Maritime Piracy: Mission Domain Intelligence Guide

Piracy risk is not a map. It is a product of monsoon windows, mothership range, freeboard and speed, and how many crew a syndicate thinks it can hold before the ransom market closes.

What Maritime Piracy covers as a mission domain

Maritime piracy intelligence is the focused study of armed robbery at sea, hijacking, and kidnap of crew for ransom. It differs from broader maritime security in that the unit of analysis is an attack event and the actors are organised criminal groups with identifiable operating patterns, ranges and business models. Practitioners maintain incident baselines by region, characterise attack profiles, model the environmental windows that permit small-boat operations, and support ship operators, insurers and naval task forces with route advice, hardening posture recommendations and post-incident reconstruction.

The regional models differ sharply. Gulf of Guinea activity has historically emphasised crew kidnap for ransom well offshore, Southeast Asian incidents cluster as low-violence opportunistic boarding in narrow straits, and the Somali basin pattern involved long-range hijack of whole vessels using motherships. Actors range from local fishing communities operating opportunistically to organised syndicates with negotiators, financiers, safe houses ashore and information sources inside ports and agency offices.

Why it matters

A single crew kidnap can hold seafarers for months and costs operators far more in negotiation, insurance and delay than the cargo is worth. Elevated risk area designations reprice war-risk premiums across whole regions and change routing for thousands of transits, with knock-on cost to importing economies. Seafarer welfare is the direct human stake. Naval task forces and coastal states allocate scarce patrol assets based on exactly this analysis, so baseline accuracy has operational consequence.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Attack positions drifting steadily further offshore, which normally indicates mothership use or an extension of small-boat operating range.
Approach without boarding incidents rising while successful boardings stay flat, a sign of improved hardening or increased naval presence.
Incidents clustering by target profile: low freeboard, slow transit speed, anchored or drifting vessels awaiting berth.
Seasonal alignment with monsoon and swell windows, since small-boat operations become impractical above roughly moderate sea states.
Shifts from cargo and property theft toward crew abduction, indicating a change in business model and a step up in violence risk.
Anchorage waiting times lengthening at a congested port, which reliably increases opportunistic boarding of stationary vessels.
Evidence of shoreside information leakage: attackers arriving with knowledge of cargo, crew nationality or transit timing.
Insurance war-risk area boundary changes and revised flag state advisories, which both reflect and reshape observed activity.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

ICC International Maritime Bureau Piracy Reporting Centre — Live incident reports and quarterly and annual statistics with position, vessel type and attack description.
ReCAAP ISC — Asian regional incident reporting and analysis, with weekly reports and classification by severity level.
UKMTO — Voluntary reporting scheme advisories and incident alerts for the Indian Ocean, Gulf and Red Sea regions.
MDAT-GoG — Maritime Domain Awareness for Trade in the Gulf of Guinea, incident alerts and regional guidance for operators.
IMO GISIS piracy and armed robbery module — Official reported incidents by member states with location, consequence and follow-up action.
Joint War Committee listed areas — Insurance market designation of hull war, piracy and terrorism listed areas, updated as risk changes.
BMP5 and industry best management practice guidance — Consensus protective measures and reporting procedures used as the benchmark for vessel hardening assessment.
AIS platforms and Global Fishing Watch — Track reconstruction around incidents and detection of anomalous small-vessel behaviour near reported positions.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Build the incident baseline — Consolidate reports from IMB, ReCAAP, UKMTO and MDAT-GoG, deduplicate carefully, and geocode every event with reporting source retained.
Characterise attack profiles — Classify by weapons, boarding method, time of day, vessel type, freeboard, speed and outcome to derive the operating pattern.
Model the environmental window — Overlay sea state, monsoon season and moon phase against incident timing to identify when small-boat operations are actually feasible.
Estimate range and reach — Derive plausible operating radii from launch points and any mothership indicators, and express risk as a reach envelope rather than a hotspot.
Assess vessel-specific exposure — Score the transit against the profile: freeboard, speed, watch posture, hardening measures and planned anchorage or drift time.
Advise routing and posture — Recommend transit timing, distance offshore, reporting scheme registration and hardening consistent with current best management practice.
Reconstruct post-incident — Rebuild the event from track data, crew accounts and imagery to update the baseline and support prosecution or insurance claims.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Criminal Intelligence — Intelligence Supporting Criminal Investigation
Geospatial Intelligence — Intelligence Derived from Place
Risk Intelligence — Structured Assessment of Threat and Consequence
Human Intelligence — Information from People, Ethically Obtained
Radio Frequency Intelligence — The Electromagnetic Spectrum as an Intelligence Source

Worked in these data points

Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
GPS Coordinates — Precise latitude/longitude coordinates identifying an exact point on Earth — the atomic unit of GEOINT analysi
Person / Name — A named individual — the subject of identity resolution and profiling.
Radio Callsign — A licensed radio identifier for a station, vessel, aircraft, or operator.

