Fake IDs on the High Seas: How Bad Actors Evade Detection

WEBVTT - The Decisive-S5Ep5 Fake IDs on the High Seas Hello, and welcome to the Decisive podcast. I'm Kristen Hallam, your host for this episode. Today, we delve into a shadowy world that impacts international trade, sanctions enforcement and maritime security, the manipulation of ship identities. Imagine a massive cargo vessel officially decommissioned and scrapped years ago, yet somehow still navigating the world's oceans.

It's digital signals, legal documents and physical identity, all forged or manipulated to conceal its true origins. This isn't science fiction. It's a growing reality driven by sophisticated actors exploiting vulnerabilities in maritime tracking systems, ship registries and regulatory oversight. This cl-destined industry of ship identity fraud enables illicit activities such as sanctions evasion and smuggling.

With billions of dollars at stake, understanding how these "zombie ships operate through spoofed AIS signals, forged documentation and vessel reflagging is crucial for regulators, insurers and global markets alike. To help us navigate these murky waters, pun intended, I am pleased to welcome back to the podcast, Jeremy Domballe, an expert in Maritime Risk and compliance at S&P Global Market Intelligence. Jeremy is going to clue us in on how vessels misrepresent their identities, the scale of this illicit trade and the measures to combat it.

Jeremy, welcome back to the decisive. Kristen, thanks for having me back. Right. So Jeremy, from your vantage point in maritime risk and compliance, what does ship identity really mean in practice?

And why is it so foundational to sanctions enforcement and commercial decision-making? It's a really good question and a crucial question, which I feel sometimes we don't stop to think about, but the identity of a vessel is quintessential in underpinning many of the foundations when it comes to shipping. You can think about it in terms of how a parcel might relate to you, and it's how we know who a vessel really is. So in practice, when we think about identity, it's built upon multiple pillars of identifiers, which we can explore a little bit more, but in terms of your registered identity or your digital identity, your physical identity and the different points of information that are housed beneath all of that.

And this matters enormously because the entire maritime compliance ecosystem from sanctions enforcements to insurance underwriting to port state control relies on accurately identifying vessels. So when I can't confidently say this vessel is X, I can't determine if it's sanctioned. And if it has proper insurance or if it's been involved in illicit trade or any other number of different points of information that might relate to that ship. So that's really why being able to understand that focal point that beginning, if you will, that identity is so important.

Thank you for that, Jeremy. Now as we've discussed on the podcast before, and you mentioned pillars just now, you can think of identity as having the digital, the physical and the document-based components. Could you just take a minute or 2 to remind us how these 3 pillars work together when things are legitimate and how bad actors exploit the seams between them? So when everything is digital, like you say, these 3 identities should mirror each other perfectly, what you see in the DigiSphere versus what you would physically see as in the tangible world and the documentation you would see would all align together.

you'd get the same picture. And what would also happen is that you have other focal points of information, which are called unique vessel identifiers or UVIs, principally, it's known as the IMO number that bring these different types of data together. It could be your digital identity. So that's like I mentioned, anything that you would transmit or could be perceived digitally, your footprint through AIS to your radar signature or when we talk about physical identity, - it could be anything from the dimensions of the ships to your deck configuration or color schemes being utilized or even the flags that you're flying on the vessel.

And then finally, when we talk about a documented identity, it's what's been registered to the vessel. So anything that speaks towards flag certificates or classification, documentation, et cetera, just documentation that is legally binding in nature. And all 3 of those should bring about the same sort of information. But the real challenge is there are - like you said, there are cracks in the scams that can sometimes occur - and when one of those pillars or when one of those sets of identifiers falls out of balance within that equation, and there lies the opportunity to then misconstrue or misassociate the activities that a vessel potentially has conducted because we're suddenly misunderstanding who they are as a vessel.

That's really helpful to have that deeper understanding as we continue our conversation, Jeremy. So what would you say are the most common ways that vessels misrepresent who they are? So the biggest one, which has definitely ramped up quite drastically over the years is principally on the digital side. So AIS manipulation, where a vessel will alter their identifiers and/or their position, I would say, to misrepresent who they are or where they are.

That's considerably ramped up to either falsely representing their dimensions or the activities that they're conducting or in some cases, adopting the identity of other vessels to completely attempt to disassociate from their actual identity. That's the big one. There are other instances in which we see identity manipulation taking place, and there are more cases now occurring, which is that of identity whitewashing, where physical alteration of a vessel might occur to disassociate themselves from again, their identity.

So it could be a vessel that's subject to sanctions and therefore, their activities might be incredibly limited. And so through a rebranding attempt, if you will physically have the name changed on the vessel as well as other markers of interest to that a ship that is completely clean or cleaner in comparison to then be able to actually access the markets that they are limited to under their sanctioned identity. That term whitewashing, obviously, it conjures up an image for me of someone like literally painting over the name of the ship on the side of the ship.

Is that a thing that happens? Yes, quite literally. And so whitewashing is a term as it might suggest, when you clean - you launder something that's potentially dirty to something that's hypothetically clean. And within the shipping landscape, it can be exactly like that in terms of painting over to reflect the identity of another ship or the name of another ship, yes.

In addition to the ramping up of known techniques used by these bad actors, Jeremy, are you seeing any new ID manipulation techniques emerging? Or is it just more about the increase in how often these known techniques are being deployed? So the scale has definitely increased. One particular phenomenon that we've seen, and you touched base on it in the intro, and it's what's been described as zombie vessels.

