The Decisive | Season 6 | Ep.5 - Fake IDs on the High Seas: How Bad Actors Evade Detection

View Full Transcript

Kristen Hallam:

You're listening to the Decisive Podcast. Insights and analysis to empower confident decision making. Hello and welcome to the Decisive Podcast. I'm Kristen Hallam, your host for this episode. Today we delve into a shadowy world that impacts international trade, sanctions enforcement and maritime security – the manipulation of ship identities. Imagine a massive cargo vessel, officially decommissioned and scrapped years ago, yet somehow still navigating the world's oceans, its digital signals, legal documents, and physical identity all forged or manipulated to conceal its true origins.

This isn't science fiction. It's a growing reality driven by sophisticated actors exploiting vulnerabilities in maritime tracking systems, ship registries, and regulatory oversight. This clandestine industry of ship identity fraud enables illicit activities such as sanctions evasion and smuggling. With billions of dollars at stake, understanding how these zombie ships operate through spoofed AIS signals, forged documentation, and vessel reflagging is crucial for regulators, insurers and global markets alike. To help us navigate these murky waters – pun intended – I am pleased to welcome back to the podcast Jeremy Domballe, an expert in maritime risk and compliance at S&P Global Market Intelligence. Jeremy is going to clue us in on how vessels misrepresent their identities, the scale of this illicit trade, and the measures to combat it. Jeremy, welcome back to the Decisive.

 

Jeremy Domballe:

Hey, Kristen, thanks for having me back.

 

Kristen Hallam:

Right, so, Jeremy, from your vantage point in maritime risk and compliance, what does ship identity really mean in practice? And why is it so foundational to sanctions enforcement and commercial decision making?

 

Jeremy Domballe:

It's a really good question and a crucial question, which I feel sometimes we don't stop to think about. But the identity of a vessel is quintessential in underpinning many of the foundations when it comes to shipping. You can think about it in terms of how a past one might relate to you, and it's how we know who a vessel really is. So in practice, when we think about identity, it's built upon multiple pillars of identifiers which we can explore a little bit more. But in terms of your registered identity or your digital identity or your physical identity and the different points of information that are housed beneath all of that. And this matters enormously because the entire maritime compliance ecosystem, from sanctions enforcements to insurance underwriting to port state control, relies on accurately identifying vessels. So when I can't confidently say this vessel is X, I can't determine if it's sanctioned and if it has proper insurance or if it's been involved in illicit trade or any other number of different points of information that might relate to that ship. So that's really why being able to understand that focal points, that beginning, if you will, that identity is so important.

 

Kristen Hallam:

Thank you for that, Jeremy. Now, as we've discussed on the podcast before, and you mentioned pillars just now, you can think of identity as having, you know, the digital, the physical and the document-based components. Could you just take a minute or two to remind us how these three pillars work together when things are legitimate and how bad actors exploit the seams between them?

 

Jeremy Domballe:

So when everything legitimate, like you say, these three identities should mirror each other perfectly. What you see in the digi-sphere versus what you would physically see in the tangible world and the documentation you would see would all align together. You'd get the same picture. And what would also happen is that you have other focal points of information which are called unique vessel identifiers or UVIs. Principally it's known as the IMO number that bring these different types of data together. It could be your digital identity. So that's like I mentioned, anything that you would transmit or could be perceived digitally, your footprint through AIS to your radar signature, or when we talk about physical identity, it could be anything from the dimensions of the ships to your deck configuration or color schemes being utilized, or even the flags that you're flying on the vessel.

And then finally we talk about a documented identity. It's what's been registered to the vessel. So anything that speaks towards flag certificates or classification, documentation, et cetera, just documentation that is legally binding in nature. And all three of those should bring about the same sort of information. But the real challenge is there are, like you said, there are cracks in the seams that can sometimes occur. And when one of those pillars or when one of those sets of identifiers falls out of balance within that equation, in there lies the opportunity to then misconstrue or misassociate the activities that a vessel potentially has conducted because we're suddenly misunderstanding who they are as a vessel.

