Concealing Illicit

Trade

SAND2018‐13263 TR and SAND2019‐9320 C

Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a
wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under
contract DE‐NA0003525.

Overview of UNSCR 2371

• In response to two
intercontinental ballistic missile
tests in July 2017, the UN Security
Council passed a ban on exports of
minerals from DPRK, including coal
• Resolution 2371 also requires
Member States to seize and
impound vessels smuggling
restricted commodities to DPRK
DPRK Coal Trade
• The United States estimates
that the coal trade generates
up to 1 billion USD in revenue
per year for the DPRK
• DPRK’s coal trade industry has
proven ties to government
involvement, with the vast
majority of revenue diverted
toward funding the military,
nuclear missiles, and weapons
programs
The Bai Mei 8 loading coal at Nampo, North Korea on July 6, 2017

Identified Deceptive Shipping Practices

• High‐risk ports of call
• Unique identifier manipulation
• IMO, AIS, MMSI
• Relation to sanctioned entities such as Syria and DPRK
• Previously de‐flagged, reflagged, flag hopping or unknown flag
• History of illicit shipments (e.g. drug smuggling)
• Crew (or other affiliated persons) associated with sanctioned entities or illicit
activities
Identified Deceptive Shipping Practices
Ship Movements and Evasion Patterns
• Visits to questionable ports or to ports within
proximity
• Loitering in and around port waters
• Concealing ports of call
• Indirect routes
• Detours
• AIS deactivation and manipulation
• Suspect draft changes

Automatic Identification System

• Automatic Identification System (AIS) is a vessel‐
tracking system that transmits a vessel’s identification,
position, course, and speed via a shipboard
transponder
• Transmits data to nearby ships and shore stations to
monitor vessel movements
• Required on international ships 300 gross tonnage and
all passenger ships*

Image source: http://www.shipspotting.com/gallery/photo.php?lid=1167937

* Required by SOLAS Chapter V, Reg. 19

AIS Manipulation
Primary Methods:
• Disable AIS
• Mask movement to conceal the origin or
destination of cargo
• Manipulate AIS
• Alter unique identifying information on
AIS
• Adjust telemetry to modify location
• Disguising vessels as smaller vessels
(fishing vessels) and utilizing class B AIS
systems

Which organization monitors

maritime traffic in your country?

Maritime Mobile Service Identity

• Considered a unique identifier for the vessel
• Number linked to a ship for use in the GMDSS (a maritime distress system)
• First three digits are the country identifier
• Remaining six digits are the vessel identifier
• Worldwide record maintained by the International Telecommunications Union (ITU)
• MMSI number is transmitted by AIS
Falsifying Cargo and Vessel Documents

• Iran falsifies vessel and cargo document to

obscure the origin or destination of cargo
• Bills of lading
• Certificates of origin
• Invoices
• Packing lists
• Proof of insurance
• Lists of lasts ports of call

What is the International Maritime

Organization (IMO) number?
• The IMO number is made of the three letters ‘IMO’
followed by the seven‐digit number assigned to all ships
by IHS Fairplay when constructed.

• The IMO Ship Identification Number is a unique seven‐

digit number assigned to propelled, seagoing vessels of
100 gross tons and above. The number is assigned by
Lloyd’s Register – Fairplay Ltd. on behalf of the IMO
IMO Number Checksum
• The last digit of the IMO is a check digit to
quickly determine if an IMO number is
valid
• If the first six numbers are known, there is only
one possible seventh number
• The checksum is for vessel built after 1991
• To determine the last digit, multiply the
first digit by 7, the second digit by 6, and so
on then add the number together and the
final digit is the last digit
• For example, what should the last number
be for IMO 793731 ͟
• (7*7)+(6*9)+(5*3)+(4*7)+(3*3)+(2*1)=157
• So the full IMO number is IMO 7937317

Voyage Deviation

Common Obfuscation Practices:

• Disabled AIS during transport
• Modified commodity origin documentation
after loitering outside ports
• Concealed coal shipment schemes
• DPRK transshipped coal through Russian ports
• Concealed coal origin to Vietnam
Case Study: Hao Fan 6

• The 1718 Committee Panel of

Experts found the Hao Fan 6 was The Hao Fan 6
violating sanctions by and its routing
history, with
transporting coal, prohibited by obvious AIS
UNSCR 2375 manipulation
• AIS behavior indicative of
sanctions violations
• Associated vessels, Hao Fan 2 and
Hao Fan 3, also possessed
suspicious AIS logs

Global
Communications Co.
Case Study
Front Companies

• The majority of the enterprises’ shares are owned by local citizens, while the
names of their North Korean partners only appear in difficult‐to‐obtain company
registration documents
• As legitimate incorporated companies, they can open accounts in local banks,
from where funds can be transferred across the globe
• Front companies use the tactic of layering to launder money, as well as to obscure transfers
to prohibited banks in Pyonyang
• Front companies can channel funds from the sale of an illicit commodity to evade financial
restrictions imposed by the UN, as seen in the next case study

Glocom: Background

Crypto‐
• Air shipment of military communication speaker
equipment bound for Eritrea from microphone
China, intercepted in 2016 and box

• Seized equipment included 45 boxes of

battlefield radios and accessories
labeled “Glocom” software
defined radio
(bottom)
Glocom: Background

• Glocom sells military radio

communications products
• Claims to be Malaysian company; all
contact and website information point
to Malaysia
• However, Glocom is not a registered
company and is not located at the
purported physical address

Stamp features the acronym

“NKPY‐PAN” for North Korea
Pyongyang‐Pan Systems

Glocom Illicit Trade Network

From UN 1874 Panel

of Experts Report
(Feb 2017)