The war in Ukraine and resulting international sanctions affected Russia sufficiently that it had to change its primary economic policies. The Russian economy transitioned from a peacetime to a wartime economy, and, as a result, Russia’s third quarter 2023 had a 5.5 percent gross domestic product (GDP) increase. An important component of this economic rebound is oil and gas revenues. Sanction loopholes, coupled with Russian resourcefulness, have helped the nation circumvent international law and maintain economic growth. Russia has continued to export oil with minimal hindrance, and that income is being funneled into the military-industrial complex to pay for the conflict in Ukraine.
Russia has rerouted oil flows to nations such as China and India, and that oil ultimately reaches Western countries after being refined. With the Urals price exceeding the $60 price cap since 11 July 2023, there is an increased need to evaluate sanctions compliance.
Western media has reported on a so-called shadow fleet responsible for a series of shady operations at sea and able to move sanctioned oil. Ship-to-ship (STS) transfers remain a significant aspect of Russian oil smuggling in line with other state-led operations. See Figure 1.
Tanker operators can conceal the origin of the oil on board and avoid inspection or sanctions compliance by performing open-sea oil transshipments. As a result, there is no accountability, for instance, in case of environmental disaster. These are typical maneuvers, already identified in the past as red flags. Where there is a will, there is a way, and where there is a (sea) way, there are Russians. Several sheltered locations in international waters have been identified as shallow waters where it is possible for Russian oil to be safely transferred to other vessels: Ceuta (near Spain), Hurd’s Bank (near Malta), and the Laconian Gulf (near Greece)1 are the main sea-transshipments hubs in the Mediterranean Sea, although there are several other sites around the Med and the Eastern Hemisphere (Figure 2).2 The evasion of sanctions through illicit STS transfers has also been documented in Venezuela, Iran, and North Korea.
There are specific challenges for the Russian operations, however, mainly driven by the fact that Russia is still geographically, economically, and politically closer to the West—i.e., to the European Union, United States, and Canada in the Arctic. These challenges demand new tactics conceived for sanctions evasion.
Sanctions on Russian oil export target the offending vessels’ insurance status, among other measures, since all tankers must carry protection and indemnity (P&I) insurance—which includes oil-spill liability coverage—to access Western ports.3 Any vessel suspected of violating sanctions is not eligible for P&I insurance and/or risks losing it, thus cutting them out from the legitimate international oil market.
To circumvent these challenges, some ship owners and oil traders have ‘conspired’ in so-called price-cap fraud: In agreement with oil brokers, ship managers of Western insured, owned, or operated tankers might declare a price compliant with the G7-imposed $60 per barrel (p/b) price cap, when in actuality the price paid is above the threshold.
The MARINE Methodology
The authors have designed a “Methodology for Analyzing Russian oil Naval Exchanges” (MARINE) tailored for tackling the Russian smuggling operations at sea and used to produce the findings reported here. Analysis of Russian port calls allowed the researchers to identify and reconstruct the activities of several suspect vessels in the 2022–23 timeframe. The findings were coupled with Automatic Identification System (AIS) data, satellite imagery, and imagery analysis. Independent findings of specific STS locations were confirmed and new spoofing cases identified.
MARINE is a comprehensive approach that ensures a thorough examination of potential illegal maritime activities, ultimately leading to the confirmation of illicit behaviors and contributing to enhanced maritime security and regulatory enforcement. The methodology is composed of the following steps (see Figure 3):
- Monitor both real-time and historical AIS data to find anomalies such as loitering, parallel sailing, anomalous movements, unexpected anchoring, sudden changes in direction, geometrical sea routes, and any other irregularity indicating potential illicit activities (such as draught changes mid-journey).
- Check for any identification deception tactics (IDTs), such as AIS spoofing. IDTs are divided by the authors into physical, electromagnetic, and bureaucratic.
- Identify the vessels involved in suspicious behaviors.
- Complete a crosschecking analysis on the vessels’ identity, insurance, ownership, and legal standing.
