NGA Anti-Shipping Activity Messages: Intelligence Source Guide

ASAM is the US National Geospatial-Intelligence Agency public record of hostile acts against shipping – position, date, hostility type, victim and narrative – published through the Maritime Safety Information service and retrievable programmatically. It is the only maritime crime incident record that is machine-readable, free, and unencumbered by licensing.

At a glance

Source	NGA Anti-Shipping Activity Messages
Category	Conflict, Crime & Human Security › Organised Crime, Gangs & Piracy
Homepage	https://msi.nga.mil/
Machine interface	`https://msi.nga.mil/api/publications/asam`
Format	`JSON`
Access	Open — no account required
Disciplines	Maritime Intelligence, Geospatial Intelligence
Mission domains	Maritime Piracy

Official anti-shipping (ASAM) incident feed. — as catalogued in the platform’s own source registry.

Anti-Shipping Activity Messages are one product within NGA's Maritime Safety Information service, which also carries broadcast warnings to mariners, navigational area warnings, the world port index, sailing directions and light lists. An ASAM record describes an incident in which a vessel or its crew was subject to a hostile or potentially hostile act: boarding, armed robbery, attempted boarding, a suspicious approach, firing on a vessel, hijacking, or the abduction of crew. Each record carries a reference identifier, the date the incident occurred, a latitude and longitude, a textual position description, the navigational area and subregion in which it falls, a hostility classification, an indication of the victim vessel, and a narrative paragraph describing what happened. The service exposes these through a browser query interface and, historically, through an HTTP endpoint returning JSON with reference, navigational area, subregion, year and date-range filtering. The record extends back decades, which makes it the longest maritime incident series that can be retrieved in bulk without negotiating a licence. Treat the endpoint path as unstable rather than fixed. The MSI service has been rebuilt more than once and the previously published ASAM path has not survived every rebuild – at the time of writing the commonly cited path returns a not-found response, while the browser query interface works. Establish the current path and parameter names from the service own interface documentation and from a live response before you write anything against it, and never from a remembered URL.

Its job is to be the machine-readable, redistributable backbone of a maritime crime picture. Every other significant incident record in this domain is either an industry product with copyright restrictions, a regional mechanism publishing PDFs, or a national channel that publishes nothing at all. ASAM is a US Government work, free of the licensing friction that stops you shipping incident rows to a client or into a shared platform, and structured enough to correlate automatically against vessel traffic, port entities and other event feeds. That makes it the right foundation layer: build your incident graph on ASAM, then use the industry and regional records as corroborating and enriching reads on top. The second job it does is temporal depth. Because the series runs back far enough to cover several complete cycles of maritime crime – the Somali basin's rise and collapse, the shift of the Gulf of Guinea from cargo theft to crew kidnapping, the persistent low-level pattern in Southeast Asian straits – it supports the kind of decadal baseline work that the current-awareness products cannot.

Who publishes it, and why that matters

NGA is a US combat support agency and intelligence community member, and MSI exists because of a statutory safety-of-navigation mission rather than because anyone is monetising it. That produces a source with unusual properties. It is free, it is public domain, it will not be paywalled, and it does not depend on a grant cycle – the institutional incentive to keep publishing navigational safety information is durable. It is also derivative: NGA does not have ships being boarded, so ASAM is compiled from reporting that reaches it, including industry reporting centres, allied naval and coast guard channels, regional sharing mechanisms and coastal state notifications. That means ASAM should not be treated as independent corroboration of the industry record; frequently it is the industry record, re-published in a better format with a government reference number attached. The other consequence of the operator's identity is presentational: the classification vocabulary, the geographic partition into navigational areas and the emphasis on warning mariners all reflect a navigation-safety mission rather than a criminological one. Read the product as what it is – an official safety notice service that happens to constitute an excellent dataset – and not as an intelligence assessment.

Provenance is the first question to ask of any dataset and the one most often skipped. Who collects it, what their incentive is, whether they publish a methodology, and whether they correct the record when they get something wrong all bear directly on how much weight a finding drawn from it can carry.

What a record actually contains

The fields you will be working with, what each one means, and whether it is something you can pivot on. Read the meanings carefully — more analysis is wrecked by misreading a field than by failing to find one, and a field that looks like an observation is often an inference.

