Piracy Risk Assessment from Vessel Convergence Patterns
Piracy staging relies on craft that are invisible to AIS. SAR imagery and RF-geolocation data can reveal convergence patterns that AIS alone cannot, though resolution limits and revisit gaps mean satellite data informs risk assessment rather than replacing real-time response.
Sensors
- Sentinel-1 SAR (C-band, ESA): 20 m ground range resolution in Interferometric Wide Swath mode, 250 km swath, 6-day repeat at the equator with a single satellite and roughly 3-day repeat with both A and B units operational. Detects vessels via normalised radar cross-section contrast against sea clutter. Small open skiffs below approximately 10 m length approach the noise floor in moderate sea states, making detections ambiguous rather than definitive.
- ICEYE SAR (X-band, commercial): Spotlight mode delivers approximately 1 m resolution over a 5 x 5 km scene; Strip mode gives 3 m over a 30 km swath. Tasked revisit can be arranged within hours on a priority basis, which substantially narrows the gap that Sentinel-1's fixed repeat leaves. X-band backscatter from metal hulls and outboard engines provides stronger contrast than C-band for very small targets in calm to moderate sea states.
- HawkEye 360 RF geolocation: A cluster-satellite constellation that geolocates RF emissions in VHF, UHF and maritime bands using time-difference-of-arrival and frequency-difference-of-arrival methods. Positional accuracy is typically 500 m to 2 km depending on geometry. Detects anomalous radio activity, including handheld VHF chatter and radar emissions, from vessels that carry no AIS. Revisit over a given ocean corridor is roughly every 90 minutes per cluster pass.
- Spire AIS and RF: A constellation of more than 100 LEO nanosatellites receiving AIS messages globally with sub-30-minute revisit at mid-latitudes and better coverage near the poles. Spire also collects RF signals in L, S and X bands. Used here primarily to establish which commercial vessels are broadcasting AIS and to flag gaps or anomalies in their message streams that coincide with SAR-detected small-craft activity.
Why AIS is the wrong tool for this problem
Piracy skiffs operate precisely because they are invisible to the systems commercial shipping relies on. AIS is mandatory for vessels over 300 gross tonnes on international voyages; a 7-metre fibreglass pirogue with two outboard engines and a crew of six carries no such obligation and typically no transponder at all. Waiting for an AIS contact to appear before raising a threat assessment is, in the piracy context, waiting for the attack to have already begun.
The analytical task is therefore not to find the commercial target, which AIS usually provides, but to detect the staging craft around it. That requires sensors that respond to physical presence rather than voluntary broadcast. SAR and RF geolocation fill that role, imperfectly but usefully.
What a convergence pattern looks like from orbit
A SAR image of a high-risk corridor such as the Gulf of Aden or the Gulf of Guinea will, on any given pass, contain dozens of small radar returns that are not associated with AIS contacts. Most are fishing vessels. The piracy-staging signature is not a single dark vessel but a geometric relationship: two or more small returns moving on converging headings toward a known commercial track, at speeds consistent with fast outboard craft (typically 20 to 35 knots), at a time when the commercial vessel is transiting rather than anchored.
Detecting that pattern requires at minimum two SAR passes separated by enough time to compute displacement vectors. Sentinel-1's 3 to 6-day repeat is too slow for this on its own. Tasked ICEYE passes, requested to bracket a transit window, can reduce the interval to 2 to 6 hours over a specific corridor, which is sufficient to resolve heading and approximate speed for craft travelling at those velocities. Even then, the analysis produces a risk indicator, not a confirmed threat. A cluster of small returns converging on a tanker could equally be artisanal fishermen working the vessel's wake.
RF anomalies as a corroborating layer
HawkEye 360 data adds a dimension that SAR alone cannot supply: evidence of radio coordination. Piracy operations in the Gulf of Guinea and Gulf of Aden have historically involved a mothership and multiple attack skiffs communicating on VHF channels. An RF-geolocation pass that places multiple emitters in close proximity, on non-standard maritime channels, in a location consistent with a SAR-detected convergence, substantially raises the probability that the pattern is not incidental.
The honest caveat is positional uncertainty. HawkEye 360's published geolocation accuracy of 500 m to 2 km is adequate for associating an emission cluster with a general area but not for distinguishing individual vessels within a tight group. The RF layer is corroborative, not conclusive. It shifts the prior probability of a threat; it does not eliminate ambiguity.
Spire's AIS record for the same time window completes the picture by confirming which large vessels were in the area and whether any of them show message-stream gaps that could indicate AIS manipulation or equipment failure during the period of interest.
The resolution floor and what it means for confidence
Sentinel-1 at 20 m resolution can reliably detect vessels longer than roughly 20 to 30 m in moderate sea states. Smaller targets produce returns that sit close to the sea-clutter noise floor, particularly in sea states above Beaufort 4. ICEYE in Spotlight mode pushes that detection floor down toward 5 to 10 m, but even at 1 m resolution a low-freeboard open skiff with minimal metal content is a marginal target. Published studies in Remote Sensing (MDPI) have demonstrated small-vessel detection rates that vary considerably with sea state, incidence angle, and vessel heading relative to the radar look direction.