Adjacent mission domains

Inside the platform: where Maritime Piracy lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

domain.php?d=piracy — Maritime Piracy dashboard
theater.php?d=piracy — Threat theater view
domain.php?d=mar — Vessel / Ship profile
search.php — Person / Name profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Maritime Piracy:

Sanctions Screening & Escalation — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Correlate Infrastructure
Run Alert Rules
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Build the incident baseline is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Model the environmental window turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Reconstruct post-incident feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Maritime Piracy

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Naval and task force analysts use piracy intelligence for patrol allocation, escort and convoy planning, and boarding team readiness. The analytic products that matter are attack profile models by region, environmental windows that permit small-boat operations, and mothership range estimates that define the threat envelope offshore. Incident baselines support force laydown decisions and measure whether presence is displacing or suppressing activity. Products feed maritime security operations planning and force protection. Constraints include rules of engagement, the legal basis for interdiction and detention at sea, and the requirement to hand detainees into a prosecution chain that many regional states are unwilling or unable to support.

🕵 National intelligence

National intelligence interest covers the organised networks behind kidnap for ransom, their financiers, negotiators and shore-based support, the informants inside ports and shipping agencies who identify targets, and the ransom payment chains. Fusion combines incident reporting, vessel movement data, financial intelligence and human reporting. Because incident data is largely open and shared through industry reporting centres, the classified value lies in network structure and finance rather than in event counts. Judgments should distinguish between opportunistic activity and organised syndicate operations, since the policy responses differ entirely.

👮 Law enforcement

Prosecution of piracy and armed robbery at sea requires careful evidence handling from the moment of interdiction: seized equipment, position records, crew testimony, communications and forensic material, all preserved in conditions that are physically hostile to evidence. Jurisdiction is the central problem, since universal jurisdiction over piracy on the high seas coexists with regional states unwilling to prosecute. Transfer agreements, flag state cooperation and mutual legal assistance all feature. Shore-based investigation of financiers and negotiators is where cases against the organisation are made, and it depends on financial intelligence and telecommunications evidence obtained lawfully.

🔍 Private investigation and corporate security

Marine insurers, shipping companies and security consultancies use piracy analysis for transit risk scoring, hardening recommendations, escort and armed guard decisions, and war risk premium negotiation. Work covers route-specific exposure by vessel profile, hardening posture assessment against current attack methods, and post-incident support. Private actors must operate within flag and coastal state law on armed guards, which varies sharply, and must not conduct surveillance ashore or engage with suspected networks directly. Kidnap response is a specialist regulated area with legal constraints on payments in several jurisdictions, and should never be improvised.

📰 Journalism and OSINT media

Journalists reporting piracy face a heavily distorted evidence base: incidents are under-reported by owners fearing delay and premium increases, over-reported in some categories where any theft is logged, and duplicated across reporting centres. Verification requires deduplicating between reporting bodies, checking incident classification, and being precise about the difference between armed robbery in territorial waters and piracy on the high seas. Crew who have been held are trauma survivors and should be interviewed accordingly, with consent and without pressure. Owners and flag states deserve right of reply, and operational detail about hardening measures should not be published.

🌍 NGO, humanitarian and human rights

Humanitarian and seafarer welfare organisations focus on the human consequences: crew held for months, families without information or income, abandoned vessels, and the long-term psychological injury that follows captivity. Practice is survivor centred, with informed consent, no pressure to recount events, and referral to specialist trauma support. Do-no-harm applies to publishing details while crew remain held, since it can affect negotiations and safety. Documentation for accountability should preserve testimony to evidentiary standards where survivors consent. Duty of care extends to local staff in coastal communities where syndicates have influence.

