Sanctions Evasion Reference

What is AIS manipulation and AIS spoofing?

Disabling a ship's position transponder, or transmitting false position data through it, so that the vessel's recorded track does not show where it actually went.

category

Maritime

also known as

AIS spoofing, going dark, transponder manipulation, dark activity

seen in

Islamic Republic of Iran, Democratic People's Republic of Korea, Russian Federation, Syrian Arab Republic

reviewed

2026-08-20

The Automatic Identification System is a transponder that broadcasts a vessel’s identity, position, course and speed. It was designed for collision avoidance — so that ships can see each other — and only incidentally became the world’s primary record of where ships go.

That design origin matters. AIS is a self-reported broadcast. The vessel transmits what its equipment is set to transmit, and there is no verification of any kind built into the system.

How it works

There are two distinct behaviours, and conflating them causes most of the confusion in this area.

Disabling. The transponder is switched off and the vessel disappears from the record. This is permitted in defined circumstances. The 2020 advisory records that the Safety of Life at Sea convention requires certain classes of vessel on international voyages to operate AIS at all times with few exceptions1 , and acknowledges that safety issues may at times prompt legitimate disablement, and that poor transmission may otherwise occur2 . The exception is genuine, which is what makes gaps ambiguous.

Spoofing. The transponder transmits false data — a false position, a false identity, or both. Here there is no legitimate version. A vessel broadcasting a position it is not at, or an identity that belongs to another ship, is making a false statement.

The 2020 advisory describes manipulation of AIS data — spoofing — as broadcasting a different name, IMO number, MMSI or other identifying information3 . The 2023 Price Cap Coalition advisory supplies the monitoring formulation: industry should vigilantly monitor irregular AIS patterns or data that are inconsistent with actual ship locations4 .

Identity manipulation

The related behaviour is manipulation of the identity a vessel transmits or displays. A ship’s IMO number is assigned to the hull for life and does not change with name, owner or flag, which is exactly why it is the identifier that designation entries use.

Physical alteration of that marking has no innocent version, and the advisories name it directly. The 2018 North Korea vessel advisory lists physically altering vessel identification5 as a tactic, describing the painting over of vessel names and IMO numbers with alternate ones6 ; the 2020 global advisory records the same practice7 .

Why the absence of data is itself evidence

The intuitive assumption is that a vessel which stops transmitting becomes invisible. In practice a gap is highly informative, because it is bounded.

A vessel that stops transmitting at a known position and resumes at another known position has defined a region and an interval. Its speed capability limits where it can have been. Its draught before and after indicates whether cargo moved. Its bunkering and port records may place it somewhere its track does not. Independent observation — satellite imagery, coastal radar, other vessels’ reports — can fill the interval.

The result is that a well-documented gap frequently produces a stronger inference than the transmitted track would have, because it shifts the burden: the vessel has to account for an interval it chose to leave unrecorded.

last position transmission resumes gap: bounded interval Bounded by: speed capability of the vessel Bounded by: draught before/after — whether cargo moved Narrowed by: independent observation — satellite imagery, other vessels' reports
A schematic timeline, not a track: this site carries no vessel-level position data. The interval between a vessel's last transmitted position and its next has a defined start and end, and what can have happened inside it is limited by what the vessel physically is and does.

How it is caught

Gap analysis. Recurrence is the signal. A single gap is weather, equipment or a safety judgement. A vessel with repeated gaps, all coinciding with voyages to the same area, is displaying a pattern.

Physical inconsistency. Transmitted data is checked against what the vessel physically is and does: speed against capability, draught against declared cargo, position against port and bunkering records.

Independent observation. Position data the vessel did not choose to broadcast can be obtained elsewhere. The 2023 advisory recommends that where there are AIS outages or suspected manipulation, stakeholders with access to long-range identification and tracking use it to establish a vessel’s true location8 , and treats combining the two as a best practice.

Reconstruction against the voyage. The UN Panel of Experts documented the pattern in detail: route detours almost always involved manipulating AIS transmissions9 while loading in one port before rejoining the original route and reactivating the system in time for delivery. The Panel lists AIS manipulation alongside loitering, voyage deviations and fraudulent documentation10 as a single combination of tactics.

Cross-vessel contradiction. Two vessels cannot occupy the same position, and a transmitted identity that belongs to a ship documented elsewhere is self-refuting.

Which vessels display these patterns, and their ownership and registry histories, is vessel- level reference work and is kept on the sister site.

