Hunting the Mother Ship: How Behavioral Intelligence Traces At-Sea Cocaine Drops

This analysis reflects the analytical methodology of Windward’s Maritime Intelligence Operations Center (MIOC), applied to a real seizure event documented in open sources and drawing on AIS data, multi-source signal fusion, and Windward’s Maritime AI™ behavioral models through a hybrid workflow that combines AI-assisted analysis with human analyst review. Vessel identifiers and ownership entities have been redacted for external distribution, AIS-based assessments are probabilistic and intended solely as decision support, and nothing herein should be construed as evidence of wrongdoing by any vessel, company, or individual. For intelligence tailored to your operational theater, visit the MIOC page.

On June 8, 2026, officers from the UK’s National Crime Agency boarded a small fishing vessel, the NEW HORIZON, as it returned to Eastbourne Harbor on England’s south coast. They found 425 kilograms of cocaine on board, worth an estimated £35 million. Five people were arrested. The vessel had not visited a foreign port. The drugs had never passed through a container terminal. They had been picked up from the sea.

What the crew of the NEW HORIZON carried out is known in law enforcement circles as an At-Sea Drop-Off, or ASDO. The technique is simple in concept and difficult to detect, with a large commercial ship having jettisoned a waterproof, GPS-tracked bundle of cocaine somewhere out in the Channel while in transit. The NEW HORIZON had sailed out to collect it.

The question facing Windward’s Maritime Intelligence Operations Center (MIOC) was a precise one: which commercial vessel, out of the hundreds that transited the English Channel during the relevant period, was the one that dropped it?

This report walks through the methodology behind that answer, examining the data sources, the analytical logic, and the behavioral signals that narrowed a field of hundreds to a shortlist of a handful. The technique applies to any ASDO case where AIS data exists.

Understanding the Technique

To find the ship, you first need to understand why the technique exists.

For decades, the dominant method for moving large volumes of cocaine into Europe was to conceal it inside legitimate containerised cargo, such as fruit shipments, timber, and industrial goods. It worked, until it didn’t. Ports responded with scanning technology, intelligence-led targeting, and trained detector dogs. Seizure rates climbed. The criminal logistics problem became harder.

The ASDO is the workaround. The mother-vessel never has to stop. It is typically a container ship, bulk carrier, reefer, or roll-on/roll-off vessel operating a normal commercial route between South America or West Africa and Northern Europe. It never has to open a container for inspection. It simply drops its illicit payload into the water while in transit through European waters, then continues to its declared port of call.

The packages themselves are engineered for the purpose. They are waterproofed, wrapped to survive rough seas, fitted with buoyancy aids, and, crucially, equipped with high-accuracy, battery-powered GPS trackers. The mother vessel doesn’t need to know where the daughter vessel will collect from. The package broadcasts its own location.

The daughter vessel does the final mile. A small, locally registered fishing boat, yacht, or rigid-hull inflatable that belongs to the coastal scenery navigates to the GPS coordinates, hauls the package aboard, and returns to a quiet stretch of coastline or a small marina. No manifest. No customs declaration. No container to scan.

There is one more feature of the technique that shapes the entire detection methodology, and it is timing. ASDOs almost universally happen at night. The logic is straightforward. Aerial surveillance is degraded after dark, passing vessel crews are less likely to observe an unexplained jettisoning, and the small lights of a fishing boat collecting floating packages are invisible against a dark sea. This nocturnal preference creates a predictable constraint that analysts can exploit.

The Daughter Vessel Timeline

Finding the mother-vessel begins not with the daughter. The NEW HORIZON is the one vessel whose behavior we can reconstruct in full.

AIS, the Automatic Identification System that commercial and fishing vessels broadcast continuously, is the foundation of maritime intelligence analysis. Even a vessel that goes dark on AIS leaves a trail of its last transmitted position, its speed and heading at that moment, and its first position when it reappears. From these data points, analysts can reconstruct a great deal.

Post-seizure analysis of the NEW HORIZON‘s AIS record told a clear story. The vessel departed Eastbourne Marina on the morning of 5 June, sailing south towards its normal fishing grounds. Eight hours later, its AIS transmission stopped. It went dark and stayed dark for two and a half days. The next position transmitted by the vessel appeared on the morning of June 8, in roughly the same area from which it had last transmitted, heading back towards Eastbourne. It was boarded on arrival later that afternoon.

The AIS dark period, from the evening of June 5 to the morning of June 8, defines the outer boundary of the analytical problem. The cocaine had to have been dropped and collected somewhere within that window. The area south of Eastbourne, where the vessel had been operating for two years, defines the geographic zone.

