Bergman had noticed fake tracks on an AIS website before, when virtual yachts from an online sail racing game had improbably appeared on AISHub last year. But this was the first time he’d seen real ships impersonated, and warships no less.
“At SkyTruth, we’re particularly concerned where fake data is impacting fishing,” said Bergman in a video call interview. “But we want to understand generally how the data is being falsified and what we can do to detect and correct it.”
Bergman identified the nine warships from a screenshot in the story, then compared their fake AIS messages to genuine messages broadcast by the same vessels before and after the imposters. He noticed immediately that these were no amateur pranks or accidents. “The fake messages were very plausible, except that we had this confirmation from the Swedish navy that the positions were false,” he says.
Over 20 types of AIS message exist—some for supertankers, others for pleasure boaters—and each contains multiple data fields covering everything from navigational information to arcane communication settings. By closely comparing fields that are usually invisible to sailors, Bergman eventually found subtle differences between the fakes and the genuine data. He then used that pattern to write a query for a global historical database of AIS messages—and was shocked by the results.
His search found nearly a hundred sets of messages from multiple AIS data providers, going back as far as last September and spanning thousands of miles. More worrying still, the ships affected were almost exclusively military vessels from European and NATO countries, including at least two US nuclear submarines.
“It was alarming when I realized there were a lot of other vessels also showing this unusual AIS profile,” says Bergman. But he needed to know that the suspicious AIS messages were actually fake, not the result of a technical hiccup or a special military setting. Bergman spent the next few months laboriously verifying the actual positions of the targeted ships. At first, he used open source data including news reports, military press releases, and enthusiast websites like Warshipcam.com. “A lot of people like to take pictures of naval vessels and post them online,“ says Bergman. “I found examples where vessels were leaving or entering areas that seemed pretty impossible.”
Bergman then overlaid synthetic aperture radar and optical imagery from the European Space Agency’s
Sentinel-1
and -
2
satellites onto the suspicious AIS pings. If they were real, the AIS data should have matched up perfectly beneath a satellite image of the ship.
Instead, Bergman saw only empty ocean, time after time. In fact, he says, “I have not yet found an instance when a track flagged by the query as false turned out to be real.”
The stars did not always align for Bergman’s detective work. Some AIS tracks did not coincide with an ESA satellite overhead, or fell on cloudy days when optical images were useless. And some warships did not have a lot of Instagram fans. In the end, Bergman managed to confirm about 15 sets of AIS data as definitively fake.
As well as the
Queen Elizabet
h’s imaginary flotilla, Bergman found fake tracks of US, Dutch, Belgian, German, Lithuanian, Estonian, and other Swedish warships. One suspect track, not previously reported, shows the US guided missile destroyer USS
Roosevelt
steaming 4 kilometers into Russian territorial waters around Kaliningrad last November, a maneuver that would have been recklessly provocative if real. There appear to have been five other fake incursions near Kaliningrad in June. One involved a Polish warship following the exact same track, speed, and course as a Swedish corvette five days earlier, another indication for Bergman that the tracks are digitally generated.