Sunday, August 16, 2009

Arctic Sea position speculation

Quick recap: A cargo vessel called Arctic Sea (MMSI 215860000) was probably hijacked on July 24th 2009 near the eastern coast of Sweden. This was big news in northern Europe, since hijackings generally happen near the Somali coast, not over here. The ship has a Russian crew of 15, it appears to be owned by a Finnish company, and the owners of that company are of Russian origin. The Finnish media had considerable trouble trying to figure out the true owners, and the owners were really hard to interview. The ship deported from the harbor of Pietarsaari on 22nd of July and carries 6500 tons of Finnish timber, worth of about 1.3 MEUR.

The really odd thing is that the ship didn't go to the nearest Swedish port, but continued towards Africa as if nothing had happened. Very strange indeed. Either the hijackers were still on the ship, or the crew is taking part in the plot.

Latest news (Ransom demanded): BBC, CNN, YLE.

There have been a few questions about AIS positions of Arctic Sea shown on aprs.fi.

Q: Why is the track not shown for the moment of hijacking between Gotland and mainland Sweden?

A: There are no AIS receivers in the area which would directly send AIS reports to aprs.fi. These receivers are run by volunteers (thank you!), and each volunteer chooses where to submit AIS data. There is a receiver in the area, but it is submitting data to MarineTraffic only, and while MarineTraffic and aprs.fi exchange AIS data, aprs.fi is not getting the reports of all of those receivers. The Swedish maritime officials have an AIS receiver network of their own, and they've reported it ran circles and stopped for a while.

Q: Is the position shown for Saturday, 15th of August, valid?

A: Technically, it's possible, but I personally would find it very unlikely. It is easy to fake and it doesn't make any sense for the hijackers to publish their true position like this.

The position report was sent by an anonymous receiver station to MarineTraffic. It is quite easy to send fake data to MarineTraffic over the Internet, since they allow unauthenticated UDP packets containing NMEA strings to be sent to the service. aprs.fi does not allow unauthenticated UDP packets, all AIS submissions are tied to a specific receiving station using a password. Of course any one of those stations could feed us invalid positions, but at least we have some idea of the originator.

If the hijackers (or someone else) wanted to play tricks, they could also go to a shop selling marine radio equipment, buy an AIS transmitter, configure Arctic Sea's MMSI number (and other correct data) in it, give it an incorrect position by crafted NMEA strings (fake GPS receiver on the serial port of the AIS transmitter) and have it transmit the packets on the correct AIS frequency. If they've got the money and motivation to hijack ships with guns and speedboats, they've certainly got the guts to buy or steal AIS equipment. They could also grab the AIS transmitter from Arctic Sea, and take it to another position using a speedboat.

The French navy says there were 3 military vessels in the claimed position on the Bay of Biscay, heading for the Baltic sea, and they didn't see the hijacked ship. And they didn't see it on their radar, either.

The coast guard of Kap Verde claims to have seen the vessel about 800 km off the coast of Cape Verde, which is some 3600 km away from the Bay of Biscay.

In any case, this is starting to become a good plot for a movie.

5 comments:

Weston DeWalt said...

Have been following the Arctic Sea disappearance from the outset and have been dismayed at how shallow the reporting has been on the situation. I found the information you have provided most interesting - and - disturbing. It appears that it is all too easy to fake a ship's position. I have posted a link to your site on my Facebook page. Please, more!

oh7lzb said...

The Finnish Police (Bureau of Investigation) reported on Saturday that they have been investigating the issue together with officials from 20 countries, co-operating via Interpol and Europol, and they have more information than what has been published, but they can't publish anything yet because it would interfere with the investigation.

Anonymous said...

The mystery with Arctic Sea' AIS is not over yet. Since the 15th of August the reported destination (but not the position) was changed at least twice: it was changed to NOVOROSSIJSK few days ago and then (up to now) to RU NVS. Haven't you saved by chance recent packets for 215860000? If so, please, publish them!

oh7lzb said...

Anonymous: All of the position data I get are automatically published. The latest positions came to me via MarineTraffic in JSON AIS format (just pre-parsed position data, no binary packets), so I don't have anything else to show.

Anonymous said...

For sure, the two position reports of August 15th where faked, as well as the last changes of the destination to NOVOROSSIJSK and to RU NVS. Perhaps a MarineTraffic station will catch the signal when the ship is passing the Canary Islands or Gibraltar - but the AIS Transceiver must be activ!