An open letter to NORAD and USNORTHCOM - Let's talk about Russian Navy operations

Russian Navy Frigate Admiral Gorshkov (credit:USNORTHCOM)

Dear North American Aerospace Defense Command & U.S. Northern Command

Do you have a few minutes?  I hope so.

I'm a long time fan of your work, defending North America and all, but it looks like information operations from unknown parties are taking place in NORAD's area of responsibility, and seem for the most part unchallenged. I don't want you to take that the wrong way, and maybe tell the public less, in an effort to reduce the attack surface, and reduce any public discussion about Russian Navy operations; I'd like you to lean into it, and I think you're already half way there.

Let me try to explain what I mean with context.

Back in the summer a few of Russian Navy ships stopped in Cuba, including the new Russian frigate Admiral Gorshkov, on their way around the world, and U.S. Northern Command told the public of that event; I was thrilled. No really, I was! Being so open and transparent with the public is not something I see militaries do frequently. Russian ships do still stop in Cuba occasionally, and it reminds me (and others) of old Soviet times when they had a significant military force there. While the Russians still do have a presence, somewhat, it's a shadow of those times. Their submarine base, as well as others, lie mostly as reinforced-concrete ruins.

We are aware of the deployment of the Russian ship Gorshkov and are taking steps to actively track it. We won't discuss all measures being taken, but NORAD is conducting air operations in defense of the US & Canada and USNORTHCOM has deployed maritime assets to track Gorshkov.

— U.S. Northern Command (@USNorthernCmd) June 26, 2019

Unfortunately, there was no follow-up saying the Russian ship left, which left an opportunity that was exploited by detractors who published rumours to social media that they were still there, days / months after they left. Being aware of a Russian warship stopping in for supplies in Havana is in the public interest, it is news, and it should be mentioned; thank you for that. However, the follow-up that they left, especially because they left within a couple of days, is equally important. I believe it is important to give the correct impression that they were passing through, not repositioning there. Not mentioning the departure gives the public the impression Russia forward deployed a frigate to be stationed in Havana, which isn't true. The Russian Navy was just passing through. In the future, I hope NORAD will be more clear about that. The initial transparency, telling the public, was fantastic, but it needed follow-through. I did notice the US Navy was tailing them as they departed the Americas; NORAD was aware of exactly where they were every moment of the day.

My bad, they ARE reporting in on AIS again!

🇺🇸 #USNavy Arleigh Burke-class destroyer USS Jason Dunham (MMSI:366997034|CS:NJDM) is heading for Florida, I guess Admiral Gorshkov has departed the #NORAD area of interest.#USSJasonDunham #DDG109 #AIS ⚓ https://t.co/MhDb4teslm pic.twitter.com/xkRfGyBsa6

— Steffan Watkins (@steffanwatkins) June 29, 2019

Just last week someone leaked to The Washington Times and CNN that the Russians were visiting in international waters off the US East Coast for their almost-yearly visit to conduct signals intelligence; NORAD could have broke that news publicly when they arrived to the region, without the leak and without help from the press. The Russian Navy AGI Viktor Leonov is well known to sail over from Murmansk every year or two. Their mission mostly out of public view because they do not use an AIS transponder, which would show where they are to ship tracking enthusiasts like myself. Without a transponder, I rely on other more creative means, including watching for others who might stumble across their location - but that's hard to come by, since they're over 12 NM away from shore, and likely only noticed by a few planes or other ships.

