Source-linked AI summary
She Spoofed Sea Ships by the Sea Shore: Measuring Large-Scale GPS Spoofing in Global Maritime Traffic
Anna Raymaker, Ryan Von Brock, Ryan Pickren, Animesh Chhotaray, Frank Li, Saman Zonouz, Raheem Beyah
TL;DR
The global scale and persistence of maritime GPS spoofing had remained unclear, despite ships' reliance on GPS-based navigation. This study analyzes AIS motion anomalies for regional patterns and identifies 31 hotspots, at least 22 with strong evidence of spoofing.
Problem
The global prevalence and persistence of maritime GPS spoofing had not been measured, although GPS interference can cause navigational errors, operational disruptions, and vessel damage.
Source: §1 · pp. 1–2Method
A motion-aware framework analyzes AIS trajectories for physically implausible motion, cross-vessel correlation, and persistent regional clusters.
Source: §1 · p. 2Results
31 anomaly hotspots were identified worldwide, of which at least 22 show strong evidence of GPS spoofing.
Source: §5 · p. 14Takeaways & Limitations
The Strait of Hormuz illustrates potential predictive value: sustained anomalies were flagged in early 2025, over a year before the 2026 Iran war.
Source: §5 · p. 15The measurements are a lower bound: the framework excludes small, short, sparse, or single-vessel events and cannot capture seasonal or longer-term trends.
Source: §3.5 · p. 6
Abstract
from arXiv · showhide
GPS spoofing has emerged as a serious threat to maritime security, yet its global prevalence, persistence, and structure remain largely unmeasured. In this paper, we present the first large-scale measurement study of maritime GPS spoofing, using global Automatic Identification System (AIS) data, which contain the GPS coordinates broadcasted over time by ships across the world. We focus on large-scale regional spoofing, where external interference displaces many vessels across an area at once, leaving a recognizable signature of physically implausible motion correlated across ships; our motion-aware, marine-specific framework identifies this signature and grades the evidence for GPS spoofing in each region it finds. Applying our approach to AIS data from over 367,000 vessels collected between late November 2024 and early February 2025, we identify 31 persistent anomalous hotspots across high-traffic maritime regions, at least 22 of which show strong evidence of GPS spoofing, with spatial and temporal structure aligning with regional conflict and economic sanctions. Notably, our method found that the spoofing activity in the Red Sea responsible for the highly-publicized grounding of the 75,000-ton container ship, MSC Antonia, was ongoing months before the incident, which has not been previously documented. Similarly, we detected persistent spoofing in the Strait of Hormuz over a year before the 2026 Iran war brought commercial shipping through the Strait to near-standstill. Together, this work establishes GPS spoofing as a widespread, recurring, and measurable threat to global maritime navigation.
1. Introduction
The paper addresses the unclear global scale and distribution of maritime GPS spoofing, a threat to navigation that can disrupt operations and damage vessels. It introduces a motion-aware AIS framework and reports persistent anomalous hotspots worldwide, including regions tied to known incidents.
1. Introduction
- GPS interference can cause navigational errors, operational disruptions, and vessel damage, while the overall scale and distribution of maritime spoofing remain unclear.The paper motivates measurement with the MSC Antonia grounding, which immobilized the ship for more than five weeks and incurred multi-million-dollar costs.Source: §1 · p. 1
- The framework flags physically implausible motion per vessel, finds anomalies correlated across independent vessels, and clusters persistent regions into spoofing zones.It combines a Kalman-based motion model with cross-vessel consensus and spatial clustering to identify the signature of regional external interference.Source: §1 · p. 2
- Over 17,000 anomalous episodes spanning 31,000 cumulative hours yielded 31 hotspots, at least 22 with strong evidence of GPS spoofing.The study analyzes AIS data from more than 367,000 vessels collected from late November 2024 to early February 2025.Source: §1 · p. 2
- The framework found the Red Sea spoofing pattern near Sudan in January 2025, five months before the MSC Antonia grounding, and persistent Strait of Hormuz spoofing over a year before the 2026 Iran war.The Red Sea tracks shared the exact latitude recorded before the grounding; the authors say the recurrence indicates both incidents belonged to longer-lived spoofing zones.Source: §1 · p. 2
2. Background and Related Work
- AIS broadcasts GPS-derived vessel positions, which are vulnerable because civilian GPS signals are typically unencrypted and unauthenticated; prior AIS-based studies remain localized or attack-specific.The paper positions its study as the first systematic global measurement of maritime spoofing prevalence and persistence using real-world AIS traffic.Source: §2 · p. 2
3. Methodology
The methodology models large-scale regional spoofing as correlated, physically implausible motion across vessels, then detects vessel-level anomalies and clusters them into zones. Validation checks alternative explanations, parameter sensitivity, and alignment with documented incidents.
