MT Kerala Hijack – Game Changer or Inside Job?

Was she the innocent victim of Nigerian maritime criminals operating at a range previously unseen, or was she part of an elaborate plot to fake a crime and illegally sell over $10 million of refined fuel product? How did a 75,000 ton ship manage to leave its anchorage without any communication and what role did the suspicious vessel that Dryad tracked south from the Niger Delta to the vicinity of Kerala play in the reported hijack?

In the following article, Dryad’s Director of Intelligence, Ian Millen, explores all known facets of the Kerala incident; from the initial intelligence reports of the suspect vessel heading toward Angola to the disappearance and later release of the Kerala off the Niger Delta, presenting Dryad’s analysis of the events of January 2014.

MT Kerala goes missing

In the early hours of 18 January 2014, MT Kerala left her long-term anchorage off Luanda without any notice. There was no indication to mark the departure of the vessel; no AIS, no form of VHF or telephone communication and, importantly, no SSAS alarm to draw attention to a possible criminal event. Having departed the anchorage, the vessel’s location became unknown and Dynacom Tankers Management reported her missing, feared hijacked. But the news was met with emphatic disbelief by some, notably an Angolan naval spokesman, Captain Augusto Alfredo, who disputed Dynacom’s version of events, stating that the ship’s crew had disabled communications on purpose to fake a pirate attack. The spokesman went on to say that there was “no piracy in Angolan waters.”
At Dryad, the news was met with far less scepticism, with our initial, and continuing, assessment being that this was indeed an act of piracy and not a crew conspiracy, although only wider and deeper investigation could prove any crew involvement in the act itself. Refined product cargo theft is a common feature in the Gulf of Guinea, although such an attack so far south would be unprecedented.

Refined product cargo theft

Nigerian-based criminals have been conducting such intelligence-led crime in the anchorages and areas offshore Gulf of Guinea for some considerable time. This crime relies upon good preparation and planning as well as a fair degree of knowledge regarding maritime operations, from navigation and communications to operating ships’ machinery. The gangs involved are highly organised, if not well disciplined, and make great efforts to remain undetected for the duration of the crime through the disabling of communications and navigation aids, as well as physical deception in the form of re-painting IMO numbers, vessel names and other distinguishing features to avoid being identified by those searching for the missing ships.

Whilst the number of incidents has steadily decreased over time, there has been a countervailing increase in the range at which such attacks are taking place, bringing the waters of a greater number of nations and vessels into the threat envelope of maritime criminals. From its geographical origins off Nigeria, we have watched refined product cargo theft firstly move steadily westward, to waters off Benin, Togo and Ivory Coast and then southward as far as Gabon – the most southerly attack until MT Kerala being that against MT Cotton off Port Gentil, Gabon in July 2013.

The Kerala hijack in January 2014 represents the greatest range at which such an attack has taken place, making Angola the sixth nation state in West Africa to have fallen victim to this type of crime. Interestingly, whilst Ghana sits between Ivory Coast and Togo, where cargo theft has taken place, there is no known report of such crime taking place in its waters; a possible reflection of better security in its anchorages and port areas. Wherever the criminals have struck, one common factor is the fact the forced navigation of vessels to waters off the Niger Delta for illegal offload and gang exit ashore on completion. This not only confirms the origins of hijackers, but shows the crime to be an extension of the significant crime against onshore oil infrastructure in support of the black market trade in fuel.

Suspicious Vessel

In the days leading up to the hijack of Kerala, a Dryad source was reporting that an unknown vessel was heading south with criminal intentions. Initially reported some 120 nautical miles southwest of Port Gentil (Gabon) on 15 January, the vessel moved further south toward Angola and was only positively identified by a second source on 19 January in the waters off Luanda, having been noted present in a restricted area. By this time, although not reported by the owners or Liberian flag state, MT Kerala had already been hijacked. When the news broke on Kerala, it became clear to Dryad’s technical analysts that the suspect vessel, a 200 ton tug, was involved in active deception to mask its identity. This strengthened the assumption that the vessel had been used as a Mothership, transporting the criminals almost 900 nautical miles from Nigeria to Angola. Subsequent tracking of the tug as it returned to the Niger Delta region, suggested that we were witnessing an attempted cargo theft operation. Whilst MT Kerala remained silent, it was assessed that she was not far away from the tug and likely heading for an illegal ship-to-ship (STS) transfer operation offshore Nigeria.

