By Robbin Laird
A September 2026of digital storytelling from The Conversation, built by researchers at the University of Sydney and the National University of Singapore’s Centre of Maritime Studies, traced the life of a single tanker called New Konk. Built in Japan in 1991 as an unremarkable cargo vessel, it was by 2019 operating as part of North Korea’s shadow fleet, the network of aging tankers that keeps sanctioned oil flowing into North Korean ports despite more than a decade of UN restrictions. The ship’s story is worth unpacking not simply as a sanctions-evasion narrative but as a case study in what maritime domain awareness looks like when the target is actively trying to defeat it.
An old ship learns new tricks
New Konk’s transformation followed a recognizable pattern. It stopped broadcasting its own identification numbers and began transmitting the International Maritime Organisation (IMO) number and Maritime Mobile Service Identity (MMSI) of another vessel, the Mouson 328, a technique the shipping world calls vessel identity laundering. Because the real Mouson 328 had since been re-registered under a new MMSI, New Konk was free to borrow its old one. To make the deception hold up under visual inspection, the ship pulled into a Chinese shipyard for a paint job, swapping a red deck for a green one and taking on the new name F.Lonline along with yet another MMSI.
By 2023, researchers tracking the ship documented a more elaborate maneuver: New Konk went dark in the East China Sea while its Automatic Identification System (AIS) transponder kept broadcasting a fabricated position hundreds of miles away, a route that had the “ship” crossing from the East China Sea into the Taiwan Strait, jumping implausibly to the South China Sea, and back again. Satellite imagery told a different story: the vessel had never left its staging area near Ningde, China, before sailing north to the North Korean coast to conduct a ship-to-ship oil transfer under cover of darkness.
The ship’s operational life appears to have ended sometime in late 2023, when it broke down and was moored in North Korean waters awaiting repairs it may never have received. Its last AIS broadcast, in mid-2025, was almost certainly another vessel spoofing its identity rather than New Konk itself. As is common for these ships, its final trace was not a physical sighting but a fraudulent electronic signature, a fitting end for a vessel whose entire second life was built on borrowed identities.
Why this is a domain awareness problem, not just an enforcement problem
It is tempting to read this as a sanctions-enforcement story: North Korea evades, the UN Panel of Experts documents, member states are legally obligated to act, and China’s Security Council veto blunts consequences. All of that is true.
But underneath the politics sits a harder technical problem that will outlast any particular sanctions regime: how do you maintain a reliable picture of activity across a maritime domain when a meaningful fraction of the traffic in it is actively lying to you?
This is precisely the problem that maritime domain awareness architectures and the broader security web, deterrence web and kill web concepts were built to address. AIS was designed as a collision-avoidance and traffic-management system, not a security sensor, and it fails as a security sensor exactly the way any single, self-reported data source fails: it is trivially spoofable by an actor with something to hide. The North Korean shadow fleet’s operators understand this better than most. They are not defeating radar or overhead imagery; they are defeating a reporting protocol that the rest of the world has come to treat, by default, as ground truth.
The fix, as the researchers themselves point out, is not a better single sensor but a fused one, that is, satellite imagery cross-referenced against AIS broadcasts, ship dimensions and silhouettes matched against claimed identities, port-call histories and ownership records layered on top of track history, and increasingly, machine learning applied to the resulting dataset to flag the behavioral signatures of identity laundering and dark-transfer loitering before a human analyst would catch them by hand.
That is a kill web in miniature: multiple sensors of different types, cued against each other, feeding a fusion layer that produces a track the adversary cannot simply switch off. It is the same logic that underpins allied efforts to build a persistent, multi-domain picture of contested air and maritime space, the difference here is that the “targets” are commercial hulls rather than combatants, and the payoff is interdiction or sanctions enforcement rather than kinetic effect.
The enforcement gap is real, but it is also a data problem
The article is honest about the limits of what better tracking can accomplish. Coastal states are obligated to deny sanctioned ships entry to shipyards and ports, and to prevent oil transfers within their exclusive economic zones, but China’s tolerance of shadow fleet activity along its coast and its veto at the Security Council means enforcement depends heavily on political will that is often absent. Some states have moved to physical interdiction: American vessels boarding Russian-linked tankers carrying Venezuelan oil, and British and European naval forces doing the same with Russian shadow fleet ships in home waters. Boarding, though, is a last resort that scales poorly; it cannot be the primary method for policing a fleet believed to number up to 750 vessels, most of which will never sail anywhere near a willing enforcer’s coastline.
That scaling problem is exactly where a persistent, automated, allied-shared domain awareness picture earns its keep. If the signature behaviors of identity laundering, a ship’s dimensions not matching its claimed MMSI, a track that loiters in a known staging area before a documented transfer window, a paint job that changes a hull’s visual signature between two satellite passes, can be codified and flagged automatically across a shared, allied-accessible database, the enforcement question shifts from “can we find the ship” to “what are we willing to do once we have.” That is a much better problem to have, and it is one that plays to the strengths of the kind of maritime AI and pattern-recognition work now maturing commercially, not just within national intelligence services.
The broader lesson
North Korea’s shadow fleet is the pioneer of this tradecraft, but it is no longer the only practitioner. Russia has built a comparable fleet to move sanctioned oil since 2022, and Iran uses similar methods against the US blockade on its ports. The techniques — MMSI spoofing, IMO number reuse, paint-and-rename makeovers, GPS falsification — are converging into a shared playbook precisely because they work against a global tracking system that was never designed with an adversarial user in mind.
The researchers behind the New Konk investigation describe their work as a “giant game of cat-and-mouse,” with the enforcers perpetually a step behind. That is the right way to think about it, and it is a familiar framing to anyone who has watched the evolution of contested-domain sensing in the military sphere: single-sensor pictures degrade under determined spoofing, and the only durable answer is a networked, fused, increasingly automated one that treats deception itself as a detectable signature rather than a gap in coverage.
The New Konk’s decade-long career of borrowed names and painted-over hulls is a small story about one aging tanker. It is also a precise illustration of why maritime domain awareness, like its counterparts in the air and land domains, is moving from a single-sensor discipline to a kill web discipline and why the states and companies building that fused picture first will be the ones setting the terms of the next round of this game.
Drawing on: Justin Hastings, Keramat Hasani, and Puay Guan Goh, “We tracked a North Korean dark ship — here’s how it stays in the shadows,” The Conversation, September 4, 2026.
The Transformation of Maritime Domain Awareness: Why the Old Model No Longer Works