ILLUSTRATIVE · FICTIONAL VESSEL · SYNTHETIC DATA · ANALYST DECISION SUPPORT, NOT A DETERMINATION OR ATTRIBUTION
Evidenx does not score, determine intent, or attribute. This card structures multi-source observations and the competing explanations to support the reviewing analyst, who makes the assessment and decides any reporting.
Step 1 of 8Scope & signal reduction
What the sweep assembled
A fictional cargo vessel, MV KESTREL DAWN, was flagged by a routine AIS continuity sweep. Six sources of openly or commercially available information were assembled and organised into one activity pattern and a set of alternatives to support the reviewing analyst. Nothing is discarded. Each item remains an observation with its provenance; this layer structures and correlates, it does not determine intent.
~13,400
raw messages & records across 6 sources
→
1
activity pattern (AIS gap with off-track presence)
→
4
alternatives weighed
AIS feed
~13,400 msgs
commercial aggregator
Satellite imagery
2 scenes
commercial EO, tasked
RF geolocation
1 collect
commercial provider
Ship-spotter photo
1
public social post
Corporate registry
3 records
public filings
Port records
partial
published schedules
Step 2 of 8The activity picture
A structured picture, not a determination
Working pattern: a
62-hour AIS transmission gap beginning near the edge of a known reception cell, with a tasked satellite scene during the gap showing a vessel
consistent with KESTREL DAWN approximately 140 nm from her last reported track. This is a
structured activity picture to support the analyst's assessment. It is not a determination of dark activity, evasion, or intent.
framed againstdark-activity indicator list (illustrative)regional AIS reception model
evidence inAIS imagery RF collect open sources
The reference lists here (dark-activity indicators, reception models) are the maritime analogue of the DFIR reference lists, authored and curated by a domain SME, not by this tool. 'Consistent with' is a similarity statement carried with its basis; it is never silently upgraded to an identification.
Step 3 of 8Pertinent findings
Multi-source facts for the analyst to interpret
Gap window vs imaged presence
temporal
The tasked scene (day 2 of the gap, 10:41 UTC) falls inside the 62-hour AIS silence. The temporal overlap is a fact; what the vessel was doing is not established by it.
Last track vs imaged position
spatial
Last AIS fix and the imaged position differ by ~140 nm, beyond drift but within powered range for the elapsed time. Surfaced as a spatial fact for the analyst to weigh.
Hull features vs registry photos
identity
Deck crane arrangement and hull markings in the spotter photo are consistent with registry photographs on file. Recorded as consistent-with; the photo's own time and place are unverified (no metadata) and it corroborates identity only if independently placed.
Each item is a neutral observation plus why it was surfaced, with provenance retained. Correlation across sources is displayed, never silently merged. Two sources agreeing is only corroboration if they are independent, and independence is recorded, not assumed.
Step 4 of 8Timeline
Registry changes, gap, collects & resumption
T-19 days Registered owner changed to a newly formed company (public filing)registry
T-6 days Vessel name and callsign re-registered (public filing)registry
Day 0 08:13 UTC Last AIS position report, near edge of reception cellAIS
Day 2 10:41 UTC Tasked scene: vessel consistent with KESTREL DAWN, ~140 nm off last trackimagery
Day 2 11:05 UTC Commercial RF collect geolocates an emitter in the same area (low precision)RF
Day 2 18:20 UTC Ship-spotter photo posted publicly; time and place unverifiedOSINT
Day 3 22:47 UTC AIS transmissions resume on the original routeAIS
Step 5 of 8Alternatives considered
Competing explanations, tested against the facts
Reception coverage gap exclude first
The gap began near the edge of a known reception cell, and terrestrial/satellite AIS coverage in the region is patchy. Common and benign. Must be excluded before anything else is entertained. The regional reception model for that window is the discriminating check and is not yet in hand.
Deliberate AIS manipulation
The off-track imaged presence and the registry churn are consistent with it, but nothing here establishes it. Open; turns substantially on the coverage-gap check and a confirmed identification of the imaged vessel.
Transponder malfunction
A hardware fault silences AIS without any deviation. Open but unaddressed by current evidence; the off-track position is the fact this explanation must account for.
Vessel misidentification
The imaged vessel and the spotter photo may show a sister ship or similar hull. Open; the identification is 'consistent with', not confirmed, and the photo is unplaced. Treating it as KESTREL DAWN is an assumption, and it is recorded as one.
Alternatives are held side by side and tested against the observations, the same alternative-hypotheses machinery used in the DFIR layer. In open-source work the benign explanation (a coverage gap) is the common case, so the system flags it as the one to exclude first. It does not choose; the analyst does.
Step 6 of 8Expected but not yet collected
Coverage limits, recorded honestly
Regional AIS reception model for the window
not_collected
The single most discriminating check: whether other vessels in the same cell went silent over the same hours. Not yet obtained; its absence carries no weight for or against any alternative. It defines the tasking.
Second imagery pass
not_collected
A revisit during the gap was weathered out (cloud cover). Would confirm or break the off-track presence independently of the single scene.
Port-call confirmation
not_collected
Regional port schedules for the plausible destination are not published for the window; an arrival record would anchor the track independently of AIS.
Provenance for the spotter photo
absent
The post carries no metadata and the account did not answer a request for origin. Assessed and not present. The photo therefore corroborates hull features only, not time or place.
This is where open-source collection and Evidenx meet: not_collected (not yet obtainable) is never held against an explanation; it is precisely what the tasking plan is built to resolve. absent (sought and not present) is different and evidentiary. In OSINT the trap is treating silence as signal; recording the difference is the guard.
Step 7 of 8Analyst support & tasking
For the analyst, not a determination
A 62-hour AIS gap with a single-scene off-track presence, an unverified public photo, and recent registry churn. The benign explanation (reception coverage) is unexcluded and flagged to check first; three alternatives remain open pending collects that are not yet in hand. The following is tasking support for the reviewing analyst, not a determination, not an attribution, and carrying no score.
Exclude the benign case first
Obtain the regional AIS reception model for the gap window and check whether co-located vessels went silent over the same hours. If they did, the pattern collapses to a coverage gap and the case closes cleanly.
Confirm or break the identification
Task a revisit or pull archive imagery for the gap window; request the RF provider's confidence ellipse for the day-2 collect. The 'consistent with' identification must be independently placed before it carries weight.
Anchor the track independently of AIS
Query port agents / published arrival records for the plausible destinations in the window. One confirmed berth resolves the spatial question either way.
Registry context, stated neutrally
The ownership and name changes are public facts with innocent explanations (sale, re-flagging). They are context for the analyst, not indicators on their own, and are recorded that way.
The analyst makes the assessment, assigns significance, and decides any reporting. Evidenx structures the observations, their provenance, and the alternatives; it does not determine intent, attribute, or score.
Step 8 of 8Conclusion
The call is the reviewing analyst's. Evidenx stops at understanding
Evidenx has taken six sources of open and commercial information to
data, to
information, to
understanding, the structured, corroborated, bounded picture on the preceding pages. It stops here.
The conclusion is the reviewing analyst's to make.data → information → understanding → their conclusion
Evidenx has not decided, and does not decide: intent, attribution, or a determination of dark activity. There is no score, rank, or confidence value in this card.
For the reviewing analyst to determine:
- Whether the activity pattern is significant once the benign case is excluded.
- Which alternative explanations survive scrutiny.
- Whether collection gaps (reception model, revisit imagery) must be closed first.
- The assessment, its confidence, and any reporting it warrants.
The reviewing analyst determination
Left intentionally blank. This is the reviewing analyst's conclusion to record. Evidenx provides the evidence, not the verdict.