Mapping Gray Maritime Networks

Relational analysis in maritime domain awareness

Traditionally, MDA has focused on intelligence, surveillance, and reconnaissance of activities at sea with limited cross domain link analysis of events, carriers, and sponsors (Wallace and Mesko, 2013). While data are routinely collected on the attributes (non-relational characteristics) of agents and stakeholders which might be helpful in traditional analysis (such as vessel type, activities, and cargoes in order to generate a risk score), less attention has been paid to the collection of relational data. Commercial shipping networks have been analyzed through regional shipping patterns (Ducruet et al., 2010), global shipping patterns (Ducruet and Notteboom, 2012), cruise ship itineraries (Rodrigue and Notteboom, 2013), and the logistics involved in global shipping (Ducruet and Lugo, 2013). Yet, little quantitative, relational research has focused on analyzing illegal or gray commercial shipping networks.

Collection, archiving, and analysis of relational data have recently been accelerated through algorithmic searches designed to sort large data sets from dynamic, open source (maritime, news, and other) databases (Robins et al., 2007; Hays et al., 2010; Franzese et al., 2012). Traditionally, link analysis1 has been used to query and visualize the contents from large databases. SNA, on the other hand, focuses on relational ties among agents (e.g., individuals, organizations, events, locations). Further, it provides metrics for network analytics (e.g., eigenvector centrality, density, clustering, cohesiveness/structural holes) not possible with link analysis (Granovetter, 1973; Watts, 2004; Kadushin, 2012; Prell, 2012; Borgatti et al., 2013; Freeman, 2016).

This research explored how SNA and open source data integration from existing databases may be applied to any nefarious (gray or dark) maritime network, providing the ability to geo-locate and track stakeholders and nodes in these networks in physical and virtual space. This would significantly improve our ability to disrupt these networks either through direct (e.g., interdiction) or indirect (e.g., financial sanctions and/or diplomatic influence) means. Further, the statistical basis for social (maritime) network analysis provides the means to assess countermeasure effectiveness by dynamically measuring changes in the network over time.

Beyond the identification of this network, we sought to track structural network changes over time. Krebs (2002), in his analysis of the network responsible for the 9/11 terrorist attack, argued that while less active dark networks are difficult to discover, even these covert networks have goals to accomplish prompting them to become more visible. This dilemma of coordination/efficiency versus concealment appears to be a predominant concern for covert organizations (Baker and Faulkner, 1993). Networks are dynamic entities, which undergo endogenous or exogenous changes over time, making temporal analysis essential to the understanding of their evolution. As Wasserman et al. assert, ‘the analysis of social networks over time has long been recognized as something of a Holy Grail for network researchers’ (Wasserman et al., 2005, p. 6).

For their part, academic researchers and analysts have leveraged temporal network data to examine the relationships between network structure and performance. Everton and Cunningham (2014) use network level metrics – namely average degree, centralization, and fragmentation – as indicators of network activity and security. Others have proposed methods for modeling panel data such as stochastic agent-based models (Snijders, 2001, 2005; Snijders et al., 2010), social network change detection (SNCD) (McCulloh and Carley, 2011), or variations of the exponential random graph models (ERGMs) for social networks, such as temporal ERGMs (TERGMs) (Hanneke et al., 2010) or separable temporal ERGMs (STERGMs) for discrete-time modeling (Krivitsky and Handcock, 2014). While we foresee the possibility of revisiting our data set to test hypotheses concerning endogenous and exogenous variables, this research focused on exploratory descriptive analysis of network-level metrics as indicators of change in network activity over time, for instance temporal analysis of the connections between ships. The ability to longitudinally assess the metrics associated with the relationships between ships, their owners/operators, and their cooperative activity is critical for network analysis as well as for predicting future activity and network associations. To that end, our network topography metrics included:

• Average degree: the average number of connections per node.

• Global clustering coefficient: indicates the likelihood of clusters, or closed triads, within the network.

• Degree and betweenness centralization: both measures indicate how centralized the network is at any given time by measuring variation in the betweenness and degree scores of all vertices in the network. A highly centralized network in terms of degree or betweenness centrality may indicate a star-like typology. Here, one or a few actors lie at the center of the network because they are highly interconnected to others within the network or because they lie along more shortest paths than do other vertices.

