Nord Stream sabotage: a look at the evidence so far
Last September a series of explosions ruptured three of the four Nord Stream pipelines laid under the Baltic Sea to deliver natural gas from Russia to Germany. The explosions released vast quantities of methane, a major contributor to global warming, into the atmosphere.
Investigations by three of the affected countries — Germany, Denmark and Sweden — are not yet complete but a substantial amount of evidence has already become public. This article reviews what we know so far and discusses some crucial questions that still need to be answered.
This article was last updated on August 27, 2023.
1. Six people on a yacht
German investigators have reportedly concluded that a 15-metre yacht called Andromeda was used for the attack on Nord Stream.
The Andromeda is a single-masted Bavaria Cruiser 50 with a diesel engine and bunks for ten people. It was hired from Mola Yachting at a marina in Rostock, Germany.
The Andromeda set sail from Rostock on September 6 last year with six people on board: a captain, two divers, two diving assistants and a female who was reportedly a doctor. The Andromeda’s crew had forged passports, at least one of which was Bulgarian.
The yacht spent a little more than two weeks at sea, returning to Rostock a few days before a series of explosions ruptured the pipelines.
On September 7, a day after leaving Rostock, the yacht called at Wiek auf Rügen, about 120km to the north-east.
The Andromeda’s subsequent travels in the Baltic Sea have now been “fully reconstructed” by German investigators, according to the Wall Street Journal. “Previously unreported findings were pieced together with data from the Andromeda’s radio and navigation equipment, as well as satellite and mobile phones and Gmail accounts,” the paper reported. “Taken together, the details show that the boat sailed around each of the locations where the blasts later took place.”
After leaving Wiek the Andromeda arrived in an area 50–60km northeast of Bornholm island where all four Nord Stream pipes were aligned in close proximity — and where three of them were later ruptured.
According to the Wall Street Journal’s account, the saboteurs planted explosives on the older pair of pipes known as Nord Stream 1 and on one of the two Nord Stream 2 pipes (which were newer and had never become operational). The omission of the fourth pipe has not been definitively explained but it’s likely that rough sea conditions prevented the divers from completing their task. Weather records for Christiansø, only 25–30 km from the sabotage area, show four days of light wind on September 9–12, but the wind picked up on September 13 and remained at Force 5 until the evening of September 16. Winds above Force 4 are generally considered unsuitable for open-sea diving.
After leaving the sabotage area the boat then proceeded to Christiansø, a tiny Danish island roughly midway between the sabotage site and Bornholm. Christiansø has only 22 hectares of land and fewer than 100 inhabitants. It is administered by the Danish defence ministry and is regarded as a wildlife sanctuary. There are few facilities on the island but in summer it’s often visited by day trippers from Bornholm.
Precisely when the Andromeda called at Christiansø and how long it stayed is unclear but it appears to have been on the island at some point between 16 and 18 September — since police later appealed for photos of the harbour taken on those dates.
The reason for visiting Christiansø is still unexplained and the next stage of the Andromeda’s voyage is even more puzzling. It headed south, away from the sabotage area, to Kołobrzeg in Poland — a distance of 130 km from Christiansø. It arrived at a marina in Kołobrzeg on September 19 and the six people on board were checked by the Polish Border Guard. According to the Polish prosecutor no items were loaded on to the yacht during its stay.
On September 20, after 12 hours in Kołobrzeg, the yacht set sail again, arriving in Wiek (where it refuelled) on September 22, finally returning to the marina in Rostock a day later.
It wasn’t until January 2023 that German federal police turned up at the Rostock marina with a warrant to search the Andromeda. Fortunately for them, the September hiring had been the last of the season and the boat had been brought on land for winter storage without being cleaned.
In the cabin, according to Der Spiegel’s account of the search, there was a plastic bottle “with apparently Polish labelling” next to the sink, and a single “barefoot shoe” lay under the map table. More importantly, “substantial traces” of an explosive — octogen, also known as HMX — were detected on a table in cabin and also, bizarrely, “on the toilet”. In addition, police removed the boat’s Garmin GPSMAP 721 navigation system which probably contained some stored data about the September voyage. According to some accounts, police also took DNA samples and fingerprints aboard the yacht.