- Assess oil prices to determine possible instances of sanction violations by examining fluctuations in prices before loading time.
- If possible, confirm the suspected STS operations with satellite acquisitions. Both optical and synthetic aperture radar (SAR) acquisitions are used to confirm the identified suspicious activities.
- Blacklist the vessels after third-party check and validation.
- Repeat this process for other ships identified as potential targets.
This methodology is an elaboration of a similar list of best practices developed by the U.S. Treasury’s Office of Foreign Asset Control (OFAC) in 2020.
Different categories of operations were identified through close monitoring of different vessels involved in STS transfers.
- AIS-tracked conventional STS transfers covered the cases in which AIS remained operational.
- Conventional routes with brief AIS deactivation encompassed different situations in which vessels, following a regular course, conducted an STS transfer with a brief deactivation of AIS in proximity of the event.4
- Conventional routes with prolonged AIS deactivation applied to vessels that possibly interrupted AIS transmission for an extended period during which one or multiple STS transfers could have occurred.5
- Extended routes to avoid maritime chokepoints identified cases in which vessels chose longer paths to bypass strategic maritime bottlenecks, such as Gibraltar, the Red Sea, or the Suez Canal.
- The presence of floating oil hubs referred to instances of large tankers lingering in specific locations without apparent commercial justification, potentially serving as temporary oil reservoirs to obscure the path and origin of sanctioned oil.6
- A combination of the above scenarios with advanced IDTs yielded varied combinations of the previous categories, coupled with IDTs to conceal the true nature of STS transfers.
Laconian Gulf: Paradise of Oil Transshipments
In January 2024, several tankers convened in international waters in the Laconian Gulf, around seven kilometers outside Greek territorial waters, to conduct possible STS transfers.7 The case shows a remarkable example of STS following a specific tanker, the Ligera.8
The Ligera is a 332-meter long and 58-meter wide very large crude carrier flagged in Djibouti. She sailed from Shanhou Chujia, China, on 25 September 2023 and remained stationary off the Malaysian coasts for more than 50 days, presumably waiting for orders. See Figure 4.9
The Ligera then transited the Red Sea to arrive in the Laconian Gulf on 9 January 2024. Details of her route reveal many anomalies, such as loitering activity, in this location and in open-sea waters (steps 1, 2 and 3 of MARINE).
Examination of maritime registries and company records reveals interesting outlines (step 4 of MARINE) and a complex pattern of flag registration, ownership, and ship management. For instance, the Ligera has changed names four times since she was built in 2002, and, at the time of the event, was still covered by the West of England Shipowners P&I association for oil-spill liability. The Ligera’s registered owner and ship management appears to be a single-vessel shell company registered in a likely fictitious hotel in the Seychelles Islands.10 This profile is close to what is usually associated with the so-called shadow-fleet: aging ships with murky ownership and managing structures used to circumvent sanctions. The Ligera is part of the gray fleet according to the authors’ classification.
The AIS data reveal that the Ligera possibly met with the Palau-flagged tanker Nautilus on 10 January 2024 at approximately 10:00 UTC in the area of 36.5507°N, 22.7028°E. Possibly loaded with crude oil, the Nautilus set sail from Ust-Luga on the Gulf of Finland on 20 December 2023 and reached this location on 7 January 2024 at approximately 22:02 UTC.11 Here, the tanker loitered near the Ligera for two days, as confirmed by SAR satellite imagery.12 See Figure 5.
The Nautilus is a crude oil tanker built in 2010, is 243 meters long and 42 meters wide. The vessel currently lacks any P&I insurance and is managed by a firm that also handles four other aging tankers, all of which were acquired after the imposition of sanctions. The registered address for this company can also be found in the Pandora Papers.13 According to the authors’ classification, this vessel belongs to the gray fleet.