🎓 University and research

Research in this area struggles with reporting bias, which is the dominant methodological issue: incident datasets measure reporting behaviour as much as attack behaviour, and the incentive to under-report varies by flag, owner and insurance arrangement. Publish deduplication rules explicitly when merging reporting centre datasets, state classification criteria, and avoid modelling attack rates without addressing under-reporting. Ethics approval is required for any work with former hostages or coastal communities. Cite specific reporting periods rather than aggregate figures, and be careful with economic cost estimates, which vary by an order of magnitude between studies depending on assumptions.

Playbook: working Maritime Piracy end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the regional model

Piracy is not one phenomenon. Determine which model applies in your area: opportunistic low-violence boarding for ship stores and cash in congested straits, offshore kidnap of crew for ransom, hijack of product tankers for cargo theft, or long-range vessel hijack using motherships. Each has a different actor structure, weapon profile, target preference and environmental constraint. A good output is a written regional model with actor type, method, target profile and range. Stop when the model explains the last two years of incidents in the area.

Phase 2 — Build a deduplicated incident baseline

Merge reporting from the industry reporting centre, regional information sharing centres, naval reporting authorities and official IMO records, then deduplicate rigorously, since one attack routinely appears in three datasets with different times, positions and classifications. Record which body classified each event and how. A good output is a single incident series with source attribution and a documented deduplication rule. Stop when the same attack cannot appear twice under any query.

Phase 3 — Correct for reporting bias

Assess who reports and who does not: owners fear delay, investigation and premium increases, some flags discourage reporting, and fishing vessels and small coastal traders are systematically absent from the record. Compare reported incidents against crew testimony, insurance notifications and local reporting to estimate the direction and rough scale of under-reporting. A good output is a bias statement accompanying every count you publish. Stop when the count is presented with its known distortion rather than as a fact.

Phase 4 — Characterise attack profiles

Code each incident for approach method, number and type of craft, time of day, weapon type, boarding method, target vessel characteristics including freeboard and speed, and outcome. Patterns emerge quickly: syndicates operate within narrow method envelopes, and changes in that envelope signal new leadership, new equipment or a new business model. A good output is a coded profile set with the current dominant method identified. Stop when a new incident can be assigned to a profile or flagged as genuinely novel.

Phase 5 — Model environmental windows

Establish the sea state, monsoon and swell conditions under which small-boat operations are feasible in the area, and overlay them on the incident record. Attack activity in most regions is strongly bounded by weather, and the resumption of a season is highly predictable. Add moon phase and daylight patterns where the record supports it. A good output is a feasibility calendar with expected activity windows. Stop when the seasonal model predicts the historical onset and cessation of activity.

Phase 6 — Assess vessel vulnerability

Score vessels by the factors that actually determine boarding difficulty: freeboard, service speed, manoeuvrability, crew size, watchkeeping arrangements, hardening measures fitted and citadel provision. A slow, low-freeboard vessel in a high-activity window is a different risk from a fast container ship on the same route. A good output is a vessel-specific exposure score rather than a route-level colour. Stop when the score changes an operational decision such as routing, timing or escort.

Phase 7 — Analyse the shore-based network

Where kidnap for ransom operates, the vessel attack is the smallest part of the enterprise. Map the roles: financiers, negotiators, guards and holding locations, logistics suppliers, and informants in ports, agencies and brokers who identify high-value targets and crew nationalities. This is intelligence and law enforcement territory rather than open analysis, so open work should stop at structural characterisation and refer. A good output is a role-based network model with evidence quality noted. Stop before naming individuals without lawfully obtained evidence.

Phase 8 — Support transit planning

Convert the analysis into decisions: routing options and distance offshore, timing against the environmental window and daylight, group transit or convoy participation, reporting and registration with the relevant naval authority, watchkeeping posture and hardening checks. Recommendations must be specific to the vessel and voyage rather than generic. A good output is a transit plan with a named risk owner and a reporting schedule. Stop when the plan is executable by the master without further interpretation.

Phase 9 — Prepare for and reconstruct incidents

Establish in advance what evidence should be preserved after an attack: bridge recordings, position logs, communications, photographs, crew statements taken early and separately, and any equipment left behind. After an incident, reconstruct the timeline precisely and feed it back into the profile set. Ensure crew welfare and trauma support take precedence over evidence collection. A good output is a reconstructed incident record and an updated profile. Stop pushing for detail whenever a crew member shows distress.