Field	Type	What it means	Pivot value
`reference`	string	The ASAM identifier, typically combining a year with a sequence number. It is the stable key for the record and the string to quote when citing a specific incident in a product or a case file.	Deduplication against other incident feeds that cite ASAM references; permanent citation in reports.
`date`	timestamp	The date the incident occurred, as reported. It is not the date NGA published the message, and the gap between the two can be days to weeks depending on the reporting chain the incident travelled.	Timeline correlation with AIS position history, port call records and other incident feeds; always allow for the publication lag when you build alerting.
`latitude, longitude`	float	The reported position in decimal degrees. Precision varies with the original report; many positions are rounded or derived from a bearing and distance from a landmark, so identical coordinates across incidents usually indicate rounding rather than a precise recurring location.	Geospatial correlation with traffic density, anchorage polygons, chokepoints and exclusive economic zone boundaries.
`position (text)`	string	The human-readable position description, frequently more informative than the coordinates because it names the anchorage, strait, port approach or distance offshore that gives the incident its operational meaning.	Port and anchorage entity resolution; grouping incidents by governance environment rather than by raw geography.
`navArea`	enum	The navigational area under the worldwide navigational warning service in which the incident occurred. This is a maritime administrative partition, not a criminological one, and it will not align with the regions your client thinks in.	Cross-reference to navigational warnings and broadcast messages for the same area and period.
`subregion`	string	A finer geographic subdivision used by the service to group incidents. Useful for consistent aggregation within the source; do not assume it matches any other regional scheme you use.	Internal aggregation and trend series; map explicitly to your own theatre definitions rather than assuming correspondence.
`hostility`	enum	The classification of what occurred – boarding, robbery, attempted boarding, suspicious approach, firing on a vessel, hijacking, kidnapping and similar categories. This is the primary severity discriminator and the field most often mis-aggregated.	Severity banding, tactic analysis, and separation of attempted from successful attacks – which must be done before any counting.
`victim`	string	The vessel affected, typically by type and sometimes by name or with identifying details withheld. Where a name is present it is the entry point to registry data; where it is absent, the incident cannot be tied to a hull.	Vessel registries and ownership chains via IMO number where obtainable; AIS identity resolution.
`aggressor`	string	What is known about the attacking party where anything is – number of persons, type of craft, weapons observed. Frequently sparse or absent, because the information depends entirely on what the crew could see and report.	Modus operandi profiling and linkage of incidents to a consistent operating group; treat sparse entries as unknown rather than as none.
`description`	string	The narrative account: how the approach and boarding occurred, what was taken, whether the crew was harmed or held, what the ship did, and whether any authority responded. The most information-dense field in the record.	Structured extraction of tactics, weapons, group size, crew consequences and response quality; the basis for all serious pattern work.
`subject or title`	string	A short summary line for the message, which often encodes the location and hostility in a compact form suitable for display and triage.	Fast filtering and alert routing before an analyst reads the full narrative.
`navigational area warnings (adjacent product)`	string	Not part of an ASAM record, but retrievable from the same service and covering the same waters. Warnings issued around an incident date give you the official operational response and the wider hazard picture.	Contextual enrichment of an incident with the warning traffic that preceded and followed it.

Coverage — and what is not in it

Worldwide, with density where the incidents are: the Gulf of Guinea, the Singapore and Malacca Straits and the Indonesian archipelago, the Bay of Bengal anchorages, the Somali basin and Gulf of Aden during their active period, the southern Red Sea, the Caribbean and the eastern Pacific approaches to South America, and West African anchorages. The historical series is deep – it reaches back decades and constitutes the longest programmatically accessible maritime incident record available – which is what makes it valuable for baseline work that no current-awareness product can support. Update rhythm is event-driven rather than scheduled: records appear as reports reach NGA and are processed, so the practical cadence is a daily or twice-daily poll with the understanding that an incident may appear days after it occurred. Coverage is of reports that reached the US government's maritime safety reporting chain. That chain is broad and includes industry, allied military and regional mechanisms, but it is still a chain, and incidents that never entered it – because a local vessel's owner had nobody to tell, or because a coastal state kept the matter internal – are absent. The service also inherits regional gaps from its contributors, so quiet stretches in the record correspond as often to quiet reporting as to quiet water.

Known blind spots

Absence of evidence here is not evidence of absence. These are the conditions under which NGA Anti-Shipping Activity Messages will not show you something that is nevertheless real:

It is a compilation, not a collection. NGA aggregates reporting from other bodies, so an incident absent from those bodies is absent here, and an incident present in both is one incident rather than two independent confirmations.
Local and non-commercial vessels are heavily under-represented. Fishing boats, coastal traders, barges and small craft absorb a large share of real maritime crime and rarely generate a report that reaches an international safety chain.
The record only knows about acts against vessels. Maritime crime that does not involve approaching or boarding a ship – illegal fishing, smuggling, trafficking by sea, pipeline theft, port-side corruption – is outside the scope entirely.
Positional precision is inherited from the original report and is frequently rounded. Coordinates cannot support inference at a resolution finer than a few nautical miles, and clusters at round numbers are artefacts.
Vessel identity is often incomplete or withheld, which breaks the pivot to ownership, management, flag and traffic history for exactly the incidents where the reporting party wanted discretion.
Aggressor detail is a function of what a crew could observe at night under threat, so the absence of weapons or group size in a record says nothing about whether weapons or numbers were present.
Publication lag makes it unsuitable as a sole tipper for live operations. If you need to know within the hour that a vessel has been attacked in your area, this is not the channel; the operational advisory services are.
Reporting chains are politically shaped. Where a coastal state discourages reporting or handles incidents domestically, the record thins in a way that is invisible in the data and correlates with weak governance rather than with low crime.
There is no negative reporting and no denominator. The record cannot tell you how many vessels transited safely, so raw counts over time conflate changes in crime with changes in traffic.

