Windward Intelligence; Customer Jobs

In this course, you will read about the customer jobs and expected outcomes that typically characterize the users of Windward Intelligence.

Section 1: Introduction; Maritime Surveillance and Situational Awareness

Read: Maritime Surveillance and Situational Awareness

Our end-users are responsible for achieving Maritime Situational Awareness (MSA), defined by the IMO as “the effective understanding of anything associated with the maritime domain that could impact the security, safety, economy, or environment”.

In today’s reality, which is no longer about navy vs. navy but more about criminal and terrorist threats, nations seek to develop an accurate and timely understanding of what is happening at sea that may affect national interests domestically and internationally.

While some of our end-users (navies and coast guards mostly) are responsible for building and constantly maintaining MSA 24/7, (with a persistent methodology), others might be responsible for ad-hoc operations, e.g., in a certain area, for a limited time or for specific vessel types e.g., only fishing vessels.

To achieve MSA and enable prevention, protection and response to potential threats, nations increasingly invest in setting up maritime surveillance capabilities to produce the information needed. However, while having integrated surveillance (combining sensors, such as AIS, LRIT, radars, VMS, …) is often perceived as having situational awareness, there is still a gap between having the data and being able to find the answers you need and to act on it, making them ‘data rich but information poor’.

The Windward claim to fame is that situational awareness is achieved when you have effective understanding, i.e., the ability to easily and quickly find what you care about, which can only be achieved when you have the right technology to support the analyst.

The need for such tools for surveillance is even more acute since there is an inherent paradox – the more sensors you have, the more you are drowning in data. While some of our customers are at the stage of obtaining sensors and others at the stage of obtaining tools to harness all the data, they all share the same problem – gaining effective understanding of what’s actually happening at sea.

Windward Intelligence provides a unique and superior Situational Awareness capability, one which has unique data about ship activities – global, historical, continuous, verified, and searchable – together with dedicated automatic tools to assist human analysis with the jobs of targeting, investigation and monitoring.

Windward Intelligence is built to reflect the needs of end users who carry out the following five different customer jobs.

SURVEILLANCE - the collection and processing of tracking information on vessel movements and actions using various sensors and methods

MONITORING - the analytic process in which the data is interpreted to assess the situation - type, scale and scope - in a certain area

TARGETING - is based on the information provided in the process of surveillance resulting in the profiler pointing to a vessel and saying "this one".

INVESTIGATION - the process of quickly collating accurate, relevant and comprehensive historical data to provide a context – or background – to what is happening now in the Maritime Domain. The purpose of the investigation is to provide a risk assessment about the current situation, to speedily facilitate decision-making.

DISSEMINATION - the sharing of information generated by the system, and knowledge preservation within the organization over time, so it can be utilized by other stakeholders now or in the future.

Maritime Situational Awareness

  1. Our end-users are responsible for achieving (MSA).
  2. Maritime Situational Awareness is defined by the IMO as “the understanding of anything associated with the maritime domain that could impact the security, safety, economy, or environment”.
  3. There is a gap between having and being able to get answers to your questions.


  • The more sensors you have, the more you might be drowning in data.
  • The more data you have, the clearer the maritime picture is.
  • Windward data is unique.
  • Windward data is historical and ongoing, global, verified, comprehensive and searchable.

Windward Data is....

  • global
  • refuted
  • attainable
  • historical
  • continuous
  • extended
  • verified
  • invalidated
  • searchable

Five User Jobs - Definitions

    the collection and processing of tracking information on vessel movements and actions using various sensors and methods
    the analytic process in which the data is interpreted to assess the situation - type, scale and scope - in a certain area
    is based on the information provided in the process of surveillance resulting in the profiler pointing to a vessel and saying "this one"
    the process of quickly collating accurate, relevant and comprehensive historical data
    the sharing of information generated by the system

Section 2: User Job: Surveillance

Read: User Job: Surveillance

You can find the material for this section in a previous post in Blogin by following this link: User Job: Surveillance. Read the material and then do the following tasks.

Surveillance: Introduction

Surveillance is the of information.

Surveillance is not a goal, but rather a in the process of achieving Maritime Situational Awareness.

The aim of maritime surveillance is to collect as much about vessels as possible.


Levels of Surveillance

  • detection
  • classification
  • identification

Define the levels of surveillance.

  • Detection is
    the ability to detect an object at sea, without the ability to say anything about what type of vessel it is, its size or its identity.
  • Classification
    is assigning to the vessel a type.
  • Identification
    provides the identity of the vessel (vessel name).

Write at least four types of sensors.


  • Given the high costs involved in surveillance, there are always compromises based on priorities versus available resources.
  • Agencies may limit surveillance to narrow areas and limit their duration.
  • Agencies focus only on ad-hoc missions.
  • Every agency prioritizes their choice of sensors based on their budget and according to their national needs.
  • Sensors are oriented to real/near-real time, and have almost no ability to record and store historical information.
  • Extracting historical data is limited and complicated, extremely labor-intensive and time consuming
  • Surveillance provides information about who is doing what and why they are doing it.