The Nautilus left the Ust-Luga oil terminal on 20 December 2023.14 Yet, she started loading oil two days earlier. It is nearly impossible to evaluate the cost of the transported oil, as the price paid is accessible only to traders and brokers.15 Given that trading and transaction procedures usually take around two weeks, it is possible the Nautilus acquired the oil toward the end of November. During this time, the Urals blend market experienced prices above the cap, with trades happening at $61 to $65 per barrel (step 5 of MARINE). Moreover, Baltic ports and Ust-Luga exports confirm their growing export trend.
Satellite imagery from Sentinel-1 seems to confirm an STS event between the Ligera and the Nautilus on 11 January 2024. A measurement of the width indicates there are two vessels side by side, approximately 100 meters wide. The combined width of the Ligera and the Nautilus, which measure 58 and 42 meters, respectively, seems to be confirmed (step 6 of MARINE). See Figure 5.
It seems the Ligera encountered another tanker, then-called the Julia A, on 29 January 2024 (step 7 of MARINE).16 This 274-meter crude oil tanker, built in 2003, departed from Novorossiysk on the Black Sea on 10 January 2024 and reached the Laconian Gulf on the 27 January. When back in Novorossiysk, the vessel also possibly spoofed her position at Gelendzhik Airport, Russia. See Figure 6. This airport has a history of mass-spoofing occurrences, including the 2017 incident with the oil tanker Atria and nearly two dozen other vessels. Acts of ‘mass spoofing’ at this airport and near Simferopol International Airport in Crimea occurred again in early June 2024.
On the Julia A’s arrival in the Laconian Gulf, she was observed lingering near the Ligera.18 Possible route anomalies, such as loitering, can be detected from the analysis of the data. See Figure 7.
The Julia A, then Liberia-flagged, has changed names six times since 2003.19 At the time of the event, the vessel was insured with P&I under the American Steamship Owner P&I association. After the Lloyd’s List article, the vessel not only lost its insurance, but it also changed name (to the Blue) and flag (to Antigua and Barbuda) on 2 February 2024—while at sea.20 Moreover, the Greek company previously associated with the tanker ceased to operate at around this time. Most important, on 28 December 2023, the Istanbul Port authorities conducted a thorough investigation of the Julia A and discovered that the mandatory oil record book, used to track all financial transactions related to Russian oil, was not accurately completed.21 The now-named Blue then sailed back to Ust-Luga, where she arrived on 20 February 2024.22
Satellite acquisitions show an STS involving the two tankers between 29 and 30 January 2024. Analysis of the vessels’ color and length and width measurements, combined with AIS data, seem to confirm the identity of the Ligera and the Julia A. See Figure 7.
After these STS transshipments, the Ligera finally reached Venezuela on 24 February 2024, according to AIS data and satellite imagery.23
Ceuta: A Sunny Hub in the West Mediterranean Sea
Back in 2022, a significant case occurred in the international waters off Ceuta, as reported by Tradewinds. The crude oil tanker Emily S, built in 2006 and not insured with P&I, is owned and managed by Chinese companies.24 The ship is noteworthy for a unique gap in her AIS transmission history. By analyzing her route and combining it with satellite imagery, it is possibly to identify a potential STS transfer that occurred in the international waters near Ceuta, approximately 25 kilometers outside of Spanish and Moroccan territorial waters.25
In December 2022, the Emily S navigated from the Primorsk oil terminal, near St. Petersburg, carrying crude oil with a declared destination of Ceuta Off Port Limits (OPL) and a declared draught of 15 meters.26 On 23 December 2022, the tanker stopped her AIS transmissions at 12:34 UTC, resuming the next day at 19:47 UTC.27 During this time, the vessel seemed to be dark.