Furthermore, because ships operating in the vicinity of the Spratly and Paracel Islands and reefs of the South China Sea are connected by large, medium, and small ports, it was imperative to not only look at the vessels themselves, but the network of locations they visited. It is important to note that when looking at the port-to-port network, the links connecting these locations are directed (e.g., when a ship departs a port, the location’s out-degree is increased; when a ship arrives in port, the location’s in-degree is increased). Our analysis was rooted in the understanding that some ports exhibit a ‘hub-like’ (Kleinberg, 1999) structure in the broader global maritime industry. Furthermore, even as new ports are added to the network, well-transited locations will more likely continue to attract linkages simply due to preferential attachment (Barabási, 2016). In practical terms, this is to say that some ports represent hubs since they are visited more often by Chinese vessels due to their strategic and/or economic value. The locations most often connected to these traffic hubs represent authorities.

Finally, we turned our attention to the set of owner/operator companies or organizations that are associated with the vessels involved in reef enhancement activities in the South China Sea. The concept of network ‘embeddedness,’ the degree to which the behavior of economic institutions within a network is constrained or enabled by their level of connection or isolation from other organizations (Granovetter, 1985), has been explored by several scholars in relation to organizational and social systems (Granovetter, 1973; Uzzi, 1997, 1999). Our analysis focused on the collection of companies and organizations associated with the vessels involved in terra forma activities in the area of interest. In order to systematically address the role of actors within this network, we turned our attention to the notion of structural holes and brokerage. Burt (2005) argued that organizations positioned aside structural holes are in an advantageous position because they separate non-redundant sources of information and resources. As such, we analyzed the connections between companies in order to identify their level of constraint, a measure that captures how redundant a node’s ties are (Burt, 1992). The more structural holes a node spans, the lower a node’s constraint.

Mapping the networks: data collection, tidying, and structuring

The foundation of our analysis relied primarily on historic geospatial ship tracking data from November 2014 to November 2015. This case study identified 314 vessels that were directly participating in or supporting reef enhancement activity in the Spratly or Paracel Islands claimed by the People’s Republic of China or were routinely working with vessels involved in such activity during the research window2. The geospatial data were generated from each ship’s automatic identification system (AIS). Each record provided information about the ship, the Maritime Mobile Service Identity (MMSI) number, an International Maritime Organization (IMO) number, speed over ground, time stamps, and coordinates. The quality of these records was mixed. While some contained all the aforementioned fields, others failed to include full records. In order to pare down and standardize this large volume of information, students in the Operations Research Department at the Naval Postgraduate School performed significant data manipulation to filter, visualize, and analyze the historic AIS tracks for the geographic area of interest.

The majority of these ships, 164, were cargo types (bulk carrier, cargo, refrigerated cargo); 42 were Chinese Coast Guard or other Chinese law enforcement vessels; 24 were tugs or pilot boats; 22 were offshore supply or research vessels; 18 were dredgers, salvage vessels, or other specialized ships; 9 were tankers or fuel carriers; 5 were fishing vessels; and, the remaining 30 were either classified as ‘other’ or are of unknown type.

To identify owner and operator companies, we cross referenced the MMSI or IMO number against various shipping databases. However, it is important to point out that not all the 314 ships provided the same amount of publicly available information. Of the 314 ships, only 83 broadcasted a valid IMO number, which is a unique reference number for ships that was created as part of the International Convention for the Safety of Life at Sea. When the IMO number was present, additional information was gathered using the Tokyo Memorandum of Understanding’s Port State Control database (Asia Pacific Computerized Information System, 2017) and Lexis Advance Research database (LexisNexis, 2019). Where there was no IMO number, additional information related to ownership and operations was found using the Marine Traffic database (Marine Traffic, 2017) and open source data from Chinese sites translated with Google Translate (Google, 2017). Information about a company’s parent company was collected using Lexis Advance Research database.

Finally, in order to compile a list of relevant Chinese ports, we used the World Port Index (National Geospatial-Intelligence Agency, 2017) and Marine Traffic database. Information on Chinese occupied islands in the Spratlys and Paracels was collected from the Asia Maritime Transparency Initiative mapping project (Asia Maritime Transparency Initiative, 2017).

