Open-source intelligence (OSINT) for maritime domain awareness: a practical guide

Open-source intelligence at sea is not a data-shopping exercise — it is a discipline of fusion and verification. The feeds are public; the skill is turning them into a corroborated, defensible assessment without fooling yourself. This guide walks the workflow we use, the signals worth chasing, and the traps that produce confident nonsense. For the feeds themselves, start with the open datasets catalog; for definitions, the MDA glossary.

The workflow: collection → fusion → verification → assessment

Good maritime OSINT is a loop, not a lookup.

1. Collection. Pull the relevant open feeds for your area of interest — AIS, SAR and optical imagery, metocean, thermal, registries, reporting. Breadth matters because the decisive fact usually lives between feeds.
2. Fusion. Bring the feeds onto one timeline and one map. A vessel’s AIS track, the SAR pass over the same water, the weather at that hour, and the news that week are only meaningful together.
3. Verification. Actively try to break each finding — is the gap really evasion, or thin coverage? Is that track real, or spoofed? Corroborate across independent sources.
4. Assessment. State a conclusion with its confidence and its evidence lineage, and name what you could not verify. An honest I don’t know beats a confident error.

This is exactly the dashboards-to-investigations shift — and it is what tool-using agents now make practical at speed.

The signals that matter

• AIS gaps. A vessel transmitting, going silent, then reappearing is the core evasion signal — but only after you normalise against expected satellite coverage, or you will flag every mid-ocean coverage hole.
• Loitering and rendezvous. Two vessels at low speed, co-located offshore, is a candidate ship-to-ship (STS) transfer — a hallmark of sanctioned-cargo movement.
• Dark ships (SAR × AIS). A Sentinel-1 radar detection with no matching AIS return is a vessel present but silent. This is the single most powerful open signal, because radar does not care whether the transponder is on. See detecting dark vessels.
• AIS spoofing. Impossible speeds, teleporting or circular tracks, land-locked positions, and duplicated or zero MMSIs betray manipulated identity. See AIS spoofing in the shadow fleet.
• Thermal anomalies. NASA FIRMS hot spots near ports and industrial coasts are a rough activity proxy — flaring, refineries, sometimes vessels.
• Reporting corroboration. Dated news tells you where attention is; used to confirm a physical signal, not to originate one.

Fusing them into a finding

Take the canonical question — “what was this tanker doing during its AIS gap?” No single feed answers it; the fusion does:

1. AIS: isolate the gap window, normalised against coverage.
2. SAR: pull the Sentinel-1 pass for that time and place; look for a detection with no transponder.
3. Association: match detections to AIS; the unmatched one is your candidate. Optical confirms in clear sky.
4. Metocean: was it loitering, or holding station in heavy seas? Context separates intent from circumstance.
5. Registry: resolve identity and ownership across MMSI and IMO; check any co-located vessel for a shared manager or sanctions link.

The output is one explained conclusion with evidence from every layer.

The traps (how OSINT goes wrong)

• Coverage-not-evasion. The most common false positive: an AIS gap that is really a satellite coverage hole. Always normalise.
• Spoofing taken at face value. A plausible track can be fabricated. Check for physically impossible movement and MMSI anomalies before trusting a position.
• Attention as truth. A news spike is a hypothesis, not a finding. Corroborate with a physical signal.
• False precision. Open imagery is coarse; do not claim a vessel count or classification the resolution cannot support. Say “no corroborating pass available” when that is the truth.

Naming these limits is not a weakness of the assessment — it is the assessment’s credibility.

Where open OSINT scales up

Open methods get you a real, defensible picture — and a sampled one. Free AIS is rate-limited; open SAR revisit is multi-day; you catch a slice of events, not all of them. The same workflow, run on licensed satellite AIS and high-revisit commercial SAR, turns sampling into persistent monitoring — and fine-tuned, multispectral-aware models sharpen detection and classification beyond what a generalist model can do. That transition is the subject of from open source to operational and fine-tuning multispectral maritime models.

---

Watch the OSINT workflow running live on open data at live.marineaware.com. To run it on licensed feeds with custom agents and fine-tuned models for your mission, talk to us.