Write the blind spot into the product. A statement that something “was not observed in NGA Anti-Shipping Activity Messages” is defensible; a statement that it “did not happen” is not, and the difference is what survives cross-examination.

Access, licensing and what you may do with it

Access model: Open — no account required

Access is open and unauthenticated over HTTPS from the Maritime Safety Information service, with a browser query interface for manual work and a JSON endpoint for programmatic retrieval. There is no key, no registration and no quota to negotiate. Three practical cautions. First, do not assume any endpoint path you were given is current: the service has been rebuilt more than once, ASAM retrieval has moved, and a path that worked in a colleague script last year may return a not-found response today. The service publishes its own interface documentation, and that plus one exploratory request is the only reliable way to establish what exists. Second, code against the observed response rather than a remembered schema, and re-probe whenever collection silently returns nothing – a moved endpoint fails as an empty result far more often than as an obvious error. Third, plan for the full-history problem: take the archive once with a wide date range, store it locally, and thereafter request only recent windows, treating your local copy as the working corpus and the service as the delta channel. For manual work the browser query interface is entirely adequate for looking up an individual incident and reading its narrative.

Licence

Works of the US federal government are generally not subject to domestic copyright, and NGA publishes maritime safety information for free public use. In practice this is the least encumbered incident data in the maritime domain: you can store it, redistribute it, embed it in a commercial product and ship it to clients without a licensing conversation, which is precisely why it should be your base layer. Two qualifications matter. NGA attaches disclaimers to its navigational products about fitness for purpose and about not substituting for official charts and publications – respect those, and never present ASAM as authoritative for navigation or for legal determination. And absence of copyright is not absence of obligation: attribute the source, do not modify records in ways that misrepresent what NGA published, and if you redistribute, keep the reference identifiers so a recipient can trace a record back. If your organisation operates outside the United States, take local advice on whether any residual rights apply in your jurisdiction rather than assuming public domain travels automatically.

Rate limits and fair use

No published limits, which means self-restraint governs. The correct pattern is one large historical pull followed by incremental date-range requests on a daily or twice-daily schedule; nothing in the underlying data changes fast enough to justify more. Use a descriptive user agent with a contact address, request compressed responses, cache locally and never re-fetch a window you already hold. Serialise your requests rather than parallelising them, back off exponentially on any error or slow response, and remember that this infrastructure also serves warnings to mariners at sea – degrading it for a bulk analytics job would be an unusually poor trade.

Licensing changes, and it changes without warning. A dataset that was free for research this year may not be free for commercial or evidential use next year. Confirm the current terms before you build a dependency on it, and record the terms you relied on alongside the data — the licence in force at the time of collection is part of the provenance.

Collecting it

How NGA Anti-Shipping Activity Messages is actually pulled, in the order you would set it up. Prefer the bulk or export interface over per-item lookups wherever one exists: it is kinder to the publisher, faster for you, and gives a reproducible snapshot rather than a series of point-in-time answers you cannot reconstruct later.

Method	Format	Cadence	Notes
Full historical pull	JSON	once, then re-baseline annually	Take the archive with a wide date range in a single controlled operation and store it. This is your corpus; everything after is a delta. Record the pull date, because later corrections to earlier records will not announce themselves.
Incremental date-window poll	JSON	daily	Request the last few weeks each day and upsert on the reference identifier. Overlapping the window absorbs the publication lag, which is the reason a same-day-only poll will silently miss incidents.
Reference lookup	JSON	per case	Retrieve a specific record by its reference when citing or verifying an incident inside a case. This is the citation-grade route and it is what belongs in an evidence file.
Browser interface	HTML	as needed	For analysts reading narratives and checking geography without touching the pipeline. Good for the manual verification step that should precede any finding.
Adjacent MSI products	JSON	as published	Navigational warnings and broadcast notices from the same service provide the operational context around an incident – what mariners were being told at the time, and whether the area was already flagged.

Ingesting it into the platform

Every step below is idempotent and cursor-based: interrupt one and it resumes from where it stopped rather than duplicating rows or losing progress. Collection is recorded per source, so a feed that quietly stops publishing shows up as a stale timestamp instead of silently thinning your coverage.

