Watching what lies beneath.
MARVIS is a maritime monitoring system that reads radar satellites and ship tracking to find unusual behaviour near subsea cables and pipelines. We tested the first version in hindcast against two confirmed European incidents, and version two is in development.
Europe runs on cables and pipes under the sea.
Power, gas and data cross the North Sea and the Baltic on the seabed. A ship that switches off its transponder near a cable can go unseen by systems that rely on AIS alone.
MARVIS combines open satellite radar with ship tracking and scores the behaviour around each corridor.
What it reads.
- Sentinel-1 radar
- ESA Copernicus, interferometric wide swath. Finds ships that do not broadcast their position, through cloud and darkness.
- BarentsWatch AIS
- Ship positions in the Norwegian economic zone from the Norwegian Coastal Administration, through an open API.
- Havbase and Kystdatahuset
- The Norwegian coastal vessel register and historical tracks.
- Danish Maritime Authority AIS
- Baltic and North Sea positions as daily files, 24 hours behind.
- CMEMS TOPAZ4 and ERA5
- Currents and sea state from Copernicus Marine, wind and waves from ECMWF.
- Sanctions lists
- EU, US OFAC, UK and Swiss lists of sanctioned vessels and owners.
How it works.
- Detect
- A constant false alarm rate detector finds vessels in Sentinel-1 backscatter, including those with their transponder off.
- Fuse
- A Kalman filter joins radar detections with AIS tracks, the vessel register, ocean models and weather into one track per ship.
- Score
- Seven hypothesis classes are scored with Bayesian posteriors against sanctions lists and the distance to each configured corridor.
- Keep the risk
- Each vessel carries a risk score that decays with a 30 day half-life when no new signal arrives.
- Sign
- Alerts carry SHA-256 evidence chains and Ed25519 signed bundles, in a format designed to meet the NIS2 notification rules.
Seven classes of behaviour.
Three of them, temporal escalation, AIS tamper detection and the cross-basin pattern, are new to civilian maritime surveillance.
- Shadow fleet
- Vessels and owners matched against EU, OFAC, UK and Swiss sanctions registers.
- Ghost ships
- Manipulated AIS identities and spoofed transponders.
- Corridor threat
- Behaviour near a cable or pipeline, scored by distance and pattern.
- Regional traffic
- Deviation from the normal traffic of a fleet in a region.
- Dark ships
- AIS silence: a warning after 30 minutes, critical after 120.
- Temporal escalation
- Five levels of persistence for an incident, kept in a 30 day log.
- AIS tamper detection
- Positions that imply impossible speeds, such as more than 1,000 knots, flag a spoofed track.
- Cross-basin pattern
- The same vessel seen in two or more basins within 30 days.
In figures.
- 5
- Layers in the inference pipeline
- 7
- Classes of behaviour scored
- 2
- Confirmed incidents tested in hindcast
- 25
- Corridors configured in four basins: 7 in the Norwegian zone, 8 in the Baltic, 5 in the North Sea and 5 in the Mediterranean
- 3
- Hypothesis classes new to civilian maritime surveillance
Built and tested in hindcast. Not watching the sea today.
The first version of MARVIS built the full pipeline and was run in hindcast against two confirmed incidents: the Nord Stream pipelines on 26 September 2022 and the Eagle S and Estlink 2 cable on 25 December 2024. Each run produced a signed evidence bundle. These are back tests, made after the events were known.
Version two builds detection on pairs of Sentinel-1 images six days apart, from Sentinel-1A and Sentinel-1C, and aims at forward validation over one cable or pipeline corridor with a pilot partner. Notification to authorities runs in simulation only. Outside the Norwegian economic zone, ship positions come from Danish daily files, 24 hours behind.
Who it serves.
We are looking for a pilot partner among maritime authorities and operators of cables and pipelines to run the forward validation of version two with us.
Write to us- National maritime authorities.
- Operators of subsea cables, pipelines and power links.
