AIS message spoofing and manipulation pattern analysis
Fabricated AIS messages, phantom vessels and MMSI cloning are detectable by cross-referencing spaceborne AIS reception with SAR imagery and RF geolocation. Temporal and geometric inconsistencies in message sequences expose manipulation that shore-based AIS alone cannot resolve.
Sensors
- Spire Global AIS (LEO constellation): Over 100 LEO satellites receive VHF AIS on channels 87B and 88B (161.975 MHz and 162.025 MHz). LEO reception breaks the self-interference problem that limits shore-based AIS in dense traffic, capturing messages from vessels that are deliberately suppressed or overwritten at the coastal layer. Revisit over open ocean is typically 20–90 minutes depending on latitude and constellation load. Provides raw message timestamps and received-signal metadata used in consistency analysis.
- exactEarth satellite AIS: Operates a dedicated maritime AIS LEO constellation with similar VHF reception capability. Supplies historical message archives with per-message metadata including satellite pass geometry, enabling retrospective reconstruction of transmission sequences for forensic timeline analysis.
- Sentinel-1 SAR (C-band, ESA Copernicus): C-band synthetic aperture radar at 5.405 GHz. Interferometric Wide Swath mode covers 250 km at 5 × 20 m resolution; Extra Wide Swath covers 400 km at 20 × 40 m. Detects physical vessel returns independent of any transmitted signal. Repeat cycle is 6 days at the equator for a single satellite, 3 days with both Sentinel-1A and 1B operating. The fundamental cross-check: if an AIS position is reported but no radar return exists at that location, the message is a candidate phantom.
- HawkEye 360 RF geolocation: Cluster-based LEO constellation that geolocates RF emitters using time-difference and frequency-difference of arrival (TDOA/FDOA). Can independently locate the physical transmitter of an AIS signal to within roughly 1–3 km CEP (published figures vary by geometry). If the geolocated transmitter position differs materially from the reported AIS position, that divergence is direct evidence of position falsification rather than merely a consistency anomaly.
- Sentinel-1 SAR (vessel detection cross-check): Used specifically to enumerate all physical radar-detectable targets in a scene and compare that list against AIS-reported vessels. Vessels above roughly 30–50 m length are reliably detectable in IW mode. Smaller craft fall below reliable detection thresholds, which is an honest limit: absence of a SAR return cannot prove a small vessel is phantom, only that it is below the detection floor.
Why AIS messages lie, and how often
The Automatic Identification System was designed for collision avoidance, not authentication. Messages are broadcast in the clear on VHF, unsigned, and trivially spoofable with commercially available transponders or software-defined radio. A vessel can transmit a false position, a cloned MMSI, a fabricated vessel name, or no message at all. The incentives are obvious: sanctions evasion, illegal fishing concealment, smuggling, and military deception all benefit from a manipulated AIS track.
Academic and industry analyses of historical AIS archives have documented several recurring manipulation signatures. Position jumps that exceed any plausible speed, course changes that defy vessel physics, MMSI numbers simultaneously transmitting from geographically separated locations, and tracks that pass through land are the most common. Shore-based receivers miss many of these because dense coastal traffic causes message collisions that mask anomalies. Spaceborne AIS, received above the collision layer, recovers a higher fraction of the raw message stream and makes the inconsistencies visible.
The four manipulation classes and their detection signatures
Phantom vessel insertion places a vessel in the AIS record that has no physical correlate. Detection rests on SAR cross-check: a Sentinel-1 scene acquired over the reported position within a few hours of the AIS transmission should show a radar return if the vessel is real. Absence is suggestive but not conclusive for vessels below roughly 50 m. For larger vessels, absence is strong evidence of fabrication.
Position falsification keeps a real vessel transmitting but moves its reported location. The physical transmitter stays in one place while the AIS track wanders elsewhere. HawkEye 360 TDOA/FDOA geolocation of the actual transmission resolves this directly: the geolocated origin diverges from the reported position by kilometres or hundreds of kilometres. This is the cleanest single-sensor proof of manipulation.
MMSI cloning assigns one vessel's identity to another transmitter. Two geographically separated AIS messages carry the same nine-digit MMSI simultaneously. Spaceborne AIS, with its wider field of view, catches both transmissions in a single pass more reliably than shore stations. The separation distance and timing of the two signals constrain which is the original and which the clone, though attribution is rarely unambiguous without additional intelligence.
Track fabrication constructs a plausible-looking historical voyage that never happened, often to create a paper trail for sanctions evasion. Detecting it requires archive analysis: checking whether the reported track is consistent with known port calls, vessel draught changes that would indicate loading or unloading, and whether SAR imagery from the relevant period shows the vessel where the track claims it was. This is the most labour-intensive class and the one most resistant to automated detection alone.
What a floating roof gives away: message-consistency checks
Before reaching for imagery, a great deal can be inferred from the AIS message sequence itself. Speed over ground reported in consecutive messages implies a minimum elapsed distance. If the position delta is geometrically inconsistent with that speed and the elapsed time, the sequence contains at least one false message. Course-over-ground changes that would require turning radii impossible for a vessel of the reported length and type are a second flag. Draught values that change between ports without a plausible loading event are a third.
