Maritime Intelligence (MARINT): Intelligence Discipline Guide

Ships are legally required to announce themselves. The interesting behaviour is what happens in the minutes after a vessel stops announcing itself.

What Maritime Intelligence is as a discipline

Maritime intelligence covers vessels, their ownership and their behaviour at sea. It combines the registry layer, which establishes flag, IMO number, class society, registered owner, ship manager and beneficial owner, with the movement layer derived from AIS broadcasts and port records. The discipline resolves vessels across name changes, reflagging and MMSI reassignment using the permanent IMO number, then analyses voyage patterns, port calls, draught changes, loitering, ship-to-ship transfers and periods of transponder silence to determine what a vessel actually did.

Sub-methods include AIS behaviour analysis and dark activity detection, ownership and management chain tracing, port state control and class record analysis, ship-to-ship transfer detection, and cargo inference from draught and route. In the cycle, maritime intelligence is both a collection and a corroboration discipline, supplying the physical movement evidence that anchors sanctions, trafficking and supply chain investigations.

Why it matters

Only maritime intelligence establishes where a hull was, what it was carrying by inference from draught and route, and who ultimately controls it through layers of single-ship companies. It answers whether a vessel went dark at a moment consistent with a prohibited call, whether two vessels loitered together in a pattern indicating cargo transfer, whether a reflagging occurred immediately after a designation, and whether a ship's inspection and class history indicates the substandard operation typical of sanctions-evading fleets.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

IMO number as the permanent hull identifier surviving name changes, reflagging and MMSI reassignment across a vessel's life
AIS transponder gaps, particularly those beginning and ending near a sensitive coastline or sanctioned port
Two vessels loitering in close proximity at low speed offshore, the classic ship-to-ship transfer behaviour pattern
Draught changes reported in AIS indicating loading or discharge without a corresponding declared port call
Rapid changes of flag, name, registered owner or manager, especially clustered around designation or inspection events
Port state control detention and deficiency history revealing operational standards and shell-managed tonnage
AIS identity anomalies such as implausible position jumps, duplicate MMSI transmissions or mismatched static data
Ownership chains running through single-ship companies in opaque jurisdictions with a shared correspondence address

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

IMO GISIS — Free public modules covering ship particulars, company and registered owner data, port reception and casualty records
Equasis — Free registration service aggregating ship particulars, ownership, class and inspection history from multiple authorities
Paris MOU and Tokyo MOU port state control databases — Inspection, deficiency and detention records exposing substandard vessels and their management
MarineTraffic and VesselFinder — AIS positions, port calls and voyage history with useful free tiers for identification and recent movements
AISHub — Community AIS data exchange giving raw feed access to contributors, useful for independent verification
ITU MARS and national MMSI registers — Maritime identity assignments linking MMSI and call sign to registered vessel and administration
OFAC SDN and EU consolidated list vessel entries — Designated vessels with IMO numbers, enabling direct screening of hulls rather than only companies
UNCTAD and national port authority statistics — Fleet ownership, registration and port throughput data providing baselines and flag-state context

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Anchor on the IMO number — Resolve the vessel to its IMO number first, since names, flags and MMSI values change specifically to defeat name-based tracking.
Build the identity history — Reconstruct every prior name, flag, owner and manager with dates, which typically exposes the moment control changed.
Trace the ownership chain — Follow registered owner, ship manager, commercial manager and beneficial owner through corporate registries to the controlling interest.
Reconstruct the voyage — Pull AIS history across providers, plotting positions, speeds, draughts and port calls, and marking every reporting gap explicitly.
Analyse the gaps — For each transponder silence, model where the vessel could have travelled at plausible speeds and which ports fall inside that envelope.
Detect transfer behaviour — Look for paired vessels at low speed in open water with correlated draught changes, then corroborate with imagery where available.
Screen and corroborate — Check hull, owners and managers against sanctions and inspection records, and confirm findings with cargo, customs and satellite evidence.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.
Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
Shipping Container — An ISO container identifier — trackable across ports, vessels, and customs events.
HS Commodity Code — The Harmonized System code classifying a traded good — the key to trade-flow analysis.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.
GPS Coordinates — Precise latitude/longitude coordinates identifying an exact point on Earth — the atomic unit of GEOINT analysi
Radio Callsign — A licensed radio identifier for a station, vessel, aircraft, or operator.
Person / Name — A named individual — the subject of identity resolution and profiling.
Sanction / Watchlist Entry — An entry on a sanctions list, watchlist, or PEP database.