3.1. Threat Model
- The threat model targets external spoofing that displaces many vessels within a bounded area, while excluding single-vessel faults and deliberate AIS falsification with a correct GPS fix.The counterfeit signal overrides authentic GPS at the receiver, whose false fix is then broadcast by AIS.Source: §3.1 · p. 3
3.2. Dataset
- The study combines a global Spire AIS feed with NOAA and Danish regional feeds; Spire covers 379,416 unique vessels from late November 2024 to early February 2025.Running the pipeline on the public regional feeds reproduced U.S. and European findings, supporting verification independent of Spire.Source: §3.2 · p. 3
3.3. Stage 1: Per-Vessel Anomaly Analysis
- A Kalman constant-velocity model flags land locations, speeds above 60 knots, and reported positions more than 5 km from predicted paths.The 5 km threshold separates rare large deviations from residual noise after filtering; a tighter cutoff could flag benign GPS and AIS errors.Source: §3.3 · pp. 4–5
- An FSM confirms an episode when at least 70% of points in a fully covered 30-minute window are anomalous, and ends it after 120 clean minutes.Episodes shorter than 30 minutes are discarded.Source: §3.3 · p. 5
3.4. Stage 2: Anomaly-Zone Clustering
- Stage 2 connects episode boundary points into jump lines, clusters their intersections, then filters and labels zones by cross-vessel spatial and temporal overlap.DBSCAN uses a 50 km radius and MinPts of 5; the recovered regions remain unchanged across the reported parameter sweeps.Source: §3.4 · p. 6
3.5. Limitations
- The framework may miss displacements below 5 km, short or low-density episodes, single-vessel interference, and seasonal trends; AIS fixes cannot identify transmitters or specific actors.The authors therefore characterize their measurements as a lower bound on global spoofing activity.Source: §3.5 · p. 6
3.6. Validation
- 13 of 31 identified zones align with externally documented spoofing; all 17 geographic regions were recovered in 13 of 20 tested parameter configurations.In 22 busy ports with no reported spoofing, the median fraction of vessels flagged was below 0.1%, and no port exceeded 1%.Source: §3.6 · p. 7
4. Results
The results identify persistent, spatially and temporally correlated anomaly hotspots worldwide and characterize their vessel-level activity and recurring geometric signatures. The hotspots include geopolitically sensitive waters as well as civilian regions without prior public spoofing reports.
4.1. Identification and Characterization
- 17,936 anomaly episodes across 2,663 vessels totaled 31,328 hours; 71% lasted under 60 minutes, with a 40-minute median duration.Deviation violations accounted for 52% of episodes and speed violations 45%; 3% involved impossible land positions. Table 2 summarizes episode durations and episodes per vessel.Source: §4.1 · p. 8, Table 2 · p. 8
4.1.1. Maritime Anomaly Hotspots.
- 31 persistent anomaly zones were detected across more than two months of AIS traffic, each aggregating multiple vessels with correlated spoofing-like motion.Their regional distribution is summarized in Table 3.Source: §4.1.1 · p. 8, Table 3 · p. 8
- Hotspots included conflict-adjacent waters and civilian zones such as the Canary Islands and Gulf of Mexico, with median flagged-vessel counts ranging from 22 to 1,852 across clusters.At monthly peaks, the Canary Islands cluster affected 7 vessels under lower-bound criteria and 403 under upper-bound criteria; the Gulf of Mexico cluster affected 13 and 1,196, respectively.Source: §4.1.1 · pp. 8–9, Figure 5 · p. 8, Figure 6 · p. 8
4.1.2. Recurring Geometric Signatures.
- Four recurring geometries—circular, linear, convergent, and irregular—describe distinct forms of anomalous motion, though the observed forms are not a comprehensive taxonomy.Circular trajectories stood out visually and were prominent in the Black Sea and East China Sea/Chinese-coast regions.Source: §4.1.2 · p. 9, Figure 7 · p. 9, Figure 8 · p. 9
2. Linear displacements.
Linear displacements appear as abrupt jumps onto straight, uniform tracks extending tens of kilometers, followed by a return to the vessel’s real position.