The Surveillance Job Story

When I want to know in an area of interest at sea, I want to be able to detect every in that area, along with what it has been doing, so I can provide stakeholders with about things that can impact security, safety, economy or environment.

To be able to detect every vessel in that area, along with what it has been doing, I need to …

  • Minimize
    the latency of target data updates, number of undetected targets, and time to collect information on a target.
  • Increase
    coverage, accuracy and the amount of identification and positional information about targets.

Persistent vs ad-hoc surveillance: what's the job?

  • For persistent surveillance, the job is to ensure, daily, that all existing sensors are maintained and active, that the data created is received by the system operators, and that the operators are skilled in processing and interpreting the data.
  • For ad-hoc surveillance, the job is to make recommendations about routine deployments, based on the situational awareness needs defined by decision makers.
  • Ad-hoc surveillance can't be carried out on board vessels

The Windward Iintelligence Value to Surveillance

  • Windward Intelligence provides reliable, persistent, global surveillance.
  • Historical data is available for only the past 60 days.
  • On a national level, Windward Intelligence can also serve as an classified, shareable platform
  • Windward Intelligence displays not only where vessels are, but what activities are being carried out by vessels.
  • Windward Intelligence includes unique data that has not been previously available to organizations.
  • The data is cost-effective, affordable, and risk-free.

Section 3: Targeting

Read: User Jobs: Targeting

As the word indicates, ‘targeting’ is the process in which the identity of a new, previously unknown target is first ascertained. Simply put, targeting - as a job - ends once the identity of a potential target becomes known to the analyst.

This process can work in one of two ways.


Using available prior information, analysts want to identify a specific target. In this case, the organization already has information about a vessel, and the analyst job is to identify this vessel in order to decide if they need to take action.

“We have information from other sources about an unidentified Syrian vessel, known to be engaged in smuggling, which left port Mersin in Turkey three days ago, and possibly transshipped offshore Cyprus the night after, and is currently on its way to Cartagena, Spain”.

 The targeting itself within the total process of an intelligence analysis, is the culmination of all the efforts and therefore the crucial stage of the process which can lead directly to action. The stage of identifying the specific target may be the final piece of the puzzle once a substantial body of intelligence and evidence is already in place.

Given the importance of being able to identify the target, analysts assigned this case might recommend aerial or maritime patrols in the region, they might request human assets to gather more information at the port in Turkey, or set an intelligence gathering requirement for the interception of satellite communication signals in the relevant area. These are expensive, time consuming and possibly risky options, but ones that are highly prioritized given that the target has already been established as interesting.

Targeting based on prior information often includes information about events that have already taken place (e.g., ‘vessel left port Mersin three days ago’). To say the least, it's quite complicated, if not impossible, to extract historical surveillance data and conduct analysis about past events, e.g., Who were all the vessels that entered Mersin over the past month? Which ones were not detected leaving port over that time? etc.


Using a predefined risk profile, analysts base their efforts on the sum of properties and behaviors of a vessel that interests them, and that can be applied to search vessels in a given area, to find vessels that match the profile.

When targeting is based on a risk profile, there may be no specific target in mind, so authorities must constantly monitor the given area for vessels that match the risk profile. Once they identify a match, the vessel can be designated suspicious and they can decide whether to take further action.

“We know that small cargo vessels that originate in China, sail to Croatia and visit our port might be engaged in the smuggling of exotic foods”.

The profile in the above example is; small cargo vessels, originating in China, sail to Croatia, visit our port and using this profile, the task is to monitor the area for any and all vessels that match those criteria.

It's important to emphasize that targeting is not only about vessel tracking - location and activities - but can also include additional factors - from ‘basic’ properties such as flag or year built, through suspicious past actions or associations, such as visits to North Korean ports, and even ownership structure related to a known Mafia family in Sicily, as a result of using the same lawyer as beneficiary owner, etc.

The leads generated by profiling may create a fair number of false leads, requiring the organization substantial resources to handle. As such, ‘more leads’ isn’t always a good thing; ‘more qualified targets’ is preferable.

Nevertheless, targeting based on profiling can be very accurate when needed. For example, it can identify targets based on regulations and VOI (Vessels of Interest) lists such as the following examples.

Since our regulations state that ‘only registered, Argentinian-flagged vessels can fish less than 20 miles from shore', all others are 100% offenders, and can be targeted for action.

In addition, specific, well established risk indicators can be translated into a precise profile such as,

‘Old cargo vessels coming from Venezuela or Colombia, stop offshore West Sahara for less than 12 hours and then enter my waters’.

 In the past, this was a manual, time consuming task, requiring a great deal of human resources. In the best case, some targeting is done using geofencing, using enter and exit activities only. Since this is labor intensive and manual process, it leads to many shortcomings and compromises.