Related disciplines

Aviation Intelligence — Aircraft, Flights, and the Aviation Domain
Logistics Intelligence — Cargo, Freight, and Physical Movement
Supply Chain Intelligence — Supplier Networks, Dependencies, and Integrity
Vehicle Intelligence — Vehicles, Registration, and Movement

Inside the platform: where Maritime Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=MARINT — Discipline hub
source-catalog.php?disc=MARINT — Source catalogue filtered to this discipline
domain.php?d=mar — Vessel / Ship profile
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Score Country Risk
Sync Intel Domains
Resolve Everything
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Anchor on the IMO number is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Trace the ownership chain turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Screen and corroborate feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Maritime Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Maritime intelligence supports recognised maritime picture compilation, force protection and freedom of navigation assessment. Analysts characterise normal traffic patterns in an area, identify vessels of interest through ownership and behaviour, detect dark activity and ship-to-ship transfers, and assess port infrastructure and naval movements. Products feed maritime domain awareness reporting, interdiction planning and rules of engagement decisions. Constraints include the fact that warships and many state vessels do not transmit, commercial AIS licensing terms bind derived products, and spoofed AIS is now common enough that any single-source position must be treated as a claim rather than an observation.

🕵 National intelligence

National intelligence uses maritime data extensively for sanctions enforcement, proliferation interdiction and illicit trade. The core analytic products are ownership chains through single-ship companies and managers, and behavioural findings such as transponder gaps aligned with prohibited port calls. Because AIS and registry data are largely open or commercially licensed, findings support designations and can be shared with partners and industry, which is why maritime work drives so much public sanctions action. Fusion with imagery, trade statistics and financial records converts a behavioural anomaly into an attributable event with a responsible legal entity.

👮 Law enforcement

Law enforcement and coastguards use maritime intelligence for smuggling, illegal fishing, pollution and trafficking investigations. Behavioural analysis identifies candidate vessels; boarding, inspection and documentary examination produce evidence. Evidentially, AIS records need provenance from the receiver or provider, and gaps must be explained with coverage analysis, because a defence will attack the inference. Port state control records, class society reports and crew lists obtained through lawful process supply the documentary layer. Jurisdiction is the recurring complication: flag state, coastal state and port state powers differ, and boarding on the high seas needs a legal basis.

🔍 Private investigation and corporate security

Corporate teams use maritime intelligence for charterer and counterparty diligence, cargo insurance and claims, sanctions compliance screening and asset tracing. Ownership chain work identifies who really controls a hull behind layers of single-ship companies, which matters for arrest actions and claims. Constraints are contractual and regulatory: commercial AIS providers restrict redistribution of derived products, crew members appearing in records have data protection rights, and findings suggesting sanctions evasion typically trigger reporting obligations for regulated clients rather than remaining a commercial choice.

📰 Journalism and OSINT media

Maritime investigations are a staple of accountability journalism, covering sanctions-busting oil trades, illegal fishing, abandoned crews and shipwrecks. Verification standards require anchoring on the IMO number rather than the vessel name, corroborating gaps against receiver coverage, and confirming ship-to-ship transfers with imagery rather than proximity alone. Give owners, managers and flag states a right of reply. Take care with crew, who are frequently the victims in these stories and who face blacklisting for speaking, and be precise that a vessel's behaviour is attributable to its operator rather than to the seafarers aboard.