What the sources say

Each numbered claim above, with the words of the document it rests on and — for the Panel of Experts reports — the paragraph it comes from. Quotes are checked against the source text at build time.

  1. “solas) requires that certain classes of vessels traveling on international voyages operate ais at all times with few exceptions”

    Guidance to Address Illicit Shipping and Sanctions Evasion Practices. U.S. Department of State, U.S. Department of the Treasury and U.S. Coast Guard, 2020.

  2. “although safety issues may at times prompt legitimate disablement of ais transmission”

    Guidance to Address Illicit Shipping and Sanctions Evasion Practices. U.S. Department of State, U.S. Department of the Treasury and U.S. Coast Guard, 2020.

  3. “manipulating ais data”

    Guidance to Address Illicit Shipping and Sanctions Evasion Practices. U.S. Department of State, U.S. Department of the Treasury and U.S. Coast Guard, 2020.

  4. “irregular ais patterns or data that are inconsistent with actual ship locations”

    Sanctions Advisory for the Maritime Oil Industry and Related Sectors. U.S. Department of the Treasury, Office of Foreign Assets Control, 2023.

  5. “physically altering vessel identification”

    North Korea Vessel Advisory: Sanctions Risks Related to Shipping with North Korea. U.S. Department of the Treasury, Office of Foreign Assets Control, 2018.

  6. “painting over vessel names and imo numbers with alternate ones”

    North Korea Vessel Advisory: Sanctions Risks Related to Shipping with North Korea. U.S. Department of the Treasury, Office of Foreign Assets Control, 2018.

  7. “painted over vessel names and imo numbers to obscure their identities”

    Guidance to Address Illicit Shipping and Sanctions Evasion Practices. U.S. Department of State, U.S. Department of the Treasury and U.S. Coast Guard, 2020.

  8. “in instances of ais outages or suspected ais manipulation”

    Sanctions Advisory for the Maritime Oil Industry and Related Sectors. U.S. Department of the Treasury, Office of Foreign Assets Control, 2023.

  9. “Route detours almost always involved manipulating Automatic Identification System transmissions”

    Report of the Panel of Experts established pursuant to resolution 1874 (2009). United Nations Security Council, 2018, para. 50.

  10. “manipulation of the Automatic Identification System, loitering, voyage deviations and fraudulent documentation”

    Report of the Panel of Experts established pursuant to resolution 1874 (2009). United Nations Security Council, 2018, para. 32.

Red-flag indicators

8 listed
01 AIS data is manipulated so that a ship broadcasts a different name, IMO number, MMSI or other identifying information — a practice referred to as spoofing. OFAC, State and U.S. Coast Guard, 2020
“manipulating ais data”

OFAC, State and U.S. Coast Guard, Guidance to Address Illicit Shipping and Sanctions Evasion Practices (2020). Read the source document

02 Transmitted AIS patterns or data are inconsistent with the ship's actual location. Price Cap Coalition, 2023
“irregular ais patterns or data that are inconsistent with actual ship locations”

Price Cap Coalition, Price Cap Coalition Advisory for the Maritime Oil Industry (2023). Read the source document

03 Ship-to-ship transfers are conducted at night or in areas assessed as high risk for sanctions evasion, concealing the origin or destination of the cargo. OFAC, State and U.S. Coast Guard, 2020
“ship-to-ship (sts) transfers”

OFAC, State and U.S. Coast Guard, Guidance to Address Illicit Shipping and Sanctions Evasion Practices (2020). Read the source document

04 Vessel names and IMO numbers have been painted over with alternate ones so the ship can pass itself off as a different vessel. OFAC, 2018
“painting over vessel names and imo numbers with alternate ones”

OFAC, North Korea Vessel Advisory (2018). Read the source document

05 A vessel physically alters the identification it is required to display on its hull or superstructure. OFAC, 2018
“physically altering vessel identification”

OFAC, North Korea Vessel Advisory (2018). Read the source document

06 A vessel navigates suspicious deviations in route — changes with no legitimate reason to go off-route, such as unsafe ports, extreme weather or emergencies. OFAC, State and U.S. Coast Guard, 2020
“suspicious deviations in routes”

OFAC, State and U.S. Coast Guard, Guidance to Address Illicit Shipping and Sanctions Evasion Practices (2020). Read the source document

07 Malign actors disguise the ultimate origin or destination of cargo by indirect routing, unscheduled detours, or transit through third countries. OFAC, State and U.S. Coast Guard, 2020
“voyage irregularities”

OFAC, State and U.S. Coast Guard, Guidance to Address Illicit Shipping and Sanctions Evasion Practices (2020). Read the source document

08 AIS is disabled for periods inconsistent with the safety convention that requires it to be transmitted. OFAC, 2019
“disabling automatic identification system”

OFAC, Syria Shipping Advisory (2019). Read the source document

Each indicator above is quoted or paraphrased from the advisory or typology report named beside it. Expand a row for the citation. These are recognition aids drawn from published guidance, not a compliance checklist.