The earliest reference I've ever found for the Viktor Leonov coming near the US East Coast was 1998, but of course I can't find that reference anymore; I thought it was off one of the wire services published years ago. I can still find a very slim reference to their visit in 2012 (https://www.usatoday.com/story/news/world/2014/02/27/russia-cuba-warship/5876249/), as well as more detail in 2014 (https://www.nbcnews.com/news/world/russian-spy-ship-docks-havana-n40041), 2015 (https://abcnews.go.com/International/russian-spy-ships-arrival-cuba-raises-eyebrows/story?id=28377558), 2017 (https://abcnews.go.com/International/russian-spy-ship-now-off-virginia-coast/story?id=45547194), and 2018 (https://freebeacon.com/national-security/pentagon-shadowing-russian-spy-ship/). These are facts, matters of history, that are being written by the press, that future generations will refer to. Telling the public what's going on is probably listed somewhere lower on the list of NORAD's daily activities than protecting the public. In today's age of information warfare, telling the public the truth, up front, denies NORAD's adversaries the capability of exploiting a lack of information to propagate disinformation. Publishing information from an official source has the effect of acting as an area of denial weapon in an information war; it denies the adversary the capability of waging a whisper campaign, spreading disinformation, since public information allows anyone to fact-check, and refute their statements, if the information is from a trusted source. I can't think of a more trustworthy source for Canadians and Americans than a NORAD press release. NORAD has the power to suffocate any information operations trying to misinform the public about Russian Navy operations in international waters, if they take the initiative to do so. Information is an area of denial weapon, and while NORAD knows that at some level, it is not taking advantage of the high ground it holds. By not being forthright with information, NORAD is ceding the information battlespace to adversaries who are exploiting the lack of information for agitprop.

I've seen (false!) reports alleging that Russian Navy ships (plural!) have been off the coast since Trump was elected, that they dock at Mar-a-Lago, that they drop anchor outside Mar-a-Lago, that they were snooping on Wifi (of course) at Mar-a-Lago, that they were planting nuclear mines along the seaboard, that they communicate with President Trump on his phone, that they tap his phone from offshore, and of course that they're there to pick up President Trump as he flees from his life of crime. Does anyone take these rumours seriously? Well, the problem is, there's so much disinformation it's hard for the American and Canadian public to keep it all straight. Snopes articles about each of these varieties of lies are not what we need; the public needs authoritative information from one of their most trusted guardian, NORAD.

While we won't discuss specific measures being taken, NORAD and USNORTHCOM routinely conduct air and maritime operations to ensure the defense of the United States and Canada. 2/2

— North American Aerospace Defense Command (@NORADCommand) December 17, 2019

I have three humble requests.

• Please continue to tell the public when Russian Navy operations are taking place in NORAD's area of interest.
• Please break the news yourself, so the public can recognize the excellent work NORAD is doing, and know it's from a trusted source.
• Please ask the US Navy to consider leaving their transponders on, as USS Jason Dunham did in the summer, but USS Mahan did not while tailing Viktor Leonov after December 14th. If they can look out their window and see their escort, turning off AIS isn't going to improve OPSEC.

I simply don't believe there's any reason for the public to rely on rumours spread by leaks and malicious actors with their own agendas; you know where "they" are, and "they" know you know where they are. Leaving the news of their arrival and departure up to the rumour mill only enables disinformation. Please continue to tell the public about their comings, but also their goings, so the public doesn't get the impression there is a traffic jam off the coast off Mar-a-Lago. 😉

Thank you, and Happy Holidays.

Steffan Watkins
Ottawa, Canada

You saw a ship on the news, but how do YOU find it using OSINT?

I've had some requests to walk people through, with more detail, how to look up ship-related information, and I'm not hiding any methods, the whole idea is for YOU to be able to loo up your own information for free (or for cheap), and not need to launch your own spy satellite.
(but if you have the chance, you really should - I'm looking at you Elon)

There are many, many, ways to skin this cat. I'm just going to go over one way as an example - this is by no means an exhaustive how-to. There are marine ship registries, forums, accident reports, all sorts of other resources - but I'm going to show you MarineTraffic.com and focus on AIS.

Let's take an article which was in the news and walk you through the process. The first thing is to figure out what is the subset of vessels, out of the tens of thousands presently at sea, that you're interested in. You need to scope out the breadth of your investigation. Here is a good start;

St Helena's cherished lifeline ship to return as anti-piracy armory

Joe Brock - APRIL 17, 2018 / 10:38 PM (original here)

JOHANNESBURG (Reuters) - The RMS St. Helena, Britain’s last working postal ship, was for nearly three decades the main source of contact between one of humanity’s remotest islands and the outside world.

Now the ship, cherished by the 4,500 residents of British-ruled St. Helena, will start a new life as a floating armory, packed with automatic weapons, bullet-proof jackets and night vision goggles, all stored for maritime security operatives.

Renamed the MNG Tahiti, the 340-foot ship will undergo some tweaks before sailing to the Gulf of Oman where it will be used to ferry guns and guards to passing vessels navigating stretches of water lurking with pirates, its new operator said on Tuesday.