Phase 10 — Measure suppression versus displacement

After a change in naval posture or an enforcement operation, test whether activity fell or moved: watch adjacent areas, changes in attack distance from shore, and shifts in target profile. Suppression without displacement is rare, and claiming success too early is a recurring institutional error in this domain. A good output is a comparative assessment across the wider region rather than the patrolled box. Stop when at least one full environmental cycle has been observed.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
ICC International Maritime Bureau Piracy Reporting Centre	Open	Twenty-four hour reporting centre publishing incident reports and periodic analysis of piracy and armed robbery worldwide.	The longest-running global incident series and the standard reference for cross-regional comparison.
ReCAAP Information Sharing Centre	Open	Incident reporting and analysis for Asia with weekly and annual reports, categorised by severity and location.	The authoritative regional series for Asian waters with consistent severity categorisation over time.
UKMTO	Open	Voluntary reporting scheme and advisory notices for merchant shipping in the Indian Ocean and Gulf region.	Near real-time incident and threat advisories plus the reporting mechanism vessels are asked to use in transit.
EUNAVFOR Operation Atalanta reporting	Open	Naval counter-piracy operation reporting for the Indian Ocean including incident updates, advisories and industry liaison output.	Official naval incident and advisory stream used to cross-check industry reporting in the Indian Ocean.
IMO GISIS piracy and armed robbery module	Registration	Official reports of piracy and armed robbery submitted by member states and organisations with standardised fields.	Provides the official record used for deduplication and for classification of incidents by location type.
IMO guidance and industry best management practice	Open	Consolidated industry guidance on threat assessment, planning, ship protection measures and reporting procedures.	Defines the hardening baseline against which a vessel's protective posture is assessed.
AIS platforms such as MarineTraffic	Licensed	Vessel movement history, port calls and track playback used to reconstruct approach and post-incident movement.	Reconstructs the victim vessel track and, where a hijacked vessel resumes transmission, its subsequent movement.
Global Fishing Watch	Registration	Vessel behaviour data including loitering and encounters, covering fishing fleets that are sometimes used as motherships.	Identifies candidate mothership behaviour and unusual loitering in areas of attack activity.
NGA Maritime Safety Information anti-shipping activity messages	Open	Official warnings and reports of anti-shipping activity worldwide with position, date and brief description.	An independent official incident stream used to cross-check and deduplicate industry reporting.
NOAA and Copernicus marine forecast products	Open	Sea state, wave height, wind and swell analyses and forecasts covering global waters at operational resolution.	Builds the environmental feasibility window that bounds small-boat operations in each region.
Joint War Committee listed areas	Open	Listing of areas of perceived enhanced risk used by the marine insurance market for war risk premium purposes.	Establishes the insurance market view of risk geography, which drives commercial routing decisions.
Oceans Beyond Piracy and successor economic studies	Open	Analytical studies estimating the human and economic cost of piracy and the effectiveness of counter-measures.	Provides cost framing and benchmarks for evaluating whether countermeasures deliver proportionate benefit.
International Transport Workers Federation and seafarer welfare organisations	Open	Reporting on abandonment, crew welfare cases and support services for seafarers affected by attacks and captivity.	Documents the human consequences and provides referral pathways for affected crew and families.
UNODC maritime crime programme reporting	Open	Reporting on prosecution capacity, transfer arrangements and legal finish for maritime crime in affected regions.	Establishes which states can actually prosecute, which determines what happens after an interdiction.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Maritime Piracy. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

