Vessel / Ship: Data Point Intelligence Guide

A ship can change its name, its flag and its owner in a week. The IMO number assigned at build stays with the hull until it is scrapped.

Understanding the Vessel / Ship as an intelligence artifact

A vessel is identified by several distinct numbers that analysts routinely conflate. The IMO number is a seven-digit identifier with a check digit, permanently assigned to the hull and unchanged by name, flag or ownership. The MMSI is a nine-digit radio identity that opens with the maritime identification digits of the flag state and does change on reflagging. The call sign is a separate radio identifier issued by the flag administration. Names, flags, owners, managers and classification societies all change independently of one another.

Ownership is deliberately layered. A single-ship registered owner company, a commercial manager, a technical manager, a beneficial owner and a charterer may all be distinct entities in distinct jurisdictions. Automatic identification system broadcasts carry identity, position, course, speed, draught and navigational status, but the identity fields are self-declared by the transponder and can be edited. Port state control inspections and classification status provide independently verified reference points.

Why it matters

Ships are the primary conveyance for sanctioned oil, arms, wildlife and bulk illicit cargo, and they leave a continuous and largely public position trace. The IMO number provides a stable spine to which name changes, flag hops, ownership transfers, detentions and casualties attach across decades. Broadcast position data supplies behaviour: where the vessel went, where it stopped, which ships it met, and precisely when it stopped transmitting at all.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Transponder gaps of unusual duration near known transfer areas indicate deliberate shutdown rather than coverage failure.
Two vessels holding matched slow speed in close proximity offshore is the classic signature of ship-to-ship transfer.
Draught changes reported between departure and arrival reveal loading or discharge that no port call explains.
Rapid sequences of name, flag and manager changes form a recognised pre-designation restructuring pattern.
Registered owner companies sharing one address with many other single-ship entities expose a controlling group.
Detention and deficiency histories indicate operator quality and which port states are still willing to accept the ship.
Spoofed positions appear as tracks inconsistent with vessel speed, terrain, or simultaneous appearances in two places.
Classification society withdrawal and insurance changes often immediately precede or follow a designation.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

IMO GISIS — Official ship particulars, company and registered owner identification numbers and casualty records.
Equasis — Free consolidated ship data: identity, class, management history and port state control inspections.
ITU MARS — MMSI and call sign assignments recorded by flag state administrations.
MarineTraffic, VesselFinder and FleetMon — Terrestrial and satellite AIS positions, port calls and historical voyage data.
Global Fishing Watch — Free AIS-derived behaviour analytics including transmission gaps, encounters and loitering events.
Paris MoU and Tokyo MoU — Port state control inspection, detention and banning records tied to individual ships.
OFAC, EU and UN lists — Designated vessels published with IMO numbers alongside their owners and managers.
Sentinel-1 radar imagery — Detects vessels at sea independently of transponders, useful across reporting gaps.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Pin the hull — Resolve every reference to an IMO number and validate its check digit, treating name and MMSI as changeable attributes.
Build the identity history — Compile name, flag, MMSI, owner, manager and class changes with dates from official and commercial registers.
Map the ownership layers — Separate registered owner, technical manager, commercial manager and beneficial owner, then look each up in company registries.
Reconstruct the voyages — Assemble position history, mark gaps, loitering and encounters, and note reported draught at each leg.
Corroborate with imagery — Use radar and optical imagery over gap periods and encounter locations to confirm presence independently of transponders.
Screen the structure — Check the vessel, owners, managers, charterers and flag registry against sanctions and detention databases.
Document with sources — Record every claim against register, snapshot date and data provider, since these histories are revised retroactively.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Geospatial Intelligence — Intelligence Derived from Place
Logistics Intelligence — Cargo, Freight, and Physical Movement
Sanctions Intelligence — Screening, Designations, and Evasion Detection
Technical Intelligence — Technology Capability, Design, and Exploitation
Criminal Intelligence — Intelligence Supporting Criminal Investigation
Imagery Intelligence — Interpretation of Visual Imagery
Financial Intelligence — Following Value Through the Financial System
Human Intelligence — Information from People, Ethically Obtained
Corporate Intelligence — Understanding Companies, Structure, and Control

Investigated in these domains

Pivots to these data points

Aircraft — An aircraft identified by tail number, ICAO hex, or registration.

