The Protection Nobody Has to Buy

Analysis · 30 August 2026 · predictions registered before research · honesty score −10, reported at a loss

Somali pirates have taken nine ships in 2026. Every one belonged to an owner who declined the optional layer. Protection did not become unaffordable — it became elective, and the bill an owner cannot avoid is now calibrated to a threat no guard can stop.

30 August 2026

Two pieces of this argument are not mine, and they belong at the top rather than in a footnote.

Windward published the incident analysis on 24 May. It established that none of the three commercial vessels hijacked in the April–May cluster carried embarked armed security; that the one hostile contact in that cluster which did not end in a seizure — the Elfriede approach of 23 April — was the only one that did; and that a non-trivial share of vessels transiting Somali-adjacent waters in early 2026 were sailing without security under cost pressure from extended Cape routings.

It also documented something stranger. Ships crossing the Somali EEZ have been writing their security posture into the AIS destination field, broadcasting ARM GUARD OB, ARMGRD ONBOARD and ARMEDGRDTRCRV, alongside a second cluster advertising Chinese crew and ownership. Windward reads those broadcasts two ways: as a measure of how operators perceive the threat, and as an intelligence signal that pirate action groups can read as easily as an analyst.

The Swedish Club, reported by Matthew Sellers in Insurance Business on 21 August, established the victim pattern: small, older ships, sailing close to shore, without an embarked armed security team — and, on the Club's own account of its own market, no vessel carrying a professional security detail successfully seized off Somalia during this wave. The same piece established that the Joint War Committee widened its listed areas in March 2026 to bring in Bahrain, Djibouti, Kuwait, Oman and Qatar and to extend along the Somali and Pakistani coastlines, and that the move was driven by the Iran conflict rather than by piracy.

What follows are two claims neither of them makes.

The account everyone is running, and what it fails to explain

The standard explanation is an enforcement gap. Naval assets that suppressed Somali piracy were pulled north to the Red Sea after late 2023 and then east toward Hormuz in early 2026; the Somali Basin was left thin; pirates returned.

That account is not wrong about the redistribution. It is weak about the mechanism, and the weakness shows in what it cannot predict. Naval thinning applies to every hull in the water. It gives no reason why the nine ships taken in 2026 are the particular nine.

Look at the list. Honour 25, a Palau-flagged product tanker carrying 18,500 barrels from Berbera to Mogadishu, boarded on 21 April about thirty nautical miles offshore, no embarked security. Sward and Eureka, taken in the same twelve-day cluster, with the ransom demand on Eureka escalating from a reported $3 million to $10 million. Lutuf, Cameroon-flagged, taken 17 August four nautical miles off Mareeyo. Sibu 1, Eritrea-flagged, taken 20 August roughly 130 nautical miles off Yemen, a vessel Somali port authorities associate with the fleet still moving Iranian oil. Liao Dong Yu 578, a Chinese fishing vessel, released in March for a reported $1.2–1.5 million. Dhows throughout.

No mainline container ship. No large tanker under a first-tier operator.

A patrol gap does not select like that.

Compulsory and optional

Marine cover for a vessel entering these waters splits into two things that behave very differently.

The first is the war-risk additional premium. It triggers on entry into a Joint War Committee listed area and carries a notification obligation to underwriters. It is not optional in any practical sense: the listing defines the water, and the water is on the route. In March the committee redrew those areas around the Iran conflict.

The second is the piracy layer — kidnap and ransom cover, and the private security that goes with it. Ransom payments, crisis consultants, legal liability and crew rehabilitation all fall outside standard hull, war risk and P&I cover, which is the gap K&R products exist to close. That layer is bought, or not bought, voyage by voyage or on an annual worldwide policy with transit premiums.

It would be tidy if the second layer had collapsed into the first — if piracy risk had been swallowed by an undifferentiated war-risk charge and stopped being priced at all. It has not. The piracy layer expanded through 2026. West P&I Club rolled out a piracy protection product bundling ransom indemnity with crisis response. CFC launched a marine K&R product that tracks insured vessels in real time and switches cover on automatically as they approach a high-risk zone, billing the premium afterward. Hardening is still priced, by people actively competing to price it.

So the mechanism is not that protection became unaffordable. It is that the two layers now answer to different threats, and only one of them is mandatory. The charge an owner must pay is calibrated to missiles and drones, which an embarked security team can do nothing about. The charge that would buy protection against boarding — the thing actually happening off Puntland — is the one the owner can decline while still lawfully making the transit.

