An AIS gap is a period during which a vessel's Automatic Identification System transponder ceases to broadcast position reports while the vessel is at sea. Under IMO SOLAS Chapter V Regulation 19, AIS Class A units on tankers of 300 gross tonnage and above are required to broadcast continuously when underway. A gap is therefore the absence of an expected signal, measured against the vessel's last-known position, declared voyage, and the coverage footprint of the receiving terrestrial and satellite AIS networks.

Why would a tanker turn off AIS?

Legitimate reasons include equipment failure, master-authorised silencing in piracy zones, port-state restrictions in inland waterways, and degraded satellite coverage near the poles. Evasive reasons include concealing a ship-to-ship transfer, masking a port call at a sanctioned terminal, breaking continuity of a voyage history between the loading port and the discharge port, and reducing the evidentiary record available to flag-state or port-state investigators.

What gap duration counts as suspicious?

The published shadow-fleet investigative practice treats any AIS broadcast gap exceeding 12 hours that is not accounted for by a documented port call, declared maintenance, or known satellite-coverage limitation as a flag for further review. Gaps of 24 to 72 hours coincident with proximity to a known STS anchorage are the canonical pattern. Shorter sub-12-hour gaps are common and rarely indicative on their own.

Which open-source AIS providers do investigators use?

The common entry-level sources are MarineTraffic and VesselFinder, both of which expose historical tracks for individual vessels through web interfaces and paid API tiers. Spire Maritime provides commercial satellite-AIS feeds with global coverage. Equasis and the IMO GISIS database supply vessel identity and registry context. For deeper attribution work, investigators cross-reference these feeds against Sentinel-2 and Sentinel-1 satellite imagery (free, ESA Copernicus) and commercial high-resolution providers such as Planet and Maxar.

← All Methodology

2026-05-19 METHODOLOGY 8 min read

AIS Gap Analysis: A Sanctions OSINT Explainer

Q: How can AIS spoofing be distinguished from a gap?

A gap is the absence of a signal: the AIS track stops, then resumes hours or days later, often at a position inconsistent with the implied transit speed. Spoofing is the presence of a falsified signal: the vessel continues to broadcast, but the reported position, course, or speed is mathematically inconsistent with physics, with the vessel's previous track, or with simultaneous radar or satellite observations. Spoofing produces implausible position jumps and identity collisions; gaps produce silence.

Q: Where do shadow-fleet AIS gaps cluster?

The dominant clusters in 2024-2026 reporting are the Laconian Gulf anchorage south of Kalamata in Greece, the Fujairah outer anchorage in the UAE, the holding areas off Ceuta in the Strait of Gibraltar, the holding areas off Singapore and the Riau Archipelago, and the Novorossiysk outer roads on the Black Sea. Each of these locations sits outside the territorial sea of a port-state inclined to inspect, and each has a documented track record of facilitating ship-to-ship transfers of Russian-origin crude and petroleum products.

AIS gap analysis is the technique of inferring vessel behaviour during periods when the vessel's Automatic Identification System transponder stopped broadcasting, by examining the geographic and temporal pattern of the gap relative to known transit lanes, anchorages, and ship-to-ship transfer hotspots. The technique is the entry point of every shadow-fleet investigation, the most evidentiarily defensible signal in maritime sanctions compliance, and the single OSINT method most routinely misapplied by counterparties relying on automated screening alone. This page is the short-reference companion to our flagship investigation, Russia's Shadow Fleet: How 287 Sanctioned Tankers Keep Urals Crude Flowing, which works the technique through three case studies.

TL;DR

AIS is a mandatory radio-broadcast positioning system under IMO SOLAS Chapter V Regulation 19. When a vessel's AIS broadcast stops, it leaves a gap. Some gaps are legitimate (equipment failure, polar coverage, jamming, port-state restrictions); others are evasive (deliberate shutdown for STS transfer, dark sailing, masked port calls). The investigative method is a five-step routine: pull the 180-day track, flag any gap over 12 hours not explained by port activity, identify the gap centre, cross-reference second vessels in the same region during the same window, and document with timestamped screenshots. AIS gaps are distinct from AIS spoofing — gaps produce silence; spoofing produces falsified positions. Both are red flags. Neither is conclusive on its own.