Register the feed and probe the schema — Add it in sources.php and feeds.php, then make one exploratory request and record the observed field names and types in the source definition. Code the parser against the observed response, not against remembered documentation, and re-probe after any collection failure.
Collect on an overlapping window — Run it through collect.php on a daily schedule requesting a window wide enough to absorb the publication lag, upserting on the reference identifier so re-collected records update rather than duplicate.
Normalise position and record precision — Store coordinates in a single geodetic frame with an explicit precision attribute derived from the significant digits and from the position text. Rounded positions must not render at the same apparent confidence as precise ones anywhere in the platform.
Classify severity from hostility plus narrative — Map the hostility value to your own severity ladder – approached, fired upon, boarded, boarded with theft, boarded with violence, crew taken, vessel taken – using the narrative to resolve ambiguity. Keep the original hostility string alongside your derived class so the mapping stays auditable.
Deduplicate against the industry and regional records — Run correlate.php against the industry reporting centre listing and the regional sharing centre reports, matching on date, position proximity and vessel. Because ASAM is partly compiled from those sources, matches indicate the same incident and must not be counted as corroboration.
Emit coordinate and vessel data points — Each record yields a dp_coordinates with precision and, where identity is disclosed, a dp_vessel resolved to a persistent entity via registry lookup. Incidents without vessel identity remain attached to place and time only.
Structure the narrative — Extract group size, craft type, weapons observed, method of approach, property taken and crew consequences into typed attributes. Where copilot.php summarises a cluster of narratives, the summary is prose about records that already exist – the structured attributes come from the text.
Publish into the maritime picture — Surface incidents in ais.php and theater.php against traffic and anchorage occupancy, and expose the series in timeline.php normalised by traffic rather than by calendar month, so that a congestion-driven rise is not read as an escalation.

Registered sources and their last-collected state are listed in sources.php, and the scheduled chain that keeps them current is in automation.php.

How it is wrong, and how to tell

Every dataset is wrong in characteristic ways. Knowing which ways is the difference between using a source and being used by one, and it is the part of source evaluation most often skipped because it is the part that takes work.

Structurally, this is a well-behaved source: stable identifiers, consistent geometry, a controlled classification vocabulary and a narrative that is usually specific about what happened. The processing is careful and the record has institutional continuity that outlasts any individual programme. Its quality limits are inherited rather than internal. Because NGA compiles rather than collects, the completeness of ASAM is the completeness of the reporting chains that feed it, and those chains are strongest for internationally managed merchant shipping and weakest for local craft. The classification is applied from the report as received, so a boarding described ambiguously by a stressed crew will be classified from that ambiguity. And because incidents arrive through several routes, the same event can occasionally appear with different positions or dates than another source gives it. Judge quality the way you judge any compiled feed: sample incidents you know from primary material, check whether they are present, whether the position and date are right, and how the narrative compares to the ship's own account. In most regions the answer is that presence is good for merchant shipping, position is right to within a few miles, dates are right, and the narrative is a faithful but compressed version of the original report.

Characteristic false positives

Suspicious approaches counted as attacks. The record deliberately includes approaches that may have been innocent, and any total that merges them with successful armed boardings will overstate severity by a wide margin.
Double counting against the industry record. The same incident routinely exists in ASAM and in the commercial reporting centre listing, often with slightly different coordinates, and a naive union of sources produces a false trend that looks alarming and is arithmetic.
Rounded coordinates read as precise. Positions cluster at round values because reports round, and heat maps built without a precision filter will invent hotspots at those coordinates.
Publication lag read as timing. The date field is the incident date but the record's appearance is later, so an alerting rule keyed on retrieval time will misplace incidents in the week and will miss them entirely if the poll window is too narrow.
Vessel identity inferred from position and time. Where the victim is unnamed, matching to a hull using AIS proximity is tempting and unreliable, and an incorrect attachment of an attack to a named ship is a serious error with commercial consequences.
Sparse aggressor detail read as absence. A record with no weapons mentioned frequently means the crew could not see or did not report, not that the attackers were unarmed.
Reporting-chain change read as crime change. A regional mechanism starting or stopping its flow of reports to NGA moves the ASAM count without anything changing on the water.
Counting incidents rather than rates. Traffic volumes and anchorage occupancy vary enormously across seasons and years, and an unnormalised count conflates exposure with risk.

None of these make the source unusable. They make it a source that requires corroboration before an assertion built on it goes into a product, which is true of every source and admitted by few.

Ageing

Individual records do not decay – an incident from 2004 remains an accurate account of 2004 – but three time-sensitive properties matter. First, records can be added late. A report that took weeks to reach NGA appears with an older incident date, which means a window you collected and considered complete may gain entries afterwards; this is why your incremental poll must overlap and upsert rather than append. Second, records can be corrected, so your local copy will drift from the service unless you re-baseline periodically. Third and most importantly, the analytical currency of the maritime picture decays fast. A threat assessment for a specific strait or anchorage built on incidents more than a couple of quarters old is describing a past environment, because enforcement posture, congestion, monsoon patterns and local conflict all shift the pattern within a season. A stale ASAM-derived product looks like a confident hotspot map whose hotspots are historical, published without a validity window. Date every product, re-baseline the corpus at least annually, and refresh operational assessments quarterly.