But that window is still too wide. Two and a half days of commercial traffic through one of the world’s busiest shipping lanes produces hundreds of vessel transits. The next step is to compress it.

Here, ASDO operational logic does the analysts’ work for them. Daughter vessels minimise their time at sea with illicit cargo on board, particularly in a heavily patrolled corridor like the English Channel. The moment the NEW HORIZON had the cocaine in its hold, it would have wanted to get home. The AIS position on the morning of June 8, assessed to be the moment the vessel began its return transit, therefore tells us that the drop-off had probably happened in the hours immediately before that, not two days earlier.

Windward analysts narrowed the search window to the 31 hours between midnight on 7 June and 07:00 on June 8. Within that refined timeframe, the candidate population shrinks dramatically.

Building the Candidate List

With the window and the geography defined, analysts ran a structured query against Windward’s AIS database for commercial vessels originating from South American or West African ports that had transited the NEW HORIZON‘s operating area between midnight on June 7 and 07:00 on June 8.

The initial results still produced a significant number of vessels. The English Channel carries a large volume of traffic originating from drug-export regions, such as Brazil, Ecuador, Colombia, the Ivory Coast, and others that are all major trading partners with Europe. To manage this population, analysts applied a second layer of filtering by vessel type. Container ships, bulk carriers, reefer vessels, and roll-on/roll-off ships are the workhorses of ASDO operations, for the straightforward reason that their size and route regularity make them plausible cover. Small coasters, tankers on short-sea trade, and passenger ferries were deprioritised.

This produced a shortlist of eight vessels, three assessed as high risk for smuggling, and five as medium. These were vessels whose observable characteristics, such as origin, type, location, and timing, placed them in the right place at the right time to have physically carried out a drop-off. The next task was to look harder at what each of them had actually done while they were there.

Reading the Behavior

AIS data does not just tell you where a vessel is. It tells you how a vessel is moving – and when a vessel’s movement departs from what would be expected of a commercial ship on a declared route, that departure becomes a signal.

Analysts assessed each candidate against a set of behavioral indicators developed from operational experience across multiple ASDO cases:

No single indicator is definitive. A vessel going dark on AIS can reflect equipment failure. A speed reduction can mean traffic avoidance or a mechanical issue. The analytical judgement depends on convergence, based on how many indicators are present simultaneously, how precisely timed they are to the assessed drop-off window, and whether the behavior recurs across multiple voyages.

With that framework in place, three behavioral profiles emerged from the candidate shortlist.

Three Profiles, Three Different Stories

Vessel 1: Precisely Timed From a Primary Export Hub

The strongest candidate in the shortlist was a reefer vessel that had departed Guayaquil, Ecuador, one of the most significant cocaine-export ports in the world, and transited the NEW HORIZON‘s operational area at approximately 01:00 in the morning on June 8. The timing was precise. It hit the nocturnal window, the exact area, in the hours immediately before the NEW HORIZON began its return to port.

Upon arriving at a Dutch port the following day, the vessel executed a post-arrival flag change to Liberia, a recognised indicator of identity management. It was already on its way back across the Atlantic within days, with its declared destination the Caribbean.

Beneficial ownership analysis added a final layer of context. The vessel’s owner, a company operating a large fleet, had prior associations with cocaine seizures on other vessels in its fleet. Those were not ASDOs, but containerised cargo interceptions. That history does not prove anything about this vessel on this voyage, but it raises the prior probability.

Vessel 2: A Pattern From West Africa and the Channel

The second high-confidence candidate told a different kind of story, not from a single precise moment, but a pattern repeated across multiple voyages.

This was a large roll-on/roll-off vessel on a regular liner service between the Gulf of Guinea and Northern Europe. Two days into its June voyage, it had executed an abrupt deceleration to near-zero speed and drifted for approximately nine hours within the Guinean Exclusive Economic Zone. The waters off Guinea and Sierra Leone are well-established as a primary transshipment zone for South American cocaine stockpiled in West Africa before onward transit to Europe.

Analysts reviewing the vessel’s historical AIS record found that this was the third time it had done this, in precisely this area, on a Europe-bound voyage. The previous instances had occurred in September 2025 and April 2026. One unexplained drift event in a high-risk zone is an anomaly. Three, on successive voyages, on the same route, in the same area, is a pattern.