🌍 NGO, humanitarian and human rights

NGOs use maritime data to document illegal fishing, forced labour at sea, oil spills, migrant rescue obstruction and arms shipments. Practice must be victim-centred where seafarers and fishers are involved, because they are usually coerced rather than complicit, and identification can end their livelihood or expose them to retaliation. Documentation for accountability should preserve raw position data, imagery and registry records with retrieval dates, since ownership records are altered rapidly after exposure. Duty of care applies to field staff in ports and to whistleblowing crew, whose safety must be planned for before any publication.

🎓 University and research

Researchers use AIS and registry data for maritime economics, fisheries science, emissions modelling and sanctions studies. Methodological care centres on coverage and data quality: terrestrial receivers cover coastlines, satellite AIS has revisit and message collision limitations, and identity fields are frequently wrong or deliberately falsified. Spoofing detection is now a standard preprocessing step. Ethics review applies where crew are identifiable. Reproducibility requires publishing the provider, the extraction window, the cleaning rules and the spoofing filters used, and archiving derived tracks rather than redistributing licensed raw data.

Playbook: working Maritime Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Anchor on the IMO number

Resolve the vessel to its IMO number before anything else. Names, flags, MMSI values, owners and managers all change, frequently and deliberately, while the IMO number stays with the hull for its life. A good output is an identity record with IMO number, current and historical names, flags, MMSI values, call sign, type, tonnage and build year with dates. Stop when the IMO number is confirmed from an authoritative registry rather than a tracking platform, since platform identity fields are frequently wrong.

Phase 2 — Build the identity and flag history

Reconstruct every prior name, flag, MMSI, owner and manager with effective dates. Reflagging immediately after a designation, or a name change followed by a manager change within weeks, typically marks the moment control changed. A good output is a dated identity timeline sourced to registry and class records. Stop when the timeline is continuous, and treat any period where the vessel cannot be accounted for in any registry as a specific question to answer.

Phase 3 — Trace the ownership and management chain

Separate registered owner, beneficial owner, ship manager, commercial manager and technical manager, then resolve each through corporate registries. Single-ship companies in opaque jurisdictions are the norm in shipping, so the analytic target is the manager and the commercial operator, which are harder to replace than the owning shell. A good output is an ownership and management diagram with registry identifiers. Stop when you reach a natural person, a group parent or a documented dead end.

Phase 4 — Retrieve movement history across providers

Pull AIS history from more than one provider or network, recording provider, query and retrieval time, because terrestrial and satellite coverage differ enormously and retention policies vary. A good output is a consolidated voyage history with the source marked per segment and positions retained with their timestamps. Stop when providers agree across their overlapping coverage, and investigate rather than smooth over any segment where they materially disagree.

Phase 5 — Screen for spoofing and identity fraud

Before interpreting any track, test for falsified positions: physically impossible speeds or jumps, tracks over land, positions inconsistent with reported draught or destination, two vessels broadcasting the same identity, and identity fields that do not match registry records. Spoofing is now routine in sanctions evasion. A good output flags every suspect segment with the test that caught it. Stop and rebuild the track from verified segments rather than analysing a corrupted history.

Phase 6 — Model coverage before interpreting gaps

Establish where reception was available for each period: terrestrial receivers cover coastal areas, satellite coverage varies with constellation revisit and message collision in dense traffic. A gap in mid-ocean often means nobody was listening. A good output annotates each gap with whether coverage existed. Stop before describing a gap as going dark unless coverage was demonstrably available, and quantify how long the vessel was unobserved rather than asserting intent.

Phase 7 — Analyse the gaps that matter

For each significant unexplained silence, model the reachable area from last known position, plausible speed and elapsed time, then identify which ports, anchorages and transfer areas fall inside that envelope. This converts an absence into a bounded set of possibilities. A good output is a reachability envelope with candidate destinations ranked by plausibility. Stop before naming a single port unless the envelope is genuinely small or independent evidence narrows it.