What this source feeds

A source is only worth what it lets you conclude. These are the disciplines that collect through it, the mission domains it serves and the data points it yields — every one is a tag, so you can follow any thread from here into the rest of the library.

Collected by these intelligence disciplines

Serves these mission domains

Maritime Piracy

Yields these data points

How each sector uses NGA Anti-Shipping Activity Messages

The same dataset is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The records are shared — the constraints, thresholds and outputs are not.

🎖 Military and defence

For naval and maritime forces this is the public-domain baseline that can be shared across a coalition without a licensing conversation, which is a practical advantage that repeatedly matters more than data quality. Use the long historical series to characterise the normal pattern for an area of operations – what kinds of incidents, against what vessel types, at what distance from shore, in what season – so that a current report can be judged as normal or anomalous. The navigational area partitioning aligns with the warning system your bridge teams already use. For counter-piracy effectiveness assessment, normalise against traffic and look for geographic displacement rather than for a fall in the total, and pair the record with your own boarding and sensor data before drawing conclusions about deterrence.

🕵 National intelligence

In maritime intelligence, ASAM's value is as the structured spine you correlate everything else against. Its length supports genuine baseline work: you can establish what a decade of normality looks like in a subregion and measure a current period against it, which is not possible with any current-awareness product. The narratives, read in bulk for a location, characterise actor capability and intent – whether groups come equipped to take cargo, product or people, whether they operate at range from a mother ship or close inshore, and whether their behaviour changed after an enforcement action. Because the source is compiled, treat gaps as questions about reporting chains, and use the divergence from industry and regional records as an indicator in its own right.

👮 Law enforcement

For law enforcement and coast guards, the record supports case linkage across jurisdictions and gives you a referenceable identifier for an incident that may otherwise exist only in a foreign national file. The narratives frequently contain the modus operandi detail that connects separate incidents to a single crew, and the position and flag information determine jurisdiction and the mutual legal assistance route. It is not evidence: it is a government compilation of third-party reports, and the evidentiary chain runs to the ship's log, the master's statement and the coastal state's investigation file. Use the ASAM reference to locate those, and cite it as a locator rather than as proof.

🔍 Private investigation and corporate security

For maritime security consultancies and marine insurers, the licensing position is the decisive practical fact: this is incident data you can put in a client deliverable and a commercial product without asking anyone. Build your route, port and anchorage risk products on it, normalise by traffic, present the severity ladder rather than a total, and use the industry and regional records to check whether the ASAM picture for a location is complete. Be candid with clients that all maritime incident data undercounts, and quantify your estimate of by how much for their specific trade rather than issuing a generic caveat.

📰 Journalism and OSINT media

For journalists, ASAM is a rare thing: a free, official, machine-readable dataset on a subject usually covered through industry press releases. It supports data-driven reporting on how maritime crime has changed over decades, on the shift from cargo theft to crew kidnapping in particular regions, and on the gap between what governments acknowledge and what shipping reports. The obligations are the usual ones plus one specific to this source: because it compiles from other bodies, do not present agreement between ASAM and an industry record as two sources confirming a fact. State your normalisation, separate attempted from successful, and give the record's publication lag if you are reporting on recent months.

🌍 NGO, humanitarian and human rights

For seafarer welfare organisations and human rights researchers, the crew consequence detail in the narratives is the accessible open record of harm to crews – assault, hostage-taking and abduction – and its public-domain status means you can publish derived analysis freely. The pattern by vessel type exposes which seafarers carry the risk, typically those on smaller and older tonnage under flags with limited protection. Handle any identifying detail carefully, aggregate for advocacy, and route live welfare concerns through established seafarer support mechanisms. Note that the record covers commercial shipping, so harm to fishers and to people moving by sea in small craft is largely outside it.

🎓 University and research

For maritime security and criminology research, this is the workhorse dataset: long, structured, free, redistributable, and therefore reproducible in a way that industry data is not. The standard designs use it as the base series and treat the divergence from industry and regional records as an object of study for estimating reporting rates. Be rigorous about normalisation by traffic exposure, about the compiled rather than collected nature of the source, and about the classification vocabulary, whose categories were designed for warning mariners rather than for criminological analysis and should be re-mapped explicitly and documented in your methods.

Playbook: working NGA Anti-Shipping Activity Messages end to end

A repeatable sequence from first pull to finished product. Each phase states what you are trying to establish, not merely what to click — the objective is a defensible chain of reasoning, not a completed checklist.

Phase 1 — Probe the API before you write anything

Make one request and read the raw JSON. Confirm the field names, the date format, the coordinate representation and how filtering actually behaves. Every wasted day with this source begins with someone coding against remembered parameter names from an earlier version of the service.