Dryad’s Actions

Throughout all of the above, Dryad’s clients were warned of the possible threat posed by the suspect vessel and, where necessary, redirected away from its location. Before confirmation that the source was credible and correlation that the information was correct, such warnings were, by necessity, general in nature. Once the threat was positively identified, more specific intelligence was produced and shared with client vessels and authorities, such as the IMB who were fed new intelligence by Dryad as it happened. The very nature of intelligence means that it is not always precise enough to prevent every incident, but it is often good enough to heighten awareness and act as a first layer of defence. This was the case with Dryad’s clients who were warned and prepared.

The Release

On 26 January, Dynacom Tanker Management announced that MT Kerala had been released, having been subjected to hijack and cargo theft to the west of Warri (Niger Delta). They further reported that almost 13,000 metric tonnes of gasoil had been stolen and that a crew member had been injured during the hijack. Despite this news, a large swathe of the shipping industry remained sceptical, as well as Angolan sources who still believed this to be some form of crew conspiracy. Highly experienced mariners questioned how a ship with 27 crew could be taken from an anchorage without the alarm being raised by SSAS, VHF or a simple mobile phone call – a reasonable question unless, like Dryad, you have seen this happen on numerous occasions with other vessels in similar circumstances.

Anatomy of a cargo theft hijack

Dryad’s analysis of similar events confirms that the well-prepared criminals use stealth to good effect, quietly boarding, normally anchored, vessels in the middle of the night when almost all the crew are asleep. Initiative is gained by the use of surprise, as they move undetected and conduct an armed assault on the bridge, traumatising unsuspecting bridge crew who are unable to raise the alarm before being under criminal control. Once in control of the bridge, communications and AIS are normally disabled and next steps are taken to round up the rest of the sleeping crew, including the ship’s master, and engine room watchkeepers. In addition to disabling communication, the pirates, whose group includes specialist expertise in the navigation and operation of ships, will go to great lengths to avoid detection once underway or during STS ops, altering the ship’s name and IMO number and sometimes altering the colour scheme of distinguishing features, such as the ship’s funnel. Once offshore Niger Delta, the criminals will make use of a smaller tankers to offload a portion of the vessel’s cargo before escaping ashore to their bases, often leaving behind a traumatised crew. Throughout the offload operation, the criminals will also ensure that the victim crew do not identify the offload vessels by using their own team to conduct the transfer ops whilst keeping the ship’s crew under control and out of sight.


In Dryad’s view, there is little doubt that Kerala was hijacked from its Angolan anchorage by Nigerian maritime criminals as there is both circumstantial and other evidence to suggest this is so. From the movements and actions of the suspicious vessel before and after the hijack date to the statements made by the ship’s operators and Liberian Registry after the ship’s release to the additional intelligence on what took place on board Kerala between 18 – 26 January 2014, it is clear that this particular brand of maritime crime has demonstrated significant and worrying reach into areas hitherto considered to be safe. Whether this latest event emboldens the criminals for other operations at such ranges remains to be seen, but this audacious attack has shown that the capability exists to do so, despite the emphatic denial by some who continue to believe that this was a crew conspiracy and not a criminal act.

Dryad’s approach in mitigating risk and reducing the likelihood of attack on its client vessels begins with the process of education. When foundation knowledge of the threats and capabilities of criminals is lacking, complacency can set in and vessels can be taken unexpectedly. Knowledge of crimes, such as the fate that befell the crew of MT Kerala, can only be the first layer of defence in combatting such crime if we believe it happened in the first place. Dryad firmly believes that the Kerala hijack was a game changer and not an inside job. Whilst we don’t expect an epidemic of similar crime at such ranges from the Niger Delta, all involved in trading in the region would do well to note this incident and take measures to guard against the possibility of being the next victim.