# AIS Data Vulnerability Indicated by a Spoofing Case-Study
## 1 Introduction
The nominal reporting intervals for data transmission vary from 2 s to 6 min and depend on the type of AIS station, the group of messages, the navigational status, the speed, and the course change of ships [1]. Slower ships send kinematic data every 10 s, medium-speed ships every 6 s, high-speed ships every two seconds. If the ship changes heading, the transmission intensity increases by a factor of 3 (for slower and medium speed ships). Table 2 shows the transmission intensity of static and dynamic information for Class A and B and for single and dual-channel transceivers. AIS transponders can receive all transmission information from both AIS channels simultaneously and combine the information from both channels into a single data stream. The standards of transmission, types, the format of messages, and symbols, make it simple for users to identify, monitor, and track targets detected by AIS. Figure 2: AIS target data (Screenshot of Navi-Harbor VTS application, Wartsila). There is additional AIS traffic present; AIS BS reports, AtoN, Application-Specific Messages and AIS-SART, MOB-AIS or EPIRB-AIS, all with variable reporting rates. In addition to the nominal reporting frequency, it is possible to poll ships for current information. A competent authority can use a base station to prompt mobile AIS devices for more frequent messages, such as vessels at anchor exposed to heavy wind [1]. If the altitude of the base station AIS is as shown in Figure 2 (1028 m) and it is located in an area with moderate shipping, and a large number of ports, including offshore industry, fishing, and yachting, VHF data link (VDL) congestion is common. When spoofing occurs in such an area, nautical safety can be affected. Today's applications of AIS data has shifted from use for collision avoidance, identification, and tracking to monitoring shipping routes, maritime traffic trends, risk analysis, marine accident investigations, near-miss investigations, search and rescue operations, waterway planning, management and maintenance using AtoNs, traffic simulation and forecasting, fisheries monitoring, ecological matters, and prevention of illegal activities at sea (e.g., illegal fishing and prevention of piracy) [1; 8; 16; 17; 18; 19; 20; 21]. The applications of S-AIS data will be even broader in the areas of marine environmental protection, maritime safety, and security [22]. This paper takes a closer look at the landscape of AIS as an essential source of information for MSA and identifies its vulnerabilities and challenges for safe navigation and shipping with a particular focus on spoofing. A case study of a specific spoofing event near Elba in December 2019 confirms that typical maritime AIS can be easily spoofed and generate erroneous position information. In conclusion, the implementation of a robust cybersecurity framework to improve defenses against spoofing and other maritime cyber threats is recommended. The paper is structured as follows: Section 2 describes the methodology, Section 3 presents AIS vulnerabilities and practical examples of significant spoofing incidents, and Section 4 refers to a practical investigation of an AIS spoofing event. Section 5 presents the discussion, and Section 6 the conclusions.