Sentinel-2 satellite imagery, however, show the Emily S alongside another tanker, the Lauren II, a 2004-built Panama-flagged ship with Chinese ownership and management.28 See Figure 8. The Lauren II was insured with P&I by the West of England Shipowners. As ship-spotters’ pictures show, the Emily S is 244 meters in length with a mostly red deck, and the Lauren II is 332 meters long with a green deck. These lengths and colors match the two vessels captured by Sentinel-2 imagery. Most important, while the Emily S possibly turned off her AIS, the Lauren II did not.29
The AIS coordinates of the Lauren II at the time of the satellite acquisition coincide with the two vessels. In addition, even if the Emily S possibly went dark, when she reappeared she seems to have declared a change in draught from the previous value of 15 to 8 meters, indicating she had lightened her load—likely from a discharge of oil at sea.30
Whereas the Emily S sailed back to Primorsk, the Lauren II continued to Bayuquan, China, arriving on 3 March 2023 after avoiding all main chokepoints and circumnavigating Africa.31
Price-cap measures were implemented on 5 December 2022. However, a transition period of 45 days was allowed for vessels carrying crude oil from Russia, purchased and loaded before 5 December 2022 and unloaded at the final port of destination before 19 January 2023. If the oil belonging to the Emily S was procured prior to 5 December the transfer could have been within the bounds of the law. In that case, it's unclear why the AIS was turned off—an action prohibited by international maritime laws.
Maltese Falcons: The Hurd’s Bank
This case has not yet been revealed by other public sources, so we will consider it and other STS areas in general terms. In spring 2023, an anonymous and 20-plus years old oil-chemical tanker registered under a flag of convenience—call it Vessel A—sailed from a Russian port loaded with oil. In the same month, the vessel changed its name back to a previously used name, while maintaining the same International Maritime Organization and maritime mobile service identity numbers. According to AIS data and ship registry data, the tanker changed her name just before reaching Malta, its declared destination. The Vessel A lacks oil spill liability insurance and is owned and managed by shell companies based, for instance, in the United Arab Emirates. These IDTs, combined with the vessel’s legal standing, classify her as part of the black fleet.32
Once she arrived in international waters at Hurd’s Bank, the ship loitered for several days and was involved in a probable STS transfer. While this activity cannot be inferred from the stable draught, which remained the same both before and after the event, it can be inferred by a second nearby ship’s data. The Vessel A met up with another rusty and conveniently flagged tanker insured by a Western firm of the International Group of P&I Clubs and owned and managed by two Western-based companies. We call this ship the Vessel B. See Figure 9.
In the shallow waters of Hurd’s Bank, the Vessel A lightened its cargo by transferring oil to the Vessel B, which significantly increased its draught. Even though the Vessel A did not alter her draught—possibly intending to deceive analysts regarding her activities—the change in draught of the Vessel B suggests a transfer. Moreover, the operation seems to be confirmed by satellite imagery.
While the Vessel A sailed back to the Russian Federation, the Vessel B’s journey was to an African country, where she arrived in late spring 2023 to unload her wet cargo. Later in 2023, port authorities of a European country carried out a thorough inspection of the Vessel A. Among the numerous deficiencies they found, the oil record book was not properly completed. The Vessel A’s lack of P&I, its transfer of oil to the P&I-insured Vessel B, and the absence of a good record of her selling prices combine to raise some concerns about her activities.
A New Hub for STS?
Findings seems to suggest the existence of a previously not as well-known STS site related to Russian oil off the Constanța coastline, approximately 500 meters outside Romanian national waters.33 European sanctions prohibit registered entities in member nations from providing any technical assistance to Russian tankers, among other restrictions.34 Absent an already exposed vessel of interest, the authors prefer to focus on an iconic instance of possible malfeasance.
The so-called Vessel C is an aging ship currently involved in moving Russian oil. The tanker came from an oil terminal in Russia. The details of her route reveal several anomalies, including that she often lingers in the Black Sea, just outside Romania’s territorial waters.
The tanker is covered by a Western company for potential oil-spill liability. Moreover, the ship is owned by a single-vessel entity located within a residential building in a Middle Eastern suburb and operated by a firm overseeing seven other aged oil tankers. Consequently, this ship should be included as part of the grey fleet.
The Vessel C is believed to have loaded oil when Urals blend was traded from $63 to $66 per barrel. Satellite imagery from Sentinel-2 show a possible STS transshipment between the Vessel C and another ship—the Vessel D—that is often spotted in the same area.
