The journey before the bust

On August 8th, Spanish joint forces of police and customs intercepted the general cargo ship NATALIA on suspicion of narcotics trafficking. The ship was en route from Lebanon via Iskenderun, Turkey to Lagos, Nigeria. Hidden on board was nearly 20 tons of hashish. We alerted our EU partners of this vessel’s behavior and high-risk patterns. Effectively, authorities caught the vessel the following day. In this blog, I’ll explain how we helped our customers identify and track the NATALIA weeks before the $470 million drug bust.

The tell

A month ago, after six years of operating under the Togo flag, NATALIA changed its flag to Palau. According to the Paris MOU, Togo and Palau are both high-risk flags. On August 4th, the vessel left the Mediterranean, passing via the Strait of Gibraltar for the first time. A recent flag change preceding an anomalous voyage is a significant red flag. Before this journey, the vessel had only ever operated in Syria. 

We notified officials of the deviation and that it was heading towards Las Palmas. In effect, customs later detained the vessel approximately 40 nm south of Fuerteventura island, Canaries. 

Before the drug bust

In addition to the flag change and pattern of deviation, our risk models detected anomalous loitering. On August 1st, the NATALIA sailed at an unusually low speed of 1 kn, offshore Algeria – a behavior consistent with drug operations in which vessels sail at slow speeds to onboard illicit goods. Interestingly, it was only on August 1st that the vessel became known as the NATALIA. That same day, the vessel had a name change from LADY LARA to NATALIA.

Name changes are not inherently risky, especially if they occur alongside a flag change or at port. However, a name change mid-voyage, mid-sea is suspicious. The ownership structure of the NATALIA was also very concerning. The commercial manager is GMZ ship management, a Lebanese company with a history of safety issues and a fleet of 17 high-risk vessels. In our system, the company has a high border security risk due to the corresponding behavior of its risky fleet. The high-risk vessels operate under Paris MOU blacklisted flags, show dark activity events, and instances of uneconomic behavior. 

In addition, the beneficial owner of NATALIA, Lara Shipping Maritime Sa, is also listed in our system as high-risk. Lara only has three vessels – two of which are high-risk, including NATALIA. The other high-risk vessel, the SAFIA, also has a blacklisted flag, and operated in the same region as NATALIA prior to the anomalous journey. Due to these risk factors, NATALIA was high-risk in our system far before the day of the drug bust. Our partners were able to act on this data to intercept the vessel and confiscate the drugs onboard. 

Taking action

Anomaly detection, powered by AI, is crucial to staying ahead of evolving threats. In this case, if only the current journey was monitored, without historical behavioral data, NATALIA might not have caused alarm for authorities. In the graph below, the orange line represents Windward’s risk threshold. The NATALIA has shown consistently high risk levels since 2018 – but in July, risk levels spiked.

Windward evaluates each vessel in context to its previous patterns and behaviors to detect when suspicious events emerge in real-time. The same goes for drifting events. Our proprietary models know how to evaluate a vessel in relation to the location and speed to distinguish legitimate behavior vs. one likely associated with drug smuggling operations. 

In addition, because we can link vessels through ownership data, we provide actionable insights to support network analysis. Get in touch with our team to learn more about how we help our partners enhance maritime domain awareness and streamline global risk operations.