# AIS Data Vulnerability Indicated by a Spoofing Case-Study
## 4 Case Study on Spoofing Large Amounts of AIS Fake Targets Nearby Elba Island and Its Impact on VDL
### Potential Consequences of Spoofing Near ELBA Island  
There were seven vessels found to be in a spoofing cloud, as shown in Table 5. To reinforce our research, a letter was sent to those in charge of the ISM of those vessels to enquire about the possible consequences for the safety of shipping. Even without their response, we were able, in our case study, to configure a navigation scenario in the affected area. The archive data were streamed using the application AIS Network Data Client and played in two different VTS applications Navi-Harbor (Wartsila) and Pelagus (Elman). The spoofing data was displayed on both ECDIS and RADAR applications via the ship tracking simulator Navi Trainer Pro (Wartsila). For this case study, we have picked up m/v \"[PERSON]\" within the area covered by the AIS spoofing cloud. We have synchronized the clock with the AIS data, and by using her actual position, course and speed, we were able to simulate what has been seen on her ECDIS screen just a minute before AIS spoofing. Figure 13 presents the information obtained by the radar (including AIS) overlay display on ECDIS. It can be seen that the navigation data are appropriate due to the matching of the ENC with radar and AIS data. This situation allows OOW to have an appropriate MSA for this particular navigational area. Figure 12: AIS RSSI signal during Elba Island spoofing event. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ship Name** & **Type** & **IMO N\({}^{\circ}\)** & **MMSI** & **Gross Tonnage** & **Year of Build** & **Registered Owner** \\ \hline La Suprema & Ro-Ro & 9214288 & 247083700 & 49,257 & 2003 & Grandi Navi Voloci \\  & & & & & Spa (Italy) \\ \hline Blue Star & & & & & \\ (ex. Minerva & Crude Oil Tanker & 9198094 & 273218590 & 58,125 & 2000 & Marine Trans \\  & & & & & Shipping Llc (Russia) \\ \hline Eliana Marino & Ro-Ro & 9226360 & 247370400 & 18,265 & 2000 & Moby Spa (Italy) \\ \hline Mega Express & Ro-Ro & 9035101 & 247183200 & 28,338 & 1993 & Forship Spa (Italy) \\ \hline Leale & Chemical/Cil Tanker & & & & & Elbana Di \\  & & & & & & Navigazione Spa (Italy) \\ \hline Crudemed & Crude Oil Tanker & 9832547 & 636018645 & 62,330 & 2018 & Sans Souci Shipping \\  & & & & & Co (Liberia) \\ \hline Cruise Ausonia & Ro-Ro & 9227429 & 247378700 & 30,907 & 2002 & Grimaldi Euromed \\  & & & & & Spa (Italy) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Ships involved in spoofing event near Elba on 3 December 2019. Figure 14 presents the first burst of AIS spoofing event displayed on ECDIS with radar overlay and AIS data, in which significant degradation of MSA is caused, and 95% of the AIS signal processing load occurs. Consequently, the radar image shows a dangerous situation of m/v \"Eliana Marino\" on a collision course with more than a dozen other fake m/v, as shown in Figure 15.  
Figure 14: AIS processing overload (Screenshot of ECDIS Navi Simulator, Wartsilla). Figure 13: Simulation of the m/v “Eliana Marino” ECDIS display just a minute before the actual spoofing occurrence (Screenshot of ECDIS Navi Simulator, Wartsilla). By filtering the presentation of sleeping AIS targets and limiting ships to a range within 6 NM, the picture is slightly more apparent, as shown in Figure 16. The ECDIS/ARPA system is relieved, and it is also possible to change the CPA and Time to Closest Point of Approach (TCPA) filter. However, from the OOWs' perspective, this situation is hazardous in navigation since a relatively large number of false signals with collision course and a very short CPA are generated. Consequently, a relatively large number of collision alarms appear, which can further lead to inadequate OOW decisions. An experienced OOW will use in this situation a \"raw\" radar picture without the AIS data support and enhance sharp visual look-out. Luckily, the AIS spoofing event took place during the daytime and in a favorable navigation area. If it occurred during the night and in a dense maritime traffic area dangerous for navigation, it might have severe consequences on the safety of navigation.