According to AIS data, the draught of the Vessel C decreased, indicating she may have unloaded oil. It is possible the oil was purchased below the cap and that it met all the required standards and certifications. In that case, the transfer could have been regular—although doubts can be raised, as Urals prices have exceeded the threshold since July 2023.
This STS is shown in one of the Sentinel-2 images (see Figure 10), and it is not the only occurrence in the region, as other AIS data and satellite imagery seem to confirm.
Looking Forward
This research leads to various implications, which must be further developed. First, our primary goal is to show a pattern of Russian tanker fleet behavior that can help the Russian economy survive and even thrive in wartime. Second, four major STS hubs are identified here for further investigations and analysis, due-diligence checks, and operational awareness for maritime authorities and intelligence agencies. This is of major importance as the analysts’ work must empower the right decision-makers to act accordingly. The authors flag that these are not the only STS areas, but they were those they investigated closely.
Third, this information adds to the overall operational picture of a significant Russian operation at sea based in the Mediterranean Sea. The Mediterranean has significant geostrategic importance and geoeconomic centrality to global economic and political stability, particularly for the regional powers that are part of the NATO alliance. Having the intelligence and specific knowledge about locations where Russia is engaged in illegal oil revenues is paramount to avoiding further illicit activities and preventing potential escalation of oil smuggling—and even possibly potential military maneuvers.
One important factor is the role of “gray” STS transfers in aiding Russia to offset the economic consequences of Western sanctions. The magnitude of barrels of oil and tankers involved is significant, yet still not well studied. The MARINE approach has proven to be efficient in targeting and, notably, identifying oil transshipments related to Russia. It is a replicable and reliable methodology that proved the concept, so other analysts could use it effectively. Instead of adhering to strict instructions, the MARINE approach allows for adaptability and exploration, making it suitable for large-scale data analysis and integration with artificial intelligence for pattern recognition. Tailored to individual requirements, MARINE can serve as an effective intelligence-based and result-oriented approach.
Moreover, analyzing the behavioral patterns of oil smugglers can yield valuable insights for the maritime, regulatory, and governmental sectors. One specific example is the potential environmental threats posed by uninsured, poorly maintained tankers with inexperienced crews crossing territorial waters. The entire shadow-fleet issue is an ecological bomb ready to explode that demands reevaluation of certain aspects of global maritime regulations by policy-makers. The international geospatial intelligence (GEOINT) community stands to gain a significant advantage by analyzing oil smuggling via assets in space, bringing greater attention to the often-overlooked capabilities of GEOINT in comparison to other, more mainstream forms of intelligence gathering.
1. When the analysts were writing this report, Laconian Gulf was still a key location for Russian-oil STS transfers. Recently, there has been a decrease in the number of tankers transferring Russian oil in this location. Greek authorities devised a smart strategy to prevent these actions from happening near their territorial waters. Greek authorities have announced naval drills in May, which have been extended multiple times, forcing all vessels to leave the area. However, this behavior lasted for two years in the region.
2. Michelle Wiese Bockmann, International Waters off Gibraltar and Laconian Emerge as Post-Sanctions Russian Crude Transfer Hubs, Lloyd’s List, 5 January 2023; Matthew Farrugia, Malta Supports Sanctions Against ‘Shadow’ Tankers Moving Russian Oil, Malta Today, 30 June 2023; Russia, Sanctions, And Ship-To-Ship Scenarios, Lloyd’s List Intelligence; Windward, Q2 2023 Risk Report; and Windward, Q4 2023 Risk Report.
3. For the U.S, see U.S Department of Treasury, OFAC Guidance on Implementation of the Price Cap Policy for Crude Oil and Petroleum Products of Russian Federation Origin, 3 February 2023; for the European Union, see EU Directorate-General for Financial Stability, Financial Services and Capital Markets Union, Oil Price Cap. Related Provision: Article 3n of Council Regulation 833/2014, updated 24 January 2024.
4. Within a window of 48 hours before and after the event.
5. Within a window of 2 and 60 days before or after the event. An example of this is seen in phantom ships, i.e., vessels that vanish from one port and reappear in another with no record of their whereabouts for days or months.