These kinematic checks are well-established in the published literature and are the first filter applied before expensive SAR or RF tasking. Their honest limit is that they generate false positives: GPS errors, transponder malfunctions, and data-entry mistakes produce identical signatures to deliberate manipulation. The checks identify candidates for further investigation, not confirmed fraud. The distinction matters when the output is used in legal or regulatory proceedings.
Layering the evidence: from flag to proof
A credible manipulation finding requires at least two independent lines of evidence. A kinematic anomaly plus a missing SAR return is stronger than either alone. A kinematic anomaly plus a TDOA/FDOA transmitter location that diverges from the reported position is stronger still. The investigative workflow moves from cheap and fast (message-consistency screening across the full AIS archive) to targeted and expensive (commercial SAR tasking or RF geolocation over a specific area and time window).
Latency matters differently for different use cases. A flag state investigating a historical sanctions-evasion case can work with archived data and accept days of processing time. A maritime authority trying to intercept an active vessel needs an alert within hours of the anomalous transmission. Spaceborne AIS providers typically deliver raw message data with latencies of under two hours for priority feeds; SAR tasking can be scheduled to a specific revisit but cannot be retrospective. The combination of near-real-time AIS screening with pre-positioned SAR tasking is the operational architecture that closes the gap.
Satellize structures this layered workflow for clients who need a defensible, documented evidence chain rather than a dashboard flag. The Overhead column has covered several publicly documented spoofing incidents using exactly this methodology.
Honest limits of the method
SAR cannot detect vessels below roughly 30–50 m in Sentinel-1 IW mode under typical sea states. Small craft used for smuggling or illicit transfers are frequently below this floor. Cloud has no effect on SAR, which is one of its genuine advantages over optical sensors, but sea clutter in high wind conditions does degrade target detection.
HawkEye 360 geolocation accuracy of 1–3 km CEP is sufficient to distinguish a vessel from a shore-based transmitter, but not to place a vessel precisely within a congested anchorage. TDOA/FDOA requires the target to be visible to at least three cluster satellites simultaneously, which is not guaranteed at all latitudes and times. Coverage gaps exist.
Message-consistency checks are blind to sophisticated manipulation that preserves kinematic plausibility. A spoofed track that moves at realistic speeds on a plausible heading through open water will not trigger a kinematic flag. Only the physical cross-checks catch it. This means the method is most effective against opportunistic or technically unsophisticated manipulation, and less reliable against state-level or well-resourced actors who understand the detection logic.
Typical figures
| AIS reception frequency | VHF 161.975 MHz (Ch 87B) and 162.025 MHz (Ch 88B) |
| Spaceborne AIS revisit (open ocean) | Typically 20–90 minutes depending on latitude and constellation load |
| SAR cross-check resolution (Sentinel-1 IW) | 5 × 20 m (Interferometric Wide Swath); 20 × 40 m (Extra Wide Swath) |
| Sentinel-1 repeat cycle | 6 days single satellite; approximately 3 days with dual-satellite constellation |
| RF geolocation accuracy (HawkEye 360 TDOA/FDOA) | Approximately 1–3 km CEP (published range; geometry-dependent) |
| Minimum vessel size detectable by Sentinel-1 SAR | Approximately 30–50 m length in typical sea states (smaller vessels unreliable) |
| AIS data latency (priority feed) | Under 2 hours for commercial spaceborne AIS providers |
| Archive depth (spaceborne AIS) | Spire and exactEarth archives extend to approximately 2012–2014 onwards |
| Sentinel-1 SAR archive depth | From April 2014 (Sentinel-1A launch) via Copernicus Data Space |
| Delivery formats | Flagged message CSV/JSON, GIS vector layers (GeoJSON, Shapefile), PDF evidence report, alert API feed |
Analytics Satellize can run
| Kinematic anomaly screening | Speed-position-time consistency checks and vessel physics constraints applied across full AIS message archive for a defined area and period | Ranked list of anomalous MMSI records with per-flag rationale, delivered as CSV or JSON |
| Phantom vessel assessment | Cross-reference of AIS-reported positions against Sentinel-1 SAR vessel detection layer for coincident time windows; absence scoring weighted by vessel reported length | GIS layer of candidate phantom positions with SAR scene metadata and confidence rating |
| Position falsification report | Comparison of HawkEye 360 TDOA/FDOA transmitter geolocation against AIS-reported position for flagged vessels; divergence distance and bearing calculated per pass | PDF evidence report with transmitter location plots, divergence statistics, and timeline |
| MMSI cloning detection | Temporal clustering of spaceborne AIS messages by MMSI; simultaneous multi-location detection flagged where geographic separation exceeds vessel transit possibility | Alert feed with MMSI, timestamps, positions of both transmissions, and separation distance |
| Historical track fabrication audit | Retrospective archive cross-check combining AIS track, Sentinel-1 SAR imagery, and port-call records to assess whether reported voyage is physically consistent | Structured evidence dossier suitable for regulatory or legal use, with source citations and confidence levels |
| Ongoing manipulation monitoring | Automated kinematic screening on live AIS feed with SAR tasking pre-positioned for priority vessels or areas; alert triggered on threshold breach | Near-real-time alert API with configurable thresholds; weekly summary report |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.