Presence Is Not Activity

A marine reserve manager looks at the evening screen and sees forty vessels inside the reserve. That is a true statement and a complete answer to a question nobody asked.

The questions the manager is actually responsible for are different. Which of the forty are fishing, as opposed to transiting or anchored? Of those fishing, which hold a license for this zone, this season, this gear? Which of the tour vessels are on the itinerary they filed, and which have drifted from it? Which small boat has spent six hours at two knots inside a no-take zone, and how many nights this month has it done the same? The screen shows presence. The mandate is about activity.

The shape repeats wherever a public authority is asked to protect territory or resources. A national mining regulator publishes a count of illegal extraction points; in Ecuador the most recent public figure runs to several hundred sites across sixteen provinces. The count cannot say which sites are active this month, which were closed by an operation and quietly reopened, or which have doubled in size. A pipeline security team sees a vehicle parked on the right of way at night. One night is a moment. Three nights running at the same kilometer is a pattern, and only the pattern is worth a patrol. A park authority sees a settlement edge against a protected boundary. The edge as of when, and moving in which direction?

In each case the system has done its job. It has detected something. What it has not done is turn a detection into the thing the rules are written about.

Why systems store moments

The reason is not carelessness. Sensors deliver moments. A radar image is an instant. A transponder position is an instant. A satellite pass, a camera frame, a patrol report: each is a point with a timestamp. The natural data structure of a detection is a dot on a map, and monitoring systems are built, correctly, to store and display dots.

Behavior is a different object. Dwell time in a zone. A speed signature consistent with fishing rather than transit. Return frequency to the same place. Cumulative effort by a vessel, a fleet, a zone, across a season. Deviation from a filed route. Growth of a footprint between two dates. None of these is visible in any single detection. Each requires holding many detections together across time, attached to the same entity, and comparing them to something.

That is where most monitoring stacks stop, because it asks for two things they were never built to hold. The first is entity continuity across sources: the ability to say that the transponder track, the radar detection, and the optical confirmation are the same vessel, so that its history accumulates in one place rather than three. The second is a model of what was authorized.

Behavior only means something against authorization

Fishing effort is not a violation. Fishing effort in a no-take zone, or beyond a quota, or without a license for that zone, is. A tour vessel’s route means nothing on its own; it means something against the itinerary that was filed and approved. A mining footprint is neutral until it is compared to the concession boundary. A cleared patch of forest is a fact; whether it is a problem depends on the land-use zoning it sits inside.

The authorization data exists. Vessel registries, fishing licenses, approved itineraries, concession cadastres, zoning maps: every authority holds them. But they live in registries built for administration, not for comparison against live observation. They are lists, kept by a different office, updated on a different schedule, in a different projection.

So the comparison happens in an analyst’s head, with a license list open in one window and a track in another. When the observation and the authorization don’t share a common model, the enforcement question, “is this allowed?”, cannot be asked of the system. It can only be asked of a person, one detection at a time.

What changes when behavior is a first-class object

Consider what an operational model looks like when behavior, rather than presence, is the thing it computes.

Entities persist across sources, so a vessel that reports its position, falls silent, and is later seen by radar is one history rather than two fragments. Behavior is computed continuously from that history: dwell, speed pattern, revisit, cumulative effort by vessel and fleet and zone and period. Authorization is held as a governed layer with validity dates, so a license that expired last month is not a license.

The rules are then written in the vocabulary of the mandate. “Fishing-consistent behavior inside a no-take zone by a vessel without a license for that zone” fires. “Vessel present inside the reserve” does not, because presence alone is not a violation and never was. The number of alerts falls sharply. The ones that remain are ones an inspector can act on, with the history that justifies the action already attached.

Effort becomes comparable to quota, so inspections are prioritized by where the fishery is actually being pressed rather than by where the most dots appear. A tour vessel’s deviation is measured in distance and duration from its filed route, not eyeballed against a chart. A mining site marked as closed after an operation, and showing fresh excavation on the next satellite pass, is flagged as reopened, and the system can say so because it holds the site’s history and not just its latest image.

None of this requires more sensors. It requires the detections that already arrive to be held together, per entity, over time, and compared against what the authority already knows it permitted.

Where the automation stops

Governed autonomous action fits this problem well, within a boundary. The effort estimation, the itinerary comparison, the revisit detection: these run continuously and without asking. The system proposes which vessels to board and which sites to inspect first. The boarding, the sanction, and the opening of a case stay with the officer and the prosecutor.

That boundary is also why the record matters. “This vessel fished inside the no-take zone for six hours” is a claim, and it will be contested. The model that produced it must be able to show which observations, from which sources, at which times, produced the estimate, and which authorization record it was compared against. A behavior estimate that cannot be traced is an opinion with a timestamp. A traced one is evidence.

A test for last month’s alerts

Take the alerts a monitoring system produced last month and sort them into two piles. In one, the alerts that describe a position at an instant: a vessel here, a vehicle there, a change in this pixel. In the other, the alerts that describe a behavior over time compared against what was permitted.

If nearly everything lands in the first pile, the system is a census. It is a good census, probably, and it cost real money to build. But the enforcement is being done by hand on top of it, by people reconstructing trajectories from dots and checking them against lists. Those people are the scarcest resource the authority has. The point of an operational model is to let them start from the second pile.