So these are vessels which have been scrapped or being demolished and their identity has been taken and reused digitally mostly to be able to conduct activities on the water. So in some cases, ships which have possibly been turned to paper clips 10 years ago are reservicing digitally and carrying out activities. The reality is that it is not those vessels come back to life. It's not as though that's the case.

That's the reality of things, but more so that a flaw has been exploited in the system to adopt the identity of these ships, which aren't necessarily have as much scrutiny because they haven't been active and they haven't been in circulation for a while. We have also seen a couple of instances where vessels currently being built having their identifiers taken. And this also doesn't take away from the fact that there is also unintentional erroneous identity adoption that takes place where a vessel might without actually realizing transmit identifiers that pertain to others.

And we've seen this occur several times where it might be a tug or a smaller noncommercial vessel on the other side of the world, transmitting identifiers that relate to a legitimate target. And so you will get this teleportation effect that sometimes occurs of a vessel moving across continents. - knew that was the case. I know I said in the intro that this wasn't science fiction, but I confess that I'm having some Star Trek beam up kind of images flashing through my mind where the ship is there and then it's there.

And then, of course, there's just the whole zombie concept as well. And I feel sometimes even jokingly, sometimes this also plays into how these plys, these demos are brought into reality. It's you think with a potential idea of how to do something differently. and that allows you to then bring it into reality.

So like you say, we talk about sort of Star Trek, Beame app, teleportation, you can digitally teleport a ship target from one place to another if you have the means to, you can misrepresent where you are, and that happens quite frequently. So the physical target will be conducting an operation, whereas the digital target will be somewhere else, doing something that appears legitimate. Sometimes there is that link, if you will, that exists. Interesting.

Interesting. So Jeremy, just stepping back for a minute to incentives and why bad actors do what they do. What are the motivations that make ID manipulation worth the risk to these bad actors? It's a constant and it is primarily for financial gain.

So when we talk about sanctions of Asian, sanctions themselves restrict access to particular markets or disencourage access to particular markets through sort of issued licenses. And so operating in this capacity allows you to then access parallel markets where those activities can take place and you can financially profit from them while also mitigating possible risk and exposure. It's ultimately applied to facilitate these operations, these activities for financial gain, as is mostly the case when we talk about tactical subiffuge or when we talk about bad actors operating, it is usually the case of operating for financial gain.

And so when we talk about sanctions against Russia, for instance, who has an incredibly large hydrocarbon industry, the sanctions applied to them restrict some of those activities. And so operating in such a manner that can actually facilitate that - those activities themselves becomes quite enticing when you realize just how much money there is to be gained from continuing those activities. Makes sense. Yes.

So what types of industries should care about vessel ID manipulation, Jeremy? And why? Why should they care? It's not an easy question to answer, but it would boil down to anyone who has direct or even indirect exposure to the maritime domain.

So that can be banks or financial institutions that could be financing either the vessels themselves or the commodities on board those vessels. That could be the insurance that are writing policies of different kinds, be it for war for cargo, for hull and machinery or others or even in terms of investing in sectors tied into the maritime domain. But the flip side is it's not just about the financial markets, the owners, managers, operators of these vessels could also face possible exposure, especially if they're chartering in ships, ensuring that they're doing the proper due diligence to vet these vessels and mitigate and minimize possible exposure is really critical.

And also from a government perspective, it's key just from a maritime domain awareness to understand how this plays out, but also in being able to apply pressure to counter some of these activities taking place, too. So it's not a simple question to answer. It's quite broad. And like I said, it would boil down to anyone who has direct or indirect exposure to the maritime domain.

Right. Again, yes, that makes sense for sure. So we're coming to the end of our time, Jeremy. Any final thoughts for our listeners on these topics?

So in terms of what keeps me up at night, when I think about identity manipulation as a part of deceptive shipping practices, it's the scale at which it happens. And we're no longer talking about it just being a case of sanctions evasion anymore. It's becoming an existential challenge to maritime governance itself, seeing more and more cases that are being flagged or attempts being made to try and receive. And so when you can no longer trust that a ship is who it claims to be, the system that's built around that, be it in terms of law, safety standards, security, it can start to fracture too.

So that to me is quite a critical concern, especially to those which attempt to completely disconnected from these various bad actor nexuses that are suddenly becoming entangled with them under full skises, not realizing that perhaps the vessel isn't who they claim they are and having exposure as a result of that. But what I would say is that in difficulty lies opportunity and the same data and technology that bad actors are exploiting and using to profiteer from all this can also be turned against them to identify these patterns of behavior in terms mitigate potential risk for agencies and entities that operate in the maritime domain.

And so understanding these deceptive patterns and most importantly, I would say, practicing due diligence and vigilance is becoming increasingly key. We didn't talk much about it today, but even in terms of - but it plays into it in terms of signals intelligence and how that's growing and how that's impacting shipping in itself, we've seen a lot of signal interference occurring in different parts of the world. And I feel as though different industries are starting to get more of a glimpse into just how significant some of these challenges might be from GNSS jamming to a displacement of targets from one area or another as a result of some of the conflicts that have taken place in specific parts of the world recently.

So yes, so I guess to round off my message to listeners is to be vigilant and practice vigilance in interacting with vessels in the maritime domain. Very important message there, especially as you say, with everything going on in the shipping world right now. So all that's left for me to do is to thank you, Jeremy, for sharing your insights with us on the decisive and thanks to you, our listeners for tuning in. If you'd like to dive deeper into some of the topics we've discussed today, please do click on the links in the description of this episode to access our latest thought leadership.

Until next time, thank you for listening to the decisive podcast from S&P Global.