Inside the platform: where Vessel / Ship lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

domain.php?d=mar — Vessel / Ship profile
datapoint.php?dp=dp_vessel — Data point hub
domain.php?d=drugs — Drug Trafficking dashboard
domain.php?d=weapons — Weapons Trafficking dashboard
sanctions.php — Sanctions Evasion dashboard
domain.php?d=supply — Supply Chain Security dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Pin the hull is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Map the ownership layers turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Document with sources feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Vessel / Ship

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Maritime domain awareness is built on hull identity and broadcast behaviour. A naval or joint analyst uses vessel data for recognised maritime picture maintenance, interdiction planning, force protection in congested waters and monitoring of adversary sealift and replenishment. The IMO number provides the stable spine across name and flag changes, and behaviour analysis identifies rendezvous, loitering and transponder shutdown patterns that warrant surveillance tasking. Constraints are legal and practical: boarding on the high seas requires a legal basis such as flag state consent, a Security Council authority or a right under the law of the sea, and a transponder gap is a collection trigger rather than evidence of an offence.

🕵 National intelligence

Vessels are the primary conveyance for sanctioned oil, arms and bulk illicit cargo, and they leave an unusually rich open trace. Requirements on sanctions evasion and proliferation are frequently answerable from commercial position data fused with registry, ownership and inspection records. The analytic product is a hull profile with an identity history, an ownership structure and a behavioural timeline. Because much of the underlying data is commercially licensed, dissemination has to distinguish the analytic conclusion from the redistributable evidence. Corroborating gaps with radar imagery converts an inference about a transponder into an observation about a ship.

👮 Law enforcement

Maritime law enforcement uses vessel identity for detentions, prosecutions and asset restraint. The IMO number is the evidential anchor because it does not change; names, flags and MMSI do. Broadcast position data is admissible with provenance from the aggregator, but analysts must be able to explain reception coverage, the self-declared nature of identity fields and the possibility of spoofing. Registry documents, class records and port state inspection reports are official records obtainable directly or by request. Boarding, search and detention are exercised under flag state, coastal state or port state authority, and the legal basis must be established before, not after, the intervention.

🔍 Private investigation and corporate security

Corporate and marine insurance investigators use vessel data for sanctions exposure screening, charterer and counterparty due diligence, cargo loss and casualty investigation, and verification of claimed voyages. Everything needed is available from commercial and public registers without any intrusive method. What a private actor may not do is spoof or transmit on maritime radio frequencies, board or approach a vessel without authority, obtain crew personal data without a lawful basis, or redistribute licensed position data in breach of terms. Crew names and nationalities visible in some records are personal data and should be minimised in any report.

📰 Journalism and OSINT media

Vessel tracking has driven major investigations into sanctioned oil, illegal fishing and arms transfers. The verification standard is to anchor everything to the IMO number, to compile identity history from official registers rather than a single aggregator, and to corroborate transponder anomalies with independent evidence such as radar imagery or port records. Aggregators back-fill and correct history, so screenshots must be dated and archived. Allegations against owners, managers and insurers carry serious commercial consequences, so distinguish observed behaviour from inferred intent, and give owners and managers a specific right of reply naming the voyages concerned.

🌍 NGO, humanitarian and human rights

Vessel analysis supports work on illegal fishing, forced labour at sea, waste dumping, ship breaking and sanctions monitoring. Open behaviour analytics allow documentation of transhipment and loitering patterns without any presence at sea, which protects both staff and sources. Where crew testimony is involved, protect the seafarers absolutely: they are frequently in a coercive employment relationship and identifying a vessel and voyage can identify who spoke. Route enforcement findings to flag states, port state control and coastal authorities that hold intervention powers. Preserve evidence to accountability standards, as these findings often support port state detentions or litigation.

