She Spoofed Sea Ships by the Sea Shore: Measuring Large-Scale GPS Spoofing in Global Maritime Traffic

TL;DR

This paper presents the first large-scale measurement study of maritime GPS spoofing using global AIS data from over 367,000 vessels collected between late November 2024 and early February 2025. It identifies 31 persistent anomalous hotspots worldwide, at least 22 of which show strong evidence of GPS spoofing, including recurring patterns in the Red Sea and Strait of Hormuz that preceded major incidents.

Key findings

• The pipeline produced 17,936 anomaly episodes across 2,663 distinct vessels, totaling 31,328 hours of anomalous operation, and identified 31 persistent anomaly zones; 13 were corroborated spoofing, 9 newly identified spoofing, and 9 suggestive, with at least 22 showing strong evidence of GPS spoofing.
• Most episodes arose from deviation (52%) or speed (45%) violations, while only 3% involved land positions; 71% of episodes lasted less than 60 minutes with a median duration of 40 minutes, and 54% of flagged ships experienced only one episode while roughly 8% had twenty or more.
• Hotspots appeared in conflict-adjacent waters such as the Black Sea, Eastern Mediterranean, Red Sea, and East Asian seas, but also in unexpected civilian zones including the Canary Islands, Gulf of Mexico, and Panama Canal; the Gulf of Mexico event on December 31 involved almost 200 vessels with synchronized jumps and was reproduced on NOAA data across 10–634 vessels.
• The Red Sea spoofing near Port Sudan matched the MSC Antonia’s pre-grounding track to the fifth decimal point five months earlier, and sustained Strait of Hormuz anomalies were detected over a year before the 2026 Iran war; sanctions-linked self-spoofing was identified for 16–215 vessels.

Methods

• Two-stage AIS pipeline: Stage 1 analyzes each vessel with a constant-velocity Kalman filter and flags land positions, speeds above 60 knots, and deviations above 5 km; a finite-state machine confirms episodes using a 30-minute rolling window with at least 70% anomalous points and a 120-minute clean-gap end.
• Stage 2 connects anomaly-segment boundary points into “jump lines,” clusters their spatial intersections with DBSCAN (ε = 50 km, MinPts = 5), filters self-spoofers and outliers, and labels vessels as cluster-associated or self-spoofed/faulty.
• Data come primarily from Spire Global’s global AIS feed from late November 2024 to early February 2025, comprising 379,416 unique vessels, with validation on public NOAA and Danish Maritime Authority regional feeds.

Limitations

• The paper states the framework targets large-scale regional spoofing and may miss displacements smaller than 5 km, episodes shorter than 30 minutes, windows with fewer than 70% anomalous points, and interference affecting only one vessel; measurements are therefore a lower bound on global spoofing activity.
• The authors state the time window cannot capture seasonal or longer-term trends, and because AIS reports the position a receiver computed rather than the received signal, they cannot localize transmitters, attribute interference to specific actors, or observe spoofing-system implementation; geopolitical context is inferred as hypotheses.
• The paper also notes no onboard ground truth exists at scale, so false-positive and missed-detection rates cannot be directly measured; validation relies on independent AIS feeds, documented incidents, dense-port checks, and parameter sensitivity analyses, and AIS coverage is uneven so absence of detected activity is not evidence that a region is free from interference.