs back to 2014, which allows retrospective track reconstruction for vessels under investigation.
Typical figures
| SAR spatial resolution (Sentinel-1 IW mode) | 5 m x 20 m (range x azimuth) |
| SAR positional accuracy (Sentinel-1, precise orbits) | Better than 10 m CE90 |
| Sentinel-1 revisit (equatorial) | 6 days single satellite; 1-3 days at mid-to-high latitudes with two satellites |
| Optical resolution (Planet SuperDove) | 3 m multispectral (8 bands, 450-900 nm) |
| Optical revisit (Planet SuperDove) | Nominally daily at most latitudes; cloud-dependent |
| Spaceborne AIS message latency (Spire) | Typically under 20 minutes globally |
| Doppler velocity resolution (Sentinel-1 vessels) | Approximately 1-2 knots for vessels with adequate radar cross-section |
| Minimum detectable position offset | Practically significant above ~500 m; unambiguous above ~2 km given SAR positional accuracy |
| Sentinel-1 archive depth | From 2014 (Sentinel-1A launch) |
| Coverage | Global; polar regions and high latitudes have best SAR revisit |
Analytics Satellize can run
| Position offset report | SAR vessel detection cross-referenced against contemporaneous AIS broadcast coordinates; offset computed in WGS-84 | Structured PDF or JSON report per vessel event, with satellite pass time, offset distance, uncertainty bounds and GIS point layer |
| Heading inconsistency flag | Wake azimuth extraction from SAR or optical imagery compared against AIS course-over-ground at nearest timestamp | Per-detection flag with wake bearing, declared COG, angular difference and image chip |
| Doppler speed anomaly alert | Sentinel-1 Doppler centroid analysis for along-track velocity estimation, compared against AIS speed-over-ground | Alert message with estimated Doppler speed, declared SOG, confidence interval and pass metadata |
| AIS timestamp forensics | Comparison of message-embedded timestamps against spaceborne AIS reception times from Spire or Orbcomm logs; propagation delay plausibility check | Anomaly table in CSV or GIS format, flagging messages with implausible timing relative to declared position |
| Fleet-level fabrication scoring | Probabilistic anomaly scoring across historical AIS track; statistical tests on speed distribution, port-call intervals and position jump frequency | Ranked fleet watchlist updated weekly, with per-vessel risk score and contributing evidence summary |
| Retrospective track reconstruction | Archive SAR detections (Sentinel-1 from 2014) matched against historical AIS logs to reconstruct actual versus declared track over a defined investigation window | Timeline GIS layer with actual detections, declared track and offset events annotated by date |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.