 

Kristen Hallam:

Thanks. It's really helpful to have that deeper understanding as we continue our conversation, Jeremy. So what would you say are the most common ways that vessels misrepresent who they are?

 

Jeremy Domballe:

So the biggest one which has definitely ramped up quite drastically over the years, is principally on the digital side. So AIS manipulation, where a vessel will alter their identifiers and or their position, I would say, to misrepresent who they are or where they are, that's considerably ramped up to either falsely representing their dimensions or the activities that they're conducting, or in some cases adopting the identity of other vessels to completely attempt to disassociate from their actual identity. That's the big one. There are other instances in which we see identity manipulation taking place, and there are more cases now occurring, which is that of identity whitewashing, where physical alteration of a vessel might occur to disassociate themselves from, again, their identity. So it could be a vessel that's subject to sanctions, and therefore their activities might be incredibly limited. And so, through a rebranding attempt, if you will, physically have the name changed on the vessel, as well as other markers of interest to that a ship that is completely clean or cleaner in comparison to then be able to actually access the markets that they are limited to under their sanctioned identity.

 

Kristen Hallam:

That term whitewashing, obviously it conjures up an image for me of someone literally painting over the name of the ship on the side of the ship. Is that a thing that happens?

 

Jeremy Domballe:

Yes, quite literally. And so whitewashing is a term, as it might suggest, where you clean or you launder something that's potentially dirty to something that's hypothetically clean. And within the shipping landscape, it can be exactly like that in terms of painting over to reflect the identity of another ship or the name of another ship. Yes.

 

Kristen Hallam:

In addition to, you know, the ramping up of known techniques used by these bad actors. Jeremy, are you seeing any new ID manipulation techniques emerging, or is it just more about, you know, the increase in how often these known techniques are being deployed?

 

Jeremy Domballe:

So the scale has definitely increased. One particular phenomenon that we've seen, and you touched base on it in the intro, and it's what's been described as zombie vessels. So these are vessels which have been scrapped or been demolished and their identity has been taken and reused digitally, mostly, to be able to conduct activities on the water. So in some cases, ships which have possibly been turned to paperclips 10 years ago are resurfacing digitally and carrying out activities. The reality is that it is not those vessels come back to life. It's not as though that's the case, that's the reality of things, but more so that a flaw's being exploited in the system to adopt the identity of these ships, which aren't necessarily have as much scrutiny because they haven't been active and they haven't been in circulation for a while. We have also seen a couple of instances where vessels currently being built are having their identifiers taken. And this also doesn't take away from the fact that there is also unintentional erroneous identity adoption that takes place where a vessel might, without actually realizing, transmit identifiers that pertain to others.

And we've seen this occur several times where it might be a tug or a smaller noncommercial vessel on the other side of the world transmitting identifiers that relate to a legitimate target. And so, you will get this teleportation effect that sometimes occurs of a vessel moving across continents. If only that were the case. No.

 

Kristen Hallam:

Yeah, I know I said in the intro that this wasn't science fiction, but I confess that I'm having some Star Trek beam me up kind of images flashing through my mind where the ship is there and then it's there, and then of course, there's just the whole zombie concept as well. Yeah.

 

Jeremy Domballe:

And I feel sometimes, even jokingly, sometimes this also plays into how these ploys, these MOs, are brought into reality. It's you tinker with a potential idea of how to do something differently and that allows you to then bring it into reality. So, like you say, we talk about sort of Star Trek beam me up teleportation. You can digitally teleport to a ship target from one place to another if you have the means to. You can misrepresent where you are. And that happens quite frequently. So the physical target will be conducting an operation, whereas the digital target will be somewhere else doing something that appears legitimate. Sometimes there is that link, if you will, that exists.

 

Kristen Hallam:

Interesting, interesting. So, Jeremy, just stepping back for a minute to incentives and why bad actors do what they do. What are the motivations that make ID manipulation worth the risk to these bad actors?

