AIS Position Spoofing Alerts Jumped from 72 a Week to 6,338 in Four Weeks. Every One Filed at Maximum Confidence. None Has Been Reviewed.

The Setup

AIS_manipulation_spoof alerts held at a low, steady baseline through most of June 2026: 17 in the week of June 1, climbing gradually to 72 by the week of June 29. Then the pattern broke. The week of July 6 produced 634 alerts — nearly nine times the prior week. July 13 produced 4,057. July 20 dipped to 2,622. July 27 peaked at 6,338 — an 88x increase over the June 29 baseline in exactly four weeks. The two most recent weeks have eased back, to 3,426 (week of Aug 3) and 801 in the partial week through Aug 18, but volume remains far above where it sat seven weeks earlier.

The Chain

Every one of these alerts carries a confidence score of exactly 1.00 — all 13,177 filed in the trailing 30 days. None has been acknowledged; none has an adjudication_status set. That combination — maximum machine confidence paired with zero human review — is the same queue-saturation pattern Overwatch's motif system has produced with ship-to-ship transfer and fraudulent-documentation alerts in prior months, but this surge is larger and faster than either. Ship-to-ship transfer took 90 days to accumulate 35,377 alerts earlier this year; spoofing produced more than a third of that total, 13,177 alerts, in 30 days, with the bulk of it landing in a three-week window. It isn't running alone: in the same trailing 30 days, the queue also received 14,860 AIS_manipulation_dark alerts, 4,305 ship_to_ship_transfer, 946 fraudulent_documentation, and 6 destination_laundering — five active motif classes, 33,294 alerts combined, with a combined review rate of zero.

The Implication

A spoofing detector firing at 1.00 confidence on every single alert isn't distinguishing likely spoofing from certain spoofing — the score has stopped functioning as a triage signal, because it no longer varies. Combined with a review backlog now five motif classes deep, whatever drove the July surge — a genuine rise in AIS manipulation, a change in detector sensitivity, or both — has not been separated from noise by an analyst at any point in the seven weeks since it started. If even 5% of the 13,177 spoofing alerts represent real position falsification tied to sanctions evasion or unauthorized ship-to-ship activity, that is more than 650 unreviewed incidents sitting in a queue that, at the current review rate of zero, is not being worked down at all.

What to Watch

Whether the Aug 3-to-Aug 17 decline (3,426 to 801, on a partial week) continues back toward the June baseline or was itself a temporary dip inside a longer elevated period. One more complete week of data resolves which.

Limitations

A constant 1.00 confidence score across 13,177 alerts is itself a reason for caution rather than reassurance: either the detector is genuinely producing a saturated true-positive rate, or the confidence field isn't varying with alert quality the way it's designed to — in which case "maximum confidence" isn't evidence the alerts are correct, only evidence the field isn't discriminating between them. This analysis can't tell those two explanations apart; doing so requires a manual review sample, not another query against the same table. A surge this large is also worth checking against a pipeline explanation — a new upstream data source, a threshold change, a reprocessing run — before it's treated purely as a shift in vessel behavior.

Data as of 2026-08-19 (through the partial week of Aug 17). Source: Overwatch motif_alerts, motif_name='AIS_manipulation_spoof' weekly trend and combined 5-class motif totals, trailing 30/75 days.