That structure sorts. An owner already carrying a large mandatory premium for a threat outside his control is exactly the owner most likely to look at the optional line and decline it. And declining is a decision about the operator rather than about the exposure.

The nine victims are not a random draw from the traffic. They are the ships whose owners said no.

The broadcast

Here is what makes the structure visible rather than merely arguable.

When protection stops being priced in a way that discriminates, the information about who is protected has nowhere to go. It does not disappear. It looks for another channel, and the channel it found is a free-text box meant to say where a ship is going, now carrying ARM GUARD OB on transits of the Somali EEZ.

A shipowner who writes that is doing something economically odd. He is disclosing his security posture to everyone with an AIS receiver, including the pirate action groups conducting pre-attack reconnaissance — a real cost, and the second of Windward's two readings. He does it because the disclosure has nowhere else to go that pays him. There is no visible market in which being hardened lowers the bill he cannot avoid. So he pays for the hardening privately and advertises it publicly, to the only audience whose behaviour it can still change.

The Chinese-crew broadcasts in the second cluster are the same move without the purchase: a claim of diplomatic cost, asserted rather than bought.

Read that way, the AIS field is a rough public register of which ships bought the optional layer — maintained by the buyers, at their own expense, because nothing else maintains one. It is the closest thing anyone has to a measurement of the share of transits carrying embarked security, and it exists because that quantity is otherwise unpublished.

The weakest joint

The argument needs the ratio between the mandatory and optional charges to have moved, and that number is not in evidence here.

War risk and K&R have been separate lines for decades, so the split existing proves nothing. If war-risk premium for these transits turns out to be small relative to the cost of an embarked team, the mandatory charge is not crowding out anything and the argument fails. A single broker circular with 2023 and 2026 rates would settle it in either direction. None was found.

There is also a case already sitting close to the central claim. The Lutuf carried two Serbian security contractors among its ten-person crew and was taken anyway. Whether they constituted an armed embarked security team is not established by anything found here. If they did, the pattern this article is built on has its first counterexample.

What this does not explain

A sufficient explanation of the resurgence already exists and needs none of the above.

Somali piracy has onshore causes that 2026 scholarship documents independently: a Frontiers in Marine Science paper revisiting the fisheries–piracy nexus through IUU fishing and governance collapse; HORN REVIEW's May assessment; Africa Defense Forum's January reporting on foreign vessels decimating Somali fish stocks; Puntland's unrelenting drought against declining catches and foreign trawling. That literature explains why men go to sea to take ships.

Nothing here competes with it. This article answers a different and smaller question — not why the attacks resumed, but why these particular hulls and not others. A reader who finds the first question more interesting is not wrong.

Two further things are unresolved. Whether counter-piracy naval strength actually fell cannot be settled from the available figures: CTF-151 had seventeen ships and units assigned across the Royal Navy's six-month tenure ending 24 August, prevented twenty-five piracy attempts, and ran a ten-nation focused operation in June, while Atalanta was extended toward February 2027 — and against that, Windward describes the thinnest Somali Basin patrol coverage since before Atalanta stood up in 2008. Those are different quantities, and no source measures them the same way in both years.

And the claim that traffic thinned is wrong in the waters that matter. Suez transits ran sixty percent below 2023 through early 2026, but transit density east of the former High Risk Area roughly doubled year on year. Ships left one corridor and entered another. The one where they arrived is the one with the pirates in it.

Sources

Windward, 24 May 2026 · Insurance Business, 21 Aug 2026 · CNBC, 20 Aug 2026 · Euronews, 27 Aug 2026 · Sheba Intelligence · BIMCO, Suez transits · Combined Maritime Forces, CTF-151 · EUNAVFOR Atalanta · Frontiers in Marine Science, fisheries–piracy nexus · HORN REVIEW, 22 May 2026 · Africa Defense Forum, Jan 2026 · MARAD advisory 2026-010 · WTW, resurgence of Somali pirates

Produced under provenance discipline. Falsifiable predictions were registered to a signed chain before any research began, verdicts were recorded before any prose existed, and the registered thesis was withdrawn entire and replaced. Honesty score −10, reported at a loss: one point for every research step the platform could not carry. The run is sealed on the host that took the writes. The chain establishes the order in which the work was recorded. It does not establish that any source cited here is correct.

sha256 afeefc4fe8f2415f814f6a03497bdd99ede1a84b842d3172eaf000cf4678575d