Phase 2 — Take the history once and own it

Pull the full archive in a single controlled operation, store it with the pull date, and treat it as your corpus. Working from a local copy makes your analysis reproducible, protects you from service changes, and removes any temptation to hammer the endpoint during exploration.

Phase 3 — Build the delta loop with overlap

Poll a rolling window that is several times wider than the observed publication lag, and upsert on reference. If you have not measured the lag for your regions yet, measure it: it is a property of the reporting chain and it differs by area, and it determines whether your alerting works.

Phase 4 — Derive your own severity ladder

Map the hostility vocabulary onto an explicit ladder from suspicious approach through to vessel seizure, resolving ambiguous cases from the narrative. Keep the original value alongside. From this point onward, never report a combined incident total without the ladder beside it.

Phase 5 — Deduplicate across sources deliberately

Match ASAM records against the industry reporting centre and regional centre listings on date, position proximity and vessel, and store a source-count per incident. Because ASAM compiles from those sources, a match means one incident seen twice, and the source-count is a completeness signal rather than a confidence one.

Phase 6 — Establish the traffic denominator

Obtain vessel traffic and anchorage occupancy for your area and period. Incidents per thousand transits, or per thousand ship-hours at anchor, is the measure that survives scrutiny; incidents per month is the measure that produces false alarms every time congestion rises.

Phase 7 — Segment by vessel status and type

Separate underway attacks from anchorage and berth incidents, and profile by hull type. These populations have different perpetrators, different weapons, different economics and different countermeasures, and an assessment that merges them is wrong for both halves of the merger.

Phase 8 — Read narratives as a corpus for each location

For a chokepoint or anchorage of interest, read every narrative for the last few years consecutively. Recurring method – approach from astern in darkness, use of poles and hooks, targeting of engine room stores, threat displayed rather than used – identifies a consistent operating group and is invisible in any aggregate.

Phase 9 — Test the reporting chain

For each subregion, compare the ASAM series against the regional mechanism and industry record over the same period and look for divergences that begin or end abruptly. Those inflections are usually changes in who reported to whom, and identifying them prevents you presenting a reporting artefact as a security development.

Phase 10 — Resolve vessels only where identity is given

Where a vessel is named, resolve it via registry data to an IMO number, owner and manager, and check for repeat victimisation across the corpus. Where it is not named, leave the incident attached to place and time. Do not infer identity from AIS proximity; the error rate is high and the consequences of a wrong attachment are commercial and legal.

Phase 11 — Corroborate before you conclude

Take the incidents carrying your conclusion and check them against the industry listing, the regional report and local reporting. You are testing position, date, severity and whether anything material was omitted from the compiled version. A conclusion resting on ten records should be able to survive an editor checking three of them.

Phase 12 — Publish with denominator and validity date

State the traffic normalisation, the severity ladder, the deduplication method and the incident window on the face of the product. Maritime risk assessments circulate for years after they are written, so a validity date is not a formality – it is what stops a client sailing on a two-year-old hotspot map.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

What to pair it with

No single source carries a finding. These are the datasets that corroborate, extend or contradict this one — and a source that contradicts is worth more than one that agrees, because it is the only thing that will tell you when you are wrong.

Source	Relationship	What it adds
IMB Piracy Reporting Centre	corroborates	The industry-side record from the ICC's International Maritime Bureau, collected directly from ships. Overlaps heavily with ASAM by construction, so treat agreement as duplication and disagreement as the interesting signal.
ReCAAP ISC	extends	The Asian government-to-government mechanism, adding a formal severity classification and a stricter legal framing for incidents in its reporting area.
UKMTO	extends	Operational advisories and incident alerts for the Indian Ocean and Gulf region, far closer to real time than any compiled record and the right channel for live awareness.
MSCHOA	extends	Maritime security guidance and reporting for transits through the high-risk area, oriented to vessels planning and executing passages rather than to retrospective analysis.
IMO GISIS	corroborates	State-reported incident data through the IMO's information system, which is biased in the opposite direction to industry reporting and useful as a third reading.
Equasis	prerequisite	Free vessel particulars, ownership and management records. The route from a named victim vessel to the company that operates it and the flag administration responsible for it.
AIS vessel tracking	extends	Traffic density and individual position history, which supplies both the denominator for rate calculations and the context around a specific incident.
NGA Maritime Safety Information	extends	The parent service: navigational warnings, broadcast notices, the world port index and sailing directions, all from the same host and all useful context around an incident.
US Maritime Administration	corroborates	Advisories and alerts on threats to US-flag and US-interest shipping, sometimes carrying assessment language that the incident record deliberately does not.

