Off the coast of Oman, a tanker is breaking apart on the rocks, and the salvage crews trying to contain it are being paid by an insurance company that is legally banned from paying anyone. Governments had to issue special permission slips just so the rescuers could accept the money. And here is the strange part: that is the most functional piece of this whole story. Because the machine the world built to pay for oil spills answered this one with: nobody.

The ship is called the Caroline Bezengi. She is twenty-five years old, longer than two football fields, and she was carrying about eight hundred thousand barrels of Russian crude oil from the Black Sea toward Asia. On June the eighth, somewhere off Yemen, an explosion tore into her engine room. Nobody has claimed it and nobody has explained it — but she was sailing along the edge of a war, in waters where ships get hit. The crew got off safely and the tanker drifted, empty of people and full of oil, until she ran aground on the rocks of southern Oman — right beside a marine reserve.

That reserve is one of the last homes of the Arabian Sea humpback whale. About eighty-two of them are left, and they never migrate. Whatever happens to this coast happens to them. By mid-August, the slick had grown past two thousand square kilometers — larger than a big city — and oil was washing onto beaches two hundred kilometers from the wreck.

Most of the news coverage is chasing one question: was this an attack — and whose? That may never be answered. But there is a second question, and it is the one that decides what happens to that coastline: who pays? That question is not supposed to be hard. The world built an answer to it — an actual machine, made of treaties and insurance and a shared fund, and for over fifty years it has paid out after more than a hundred tanker spills. This time, the machine checked its own rulebook and switched itself off.

The machine was born in 1967, when a supertanker called the Torrey Canyon hit a reef near England. There were no rules for a disaster that size. Britain's best available legal tool turned out to be the air force: they bombed their own coastline for two days, trying to burn the oil off the water. Nobody wanted to improvise like that again. So governments built a safety system, and the simplest way to picture it is three nets stretched one under another, like nets under a trapeze act.

Net one: the shipowner pays. No lawsuit about whose fault it was — if your ship spilled it, you owe for it. Net two: the owner must carry insurance, by law, and the victims can bill the insurer directly. Even if the owner disappears, the insurance is still standing there with its name on the certificate. Net three: if the damage is bigger than both, an international fund takes over — filled by oil importers around the world, good for roughly two hundred ninety million dollars per disaster.

Now watch what happened to each net — because every one of them hangs on a written rule, and every rule has an off-switch. Net one says: the registered owner pays. The registered owner of the Caroline Bezengi is a paper company in Shanghai, created about seven months before the accident. It owns nothing else. It answers no phone. A rule that points at a name on a registry is a rule you can satisfy with a name on a registry.

Net two says: the insurance certificate must be vouched for by the ship's flag state. But a flag is a service ships can rent, and swap. This tanker flew the flag of Cameroon — until June, when Cameroon crossed her off its registry along with dozens of other shadow tankers. Ask a ship like this for its certificate, and you will usually get one. The paper looks right. The paper just doesn't pay. On this wreck, the only insurance money that has actually appeared is coming from a sanctioned Russian company — the one from the start of this story, paying the salvage crews through those special permission slips. That is what cover outside the machine looks like: it can hand cash to a salvage crew, but no beach can bill it.

Net three has a clause written back at the machine's founding: the fund does not pay for damage caused by an act of war. It was written for a world where war meant navies fighting navies — not a gray economy where a civilian tanker full of civilian cargo gets hit on an ordinary shipping lane. Oman is a paying member of the fund. The fund looked at the explosion, called it an act of war, and stepped back.

Here is the part that turns a bad accident into a design story: this fleet did not appear by chance. At this scale, it was built by a rule. In December 2022, Western governments wanted to squeeze Russia's oil income without stopping the oil. So they set a price ceiling, and they enforced it through the one chokepoint they controlled: insurance. Nine out of ten large ships in the world are covered by a small circle of Western insurers. The rule said — carry Russian oil above the ceiling, and you lose that coverage.

The lever worked. Russian oil left the insured world — and kept sailing. Today roughly one tanker in five belongs to this shadow fleet: old ships, paper owners, rented flags, insurers nobody can collect from. They carry about two thirds of Russia's crude exports. And this is the catch nobody wrote down: the sanctions lever and the victims' safety net are the same rope. The compensation machine stands on Western insurance — and the price cap works precisely by pulling that insurance away. Use the rope as a weapon, and the nets go slack. The machine's other holes are older than any sanction — paper owners and the war clause were always there. What the cap did was push a fifth of the world's tankers through all of them at once. Nobody decided that Oman pays. Three old rules and one new one added up to it.

So what would a different design look like? There are three serious candidates, and each one carries a real price. Design one: stop checking the paper and start checking the payer. Twelve northern European countries already stop passing tankers and ask for insurance documents — and more than ninety percent of the ships hand over a certificate. Some of that paper comes from insurers who are themselves under sanctions. So the upgrade is to verify who actually stands behind the certificate — and detain the ship when the answer is nobody.

The price starts with a warship on your radar: Russia has begun escorting its tankers through these waters, so every detention is a naval standoff waiting to happen. And the law is against making a habit of it — the right to sail peacefully through a strait is one of the oldest promises between nations; for Denmark's straits it is written in a treaty from 1857. Denmark inspected one hundred twenty-two of these ships in a year. It detained five.

Design two: fix the fund's rulebook. The fund's own governing body has admitted the war clause leaves exactly this scenario uncovered — an attack on a civilian ship, massive pollution, no payer. So rewrite the clause: attacks on civilian tankers get covered. Some proposals go further and would fill a new pot with money from seized or frozen assets.

Then comes the bill. The fund is filled by oil importers everywhere, so a patched clause means a war's cleanup gets spread across everyone who buys oil, including countries with no part in it. And there is a quieter cost: the softer the net under uninsured ships, the cheaper it becomes to run ships uninsured. The patch would subsidize the exact fleet that produced this spill. Money also arrives after the fact — a check does not clean a whale nursery.

Design three: go after the layer that vouches for everything else — the flag. A certificate is only as trustworthy as the state that stamps it, and some registries will stamp almost anything for a fee. One concrete proposal: make ship registries part of the reviews run by the global money-laundering watchdog, the FATF. Cameroon — this tanker's last flag — is already on that watchdog's warning list for other reasons, and getting off the list is something governments genuinely work for. That is real leverage, and it can work: under diplomatic pressure, Panama has already struck hundreds of suspect ships from its registry.

The price: squeezed ships slide down the ladder — to weaker registries, then to fake flags, then to no flag at all. And a ship with no state answers to no one. Estonia has already had to board one such ship in the Baltic.

Back to that certificate — the real paper, with the real stamp, worth nothing. The loud debate is binary: sanctions, more or less. But the design question underneath is different. The world had one system that both disciplined shipping and paid its victims; that system became a weapon, and no replacement net was ever strung underneath it. So the next time a government says it will enforce a rule "through insurance," there is one question worth asking: who was that insurance quietly protecting before — and who is standing under the net now?