Phase 8 — Detect ship-to-ship transfer behaviour

Look for paired vessels at low or zero speed in open water or a known transfer anchorage, holding relative station for hours, with correlated draught changes before and after. Draught change is what distinguishes a transfer from a rendezvous. A good output pairs the behavioural signature with the draught evidence and, where possible, imagery of the two hulls alongside. Stop before asserting a cargo transfer from proximity alone, which is the most common overreach in maritime reporting.

Phase 9 — Infer cargo from draught, route and port

Compare reported draught against the vessel's laden and ballast marks, and read it against the route, the terminal called at and the cargo the port handles. This gives a defensible inference about whether the vessel loaded or discharged and roughly how much. A good output states the inference and its basis explicitly. Stop before naming a specific commodity unless the terminal is single-purpose or documentary evidence supports it.

Phase 10 — Pull inspection, class and casualty records

Retrieve port state control inspection results, detentions, deficiencies, class society status and changes, casualty records and insurance cover status. Substandard maintenance, frequent class changes and loss of protection and indemnity cover are characteristic of sanctions-evading and grey fleet operations. A good output summarises safety and class standing over time. Stop when the pattern is documented, since a single detention proves little and the trend is the finding.

Phase 11 — Screen hull, parties and cargo against restrictions

Check the IMO number, names, MMSI, owners, managers, flag and known charterers against sanctions lists, port state advisories and flag state deregistration notices. Vessels are designated by IMO number precisely because names change. A good output is a screening record with list versions and dates, covering every party in the chain. Stop when the whole chain is screened rather than only the registered owner, since managers are frequently the designated party.

Phase 12 — Corroborate and refer

Confirm consequential findings with satellite imagery of the vessel at berth or alongside another hull, terminal records, customs data and open reporting, then refer credible evidence of sanctions breach, illegal fishing or forced labour to the relevant authority. A good output distinguishes clearly between AIS evidence, documentary evidence and inference. Stop before publishing findings that could expose crew to retaliation without first considering their safety and, where practicable, the position of a seafarers' welfare organisation.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
IMO GISIS	Registration	IMO global integrated shipping information system with ship particulars, company registration, casualty and port reception data	Authoritative IMO number, registered owner and company identity numbers that anchor the whole investigation
Equasis	Registration	Free consolidated ship information covering particulars, classification, inspections, detentions, managers and insurers	Single best free source for ownership, management and inspection history in one record
Paris MOU port state control database	Open	European inspection results with deficiencies, detentions, company performance rankings and banned vessel lists	Establishes safety standing over time and identifies operators with systematically substandard inspection performance
Tokyo MOU port state control database	Open	Asia-Pacific inspection records with deficiency and detention detail and company performance data	Coverage of the Asia-Pacific region, essential for vessels that avoid European ports
MarineTraffic	Registration	Commercial AIS aggregation with live and historical positions, port calls, vessel particulars and photographs	Voyage reconstruction and port call history, subject to licensing limits on redistribution
VesselFinder	Registration	AIS tracking platform with historical tracks, port calls and vessel databases including ownership fields	Independent second AIS source for corroborating tracks and detecting provider-specific gaps
AISHub	Registration	Community AIS data sharing network providing raw feeds in exchange for contributing receiver data	Access to raw message data with known receiver provenance, useful where evidential quality matters
Global Fishing Watch	Open	Open platform combining AIS and VMS with fishing effort inference, encounters, loitering and port visit events	Detects transshipment encounters, loitering and fishing behaviour using published, peer-reviewed and reproducible methodology
ITU MARS maritime identity database	Open	Registered MMSI numbers, call signs and ship station licences by administration	Validates whether an MMSI is properly assigned and to which administration and vessel
OFAC and EU consolidated sanctions lists	Open	Designated vessels identified by IMO number, name, flag and owner, plus designated shipping companies	Screening the hull and every party in the ownership and management chain
UNCTAD maritime transport statistics	Open	Fleet ownership by beneficial owner country, registration by flag, port throughput and liner connectivity data	Structural baselines for fleet ownership and flag choice against which anomalies are judged
IACS member class societies	Open	Classification society registers with class status, surveys, suspensions and withdrawals for classed vessels	Class changes and withdrawals are early indicators of a vessel moving into the grey fleet
Flag state registries	Open	National ship registers listing registered vessels, owners, tonnage and registration status, with varying transparency	Confirms current registration status and detects deregistration following designation, detention or loss of class
European Maritime Safety Agency information	Open	EU maritime safety data including inspection frameworks, pollution response and traffic monitoring systems	Regulatory context for European waters and the reporting obligations that apply there
Sentinel-1 and commercial satellite imagery	Registration	Radar and optical imagery capable of detecting vessels at sea regardless of transponder status and cloud cover	Confirms presence and alongside operations independently of AIS, which is decisive for dark activity claims
Lloyd's List Intelligence or Clarksons	Licensed	Commercial maritime databases with ownership, fixtures, casualty, sanctions and detailed fleet analytics	Beneficial ownership and commercial fixture detail rarely available in free sources

