AIS spoofing vs. AIS gap: how to tell them apart
Two vessels disappear from the AIS feed on the same watch. One of them is sitting in a radio shadow behind a headland, broadcasting nothing because the signal can't get out. The other is running a transponder that's broadcasting a position it isn't at, with a name that may not belong to the hull underneath it. Both show up on the plot as a problem. They are not the same problem, and treating a spoof like a gap, or the other way around, burns a tasking cycle you don't have spare.
What a gap looks like on the record
An AIS gap is an absence. The transponder goes quiet for reasons that are usually mundane: the vessel is in a dead zone, the antenna's iced over, someone switched the unit off because the skipper doesn't want the position logged, or the receiver network just didn't catch that pass. The track stops at point A and either never resumes or picks up later at point B, with a straight-line interval between them that's consistent with the vessel's last known course and speed.
The tell is that there's nothing where there used to be something. No position reports, no CPA data to argue with, just silence and the before/after bookends.
What spoofing looks like on the record
AIS manipulation in fisheries produces noise, not silence. A spoofed AIS position means the transponder is broadcasting an MMSI, a course, and a position that don't reconcile with each other or with physical reality. The versions a watch desk sees most often:
- A vessel reporting a position on land, or in water too shallow for its draft
- Two vessels broadcasting the same MMSI at once, in different places
- Speed-over-ground jumps no hull can make: 4 knots to 22 knots in one ping, nothing in between
- A track holding steady through a known detection zone while the independent hit lands somewhere else entirely
Where a gap is absence, a spoof is a false presence. The transponder is talking the whole time. It's just not telling the truth.
Why the distinction changes what the desk does next
A gap gets you a question: where was this vessel during the silence, and does the before/after track support an innocent explanation? That's last-known-course projection, and where you have one, an independent detection layer to fill the blank.
A spoof gets you a different question: who owns this MMSI, has it been cloned or reused somewhere else in the fleet, and is the bad broadcast deliberate or a hardware fault. That's less a tasking problem and more an identity problem, and it usually sits with whoever handles the vessel registry and flag-state correspondence, not just the duty officer plotting positions.
Confusing the two costs time either way. Chase a spoofed position as if it's a real track and a patrol asset gets sent to broadcast coordinates with nothing actually sitting there. Write a spoof off as a routine gap and you lose the fact that the vessel was, right then, feeding the record bad data.
Telling them apart fast
The quickest discriminator is what the AIS record itself is doing at the edges of the anomaly. A clean stop followed by a clean resume, with nothing in between, reads as a gap. Reports that keep coming but stop matching reality, impossible speed, impossible position, a duplicate MMSI, read as a spoof. A position with no AIS broadcast behind it at all is a gap. A position with an AIS broadcast that puts the vessel somewhere else entirely is a spoof, and that's the case manual plotting is worst at catching, because the AIS track looks perfectly normal sitting on its own.
A daily comparison between optical detections and the AIS record catches that second case without anyone working the AIS log by hand.
If your desk is still trawling AIS gaps manually, see what a daily list of unmatched detections does for your tasking queue.