“The ship is good to go with a few adjustments,” said Mark Gray, a former British Royal Marine and founder of floating armory firm MNG Maritime. “By the middle of the year we hope to have her operating.”

Tahiti Shipping, a subsidiary of MNG Maritime, bought the ship for an undisclosed fee on Tuesday, the St. Helena government said in a statement.

The construction last year of a commercial airport on the isolated island in the middle of the South Atlantic rendered the 156-passenger ship obsolete, prompting St. Helena authorities to put it up for sale and begin planning a gala farewell.

Before weekly flights to South Africa began in October, a five-night voyage to Cape Town on the RMS St. Helena was the only major transport route off an island made famous as the windswept outpost where French emperor Napoleon Bonaparte died.

The yellow-funnelled ship was purpose-built by the British government in 1989 to service the island and is the last of a royal mail fleet that once connected the far-flung tentacles of the old British Empire.

Its final voyage was marked with a public holiday on St. Helena, with flag-waving crowds gathering on the rocky coastline to catch one last glimpse of the ship that had delivered them everything from car parts to Christmas turkeys.

A flotilla of fishing vessels and yachts flanked the ship with those on board popping champagne corks as plumes of balloons were released into the sky to cheers from St. Helena residents, known locally as “Saints”.

“I fully appreciate the role this vessel has played in all Saints’ lives,” MNG Maritime’s Gray said. “It is not a responsibility we take on lightly. We will continue to treat her in the manner to which she has become accustomed.”

Writing by Joe Brock; Editing by Mark Heinrich (Reuters)

After reading that, do you have more questions than you started with? I sure do. First, how many ships like this does MNG Maritime and their subsidiaries have? What about other floating armouries? ...and where are they? Someone must have already made a list, hopefully with IMO or MMSI numbers which definitively identify the ships that might have duplicate names.

Web search engines like Google and Duck Duck Go will help you greatly, since none of these operations are in any way secret or covert, they are publicly discussed and licensed. These are extremely heavily armed vessels moored in strategic locations around choke points where there is high pirate activity.

Here is a fantastic resource:

"Stockpiles at Sea, Floating Armouries in the Indian Ocean"

SMALL ARMS SURVEY 2015, Chapter 8, Pages 216-241

written by Ioannis Chapsos and Paul Holtom

http://www.smallarmssurvey.org/fileadmin/docs/A-Yearbook/2015/eng/Small-Arms-Survey-2015-Chapter-08-EN.pdf

Google some more more and you'll soon find this:
https://seenthis.net/messages/688184

From those, you should have a list of a few dozen Vessels of Interest (see what I did there?)

Put all the vessel information you can find in a spreadsheet; with a little luck copy & paste works.

I'm going to use the IMO numbers because they're tied to the ship, whereas the MMSI number change with the registration and ownership. Sometimes you have access to one, or the other - always record both, and the callsign if you have it. Keeping a spreadsheet of the ships you've put information together about is essential. I recommend using Google Docs.

Now we come to the MarineTraffic.com portion of our lesson; 

Create an account, and if you're really into this, pay your yearly pound of flesh and get access to more than the free account offers.  First of all, you need a "fleet" of 50. Their basic account would provide you that. The "fleet" concept groups vessels in whatever category you would like, and allows you to control them in bulk groups easily.

Here are all the IMOs from the aforementioned floating armouries:

8112823

6524230

7027502

8965593

5278432

8107713

8107036

7313432

5427784

8701105

8129084

7406215

9606194

8131386

7412018

7624635

8413174

7353432

7709253

8206105

7911777

7115567

9050101

4908729

8410691

8912572

8333283

8301216

7932006

8003175

7319242

7636339

7392854

8333506

First, search for one of those ships, any one

Click the result, it will open up a details page on that ship

You want to make a new fleet, so click the down arrow beside "Add to default fleet" and scroll to the bottom, select "Add to new fleet". Name it something obvious, like "Floating Armouries"

Now, click the little person icon at the top right, and pull down to "My Fleets"

Select the Floating Armouries fleet you created previously. Notice the "import" line? That's what you want! That's why having a spreadsheet with the list of ships you're tracking is very handy.

Now you're presented with a big empty box for IMO or MMSI numbers; paste the whole list in that box. Any duplicates will disappear, so don't be too careful.