6. This is the what we call the Tanker-in-the-Middle fraud.
7. Since 1936, Greece has limited its territorial waters to 6 nautical miles (instead of the standard 12) from their coast, leading to a significant number of STS transfers occurring in international waters instead of Greek waters. See Law No. 230/1936 concerning the extension of the territorial waters of the Kingdom of Greece. See also, Andreas Stergiou, The Greek-Turkish Maritime Dispute. Resisting the Future (New York: Springer, 2022).
8. All ship information available on the Equasis database.
9. All AIS data have been provided and crosschecked using Global Fishing Watch.
10. The address is Suite 23, 1st Floor, Eden Plaza, Victoria, Mahe Island, Seychelles. However, the Eden Plaza is a shopping mall and not a hotel, and is located near a luxury apartment complex named Eden Island Luxury accommodations.
11. AIS data provided by Global Fishing Watch.
12. AIS data provided by Global Fishing Watch.
13. Precisely Suite 10, 3rd Floor, La Ciotat, Mont Fleuri, Mahe Island Seychelles, a recurrent address in offshore Pandora paper-leaks and for other companies we identified.
14. AIS data provided by Global Fishing Watch.
15. Nevertheless, it is necessary to consider numerous other factors, including the amount of time it takes to load, the process of spot-chartering (i.e., finding an available ship), the duration of contract negotiations, and other administrative procedures.
16. AIS data provided by Global Fishing Watch.
17. AIS data provided by Global Fishing Watch.
18. AIS data provided by Global Fishing Watch.
19. Information available on the Equasis database.
20. Information available on the Equasis database.
21. Information available on the Equasis database.
22. AIS data provided by Global Fishing Watch.
23. AIS data provided by Global Fishing Watch. See Figure 4.
24. Information available on the Equasis database.
25. Author’s calculations. The distances vary for each STS event, which always remains outside national waters but inside nations' exclusive economic zones (EEZs).
26. Outer Port Limits; AIS data provided by Global Fishing Watch.
27. AIS data provided by Global Fishing Watch.
28. Information available on the Equasis database.
29. AIS data provided by Global Fishing Watch.
30. AIS data provided by Global Fishing Watch.
31. AIS data provided by Global Fishing Watch.
32. According to the author’s classification, the so-called shadow-fleet is divided into the gray and black fleet. The criteria for distinguishing the grey and black fleet from the white fleet (which represents 95 percent of world-fleet and should be sanctions-compliant) are various, so the gray fleet refers to oil tankers that appears law-abiding and sanction-proof. This is achievable through complex ownership structures, aimed at addressing the identification of the company, or by basing ownership and insurance beyond sanctions’ perimeter. For our case, a vessel is part of the gray fleet if: it is not owned, operated and financed from an EU/G7+ entity (e.g., ownership based in Russia); it is insured with a P&I insurance not from the International Group of P&I or it is not insured with P&I; it is insured with P&I from the International Group, but has the following characteristics: it has a complex, murky ownership and managing structure. Concerning the black fleet, the authors acknowledge it as a smaller part of the gray fleet, and composed of ships that possess all the qualities of the gray fleet and are also engaged in Identification Deception Tactics (IDTs).
33. The authors discovered this new STS site in October 2023, when MARINE was at its early stages. In the meantime, valuable research has been published on the topic in December 2023. See Andrej Androjna et al., AIS Data Manipulation in the Illicit Global Oil Trade, Journal of Marine Science and Engineering 12, no. 1 (2024). This discovery solidifies our confidence in the effectiveness of the MARINE approach and international endeavors to undermine Russian oil revenues.
34. Council Regulation (EU) 2022/1269 of 21 July 2022 amending Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia’s actions destabilizing the situation in Ukraine, L193/14, 193/67 and 68. Council Regulation (EU) 2022/1903, 2022/1904, 2022/1905, 2022/1906 and Council Decision (CFSP) 2022/1907, 2022/1908, 2022/1909.
