# AIS Data Vulnerability Indicated by a Spoofing Case-Study
## 4 Case Study on Spoofing Large Amounts of AIS Fake Targets Nearby Elba Island and Its Impact on VDL  
With the increasing demand for maritime VHF data communications, AIS is heavily used for maritime security, maritime situational awareness and port security [46]. VDL exposure remains an increasingly serious problem in many parts of the world due to the proliferation of AIS applications, message types, services, and equipment types, as well as unanticipated increases in user traffic. The critical threshold of 50% VDL has already been exceeded in some areas of the world where shipping is at a high level. However, when intentional emission of virtual targets occurs in addition to the high AIS traffic, such actions can further jeopardize the operation of the system. The IALA has indicated that additional AIS channels are needed to provide maritime safety information and general data communications and to protect the integrity of the AIS VDL [46]. Each ship transmits its AIS data and receives the AIS data from all ships within its VHF radio range. In high traffic density situations, it becomes necessary to reduce the number of vessels in a communication cell. When the number of AIS messages begins to overload the network, the AIS station can automatically reduce the size of its cell by ignoring weaker, more distant stations in favor of nearby ones. When the data link is congested to the point that the transmission of safety information is compromised, two different methods are available to resolve the congestion [47; 48; 49]. First, the own station can intentionally reuse slots from the most distant station(s) within the candidate slot selection interval, but the slots allocated by the base stations can only be used if the base station is more than 120 NM away from the own station [48]. A distant station that was the subject of the intentional slot reuse is excluded from further intentional slot reuse for a period of one frame. This allows time slots used by weak stations far away to be used by stations nearby. This method is known as the Robin Hood principle [50]. In addition, to resolve congestion and protect VDL functionality, the base station may allocate Class A reporting rate to all non-Class A shipborne mobile stations, and to resolve congestion for Class A shipborne mobile stations, the base stations may use slot allocations to redirect slots to reserved Fixed Access Time Division Multiple Access (FATDMA) slots. In this way, the broadcasting system can be overloaded by up to 500% by sharing slots and still provide close to 100% throughput for ships closer than 8 to 10 NM to each other in a ship-to-ship mode: i.e., only more distant targets are affected by the outage in order to give priority to closer targets that are of greater interest to navigators and VTS operators. In practice, the capacity of the system is almost unlimited so that a large number of ships can be accommodated simultaneously. The only known AIS spoofing case where a large number of fake AIS messages were delivered occurred on 3 December 2019, starting at 13:13 UTC, in the maritime area between the island of Elba and Corsica. Thousands of AIS streams were received and recognized as Dutch-flagged naval units that were artificially generated and had different identification codes, positions, routes, and speeds. This information completely saturated a circular sea area with a radius of about 11 NM. The attack was repeated three times, at 13:13 UTC (duration 3 min), at 13:28 (duration 4 min), and the last burst started at 13:37, lasting only a few seconds. From Figure 5 the generation of regular position reports with increasing Maritime Mobile Service Identity (MMSI) numbers is evident. During the first burst, 2389 messages were received, all messages were categorized as AIS message number 1. The smallest MMSI number was 244800009, and the largest was 244803507. In the second burst, the smallest MMSI received was 244803510, and the last was 244807010.