High Sea Russian Oil Transfers: Smuggling Methods

The recent news that a Chinese merchant paid north of $375 million for 13 tanker ships able to engage in ship-to-ship (STS) transfers of Russian crude oil in the mid-Atlantic made waves in the maritime ecosystem. 

“The fleet, which shows no signs of breaching any sanctions, demonstrates how Moscow’s war on Ukraine has led to a new, furtive oil market that operates beyond the scope of traditional trade routes,” notes Markets Insider.  

There is definitely a shadow market, but more than just these 13 vessels have been recently involved – Windward has identified over 20 vessels engaged in deceptive shipping practices (DSPs) over the past few months. And STS transfers are just one of several smuggling methods being deployed globally. 

This report will uncover the larger picture by briefly highlighting four main operation patterns recently flagged by Windward’s Maritime AI^TM platform as suspicious and likely to be involved in trade with Russia. It includes the behavioral typology of a vessel carrying crude oil from Russia, plus another ship carrying the crude to its final destination. The report also covers advanced deceptive shipping practices (DSPs), such as the usage of potential ID and location tampering that enable vessels to obscure their locations. 

A Shift in Russian Oil Deceptive Shipping Practices?

Generally speaking, the disablement of automatic identification systems (AIS) is easy to detect and sometimes less appealing than other concealment methods. Bad actors do not want to risk harming their commercial reputation, losing insurance coverage, and/or being involved in accidents. Unsurprisingly, though, the beginning of Russia’s invasion of Ukraine saw a spike in dark activities and ownership changes, as some Russian entities worked quickly to get around incoming sanctions. 

Dark activity committed by Russian-affiliated vessels has returned to normal in the past two months, compared to the peak at the beginning of the war, with one notable exception. The number of oil tankers engaging in dark activity in the mid-North Atlantic Ocean has jumped substantially during the past two months. This indicates that despite some illegal activities targeting dry cargo, maintaining the flow of crude oil exports is important for keeping the Russian economy afloat.  

Why the Mid-North Atlantic?

Why has the usually quiet and unremarkable mid-North Atlantic suddenly become a focal point of suspicious activity? Part of the appeal is that it falls outside European maritime jurisdiction and is the closest point between Europe and the Malacca Strait when sailing westward. A significant percentage of oil transported by sea passes through the strait and some countries in Northeast Asia, including China, rely on oil imports arriving via Malacca. 

The mid-North Atlantic is also accessible via major waterways, such as the Suez Canal and Gibraltar Strait (see more about them below in the “Checkpoint Avoidance” section). After passing through these regulated checkpoints, vessels engaging in illicit activities can return via the Cape of Good Hope to avoid maritime checkpoints. Lastly, the mid-North Atlantic route was successfully used in the past to export Venezuelan sanctioned crude oil. 

How does this rendezvous point work?

The Main Operation Patterns 

1. Aimless Journeys and STS Operations  

Most commercial journeys usually involve a vessel going from port A to port B. An “aimless journey” occurs when a vessel goes from port A…to port A. If a ship sets out fully loaded and then returns empty to the same port, suspicions are raised. All the more so when it becomes apparent that STS activity was conducted far from shore. 

Windward’s AI-driven technology identified a pattern of tanker vessels that arrive from Russia (Ust-Luga/Primorsk in Baltic Sea) to the mid-north Atlantic Ocean, and then engage in dark activity for more than a day, or conduct a STS with other tankers, before heading back to Russia after a significant draft change. Significant draft changes usually signify either the loading or unloading of wet cargo for tankers. We identified multiple STS meetings and dark activities in the past couple of months carried out by these vessels. 

For example, three tanker vessels recently exhibited aimless journey characteristics in two separate incidents. All three engaged in seemingly illogical sailing patterns and draft changes, which is often a sign of tankers onboarding or offloading sanctioned crude oil.  

Emily S (IMO 9321847) sailed from the Ust-Luga to the mid-Atlantic. It called port at Ust-Luga on June 4, 2002, changing its draft from 7.9m to 14.7m, suggesting that it picked up a substantial amount of cargo. The vessel departed and engaged in dark activity for five days near the coast of Spain. A few days after ending the dark activity, it changed its draft to 8.7m on June 22, suggesting it had offloaded wet cargo and was substantially lighter, and returned to Ust-Luga on June 30.