 

Jeremy Domballe:

It's a constant, and it is primarily for financial gain. So when we talk about sanctions evasion, sanctions themselves restrict access to particular markets or discourage access to particular markets through sort of issued licenses. And so, operating in this capacity allows you to then access parallel markets where those activities can take place and you can financially profit from them while also mitigating possible risk and exposure. It's ultimately a ploy to facilitate these operations, these activities for financial gain. As is mostly the case when we talk about tactical subterfuge or when we talk about bad actors operating, it is usually the case of operating for financial gain. And so when we talk about sanctions against Russia, for instance, who has an incredibly large hydrocarbon industry, the sanctions applied to them restrict some of those activities. And so, operating in such a manner that can actually facilitate those activities themselves becomes quite enticing when you realize just how much money there is to be gained from continuing those activities.

 

Kristen Hallam:

Makes sense, yeah. So, what types of industries should care about vessel ID manipulation, Jeremy, and why, why should they care?

 

Jeremy Domballe:

It's not an easy question to answer, but it would boil down to anyone who has direct or even indirect exposure to the maritime, to the maritime domain. So that can be banks or financial institutions that could be financing either the vessels themselves or the commodities on board those vessels. That could be the insurers that are writing policies of different kinds, be it for war, for cargo, for hull and machinery or others, or even in terms of investing in sectors tied into the maritime domain. But the flip side is it's not just about the financial markets. The owners, managers, operators of these vessels could also face possible exposure, especially if they're chartering in ships. Ensuring that they're doing their proper, are doing their proper due diligence to vet these vessels and mitigate and minimize possible exposure is really critical. And also from a government perspective, it's key, just from a maritime domain awareness to understand how this plays out, but also in being able to apply pressure to counter some of these activities taking place too. So it's a, it's not a simple question to answer. It's quite broad. And like I said, it would boil down to anyone who has direct or indirect exposure to the maritime domain.

 

Kristen Hallam:

Right. Again, yeah, that makes sense, for sure. So, we're coming to the end of our time, Jeremy, any final thoughts for our listeners on these topics?

 

Jeremy Domballe:

So in terms of what keeps me up at night, when I think about identity manipulation as a part of deceptive shipping practices, it's the scale at which it happens. And we're no longer talking about it just being a case of sanctions evasion anymore. It's becoming an existential challenge to maritime governance itself, seeing more and more cases that are being flagged or attempts being made to try and deceive. And so when you can no longer trust that a ship is who it claims to be, the system that's built around that, be it in terms of law, safety, standards, security, it can start to fracture too. So that to me is quite a critical concern, especially to those which attempt to completely disconnect it from these, from these various bad actor nexuses that are suddenly becoming entangled with them under false guises, not realizing that perhaps the vessel isn't who they claim they are and having exposure as a result of that. But what I would say is that in difficulty lies opportunity. And the same data and technology that bad actors are exploiting and using to profiteer from all of this can also be turned against them to identify these patterns of behavior in terms mitigate potential risk for agencies and entities that operate in the maritime domain. And so understanding these deceptive patterns, and most importantly, I would say practicing due diligence and vigilance is becoming increasingly key.

We didn't talk much about it today, but even in terms of – but it plays into it in terms of signal, signals intelligence and how that's growing and how that's impacting shipping in itself – we've seen a lot of signal interference occurring in different parts of the world, and I feel as though different industries are starting to get more of a glimpse into just how significant some of these challenges might be, from GNSS jamming to displacement of targets from one area or another as a result of some of the conflicts that have taken place in specific parts of the world recently. So, yeah, so I guess to round off my message to listeners is to be vigilant and practice vigilance in in interacting with vessels in the maritime domain.

 

Kristen Hallam:

Very important message there, especially, as you say, with everything going on in the shipping world right now. So, all that's left for me to do is to thank you, Jeremy, for sharing your insights with us on the Decisive. And thanks to you, our listeners, for tuning in. If you'd like to dive deeper into some of the topics we've discussed today, please do click on the links in the description of this episode to access our latest thought leadership. Until next time. Thank you for listening to the Decisive Podcast from S&P Global. Please subscribe and join us for next week's episode. Until then, stay curious and stay informed.