The relationships between sets of actors aforementioned were recorded through one-mode and two-mode, square matrices that included relationships tying ships to other ships, companies to other companies, ships to companies, and ships to locations. Table 1 provides a brief description of these relationships as well as a brief description of how the matrices were recorded.

Table 1.

Relationship codebook.

From the two-mode matrices previously noted, we derived one-mode matrices in the standard way. The following subsections expand on our analysis of three networks:

1. Ship-to-ship network: a temporal network of ships tied to each other based on co-location at terra forma sites.

2. Location-to-location network: a weighted directional network containing locations within the South China Sea relevant to the gray network involved in terra forma activities.

3. Company-to-company network: a network of companies associated with the ships involved in the activities aforementioned.

Analysis of the ship-to-ship network

In this network, ship clusters formed around the different islands/reefs in the area of interest. Here, isolated nodes represent ships travelling in the South China Sea with no co-occurrences detected. Table 2 includes temporal metrics of the ship-to-ship network that grew or shrank over time, as the number of ships co-located in the vicinity of the reefs/islands increased or decreased.

Table 2.

Temporal network level metrics.

Relationship	Type	Definition
Ship co-location	One-mode	For each month, a ship-to-ship network was created by determining whether the ships were co-located within 3 km of each other at the same time based on route trajectories (excluding major ports)
Ship at location	Two-mode	A ship was considered to be arriving at a port or island if it broadcast an AIS location within a certain distance threshold (five nautical miles). If a ship’s location was determined to be within the threshold for multiple ports, the closest port was considered its destination
Ship to company	Two-mode	A ship was tied to a company when a company was listed as the ship’s owner, operator, document compliance company, manager, or technical manager
Company to company	One-mode	A subsidiary company was tied to its parent company

The trends of each measure are unpacked in detail below, followed by a series of figures illustrating the network at three time periods (Fig. 1 – February 2015, Fig. 2 – April 2015, Fig. 3 – November 2015):

• Average degree scores: these increase over time starting at T0 but begin to decrease at T12. While this trend is closely paralleled by the network size, it also indicates time periods when vessels of interest (VOIs) increased their traffic flow to major locations (see next section). Figure 1 plots a network (T3) where average degree is relatively low; in contrast, Figure 2 plots another (T5) where average degree is relatively high.

• Clustering coefficients: the clustering coefficient overall was relatively high. This is due to the fact that some ships remained anchored for significant periods of time at the islands where reef enhancement activity took place. Simply, having three or more ships located in the same location at the same time resulted in many complete triads in the network. Periods with lower clustering correspond with time periods when there is less concentration of activity among the central hub islands. Figures 1 and 2 reflect high clustering, while Figure 3 reflects low clustering.

• Degree centralization: degree centralization ranges from 0.103 to 0.206. High degree centralization indicates time periods when specific vessels are highly active and possibly interacting with a large number of vessels. Figure 2 captures a time period with high degree centralization – where one tugboat (largest node in yellow) travels to and from the islands of Subi Reef, Fiery Cross Reef, and Mischief Reef, and also travels back to the port of Yangpu.

• Betweenness centralization: betweenness centralization is generally low for the entire time period indicating that no key vessel in the network is playing a brokerage role on its own. Betweenness centralization was highest is February 15. During this time period (see Fig. 1), the vessel with the highest betweenness centrality is a tugboat (yellow in Fig. 1) that traveled frequently between the three major islands in the network (Subi Reef, Fiery Cross Reef, and Mischief Reef).

Figure 1:

Figure 2:

Figure 3:

Analysis of the location-to-location network

The transit routes for the ships in the sample set were analyzed in order to identify ports or islands visited from November 2014 to November 2015 (Fig. 4). Connections between the vessels and various ports and reefs, based on their travel routes, were created between the different destinations. For example, the bulk carrier Wu Chang Hai travelled from the port of Basuo to Subi Reef, from Subi Reef to Fiery Cross Reef, and then from Fiery Cross Reef to the port of Tianjin Xin Gang. This resulted in the following directed connections: Basuo→Subi Reef→Fiery Cross Reef→Tianjin Xin Gang.