What AIS is, in one paragraph

The Automatic Identification System is a VHF radio data link, broadcast on two channels in the maritime mobile band, that transmits a standardised set of vessel-identity and navigation fields at intervals of a few seconds when underway and a few minutes at anchor. Class A transponders are mandatory under IMO SOLAS Chapter V Regulation 19 on all ships of 300 gross tonnage and above on international voyages, on all cargo ships of 500 gross tonnage and above not engaged on international voyages, and on all passenger ships irrespective of size.^[1][2] Class B transponders are a lower-power consumer variant fitted to recreational vessels and smaller commercial craft and are not in scope of the SOLAS mandate. The broadcast carriage includes the Maritime Mobile Service Identity (MMSI), the IMO number, position (latitude/longitude), course over ground, speed over ground, navigational status (underway, at anchor, moored, restricted manoeuvrability), heading, rate of turn, and a destination string entered by the master. The signal is received by terrestrial VHF stations within roughly 40 nautical miles and by satellite AIS payloads operated by commercial constellations including Spire, ORBCOMM, and exactEarth (Kpler) and aggregated by services including MarineTraffic and VesselFinder.^[3]

Why AIS broadcasts stop

Gaps fall into two operational categories, and the investigative task is to distinguish them.

Legitimate causes include genuine equipment failure (AIS transponders are commodity hardware with a non-trivial fault rate); satellite-AIS coverage limitations in polar latitudes and in dense receiver-saturation zones near major port complexes; deliberate VHF jamming in active conflict areas and in zones of high GNSS interference; master-authorised silencing in declared piracy high-risk areas under BIMCO and industry guidance; and port-state restrictions on AIS broadcasting in inland waterways and certain naval-controlled areas.

Evasive causes include manual shutdown to conceal a ship-to-ship transfer, the deliberate breaking of voyage continuity between a sanctioned loading port and a non-sanctioned discharge port, dark sailing into and out of a sanctioned terminal, and the suppression of evidentiary AIS data ahead of a known port-state inspection. The IMO addressed deceptive shipping practices directly in IMO Resolution A.1106(29) on revised AIS guidelines and in subsequent guidance reinforcing the carriage and continuous-operation requirements. The OFAC May 2020 advisory on deceptive shipping practices set out the now-canonical list of AIS-manipulation indicators, several of which remain the operative compliance reference text six years later.^[4][5]

How to identify a suspicious gap

The investigative routine collapses to five steps. The same routine is used by KSE Institute, Windward, Lloyd's List Intelligence, and Sayari in their published shadow-fleet identifications, and it is the routine that, when documented properly, produces a file admissible to a compliance committee, an insurer, or an enforcement authority.

The five-step method

Pull a 180-day AIS track. Use MarineTraffic, VesselFinder, or Spire Maritime to retrieve the vessel's last 180 days of position reports. Export to CSV or KML with timestamp, lat/lon, course, speed, and navigational status.^[6]
Flag every gap longer than 12 hours that is not explained by a port call or by a transit speed consistent with the gap distance. A vessel that produces near-continuous reports for three months and then a single 36-hour blank centred on the Laconian Gulf is the canonical signature.
Identify the gap centre coordinates. Take the midpoint between the last position before the gap and the first position after the gap, and plot against a chart of known STS anchorages and sanctioned terminals. If the implied straight-line speed exceeds the vessel's design speed, the gap encloses an unreported stop.
Cross-reference any second vessel in the same region during the same window. Query the AIS providers for all vessels reporting within roughly 50 km of the gap centre during the gap interval. A second tanker of complementary cargo class with a coincident slow-down or anchorage call is the standard ship-to-ship transfer signature. See the companion explainer on ship-to-ship transfer detection for the full STS detection workflow.
Document with timestamped screenshots. Capture the AIS track, the gap interval, the second vessel's coincident track, any Sentinel-2 or Sentinel-1 imagery overlapping the window, and the Equasis registry extract. Record the provider, the URL, the query timestamp, and the analyst's reasoning.^[7]

Hotspot anchorages where gaps cluster

The dominant clusters in 2024-2026 reporting, against which any new gap should be plotted, are the Laconian Gulf south of Kalamata in Greece (the primary EU-adjacent STS zone for Russian-origin crude moving westbound and southbound), the Fujairah outer anchorage in the UAE (the primary Asian-corridor STS zone), Ceuta at the western Mediterranean entrance, the holding areas off Singapore and the Riau Archipelago, and the Novorossiysk outer roads on the Black Sea.^[8][9] The KSE Institute Russian Shadow Fleet Tracker maintains a current view of cluster intensity by month.^[10] Each location sits outside the territorial sea of a port-state inclined to inspect, and each has a documented track record. A 24-72 hour AIS gap coincident with proximity to any of them is the standard trigger for a vessel dossier escalation. The deeper STS-transfer detection workflow, including satellite-imagery cross-reference, is in our ship-to-ship transfer detection methodology.