🎓 University and research

Maritime research uses position data for fishing effort estimation, emissions modelling, trade flow analysis and detection of anomalous behaviour. The central methodological caveats are that reception coverage is spatially uneven, that identity fields are self-declared and occasionally spoofed, that vessel type labels in commercial datasets are inconsistent, and that aggregators revise history so a dataset must be versioned and dated. Open sources such as Global Fishing Watch support reproducible work where commercial licences would not. Ethics review is rarely required for vessel data but crew-related analysis is human subjects research and should be treated as such.

Playbook: working Vessel / Ship end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Pin the hull

Resolve every reference to an IMO number and validate its check digit, treating name, flag, MMSI and call sign as changeable attributes hanging off that spine. Where only a name is available, expect duplicates and resolve using type, tonnage, build year and route. A good output is a single hull identity with its current and historical attributes. Stop when you are certain you are tracking one ship rather than a name.

Phase 2 — Build the identity history

Compile every name, flag, MMSI, call sign, owner, manager and classification society with dates, from official registers and consolidated sources. Rapid sequences of change are themselves a finding, particularly around designation dates. A good output is a dated identity timeline with a source per row. Stop when the history is continuous from build or from the earliest period relevant to the case.

Phase 3 — Map the ownership layers

Separate registered owner, bareboat charterer, technical manager, commercial manager, beneficial owner and any protection and indemnity cover, then look each up in company registries. The registered owner is nearly always a single-ship company revealing nothing without further work. A good output is an ownership diagram with jurisdictions and registry references. Stop when you reach either a natural person or a genuine dead end you can describe.

Phase 4 — Assemble the position history

Collect broadcast position data across providers for the period of interest, recording provider, retrieval date and coverage characteristics. Note that terrestrial and satellite reception differ enormously by region. A good output is a track with source attribution and explicit coverage caveats. Stop when the track covers the period or its gaps are characterised by cause rather than assumed. Where two providers disagree, keep both tracks rather than choosing, and record which reception network each came from.

Phase 5 — Characterise the behaviour

Identify port calls, loitering, encounters with other vessels, speed and course anomalies, draught changes between departure and arrival, and transmission gaps with their durations and locations. Draught change without a port call implies loading or discharge at sea. A good output is a behavioural event list with times and positions. Stop when each notable event is described in observable terms rather than characterised.

Phase 6 — Test for spoofing

Check for tracks inconsistent with the vessel's speed capability, positions over land, simultaneous appearances in different places, identity fields that changed mid-voyage, and MMSI values inconsistent with the declared flag. Identity fields are self-declared and editable. A good output flags each suspect segment with the reason. Stop when the track is either internally consistent or its inconsistencies are documented. Where spoofing is indicated, verify hull identity against registered dimensions, tonnage and photographs before proceeding.

Phase 7 — Corroborate gaps with imagery

Use synthetic aperture radar over gap periods and encounter locations to detect vessels independently of transponders, and optical imagery where cloud and daylight allow. This converts a gap from an absence into a presence or a genuine absence. A good output pairs each significant gap with an imagery search result, positive or negative. Stop when the gaps that matter have been tested against independent collection.

Phase 8 — Pull the inspection record

Retrieve port state control inspection, deficiency, detention and banning history, and classification society status including withdrawals. These are independently verified reference points and they indicate which port states will still accept the ship. A good output is an inspection timeline with deficiencies summarised. Stop when the safety and compliance record is documented across the relevant memoranda. Note crew-related deficiencies separately, since wage and rest-hour findings are leading indicators for labour abuse investigations.

Phase 9 — Screen the whole structure

Check the vessel, owners, managers, charterers, insurers and flag registry against sanctions and enforcement data with dated list versions, and apply ownership rules for unlisted entities controlled by designated persons. A good output is a screening log covering the full structure. Stop when every entity in the ownership diagram has been screened. Include protection and indemnity cover and the classification society, since both frequently withdraw around a designation. Record the date of each check alongside the list version used.

Phase 10 — Link cargo and counterparties

Connect the vessel to shipment records, container movements, bunkering, port agents and charter fixtures where visible, to establish what it carried and for whom. A hull profile without cargo linkage answers only half the question. A good output associates voyages with declared cargoes and named parties. Stop when the voyages of interest have documented or explicitly undocumented cargo. Where cargo cannot be evidenced, say so rather than inferring it from the vessel type and route.

