the ship channel broadcasts to anyone with forty dollars of radio

My dad named the tug before my laptop did. I had a dipole taped to my mom's kitchen window, painter's tape, because she has opinions about scotch tape on glass, and the laptop was pulling in AIS from the channel, eight or so miles away, when he leaned over my shoulder, looked out past the fence, and said the vessel turning at the bend was a tug pushing a barge. Twenty seconds later the decoder printed the label and the label agreed with him.

It was a Saturday visit home. On the table next to the plastic cover my mom keeps on everything sat a $40 USB radio stick, an RTL-SDR Blog V4, and my laptop. Twenty minutes after plugging it in, the screen showed the Houston Ship Channel, tanker by tanker: names, positions, headings, speeds, drafts. The same water my dad worked beside for thirty years as a machinist, broadcasting itself to anyone with forty dollars of radio and a window.

the part everyone gets wrong

People hear "software defined radio" and picture a hacker toy, exploits, movie stuff. The V4 is the opposite of that, and the opposite is the review. It's a receive-only device. There is no transmit path in the hardware at all. What it does is listen, and listening turns out to be the bigger scandal, because the ships aren't hiding anything.

AIS, the Automatic Identification System, is the VHF broadcast that commercial vessels carry, and the standard's own write-up says it "offers essentially no security". No authentication. No encryption. Every couple of seconds while underway, a ship states who it is, where it is, how fast, which way, and how deep its hull sits in the water. That last number is draft, and draft is cargo. A loaded tanker sits lower than an empty one, and my dad read that column the way I read a log line: heavy, light, turning for the dock. He did it from thirty years of watching the channel, no radio required. The broadcast just put his eyes on a screen.

Here's the thing I keep coming back to. This is the same shape as a network protocol designed on trust, and everyone involved knew better by 2014. Researchers at Trend Micro, Marco Balduzzi, Alessandro Pasta and Kyle Wilhoit, published a security evaluation of AIS at ACSAC that December showing spoofing, hijacking and availability attacks: fake vessels, false positions, traffic that shore-side tracking displays accepted as real. I'm not going to walk through any of the how, because that's published research you can read and because transmitting on those frequencies without a license is illegal. The point survives the redaction: the system ships every claim unsigned, and the port runs on the assumption that nobody lies on the radio. Receive-only is the whole lesson. It lets you see exactly how much critical infrastructure is still built on the honor system.

what the stick actually is

The lineage explains the weirdness. RTL-SDR sticks started as TV tuner dongles, built around the RTL2832U demodulator chip, until people noticed the chip would hand over raw samples of almost anything. The V4 is the fourth hobbyist revision of that accident: an R828D tuner, a built-in HF upconverter, a 1 PPM temperature compensated oscillator, and a software switchable bias tee for powered antennas. It launched in August 2023 at $29.95 dongle-only and $39.95 with the antenna set, free shipping, which is the price of two lunches.

AIS runs on two VHF channels, 161.975 and 162.025 MHz per ITU-R M.1371, the spec I read instead of an app, and decoding it is a solved problem. The setup is a driver, a decoder, and a chart plotter, and then the channel appears on your kitchen table. Two traps worth naming. First, the V4 needs updated drivers; the old V3 drivers won't work with it, and I know exactly how long a person can blame a good antenna for a driver problem, because that was me, for about an hour, in my mom's kitchen. Second, placement matters more than price. The dipole legs taped to the window outperformed everything else I tried, because VHF at ground level is line of sight and ships carry tall antennas.

I should admit how long this took me. I'd owned the V4 for two years at that point. Weather satellite passes, aircraft positions, all the usual. It took me until a Saturday in my parents' kitchen, eight miles from the water, to point it at the channel my dad has worked next to since before I was born. The distance from my homelab to that screen was two years and one pair of painter's tape.

where it breaks

The product itself is going extinct. Rafael Micro stopped making the R828D chip, the V4 ran on stockpiles, and that stockpile is now exhausted; the last obtainable chips were faulty, so no more V4 batches are possible. The V3 stays in stable production, and the V4L Lite, $37.95, carries the same architecture on the R828S chip with two inputs instead of three, less filtering, slightly better sensitivity, and its own driver update. If you want a V4 specifically, resellers may still have limited stock, and here's the part that should make a security person smile sideways: there are fake V4 listings on marketplaces, V4-shaped enclosures with V3-clone guts inside, sometimes not even that. Buy from the resellers' list on the official store page. Counterfeit supply chains for a forty dollar receiver. The trust problems go all the way down, and the dongle is the small one.

The protocol is the big one, and it's not fixable by the buyer. AIS was designed in a world where the threat model was "ships cooperate for safety", and the design is intact. Any decoder hears everything. Any display trusts everything. The 2014 researchers showed what that means with a transmitter; you can see half of it with a receiver, by watching labels appear and cross-checking them against what your own eyes tell you. My dad's tug, for the record, was where he said it was. But nothing in the broadcast had proven that. He had.

what to do

1. Buy from the resellers' list. A real V4 if stock remains, otherwise the V3 or the $37.95 V4L. All three decode AIS fine.
2. Update the drivers before you debug anything else. The V4 and V4L both need them, and the antenna is innocent.
3. Pick a Saturday. Decoder, free chart plotter, dipole by the window, and the channel shows up in twenty minutes.
4. Treat every AIS contact as unauthenticated telemetry with a from: field. If a dashboard you operate consumes AIS, remember the feed can lie and design accordingly.
5. Stay receive-only. Transmitting needs a license, it's illegal without one, and everything worth learning is on the listening side anyway.

The port has been telling anyone with a receiver where it is and what it's carrying since before I could drive, and the only authentication on the whole system is a machinist's memory of thirty years of tugs. That's the security review. The physical world does not care about your dashboard, and now my dashboard finally knows it.

He still named the tug first.