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Maritime Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Global Fishing Watch map and API — Open access to encounter, loitering and port visit events with documented methods; strongest for fishing vessels, less complete for tankers.
QGIS with maritime plugins — Plots tracks, port polygons and reachability envelopes; excellent analytically, and projection choices matter for distance calculations.
Python with pandas and geopandas — Cleans AIS, detects impossible speeds and computes encounters reproducibly; requires explicit spoofing filters the analyst must write.
SNAP or SAR processing tools — Detects vessels in radar imagery irrespective of transponder status; needs care with sea state and platform artefacts.
AIS decoders such as pyais or gpsdecode — Parse raw NMEA messages into structured positions and static data; preserves provenance far better than platform exports.
Corporate registry search tooling — Resolves single-ship companies and managers across jurisdictions; many shipping registries offer minimal beneficial ownership disclosure.
Reachability and drift modelling scripts — Bound where a vessel could have travelled during a gap; results depend on assumed speed and current handling.
Screening automation against sanctions lists — Checks IMO numbers and party names across regimes; transliteration variance in owner names produces both misses and false hits.
Imagery tasking and archive platforms — Retrieves or commissions imagery to confirm alongside operations; revisit and cost constrain what can be confirmed retrospectively.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Score Country Risk — Recomputes country risk from the weighted inputs and snapshots the result so movement over time is measurable.
Sync Intel Domains — Refreshes the reference and country-level intelligence datasets from their authorities.
Resolve Everything — Batch-resolves ASN, country, org and netblock for every IP from local reference datasets — no API calls, so it runs at millions of rows and works offline.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