Import, and voila - you have a MarineTraffic fleet with all the Floating Armouries in it.

Then, you can show only the vessels in your fleet at the map view, and exclude all the others so you're not distracted.

You're ready to follow these, or other ships that match your interests, around the globe.

Did I cheat by using a pre-made list that someone else already published in a PDF? Yes. Absolutely. OSINT is all about that sort of "cheating". Use what others have already blazed the trail with, and add to that. There is no reason to start from scratch, but remember to both protect your sources, and credit them - those two things may seem at odds, because they are. I've offended people both by crediting, and not crediting them. I try to error on the side of giving credit publicly, unless someone tells me not to.

Happy hunting!

Argentine Navy research vessel operates near Falklands; catches the Royal Navy's eye

https://surenio.com.ar/2016/05/buque-ara-puerto-deseado-finalizo-participacion-la-campana-oceanografica

Following ship movements is greatly more entertaining when you can spot an interaction between vessels that have otherwise not been identified as being related. I think this makes a great example of that. The interaction was nothing out of the ordinary, I'm sure this sort of thing happens every day, but it's neat to catch it all the same.

Weeks ago Argentinian sources reported that the ARA Puerto Deseado would be conducting operations near the Falklands from 2018-08-22 onward. On 2018-08-30 the Argentinian Navy oceanographic survey ship ARA Puerto Deseado had been performing operations for over a week in the same area, then seemed to depart, and head toward the Falkland Islands. After not reporting their position via Satellite-based AIS for an hour, the HMS Clyde departed from where she was, and headed toward the Argentine Ship at full speed. Shortly after that, ARA Puerto Deseado reappeared on AIS-S, it seems their transponder was beaconing again to the satellite above. They had already turned around, and were no longer heading toward the British territorial limit. Minutes after returning to AIS visibility, with their heading reversed, HMS Clyde turned around as well.

marinetraffic.com

marinetraffic.com

🇦🇷 Argentine Navy oceanographic survey ship ARA Puerto Deseado was operating rather near the British territorial waters around the Falkland Islands, and I do believe the @RoyalNavy noticed. Good reaction time too.#ARAPuertoDeseado #AGS #Q20 https://t.co/i0k7fgEe1E pic.twitter.com/OXPzWpNKOr

— Steffan Watkins 🇨🇦 (@steffanwatkins) 3 September 2018

This piqued author HI Sutton's curiosity, and he wrote up his assessment in his blog, here (with credit to me too, which was appreciated!)

The Telegraph UK contacted the Royal Navy for a quote, so they did some legwork, but failed to mention the OSINT origin of the story. Poor show.

Then The Sunday Express got a hold of this story (here - wow...)

Finally, the Argentine Navy had to put out a statement (here)

Conclusion:

The short version? It is absolutely remarkable that a ship, any ship, changed its behaviour and headed straight at the Falklands as they did.

...but was it nefarious? There is no reason to believe there was anything malicious afoot.

I still think it's odd that ARA Puerto Deseado's AIS transponder beacons feverishly (as Juanma Baiutti pointed out), then drops silent for two hours, but evidently that's the way they have it configured, or that's the way it's working The Argentinian Navy say they didn't disable their AIS. None the less, they were close enough to provoke the HMS Clyde to start to head in their direction briefly, until it became evident they'd turned around already. There was nothing nefarious about anyone's; activities, but its the Royal Navy's job to be prepared for anything.

Another misconception that was circulating was their speed; that they were headed toward the Falklands at "full speed"... I'm not sure what their maximum speed really is, but they were only doing 7-8kn, so I would hope not.

Lastly, I must thank the Telegraph for this gem from the Royal Navy:

"This was unusual activity (..) it was the course and speed [of the Argentinian ship] towards the islands which was unusual"

said the UK Ministry of Defence Spokesperson (per The Telegraph)

Much thanks to @feibianAjax who tipped me off to the presence of the ARA Puerto Deseado near the Falklands!

Sorry Australians, there was no Chinese "Spy Ship" following HMAS Adelaide around.

Australian Broadcasting Company (ABC) News - original here

The Australian news media ran a story the other day that caught my eye. The collection of articles published by different outlets can be summed up like this;
An Australian warship arrives in Fiji, shadowed by a Chinese Spy vessel, and while the Australians were told there would be a Chinese fishing vessel beside them, they were surprised to find this Chinese "fishing vessel" was actually a SIGINT vessel, with all its attention focused on the Australian ship.