  • It's impossible for a human operator to catch every vessel everywhere in the national waters, and when the operator does notice and flag a suspicious vessel, precious time has been lost.
  • Perhaps the main flaw in this method is that it is performed on a small scale and limited scope, and not systematically; only some vessels are screened, and only for their recent behavior.
  • Targeting based on risk profiling is, in many cases, reliant on the operator’s knowledge, level of skill and motivation, introducing bias and inaccuracy into the process. Perhaps one operator knows that a vessel stopping in certain area is suspicious because three years ago a vessel displaying similar behavior was caught smuggling. The operator taking the next shift may have no knowledge of the three-year-old incident, so he will not flag the current event for further investigation.

Current practices of risk profiling depend mainly on properties such as flag and size rather than on behavior of the vessel. Because profile-based targeting is currently based on a very simple mechanism to flag potential targets, organizations may struggle in adopting stronger tools for targeting (such as Windward Intelligence) because they may be unaware of the potential of using behavioral risk indicators. For example, the Chileans look for high-risk vessels ‘sailing a flag belonging Muslim nations’, but not vessels that have actually visited or operated in those countries.

The process of targeting is rarely a clear-cut, 100% accurate identification of an offender, but rather the generation of a lead which requires further investigation to determine its status and perhaps collect evidence.

Job Story




When I assess risk in the maritime domain, I want to be able to identify specific targets and events which may pose risk, so I can start investigating and assign additional surveillance assets.

A Day in the Life of an Operator (Targeting Based on Risk Profiling)

Operators can be required to identify potential targets as part of their day-to-day surveillance and monitoring work, based on risk profiles they receive from intelligence…

Operators in the Peruvian Navy attempt to detect vessels heading north and stopping offshore a certain region in the northern part of the country, because they might be engaged in drug smuggling.

… or on local regulations as we mentioned above.

'Vessels may only anchor in the official Port Waiting Area, hence any vessel that anchors elsewhere is by definition an offender.'

While operating the national Command and Control system, along with MarineTraffic and other surveillance assets, operators might come across vessels that match a risk profile. From what we’ve seen, operators mostly happen to stumble over them, rather than proactively seek them.

The exception is Fisheries VMS analysts, who actively seek vessels that are possibly conducting illegal fishing, and they are often assisted by some level of alerts for geofencing (enter/exit).

Some organizations may have protocols to establish a more robust framework of conducting risk profile-based targeting, either for vetting events that take place in national waters or for screening incoming vessels. For example, The South African Fishing Ministry (DAFF) targets and investigates any foreign fishing vessel which enters their EEZ, and if needed, they recommend inspections at port and can even request a navy patrol vessel for interdiction.

A Day in the Life of an Analyst (Targeting Based on Prior Information)

As part of an ongoing intelligence effort related to a certain challenge, arena or affair, analysts may be tasked with identifying a potential target. This is target-based intelligence work, since the ongoing investigation provides the analyst with prior information so he/she can uncover the identity of a vessel which is hypothesized to exist.

This is commonly a process of elimination, in which a ‘pool’ of potential targets is inspected according to existing leads, and the pool is narrowed until there is an even smaller number of vessels which can be designated as a watch list (i.e., a VOI List), to be effectively tracked and investigated until the identity of the offender become clear.

The analyst has intelligence leads pertaining to the targets, and will need to collect and analyze surveillance data in order to try and identify them. As this process is built on surveillance-generated data, the ability to extract past information is very limited, and poses one of the main bottlenecks in the process.

Upon identification of a target, it can be further investigated by the analyst as part of the overall intelligence analysis, and can also be used to enrich the database of risk profiles that the organization uses to detect other similar targets (if relevant).


Windward Intelligence fundamentally changes the way targeting is conducted in an organization, both in real time and historically, in three main ways.

  1. It introduces a whole new spectrum of targeting, one that is based on behavior profiles, something organizations today are not equipped to do (except for limited some geofencing, but certainly not complex activity patterns of behavior such as Windward Intelligence provides).
  2. The automatic and flexible Rule Engine breaches the limitations of scope and scale, enabling analysts to apply customized rules systematically and continuously, to detect anything and anyone that matches the risk profile, anywhere in the world, both present and past. The organizational knowledge, as defined as rules in the Rule Engine, is preserved in the system over time, generating alerts and creating continuity of method.
  3. As an automatic process Windward Intelligence is more accurate, faster, and cost-effective, saving analyst and operator time, allowing them to focus on what they do best - investigate and assess risk.

Windward Intelligence enables customers to be less vulnerable by achieving total targeting capability, flagging any and all suspicious events and potential targets further investigation, completely independently, 24/7. Rather than sampling a limited number of vessels to monitor, the Rule Engine continuously searches - throughout time and globally - all activities defined as suspicious.