# S8 — Red Vessel: Escalating Threat

> **Synthetic demo data only. Not based on real observations.**

## Scenario Summary

**Date:** 2025-07-03 · **Duration:** 8 hours (06:00–14:00 UTC) — *longest scenario*  
**Classification:** CRITICAL — IMO watchlist vessel, dual AIS-dark, MAC co-observation, 5-drone port approach  
**Ship:** MV KASPIYSK · MMSI 636092744 · Flag: Liberia · IMO: 9234567

---

## Narrative

MV KASPIYSK, an old bulk carrier with no Baltic port history, transits the Gulf of Finland
westbound on 2025-07-03. Its IMO number matches a Tier-2 watchlist entry immediately
flagging it for elevated surveillance.

**Stage A (06:00–07:30) — Yellow alert.** Ship enters international waters east of the Gulf.
IMO cross-match triggers automated alert. Course 270° direct toward Finnish coast with no
declared destination.

**Stage B (07:30–09:00) — Orange → Red.** Ship crosses the Finnish EEZ boundary unannounced,
ignores VHF hails, and decelerates from 9 kn to a full stop 18 km south of Helsinki. Finnish
Border Guard patrol plane tasked; visual confirms deck cargo under tarps inconsistent with
the declared ballast-only voyage.

**Stage C (09:00–09:30) — Pre-launch staging (smoking gun).** Ship holds position. Fifteen
minutes before launch, coastal MAC sensor MAC-HEL-COAST-01 detects the **DJI controller MAC**
`A4:83:E7:88:AA:01` at −68 dBm, followed by five drone boot-up MACs appearing sequentially.
AIS goes dark at 09:25.

**Stage D (09:30–10:15) — Swarm launch.** Five drones lift off simultaneously at 09:30,
climbing to 80–110 m and fanning out northwest toward Helsinki-area targets. Patrol plane
RAD-PLN-01 acquires all five contacts within 90 seconds. AIS briefly reappears at 09:35,
then goes dark again as the ship begins its south-bound departure.

**Stage E (10:00–11:30) — Intercept & exfiltration.** Border Guard patrol drone scrambles
from Helsinki-Malmi. D3 enters restricted airspace over Helsinki West Harbor approach. Ship
AIS reappears at 10:15 heading south at 11 kn. No intercept of the mother vessel.

**Stage F (11:30–14:00) — Departure.** Ship crosses EEZ boundary southbound at 11:30.
Fusion engine issues incident INC-S8-2025-07-03-001 with composite confidence 0.94.

---

## Drone Targets

| Drone | MAC | Target | Key event |
|-------|-----|--------|-----------|
| T-DRN-S8-01 | 5C:E2:8C:BB:01:01 | Espoo coast | Westernmost prong |
| T-DRN-S8-02 | 5C:E2:8C:BB:02:02 | Lauttasaari | Helsinki suburb approach |
| T-DRN-S8-03 | 5C:E2:8C:BB:03:03 | Helsinki West Harbor | **Geo-fence violation** |
| T-DRN-S8-04 | 5C:E2:8C:BB:04:04 | Helsinki center coast | Port-area approach |
| T-DRN-S8-05 | 5C:E2:8C:BB:05:05 | Kulosaari | Eastern flank |

---

## Satellite Forensics Images

Three synthetic satellite captures are included in `data/static/`:

| File | Timestamp | Content |
|------|-----------|---------|
| `satellite_01_vessel_holding.png` | 09:00 UTC | MV KASPIYSK stationary, no drones |
| `satellite_02_drones_launching.png` | 09:32 UTC | 5 drone contacts at vessel bow |
| `satellite_03_drones_dispersing.png` | 09:38 UTC | Swarm dispersing, vessel departing south |

---

## Data Files

| File | Format | Rows |
|------|--------|------|
| `data/realtime/ais.ndjson` | NDJSON | ~58k |
| `data/realtime/ais_decimated.ndjson` | NDJSON | ~10k |
| `data/realtime/ais_snapshot.geojson` | GeoJSON | ~600 |
| `data/realtime/drone_radar.ndjson` | NDJSON | ~6k |
| `data/realtime/plane_radar.ndjson` | NDJSON | ~7k |
| `data/realtime/mac.ndjson` | NDJSON | ~7k |
| `data/realtime/mac.csv` | CSV | ~7k |
| `data/static/satellite_*.png` | PNG | 3 images |

---

## Regenerating data

```bash
cd /path/to/r-mac-data-scenarios
python scenarios/08-red-vessel-escalation/generate.py
python scenarios/08-red-vessel-escalation/generate_images.py
```