#576: How to track dark ships using OSINT (with demos)

The Rise of Dark Fleets and Cyber Threats at Sea

David Bombal opens with recent news about hacked Chinese cranes at U.S. ports, setting the stage for a deep dive into dark fleets—ships that evade sanctions by manipulating their identity or turning off tracking systems. The episode introduces Ray Baker, an expert in OSINT and maritime intelligence, and sets the tone for a technical yet accessible exploration of how these vessels operate and how they can be tracked.

Ray Baker’s Journey into OSINT and Maritime Intelligence

Ray Baker shares her unexpected path into OSINT—from graphic design to cybersecurity research, sparked by a blog about hacking a ship. She explains how her curiosity led her to specialize in maritime analysis, combining cyber, human, and technical intelligence to uncover hidden threats.

Understanding AIS: The Lifeline and Weakness of Ship Tracking

The episode breaks down how AIS (Automatic Identification System) works—required for ships over 300 tons—and how it’s exploited by dark fleets. Ray explains how ships can change their IMO number, flag, name, or paint over hulls to hide their identity, making them nearly invisible to casual observers.

Tracking Dark Ships with Free and Paid Tools

Ray demonstrates how to use platforms like MarineTraffic and TankerTrackers to monitor ship movements in real time. She highlights red flags such as sudden stops, erratic paths, and AIS signal drops, which often indicate illicit cargo transfers.

The Human and Cyber Dimensions of Maritime Security

Beyond tracking, Ray reveals how port infrastructure—like cranes and cameras—can be hacked. She shows how poor security on Chinese-made cranes at U.S. ports poses a real threat, and how attackers could pivot from a camera to the entire port network.