Russian ships fake locations to appear in two places at once

Russian tankers in the Black Sea have adopted a new and apparently coordinated method of falsifying their tracking data, transmitting false frozen positions even as the vessels sailed hundreds of miles away, according to researchers tracking the so-called shadow fleet.

At least 12 sanctioned tankers appear to have used identical devices to broadcast deceptive Automatic Identification System (AIS) signals, said Ollie Ballinger, a specialist in shadow fleet tracking at University College London. Six of the tankers he tracked simultaneously broadcast two AIS positions in recent months, making it appear the ships were in two places at once. AIS is the system ships use to broadcast their locations to other vessels and coastal authorities.

Russian shadow fleet vessels have long manipulated their AIS data, a practice known as spoofing, to evade Western sanctions aimed at cutting Moscow’s oil revenues following the full-scale invasion of Ukraine. The new tactics appear designed to protect the tankers from Ukrainian drone attacks as Moscow and Kyiv engage in tit-for-tat strikes across the Black Sea. Kyiv said in late September that it had hit more than 300 Russian vessels in the space of 11 weeks.

“This is certainly new behaviour for sanctioned shadow fleet tankers operating in the region,” said Bridget Diakun, research director at Lloyd’s List Intelligence. “In all likelihood it is part of this broader trend of Russia trying to protect these assets as the EU becomes more proactive in its approach to interfering and disrupting [sanctioned ships] and the Ukrainians become more aggressive in their approach to trying to disrupt Russia’s oil exports.”

The double positioning was notably used as the tankers passed out of the Black Sea through the Bosphorus, where Turkish authorities require ships to transmit a position as they navigate the narrow waterway guided by tugs. The ships would briefly turn on their real satellite-tracked AIS during the transit while simultaneously transmitting a second frozen position near the mouth of the Bosphorus, apparently to avoid attack as they continued their journeys.

The Russian-flagged oil tanker Pirop, for example, broadcast a position near the Bosphorus Strait on August 27 while simultaneously broadcasting that it was located about 800 kilometres away on the Turkish coast. She Ray Ships Co, listed as Pirop’s manager on shipping database Equasis, did not respond to a request for comment.

Other evidence that the ships had been fitted with identical devices running the same programme included the repetition of exactly the same position coordinates, unlike ordinary ships whose coordinates vary slightly as they shift on the water, and the fact that all position reports were frozen at the same time: 08:13 UTC.

While sanctioned tankers frequently spoof their AIS positions, the apparent use of identical devices across multiple ships is highly unusual. All but one of the tankers observed in the Black Sea had reflagged to Russia in the past year, meaning they now fall under Moscow’s maritime regulations. Many have been fitted with nets and cages to protect against drone attacks, while more than 30 shadow fleet tankers have changed their names to Russian words for gemstones.

Shadow fleet tankers carry sanctioned cargo from Russia