What an AIS gap actually means — and what it doesn't.

When a vessel stops broadcasting AIS, the easy interpretation is that it has something to hide. The interpretation is sometimes correct, often wrong, and rarely as clean as a screening alert makes it sound. A gap is a question, not an answer.

AIS — the Automatic Identification System — was designed for collision avoidance, not surveillance. Vessels above 300 gross tonnes are required to broadcast position, course, and identity at intervals of a few seconds to a few minutes, depending on speed. Coastal stations and satellites pick up the signal. When the broadcast stops, that absence is logged.

Three reasons a gap exists.

The first is geometry. AIS coverage is uneven. Satellites pass overhead at intervals; coastal stations have horizon limits. A vessel sailing through a known coverage shadow can be silent on third-party feeds for hours without ever turning its transponder off. The signal is being broadcast — it just isn't being received.

The second is equipment. Transponders fail. Antennas ice over. Power is rerouted. Crews forget to switch units back on after maintenance. In our population data, equipment-driven gaps cluster around port departures and mid-voyage refuelling, and resolve themselves within 24–48 hours.

The third is intent. A transponder switched off deliberately, or a transponder left on while broadcasting falsified position data — sometimes called AIS spoofing. This is the case operators care about. It is also the rarest of the three, which is exactly why it requires evidence and not assumption.

A black-box system collapses these three into a single red flag. A glass-box system keeps them apart.

How HUAX classifies a gap.

Every gap in the HUAX evidence chain is annotated with three pieces of context: expected_coverage, peer_baseline, and prior_behaviour.

expected_coverage compares the vessel's last-known position to the satellite and coastal coverage map for that hour. A four-hour gap mid-Atlantic is not surprising. A four-hour gap in the South China Sea is.

peer_baseline compares the vessel to its peer group — same type, same trade lane, same season. If similar vessels in similar coordinates show comparable gap rates, the signal is downweighted. If this vessel is an outlier against its own peers, the signal is amplified.

prior_behaviour compares the vessel to itself. A vessel that has historically transmitted continuously and suddenly goes dark is a different kind of question than a vessel with a long history of intermittent transmission.

What this means for the alert.

The output of this classification is not a binary flag. It is a structured signal: the gap, its three context fields, the resulting probability that intent — rather than geometry or equipment — explains the silence, and a pointer to the supporting observations. Risk teams can read the reasoning, challenge it, and override it. That is the difference between an alert and an argument.