The IMO number is the only stable identifier. Names, flags and MMSI values are changed specifically to defeat name-based tracking, sometimes several times a year. An investigation anchored on a name will lose the hull and may follow the wrong one.
Assume AIS can be false. Spoofed positions, cloned identities and manipulated static data are now routine in sanctions evasion. Run physical plausibility checks and identity cross-validation before treating any track as an observation rather than a claim.
A gap is not automatically going dark. Satellite AIS revisit, message collision in busy waters and thin terrestrial coverage all produce genuine silences. Quantify the coverage before you characterise the silence, then quantify how long the vessel was unobserved.
Proximity is not transfer. Two hulls close together for hours is suggestive; correlated draught changes across the encounter, or imagery showing them moored alongside with fenders, is evidence. Publishing the former as the latter is the discipline's classic error.
Follow the manager, not the owner. Single-ship owning companies are disposable and are replaced within days. The technical and commercial managers hold the operational capability and recur across fleets, which makes them the durable analytic target.
Class and insurance changes are early warnings. Withdrawal of classification, movement to a marginal class society, or loss of protection and indemnity cover reliably precede a vessel's move into grey fleet trading, often months before designation.
Crew are usually not the subject. Seafarers on sanctioned and substandard vessels are frequently coerced, unpaid or abandoned. Name operators and owners; protect crew identities, and consider their safety and employment before publication.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Maritime Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of vessels in a monitored portfolio anchored to a verified IMO number with a complete identity history.
Share of reported dark activity findings supported by an explicit coverage analysis rather than a bare gap observation.
Spoofing detection rate, measured by the share of tracks screened with plausibility and identity checks before analysis.
Proportion of asserted ship-to-ship transfers corroborated by draught change or imagery rather than proximity alone.
Time from a designation, detention or flag change affecting a monitored vessel to analyst notification.
Number of referrals to sanctions authorities, port state control or fisheries enforcement accepted and acted upon.
Accuracy of ownership conclusions, tested against subsequent official designations, vessel arrests or court findings where these become available.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Reading an AIS gap as deliberate concealment when terrestrial receiver coverage is simply absent and satellite revisit is sparse
Tracking by vessel name, which changes frequently and is duplicated across many unrelated hulls
Trusting AIS static data such as destination and cargo fields, which are manually entered and routinely wrong or falsified
Assuming the flag state indicates control, when open registries deliberately decouple flag from ownership and operation
Interpreting any close approach as a ship-to-ship transfer without draught, duration and imagery corroboration
Missing AIS spoofing, where a vessel transmits a false identity or a fabricated track while physically elsewhere

Legal and ethical considerations

AIS is an unencrypted safety broadcast, so reception is lawful, but commercial AIS aggregators impose licensing and redistribution terms that apply to derived products. Sanctions screening obligations vary by jurisdiction and by the nationality of the parties involved; findings that suggest evasion generally carry reporting duties. Crew members appearing in records are individuals with data protection rights. Do not interfere with, spoof or transmit AIS, which endangers navigation safety and is a criminal offence in most maritime jurisdictions.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Maritime Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 9 mission domains, 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How do I tell a real transponder shutdown from a coverage gap?

Model the coverage for that place and period. Terrestrial AIS reaches roughly to the horizon from coastal receivers, so mid-ocean coverage depends entirely on satellite constellations whose revisit intervals and message collision rates vary with traffic density and latitude. Check whether other vessels in the same area were being received at the same time, which is the single most useful test. If neighbouring traffic was reported continuously and your vessel was not, silence is meaningful. If the whole area went quiet, it is a coverage artefact and should be reported as one.

What actually proves a ship-to-ship transfer?

A layered case. Behaviour first: two vessels at low or zero speed, holding relative station for several hours, in open water or a known transfer anchorage. Then physical evidence: reported draught increasing on one and decreasing on the other across the encounter, which indicates cargo actually moved. Then imagery: optical or radar showing the hulls moored alongside. Documentary corroboration such as subsequent port calls and cargo declarations completes it. Proximity alone establishes an encounter, nothing more, and reporting it as a transfer is the most common error in this field.

How do I get past single-ship owning companies?

Stop treating the owner as the target. Work the managers, which appear in Equasis and IMO company records with their own identity numbers and typically operate many vessels. Look at the protection and indemnity club, the classification society, the technical manager's address, shared officers across registries, and repeated crewing agencies. Fleet-level patterns emerge quickly: several nominally unrelated single-ship companies sharing one manager, one insurer and one correspondence address is the standard structure, and documenting that structure is usually more valuable than piercing any individual shell.

Can I infer what cargo a vessel is carrying?

Within limits, and only by inference. Reported draught compared against the vessel's laden and ballast marks indicates whether it loaded or discharged and roughly how much. The terminal called at constrains the commodity, since many berths handle one product. Route, tank configuration and vessel type narrow it further. What you cannot do from AIS alone is name a commodity with confidence, and you certainly cannot establish its origin. Say what the draught and terminal support, and reserve specific cargo claims for cases with customs data, cargo documents or operator statements.

