When Ships Stop Moving: The Growing Intelligence Value of Maritime Anomalies

More than a dozen Iranian oil tankers and other vessels associated with Tehran’s shadow fleet have gathered in international waters off Sri Lanka. Many are reportedly empty. They are not loading cargo, discharging oil or conducting what would normally be understood as routine commercial voyages.

That is precisely why they matter.

The Financial Times reported on 26 August that the vessels have accumulated off Sri Lanka as the U.S. blockade increasingly restricts access to Iranian ports. Seventy-one merchant vessels have reportedly already been diverted, disabled or boarded during the blockade, while operations at Iran’s principal Kharg Island oil terminal have been heavily disrupted.

The concentration illustrates an increasingly important principle in maritime intelligence: movement is not always the signal. Sometimes the signal is that ships stop moving.

The Shadow Fleet Is No Longer a Fringe Fleet

Shadow shipping has expanded far beyond a small collection of ageing tankers operating around sanctions.

S&P Global estimated in July that vessels associated with shadow-fleet activity now account for approximately 22% of the global tanker fleet. The phenomenon has become sufficiently significant to tanker markets that Platts introduced dedicated shadow-fleet freight assessments in August.

Russia provides another indication of scale. The Kyiv School of Economics' July Shadow Fleet Tracker found that Russia used 325 different tankers to transport oil and petroleum products during June. Of those, 176 vessels, or 54%, were classified as shadow-fleet tankers. Their transported volumes were almost 25% higher than a year earlier.

Iran similarly relies on networks extending well beyond the vessel itself. On 25 August, the U.S. Treasury announced sanctions against more than 60 entities, individuals and vessels linked to Iranian oil, military procurement, cyber activity and associated financial networks.

Treasury described a system involving vessel brokers, ship managers, bunkering companies, financial intermediaries and frequently changing ownership structures across multiple jurisdictions. A tanker therefore cannot always be analysed as an isolated ship. It may be one node within a much larger economic and logistical network.

The Intelligence Is in the Behaviour

Traditional maritime monitoring naturally concentrates on where a ship is going, what it is carrying and when it will arrive. Increasingly, analysts also need to ask whether a vessel's behaviour makes sense for its declared commercial function.

A tanker sitting empty offshore may indicate congestion. Several associated tankers clustering in the same waters for an extended period may indicate something else entirely.

Their location, duration at anchor or drifting, previous port calls, ownership relationships, flag changes, AIS behaviour and subsequent movements can collectively reveal the impact of sanctions, military pressure or a disrupted supply chain before those effects become visible in conventional economic statistics.

The Sri Lankan concentration follows that pattern: movement, disruption, displacement, clustering and then strategic signal.

The vessels are important not because they have disappeared. They are important because they have accumulated somewhere they ordinarily would not.

That distinction matters. Maritime intelligence often focuses on suspicious movement, but abnormal inactivity can be just as revealing. A vessel that stops moving may be waiting for instructions, avoiding interdiction, preserving fuel, awaiting a transfer, concealing commercial uncertainty or responding to a wider geopolitical shock.

Once several related vessels begin behaving in the same way, the anomaly becomes more significant.

It Is Not Just Tankers

The same analytical problem is appearing across very different parts of the maritime domain.

Russian fishing vessels operating around European waters have generated concern that ostensibly commercial platforms may also support surveillance or mapping of critical maritime infrastructure. In the South China Sea, large concentrations of Chinese fishing and maritime militia vessels can create physical presence and political pressure without conventional naval combat.

Research vessels collecting legitimate oceanographic data can simultaneously produce information with military utility. Merchant vessels can change names, flags and ownership structures while continuing to serve sanctions-evasion or trafficking networks. Small craft can appear commercially insignificant yet form part of sophisticated narcotics supply chains.

These are different phenomena and should not be treated as equivalent. But they increasingly present the same analytical challenge: the vessel's declared identity may explain only part of its actual function.

Criminal trafficking illustrates the scale of the problem. The UN Office on Drugs and Crime estimates that more than 90% of cocaine quantities seized globally in 2023 were associated with maritime trafficking.

Individual interdictions can involve enormous volumes. On 22 August, the U.S. Coast Guard intercepted a vessel approximately 50 miles south of Puerto Rico carrying approximately 7,250 pounds of cocaine, valued at about $54.5 million. Five people were detained.

The broader point is not that a shadow tanker, fishing vessel, research ship and drug boat belong to the same category. They do not.

The point is that maritime analysts increasingly need to judge vessels by what they do, not simply by what they are registered as.

From Tracking Ships to Reading Maritime Systems

This is where maritime situational awareness increasingly needs to move beyond dots on a map.

A vessel's position is data.

A vessel unexpectedly stopping is information.

Twenty related vessels unexpectedly stopping in the same geographical area may constitute intelligence.

The analytical value lies in identifying the deviation from expected behaviour and then connecting it to the wider geopolitical, economic or criminal environment.

That is why AIS alone is insufficient. Ownership records, sanctions designations, port calls, draught changes, ship-to-ship transfers, corporate connections, historical movement patterns and periods of apparent inactivity can all form part of the same picture.

The maritime domain is increasingly populated by vessels whose legal identity, commercial purpose, cargo, ownership and strategic function do not always align neatly.

The Iranian tankers sitting off Sri Lanka provide a timely example. They are not simply ships waiting offshore. Their collective inactivity is a visible consequence of a much larger confrontation involving sanctions, military power, energy flows and maritime geography.

For businesses, ports, insurers and governments, this matters because the operational impact often appears first in behaviour, not in official statements.

Sometimes, understanding what is happening at sea begins with a surprisingly simple question:

Why has that ship stopped?