Major Anomaly Detected! GPS Jamming off Sudan’s Coast

Suspicious incidents happening recently in Sudan, which were first flagged as a spike in slow-speed activity off the coast of Sudan but turned out to be GPS jamming, emphasize the importance of early detection and staying attuned to evolving geopolitical alliances. 

The slow-speed activity increase did not actually indicate the presence of vessels in the area, but rather human intervention from third–party radio frequency (RF) interference (or “GPS jamming”). This became apparent due to artificial vessel patterns and clustering that was detected, and it makes sense in the context of the region’s geopolitics.  

Events in the maritime ecosystem are sometimes not as they originally appear, as this report will demonstrate. 

Windward’s Early Detection Model – which provides near real-time alerts on anomalies and trend shifts, either globally or within predefined areas – flagged a major increase in slow-speed activity off the coast of Sudan during the week starting on August 18. There was a 270% rise there, compared to the weekly average in 2024.

The near real-time alerts on anomalies and trend shifts from the Early Detection Model may indicate geopolitical events, and/or military or paramilitary operations that can affect national security and global trade.

The Early Detection Model flags two types of anomalies:

• Local: spikes that are indicative of a “sudden change”  that may reflect military exercises, extreme weather, and other events contained to a specific region
• Global: gradual process changes, often in multiple geographies, likely indicative of a new global trend, such as a new trade route 

Windward’s Maritime AI™ platform aggregates activities over time (based on over a decade of behavioral and historical data) to automatically flag anomalies as they occur. The model creates millions of time-series vectors, each representing a meaningful real-world phenomenon and its evolution over time. In other words, each time series indicates a “normal” baseline for behavior in a specific area, vessel population, season, and other metrics.

The machine learning model forecasts expected values within a specific “normal” range based on these millions of baselines. If a value falls outside of the prediction interval, the system automatically flags it as an anomaly, prompting an analyst to investigate further.

Public sources have been reporting a growing increase in military collaboration between Iran and Sudan over the past few months, with Iranian forces training the Sudanese army and hoping to build a naval base. Given these geopolitical circumstances, Windward’s analysts launched an investigation into the anomaly using Windward’s platform.

An examination of the area revealed that the increase was not rooted in the actual presence of vessels in the area, but rather in human intervention from third–party radio frequency (RF) interference (or “GPS jamming”) – probably originating from a station on the coast. 

A normal distribution of vessels engaged in slow-speed activities in the area usually appears more sporadically and randomly (see image 2 below). But all vessels that were flagged for slow-speed activities in the area since August 11, 2024, were condensed into three main areas, displaying uncharacteristic and artificial patterns, which were clearly computer-generated (please refer to image 3).

Windward’s analysts used a satellite imagery overlay to verify the absence of actual vessels in the area. The satellite images confirm that no vessels were actually in the area where GPS jamming is suspected, strengthening the suspicion of human intervention (image 4 below).

Windward’s Sequence Search capability shows that over the past year, 43 cargo vessels sailed from Yemen to Sudan (calling port in Sudan after calling port in Yemen), with a significant increase between July and August 2024:

Four vessels conducted over 91 slow-speed activities in May alone, all near the Port of Sudan. The data shows that over 80% of the slow-speed activities were conducted by two out of the four vessels, one of which started operating in Sudan only in May 2024, after its ownership was changed on May 24, 2024, to a Turkish company and its subsidiary, a Liberian-based company. 

In the relevant geographical and circumstantial context, extended periods of slow-speed activities are usually indicators of illicit activities, such as dark ship-to-ship (STS) meetings (where one or both vessels are not transmitting their AIS signals).

An example from May 2024 shows that one of the two vessels mentioned above, which arrived in Sudan after calling port in Yemen, conducted a long slow-speed activity in Sudan. Optical satellite imagery shows that during this period of slow-speed sailing, on May 15, 2024, the vessel was engaged in a dark STS meeting with what appears to be a non-emitting service vessel (image 8 below). Windward’s Sequence Search capability shows that the vessel traveled from Yemen to Sudan a total of 10 times in just the past year.

Windward’s Early Detection Model automatically identifies and flags anomalies in real-time, saving analysts valuable time they usually spend on manual queries. Aside from being time-consuming, analysts can only identify and run a limited number of queries on issues they know to be of interest. Automatic anomaly detection directs analysts’ attention to the questions they do not yet know to ask, and the leads they most urgently need to explore.

The anomaly of slow-speed activity off the coast of Sudan, and the investigation that followed, revealed a case of deliberate third–party RF interference and increased suspicious activity in a notorious area of interest – displaying a level of GPS jamming that has never been seen there before.

Windward’s data does not show any current impact on trade flows in the region, but our analysts will continue to monitor the area to ensure nothing is missed. Our Early Detection Model will flag any additional anomalies as they emerge.