Legal, ethical and operational constraints

The licensing position is the most permissive in this domain: US federal government works are generally free of domestic copyright and NGA publishes maritime safety information for public use, so storage, redistribution and commercial incorporation are available to you without negotiation. Attribute the source, preserve the reference identifiers and respect NGA's disclaimers about fitness for navigation. Beyond licensing, three constraints apply. First, characterisation: incidents recorded here span acts that are piracy in international law and acts that are domestic armed robbery within territorial waters, and the record's classification vocabulary is operational rather than legal. Never let an ASAM hostility value stand as a legal characterisation in an advice or a filing. Second, personal data: narratives can identify crew who were assaulted, held or abducted, and although the record is public, aggregating and republishing those details in a commercial product engages data protection obligations in most jurisdictions and can cause real harm to seafarers and their families. Third, export and dissemination rules: the data is unclassified and public, but if your organisation fuses it with controlled material, the resulting product inherits the controls of the most sensitive input, and the public origin of one layer does not release the composite.

Operational security

You are making unauthenticated HTTPS requests to a US government intelligence-community agency's public service. The requests are logged – source address, timing, user agent, and the date ranges and references you asked for. For most users this is entirely unremarkable and involves no meaningful exposure; maritime safety information is consumed globally by shipping companies, researchers and navies. It is worth thinking about in two cases. If your organisation's association with a US agency's service would itself be sensitive in your operating environment, note that the traffic is visible to your local network operators and to any intermediary, not only to NGA. And if you are querying repeatedly for a narrow window and a specific area during a live operation, that pattern is more informative than any single request. The mitigation is straightforward and cheap: take the full archive once, work from the local copy, and let the daily delta poll cover a standard wide window rather than the specific area you care about.

Two rules that hold regardless of jurisdiction. Collection that is lawful is not automatically proportionate, and a dataset assembled for one purpose does not carry consent for another. Where the records concern identifiable people, the question is not only whether you may hold the data but whether holding it serves the purpose you are accountable for.

Is it earning its place?

Sources accumulate. Feeds get added during an incident and are never reviewed again, and a decade later the pipeline is carrying dead weight that nobody dares remove. These are the measures that show whether NGA Anti-Shipping Activity Messages is contributing anything, and they are worth baselining now so the answer is available later.

Measured publication lag per subregion between incident date and first appearance in the API, which determines whether your poll window is adequate and whether alerting on this source is viable at all.
Source-count distribution across your deduplicated incident set, tracked per region as the practical measure of how complete any single record is for that water.
Parser failure rate and schema drift events per year, which tells you whether coding against the live response has actually protected you from service changes.
Proportion of incidents with a resolvable vessel identity, since that fraction bounds all ownership, repeat-victimisation and fleet-exposure analysis you can offer.
Coordinate precision distribution in your corpus, as a direct constraint on the resolution at which any geospatial product can honestly be drawn.
Divergence between the ASAM series and the regional mechanism for the same waters, monitored for abrupt inflections that indicate a reporting-chain change rather than a security change.
Share of your maritime products that carried a traffic-normalised rate rather than a raw count, as a simple quality-control measure.
Time from a new record appearing to an analyst having read the narrative, for the regions where you have committed to current awareness.

Beware of volume. Indicator counts rise easily and say almost nothing. Unique contribution — findings this source produced that no other source in your stack would have — is the measure that matters, and it is usually far lower than anyone expects.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Read the live JSON before you write the parser. The service has been rebuilt before, and coding against a remembered schema is the most reliable way to lose a day and then silently collect nothing.
ASAM is compiled, not collected. Agreement with the industry record is duplication, not corroboration, and treating it as confirmation will make you confident about numbers that came from a single original report.
Normalise by traffic or say nothing about trend. Incident counts move with congestion, seasons and trade volumes, and an unnormalised series will manufacture escalations that no mariner experienced.
The hostility field is a warning vocabulary, not a criminological one. Map it to your own severity ladder explicitly, keep the original value, and never publish a total that merges suspicious approaches with armed boardings.
Coordinate precision is inherited from a stressed crew's report. Store precision as a first-class attribute and refuse to render points at a resolution the source cannot support.
Overlap your poll window generously. Late-arriving records with older incident dates are normal, and an append-only pipeline keyed on retrieval date will lose them permanently.
Position text often beats coordinates. Knowing an incident happened at a named anchorage tells you about the governance and traffic environment in a way that a decimal pair does not.
Never infer a victim vessel from AIS proximity. Where the record does not name the ship, the correct output is an incident with no vessel attached, and the discipline to leave it that way is what separates a defensible product from a lawsuit.
Use the public-domain status deliberately. This is the one maritime incident record you can freely share with a coalition partner, a client or a research collaborator, and building your architecture on it rather than on licensed data removes a category of problem permanently.

Questions analysts actually ask

Is ASAM independent of the industry piracy reports?

No. NGA compiles from reporting that reaches it, including industry and regional mechanisms, so many records describe the same incidents. Use it as a structured, redistributable base layer, and look to local reporting and coastal state sources for genuinely independent confirmation.

Can I redistribute the data commercially?

