This content is not available in your region

HMS Defender: AIS spoofing is opening up a new front in the war on reality

British destroyer HMS Defender arrives at the port of Batumi, Georgia.
British destroyer HMS Defender arrives at the port of Batumi, Georgia.   -   Copyright  AP/Georgian Interior Ministry
By Tom Bateman

An incident involving a British warship off the coast of Russian-occupied Crimea on June 24 may have begun online - with a virtual voyage that never really happened.

HMS Defender made headlines after sailing 12 km off the Crimean coastline. The Kremlin regards those waters as Russian territory. For much of the rest of the world, they belong to Ukraine.

Russia's Defence Ministry claimed it fired warning shots and dropped bombs to deter the Royal Navy vessel. Britain's Ministry of Defence denied those claims.

A BBC reporter on board HMS Defender said the ship was harassed by Russian fighter jets and coastguard vessels.

But data sourced from ship tracking site Marine Traffic shows the two sides may have engaged in what one expert called "virtual naval diplomacy" even before Thursday's incident.

The voyage that didn't happen

In the early hours of June 19, the site's tracking data showed the HMS Defender and a Dutch frigate, HNLMS Evertsen, approaching the port of Sevastopol in Crimea.

The strange thing is, they weren't there.

A live webcam feed showed both ships were actually docked roughly 300 km away in Odessa, Ukraine, at the time Marine Traffic showed them approaching Russian-controlled territory.

Marine Traffic allows users to track global shipping traffic using publicly available Automatic Identification System (AIS) data. Ships above a certain size are required to transmit AIS data containing their GPS coordinates, course, and speed.

How do you spoof AIS?

Shipping transparency watchdog Global Fishing Watch told Euronews Next that faking a ship's position was complicated but possible.

I suspect it's sending a signal to the Royal Navy and to the crew on HMS Defender and the Dutch frigate. The message that we know what you're up to, and we're ready for you.
Anders Puck Nielsen
Naval analyst, Royal Danish Defence College

"Some AIS units are consistently giving offset or flipped coordinate values. This is very easy to spot since it results in ship tracks in impossible locations, in the Himalayas, over Antarctica," Global Fishing Watch data analyst Bjorn Bergman said.

"In some more unusual cases, we get false AIS positions resulting from the ship receiving manipulated or scrambled GPS information. It's also possible for an AIS track to be entirely simulated and imputed into the data stream from a terrestrial AIS receiver".

Fake ships, real conflict

Anders Puck Nielsen, a naval analyst at the Royal Danish Defence College, told Euronews Next an unknown actor placed the virtual voyage on Marine Traffic as a warning.

"I suspect it's sending a signal to the Royal Navy and to the crew on HMS Defender and the Dutch frigate. The message that we know what you're up to, and we're ready for you," he said.

"It’s about deploying disruptive power," said another military expert who commented to Euronews Next on the condition of anonymity.

AIS spoofing isn't just an issue in the Black Sea. Swedish naval vessels operating in the Baltic Sea encountered a similar spoofing incident earlier this year when AIS data inaccurately suggested they were in Russian waters off Kaliningrad.

Sweden's armed forces took the incident seriously.

"It is important that the publicly available information is correct, as errors can affect confidence in the authority," they said in a statement published in March.

"Information manipulation and disinformation is constantly happening in various ways in our society without us always being aware of it".

The future of warfare

For Puck Nielsen, Defender and Evertsen's faked trip to Sevastopol hints at the emergence of a new kind of conflict.

"This Marine Traffic thing makes me think, are we seeing a concept of virtual naval diplomacy where they sort of virtually send a warship through their waters," he said.

Vessels involved in illegal activity often hide their identity when broadcasting AIS.
Bjorn Bergman
Data analyst, Global Fishing Watch

"I guess it's a variation of what we see with Facebook and Twitter and social media, in general, being manipulated for different purposes. We need to learn that we can't always trust this information".

While the Crimea incident shows how falsified AIS data has become part of the information war between global powers, for Global Fishing Watch's Bergman, AIS spoofing is tied to real-life criminal activity.

"Vessels involved in illegal activity often hide their identity when broadcasting AIS," he said.

One vessel pursued by Interpol for illegally catching toothfish attempted to evade detection by scrambling its AIS identifiers with those of other ships, Bergman said.

"However the position information the vessel broadcast did continue to be accurate, allowing their location to be passed to the Indonesian Navy who captured the vessel," he added.

Euronews Next has contacted Marine Traffic for comment on this story.