Phase 11 — Assess intent separately

Write observed behaviour and inferred purpose as distinct sections. A transponder gap, a rendezvous and a draught change are observations; sanctions evasion is an assessment with a confidence level. Owners, insurers and seafarers face serious consequences from the latter. A good output allows a reader to accept the observations and dispute the assessment. Stop when the language matches the evidence.

Phase 12 — Preserve and date everything

Archive registry extracts, track exports and screenshots with provider, retrieval time and coverage notes, because aggregators back-fill and correct history and today's query will not reproduce next month. A good output is an evidential package that stands independently of the platforms it came from. Stop when every claim in the product maps to a preserved artifact. Capture the coverage caveat with the extract, because a track without its collection context cannot be interpreted later.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
IMO GISIS	Registration	Official ship particulars, IMO company and registered owner identification numbers, casualty records and port reception facility data.	Authoritative confirmation of hull identity and of the company numbers linking owners and managers across vessels.
Equasis	Registration	Free consolidated ship information combining identity, classification, management history and port state control inspection results.	The single best free starting point for identity history, management chain and inspection record on any merchant vessel.
ITU MARS	Open	International Telecommunication Union maritime radio station database recording MMSI and call sign assignments notified by administrations.	Confirms which administration assigned an MMSI and whether the value is consistent with the vessel's declared flag.
Global Fishing Watch	Open	Open platform providing position-derived analytics including fishing effort, encounters, loitering events and transmission gaps.	Free, citable behaviour analytics for transhipment and gap analysis without a commercial licence restricting publication.
MarineTraffic	Registration	Commercial platform with terrestrial and satellite positions, port calls, voyage history, particulars and photographs.	Detailed track reconstruction and port call history, subject to licence terms on redistribution of extracts.
VesselFinder and FleetMon	Registration	Alternative commercial position aggregators with differing reception networks, coverage and historical depth.	Cross-checks a track against a second reception network, which is essential when assessing whether a gap is real.
Paris MoU on Port State Control	Open	Inspection, deficiency, detention and banning records for ships calling in the European and North Atlantic region.	Independent verified evidence of ship condition, operator quality and which authorities have detained the vessel.
Tokyo MoU on Port State Control	Open	Equivalent inspection and detention records for the Asia-Pacific region, with a searchable database of results.	Extends inspection history to Asian port calls, which is where much of the sanctioned trade actually berths.
OFAC, EU and UN designation lists	Open	Designated vessels published with IMO numbers, together with their owners, managers and operating companies.	Establishes whether the hull itself, or any entity in its ownership chain, is subject to a binding restriction.
Copernicus Sentinel-1 radar	Registration	Free synthetic aperture radar imagery capable of detecting vessels at sea independently of transponder broadcasts.	Corroborates or refutes presence during transmission gaps and at claimed rendezvous locations.
Flag state registries	Registration	National ship registers recording registration, ownership, tonnage, mortgages and certificates for vessels under that flag.	Primary documentary evidence of registration and ownership, and the route to deregistration records after a flag hop.
IHS Markit and Lloyd's List Intelligence	Licensed	Commercial maritime intelligence with ownership hierarchies, beneficial owner assessments, casualty and fixture data.	Provides beneficial ownership analysis and charter information that public registers do not disclose.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Vessel / Ship. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

