In February, an oil tanker transmitted a signal showing it was sailing west of Japan.
But the tanker’s path was highly unusual. Over the course of a day, its signals showed erratic behavior as the ship rapidly changed position.
A satellite image, taken during this time, deepened the mystery: There was no ship there at all.
The Cathay Phoenix was sending a fake location signal. This is known as “spoofing.”
In reality, the ship was 250 miles north loading oil at the Russian port of Kozmino, part of a journey to China that likely caused a breach of U.S. sanctions.
The Cathay Phoenix is not a lone rogue ship, but one of at least three tankers identified by The New York Times taking extraordinary steps to hide their true activity, a practice that helps them to elude U.S. government oversight and puts their American insurer at risk of violating recent sanctions on Russian crude oil.
For years, ships wanting to hide their whereabouts have resorted to turning off the transponders all large vessels use to signal their location. But the tankers tracked by The Times go beyond this, using cutting-edge spoofing technology to make it appear they’re in one location when they’re really somewhere else.
During at least 13 voyages, the three tankers pretended to be sailing west of Japan. In reality, they were at terminals in Russia and shipping oil to China.
The vessels are part of a so-called dark fleet, a loose term used to describe a hodgepodge array of ships that obscure their locations or identities to avoid oversight from governments and business partners. They have typically been involved in moving oil from Venezuela or Iran — two countries that have also been hit by international sanctions. The latest surge of dark fleet ships began after Russia invaded Ukraine and the West tried to limit Moscow’s oil revenue with sanctions.
“The type of spoofing we are seeing is uncommon and sophisticated,” said David Tannenbaum, a former sanctions compliance officer at the U.S. Treasury, referring to the tankers identified by The Times. “It definitely looks like evasion on all parts.”
To date, it’s been rare to prove the true location of a ship pretending to be somewhere else. But a Times analysis of publicly available shipping data, satellite imagery and social media footage helped clearly establish that the tankers were not where they claimed to be.
The ships most likely sell their Russian oil to China above a price limit set by the sanctions. Since neither country recognizes the sanctions, the tankers themselves are not in violation by spoofing or carrying the oil.
But the tankers still have motive to spoof: to maintain their insurance coverage, without which they cannot operate in most major ports. The only insurers financially able to cover tankers are mostly based in the West and bound by the sanctions. If a client ship were to carry Russian oil that’s sold above the price limit, the Western insurer would be in violation of the sanctions and must drop its coverage.
“It’s significant when you look at dollar terms,” said Samir Madani, co-founder of TankerTrackers.com, which monitors global shipping, who first alerted The Times to several of the suspicious ships. “It’s around $1 billion worth of oil that is going under the radar while using Western insurance, and they’re using spoofing in order to preserve their Western insurance.”
In addition to the three tankers transporting oil, Times reporters tracked another three vessels spoofing while off the coast of Russia, though it’s unclear what cargo they carried.
All six tankers are insured by a U.S.-based company, the American Club. The Times provided the company with the names of the tankers, as well as details about the voyages on which they spoofed.
In an emailed response, Daniel Tadros, the American Club’s chief operating officer, said he could not comment on any potential investigations because of legal and privacy requirements. “Insurance cover is automatically excluded in the event of sanctions’ violations,” he said.
The U.S. has also created so-called safe harbor provisions to protect insurers from liability if they inadvertently cover ships violating sanctions. As of May 30, a regularly updated list of American Club’s clients posted on its website showed the company is most likely still insuring the six tankers.
There has been at least one change since The Times approached the company with evidence of spoofing. The website had said the Cathay Phoenix’s current policy would expire in February 2024. But recently, the expiration date suddenly shifted much earlier to June 2023. The company would not comment on the reason for the change.