Reporter's Notebook: How to Investigate Shadow Fleets

In the world of maritime trade, some ships play a dangerous game of hide-and-seek. They rapidly change flags, shift ownership, and even cut their tracking systems mid-voyage. These “dark fleet” tactics are often employed by vessels involved in nefarious activities such as sanctions evasion, arms trafficking or illegal fishing.

At first sight, the trail of such ships can appear hard to follow. Yet the evidence is often still there, scattered across open sources. With perseverance, it can be possible to uncover more information about who is behind these shadowy vessels.

As an example, we’ll walk you through some of the OSINT resources we consulted to investigate three Syrian ships which were sanctioned by the European Union for allegedly helping Russia transport grain stolen from occupied territory in Ukraine. (You can read our full investigation here.) 

Red Flags 

Our case began with a curious detail: Leaked documents obtained by reporters revealed that multimillion-dollar ships which once belonged to the Syrian government had been sold for just $1 each in 2023. 

After the sale — to an opaque offshore firm in the Seychelles — the ships began to shed their old identities. They repeatedly changed names, and at times went dark by disabling the transmitters that commercial vessels are required to keep on to broadcast their locations. 

This behavior caught our attention, as did another red flag, so to speak: The vessels were frequently changing their countries of registration, and flying what are known as flags of convenience. This refers to flags from jurisdictions that allow ship owners to register their vessels far from home, often with minimal oversight, low taxes, and fast, easy registration. While legal, these registries have been criticized by regulatory agencies and rights groups for lowering labor and safety standards as they compete to attract shipowners. 

Navigating Ship Data Sources

After deciding to probe who was behind the flag-hopping Syrian vessels, the first step was to collect their basic details. Like people, ships have several identifiers, and gathering this information is the starting point for any investigation.

Some markers are more reliable than others. While names, flags, owners and radio IDs can all change, there is one data point that is permanent: The seven-digit code known as an IMO number, which is assigned to a ship at construction and never changes. 

You can find a vessel’s IMO number by searching its name on the website of the International Maritime Organization (IMO), which is accessible with a free account. This official database also provides information about a ship’s history, including past and current names and registered flags. 

After confirming a vessel’s IMO number and flag, you can then approach the country where it is registered to seek documents that typically include information about the owner, sometimes the operator, and key vessel particulars such as tonnage, build year, and class.

While some ship registries are searchable online, others remain opaque or completely inaccessible — as is the case in Syria. Lloyds’ List, an outlet that covers the shipping industry, has a useful directory with contact information for the world’s ship registries. 

We found that emails sent to generic registry addresses were almost always ignored. It was more effective to determine the person responsible for the country’s registration system, and then send them a short, polite email directly. 

Third-party databases can also help fill information gaps in official sources. Equasis, which offers free accounts, can add further details on ownership and management, while paid databases such as Lloyd’s List, Sayari, and Orbis can offer even deeper insights. Yet while these third-party sources are valuable, their findings should always be treated as leads and verified against official documents.

It’s also important to be on the lookout for a worrying new development: the proliferation of fake ship registries. These are unrecognized operations that issue documents which appear official but have no legal standing. For shipowners seeking to hide illicit activities, they provide the perfect cover.

We quickly identified one such phony registry when we emailed authorities in Timor-Leste about one of the Syrian ships that was flying its flag. Timor-Leste’s National Directorate Maritime Transport told OCCRP that it did not maintain an international ship registry and that it had no knowledge of the vessel we enquired about. 

To spot such fake registries, first confirm whether it is recognized by the IMO or the International Transport Workers’ Federation (ITF). If not, it’s likely fraudulent. Dodgy websites and inconsistent or duplicated registry numbers are other warning signs.

Tracking a Ship’s Movements

You’ve uncovered some information about a ship and its owner and now you want to know where it’s been. There are several avenues to explore.

For safety reasons, commercial vessels are required to broadcast their location via AIS transponders. This and other tracking data is collected and visualized on sites like MarineTraffic.com, where you can follow a ship’s live movements. 

However, accessing information about a vessel’s historical routes is more difficult. This satellite data is collected by private companies who sell it for a hefty fee. Thankfully, a platform known as Global Fishing Watch provides free access to this information and a helpful interface for mapping a vessel’s path. After creating a free account, you can use the platform’s map to find specific ships or look into activities in certain locations.

Things get even tricker, however, when ships deliberately turn off their AIS transponders — as was the case with the Syrian vessels. In such instances, you’ll have to turn to other resources to help connect the dots. 

One of the strongest types of proof you can obtain is satellite imagery, as it offers definitive evidence of a vessel being in a precise location at a specific time. In the case of the Syrian ships, satellite images confirmed the ships’ presence at grain terminals of Russian-occupied ports in Ukraine — a strong indication that they were still aiding Moscow in this sanctioned trade.  

Free resources such as Google Earth can provide such satellite imagery, as well as paid tools that give free access to journalists and activists, like planet.com. Maxar, which has some of the best coverage, may waive fees if your story is in the public interest. 

There’s another important resource you shouldn’t overlook: humans. Not only are there professional boat trackers, such as the Bosphorus Observer consultancy, who spotted some of the Syrian ships we were investigating during their “dark” periods, but there are also amateur enthusiasts who take photos of ships at ports and then post them online, on sites like MarineTraffic and VesselFinder, with locations and timestamps. 

But nothing beats seeing something with your own eyes. For the Syria investigation, reporters from our partner SIRAJ were tipped off that one of the vessels was docked in the country’s Latakia port. When a journalist arrived at the yard to look for the ship, they found a large freighter, but the name was hidden behind a tarp that had been hung across the hull. Then came a gust of wind — lifting the tarp just long enough to see its name.