How Smuggling Networks Use the Same Tactics as Sanctions Evaders

At a Glance

• A vessel moving narcotics and a vessel moving sanctioned crude face the same problem, which is moving without being identified, and they solve it the same way.
• Prolonged dark activity, ship-to-ship transfers, fraudulent flags, and identity changes appear in both threat profiles because the technique is cargo-agnostic.
• One Mali-flagged cargo vessel went dark for more than three weeks off Libya after a reflag to a registry the IMO has been told is being fraudulently broadcast.
• A vessel that disappeared for nine days, made a two-hour call at a private wharf, and went dark again had never called at that country in a 632-port-call history.
• The behavioral layer does not distinguish between mission sets, which means the intelligence that finds one finds the other.

The Problem Is the Same, So the Playbook Is the Same

A vessel carrying crude loaded at a sanctioned terminal and a vessel carrying cocaine loaded off a Colombian beach are solving an identical problem. Both need to move cargo across international waters and into a port without the voyage being reconstructed afterward.

The techniques that solve that problem are not commodity-specific.

Going dark at the point where the record would matter. Transferring cargo at sea so the vessel entering the controlled port is not the vessel that loaded it. Changing flag, name, and MMSI so the history does not follow the hull. Declaring an origin that is not where the cargo actually came from.

One Windward counter-narcotics assessment described a vessel as a textbook case of exploiting phantom registries, deliberate AIS manipulation, and corporate opacity to move illicit cargo across continents while evading detection. Every element of that sentence would be equally at home in a sanctions evasion report. The only thing that differed was what was in the hold.

The compliance community and the enforcement community have historically treated these as separate problems with separate tooling. At the vessel behavior layer, they are one problem.

Dark Activity Says Where, Not Why

An AIS gap does not explain itself. It tells you a vessel stopped transmitting, at a particular place, for a particular duration, and then resumed.

For a sanctions analyst, a vessel going dark near a designated terminal reads as an attempt to obscure a port call. For a counter-narcotics officer, a vessel going dark in open water at a known transfer area reads as an attempt to obscure a meeting. The signature is identical. A gap in the record at a location and time consistent with illicit activity, bracketed by normal transmission either side.

Windward tracked a Mali-flagged general cargo vessel that left its Albanian base port in late August 2026 declaring Egypt as its destination, switched off AIS in open water off eastern Libya, and stayed dark for more than three weeks. It reappeared almost exactly where it had gone dark, immediately changed its declared destination back to Albania, and sailed straight home.

Two details make the gap meaningful rather than ambiguous. The vessel reported normally right up to the switch-off and again immediately after reappearing, which makes a coverage failure unlikely. And it was the only vessel in the surrounding area to go dark during that period.

A second case shows the same shape with a shorter clock. A vessel went dark for nine days, surfaced inside a bay for a two-hour call at a private wharf, and went dark again shortly after departure. The call was its first ever in that country across a 632-port-call history. Acting on that assessment, a coast guard boarded the vessel on its return leg and found empty cartons aboard, consistent with cargo already discharged.

Neither case was resolved by reading the AIS record. Both were resolved by reading what the AIS record was missing, against what the vessel had done before.

Transfers at Sea Serve Both Missions

Ship-to-ship transfer is the single most transferable technique between the two threat profiles.

Sanctioned operators use it to break the link between cargo and origin. Crude loads at a designated terminal, moves at sea to a vessel with a clean profile, and arrives at a legitimate port with documentation describing a different voyage.

Trafficking networks use it for the same structural reason. Contraband moves from a vessel that cannot safely enter a controlled port to one that can, or from a mothership to a small craft that never appears in any commercial record at all.

The behavior is detectable in imagery regardless of AIS status. Two hulls alongside are visible in EO and SAR whether or not either is transmitting, and draft changes consistent with a transfer are visible even when no AIS record of the event exists.

The limits are worth stating honestly: A high-speed craft operating at up to 40 knots can be outside the frame by the time imagery is processed and delivered, which is why detection at the mothership end of the chain is more tractable than at the receiving end.

The analytical value sits in identifying the vessel that is positioned to make the transfer, not in catching the transfer itself.

Identity Changes Exist to Break the History

Flag-hopping, MMSI changes, and renaming all serve one purpose across both threat profiles. They prevent a vessel’s record from following it.

A hull with a documented pattern of illicit behavior reflags, renames, and reappears as a nominally clean entity. Screened on what it declares, each incarnation looks unremarkable. Screened against ownership networks and multi-year behavioral history, the underlying identity remains traceable.

The flag itself is increasingly the tell. The Mali-flagged vessel above had reflagged in June 2026 following a renaming and a series of identity changes. Mali has informed the IMO that vessels are fraudulently broadcasting its flag, which means the registration cannot be read as a flag state providing oversight. The vessel did not acquire a regulator. It acquired the appearance of one.

That is as relevant to a customs officer deciding whether to inspect a vessel before it berths as it is to a compliance analyst screening a counterparty.

Evasion Does Not Always Mean Going Dark

One case is worth including because it breaks the pattern the other examples establish.

A general cargo vessel ran three consecutive voyages from Colombia to Turkey across eleven months. On each transit, it made a short stop off a stretch of Colombian coastline associated with small-craft interdictions, then roughly two weeks later slowed to under three knots on the Atlantic approach to Gibraltar before continuing into the Mediterranean toward its declared destination.

AIS transmitted continuously throughout. No dark periods, no identity changes, no recorded meetings.

The anomaly is not in what was hidden. It is in a slowdown with no operational purpose, repeated three times, in a location where none of nine comparable vessels slowed, on voyages that were never bound for a port near the strait.

A screening model looking for concealment would return nothing here. A model assessing behavior against peer vessels and the vessel’s own history returns a question worth asking.

One Architecture, Two Mission Sets

Customs enforcement and sanctions compliance operate from different data systems, different alert triggers, and different evidentiary standards. The vessel behavior layer recognizes none of those distinctions.

In the Caribbean, a multi-agency operation using Windward’s platform and agentic capabilities contributed to the disruption of a transnational smuggling network and the seizure of $54.5 million in illicit assets. The same behavioral models, satellite fusion, and ownership resolution underpin sanctions screening for commercial compliance teams.

The practical question splits by where an agency is starting from.

Agencies already using maritime intelligence for sanctions work should be asking whether their current tooling surfaces what they need for interdiction, because the behaviors overlap but the alerting usually does not.

Agencies approaching maritime intelligence as a customs or counter-narcotics tool should understand that the architecture for finding the smuggling vessel is the same architecture for finding the sanctions evader. Buying one and then discovering you needed the other is a common sequence, and an avoidable one.

Written by Maya Romi, Windward Senior Content Manager.