Spoofing versus gap

The two failure modes are different and produce different forensic signatures. A gap is silence: the AIS track stops, then resumes hours or days later, often at a position inconsistent with the implied transit speed from the prior fix. Spoofing is falsification: the vessel continues to broadcast, but the reported position, course, or speed is mathematically inconsistent with physics, with the prior track, or with simultaneous radar or satellite observations. Spoofing produces implausible position jumps and, in egregious cases, identity collisions where two vessels broadcast the same MMSI from different locations. Documented GPS-spoofing zones include the Strait of Hormuz and the Black Sea, where state and quasi-state actors have produced large-area GNSS interference fields that disrupt AIS positions for entire traffic lanes. The Center for Advanced Defense Studies (C4ADS) published the foundational empirical work on these effects.^[11] Windward's vessel-behaviour analytics work, including the analysis of the Eagle S incident, documents the continued growth of AIS manipulation across both modes.^[12]

Limitations

Three honest limits on what AIS gap analysis can establish.

Commercial AIS aggregators have real coverage gaps. Polar latitudes, dense port-area receiver saturation, and the inherent constraints of low-Earth-orbit satellite revisit cadence all produce non-evasive gaps that look, on a single-provider track, identical to evasive ones. A robust investigation cross-references at least two providers (MarineTraffic plus Spire, for example) before concluding a gap is genuine.^[6] Not every gap is evasive. Equipment failure, jamming, and master-authorised silencing in piracy zones produce gaps that have nothing to do with sanctions evasion. A gap is a signal for review, not a verdict. AIS gap analysis alone does not establish what cargo moved. It establishes that a vessel was, for some interval, not where its declared voyage placed it. Cargo-paper analysis, satellite imagery, ownership reconstruction, and insurance verification are the additional steps that turn a gap into a sanctions-relevant finding. The full multi-method workflow is set out in the flagship investigation at Russia's Shadow Fleet: 287 Sanctioned Tankers.

Cross-references

Russia's Shadow Fleet: How 287 Sanctioned Tankers Keep Urals Crude Flowing — the flagship investigation that works AIS gap analysis through three named case studies.
Russia Shadow Fleet Tanker Cross-List Dataset (v0.1) — the field schema and downloadable JSON behind the headline count.
Shadow Fleet IMO Lookup Tool — query an individual IMO number against the cross-list.
STS Transfer Detection — the satellite-imagery and dual-AIS-track method for confirming a ship-to-ship transfer.
Flag-of-Convenience Registry Analysis — the registry-history pattern that pairs with gap analysis in shadow-fleet identification.
Sanctions-evasion vessel-tracking field guide — the applied, field-ready version of this detection workflow.

Sources

Automatic Identification Systems (AIS). International Maritime Organization, mandatory-carriage page citing SOLAS Chapter V Regulation 19.
IMO Resolution A.1106(29): Revised Guidelines for the Onboard Operational Use of Shipborne Automatic Identification Systems (AIS). International Maritime Organization, adopted December 2015.
What kind of information is AIS transmitted? MarineTraffic help centre — field list and broadcast cadence.
Sanctions Advisory for the Maritime Industry, Energy and Metals Sectors, and Related Communities. U.S. Department of the Treasury, OFAC advisory of 14 May 2020.
AIS Manipulation: The Newest Trend in Russian Vessels Sanctions Evasion. Windward, 2022.
MarineTraffic and VesselFinder — consumer-tier historical AIS providers; Spire Maritime — commercial satellite-AIS API.
Equasis — IMO-backed ship information database; identity, registry, and management cross-reference.
Dark-fleet tankers cluster off Greece as Russia evades sanctions. Lloyd's List Intelligence reporting on the Laconian Gulf cluster.
Policy briefing: tackling the Russian shadow fleet. Centre for Research on Energy and Clean Air (CREA), August 2024 — STS hotspot mapping.
Assessing Russia's Shadow Fleet. KSE Institute Russian Shadow Fleet Tracker, June 2024.
Above Us Only Stars: Exposing GPS Spoofing in Russia and Syria. Center for Advanced Defense Studies (C4ADS), 2019 — foundational empirical work on GNSS spoofing in the Black Sea and beyond.
The Eagle S and the Threat to Underwater Infrastructure. Windward, January 2025.
IMO Global Integrated Shipping Information System (GISIS). Vessel-identity and incident registry.

Need a vessel pattern-of-life dossier built around AIS gap analysis?

We build dossiers that cross-reference AIS history, flag and ownership chains, P&I cover verification, and STS-transfer signatures against sanctions lists and public leak datasets — written to be usable by compliance, legal, and insurance counterparties.

Request an Investigation