Figure 4:

To identify prestigious nodes within this directed network, hubs and authorities scores (Kleinberg, 1999) were computed. A location’s authority score was computed in order to determine where reef enhancement activity was concentrating, and a hub score was calculated in order to identify which locations were serving as major connection points for vessels. The top 10 for each score are shown in Table 3. There was not much difference in the order of locations between their hub and authority score. The top 4 islands for both hub and authority scores were made up of Mischief Reef, Fiery Cross Reef, Subi Reef, and Johnson Reef South. The close relationship between islands’ hub and authority scores can be explained by the fact that while construction continues on them, they are simultaneously being used as hubs to build up other reefs.

Table 3.

Top 10 hubs and authorities.

Time	Period	Size	Edges	Average degree	Average clustering coefficient	Degree centralization	Betweenness centralization
T0	November 2014	34	41	2.412	0.422	0.103	0.013
T1	December 2014	24	36	3.000	0.561	0.159	0.043
T2	January 2015	36	107	5.944	0.578	0.133	0.035
T3	February 2015	48	201	8.375	0.708	0.181	0.072
T4	March 2015	75	469	12.507	0.691	0.154	0.032
T5	April 2015	82	781	19.049	0.711	0.206	0.048
T6	May 2015	99	898	18.141	0.657	0.138	0.026
T8	June 2015	122	1,451	23.787	0.698	0.168	0.042
T9	July 2015	124	1,087	17.532	0.661	0.174	0.044
T10	August 2015	97	768	15.835	0.687	0.143	0.051
T11	September 2015	90	845	18.778	0.729	0.183	0.035
T12	October 2015	70	694	19.829	0.730	0.178	0.023
T13	November 2015	67	464	13.851	0.614	0.163	0.036
T14	December 2015	62	400	12.903	0.694	0.151	0.053
T15	January 2016	68	402	11.824	0.700	0.153	0.033
T16	February 2016	53	318	12.000	0.677	0.206	0.023
T17	March 2016	39	153	7.846	0.653	0.205	0.067

The ports of Sanya of Basuo were within the top 10 for both hub and authority scores, indicating that these ports are important in terms of getting supplies to the Spratly Islands. Both these ports are located in the large island province of Hainan in the south of China.

Analysis of the company-to-company network

In order to focus on the company network of the owners and operators of the vessels associated with terra forma activities, we took the two-mode network of ships connected to these companies and created a company to company network based on shared involvement with the same ship. We then added information connecting co-involved companies to their parent organizations. The resulting networks are shown in Figure 5, with the network on the left highlighting the involvement of Chinese Government entities (orange nodes), while the network on the right depicts the same network with Chinese Government nodes removed.

Figure 5:

Organizations that are explicitly a part of the Chinese Government (such as the different branches of their Coast Guard and the Ministry of Transportation Bureau) play a central role in reef enhancement activities in the South China Sea3. The Chinese Government is not the only key collection of entities with vessels that have been supporting the reef enhancement activities. After removing Chinese Government entities, the resulting network (Fig. 5, right) highlights the interrelated companies that own or operate VOIs and are sized by their inverse constraint (because companies with low constraint lie in an advantageous position for brokerage). The companies with the least constraint are shown in Table 4 along with the color of the component to which the they belong.

Table 4.

Top 10 companies with lowest constraint.

Top 10 hubs	Hub score	Top 10 authorities	Authority score
Fiery Cross Reef	1.000	Mischief Reef	1.000
Johnson Reef South	0.698	Fiery Cross Reef	0.682
Mischief Reef	0.683	Subi Reef	0.567
Subi Reef	0.660	Johnson Reef South	0.513
Hughes Reef	0.406	Gaven Reef	0.380
Gaven Reef	0.366	Hughes Reef	0.369
Sanya (Port)	0.352	Sanya (Port)	0.289
Second Thomas Reef	0.346	Cuarteron Reef	0.219
Cuarteron Reef	0.190	Second Thomas Reef	0.164
Basuo (Port)	0.128	Basuo (Port)	0.102

The largest component, colored red in Figure 5 (right), contains 25 companies and has at its center the China Communications Construction Company, Ltd (CCCC), which is the parent company to many of the vessels involved in reef enhancement activity in the South China Sea. CCCC is the company with the lowest constraint and likely plays a large brokerage role between its various subsidiaries. Some of these subsidiaries (CCCC Tianjin Dredging Co Ltd and CCCC Shanghai Dredging Co Ltd) also play an important brokerage role in the network. Overall, this subgroup contains 34 vessels (13 dredgers, salvage vessels, or other specialized ships; 11 offshore supply or research vessels; and 10 tugs or pilot boats). It is noteworthy to point out that this subgroup of companies owns the majority of dredgers in our sample set and is directly connected to the Chinese Government (Fig. 5, left).