2. Ukrainian connections
There are several reasons for suspecting the sabotage was carried out and organised by Ukrainians. There are also signs that Poland was used for logistical and financing purposes, though at present there is no indication the Polish authorities knew about it.
● A mysterious company: The hiring fee for the Andromeda was paid by Feeria Lwowa, a Polish-registered company operating from an accommodation address in Warsaw. It appears to be a shell company disguised as a travel agent. Company documents show the director of Feeria Lwowa is a 55-year-old Ukrainian woman. She is believed to live in Kyiv. The company’s owner, according to the documents, is another Ukrainian woman. She is reported to live in the Russian-occupied Crimean Peninsula and may have acquired Russian citizenship.
● A Ukrainian suspect: A photo in one of the forged passports has been tentatively identified as that of a Ukrainian man in his twenties whose relatives say he is serving in the Ukrainian military.
In an apparently related development, police interviewed a German woman living in Frankfurt an der Oder, a town adjacent to the Polish border. She is said to be the former partner of “a Ukrainian suspect” and is being treated as a witness. She is reported to have a child fathered by the suspect and police have taken a DNA sample from the child to compare with DNA found on the Andromeda. The outcome of the DNA tests has not yet been revealed.
● A Ukrainian plan: In mid-June 2022 Dutch military intelligence warned the CIA that it had heard from a source in Ukraine about a plan to sabotage Nord Stream. According to the intelligence, those involved in planning the attack reported directly to General Valerii Zaluzhnyi, Ukraine’s highest-ranking military officer. To maintain deniability by the Ukrainian government, President Zelensky was not to be informed.
By the time the Americans received this intelligence the attack seemed to be imminent: according to the plan it would take place just after Nato’s BALTOPS22 exercise in the Baltic which was due to end on June 17.
The US raised the matter with Ukraine and the threatened attack did not materialise in June. Later that summer, according to the Wall Street Journal, the CIA told allies it believed the plan had been abandoned.
The Dutch intelligence report setting out the Ukrainian plan later appeared on a Discord server and was seen by the Washington Post. The intention, as described by the paper, was for six members of Ukraine’s special operations forces to rent a boat using false identities and then dive to the floor of the Baltic Sea, damage or destroy the pipelines and escape undetected.
This was remarkably similar to what investigators believe actually happened in the Baltic three months later. There were a few differences, though. The reported plan talked of sabotaging Nord Stream 1 but made no mention of Nord Stream 2, there was also mention of the divers using a submersible and the intention was not to hire a boat from Germany but from a different country on the Baltic coast.
3. A series of explosions
On September 26 last year seismologists reported two underwater explosions in the Baltic. According to Norsar, a Norwegian monitoring organisation, the first occurred at 02.03 local time, about 25km southeast of Bornholm island and a second — larger — blast was recorded 17 hours later, some 50km northeast of Bornholm.
The first blast had a magnitude of 1.8 (categorised as a microearthquake) and equivalent to 190–320kg of TNT, Norsar said. The second underwater event had a magnitude of 2.2 or 2.3 which the seismologists described as corresponding to “a noticeable earthquake” and estimated as equivalent to 650–900kg of TNT.
It soon became clear, though, that this second event — which seismologists at first thought was a single big explosion — had actually been a series of smaller explosions happening almost simultaneously.
Torrents of gas surging up to the surface of the sea showed the pipes had been ruptured in four different places — three north of Bornholm and one south of the island. The gas continued bubbling for days and shipping authorities declared an exclusion zone with a radius of five nautical miles around each of the locations:
54°52.6′N 15°24.6′E
55°32.1′N 15°41.9′E
55°33.4′N 15°47.3′E
55°32.45′N 15°46.74′E
The quantity of explosives that would be needed to cause so much damage is an important question because a very large quantity would be impossible to carry on a small boat like the Andromeda.
German security officials told Der Spiegel they believed “massive explosive devices with the force of 500kg of TNT” had been used. Denmark and Sweden were more vague about the quantity, saying in a joint report to the UN that the blasts were equivalent to the power of “several hundred kilograms of explosive”.