Then, as the vessel approached the English Channel during the NEW HORIZON‘s blackout period, a three-hour AIS transmission gap opened up, beginning at 01:44 on June 8 and closing at 04:50. The vessel’s speed before and after the gap was consistent, and there was no navigational explanation for the blackout. The timing fell squarely within the nocturnal ASDO window.

Vessel 3: A Slow Down in Daylight

The third candidate illustrates the importance of applying the full indicator set rather than stopping at any single signal.

This vessel had departed a Brazilian port and entered the NEW HORIZON‘s operational zone on the morning of June 7. Two hours after arriving in the zone, it executed a sharp speed reduction, dropping from 10 knots to 1.5 knots for fifteen minutes, roughly twelve nautical miles from the centre of the daughter vessel’s operating area.

Spatially, this is compelling. Behaviourally, it is suspicious. However, it happened at 09:00 in the morning. ASDOs, as a matter of operational practice, do not happen in daylight. The risk of visual detection from passing vessels, from aerial assets, and from the sheer visibility of a fishing boat manoeuvring around floating packages in broad daylight is prohibitive.

This vessel remained on the high-risk shortlist, but with a clear intelligence caveat, as the daylight timing degrades confidence relative to the other two profiles. It is not eliminated. The ASDO methodology is evolving, and exceptions to the nocturnal norm have been observed. Yet, it sits at a lower confidence tier than vessels whose behaviour aligned with the hours of darkness.

What This Methodology Makes Possible

The three profiles above were produced from a single case, but the analytical framework behind them is designed to be replicable. Any ASDO case in a corridor where reliable AIS data exists can be approached the same way by reconstructing the daughter vessel’s timeline, defining the analytical window, building the candidate list through sequential filtering, and assessing each candidate against the behavioural indicator set.

Several features of this approach are worth drawing out explicitly, because they represent the difference between this methodology and a simple vessel-tracking query.

1. Historical Depth Matters

A single-voyage anomaly carries limited analytical weight. The vessel with repeated West African drifting signatures became a high-confidence candidate not because of what it did in the Channel in June 2026, but because of what it had done in September 2025 and April 2026. Historical AIS baselines, years of voyage data rather than a live feed, transform a suspicious event into a demonstrable pattern. This is not available from real-time tracking platforms alone.

2. The Nocturnal Filter is a Genuine Discriminant

Applying time-of-day as a modifier on the risk assessment provides important operational context for distinguishing higher-confidence candidates from lower-confidence ones. The third vessel in this case illustrates the point. It failed the nocturnal test, and that failure meaningfully differentiated it from the other two high-risk profiles.

3. Convergence, Not Single Indicators 

The most dangerous analytical error in this type of work is treating any single indicator as sufficient. Origin port alone produces too many false positives. AIS gaps alone produce too many technical-fault explanations. The power comes from the simultaneous presence of multiple indicators, such as spatial alignment, temporal alignment, behavioural anomaly, and historical context, pointing in the same direction at the same time.

4. The Framework Scales

The English Channel is one of the highest-traffic maritime corridors in the world. If the methodology works here, narrowing hundreds of transits to a shortlist of three high-confidence profiles, it works in corridors with lower traffic volumes too. The same analytical logic applies to the West African coast, the Caribbean, and in the approaches to the Iberian Peninsula, wherever a daughter vessel’s AIS record can be reconstructed.

The Ship That Never Stopped

The NEW HORIZON‘s crew collected their payload from the sea and sailed home. The vessel that dropped it continued to its declared European port, discharged its legitimate cargo, and, if it follows the pattern of similar cases, set out again on the same route within days.

From the outside, nothing happened. A commercial vessel transited the English Channel. That, on its own, is unremarkable. 

But the data says otherwise. The data shows a vessel arriving from a known export hub. It shows a three-hour transmission gap precisely timed to the nocturnal window. It shows a pattern of behaviour that has now repeated three times on three consecutive voyages. The data shows that something happened in the English Channel on the morning of June 8, 2026, and it shows, with reasonable analytical confidence, which class of vessel was responsible.

Maritime drug trafficking leaves a trace. Not in the cargo manifests, not in the port calls, not in the customs declarations. It leaves a trace in the physics of movement through the water, recorded 24 hours a day by the AIS infrastructure that covers the world’s major shipping lanes. The analytical challenge is knowing how to read it.

Mission-Ready Intelligence, at Your Service

Detecting patterns like these requires more than static monitoring. Windward’s MIOC integrates multi-sensor intelligence with Agentic AI to detect, collect, and analyze threats in real time. To discuss ongoing intelligence coverage or ad-hoc forensic deep dives tailored to your operational theater, get in touch with us.