Image 2: Emily S journey path between the Mid-North Atlantic and Russia

The second example features the Zhen I (IMO 9255880) and Lauren II (IMO 9258521), which are also crude oil tankers. Zhen 1 sails under the Palau flag, Lauren II under Panama’s. They had a ship-to-ship (STS) operation in the North Atlantic Ocean on May 26, 2022 for 32 hours. Zhen I came from Primorsk, Russia – there was a port call on May 13 and a draft change from 9.5m to 14.5m, suggesting wet cargo had been added. Lauren II sailed from South-East Asia. After the meeting, Zhen I changed its draft from 14.5m to 9m, and Lauren II changed its draft from 11.5m to 13.6m ten days after the meeting. The vessels’ behavior strongly indicates that wet cargo, possibly Russian crude oil, was passed from Zhen to Lauren II. 

Image 3: Meeting between Lauren II and Zhen 1 in the mid-Atlantic on May 26, 2022

2. Checkpoint Avoidance 

At least three tankers arrived from Asia, mainly China, via the Malacca strait, Arabian Sea, Suez Canal and Gibraltar Strait, all the way to the mid-Atlantic Ocean. There, they engaged in dark activities, changed drafts and returned to East Asia from the South, passing near South Africa and the Indian Ocean. 

As briefly explained in the Why the mid-Atlantic? section of this report, the Suez and Gibraltar are well-regulated, major checkpoints. There is no issue to pass through them at the beginning of a journey…but if tankers take a much longer route back to their starting point, around the Cape of Good Hope for no obvious reason (a longer journey is certainly more expensive), it seems likely that they wished to avoid checkpoints at which their cargo might be examined. 

Monica S (IMO 9292163) for example, is a crude oil tanker flying the Panama flag, that conducted six dark activities in the secluded areas between Morocco, Cape Verde and the Azores just in the last month, followed by significant draft changes. Its behavioral patterns also show a clear indication of trying to avoid the Suez and Gibraltar checkpoints through the Cape of Good Hope.

Image 4: Monica S. going around the Cape of Good Hope

3. Floating Storage

Some vessels – we have found four in this category – have been recently flagged by Windward’s AI-powered platform for serving as “floating storage” in the middle of the ocean and helping exchange fuel between different tankers. While some of the vessels arrive from Asia, it is not clear where their final destination is, as they continue to drift in the mid-North Atlantic area.

For example, Crystal Rose (IMO 9292228), a crude oil tanker flying Panama’s flag, has been drifting in the mid-Atlantic since early June, engaging in several suspicious behaviors, such as dark activities, course deviations, and drifting close to other ships. There is no commercial explanation for a tanker of this size to be drifting “idly” for over two months. Its draft often changed several times in the same day, from 11m all the way up to 20.5m. This tanker is likely holding oil for one tanker, until a second tanker can come and pick it up, in an attempt to obscure the path of the sanctioned oil. There are big swells in the middle of the Atlantic, this is not a reasonable place to wait or drift. 

Image 5: Crystal Rose drifting for a little over two months in the same spot in the Mid-North Atlantic

4. ID and Location Tampering

“Technology to hide a ship’s location previously available only to the world’s militaries is spreading fast through the global maritime industry as governments from Iran to Venezuela — and the rogue shipping companies they depend on to move their petroleum products — look for stealthier ways to circumvent US sanctions,” according to the Associated Press. 

A recent example was detected by Windward’s AI-driven technology. Tanker J turned off its AIS transmitter after passing the Gibraltar Strait (see “Checkpoint Avoidance” above) and turned it on after five days, supposedly reappearing near the Malacca Strait. Covering that distance in five days is not possible, this is an example of ID and location tampering. The owners of this vessel are also linked to Skadi, a tanker known to have been carrying Russian crude oil and then going dark in June. 

The Ability to Adapt is Critical 

The mid-2010s through the beginning of the 2020s has seen an evolution in deceptive shipping practices. At first there were mostly identity changes via flags/names/ownership, then bad actors began engaging in dark activity and identity manipulation via transmitting invalid IMOs. The dawn of the 2020s and the introduction of OFAC’s deceptive shipping practices advisory brought flag hopping and location tampering – transmitting fake GPS locations. 

Russia’s invasion of Ukraine has clearly had a huge impact on the maritime ecosystem (and the world). Russia possesses the fourth largest coastline in the world and has access to 12 seas and three oceans, with large amounts of commodities moving through the area. Long-term strategic planning, however, requires thinking beyond this conflict. 
Organizations in the maritime ecosystem would be wise to adopt a platform that is dynamic and can quickly add the latest risks. An analysis and insights platform that proactively sends alerts, or enables searches for specific points of interest. Artificial intelligence by itself is not sufficient, it must be shaped and guided by maritime experts with decades of experience in tracking deceptive shipping practices.  

Don’t Wait for New Patterns to Emerge