For years, ships wanting to hide their whereabouts have resorted to turning off the transponders all large vessels use to signal their location. But the tankers tracked by The Times go beyond this, using cutting-edge spoofing technology to make it appear they’re in one location when they’re really somewhere else.
During at least 13 voyages, the three tankers pretended to be sailing west of Japan. In reality, they were at terminals in Russia and shipping oil to China.
The vessels are part of a so-called dark fleet, a loose term used to describe a hodgepodge array of ships that obscure their locations or identities to avoid oversight from governments and business partners. They have typically been involved in moving oil from Venezuela or Iran — two countries that have also been hit by international sanctions. The latest surge of dark fleet ships began after Russia invaded Ukraine and the West tried to limit Moscow’s oil revenue with sanctions.
[...]
To date, it’s been rare to prove the true location of a ship pretending to be somewhere else. But a Times analysis of publicly available shipping data, satellite imagery and social media footage helped clearly establish that the tankers were not where they claimed to be.
The ships most likely sell their Russian oil to China above a price limit set by the sanctions. Since neither country recognizes the sanctions, the tankers themselves are not in violation by spoofing or carrying the oil.
But the tankers still have motive to spoof: to maintain their insurance coverage, without which they cannot operate in most major ports. The only insurers financially able to cover tankers are mostly based in the West and bound by the sanctions. If a client ship were to carry Russian oil that’s sold above the price limit, the Western insurer would be in violation of the sanctions and must drop its coverage.
“It’s significant when you look at dollar terms,” said Samir Madani, co-founder of TankerTrackers.com, which monitors global shipping, who first alerted The Times to several of the suspicious ships. “It’s around $1 billion worth of oil that is going under the radar while using Western insurance, and they’re using spoofing in order to preserve their Western insurance.”
[...]
There has been at least one change since The Times approached the company with evidence of spoofing. The website had said the Cathay Phoenix’s current policy would expire in February 2024. But recently, the expiration date suddenly shifted much earlier to June 2023. The company would not comment on the reason for the change.
(After this story was published, the coverage expiration for another tanker The Times found spoofing, Eternal Peace, was also changed to June from February 2024.)
[...]
To carry out their deception, the tankers can use military-grade equipment, or software, that is now commercially available. This technology makes it possible to manipulate a vessel’s reported location, which is broadcast by an automatic identification system, or AIS. The signals communicate a ship’s identification, location and route over a radio frequency picked up by other vessels, ground stations and satellites.
For all the sophistication of the spoofing technology, there can be telltale signs for when it is being used, among them, odd geometric patterns in a ship's AIS data — like the course seemingly carved by the Cathay Phoenix off Japan. Experts believe this may at times be the software’s attempt to mimic a vessel at anchor.
[...]
Beyond monitoring for AIS abnormalities, O.F.A.C. also advises insurers to investigate the corporate histories of vessels in high-risk areas for sanctions evasion. The agency warns that ship owners may try to avoid scrutiny by using “complex business structures, including those involving shell companies.”
Mr. Tannenbaum said a good time for insurers to look for warning signs was during the creation or renewal of a tanker’s policy.
“These are all common, standard ‘know your customer’ practices that should be applied,” he said. “This is your opportunity to see if this is a bad apple ahead of time or not.”
From the article:
[...]
[...]
[...]
[...]