2. Linear displacements.
- Linear displacements appear as abrupt jumps onto straight, uniform tracks extending tens of kilometers before vessels snap back to their real positions.The paper classifies a track as linear when it spans at least 10 km and at least 75% of points lie within 250 m of the line.Source: §2 · p. 9
3. Point convergence.
In a convergence pattern, multiple vessels simultaneously appear at the same small inland location before returning to their true maritime positions.
3. Point convergence.
- At Jordan’s Queen Alia Airport, multiple vessels simultaneously appeared in the same small inland area before returning to their maritime positions.The paper defines convergence as at least 25% of anomalous points from five or more vessels falling within a 300 m radius.Source: §3 · p. 9
4. Irregular displacements.
Irregular anomalies lack stable geometric patterns and can be difficult to distinguish from benign AIS or GPS errors. Across clusters, the paper also describes varied persistence, from sustained activity to brief or intermittent episodes.
4. Irregular displacements.
- Irregular trajectories are hardest to distinguish from benign AIS/GPS dropouts, MMSI reuse, or multipath reflections, motivating cross-modal validation.The paper points to checks such as speed consistency and cross-vessel timing.Source: §4 · pp. 9–10
- Linear displacements were the most prevalent geometry, appearing in 14 of 31 clusters; circular loops appeared in roughly one-third, convergence in one, and irregular trajectories in five.Table 4 groups clusters by their dominant trajectory pattern.Source: §4 · p. 10, Table 4 · p. 10
4.1.3. Temporal Persistence Patterns.
- Anomaly zones varied over time: some persisted continuously for days, others returned in bursts, and some disappeared after brief episodes.The analysis represents flagged-vessel activity in each cluster as a one-minute-resolution time series formed by merging overlapping vessel intervals.Source: §4.1.3 · p. 10
- Sustained clusters required at least seven consecutive days of elevated activity, with daily flagged-vessel counts varying by no more than 10%.This criterion captures long-duration zones with stable intensity over time.Source: §1 · p. 10
1. Sustained.
Figure 9 contrasts sustained multi-day activity in the Black Sea with intermittent, isolated, and recurrent patterns elsewhere; Table 5 summarizes each cluster’s dominant temporal persistence pattern.
1. Sustained.
- Figure 9 shows sustained multi-day activity in the Black Sea, alongside intermittent, isolated, and recurrent patterns in other regions.The examples are Cluster 2 in the Black Sea, Cluster 3 in the Taiwan Strait, Cluster 10 in the Gulf of Mexico, and Cluster 11 off Gaza.Source: Figure 9 · p. 10
- Table 5 summarizes the dominant temporal persistence pattern for each cluster.Source: Table 5 · p. 10
- Recurrent clusters have at least three activity peaks separated by approximately regular intervals, with inter-peak spacing coefficient of variation below 0.3.These clusters represent periodic or scheduled anomaly recurrence.Source: §2 · p. 10
2. Recurrent.
Intermittent clusters contain multiple irregular bursts of anomalous activity separated by quiet periods, without meeting the thresholds for sustained or recurrent behavior.
2. Recurrent.
- Intermittent clusters contain multiple irregular anomaly bursts separated by quiet periods, but do not meet sustained or recurrent thresholds.The category captures sporadic or short-lived events, including Taiwan Strait Cluster 3.Source: §3 · p. 10
4. Isolated.
The section classifies isolated events, grades the evidence for spoofing across 31 anomaly zones, and examines cases spanning conflict-adjacent waters, civilian corridors, and sanctions-linked shipping. At least 22 zones show strong evidence of spoofing, with cases illustrating varied geometries and persistence.
4. Isolated.
- Isolated clusters have one short peak under three days, with all other peaks below 25% of maximum intensity.Across the 31 hotspots, sustained, recurrent, intermittent, and isolated patterns vary by region; shorter isolated incidents occur in the Gulf of Mexico and Panama Canal, while Canary Islands anomalies recur.Source: §4 · pp. 10–11
- Sustained anomalies appear in the Black Sea, North Sea, and Strait of Hormuz; recurrent and intermittent patterns dominate East Asian waterways and the Eastern Mediterranean.Brief isolated incidents also occur in regions without known conflict.Source: §4 · pp. 10–11
