Bjorn Bergman is a data analyst working for SkyTruth and Global Fishing Watch who has been investigating fake AIS tracks for years, usually to uncover illegal fishing. In March this year, Bergman read a Swedish newspaper story in which the Swedish navy said the locations of nine of its vessels had been faked on MarineTraffic.

Bergman had noticed fake tracks on an AIS website before, when virtual yachts from an online sail racing game had improbably appeared on AISHub last year. But this was the first time he’d seen real ships impersonated, and warships no less.

“At SkyTruth, we’re particularly concerned where fake data is impacting fishing,” said Bergman in a video call interview. “But we want to understand generally how the data is being falsified and what we can do to detect and correct it.”

Bergman identified the nine warships from a screenshot in the story, then compared their fake AIS messages to genuine messages broadcast by the same vessels before and after the imposters. He noticed immediately that these were no amateur pranks or accidents. “The fake messages were very plausible, except that we had this confirmation from the Swedish navy that the positions were false,” he says.

Over 20 types of AIS message exist—some for supertankers, others for pleasure boaters—and each contains multiple data fields covering everything from navigational information to arcane communication settings. By closely comparing fields that are usually invisible to sailors, Bergman eventually found subtle differences between the fakes and the genuine data. He then used that pattern to write a query for a global historical database of AIS messages—and was shocked by the results.

His search found nearly a hundred sets of messages from multiple AIS data providers, going back as far as last September and spanning thousands of miles. More worrying still, the ships affected were almost exclusively military vessels from European and NATO countries, including at least two US nuclear submarines.

“It was alarming when I realized there were a lot of other vessels also showing this unusual AIS profile,” says Bergman. But he needed to know that the suspicious AIS messages were actually fake, not the result of a technical hiccup or a special military setting. Bergman spent the next few months laboriously verifying the actual positions of the targeted ships. At first, he used open source data including news reports, military press releases, and enthusiast websites like Warshipcam.com. “A lot of people like to take pictures of naval vessels and post them online,“ says Bergman. “I found examples where vessels were leaving or entering areas that seemed pretty impossible.”

Bergman then overlaid synthetic aperture radar and optical imagery from the European Space Agency’s Sentinel-1 and -2 satellites onto the suspicious AIS pings. If they were real, the AIS data should have matched up perfectly beneath a satellite image of the ship.

Instead, Bergman saw only empty ocean, time after time. In fact, he says, “I have not yet found an instance when a track flagged by the query as false turned out to be real.”