The recent naval dispute between Russia and the UK in the Black Sea may have involved a cyberattack as well as conventional weaponry, an analysis of vessel tracking data has found.
Yesterday, Russia claimed to have fired 鈥溾�� at the UK Royal Navy destroyer HMS Defender for being inside 鈥淩ussian waters鈥�, although the UK Ministry of Defence at the Defender or that the ship was in such waters. The event took place off the coast of Crimea, Ukraine, which is disputed territory.
But last week, on 19 June, an international vessel-tracking system appeared to show HMS Defender and the Royal Netherlands Navy鈥檚 HNLMS Evertsen travel across the Black Sea to sail within a few kilometres of a Russian naval base at Sevastopol.
Advertisement
This would have been a provocative act, but the voyage never actually happened 鈥� both ships remained docked at Odessa, Ukraine, as confirmed by a live web cam feed. The tracking readings seem to have been faked, in a possible cyberattack.
The readings in question come from the Automatic Identification System (AIS), which is required on all ships by international law. It transmits position data from the vessels鈥� GPS along with an ID and other details at regular intervals. But GPS can be fooled by a transmitter imitating a GPS satellite and sending false information, which would in turn result in incorrect AIS tracks.
A previous false AIS incident took place in the Black Sea in 2017. On that occasion, at least 20 merchant vessels showed locations 32 kilometres inland at Gelendzhik Airport.
This time, the spoofing is more subtle, and only seems to have affected two vessels. Rather than being instantly teleported to a false location, their co-ordinates were changed gradually to mimic normal travel, suggesting a deliberate attempt to mislead.
鈥淗MS Defender was alongside [moored] in Odessa at the time of the alleged AIS track. 聽Why this occurred would be a question for the originator of the track imagery,鈥� says commander A. J. Stevens of the Royal Navy.
at the Resilient Navigation and Timing Foundation in Virginia speculates that the GPS spoofing could have been done by Russia.
鈥淚t took a lot of effort to do this,鈥� says Goward. It may be intended to show shows that Russia is a force to be reckoned with, and that mariners cannot rely upon the US-operated GPS system, he says.
at the University of Texas at Austin says the tracks could have been generated by GPS spoofing, or from a fake AIS transmitter.
鈥淎IS messages don鈥檛 carry a digital signature, so there is no way to authenticate a message as having come from the ship claimed,鈥� says Humphreys. 鈥淭his means it鈥檚 easy to gin up a fake AIS signal purporting to be the Royal Navy鈥檚 HMS Defender and broadcast it around the Black Sea with some provocative-looking tracks. 鈥�
Humphreys says he has seen AIS fakery before, but never for a warship. He too suggests that the most likely source is Russian disinformation 鈥� to sow confusion.
H. I. Sutton at USNI News, who , says AIS is an important source of open-source information about ship movements, and sometimes the only way of telling where a vessel is.
鈥淚n this case, we were able to use other open-source intelligence, public webcams, to disprove the AIS tracks. But this would not always be the case,鈥� says Sutton.
Spoofing could be used to make a ship run aground on a reef or sandbank, or collide with another vessel. Alternatively, someone could use fake tracks to support claims that a boat wasn鈥檛 fishing in a prohibited area. But the military context of this incident is worrying, given heightened tensions.
鈥淭his kind of thing could easily lead to a shooting war by making things more confusing in a crisis,鈥� says Goward. 鈥淣ATO ships conduct 鈥榝reedom of navigation鈥� patrols by sailing through disputed waters. Sometimes they come close to agreed-upon territorial seas on purpose. Something like this could cause an incident that could escalate out of control.鈥�
The Russian and Dutch defence ministries didn鈥檛 respond to a request for comment.