QGIS — Plots incidents, ranges and environmental windows against transit routes. Strong spatially, though range-ring analysis needs careful assumptions about craft endurance.
Python with pandas — Deduplication across reporting centres, profile coding and seasonality analysis. The deduplication rules matter far more than the code that implements them.
AIS track playback platforms — Reconstructs approach geometry and post-incident vessel movement. Coverage gaps offshore limit reconstruction exactly where attacks occur.
Marine weather and sea state viewers — Establishes feasibility windows for small-boat operations. Model resolution may be too coarse for very local conditions near the coast.
Structured incident coding templates — Enforces consistent profile coding across analysts and time. Low technology, but the only defence against a dataset that cannot be compared with itself.
Risk scoring spreadsheets with documented weights — Converts vessel and route characteristics into an exposure score. Transparent, but weights must be reviewed as attack methods change.
Sentinel-1 SAR viewers — Detects small craft and motherships in some conditions independent of transmissions. Small wooden craft are frequently below reliable detection thresholds.
Secure case management with restricted access — Holds crew testimony and network material under access control. Requires discipline about who can see hostage-related material during a live case.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Incident counts measure reporting behaviour as much as attack behaviour. Owners fear delay, investigation and premium increases, so every published count needs an explicit statement of the direction and likely scale of under-reporting.
Deduplicate before you analyse. A single attack appears in industry, regional and official datasets with different times, positions and classifications, and naive merging inflates the series in exactly the periods everyone is watching.
Freeboard and speed determine boardability more than any route-level risk colour. A slow, low vessel in a quiet area may face higher real exposure than a fast, high-sided ship in a headline region.
Syndicates operate inside narrow method envelopes. A sudden change in approach craft, weapon type or time of day usually signals new leadership, new equipment or a new financier rather than random variation.
Environmental windows bound the threat more tightly than patrols do. Model the sea state and monsoon feasibility first, because a large share of apparent enforcement success is simply the season closing.
Distinguish armed robbery in territorial waters from piracy on the high seas. It is not pedantry: the legal regime, the jurisdiction and the available response differ completely, and the categories are routinely conflated.
For kidnap for ransom, the vessel attack is the smallest part of the enterprise. Negotiators, financiers, guards and port informants constitute the organisation, and countermeasures aimed only at the water rarely change its economics.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Maritime Piracy is producing anything, and they are worth baselining before you change process or tooling.

Proportion of incidents in the maintained baseline that are confirmed unique after deduplication across all reporting sources.
Accuracy of seasonal activity window predictions, scored against the observed onset and cessation of attacks each cycle.
Share of transit advisories that produced a documented change in routing, timing or protective posture.
Time from an incident report to an updated attack profile assessment distributed to operators on the affected route.
Rate of successful boardings against vessels that had implemented recommended hardening compared with those that had not.
Displacement measurement: change in activity in adjacent areas following a change in naval posture, tracked over a full environmental cycle.
Number of crew welfare referrals made from incident reporting, as a measure that the human consequence layer is being handled.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Underreporting is systemic. Operators avoid reporting to prevent delay, insurance consequences and port state investigation, so counts are floors.
Definitions differ: piracy under UNCLOS applies on the high seas, while armed robbery within territorial waters is a separate legal category.
Falling incident counts frequently reflect naval presence and hardening rather than reduced intent, so declaring an area solved invites recurrence.
Small-boat attackers are indistinguishable from fishermen in imagery and AIS, which makes pre-attack detection unreliable.
Conflating piracy with state-linked maritime attacks or maritime terrorism produces the wrong response and the wrong insurance treatment.
Ransom figures circulating in open reporting are usually negotiating positions or rumour rather than settled amounts.

Legal and ethical considerations

Seafarer identity, crew nationality and family contact details are protected personal data and are directly exploitable by kidnap syndicates during an active negotiation, so handle them under strict access control. Ransom payment is regulated or prohibited in several jurisdictions, particularly where designated groups may benefit, and analysts should never advise on payment. Distinguish piracy from armed robbery within territorial seas, since jurisdiction and permitted response differ. Coordinate with reporting centres rather than publishing live incident detail.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Maritime Piracy, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 6 data points, 5 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Are incident statistics trustworthy?

They are useful and systematically incomplete. Under-reporting is driven by commercial incentives: reporting can mean delay, investigation, higher premiums and reputational consequences, so owners frequently do not report minor boardings and thefts. Fishing vessels and small coastal traders are largely absent from the record entirely. At the same time, duplication across reporting centres inflates counts. Use the series for trend and profile analysis rather than absolute levels, deduplicate rigorously, and publish an explicit bias statement with any figure. Where a decision depends on absolute numbers, seek corroboration from insurance notifications and crew testimony.

What is the difference between piracy and armed robbery at sea?

Location and legal regime. Piracy under the law of the sea occurs on the high seas or in a place outside the jurisdiction of any state, and attracts universal jurisdiction, meaning any state may seize and prosecute. Armed robbery against ships occurs within a state's territorial waters and falls under that state's criminal law, with no universal jurisdiction. The practical consequences are large: available naval responses, boarding authority, detention and prosecution routes all differ. Reporting bodies classify by these criteria, so any merged dataset needs the classification preserved rather than collapsed.