However, there are a couple of factors which mean the actual quantity of explosives is likely to have been less than those estimates suggest. Explosions are usually ranked in terms of “TNT equivalent” but some explosives are more powerful than TNT. According to German investigators the explosive used to attack Nord Stream was (or included) octogen, also known as HMX. It takes only 60kg of HMX to achieve the same explosive force as 100kg of TNT.
The other consideration is that the Nord Stream explosions were not typical. They targeted pipes containing gas under extremely high pressure.
Nord Stream’s pipes were designed to withstand internal pressures of more than 170 bar (roughly 170 times normal atmospheric pressure). The pipelines were not operational at the time of the explosions, so the pressure is likely to have been lower — possibly in the region of 100 bar — but still very significant.
Rupturing the pipes with explosive would cause a sudden and violent release of gas which in turn would affect the seismological data, including estimates of the TNT equivalent.
In response to questions sent by email, Norsar seismologist Ben Dando said: “The influence of the pressurised gas is an important consideration. The explosive force (or TNT equivalent) that we state should not be interpreted as a definitive detonation charge size … the total energy released will include the degassing and depressurisation from the pipeline.”
At present, nobody seems sure how big a share of the TNT equivalent was due to the release of gas, but the larger the effect of the gas, the smaller the quantity of explosives. A group of seismologists are looking at this in more detail and plan to issue a scientific paper in due course.
4. Location of the explosions
The Nord Stream pipes run for more than 1,200km beneath the Baltic Sea — which should have given the bombers plenty of options when deciding where to plant their explosives. However, there are a few puzzles regarding the eventual choice of locations.
The main sabotage area northeast of Bornholm had advantages and disadvantages. It was away from busy shipping lanes and, conveniently, all four pipes were fairly close together. OSINT analyst Oliver Alexander has also noted that this was at the outer limits of Danish coastal radar, thus reducing the chances of the Andromeda’s activities being noticed.
The main disadvantage of the chosen area was the depth of water — almost 80 metres — which was far from ideal for diving. There were plenty of other places where the water was shallower.
A further puzzle about the area of the three explosions is that it straddles a boundary between the Exclusive Economic Zones (EEZs) of Denmark and that of Sweden. One bomb exploded on the Danish side and two on the Swedish side — so the question is whether that was intentional and, if so, why.
In comparison with the attacks northeast of Bornholm, the site of the isolated explosion 25km southeast of the island looks anomalous. Apart from being within Danish radar range it was in an area where NS-1 and NS-2 follow separate courses. The explosion there hit one of the NS-2 pipes — the same pipe that was hit in the explosions further north — leaving the remaining NS-2 pipe intact. The question that raises is whether the saboteurs had made a mistake and attacked the wrong pipe.
5. Diving deep
There have been repeated claims that it would not be feasible to carry out 80-metre dives from such a small boat, since the Andromeda had no space for a decompression chamber. However, a mention of helium in the intelligence report about the Ukrainian plan points to an alternative solution. By breathing a mixture of oxygen and helium and pausing at intervals while returning to the surface, the need for a decompression chamber could be avoided. A Dutch military website describes the process when used by navy divers.
In an interview with the Ostsee-Zeitung, Achim Schloeffel, an “extreme diver” and trainer, suggested the difficulties have been exaggerated. The pipeline would be easy to locate from sea charts or with an echo sounder costing around $3,000. The location could be marked by dropping a 15kg weight attached to a line with a marker buoy on the other end and divers would follow the line down to the exact spot. Explosives could be guided down the line in the same way. The boat would continue sailing and return to the marker buoy to pick up the divers when they surfaced
“Anyone who has completed level two in our diving school would be able to do this,” Schloeffel told the paper. “Especially for those who regularly go wreck diving, a dive to the pipeline would not be a problem for them. Just around Bornholm there is a pile of wrecks lying at a depth of about 80 meters — about the same depth as the pipeline. They are dived regularly.”
To summarise: diving to 80 metres from the Andromeda appears feasible but if the explosives were as bulky as most estimates suggest, manouevring them into position on the pipelines could be difficult and time-consuming — which is why some people think the job would be a lot easier using a submersible.
Another factor to be considered is the weather, because choppy seas would make the diving more complicated. Weather records for Christiansø show light winds for most of the Andromeda’s voyage though there was a period of five days, starting on September 13, when stronger winds could have obstructed diving.