Is AIS data admissible in court?

It can be, with the right foundation. What courts need is provenance: which receiver or provider generated the record, when it was retrieved, what processing was applied, and an expert who can explain both the technology and its failure modes including spoofing and coverage gaps. Raw message data with receiver metadata is far stronger than a screenshot from a tracking website. Commercial providers can supply certified extracts. Where a gap forms part of the argument, expect the coverage analysis to be attacked first, so prepare it to the same standard as the positive evidence.

What are the strongest early indicators of a vessel entering the grey fleet?

A cluster of changes over a short period: sale to a newly incorporated single-ship company in an opaque jurisdiction, reflagging to a registry with weak oversight, change to a marginal classification society or loss of class, loss of mainstream protection and indemnity cover, change of manager to an entity with no track record, an ageing hull continuing to trade past normal scrapping age, and increasing AIS gaps. Any one is unremarkable; three or four together within months is a reliable signal and warrants monitoring before any designation exists.

How should I handle crew information found in records?

Minimise and protect. Crew lists, certificates and social media traces are personal data, and seafarers on sanctioned or substandard vessels are usually working under coercion, non-payment or abandonment rather than participating in a scheme. Publishing their names can end their careers through informal blacklisting and expose them to retaliation from manning agents. Anchor accountability on owners, managers, charterers and flag states. Where crew are witnesses or victims, involve a seafarers' welfare organisation and take advice before any contact, since approaches can put them at immediate risk.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

SOLAS Chapter V regulation 19, which mandates AIS carriage and therefore creates the cooperative broadcast this discipline relies on.
IMO ship identification number scheme, which assigns the permanent IMO number used to anchor vessel identity across name and flag changes.
UN Convention on the Law of the Sea, which allocates flag, coastal and port state jurisdiction and governs boarding on the high seas.
Paris and Tokyo Memoranda of Understanding on port state control, which define inspection regimes, detention criteria and company performance rating.
IMO International Safety Management Code, which requires documented management systems and identifies the company responsible for operation.
Port State Measures Agreement administered by the FAO, which governs port access for vessels suspected of illegal, unreported and unregulated fishing.
Maritime Labour Convention, which sets seafarer employment, repatriation and welfare standards relevant to abandonment and forced labour findings.
OFAC and EU maritime sanctions guidance, which sets expectations for due diligence including AIS gap monitoring and ownership screening.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Global Integrated Shipping Information System — International Maritime Organization. Official ship particulars, company identity numbers and casualty data
Equasis ship information system — Equasis, hosted by the European Commission and partners. Free consolidated vessel particulars, management, class and inspection history
Port state control inspection database — Paris Memorandum of Understanding. European inspection results, detentions and company performance rankings
Port state control database — Tokyo Memorandum of Understanding. Asia-Pacific inspection and detention records with company performance data
Global Fishing Watch data and methodology — Global Fishing Watch. Open AIS-derived fishing effort, encounter and port visit datasets with published methods
Maritime mobile Access and Retrieval System — International Telecommunication Union. Registered MMSI and ship station identity records by administration
Review of Maritime Transport — UNCTAD. Annual analysis of fleet ownership, registration, port throughput and shipping markets
Specially Designated Nationals list including vessel entries — US Office of Foreign Assets Control. Designations identifying vessels by IMO number and naming shipping companies
International Association of Classification Societies resources — IACS. Class society standards, membership and unified requirements governing vessel classification
Copernicus Sentinel-1 radar imagery — European Space Agency and European Commission. All-weather radar imagery used to detect vessels independently of transponder status

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: resolves hulls by IMO number, reconstructs voyages including dark gaps, and screens owners and managers continuously. Explore the platform, or browse the rest of the library by following any tag above.