IMO check digit validators — Confirm a seven-digit IMO number is well formed before use; a valid number can still be mistyped into another real vessel, so corroborate with particulars.
Global Fishing Watch APIs — Retrieve encounters, loitering and gap events programmatically under an open licence; detection thresholds are fixed and may miss short events.
AIS decoders such as libais or pyais — Parse raw broadcast messages into positions and identity fields; raw feeds contain corrupt and spoofed messages that require filtering before analysis.
QGIS with track plotting — Visualises voyages against boundaries, exclusive economic zones and imagery footprints; great circle versus straight line rendering can imply routes never sailed.
Sentinel-1 processing tools — Detect vessels in radar imagery during transponder gaps; detection depends on sea state and vessel size, and small craft are frequently missed.
Registry scraping and archiving tools — Capture registry and inspection pages with retrieval timestamps; registers overwrite records without versioning, so timing of capture is decisive.
Graph tooling for ownership — Maps single-ship companies, managers and shared addresses into controlling groups; shared corporate service addresses create false clusters if not filtered.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Anchor on the IMO number and treat everything else as an attribute with a validity period. Name, flag, MMSI, call sign, owner and manager all change independently, and analysis keyed on any of them will silently split or merge hulls.
A gap is a collection problem until proven otherwise. Terrestrial reception is coastal, satellite revisit is finite, and equipment fails. Establish expected coverage for that area and period before characterising a silence as deliberate.
Draught reporting is underused and highly informative. A vessel that departs light and arrives laden without a port call in between has loaded somewhere, and that somewhere is usually a rendezvous position you can then image.
Single-ship registered owners are the norm, not the anomaly. The finding is not that the owner is a shell but that many such shells share one address, one manager or one correspondence agent, which is what identifies the controlling group.
Identity fields are typed by a human into a transponder. MMSI and name can be set to impersonate another ship entirely, so a track that behaves strangely should trigger an identity check against particulars, dimensions and photographs rather than acceptance.
Aggregators rewrite history. They back-fill satellite data and correct identity records, so a screenshot taken today may not be reproducible, and any claim in a published product needs a dated preserved extract behind it.
Port state control detentions are among the few independently verified facts about a vessel. They cost the operator money and are recorded by an authority, which makes them far stronger evidence of operator quality than any commercial risk score.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Vessel / Ship is producing anything, and they are worth baselining before you change process or tooling.

Proportion of vessel references resolved to a validated IMO number rather than tracked by name or MMSI.
Share of significant transponder gaps tested against independent imagery or port records rather than assumed deliberate.
Rate at which ownership chains are traced to a natural person or a documented dead end rather than stopping at the registered owner.
Median time from a vessel designation to reassessment of the associated fleet and management structure.
Number of behavioural findings later corroborated by a port state detention, seizure or enforcement action.
Proportion of published claims supported by a dated preserved extract rather than a live platform link.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Transponder identity fields are self-declared, so MMSI and name can be spoofed to impersonate an entirely different ship.
Coverage gaps often reflect terrestrial receiver limits or satellite revisit rather than deliberate transponder shutdown.
The registered owner is almost always a single-purpose company that reveals nothing without further registry work.
IMO numbers are occasionally mistyped or reused in commercial datasets, silently merging two ships' histories together.
Aggregators back-fill and correct history, so a screenshot taken today may not match the same query next month.
Two ships sharing a name is common, and matching on name alone reliably produces confidently wrong conclusions.

Legal and ethical considerations

Position broadcasts are transmitted openly and analysing them is generally lawful, but commercial aggregators impose licence terms on bulk collection and redistribution. Crew details, where visible, are personal data and should be minimised. Assertions that a ship is smuggling or evading sanctions carry serious consequences for owners, insurers and seafarers, so distinguish observed behaviour from inferred intent. Preserve extracts with provider, retrieval time and coverage caveats to keep the record evidentially sound.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Vessel / Ship, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 8 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

The transponder went dark for six days. Does that prove a ship-to-ship transfer?

No. It establishes an absence of received broadcasts, which has several causes: coverage limits away from coastal receivers, satellite revisit gaps, equipment failure, and deliberate shutdown. Build the case from more than the gap. Check whether other vessels in the same area and period were also unreceived, which points to coverage. Check draught reported at departure and arrival, since a change without a port call implies loading or discharge. Task radar imagery over the gap area for the period. A gap plus a draught change plus a radar detection of two hulls alongside is a finding; a gap alone is a collection trigger.

Two databases give different owners for the same ship. Who is right?

Probably both, because they are answering different questions. Registered owner, bareboat charterer, technical manager, commercial manager and beneficial owner are distinct roles that frequently sit in different jurisdictions with different entities. Commercial datasets label these inconsistently, and beneficial ownership entries are often assessments rather than documented facts. Go to the official sources: the flag registry for registration, GISIS for company identification numbers, Equasis for the management chain, and company registries for the entities themselves. Then state each role separately in your product rather than using the single word owner, which is where most confusion originates.