6. Help from unknown sources?
The people aboard the Andromeda were clearly not on a pleasure trip and, based on the published evidence, it’s reasonable to conclude that they had some role in the Nord Stream sabotage.
We still don’t know who organised and funded the attack, where the explosives came from or where and how they were delivered to the boat, but German investigators seem convinced they were planted by the Andromeda’s divers.
In the absence of further information, though, it’s not unreasonable to question whether the Andromeda crew, once they set sail, could have accomplished that task unaided. In that connection, there has been spculation about a larger vessel that was in the sabotage area northeast of Bornholm during the first part of the Andromeda’s voyage — a Greek-flagged tanker named Minerva Julie.
7. A drifting tanker: the Minerva Julie
On September 6 — the same day that the Andromeda yacht left Rostock — the Minerva Julie, passed north of Bornholm island heading eastwards but then slowed down and stopped in what later became the main sabotage area. It spent the next six days in the same area, alternately drifting and running its engines (see graphic), before heading off to Estonia and Russia.
The explanation given by the tanker’s operators, Athens-based Minerva Marine, was that it had been drifting while the captain awaited instructions, and that this was in line with “standard shipping practice”.
Despite suggestions that the Minerva Julie could have contributed in some way, it’s unclear what sort of help the ship might have provided.
8. Deliberate deception?
One possibility, which can’t yet be discounted, is that the attack was a false flag operation to discredit Ukraine and damage relations with its supporters in the conflict with Russia. A variation on that idea is that the Andromeda’s voyage was a smokescreen to divert attention from the real culprit.
One reason for suspicion is that the Andromeda’s crew seem to have made little effort to cover their tracks and left plenty of clues behind: was it intentional or were they just careless?
There’s also the question of what Russian warships were doing close to the main sabotage area four days before the explosions.
9. A visit by Russian warships
The most notable of the Russian naval vessels was the SS-750 rescue ship which is well equipped for underwater operations. It carries a 55-tonne mini-submarine on its deck and has a crane for lowering it into the water.
The mini-submarine is the Priz-class AS-26 submersible which has a crew of four and can carry up to 20 passengers (see video). It is designed to rescue trapped submariners from depths of up to 1,000 metres but it also has a manipulator arm capable of lifting 50kg.
The SS-750 left Baltiysk naval base shortly after midnight on September 21 and is believed to have been accompanied by two rescue tugboats, the Aleksandr Frolov and SB-123, both of which have lifting equipment.
The SS-750 was travelling “dark” with its Automatic Identification System (AIS) turned off, but the two tugs kept their AIS on for a while. It showed them heading west, in the direction of the Danish island of Bornholm.
The Aleksandr Frolov tug was the last to turn off its AIS, at 14.22 on September 21. At that point it was 45 nautical miles from the sabotage area northeast of Bornholm, which it could have reached by about 19.30 — half an hour after sunset — if it continued at its previous speed.
OSINT investigators managed to track the first part of the Russian vessels’ journey but not the most crucial part when they were closest to the sabotage area (details here, here and here). Even so, it does appear that between the evening of September 21 and the afternoon of September 22 (when they left the area) they would have had an opportunity to plant explosives if that had been their mission.
Meanwhile, Denmark had sent the patrol vessel Nymfen to investigate and it arrived early on the morning of September 22. In response to a freedom of information request the Danish Defence Command later revealed that the Nymfen had taken 112 photos of the Russian ships but said it would not be releasing the images, citing their “intelligence value”. A further request elicited the information that 26 of the photos showed the SS-750.
Russia responded to this by implying that the suspect ships had been elsewhere at the time. Foreign ministry spokesperson Maria Zakharova told a news conference that from September 19 to 24 Russia’s Baltic fleet was holding an exercise at the opposite end of the Baltic.
“The forces and assets of the Baltic fleet which were involved in the planned exercise during this period … could not be in the area of the alleged terrorist act,” Zakharova said.
The exercise described by Zakharova was confined to the waters of Russia’s Exclusive Economic Zone (EEZ) adjacent to Kaliningrad. According to the Russian military, it involved “more than 15” naval vessels and OSINT analyst Oliver Alexander has identified 17 vessels mentioned in official Russian press releases as having taken part.
