🛰️ Taiwan Gray Zone & Submarine Cable Monitor

Gray Zone Monitor Dark Vessels Articles 中

Cable Approach Early Warning

Trajectory Prediction • Pattern of Life • Unexpected Entries • Taiwan's Cables

In short

The site's threat scoring only sees a ship once it is already sitting next to a cable. The cable approach early warning aims to see it coming: from AIS archived July–October 2026, it tabulates how often ships in a given area, speed, heading and distance band went on to appear slow within 5 km of a submarine cable within 6, 12 or 24 hours (a pattern-of-life table). On the held-out test period, non-fishing 12-hour warnings reach an AUC of 0.84 and 23.5% precision in the top 1% — about 25× the base rate. An "unexpected entry" anomaly score highlights approaches that looked least likely beforehand. It currently runs in shadow mode and does not feed the score.

RELATED → Cable Threats Methodology What Is AIS What Is a Dark Vessel
In February 2023 both of Matsu's submarine cables were cut within a week, leaving 14,000 residents offline for about 50 days. In early 2025 cables off Keelung and between Taiwan and Penghu followed.

Each time, the AIS record was pulled up afterwards: the ship slowed over the cable, loitered, dragged. The question is — could we notice it before it arrives?

Why an Early Warning?

The site's threat scoring checks whether a ship has been within 5 km of a cable and whether it loitered there below 5 knots for more than 3 hours. These are after-the-fact indicators: the score only reacts once the ship has actually stopped next to the cable.

The cable approach warning moves the same event forward in time: for a ship that is currently at sea, more than 5 km from any cable and not in port, will it report a position "within 5 km of a cable, below 5 knots, not in port" in the next 6, 12 or 24 hours? The event definition is deliberately identical to the scoring, so what the warning says is coming is exactly what the score will later see.

0.7%
Merchant base rate, slow entry within 6 h
2.0%
Merchant base rate within 24 h
16 km
Median merchant distance before entry (p90 78 km)
7.8%
Fishing base rate within 24 h

The base rate is low: pick any merchant-ship position and the chance it appears slow beside a cable within 24 hours is just 2%. And merchant ships that do enter mostly come from far away — a median 16 km before entry, one in ten more than 78 km — so "how close is it right now" is not enough on its own.

The Model: a Pattern-of-Life Table

The intuitive approach is to extrapolate each ship's track in a straight line and see whether it crosses a cable. In testing this did worse than looking at the current distance alone — what ships do near cables is slow down, turn into port and wait at anchor, not sail straight on. The useful signal is "do ships in this patch of sea, at this speed, on this heading, usually end up here?"

So the model is a probability table counted from the archive:

Table keys P(entry | vessel group, 0.1° cell, speed bin, heading sector, cable-distance band)
Speed bins: <1 / 1–5 / 5–12 / ≥12 kn; heading: eight 45° sectors; distance: 5–10 / 10–20 / 20–40 / ≥40 km.
Sparse cells cannot be trusted, so the table uses hierarchical shrinkage: group → group×distance×speed → ×cell → ×cell×speed → ×cell×speed×heading, each level borrowing strength from the one above: p = (k + 10·pparent) / (n + 10). A cell seen once with one entry does not become 100%.

Fitting, threshold selection and testing are split in time (first 70% fits the table, next 15% picks the alert threshold, last 15% is reported), and one in ten vessels is held out entirely for testing so the model cannot simply memorise a ship.

Model comparison (merchant ships, test period, 12 h)

MethodAUCTop-1% precisionTop-1% recall
B0 current distance to cable only0.742.8%3.1%
B1 closest approach of the extrapolated path0.712.5%2.7%
M1 pattern-of-life table0.8422.8%24.7%

Merchant 12-hour base rate in the same period: 0.92%. Top-1% precision of 22.8% ≈ 25× the base rate.

Test Results

The production model first applies the same exclusion rules as the threat score (fishing-net beacons, invalid MMSIs and Taiwan-flagged vessels are left out), then is evaluated on the test period:

Non-fishingBase rateAUCTop-1% precision / recall
6 hours0.52%0.8918.1% / 34.6%
12 hours0.96%0.8423.5% / 24.4%
24 hours1.43%0.8126.6% / 18.6%

The alert threshold actually in use was chosen on the validation period as "the lowest threshold with non-fishing precision ≥ 20%": a 12-hour entry probability ≥ 0.12. On the test period at that threshold, precision is 18.4% and recall 33.9% — roughly one alert in five really does enter slow within 12 hours, and a third of all entries are caught.