I can't tell if I'm disapointed or pleased with this, since it gives some validity to the belief that the Australian news media push a "red scare" narrative, just like the American news media; but they have different "Reds"! In America, it's the Russians who are coming. For Australia, it's the Chinese. On a certain level there's some truth to both, but nothing like what's being portrayed by these misleading articles. While it's true that the Chinese are exerting their influence in the Pacific, this story isn't about that, it's about a Chinese Spy Ship tailing the Australian Navy, and that just didn't happen.

HMAS Adelaide (IMO:9608972|MMSI:503000021) was the ship the Chinese were supposedly focused on, and one of the largest warships the Royal Australian Navy (RAN) has; she's a Canberra-class landing helicopter dock (aka LHD). She's their crown jewel. That may be why the 2nd ship, the HMAS Melbourne, an Adelaide-class guided missile frigate (FFG), garnered no attention at all.

Here are the facts. HMAS Adelaide departed Townville, Australia on 2018-06-01, arrived in Suva Fiji 2018-06-08, and left again 2018-06-11 heading to Togo, per the information broadcast by their publicly available AIS transponder data.  There is no reason the Australian press needed to ignore any of this data, and unfortunate the Australian MoD didn't put out a press release specifically debunking the misinformation that was running rampant.

Size Comparison
Royal Australian Navy

Yuan Wang 7, the "Spy Ship", which is actually a Chinese PLA(N) satellite telemetry ship, arrived and moored in the port of Suva Fiji right before the HMAS Adelaide docked, but the Chinese vessel didn't dock as was reported, they stayed moored in the harbour for days. Yuan Wang had been operating to the North, and came from that direction, while the Australian Ships came from the West, or as they call it, Australia. At no time was the Yuan Wang 7 "chasing" or "tailing" the Australian ships. That detail is simply impossible, they were not in proximity of each other until they both arrived in Fiji. The Australians left Fiji 2018-06-11, and the PLA(N) Yuan Wang 7 left 2018-06-15, both in different directions even. None of these facts line up with the overall Australian news media's depiction of the events, and that's a little disappointing.

There is hope for the Australian news media, so they don't get punked by unreliable sources in the future, and I'm here to serve it up for them as easily as I can possibly make it. Point and click. Here are all the Yuan Wang vessels, with their corresponding links to MarineTraffic.com, where you can see them (for free) if they're near a shore based AIS-T receiver feeding into to their service. With a paid account you look up more history, and can purchase satellite-based AIS coverage, so you can see the vessels when they're farther out at sea.

If you're thinking to yourself that it would be ridiculous for a cloak and dagger "spy ship" to have their transponder on all the time, there might just be hope for you yet. SIGINT collection vessels, AGIs, don't usually have their transponders on at all. What hasn't been mentioned either is every ship is a "spy ship"; it's every Navy's responsibility to gather intelligence when the opportunity arises, and I'm quite sure Yuan Wang 7 was collecting some intelligence from both of the Australian warships it found itself in proximity to, but it's far more nuanced than the Australian news media portrayed it.

Chinese PLA(N) Yuan Wang Satellite Tracking (and support) Vessels:

ship name	mmsi	MarineTraffic.com link:
Yuan Wang 21	412380260	https://www.marinetraffic.com/en/ais/details/ships/mmsi:412380260
Yuan Wang 22	412380270	https://www.marinetraffic.com/en/ais/details/ships/mmsi:412380270
Yuan Wang 2	412958000	https://www.marinetraffic.com/en/ais/details/ships/mmsi:412958000
Yuan Wang 3	412962000	https://www.marinetraffic.com/en/ais/details/ships/mmsi:412962000
Yuan Wang 5	413289000	https://www.marinetraffic.com/en/ais/details/ships/mmsi:413289000
Yuan Wang 6	413326000	https://www.marinetraffic.com/en/ais/details/ships/mmsi:413326000
Yuan Wang 7	413379290	https://www.marinetraffic.com/en/ais/details/ships/mmsi:413379290

There is only one loose end. The Yuan Wang 7 started to sail toward Fiji, at relatively high speed, on 2018-06-05 ~14:00Z. It seems the Royal Australian Navy "for OPSEC reasons" doesn't transmit their location using AIS-S, so I don't know if on, or around, 2018-06-05 they also started heading towards Fiji, or gave the Chinese some other tell that made the Chinese make a sprint for Fiji at almost 20kn (pretty fast for such a big ship). Some sarcastically suggest it's "quite a coincidence" that they all arrived around the same time, but the PLA(N) Yuan Wang 7 restocks in Fiji regularly, so it isn't as wild a coincidence as it may seem to someone unfamiliar with the vessel's previous movements.

