... “It was alarming when I realized there were a lot of other vessels also showing this unusual AIS profile,” says Bergman. But he needed to know that the suspicious AIS messages were actually fake, not the result of a technical hiccup or a special military setting. Bergman spent the next few months laboriously verifying the actual positions of the targeted ships. At first, he used open source data including news reports, military press releases, and enthusiast websites like Warshipcam.com. “A lot of people like to take pictures of naval vessels and post them online,“ says Bergman. “I found examples where vessels were leaving or entering areas that seemed pretty impossible.”

Bergman then overlaid synthetic aperture radar and optical imagery from the European Space Agency’s Sentinel-1 and -2 satellites onto the suspicious AIS pings. If they were real, the AIS data should have matched up perfectly beneath a satellite image of the ship.

Instead, Bergman saw only empty ocean, time after time. In fact, he says, “I have not yet found an instance when a track flagged by the query as false turned out to be real.”

The stars did not always align for Bergman’s detective work. Some AIS tracks did not coincide with an ESA satellite overhead, or fell on cloudy days when optical images were useless. And some warships did not have a lot of Instagram fans. In the end, Bergman managed to confirm about 15 sets of AIS data as definitively fake.

As well as the Queen Elizabeth’s imaginary flotilla, Bergman found fake tracks of US, Dutch, Belgian, German, Lithuanian, Estonian, and other Swedish warships. One suspect track, not previously reported, shows the US guided missile destroyer USS Roosevelt steaming 4 kilometers into Russian territorial waters around Kaliningrad last November, a maneuver that would have been recklessly provocative if real. There appear to have been five other fake incursions near Kaliningrad in June. One involved a Polish warship following the exact same track, speed, and course as a Swedish corvette five days earlier, another indication for Bergman that the tracks are digitally generated.

In recent months, the faking activity appeared in the Black Sea for the first time. In June someone faked the AIS tracks of the UK destroyer HMS Defender and the Dutch frigate HNLMS Evertsen to show a direct approach to the Russian naval base at Sevastopol, near occupied Crimea—even while webcams showed them at dock in Odessa. And on July 2, Bergman’s query turned up another apparently fake incursion into Russian-claimed waters off Crimea, this time supposedly by the UK patrol vessel HMS Trent, accompanied by an Italian frigate and a Bulgarian corvette. He has yet to confirm these incidents using satellite imagery.

“We are aware of manipulation of AIS tracking data placing Carrier Strike Group vessels in areas where they were not,” a spokesperson for the UK Ministry of Defence told WIRED. “There was no operational impact on any of the vessels, but AIS is the commercial global safety system for all marine traffic. Any manipulation could result in a serious incident.” The US Navy did not immediately provide a comment.

Bergman has found no evidence directly linking the flood of fake AIS tracks to any country, organization, or individual. But they are consistent with Russian tactics, says Todd Humphreys, director of the Radionavigation Laboratory at the University of Texas at Austin. “While I can't say for sure who's doing this, the data fits a pattern of disinformation that our Russian friends are wont to engage in.”

Just two days after the HMS Defender had its AIS track faked, Russian forces allegedly fired warning shots at the destroyer during a transit close to the Crimean coast. “Imagine those shots hit their mark and Russia claimed to show that NATO ships were operating in their waters,” says Humphreys. “The West might cry foul, but as long as Russia can flood the system with enough disinformation, they can cause a situation where it's not clear their aggression was wrong. They love to operate in that kind of nebulous territory.”

One complication to that theory is that two Russian military ships recently also appeared in Bergman’s searches, showing them violating neighboring countries’ waters in turn. In June the patrol ship Pavel Derzhavin was shown within Ukrainian waters near Odessa, while the corvette Stoikiy supposedly sailed from Kaliningrad into Polish territory. Bergman believes that neither encroachment actually occurred.

Bergman is not making public the exact pattern that distinguishes the fake AIS messages, for fear that the attacker or attackers might modify them to be less detectable. He did tell WIRED that the fake tracks were all shown as coming from shore-based AIS receivers, with none collected by satellites. Given that real AIS signals from civilian ships near the supposed warship tracks were received by satellites overhead, Bergman believes this shows the fake AIS messages were not generated by actual malicious transmissions. Instead, he thinks they were created in AIS simulator software and then copied into the data stream feeding the AIS websites. ...