Every ship broadcasts a nine digit identity that is issued by a government and looked up in a public register. This one is correctly formed, correctly checksummed, and in no register in the world.
I run an AIS receiver on the roof of my house on the north side of an estuary, and I feed it to one of the public tracking sites, which is a hobby about eleven thousand people in this country have.
The system is worth explaining because it is unusually honest.
Every vessel over a certain size carries a transponder that broadcasts, on two VHF channels, its identity and its position. Identity is an MMSI: a nine digit Maritime Mobile Service Identity, issued with the ship's radio licence by the flag state.
The first three digits are the country. 232 and 233 and 235 are the United Kingdom. The rest identifies the vessel, and the whole number is in a register you can search.
The transponder also sends a static message every six minutes with the vessel's name, callsign, type, length and beam, and a dynamic message every few seconds with position, course, speed and heading.
None of it is encrypted and none of it is authenticated. That is a known weakness and it is why spoofing exists, and I will come back to it.
Since the March of 2021 I have received a vessel that is not in any register.
The MMSI starts 232, which is a British number. The check on the format is fine: nine digits, valid country prefix, not one of the reserved ranges.
It is not in the register. Not the UK one, not the international one, and not in the databases the tracking sites build up from years of observations, which between them hold nearly every number that has ever been transmitted.
I have submitted it to the site I feed. It sits in their unknown vessels list with about four hundred others, which is normal, because that list is mostly typos and misconfigured units on small boats.
The static message is what stops this being a typo.
A misconfigured unit sends a wrong number and a right name. This one sends a name.
Six characters, which is short for a vessel name and is allowed. It is a word. I am not going to write it, and the reason is that I looked it up and I found it in one place, and that place is a list of vessels lost from this estuary, and the year against it is 1959.
The static message also carries dimensions. Length 21 metres, beam 6. Type: 30, which in the AIS code table is fishing.
A twenty one metre fishing vessel is a big trawler for this coast and a completely ordinary size for 1959.
The track.
It is not a wandering ghost signal. It has a course.
I have recorded two hundred and six passes since 2021. Every one of them goes down the deep water channel from the north east, past the point where the channel bends, and out.
Speed between six and eight knots, which is a trawler making passage rather than working.
The track is smooth. Position updates every two to ten seconds, course over ground changing gradually the way a hull does, and the heading and the course agree to within a few degrees, which is the tell that separates a real vessel from a spoof: a spoofed track is usually a plotted line with the heading calculated from it, and it is too clean.
This one has the small errors a real GPS on a moving boat has. It wanders by ten or twenty metres and comes back.
Where it stops being data.
The channel bends at a point where the deep water runs within four hundred metres of a headland with a footpath on it.
I have been up there for eleven of the passes, because I know the timing now: it comes through between 04:10 and 04:50, and it comes through on nights when the tide is making, and I can predict it to within about twenty minutes.
You can see a lit vessel in that channel from the headland easily. On a clear night you can read the shape of it.
There is nothing there. Eleven times, with binoculars, with the receiver's live plot on my phone showing it four hundred metres away doing seven knots.
The last two times I took a thermal monocular, which is a two hundred pound thing I bought for this and have never used for anything else, and there is nothing on the water at all.
The other receivers.
This took the longest and it is what means the fault is not on my roof.
AIS is line of sight VHF and the tracking sites are fed by many receivers, and a message is normally heard by several.
I asked, through the site's forum, whether anybody else on this estuary had seen the number. Two people had. One of them is eleven miles up the coast and one is on the south side.
Their receipts of it are at the same timestamps as mine, to the second, from positions that triangulate.
Three receivers, in three places, hearing the same transmission at the same moment from the position the message claims.
That is not a fault in a receiver, and it is not somebody transmitting from a house, because a shore transmitter would triangulate to a fixed point ashore and this one moves down the channel.
Spoofing.
It is easy. A software defined radio and a laptop can put anything on AIS and there are people who do it as a stunt.
I have thought about it for four years and here is where I get stuck.
A spoofer would have to be transmitting from a boat, in that channel, at four in the morning, two hundred and six times, over four years, in all weathers, with no lights, invisible to thermal, broadcasting a fishing vessel's dimensions from 1959 and a name off a loss list, at a speed and heading that match the tide.
If somebody is doing that, they are doing it from a real boat that I cannot see, and I would like that explained too.
What I do is nothing, and there is a reason nothing is right.
The Coastguard have a number for AIS anomalies and I have not used it. What I would be reporting is a vessel that has never impeded anybody, never entered a traffic scheme, never claimed to be in distress and never come near a real ship, because I have checked all two hundred and six against everything else on the plot that night.
It stays in the deep water channel. It comes through on a making tide at the top of the night and it goes out, and it has never once made a mistake a boat could make.
The only thing I have changed is that I now leave the receiver on when I go away, which I did not used to, because it is a Raspberry Pi in the loft and I used to shut things down.
I check the log when I get back. It has never missed a night I would have expected it, and I have started to feel that it would be rude if it did.