On November 25, 2018, a large commercial cargo ship suddenly parked itself under the recently-constructed Crimean Bridge over the Kerch Strait, preventing three Ukrainian Navy vessels from reaching the Sea of Azov port of Mariupol. As they tried to turn back, the ships were pounced on by foreign military forces and - in the ensuing confusion - captured.

The event sparked international outrage at the time, but has since been viewed as a textbook example of a new generation of hybrid warfare, blurring the lines between military and unconventional conflict.

Coinciding with the Kerch Strait incident, Norwegian naval officer Commander Stian Schnelle submitted his graduate thesis to the Norwegian Staff College based on work he had completed in cooperation with the Naval Postgraduate School (NPS). He had applied a novel new maritime network analysis methodology developed by NPS’ Common Operational Research Environment (CORE) lab to identify maritime traffic engaged in “gray” activities - commercial vessels sailing under ulterior motives - to the security concerns of his native country.

With uncanny synchronicity, Schnelle’s thesis had identified a similar commercial gray maritime network of ships, owners and operators that could be employed to block the Kerch Strait – months ahead of the incident.

“I’m not making this up: the same week as he’s turning in his thesis, on the front page of the paper is this picture of a commercial tanker being used in a military context,” remarked Dr. Wayne Porter, CORE’s executive director and a retired U.S. Navy Captain. “I got an email from the Norwegians saying it was a really great proof of concept!”

Schnelle’s thesis received the Staff College’s highest marks, but it also garnered immediate attention in the Norwegian Armed Forces: commercial vessels under different flags, such as the one which blocked the Kerch Strait, had taken to regularly “loitering” outside military areas and events before continuing on their merry way.

Ships such as these are easy to track via Automatic Identification System (AIS) data - information ships transmit globally to avoid collisions. But systematically identifying how, when, why and where the gray maritime networks driving them operate has proven elusive - until now. Under Porter’s guidance, the CORE Lab had pioneered fusing AIS data with Social Network Analysis (SNA) to yield precisely this critical information.

“My concept was this: if we commonly use AIS data to track known bad actors anywhere in the world, why not apply SNA to this?” Porter explained. “Ships are big pieces of metal in the water intermittently broadcasting through AIS; if we can track where they are or what they’re doing as an indicator of something we’d be interested in, we can use that to point to who the owner-operator is, what cargoes they’re carrying, what ports they’re frequenting, what other activities they’re conducting, and suddenly we’ve just mapped an entire network, the gray maritime network that they belong to.”

NPS’ concept was picked up by the Norwegian Defense Research Establishment (Forsvarets forskningsinstitutt, FFI), which entered it in May for the innovation challenge at NITECH19, the NATO Communications and Information Agency’s fourth annual industry conference geared towards accelerating transformational technology solutions to NATO’s most pressing issues.

The joint NPS/FFI project - “Dual-use of AIS-data: Combining Historical and Live AIS Track with Social Network Analysis for Increased Maritime Network Awareness” - was awarded the most innovative technology, and NPS and FFI worked together to develop a formal pilot which could be fielded throughout NATO as an app to easily identify these networks.

“I was told there were 50 or 60 different entries from 11 different countries, and we won the whole thing,” said Frank Brundtland Steder, a principal scientist at FFI who exhibited the project. “Of course, being as diplomatic as possible, I had on my NPS tie, an FFI tie pin and Norwegian Navy cufflinks.”

“I couldn’t let slip the opportunity to highlight the good cooperation between us,” he added.

This cooperation is not happenstance, however, but rather reflects decades of dedicated partnership building between the Norwegian military and NPS. Steder himself was an NPS student in 2002 and the second foreign student to attend the university’s Defense Analysis (DA) department; the first was also a Norwegian naval officer. Since August 2014, FFI has consistently had a guest research scholar presence at NPS as well.

In the years since, Steder and his compatriots have continued to strengthen this relationship, particularly through FFI, which Porter described as the “Norwegian Rand Corporation.” Based on conversations with Porter about work CORE was doing, Steder had himself originally encouraged Schnelle to go to NPS when he expressed interest in exploring hybrid warfare at sea.