Fishing vessels score an even higher AUC (about 0.91), but their base rate is high and their numbers large; listing them all would produce hundreds per run. Fishing vessels therefore join the warning list only when the threat score already rates them high or critical.

The Hotspots Are Not Noise: Waiting Areas Beside Cable Landings

List the grid cells where merchant ships most often entered slow in the archive, and nearly all are waters beside cable landings where ships wait to enter port:

📍
Off Tamsui / Taipei PortThe densest cell in the archive (2,445 entries).
📍
Fuao, Matsu1,337 entries; the waters of the 2023 double cable cut.
📍
Magong, Penghu990 entries; the landing end of the Taiwan–Penghu cables.
📍
Off Budai, Liaoluo Bay (Kinmen), 50 km off KeelungThe remaining major hotspots.

This means the warning list will always contain many routine waiting ships: ships waiting for a berth happen to wait next to cables. The warning only answers "will it come close", not "is the approach suspicious". Every warning therefore carries the ship's threat score and risk level, and the "unexpected entry" score in the next section separates routine approaches from unusual ones.

Unexpected Entries: Approaches That Didn't Look Likely

The "unexpected entry" score looks at approaches that have already happened: ships that are now slow within 5 km of a cable but were outside the zone (and not in port) 3 to 12 hours earlier. Going back to the moment the ship was still outside, it looks up the entry probability the model gave it then (prior_p). The lower the probability, the less the approach resembles routine waiting, judged by the history of that patch of sea, that speed and that heading.

A ship that has stayed inside the zone throughout is not a "fresh entry", so long-term anchoring does not trigger repeatedly.

171
Non-fishing fresh entries in the test period
0.105
Median prior entry probability
≈0
Prior probability at the 10th percentile

The lowest prior_p cases in the test period fall into two groups:

🚢
Beside the cables between Kinmen and XiamenSeveral Chinese merchant ships were 20–130 km away at speed 5–6 hours earlier, then suddenly slowed within 5 km of a cable. Historically, ships on that heading at that speed almost never stop there.
🛡️
A China Coast Guard ship beside a Matsu cableCHINACOASTGUARD14516 was 12.9 km from the cable 3.3 hours earlier, then slowed within 4.8 km of a Matsu cable (about 26.09°N, 119.76°E).
How to read it: a low prior_p only means "judged by historical behaviour, this approach is unusual". There may be entirely legitimate reasons (sheltering from weather, a change of port, instructions from shore), or it may merit a closer look at the track. It is a ranking tool, not a determination.

Live Trial

The warning is recomputed after every AIS update and written to cable_warnings.json (at most 100 warnings and 50 unexpected entries). Ships whose latest position is more than 3 hours older than the snapshot are not scored.

Trial run on 2026-10-24: 1,092 ships evaluated, 17 warnings issued. They cluster around flag-of-convenience tankers waiting off Penghu and slow cargo ships off Kinmen and Matsu — the very waters of the 2023 Taiwan–Matsu and 2025 Taiwan–Penghu cable breaks. Some of those ships are also rated critical by the threat score; many are simply waiting for a berth. That is exactly why the warning has to be read together with the score and the unexpected-entry score.

One production run after going live (2026-10-24 23:47 UTC): 1,600 ships scored, 21 warnings, 53 ships already slow beside a cable, 3 unexpected entries. Three observations:

Other Findings Along the Way

The cable warning is phase 2 of the site's trajectory-prediction work. The earlier phases (baseline models and a motion model for SAR dark-vessel matching) produced several findings worth recording:

🎣
For fishing boats, "stays put" beats constant velocity 3–7×At horizons of 6 hours or more, assuming a fishing boat stays where it is gives a median error of 6.7 km (8.3 km at 24 h); extrapolating its current velocity gives 18 km (62 km at 24 h). Fishing boats circle within a fishing ground, and a constant-velocity model pushes them out of it. The motion model therefore decays a moving fishing boat's velocity within about an hour, while merchant ships keep constant velocity.
🧭
Merchant ships' reported course is reliable; fishing boats' is notFor merchant ships, extrapolating the AIS-reported speed and course beats using the displacement between the last two positions; for fishing boats it is the reverse. The same field varies widely in quality by vessel type.
⏱️
The AIS "time" is not the fix timeThe Port Bureau feed's Record_Time is in Taiwan local time and lags the fetch time by 2.5–15 minutes (median 3.7). Treating fetch time as fix time misplaces a 12-knot ship by about 1.4 km on average — not negligible against kilometre-scale SAR matching gates.
🛰️
A looser matching gate makes dark vessels "disappear"Loosening the dead-reckoning gate for SAR matching makes more ships matchable on paper, but a full simulation (randomly turning 20% of ships dark) showed the share of dark vessels "claimed" by some other nearby ship rising from 10% to 52% — in a dense fishing fleet, any uncertain ship can explain a nearby detection. The stricter gate was adopted: wrong-ship matches 8.1% → 6.4%, dark vessels claimed 11.1% → 9.7%. Judging by "coverage" alone would have picked the wrong model.
⏳
The real bottleneck is snapshot spacing, and GitHub sets itThis site fetches AIS on GitHub Actions schedules. Two weeks of run history showed only 76 of 243 scheduled slots actually firing (31%), with no failures recorded — the platform simply dropped the schedule events. The archive's real snapshot interval has a median of 2.2 hours (p90 4.9 h); after switching to a heartbeat that dispatches runs, the heartbeat's own schedule was dropped just as heavily. At 2–3 hour spacing it is hard to tell ships apart in a dense fleet, which limits SAR matching and warning timeliness more than any model improvement.
🪤
Fishing-net beacons swamp the warningsIn the first version, the warning's "other" vessel group was almost entirely fishing-net beacons such as 321 12V2 and NETFISHING 7V7 (invalid MMSIs, voltage in the name). The warning and the threat score must share one set of exclusion rules, or the two disagree on what counts as a ship.
🔀
One MMSI is not one shipMany Chinese fishing boats share an MMSI, so positions under one number "teleport" between places. Tracks are therefore keyed by (MMSI, ship name) and split at gaps over 6 hours or implied speeds over 100 km/h; about 25% of archived positions are in port and are excluded from prediction error.

Data Limitations & Disclaimer

  • Warnings and unexpected-entry scores are leads to investigate, not factual or legal findings, and not an accusation against any named vessel.
  • The system runs in shadow mode: results are written to a data file only, do not feed the threat score, and are not yet shown on the map.
  • The high-scoring areas include a great deal of routine waiting beside cable landings; the warning list is not a suspect list.
  • Test-period alert precision is 18.4%: roughly four alerts in five do not enter slow within 12 hours.
  • The actual AIS snapshot interval is several hours, so a ship can enter and leave a cable zone between snapshots unseen; tracks are split at gaps over 6 hours and entries after such a gap are not counted, so positives are under-counted.
  • The model was fitted on July–October 2026 data and needs refitting when seasons, routes or port operations change.

This page is for research and education, aggregating public data under the MIT License. When citing, please attribute the source and note the limitations above.

FAQ

What does the cable approach warning predict?
Whether a ship currently more than 5 km from any cable will, within the next 6, 12 or 24 hours, report a position within 5 km of a cable, below 5 knots and not in port. These are exactly the cable-proximity and low-speed thresholds of the site's threat score; the difference is that the score only sees the event after it happens, while the warning looks ahead.
Why not extrapolate the track in a straight line?
Near cables, ships usually slow down, turn into port or drop anchor, which a straight-line extrapolation cannot capture. For 12-hour predictions on the test period, ranking by the closest approach of the extrapolated path gave an AUC of 0.71 — worse than the 0.74 from current distance alone — while the pattern-of-life table reached 0.84.
Does a warning mean the ship is suspicious?
No. The high-scoring areas are waiting waters beside cable landings — off Tamsui/Taipei Port, Fuao in Matsu, Magong in Penghu, Liaoluo Bay in Kinmen — and many warned ships are simply waiting to enter port. The warning only answers "will it come close"; whether that is suspicious has to be judged with the threat score and the unexpected-entry score.
What is an "unexpected entry"?
A ship that is now slow within 5 km of a cable but was outside the zone 3 to 12 hours earlier, scored by the entry probability the model gave it at that earlier moment. The lower the probability, the less the approach resembles routine waiting. The most unusual test-period cases include ships that were 20–130 km away at speed hours earlier and then slowed beside the cables between Kinmen and Xiamen, and a China Coast Guard ship slowing within 4.8 km of a Matsu cable.
How accurate is the warning?
For non-fishing 12-hour warnings on the test period, the base rate was about 0.96%; at the alert threshold precision was 18.4% and recall 33.9%, about 19× the base rate, and precision in the top 1% was 23.5%. In other words roughly one warning in five really enters slow within 12 hours, so human review is still needed.
Read the scoring methodology → ← Back to articles

Sources

The background and data on this page can be checked against these public sources:

This page is for research and education; warning signals are leads to investigate, not legal or factual findings. See the methodology.

Related gray-zone topics