4.1.4. From Anomalies to Spoofing.
- The evidence tiers distinguish corroborated spoofing, distinctive signatures without external corroboration, and suggestive but less distinctive anomalies.Multiple authors, including a maritime-domain expert, independently reviewed the labels and reached consensus; they were not blinded.Source: §4.1.4 · p. 11
- 22 of 31 anomaly zones show strong evidence of GPS spoofing: 13 are corroborated by incident reports and 9 are previously undocumented.Source: §4.1.4 · p. 12
4.2. Case Studies and Geopolitical Context
- Black Sea spoofing was the dataset’s most sustained and spatially widespread, affecting 902–2,297 vessels and concentrating around Sevastopol, Sochi, and Novorossiysk.Circular crop-circle loops and abrupt long-range jumps occurred across the basin.Source: §4.2 · p. 12
- In the Israel–Red Sea corridor, convergence near Gaza and the eastern Mediterranean coincided with conflict escalations, while repeated linear displacements near Port Sudan matched the MSC Antonia pattern five months earlier.The Charmous and at least 11 nearby vessels showed the same displacement at overlapping timestamps.Source: §4.2 · pp. 12–13
- Civilian-zone anomalies included synchronized Gulf of Mexico jumps across almost 200 vessels, while the Canary Islands showed recurrence and Gulf and Panama events were isolated.The Gulf event was reproduced using NOAA AIS data; the text rules out multipath, random receiver error, and the later geomagnetic storm as explanations.Source: §4.2 · p. 13
- Using lower and upper bounds, the authors identify 16-215 sanctioned vessels engaged in likely self-spoofing; Hyperion showed false inland AIS positions near Vladivostok aligned with legitimate voyages to China.Coordinate manipulation lets a vessel maintain continuous transmission while obscuring its true movements.Source: §4.2 · p. 14
5. Concluding Discussion
The study finds structured, recurring maritime GPS anomalies across global hotspots, with operational hazards for vessels and strategic links to conflict and sanctions evasion. It argues that persistent patterns can be monitored for early warning, while identifying longer observation and additional sensors as future needs.
5. Concluding Discussion
- The analysis identifies 17,936 anomaly episodes across 2,663 vessels and 31 worldwide hotspots, with at least 22 hotspots showing strong evidence of spoofing.The zones exhibit distinct geometric and temporal signatures and cluster around conflict regions, trade corridors, and sanctions-linked routes.Source: §5 · p. 14
- Falsified coordinates can mislead ships into restricted waters, collisions, or groundings, while self-spoofing can conceal sanctioned movement from remote monitors.Smooth straight-line tracks may be difficult to detect in real time, and large vessels need one to two nautical miles to stop or significantly alter course.Source: §5 · pp. 14–15
- Recurring hotspots can be monitored as risk maps, and the Strait of Hormuz anomalies were flagged over a year before the 2026 Iran war.The authors say such monitoring could support safety advisories or chart overlays for ships and provide intelligence to regulators, insurers, and coastal states.Source: §5 · p. 15
- Future work should extend observation periods, add sensors such as radar and inertial logs for cross-validation, and adapt the pipeline for continuous monitoring.Source: §5 · p. 15
Appendix A. Open Science
The appendices provide a reproducible implementation, validate the findings and parameter choices, and describe the study’s ethical safeguards and limits. They emphasize that AIS coverage is uneven and regional observations generally do not establish who caused interference.
Appendix A. Open Science
- The implementation, documented thresholds, and parameters are available in an anonymous repository with reproducible pipelines for Gulf of Mexico and Baltic events using public AIS feeds.The pipelines use NOAA data for the Gulf of Mexico event and Danish Maritime Authority data for the Baltic event.Source: Appendix A · p. 17
Appendix B. Additional Validation
- Manual checks attributed representative false positives to identifier reuse, cloned transmitters, or rare GPS faults, which are classified as faulty transmissions and excluded during clustering.The Hamburg flag rate was 0.8%, attributable to MMSI reuse.Source: Appendix B · pp. 17–18
- Plausible parameter changes recover nearly the same zones and regions, although changing the deviation threshold shifts the episode count by a third.The sensitivity sweep varies each parameter independently; recovery is measured geographically against the baseline run.Source: Appendix B · p. 18, Table 7 · p. 18
Appendix C. Ethical Considerations
- The study is passive and retrospective, and it reports primarily regional or aggregate findings without identifying individual crew members or attributing responsibility without supporting evidence.Geographic or temporal association with conflict is treated as context, not attribution to an actor.Source: Appendix C · p. 19
- Uneven AIS coverage makes high-traffic and better-received regions more observable, so an absence of detected activity does not show that a region is interference-free.The paper also notes that regional observations generally cannot identify a transmitter or responsible actor, and that the pipeline has dual-use implications.Source: Appendix C · p. 19