Report: Smugglers Defraud IMO to Create Fake IDs for Blacklisted Ships

In a new report released Thursday, researchers at the security think tank C4ADS identified nearly a dozen vessels that have evaded UN sanctions by "laundering" their identities with fake IMO registrations. 

The tactic goes further than the common practice of tampering with AIS presets, which is often seen among the tankers that violate UN sanctions to deliver fuel to North Korea. The perpetrators of this more sophisticated scheme are fraudulently setting up fake vessel registrations with IMO for ships that do not exist, then using the new fake ID to rebrand blacklisted vessels and give them a clean slate. The "dirty" vessel receives a brand new IMO number, MMSI, history, deadweight tonnage, length and beam, which it can enter into its AIS transponder and use during port state control inspections. In a more complex variation on this scheme, a second "clean" vessel takes on the new fake identity, freeing up its own identity for use by a "dirty" ship. 

The C4ADS team's analysis - backed with sophisticated technology provided by Palantir, Windward, Amazon, Planet Labs, Airbus and Maxar - has identified at least 11 ships which have used this tactic in recent years. The new report gives two examples: the blacklisted Kingsway, which became the Apex / Shun Fa (IMO 8528864) in 2019; and the suspected smuggling vessel Subblic, which became the Hai Zhou 168 (IMO 8514045) in 2019. 

First, the ship is physically altered to look like a different vessel. Then, using fraudulent documents, the vessel operator tricks registration personnel at IMO into issuing a new vessel identity for a newbuild or an existing vessel that is new to internationl trade. That new identity is painted on the hull and entered into the AIS transciever, and the blacklisted ship can return to commercial operations.

This tactic is very hard for maritime officials to detect and defeat, C4ADS wrote. 

"Ships involved in vessel identity laundering schemes rarely exhibit the usual telltale signs of AIS tampering or sloppy paint jobs that cover old ship names," wrote the researchers. "As a result, law enforcement and civil regulators have a significantly greater challenge in identifying vessels involved in an identity laundering operation."

The sanctioned vessel Kingsway underwent this fraudulent transformation in July 2018, repainting her decks and becoming the (nonexistent) vessel Apex. IMO detected a related transaction in April 2020, but Kingsway managed to slip under the radar and keep trading as Apex until May 2021. She even made an uneventful port call in Kaohsiung, Taiwan, where she had been denied entry before her transformation.

In another example, the blacklisted tanker Subblic became the "newbuild" Hai Zhou 168 through a complex shell game. The operator created a false identity for a second, real vessel, then transferred the second vessel's original identity to the Subblic. The blacklisted Subblic has since delivered petroleum to North Korea as Hai Zhou 168 at least 17 times, according to C4ADS. In a sign of challenges to come, her "clean" identity has been occasionally handed off to other North Korean tankers to use for their own AIS transmissions.

C4ADS noted that detecting this kind of sophisticated registration fraud will be hard for IMO (or any authority) to achieve every time. However, it recommended several changes to make the process harder to game. First, it recommends that IMO should require regular photos of the ship and updates on its status from the operator, in the same manner that everyday citizens must regularly reapply for a passport or a drivers' license. 

Second, C4ADS advised that IMO should require owners to submit the ship's dimensions, hull number and engine number during registration, as these data fields are often left blank in practice. It also recommended collecting photos of the vessel from all four sides. "If implemented, these improvements to the IMO’s registration system would meaningfully challenge the ability of illicit actors to commit IMO number fraud and create shell identities on demand," the authors concluded.