The Setup
1,333 vessel renames have been logged in the identity graph since April 2. Zero have ever been flagged as obfuscation — while the two smaller categories of identity change sitting right next to renames in the same table are flagged at 100%. temporal_edges is the append-only graph of vessel identity changes: a name change, an MMSI reassignment, a flag jump, a shell-company hop between managers. Three of those categories carry an obfuscation_flag that fires automatically when the change pattern looks like evasion rather than routine paperwork — a new MMSI with no name continuity, a management transfer to an entity with under 30% name similarity to the last one. mmsi_changed sits at 937 edges, and every single one is flagged. shell_hop sits at 540 edges, and every single one is flagged. Between them, that's 1,477 identity changes the graph treats as presumptively suspicious.
renamed_to is bigger than either of those categories on its own — 1,333 edges, one per vessel, dating back to the first week of April and still adding roughly 76 new rows a month. Renaming a vessel is the single most common way to sever a name from a history: it's the first move in flag-hopping, the standard opening in sanctions evasion, and the change type most likely to precede a shell-hop or MMSI swap rather than follow one. And it has a 0% flag rate. Not low — zero. No renamed_to edge, across five months and 1,333 vessels, has ever tripped the obfuscation heuristic.
The Chain
The obfuscation logic that flags shell_hop runs a name-similarity check between the old and new entity. mmsi_changed flags on the absence of name continuity across the identity swap. Both of those checks have an obvious analogue for a rename — compare old name to new name, flag on low similarity or on a pattern match against known evasion naming conventions (slight misspellings, reused IMO with cosmetically altered name, re-registration under a near-identical string). That comparison is not running against renamed_to edges at all. The average confidence_decay on these edges is 0.657, meaning the graph itself treats a meaningful fraction of these renames as low-confidence signal — decay is doing quiet, private work that never surfaces as a flag an analyst would actually see.
The practical effect: a vessel can rename, rename again, and eventually mmsi-swap or shell-hop, and only the last step in that chain generates a flag. The rename that started the sequence is invisible to anyone scanning obfuscation_flag = true.
The Implication
Vessel identity screening built on top of temporal_edges — sanctions exposure checks, ownership-chain traversal, anything that filters on obfuscation flags to triage analyst attention — is structurally blind to the largest single category of identity change in the table. A rename-then-shell-hop sequence surfaces one flagged edge instead of two, and a rename that never proceeds to a shell-hop or MMSI change surfaces zero. Given that renames outnumber the two flagged categories combined, the flagged subset of the identity graph is undercounting the true volume of identity churn by more than half.
What to Watch
Whether renamed_to edges start carrying an obfuscation check at all, and whether the 76-a-month pace holds or accelerates — a jump in rename volume with continued 0% flagging would be the clearest sign the detection gap is being actively used rather than just sitting open.
Limitations
This reflects obfuscation_flag as currently computed on temporal_edges and does not evaluate whether individual renames were legitimate (re-registration, ownership change, routine re-branding) versus evasive. Confidence-decay values are a proxy for edge reliability, not a substitute for a dedicated name-similarity check. Numbers reflect a snapshot query against the production identity graph.
Data as of 2026-09-04. Source: Overwatch temporal_edges, relation_type='renamed_to' (1,333 edges, 1,333 distinct vessels, 0 obfuscation_flag=true, avg confidence_decay 0.657, first edge 2026-04-02, 76 edges in trailing 30 days) vs. relation_type IN ('mmsi_changed','shell_hop') (937 and 540 edges respectively, 100% obfuscation_flag=true for both).