By now, I think AIS (Automatic Identification System) tracking has become fairly mainstream within cyber/geopolitics/journalism, at least more than it was in 2019 when I started doing it. AIS allows for the tracking of vessel movements in addition to many other cool data points like draft (weight) and speed. We know about it, and the adversaries know about it (and everyone manipulates it).
But have you ever heard of LRIT?
Long Range Identification and Tracking (LRIT) was mandated by the International Maritime Organization (IMO) under SOLAS regulation V/19-1. That seems quite complicated, but simply put SOLAS is the International Convention for the Safety of Life at Sea and sets standards for commercial shipping. The treaty was first adopted in 1914 after the Titanic sank. I can’t imagine why…
So, if a vessel is going to operate internationally, the flag state has to comply with SOLAS and the use of LRIT is mandatory for vessels 300 tons or more on international travel. The main difference is that AIS is publicly broadcast, while LRIT is closed.
Every six hours, satellites query vessels, and vessels respond with their position and identification; the data gets shared with authorized groups like the flag states to see their own vessels, port states to see within 1,000nm, and coastal states to see vessels within their Exclusive Economic Zones (EEZ). There is no way to publicly access LRIT feeds.
So Why Should OSINT Analysts Care?
I clearly don't have access to LRIT data, but I wonder whether adversaries try to perform elaborate spoofing like they do with AIS, or just turn it off. I assume that AIS manipulation is worth more effort because it is watched around the clock by analysts.
While we may never get access to LRIT data, it is important to understand LRIT architecture to
Help prevent cyberattacks
Know where to request the data
The LRIT data gets transmitted via satellite to national and regional data centers to help them monitor their own fleets and identify any maritime issues. The data is also transmitted to the International LRIT Data Exchange (IDE) managed by European Maritime Safety Agency (EMSA), which maintains a long list of data centers connected to it. The European Maritime Awareness Centre (EMAC) receives and aggregates all the regional data for all authorized users.
Each of those nodes is a possible adversarial target. A breach of the IDE wouldn’t just expose one vessel’s positional data; it would expose the movement patterns of every tracked vessel for every authorized state using the system. We already know that threat actors are focusing on maritime critical infrastructure; the IMO itself was hit back in 2020 with an attack on its IT systems.
And here is further proof:
Massive Cyber Attack Threatens Release of Data from 38 Maritime Companies
Hackers Disrupt Communications of Dozens of Iranian Oil and Cargo Ships
The IDE is an attractive target, and these data centers have a human vector that attackers frequently exploit for credential harvesting, phishing, and/or vishing attacks.
What You Can Do With This Knowledge
You won't get the LRIT data unless you work in tandem with government agencies, but the compliance records are public. Port State Control (PSC) inspections occur each time a vessel enters port. Inspectors supposedly check LRIT compliance as part of the standard protocol. When a vessel’s LRIT system is off or nonfunctional, it gets logged as a deficiency which then becomes a searchable record.
The Paris MOU (parismou.org) and Tokyo MOU (tokyo-mou.org) both have online inspection databases (European and North Atlantic, and Asia-Pacific). You can search by vessel name, IMO number, or flag state to look for LRIT deficiency codes, but you have to have a vessel of interest to start with rather than a category number and then look through the codes, which is annoying for broader analysis.
Paris MOU uses the deficiency codes:
10137 — LRIT (Long Range Identification and Tracking)
10113 — AIS
10103 — Radar
10115 — GNSS/satellite navigation receivers.
THETIS is the European Maritime Safety Agency’s public database of Port State Control inspections used by Paris MOU
A pattern of LRIT deficiencies isn’t hard proof of anything illicit, but layered against AIS dark periods, it can indicate intentional manipulation rather than equipment issues. A vessel with AIS gaps and repeated LRIT noncompliance looks like someone who doesn’t want to be seen.
Journalists have an additional toolset here that OSINT analysts don’t use: formal access requests. LRIT data is held by governments, which means it’s subject to the same legalities as other official records and FOIA records would apply.
FOIA requests could be made to:
the U.S. Coast Guard for position records on specific vessels during specific timeframes. The USCG maintains a national data center (NDC) of LRIT data for U.S. flagged vessels and vessels entering U.S. waters
the EU member state maritime authorities that maintain LRIT data under the SafeSeaNet and EMSA
the open registry flag states like Panama, Marshall Islands, Liberia that have LRIT access although this might prove difficult
the IMO’s LRIT Coordinator which tracks vessel noncompliance that gets reported by flag states. This goes out in IMO reporting and can be requested formally.
The use of public PSC records, public AIS data, and formal LRIT requests can tell a significantly stronger story about illicit activity than just one on its own.
The Methodology
Ask yourself if the vessel is over 300 gross tons; if not, then a record won’t exist.
Search PSC records at Paris MOU or Tokyo MOU by IMO, flag state, and LRIT codes
Here you could implement an AI action to pull and sort records
Match up AIS dark periods with PSC dates and ask yourself if there is any overlap or pattern of noncompliance.
Document any variances between AIS/LRIT/reporting and any enforcement action
If you want to know more about tracking vessels, check out my book Deep Dive, which has a hefty chapter on maritime OSINT and Deep Insight will help you create AI workflows.