To reiterate, I'm not suggesting any Chinese Navy vessel wouldn't collect intelligence on the Australian ships, of course they would, but the reverse is true too. Both countries are regional powers with significant naval presence. Unfortunately, the stories about this encounter got almost all of the facts wrong, and they really didn't need to. All of the location information I've referenced above would have been at their fingertips if they'd known where to look on June 9th before the story was published.

References:

Yuan Wang 7 moored in the harbour 2018-06-08 ~20:00Z,
and didn't dock until days later.

HMAS Adelaide (IMO:9608972|MMSI:503000021)
Arrival 2018-06-08 ~22:00Z

HMAS Adelaide (IMO:9608972|MMSI:503000021)
Departure 2018-06-11 ~04:00Z

Yuan Wang 7 departed 2018-06-15 ~04:00Z

RIMPAC 2016 has a Russian shadow

The Pribaltika, a Balzam-class AGI - April 2016 - Vladivostok
Credit: forums.airbase.ru

RIMPAC 2016 is going on in Hawaii right now, with a large Canadian contingent taking part!

Two years ago the Chinese Navy was invited to bring their ships... and they sent an extra, a spy-ship (AGI) to "listen in" on the whole event, just outside of American waters.  Oh, those crafty Chinese!
https://news.usni.org/2014/07/18/china-sends-uninvited-spy-ship-rimpac

I haven't heard anything about another Chinese AGI being spotted, yet, but the Russians weren't invited to RIMPAC 2016 (that's poor form guys!) so they showed up anyway, with their own "spy ship", the Pribaltika, a Balzam-class AGI.
https://news.usni.org/2016/07/06/russian-spy-ship-now-off-hawaii-u-s-navy-protecting-critical-information

In 2014 the Pribaltika was lurking around Alaska, listening to the fishies, or something.
http://7fbtk.blogspot.ca/2014/08/russia-keeping-tabs-on-alaska.html

I look forward to see how this pans out, as I noticed some of the Russian Navy's warships around the Kuril Islands (North of Japan), and they could easily have been headed East.  Anyone wonder where the Russian Navy Pacific Fleet Subs are hanging out?  I bet they're listening in too, nearby.

RFS Fotiy Krylov and RV Marshal Gelovani visit Shanghai, China

To recap, ships from the Russian Navy Pacific Fleet, RFS Fotiy Krylov and RV Marshal Gelovani, have traveled from Vladivostok, to Nicaragua, did some stuff while they were there... and are on their way back to their home port.  To my surprise they stopped in the port of Shanghai! Luckily Shanghai has some excellent shipspotters that really go the extra mile.
Thank you for the pictures Justin Zhu!

See previous posts here and here for more details about their trip.

2015.11.01 Update:
They have left, going to Vladivostok (I think)
Они оставили , идя до Владивостока ( я думаю)

RV Marshal Gelovani / Маршал Геловани

October 29, 2015 - Shanghai, China

Photo Credit: Justin Zhu Twitter: @justin86zy

RV Marshal Gelovani / Маршал Геловани

October 29, 2015 - Shanghai, China

Photo Credit: Justin Zhu Twitter: @justin86zy

RFS Fotiy Krylov / Фотий Крылов

October 29, 2015 - Shanghai, China

Photo Credit: Justin Zhu Twitter: @justin86zy

RFS Fotiy Krylov / Фотий Крылов

October 29, 2015 - Shanghai, China

Photo Credit: Justin Zhu Twitter: @justin86zy

Russian supertug Fotiy Krylov and the Russian Research Vessel Marshal Gelovani pic.twitter.com/ZLg5SKCwLy

— justin zhu (@justin86zy) October 30, 2015

Last recorded position:

Berth where she docked: