Going dark: a field guide to how the shadow fleet hides on AIS

When the G7 introduced a price cap on Russian oil in December 2022, it created an incentive worth billions: move crude above the cap without touching Western insurance, finance or services. The response was a shadow fleet — hundreds of aging tankers, opaquely owned, that trade outside the mainstream system. And because trading in the shadows means defeating the one system built to make ships visible, the shadow fleet has become the world’s most active laboratory for AIS manipulation.

This is a field guide to how it is done, and how it is caught. (For the strategic picture — the fleet’s size, why P&I withdrawal is the sharpest lever — see our companion piece, what is the dark fleet.)

The four techniques

Almost everything the shadow fleet does to AIS falls into four families.

1. Going dark

The simplest move: switch the transponder off. A vessel that was broadcasting goes silent — typically around a loading at a sanctioned port or a ship-to-ship transfer — then reappears later, “clean,” some distance away. The gap is the point: it breaks the continuous track that would otherwise link the cargo to its origin.

Going dark is also the crudest move, because a gap is itself a signal. A tanker that reliably vanishes for eighteen hours near a known transfer zone and reappears riding lower in the water has told you a great deal precisely by telling you nothing.

2. Location spoofing

More sophisticated is to keep broadcasting, but to broadcast a lie. Location spoofing transmits a falsified GPS position so the vessel appears somewhere it is not — loitering innocently in one sea while physically loading in another. The tell is physical impossibility: tracks that trace neat circles, “teleport” hundreds of miles between pings, or run across dry land. Global Fishing Watch has documented tankers falsifying their AIS positions to conceal entry into Russian Black Sea ports — a clean example of the technique in service of sanctions evasion.

A related problem is upstream GNSS spoofing and jamming, heavy near certain Russian export terminals and in conflict zones, which corrupts the real position feeding the transponder. The effect on the data looks similar; the intent differs.

3. Identity manipulation

An MMSI number is software-mutable and an AIS-broadcast ship name is just text, so both can be forged. Shadow-fleet vessels have broadcast the identity of another ship, a scrapped ship, or a duplicated “pirate” MMSI — muddying which hull is actually where. This is why serious analysis never trusts the broadcast identity alone and instead resolves identity across the stable IMO number and multiple registries.

4. Disguised transfers

The point of most of the above is the ship-to-ship (STS) transfer — moving cargo between vessels at sea so a “dirty” cargo boards a “clean” ship. STS transfers cluster in known areas (off Greece, off West Africa, off Malaysia), and detecting them means spotting two vessels holding station together, often with one or both showing gaps or spoofed positions during the rendezvous.

Why AIS manipulation is self-defeating — eventually

Here is the paradox the shadow fleet cannot escape: every technique for hiding on AIS creates its own signature. A gap is a signal. An impossible track is a signal. A borrowed identity is a signal. The manipulation does not make a vessel invisible; it makes it anomalous — and anomalies are exactly what a well-built detection pipeline looks for.

The trick is to stop treating AIS as ground truth and start treating it as a claim to be checked:

• Kinematic plausibility. Is this track physically possible for this ship? Circles, jumps and land crossings fail the test.
• Coverage-normalised gaps. Is this silence meaningful, or just thin satellite coverage? A gap only counts once normalised against the coverage expected in that patch of ocean.
• Non-cooperative corroboration. Satellite radar (SAR) sees a hull whether or not it is broadcasting. A radar detection with no matching AIS return is a candidate dark ship. This AIS-gap-to-SAR fusion is the backbone of detecting a vessel that has turned off its AIS.
• Identity and network resolution. Resolve MMSI to IMO to beneficial owner across registries, and map the ownership network — the shell structures behind sanctioned tonnage tend to reuse the same patterns.

Why it matters beyond sanctions

The tradecraft catalogued here is not confined to oil. The same techniques — going dark, spoofing, false identity — reappear wherever a vessel wants to act unseen: in illegal fishing, in the Red Sea where ships hid to avoid attack, and in the Baltic where vessels implicated in cable damage overlap heavily with the sanctioned shadow fleet. Understanding how ships lie on AIS is, increasingly, a general-purpose maritime skill.

By 2024, the EU, UK and US were sanctioning shadow-fleet vessels by name in the hundreds — a recognition that the fleet had become systemic. Each listing is, in effect, the end of a detection story: a vessel whose anomalies finally added up. Our dark-fleet and sanctions screening work is about getting to that conclusion earlier — scoring the behaviour before the cargo is lifted, not after the ship is designated.

The shadow fleet’s bet is that the ocean is too big and the data too noisy to catch them. The counter-bet — the one worth making — is that hiding leaves a trace, and that the trace is readable.

---

Sources: G7/EU oil price cap documentation (Dec 2022); Global Fishing Watch analysis of AIS falsification into Russian Black Sea ports; EU/UK/US shadow-fleet vessel designations (2024); contemporaneous reporting and academic analysis of AIS spoofing. Figures are widely reported estimates.