Does naval presence reduce piracy or move it?

Usually both, in proportions that take a full environmental cycle to establish. Presence raises the cost of operating in the patrolled area and can suppress activity, but organised groups with mothership capability simply operate further offshore or shift to adjacent waters, and opportunistic actors move to less patrolled straits. The analytic discipline is to measure across the wider region rather than the patrolled box, tracking attack distance from shore and target profile changes alongside raw counts. Declaring success from a drop inside the patrol area during a closing monsoon window is a recurring institutional error.

What hardening actually works?

The measures that increase boarding time and reduce approach opportunity: maintained lookout with radar watch, speed and manoeuvre when approached, physical barriers at the lowest freeboard points, secured access to the accommodation, a properly designed and provisioned citadel with independent communications, and drilled crew procedures. Equipment fitted but not drilled achieves little. The decisive variables remain freeboard and speed, which are fixed by vessel design, so the protective posture must be matched to the vessel rather than applied generically. Detailed configuration should stay within the industry guidance channel rather than published.

How should analysts handle crew who have been held?

With the same care as any trauma survivor and with no operational urgency permitted to override it. Interviews should be voluntary, on their timetable, with informed consent about how material will be used, and conducted by someone trained rather than by whoever needs the data. Avoid repeated re-interview, which is a known driver of further harm. Route survivors to specialist welfare and psychological support through seafarer welfare organisations and unions. If a crew member shows distress, stop. Evidence obtained by pressure is both unethical and unreliable, and it will not survive a courtroom.

Can ransom payment be analysed openly?

Only at a structural level. Payment chains, negotiator identities and amounts are handled within a regulated, legally constrained response process, and several jurisdictions restrict or prohibit payments to designated groups, which creates serious legal exposure for anyone involved. Open analysis can address the economic model in general terms: that a ransom market requires holding capacity, negotiation intermediaries and shore-based finance, and that its viability depends on expected payout against cost. Anything specific belongs with law enforcement, financial intelligence units and the specialist response providers operating under legal advice.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

UN Convention on the Law of the Sea, which defines piracy, universal jurisdiction and the right of seizure on the high seas.
SUA Convention on the suppression of unlawful acts against the safety of maritime navigation, which supplies additional offence and jurisdiction provisions.
IMO guidance on prevention and suppression of piracy and armed robbery, which sets the reporting and response framework for member states.
Industry best management practice for maritime security, which defines the hardening and reporting baseline for merchant vessels.
ISPS Code, which governs ship and port facility security assessment, plans and levels.
Maritime Labour Convention, which sets seafarer welfare obligations relevant to crew held or affected by attacks.
Djibouti Code of Conduct and Yaounde Code of Conduct, which provide regional cooperation frameworks for information sharing and response.
Applicable sanctions regimes restricting payments to designated groups, which constrain ransom response and require legal advice.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Piracy and Armed Robbery Against Ships reports — ICC International Maritime Bureau. Global incident reporting and periodic analysis from the Piracy Reporting Centre
Piracy and Armed Robbery reports for Asia — ReCAAP Information Sharing Centre. Regional incident data and analysis with consistent severity classification
Advisories and voluntary reporting scheme — UK Maritime Trade Operations. Near real-time advisories and reporting mechanism for merchant shipping
Counter-piracy operational reporting — EUNAVFOR Operation Atalanta. Naval operation incident reporting and advisories for the Indian Ocean
Piracy and armed robbery reporting module — International Maritime Organization. Official member state reports of piracy and armed robbery incidents
Anti-shipping activity messages — US National Geospatial-Intelligence Agency. Official worldwide reports of attacks and attempted attacks on shipping
Global Maritime Crime Programme reporting — UN Office on Drugs and Crime. Analysis of prosecution capacity and legal finish for maritime crime
Seafarer welfare and abandonment reporting — International Transport Workers Federation. Documentation of crew welfare cases including captivity and abandonment
Copernicus Marine Service ocean and wave products — European Commission. Sea state and wave analyses used to model small-boat operating windows

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: deduplicated incident baselines, attack profile modelling and transit-specific exposure scoring for every route you operate. Explore the platform, or browse the rest of the library by following any tag above.