Spoofing and jamming – evolving geopolitical risks for marine insurers

Ongoing geopolitical conflicts across the globe have impacted the world’s international trade - especially the commercial shipping routes through strategic gateways, such as the Bab al Mandab Strait and the Strait of Hormuz. One emerging practice that is causing problems for marine insurers is the multi-layered evasion ecosystem that has evolved with the ultimate aim of disrupting navigation and tracking. 

Spoofing

The Automatic Identification System (AIS) is a short range tracking system which transmits a vessels’ name, position, identification (IMO and MMSI) numbers and speed by using transceivers onboard a vessel, alongside some information which is input manually, such as destination. 

Deliberate or intentional disablement of AIS systems has become a relatively simple and commonly used practice to mask certain operations or activities. This has evolved into spoofing attacks from unwanted third parties. Spoofing occurs when the AIS is manipulated, either by a first or third-party. First party manipulation occurs when an entity related to the ship deliberately manipulates its AIS system, such as the vessel’s captain or corporate body. Third party spoofing arises when the vessel is the unbeknown victim of their AIS being manipulated.  

Third party spoofing has evolved to mimic first party spoofing, making it challenging for insurers to identify genuine victims. However, an assessment of the behaviour of all vessels within the scope of the impacted area can assist in showing whether the interference was a widespread issue and, therefore, potentially the act of a third-party. 

Spoofing was first seen around August 2023 in the Black Sea, and has steadily increased intensity with areas of disruption, usually near conflict zones, ranging from the Baltic to the Arabian Gulf. There are also areas from which any accurate data cannot be obtained and are considered blackout zones, such as the Kerch Strait. 

Spoofing is accomplished in various ways:

• Sanctioned vessels may carry two AIS device numbers which transmit simultaneously.
• There may be an agreement between sanctioned vessels to share AIS numbers to hide their true positions.
• Changing a vessel’s AIS numbers several times during a single voyage.

The analysis of data from the vessel can show that spoofing has occurred, if various patterns are identified:

• Box - The position of a vessel moves in a square pattern.
• No movement - The vessel position appears not to be moving at all, which is impossible.
• Prefect circle - A geometric perfect circular pattern, which is unachievable in reality.

Jamming

This process involves the intentional interference of a vessel’s signal frequency transmission with the purpose of disrupting Global Positioning Systems (GPS) signals which are relied upon for navigation. The jamming device emits powerful radio signals on the same frequency as GPS, overpowering the vessel’s receiver to a point it can no longer operate. 

Generally, jamming is linked to areas of military activity, such as the Baltic Sea, Red Sea, Gulf of Aden, Novorossiysk and Crimea. 

The distance a vessel “jumps” (the change in its position) during a jamming episode can be a few kilometres to several thousand kilometres – and can sometimes appear to disappear altogether. 

Although less complex than spoofing, jamming is still disruptive for vessels navigating in high risk conflict areas. Some vessels are deliberately using this practice to evade sanctions by trying to avoid detection, resulting in innocent vessels being affected. Some vessels are also being intentionally targeted to disrupt their intended voyage.

Motives 

Spoofing and jamming can be used for various reasons and “dark periods” can last days or months. Motives include:

• Illicit oil trades (at port or ship to ship). 
• Create confusion and disruption, for example, whilst cutting undersea cables.
• Vessels may want to appear in a reputable port or enroute to a recorded destination, when their true location is elsewhere.

Whilst the motives can be on the ‘darker’ side, it is usually those innocent parties that suffers the most.  A shipper will simply want his goods to be shipped from A to B, yet could find itself in a complex deception with no opportunity to recover its goods.

Innovative solutions

Although challenging, international regulators, such as the International Maritime Organisation (IMO), Office of Foreign Assets Control (OFAC), and the Financial Action Task Force (FATC) are attempting to fight back and are using real time AIS, satellite imagery, human intelligence, and pattern-based analysis to detect spoofing and tackle jamming.

The industry needs to embrace innovative solutions in order to mitigate the impact of these dangerous and deceptive practices:

• Ship owners and vessel operators are encouraged to implement robust risk assessments and crew training to identify GPS interference indicators. 
• Utilising non electronic vessel position fixing techniques, such as cross referencing  visual bearings and water depth to authenticate GPS information. 
• Avoid the reliance on one source of GPS by installing multi frequency and multi constellation global navigation satellite system receivers, allowing a vessel to alternate between different satellite networks. 
• Increased collaboration between authorities and nations. 
• Continued development of alternative technologies for positioning systems.

Insurers would be wise to look into these solutions and check whether their insured’s are taking note of the potential risks when, for example, contracting with vessels for the movement of cargo.  Does the vessel have evidence of procedures in place to mitigate the risks? 

Comment 

The aftermath of a jamming and/or spoofing incident can leave the policy holder exposed to a potentially large outlay or total loss in relation to any claims made during the interference duration. Examples include:

• Delays in cargo reaching their destination
• Vessels colliding and exploding, sustaining damage and injury to crew and cargo
• Vessels straying into traps where the cargo is seized and/or vessel detained
• Oil spills
• Vessels getting stuck in shallow waters impacting the cargo, i.e. perishable products
• A legally operating vessel colliding with an uninsured shadow fleet vessel. 

Insurers are now being asked to consider cover for such incidents and will need to carefully assess whether such losses are covered.  Cargo policies and liability policies will certainly be expected to keep up with the ever changing landscape, with incidents not necessarily flowing from the usual chain of events.  Insurance policies are expected to cover cargo losses where there is, for example, damage incurred during shipment.  However, what happens when that damage is due to jamming or spoofing?  With claims no doubt increasing due to incidents perhaps not first envisaged by insurers, wordings will need to be reviewed.

The increase of these incidents highlights the fast paced evolution of evasion techniques being utilised and the importance of keeping abreast of procedures to mitigate and/or prevent such interference and disruption to international trade.

Related item: Behind the flags: The role of flag hopping as a deceptive shipping tactic