4.6.2 — Maritime Security — maturity: live

Sanctions Evasion Detection

Correlating satellite SAR, optical, and RF intelligence to identify vessels conducting identity fraud, flag-hopping, and covert cargo transfers to circumvent international sanctions regimes.

Auto-drafted reference page — content reviewed for shape, individual references not yet link-checked.

Sanctions only work if they can be enforced, and enforcement depends on knowing where sanctioned vessels actually are — not where they claim to be. A sophisticated evasion playbook has emerged: ships disable AIS, spoof GNSS positions, conduct at-sea transfers in poorly monitored stretches of ocean, and change names and flags between port calls. No single commercial data provider covers this kill chain end to end, and those that do operate under licensing terms that exclude sharing with law-enforcement or intelligence consumers without US or EU approval.

A sovereign satellite stack closes the gap. Wide-area SAR detects vessels regardless of AIS status or weather. RF survey payloads fingerprint individual transceivers — MMSI numbers can be changed; radio hardware signatures cannot. Optical imagery confirms vessel silhouette, funnel markings and cargo configuration, enabling cross-epoch comparison as a ship cycles through aliases. Fused against a sovereign entity database and historical track record, the system generates attribution confidence scores that hold up in legal proceedings and diplomatic demarches.

The operational payoff is leverage. A nation that can independently confirm sanction-busting activity does not need to rely on a partner's declassified reporting — it controls the timing and form of disclosure. That matters when the evasion involves a third-country intermediary the partner is reluctant to name, or when the enforcement action has downstream consequences for domestic shipping or energy supply. Sovereign detection capability converts sanctions from a passive list into an active, continuously enforced instrument of foreign policy.

What matters

GNSS spoofing has been documented in the Black Sea, Persian Gulf, and South China Sea, making AIS-based monitoring legally unreliable as sole evidence.
SAR satellite vendors subject to US ITAR or EAR controls can be compelled to withhold tasking or products during escalatory episodes — exactly when demand peaks.
Attribution confidence sufficient for UN Security Council reporting requires a verifiable, unbroken chain of custody from raw sensor to finished intelligence that a third-party SaaS arrangement cannot guarantee.
Re-flagging a vessel takes days; a sovereign RF fingerprint database invalidates the alias immediately because the radio hardware signature is persistent across name changes.

Sovereignty score: 9/10 — A nation that depends on allied commercial imagery to prove sanctions evasion surrenders both the timing and the political terms of enforcement to the provider's government.

US and EU export controls on SAR and RF satellite data products can be selectively withheld during diplomatic crises, leaving enforcement agencies blind precisely when political pressure to act is highest.
Evidence presented at the UN Security Council or in domestic courts must have a sovereign, auditable provenance chain; SaaS analytics products with opaque processing pipelines fail that standard.
Sanctions targets increasingly include intermediary states with close ties to major data-broker nations, creating structural conflicts of interest that a sovereign system is designed to bypass.
Domestic energy security and trade continuity mean that a nation may need to enforce sanctions selectively or at a pace it controls — impossible if the intelligence feed is operated by a foreign commercial entity subject to that partner's foreign policy priorities.

Reference architecture

Payload: Dual-mode: (1) X-band SAR, 3m STRIPMAP / 1m spotlight, 50km swath for dark vessel detection; (2) RF survey payload, 100 MHz to 6 GHz, covering AIS (161/162 MHz), VSAT uplinks and radar emissions, 2km geolocation accuracy via TDOA/FDOA across three-satellite clusters
Bus class: ESPA-class microsat, 150–180kg, 600W payload power; SAR and RF payloads share bus on alternating operational modes to manage power budget
Orbit: Sun-synchronous LEO at 520–560km; 18-satellite walker constellation providing global coverage with median revisit of 3 hours over high-priority ocean zones; 6-satellite RF cluster subset flying in tight formation (≤200km separation) for TDOA geolocation
Ground segment: 4-station national network (X-band downlink for SAR, S-band TT&C) co-located with existing naval communications infrastructure; encrypted uplink for tasking commands; SatNOGS amateur-band beacon as contingency health monitor only
Software & data
Latency
Cost band
Lead time

References

UN Panel of Experts on DPRK — Report S/2024/215 — The Panel documents systematic use of AIS manipulation, ship-to-ship transfers, and flag-hopping by vessels supplying the DPRK ballistic missile programme. Satellite SAR and optical imagery are cited as the primary means of detection.
IMO Circular MSC-FAL.1/Circ.3 — Guidance on Maritime Cyber Risk Management — IMO acknowledges that GNSS integrity and AIS authenticity are vulnerable to deliberate manipulation, undermining flag-state accountability for vessel movements.
OFAC Sanctions Compliance Guidance for the Maritime Industry — The US Treasury's OFAC explicitly lists AIS manipulation, physical flag changes, and falsified cargo documentation as high-risk indicators of sanctions evasion requiring enhanced due-diligence monitoring.
HawkEye 360 — RF Maritime Analytics — HawkEye 360 demonstrates that cluster-based RF geolocation from small-satellite constellations can persistently track vessel radio emitters independently of AIS, providing ground-truth positioning for dark vessel detection.
ICEYE — Persistent Monitoring for Maritime Sanctions Enforcement — ICEYE's SAR microsatellite constellation provides sub-metre spotlight imagery in all weather conditions, enabling detection and identification of vessels conducting at-sea transfers in remote ocean areas relevant to sanctions evasion.