HARBINGER: Dark-Fleet Risk From Public Data, No Satellites Required

Updated 18 September 2026.

HARBINGER scores how strongly a vessel's track shows behaviors associated with illegal, unreported, or unregulated fishing, using publicly broadcast AIS positions and publicly published zone boundaries. There is no satellite imagery in the pipeline, no proprietary feed, and no API key. It runs seven behavioral detectors over each vessel's track, combines them into a risk band, and writes a narrative an analyst can read and argue with. It is a research prototype, not a product in use, and an advisory triage tool: it points attention, it does not adjudicate, and no enforcement action is authorized on its output.

An earlier, shorter version of this note said the detectors looked for "speed and heading signatures consistent with transshipment" and that a test against a NOAA reserve had checked the risk ranking. Both were imprecise, and the corrections are below.

Where the data comes from

The vessel tracks are the daily national AIS files that NOAA publishes through MarineCadastre. They need no key and arrive in daily batches, which means HARBINGER works a day behind, not in real time. Zone boundaries, the marine protected areas, exclusive economic zones, and particularly sensitive sea areas the detectors test against, come from NOAA's own GIS services and from Marine Regions. Every source is public and keyless.

The seven detectors

Each detector looks at one behavior and reports a severity and a confidence.

1. AIS gap. A break of more than six hours between position reports. It scores worse if the vessel was moving slowly before it went dark, or if it reappeared somewhere other than where it should have been. Gaps happen for innocent reasons too, and a shore receiver dropping out is one of them, so a gap is weighed as one signal among several rather than as proof.
2. Loitering. Two hours or more at four knots or less. This is what fishing looks like, which is a strength and, as covered below, a weakness.
3. Speed anomaly. A rolling z-score on speed over ground, firing at 2.5 standard deviations or more. It needs at least two anomalous fixes and a change of at least two knots before it counts, so a single bad fix does not.
4. Erratic course. A mean turn of 35 degrees or more on slow segments, plus a measure of heading disorder. The zig-zag pattern is a fishing signature. Transshipment is handled by a separate check, described below.
5. Speed divergence. A median gap of three knots or more between the speed the vessel reports and the speed implied by its successive positions. That is either bad data or a position being spoofed.
6. Zone incursion. A point-in-polygon test against protected and restricted zones. It scores higher if the vessel was slow inside the zone, because transit and fishing are different acts. For an exclusive economic zone it fires only when a foreign-flagged vessel is moving slowly.
7. Speed-trend forecast. A forecast of whether the vessel's speed is heading into the loitering band, with extra weight if it is also heading toward a zone. This is a projection of a trend, nothing more.

There is an eighth check that runs between pairs of vessels rather than on one: rendezvous, two vessels within half a nautical mile of each other, both at three knots or less, for at least an hour. That is the transshipment signature, and it is deliberately kept out of the per-vessel score because it is a claim about two tracks, not one.

How the score is built

The detectors that fired are ranked by severity. Each adds its severity weighted by its confidence, with diminishing weight for each additional signal. The total is capped at 10, and the bands are fixed: critical at 8 or above, high at 6, elevated at 4, watch at 2, and clear below that.

The assessment itself carries a confidence, based on how dense and how long the track is. A sparse track is labelled provisional rather than handed a clean bill of health it has not earned. Every assessment is written out as a narrative, with the raw evidence and the time window behind each signal, and the input is hashed so the run can be replayed exactly later.

What we tested on a real reserve

We pulled the boundaries of the Tortugas Ecological Reserve, in the Florida Keys National Marine Sanctuary, from NOAA's GIS, and ran one full day of real AIS traffic, 1 January 2024, against them. The zone check fired on one vessel, which had four position fixes inside the southern section of the reserve. It was graded watch, not critical, because it was moving at transit speed the whole way through.

That test showed two things. The point-in-polygon geometry works against a boundary NOAA publishes, and the tool distinguishes transit speed inside a reserve from slow movement inside one. It did not validate the risk ranking, and the earlier version of this note should not have implied that it did.

What it gets wrong

When applied to a batch of real fishing vessels in US waters, HARBINGER over-flags. Loitering and erratic course are signatures of fishing, and legal fishing produces the same signatures. Without more, those signals describe a working boat, not evidence of anything illegal.

There is no ground truth yet. HARBINGER keeps a calibration log for confirmed outcomes so it can one day measure its own precision and recall, and that log is empty, so we make no precision or recall claim. A gap in AIS can be a switched-off transponder or a shore receiver that fell over. The lookup from a vessel's identifier to its flag is partial. Two of the Pacific zones in the demonstration set are rough boxes rather than real boundaries. And the polygon test breaks down at the antimeridian and the poles.

That is why the output is labelled advisory, and why the narrative shows its evidence instead of just a number.

What an analyst gets

A list sorted by band, and for each vessel a short written account of which behaviors fired, when, and on what evidence. The point is not to replace the analyst's judgment. It is to spend that judgment on the few tracks that deserve it, and to leave a record that can be checked by someone who was not in the room.

It is designed to run on hardware the organization owns, against data anyone can download, and the code carries 42 tests. When it is wrong, it is wrong in a way that can be shown, which matters in a tool that points at real boats.