How it is detected

A transmission gap is bounded and therefore informative: the positions where transmission stopped and resumed define a region, the vessel's speed capability limits where it can have been within the interval, and draught readings before and after indicate whether cargo moved. Recurrence is what converts a gap from an equipment or safety judgement into a pattern. Transmitted data is separately tested against physical reality — speed against capability, position against bunkering and port records — and against independent observation from satellite imagery, which has repeatedly placed vessels where their own tracks did not. A transmitted identity belonging to a ship documented elsewhere refutes itself.

Enforcement record

Documented outcomes on this site that turned on this technique.
Case Outcome Authority Date Penalty
Adani Enterprises: 35 cargoes of LPG that were not Omani 2023–2026 Settlement OFAC 2026-05-18 $275,000,000

Related techniques

  • What is a ship-to-ship transfer? — Transferring cargo directly between two vessels at sea, rather than through a port, so that the cargo changes hands where there is no port authority, no customs entry and no independent record.
  • What is flag hopping? — Re-registering a ship repeatedly between flag states, often to registries with limited oversight, so that its regulatory history is broken and its documented identity keeps changing.
  • What is a phantom shipment? — A phantom shipment is a trade transaction that is documented, financed and paid in full when no goods, or far fewer goods, were ever shipped. The payment is the entire purpose.
  • What is cargo origin blending? — Mixing, decanting or re-documenting a commodity in transit so that restricted cargo is no longer traceable to its origin and arrives certified as coming from somewhere else.

Where this appears

Sanctions programmes

  • Iran sanctions — A layered set of US, EU and UN measures dating from 1979 and substantially rebuilt after 2018, covering energy, finance, shipping, and proliferation-related procurement.
  • North Korea sanctions — The most comprehensive UN-mandated regime, prohibiting most trade with North Korea, backed by Panel of Experts reporting that documents evasion in unusual detail.
  • Russia sanctions — Measures imposed from 2014 and greatly expanded from 2022, combining designations, sectoral restrictions, export controls and a price cap on seaborne oil.
  • Syria sanctions — US, EU and UK measures restricting dealings with the Syrian government, its energy sector and designated parties, with substantial humanitarian carve-outs.

Jurisdictions in the published record

  • United Arab Emirates — A major re-export hub and financial centre that appears in enforcement records across almost every technique on this site, principally because of the volume of trade that passes through it.

Terms used on this page

  • Automatic Identification System — A mandatory maritime transponder system that broadcasts a vessel's identity, position, course and speed to nearby vessels and shore stations.
  • IMO number — A seven-digit identifier assigned to a ship's hull for life by the International Maritime Organization, which does not change with name, owner or flag.
  • Shadow fleet — A loosely defined group of ageing tankers with opaque ownership and insurance that carry sanctioned or price-capped cargo outside mainstream shipping arrangements.
  • Ship-to-ship transfer — Transferring cargo directly between two vessels at sea or at anchorage rather than through a port terminal.
  • Flag state — The country in which a ship is registered, whose law governs the vessel and which is responsible for inspecting and certifying it.

Further reading and sources

  1. Guidance to Address Illicit Shipping and Sanctions Evasion Practices. U.S. Department of State, U.S. Department of the Treasury and U.S. Coast Guard, 2020. Global maritime advisory, 14 May 2020.
  2. North Korea Vessel Advisory: Sanctions Risks Related to Shipping with North Korea. U.S. Department of the Treasury, Office of Foreign Assets Control, 2018.
  3. Reports of the Panel of Experts, 1718 Committee (Democratic People's Republic of Korea). United Nations Security Council, 2024.
  4. Syria Shipping Advisory: Sanctions Risks Related to Petroleum Shipments to Syria. U.S. Department of the Treasury, Office of Foreign Assets Control, 2019.
  5. Sanctions Advisory for the Maritime Oil Industry and Related Sectors. U.S. Department of the Treasury, Office of Foreign Assets Control, 2023. Price cap advisory, 12 October 2023.