The second largest component, colored blue in Figure 5 (right), contains 21 companies and is made up of two large conglomerates – the China Ocean Shipping (Group) Company (COSCO) and China Huaneng Group. This collection of companies is connected to 15 ships, all of which are bulk carriers, that traveled two and from the Spratly Islands.

Findings and conclusions

In this case study, we identified 314 Chinese vessels that are assessed to have engaged in dredging, terra forma, or reef enhancement operations in the South China Sea. Principally, these vessels are involved in the construction of artificial land formations in the Spratly and Paracel Islands, Mischief, Subi, and Fiery Cross Reefs. The vessels are collectively owned by as many as 170 different companies/entities, some of which are parents or subsidiaries of one another. Initial research that identified links between reef enhancement vessels and their holding companies was conducted and illustrated. Specific companies of interest were then evaluated by examining two different structural characteristics of the network: the subgroups based on components within the network and each company’s brokerage potential. Companies that might play a brokerage role (by connecting nodes within company to company sub-networks) were identified by measuring their constraint.

Using commercially available geospatial and temporal data, our research team was also able to develop a network of homeports for dredging and support vessels. This information enables more robust analysis of current and future network activity. The outcomes from this analysis suggest not only the potential to anticipate future terra forma activity in the South China Sea but to leverage the information gathered on commercial shipping companies to facilitate enhanced money-tracking and better informed sanction regimes against the large, publicly traded holding/operating companies whose assets are contributing to potential UN Convention on Law of the Seas (UNCLOS) violations. For instance, if sanctions are pursued in response to violations of the UNCLOS, such actions may not be taken against the government of the People’s Republic of China, but rather against those companies supporting the illicit activity. Since many of these companies are State Owned Enterprises, their activity places the PRC and their investors at great risk.

We conclude from our research experience, that depictions of the maritime networks (such as network visualizations of operating areas and ports visited associated with specific VOIs) could, with relative ease, be integrated into existing Maritime Domain Awareness platforms such as SEAVISON. This would significantly contribute to an enhanced awareness of specific ship affiliations and activities. Additionally, this information could contribute to predictive analysis to determine where impending reef enhancement activity may begin.

Recommendations for further research

In order to better identify locations important to a given maritime network, AIS data can be analyzed to identify finer patterns through more detailed and sophisticated geospatial analysis, that can again be combined with network analysis of the relationships between locations, ships, and companies. This approach can also be applied to other areas involving maritime networks, including networks related to illegal, unreported and unregulated fishing (IUUF), maritime arms and narcotics trafficking, piracy and other types of gray maritime activity. The ability to identify and track the activity of malign networks is critical to the enforcement of international maritime law, law enforcement activities, and issues related to sovereignty, including intrusions into Exclusive Economic Zones. Further research could therefore focus on anomaly detection of erroneous or deliberately misleading AIS data and on filtering algorithms to separate VOIs from ships routinely operating in highly trafficked areas. Such research, is currently ongoing in the Baltic Sea and high Arctic region, and there has been interest expressed in applying this analytic methodology to other state-supported and criminal maritime networks.

Disclaimer

The views expressed in this paper are those of the authors and do not reflect the official position or policies of the United States Navy or the Department of Defense.

Name	Constraint	Component color
China Communications Construction Company Ltd (CCCC)	0.162	Red
Shenzhen Ocean Shipping Co Ltd (COSCO SHENZHEN)	0.275	Blue
CCCC Tianjin Dredging Co Ltd	0.309	Red
China Huaneng Group Co Ltd	0.321	Blue
China COSCO Shipping Corp Ltd	0.328	Blue
CCCC Shanghai Dredging Co Ltd	0.331	Red
COSCO Shipping Seafarer Mgmt	0.355	Blue
Tianjin Cosbulk Ship Mgmt	0.361	Blue
ICBC Financial Leasing Co Ltd	0.367	Blue
COSCO Bulk Carrier Co Ltd (COSCO BULK)	0.368	Blue