Established at NPS in 2007, CORE has a long history of applying the analytic methodologies of SNA to complex problems operators face in the field, from networks of insurgents and psychological operations to narcotics trafficking and money laundering.

The CORE Lab has generated a diverse range of studies directly advancing the capabilities of the military and government agencies, but they all have one thing in common: they’re focused on human networks.

“When I came into the DA department in 2015, I was the only Navy guy, so my sense was why aren’t we using this for maritime applications?” Porter recalled. “The department had done legions of work into dark networks, but none of it had been directed towards a maritime network, looking at ships, organizations, ports, cargoes, etc.”

As Director of NPS’ Littoral Operations Center, Porter obtained Naval Research Program funding to look at “reef enhancement activities” - the creation of artificial islands which potentially project military power - in the South China Sea. Working with social network analysts Rob Schroeder and Chris Callaghan, faculty associates for research in the CORE Lab, the project soon took off.

The team began by looking at AIS data: where ships were loitering and where they were co-located with other ships, based on tens of thousands of tracking points of supply ships, dredges, fuel barges and cargo deliveries.

Visualized, this looks “like someone spilled a whole bunch of Skittles,” according to Schroeder, but applying advanced mathematical techniques of SNA to a wealth of publicly-available data allowed relationship patterns to emerge between ships, companies and locations.

“We can identify a whole bunch of companies and other ships related to those companies that have been involved with some of the hybrid activities,” Schroeder noted. “We can further identify the central ports - and actual piers in those ports - that these ships and their owner-operators are using, as well as build a topography of other companies involved.”

Commercial vessels and their parent companies systematically supporting such activities - whether reef enhancement, loitering for intelligence collection, smuggling to circumvent international sanctions or other questionable activities - operate as only partially transparent networks for nominally above-board companies. In doing so, companies expose themselves to significant risk.

“These ships might be owned and operated by the same company and maybe not, but the bottom line is we use this co-location and ask why are commercial ships - these aren’t military ships - loitering in this area coincident with activity taking place and who are they?” Porter added. “If not illicit, these activities certainly are malign.”

The bottom line, according to Porter, is that illuminating these gray maritime networks opens the door to monitoring and/or disrupting them. In the case of the South China Sea, for example, were it determined that reef enhancement endeavors are in flagrant violation of the United Nations Convention on the Law of the Sea, participating ships and their publicly-traded major holding companies would now be facing costly sanctions.

It’s not just the South China Sea, however. The methodology the CORE Lab developed can be applied anywhere in the world gray maritime networks seek to operate.

When, in 2017, Porter met with Steder to socialize the CORE Lab’s work, its applicability to areas of Norwegian and U.S./NATO interest - the vast breadth of waters from the Baltic Sea to the North Sea and the “High North,” i.e. the Arctic - was immediately obvious.

“I was talking about using SNA for terrorist networks, better interdiction, etc. and [Porter] said ‘Why not do this on ships? We’ve just done this for the South China Sea and they found it very effective; let’s do something similar in the Baltics,’ and all of a sudden we were off,” Steder recalled. “Everyone agreed it was a great idea: it would help give us an objective-based platform across the board to basically see the same picture of suspicious behavior and act accordingly.”

Simultaneous to FFI starting to pursue the concept, Steder met Schnelle, who soon embarked on a path of study - supported by NPS’ CORE lab - to turn the idea into reality. Their joint innovative work would culminate in NPS and FFI’s recognition at NITECH19 and its potential implementation throughout NATO.

In a new era of Great Power Competition, forging new means like mapping gray maritime networks to effectively counter fluid threats and adversaries has become increasingly imperative. For Porter, the project’s success represents what NPS does best: directly advancing the warfighting capabilities of the United States and its allies and partners.

“This is a nice feather in our cap because people are starting to recognize that the operational aspect of what we’re doing here isn’t just academic,” he said. “We’re not doing this for academic kudos: the work the CORE lab has done in SNA, or more accurately, maritime network analysis, is far and away beyond anything that’s being done anywhere else, particularly for military operations.”