AIS — the Automatic Identification System — was designed in the 1990s as a collision-avoidance protocol. Every commercial vessel over 300 gross tons broadcasts its identity, position, speed and heading every few seconds on two VHF channels. Coastal stations + satellites pick up those broadcasts and merge them into a global feed.
That feed is the foundation of every serious maritime intelligence product. Bloomberg, S&P Maritime Intelligence, Lloyd's List Intelligence — they all start with AIS, then layer normalisation, vessel ownership data and analyst reports on top.
The catch: AIS raw is useless. Of course the ship is in the shipping lane. Of course it's at the port. The value is in the anomalies.
What "anomaly" actually means
For supply-chain and security teams, four AIS patterns drive 90% of useful alerts:
1. Dwell time
How long has a vessel been inside a defined geographic zone with low or zero speed-over-ground?
- Port congestion: container vessel parked at LA/Long Beach for >12 hours
- Chokepoint slowdown: tanker idling at Hormuz / Suez / Panama for >4 hours
- Cable threat: research vessel hovering over a subsea cable corridor for >30 minutes
- Sanctions risk: any vessel dwelling at a sanctioned port for any time
Dwell-time alarms are the single highest-ROI AIS vessel tracking signal we know of. They convert a firehose into a handful of high-confidence alerts.
2. Course deviation
A vessel that abruptly changes course off its declared destination is either re-routing for legitimate operational reasons or doing something the owner doesn't want auditable. Both are worth knowing.
The classic case: a tanker declaring an EU destination via AIS, then heading toward an Iranian terminal halfway through the voyage. Course-change detection + destination cross-check + sanctions-list lookup catches this.
3. AIS spoofing / dark periods
A vessel that goes "dark" (stops broadcasting AIS for hours, then resumes claiming to be elsewhere) is hiding something. Detection requires tracking the disappearance + reappearance pair and computing the implied speed — if the vessel claims to be 1,200km from its last-seen position 4 hours later, that's a 750km/h ship.
4. Identity spoofing
Two vessels broadcasting the same MMSI (Maritime Mobile Service Identity) at the same time = at least one of them is faking. Cross-referencing AIS broadcast against the IMO vessel registry catches a meaningful fraction of shadow-fleet activity.
Where the data comes from
You have four practical options:
- AISStream.io — free WebSocket feed of global AIS messages, rate-limited. Good for getting started, not enough for a production fleet.
- AISHub — community-run network of receivers, free if you contribute a station, paid otherwise.
- MarineTraffic / VesselFinder / FleetMon — commercial APIs with global coverage including satellite-AIS. $$$$ but reliable.
- Exact Earth / Spire / Orbcomm — satellite-AIS providers. The gold standard for open ocean coverage. Six-figure annual contracts.
For most teams the right answer is "AISStream + one of the commercial providers for the routes that matter most." Don't overpay for global satellite coverage when you only care about three ports.
The geofencing layer
AIS is a stream. Geofencing is the filter that turns a stream into alerts you can read.
Three zone shapes cover almost everything:
Circles for single ports. Centre on the harbour, radius to include the anchorage. Simple to draw, easy to tune.
Polygons for port basins. The bay shape isn't round, neither is your alerting need. A polygon around the actual basin filters out vessels passing through the approach lane.
Long corridors for shipping lanes and subsea cables. Polygon with a thin width along the asset path. Use these for cable-watching and chokepoint monitoring.
You can read more about the polygon-vs-circle trade-off in Polygons beat circles (most of the time).
A practical dwell-time pipeline
The minimum viable port risk monitoring pipeline that actually works in production:
AIS stream → per-zone filter → augur_zone_dwell table
(zone_id, mmsi, first_seen_at,
last_seen_at, fired_at)
Every 5 minutes:
for each (zone, mmsi) pair where vessel still inside zone:
elapsed = now() - first_seen_at
if elapsed >= zone.dwell_minutes and fired_at is null:
→ fire alert, set fired_at
if vessel exited zone:
→ clear row
Persistence across runs is the key bit. Without the augur_zone_dwell table, the dispatcher forgets the first-seen timestamp every poll cycle and the alarm never fires.
Real signals we've seen
A handful of dwell-time alerts that actually mattered, with the threshold that caught them:
- Container backlog at LA/Long Beach during the 2024 strike (12h dwell on Maersk feeders)
- Russian shadow-fleet tanker dwelling at a sanctioned Iranian crude terminal (any dwell)
- Research vessel hovering over the BSCC cable in the Baltic for 90 minutes (30-minute threshold caught it)
- Container vessel diverting around Houthi attacks via the Cape of Good Hope (route-change alarm, not dwell)
The shadow-fleet problem
A growing fraction of global oil movement is now on the "shadow fleet" — vessels with opaque ownership, dodgy flag states, and routine AIS spoofing. Standard AIS-based monitoring catches some of it; comprehensive coverage needs satellite-AIS, vessel-imagery and pattern-of-life analysis.
This is the bit where commercial maritime-intelligence providers earn their fee. The OSINT-only stack catches the easy cases.
Wire-up checklist
If you're standing up maritime monitoring this quarter:
- [ ] Pick your AIS feed (start with AISStream.io's free tier)
- [ ] Define your top 10 port watch zones as polygons
- [ ] Set dwell-time threshold per zone (4h for chokepoints, 12h for ports, 30m for subsea cables)
- [ ] Wire a Slack channel for the alert output
- [ ] Cross-reference vessel MMSI against the OFAC SDN list daily
- [ ] Plan an upgrade path to a paid feed for the routes you care most about
Augur's AIS dwell-time alert engine is one option. The data is public. The dispatcher is the work.