How do I detect a spoofed identity?

Look for physical impossibility and internal inconsistency. Tracks that cross land, imply speeds the vessel type cannot achieve, or place the same identity in two places simultaneously indicate spoofing or a duplicate broadcast. Check whether the MMSI's maritime identification digits match the declared flag, whether reported dimensions match the registered particulars, and whether the identity fields changed mid-voyage. Corroborate with imagery: a radar detection at the broadcast position either supports the track or does not. Photographs of the hull and its markings from port call sites are surprisingly effective at settling identity disputes.

What can port state control records tell me that commercial data cannot?

They tell you what an inspector physically observed aboard, on a date, and what it cost the operator. Deficiency codes describe specific failings from safety equipment to crew certification and living conditions, and a detention means the ship was not permitted to sail until they were fixed. That is independently verified evidence of operator quality, and the pattern across regions tells you which port states still accept the ship. Crew-related deficiencies, particularly on wages and rest hours, are also a leading indicator for labour abuse investigations. None of this appears in position data or in a commercial risk score.

Can I publish a track exported from a commercial platform?

Check the licence, because most restrict redistribution of raw position data and derivative works. Many permit limited use of screenshots with attribution for editorial purposes, and terms differ between consumer and enterprise tiers. Open sources are safer for publication: Global Fishing Watch provides openly licensed analytics, and radar detections from Sentinel imagery are free to redistribute with attribution. Where you must rely on commercial data, obtain written permission or use it to establish the finding while publishing an independently derived illustration. Record the licence position with the archive so a later challenge can be answered.

How should I handle crew information found in vessel records?

Minimise it. Crew names, nationalities, certificate numbers and photographs are personal data about people who are frequently in a vulnerable employment position and rarely implicated in the conduct being investigated. Collect only what the investigative purpose requires, restrict access, and exclude it from circulated products unless a named individual is genuinely material. In forced labour and abandonment cases the crew are the victims, and identifying them can expose them to retaliation from manning agents and operators. Where seafarers provide testimony, protect them as sources and route welfare concerns to the relevant union, flag state or port welfare organisation.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

IMO Resolution A.1078 and the IMO ship identification number scheme establish the permanent seven-digit hull identifier.
SOLAS Chapter V requires carriage and operation of automatic identification system equipment on most commercial vessels.
ITU Radio Regulations and Recommendation M.585 govern maritime mobile service identity assignment and structure.
The United Nations Convention on the Law of the Sea sets flag, coastal and port state jurisdiction and the limited rights of visit on the high seas.
The Paris and Tokyo Memoranda of Understanding define the port state control inspection regime that produces detention records.
The Maritime Labour Convention sets seafarer employment standards and underpins abuse and abandonment investigations.
The FATF and IMO guidance on sanctions evasion in the maritime sector defines the deceptive shipping practices analysts look for.
The Port State Measures Agreement obliges parties to deny port access to vessels engaged in illegal fishing.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Global Integrated Shipping Information System — International Maritime Organization. Official ship particulars, company numbers and casualty records.
Equasis ship information — Equasis, hosted by the European Maritime Safety Agency. Free consolidated identity, management and inspection data.
Maritime mobile access and retrieval system — International Telecommunication Union. Authoritative MMSI and call sign assignment records.
Global Fishing Watch data and analytics — Global Fishing Watch. Openly licensed vessel behaviour analytics including encounters and gaps.
Port state control inspection database — Paris Memorandum of Understanding on Port State Control. Inspection, deficiency and detention records for European port calls.
Port state control information system — Tokyo Memorandum of Understanding on Port State Control. Inspection and detention records across the Asia-Pacific region.
Sanctions designations including vessels — Office of Foreign Assets Control, US Department of the Treasury. Designated hulls published with IMO numbers and associated entities.
Sentinel-1 synthetic aperture radar archive — European Space Agency and European Commission. Free radar imagery for detecting vessels independently of transponders.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: anchors ships to IMO identity, tracks broadcast behaviour and unwinds layered ownership structures. Explore the platform, or browse the rest of the library by following any tag above.