This is not a defect to be engineered away; it is a physical constraint. Buyers should expect that a satellite-derived convergence alert will carry a confidence band, not a binary verdict. The appropriate use is to cue heightened watchfulness and, where naval or coast-guard assets are available, to direct aerial or surface investigation. Satellite data is the long-range early-warning layer, not the fire-control solution.
Corridor prioritisation and archive exploitation
Not every ocean corridor warrants continuous tasked SAR coverage; the economics do not support it and the threat is not uniform. A more practical architecture uses Sentinel-1's free archive, which extends back to 2014, to characterise baseline small-vessel density in specific corridors during specific seasons. The Gulf of Guinea threat pattern, for instance, concentrates in the waters off the Niger Delta and shifts with weather and fishing seasons. An analyst who knows the baseline can set a statistically meaningful threshold for anomalous convergence rather than treating every cluster of small returns as a threat.
Satellize runs this type of archive-baseline-plus-tasked-alert architecture for clients who need corridor-specific risk products. The method is the same one applied, at smaller geographic scale, in the Tonga crop-estimation programme: establish a statistical baseline from open-archive data, then task commercial sensors only when the baseline flags an anomaly worth resolving. It keeps tasking costs proportionate to actual risk.
Limits on real-time utility
The single most important constraint for an operational buyer to internalise is latency. A Sentinel-1 pass produces a Level-1 product available in the Copernicus Data Space within 1 to 3 hours of acquisition. Processing to a vessel-detection layer, cross-referencing with AIS, and generating a convergence alert adds further time. ICEYE tasked imagery can be delivered in near-real-time, with some products available within 30 minutes of acquisition under priority arrangements, but that still places the alert well after the moment of observation.
A piracy attack in the Gulf of Aden typically closes from horizon to boarding in under 20 minutes at skiff speeds. No satellite constellation currently provides the combination of sub-minute revisit and sub-10-metre resolution needed to track an active attack in real time. What satellite data does well is the hours-to-days prior window: identifying that a suspicious pattern is developing in a corridor before a vessel enters it, and informing routing decisions or naval tasking accordingly. That is a genuinely useful capability. It is not a substitute for vessel-mounted radar, armed escorts, or citadel procedures.
Typical figures
| SAR spatial resolution (Sentinel-1 IW mode) | 20 m ground range, 250 km swath |
| SAR spatial resolution (ICEYE Spotlight mode) | ~1 m, 5 x 5 km scene |
| Sentinel-1 revisit (equatorial, dual satellite) | ~3 days; single satellite ~6 days |
| ICEYE tasked revisit | Hours, subject to constellation capacity and priority tier |
| HawkEye 360 RF geolocation accuracy | 500 m to 2 km (TDOA/FDOA method) |
| HawkEye 360 revisit over a corridor | ~90 minutes per cluster pass |
| Spire AIS revisit (mid-latitude) | Sub-30 minutes |
| Minimum detectable vessel length (SAR, calm sea state) | ~20-30 m (Sentinel-1); ~5-10 m (ICEYE Spotlight); ambiguous below these thresholds in Beaufort >4 |
| Alert latency from acquisition | 1-3 hours (Sentinel-1 standard); <30 minutes possible (ICEYE priority) |
| Sentinel-1 archive depth | From 2014; freely accessible via Copernicus Data Space |
Analytics Satellize can run
| Corridor baseline small-vessel density map | Statistical characterisation of SAR-detected non-AIS returns over multi-year Sentinel-1 archive, segmented by season and sea state | GIS layer (GeoTIFF or GeoJSON) with density percentile bands per 0.1-degree grid cell |
| Convergence anomaly alert | Multi-pass SAR displacement vector computation; returns exceeding baseline density threshold and converging on a known commercial track flagged as anomalous | Timestamped alert message with coordinates, estimated vessel count, heading vectors, and confidence band |
| RF-corroborated threat indicator | Spatial and temporal intersection of HawkEye 360 RF emission clusters with SAR convergence anomalies; Spire AIS cross-check for nearby large vessels | Structured report with SAR evidence, RF emission summary, AIS context, and composite risk score |
| Transit-window risk assessment | Historical incident overlay (from published IMB and UNODC records) combined with current-cycle SAR and RF observations for a named corridor and date range | PDF or API-delivered risk brief per planned transit, with recommended routing alternatives if anomalies are present |
| Seasonal threat calendar per corridor | Archive SAR density analysis correlated with published piracy incident databases and meteorological seasonality | Annual calendar product (spreadsheet or dashboard feed) showing elevated-risk periods by corridor |
| Post-incident reconstruction | Retrospective SAR archive pull bracketing a reported incident; AIS gap analysis; RF emission timeline from HawkEye 360 archive | Evidential package for insurers or flag-state authorities, with annotated imagery and timeline |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.