Generally yes. US federal government works are typically free of domestic copyright and the service is published for public use, so this is the incident data you can put in a product without a licensing conversation. Attribute it, keep the reference identifiers and respect NGA's fitness-for-purpose disclaimers.

Why did an incident appear days after it happened?

Because the record travels a reporting chain before NGA publishes it, and the lag varies by region and by reporting route. Measure the lag for your areas, and make your collection window several times wider than it, upserting rather than appending.

How far back does the record go?

Decades – it is the longest maritime incident series you can pull programmatically. That depth is its principal advantage over current-awareness products, and it is what makes genuine baseline comparison possible.

Should I use this for live alerting on an area?

Only as a secondary layer. The publication lag makes it unsuitable as the primary tipper for a vessel in transit; the operational advisory and reporting services exist for that. ASAM's role is baseline, pattern and post-incident analysis.

The victim vessel is not named. Can I work out which ship it was?

You should not. AIS proximity matching looks convincing and is unreliable, and wrongly attaching an attack to a named ship has commercial and legal consequences for its owner. Leave the incident attached to place and time and say so.

Are the coordinates accurate enough for geospatial analysis?

At the scale of straits, anchorages and approach areas, yes. At the scale of a specific position, frequently not – many positions are rounded or derived from a landmark bearing. Store a precision attribute and let it govern what you draw.

Why does the record disagree with the regional centre's count?

Different reporting chains, different inclusion criteria and different severity classifications. The divergence is analytically useful: an abrupt change in it usually means a reporting relationship changed, which is a finding about information flow rather than about crime.

Is an ASAM record evidence of an offence?

No. It is a government compilation of a third-party report, produced for navigational safety. Use the reference to locate the primary material – the ship's log, the master's statement, the coastal state's file – and build any evidentiary case on those.

The endpoint I was given returns a 404. Is the data gone?

Almost certainly not – the path has moved. The MSI service has been rebuilt more than once and ASAM retrieval has changed location, while the browser query interface on the same site continues to work. Consult the service own interface documentation and confirm the current path with a live request, and build a monitor that alerts on an empty collection result rather than only on an HTTP error.

Standards, formats and interoperability

What this source speaks natively, and what it has to be translated into before a partner can consume it. Work that arrives in a recognised format is easier to defend, easier to hand over and easier to automate against:

JSON over HTTPS from a public government service, with stable reference identifiers suitable for use as persistent citation keys in reports and case files.
Geographic organisation by navigational area under the worldwide navigational warning service, which aligns with the maritime warning system but not with any criminological or commercial regional scheme.
Records map cleanly to STIX 2.1 incident and location objects, with vessel identity as an identity object where disclosed and the reference retained as an external reference.
IMO numbers are the correct persistent vessel key where a victim vessel can be resolved; vessel names alone must never serve as identity.
Coordinates should be handled in a standard geodetic frame with an explicit precision attribute, since the source mixes precise and rounded positions without flagging which is which.
The legal distinction between piracy on the high seas and armed robbery against ships within territorial waters governs characterisation, and the hostility vocabulary here does not encode it.
Public-domain status makes the data suitable for MISP, TAXII and CSV redistribution without licence encumbrance, which is a genuine architectural advantage worth designing around.
Adjacent MSI products – navigational warnings, broadcast notices, the world port index – share the same service and provide the standard context layer for an incident.

References

Primary documentation and authoritative references for this source. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

NGA Maritime Safety Information — US National Geospatial-Intelligence Agency. The service home: anti-shipping activity messages, navigational warnings, the world port index and the browser interfaces to all of them.
MSI API documentation — US National Geospatial-Intelligence Agency. The service publishes its own interface documentation. This is the authoritative statement of which endpoints and parameters currently exist, and it should be consulted before any parser is written.
MSI piracy and ASAM query page — US National Geospatial-Intelligence Agency. The browser interface for querying anti-shipping activity messages by reference, navigational area, subregion and date. The right place to read narratives and to confirm what the query interface currently supports.
National Geospatial-Intelligence Agency — NGA. The parent agency, its mission and its public data policies – relevant to understanding why this product exists and why it is free.
IMB Piracy Reporting Centre — ICC International Maritime Bureau. The industry-side incident record, collected directly from ships and one of the inputs that reaches compilations like this one.
ReCAAP Information Sharing Centre — ReCAAP ISC. The Asian government-to-government mechanism, with a formal severity classification that is the best available structured severity read for that region.
International Maritime Organization — IMO. The legal framework distinguishing piracy from armed robbery against ships, plus reporting and investigation guidance.
Equasis — Equasis. Free ship particulars, ownership and management data – the first pivot from a named victim vessel to the company behind it.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this source: it polls ASAM on an overlapping window into a persistent corpus, deduplicates it against the industry and regional records before anything is counted, and renders every incident against traffic and anchorage occupancy with its own coordinate precision showing.. Browse the full source catalogue, or follow any tag above into the rest of the library.