# AIS Data Vulnerability Indicated by a Spoofing Case-Study
## 1 Introduction
The AIS uses the Time Division Multiple Access (TDMA) protocol, in which the time unit is divided into a number of equal slots containing a fixed amount of data, and the AIS station selects one or more free slots for data transmission [1; 9; 13; 14]. The data is transmitted over a tracking system with a self-organized time division multiple access (SOTDMA) at a data rate of 9600 bits per second using Gaussian Minimum Shift Keying (GMSK) modulation. The ship transponder encodes the relevant information  
Figure 1: Types of AIS stations, according to the authors of [1; 6]. in the AIS message string to within 256 bits. Messages are fragmented using National Maritime Electronic Association standard 0183 (NMEA0183) with a maximum sentence size of 82 characters; if an extended message is transmitted, the payload is split into multiple fragment sets, with a maximum of five (e.g., Binary addressed message or AIS application message 6 can be variable in length, up to a maximum of 1008 bits). According to the amount of data to be transmitted, one or more time-slots can be required. The standard mandates that a transceiver can continuously transmit data for a maximum number of consecutive slots, as a continuous data stream, depending on its class. Class A devices can transmit continuously for five consecutive slots, while transmitting Class B devices can occupy the medium for a maximum of three consecutive slots, as per Table 1[15]. The key to the SOTDMA protocol is the availability of a highly accurate standard time reference (provided by the precise time signal in the Global Navigation Satellite System (GNSS) satellite transmission) to which all stations can synchronize their time slot assignments to avoid overlap [16]. The messages are transmitted with a power of 12.5 W (class A) and a bandwidth of 25 kHz. When a particular ship's message is broadcast, the station AIS announces its next broadcast position. The required ship reporting capacity under the IMO performance standard is at least 2000 time slots per minute at maximum 50% utilization. A single AIS channel capability is equal to 2250 messages transmitted within one minute, giving a slot length of 26.7 ms:  
\[2250\;\mathrm{min}^{-1}=\frac{9600\;\mathrm{bit}/\mathrm{s}}{256\;\mathrm{bit }}.60\;\mathrm{s} \tag{1}\]  
AIS transmission can be on two channels, channel 87B on 161.975 MHz or 88B on 162.025 MHz, respectively, referred to as AIS channels 1 and 2, doubling the data capacity. The envisaged capacity of 4500 telegrams per minute is assumed to be sufficient for unrestricted ship-to-ship (2S) and even ship-to-shore (4S) use, with a typical range of 20 nautical miles (NM) between ships and up to 40 NM between ship and shore. The more accurate range (D) can be calculated using the heights (h\({}_{1}\), h\({}_{2}\)) of two VHF antennas. The following example shows the signal range calculation for an AIS base station in Slovenia, located at Mount Slavnik at an altitude of 1028 m, successfully receiving data from the current vessel at a distance of over 90 NM. The height of the ship's VHF antenna is 30 m. The current reception data is also shown in Figure 2. Ships that are at the edge of the theoretical range of the AIS signal are detected, but no static ship data is available. \[\mathrm{D}\;=2.5\left(\sqrt{\mathrm{h}_{1}}+\sqrt{\mathrm{h}_{2}}\right) \tag{2}\]  
\[\mathrm{D}\;=2.5\left(\sqrt{1028\;\mathrm{m}}+\sqrt{30\;\mathrm{m}}\right)=93. 85\;\mathrm{NM} \tag{3}\] \begin{table}
\begin{tabular}{c c} \hline \hline
**Number of Consecutive Slots** & **Maximum Binary Data Bytes** \\ \hline
1 & 12 \\
2 & 40 \\
3 & 68 \\
4 & 96 \\
5 & 121 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Maximum binary data bytes that could be transmitted using a given number of consecutive time-slots [15]. However, the detection probability of the AIS is not a purely geometric matter but depends on VHF propagation, which is affected by ground conductivity, atmospheric conditions, receiver sensitivity, antenna attenuation, signal shadowing, radio interference, and more.