However, the three vessels spotted near the Nord Stream sabotage area northeast of Bornholm island are not mentioned in reports of the exercise and were clearly not part of it since they were active far beyond the boundaries of the Russian EEZ.
Bizarre as the Russian explanation might be, media reports indicate that Germany’s investigators have discounted Russia as a possible suspect.
Russian naval vessels observed close to the sabotage area before the explosions “are no longer considered interesting by the German investigators”, the Swedish newspaper Expressen reported.
The reasons given for this loss of interest are not very specific but the suggestion is that further tracking information from military and other sources means involvement by the Russian ships can now be ruled out. The German TV programme Tagesschau reported:
“Some of these [Russian] ships had switched off their signals so that they could not be located. In German security circles it is said that this approach by Russian military ships is not unusual, but takes place regularly in the Baltic Sea. NATO is still able to track the movements of the ships. The German investigators also followed these tracks, evaluating satellite images and radio recordings.”
Similarly, Expressen’s report says the Russian ships’ positions “have been mapped” and “the conclusion must be that they have not been in such a place that they could have carried out the deed”.
10. Accusing the United States
Suspicion has also fallen on the United States which opposed the construction of Nord Stream because it made EU countries heavily reliant on gas supplies from Russia, giving rise to fears that Russia might use this dependence as a political tool. By 2021, 45% of the EU’s gas imports were coming from Russia. Nord Stream 1 began operating in 2011 and, by 2021, 45% of the EU’s gas imports were coming from Russia.
Construction of Nord Stream 2 began in 2011 with the aim of doubling capacity. It was completed in 2021 but had not become operational.
In February 2022, a couple of weeks before Russia invaded Ukraine, President Joe Biden told a news conference: “If Russia invades — that means tanks and troops crossing the border of Ukraine again — there will be no longer a Nord Stream 2. We will bring an end to it.” Asked how that would be done, Biden did not elaborate and replied: “I promise you, we will do it.”
In the light of the subsequent sabotage this has often been interpreted as a threat to blow it up. By the time the explosions occurred, however, the oil flow had already stopped.
In June 2022 — four months after the invasion of Ukraine — Russia cut the gas flow of Nord Stream 1 by more than half, blaming technical issues. It said sanctions were preventing it from getting a spare part.
This was followed by a ten-day shutdown in July, reportedly for annual maintenance. A further shutdown — again, allegedly for maintenance — came at the end of August. It was supposed to last for only three days but supplies never resumed. Ursula von der Leyen, president of the EU Commission, accused Russia of attempting to manipulate the energy market. The shutdown not only raised gas prices but also left Europe facing the prospect of energy shortages during the coming winter.
The upshot of this was that by the time the pipelines were blown up Nord Stream 1 had already been out of action for a month, with no real prospect of gas supplies resuming, at least while the war in Ukraine was still going on.
Meanwhile Russia was ready to start up Nord Stream 2 but, under pressure from the US, Germany was withholding the project’s final certification. Following the explosions, Russia offered to supply gas through the single NS2 pipe that was still intact, but Germany quickly rejected that idea.
It could therefore be argued that by September 2022 the US had no reason to blow up Nord Stream. Biden had already achieved his objective of bringing “an end” to NS2, and NS1 — which he hadn’t threatened to close — was out of action too.
Regardless of that, the most popular (and most believed) theory on social media is that the US blew up Nord Stream. This is mainly the result of an article by the American journalist Seymour Hersh claiming that US Navy divers carried out the attack with assistance from Norway.
According to Hersh, the US used Nato’s BALTOPS exercise in June last year as cover for planting the explosives. His account of how it was allegedly done is based on information from an anonymous source said to have “direct knowledge of the operational planning”. It has not been possible to verify this independently and several of the key claims have since been discredited.
For example, Hersh maintains that the divers were “operating from a Norwegian Alta class mine hunter” but subsequent checking shows this was impossible. There were two Alta class vessels in service at the time — the Otra and the Rauma — but neither of them took part in BALTOPS and both were in Norwegian waters, not the Baltic Sea, at the relevant time (details here).
According to Hersh, the explosives remained under the sea for three months awaiting a decision to detonate them and were eventually triggered by a Norwegian Navy P8 surveillance plane dropping a “sonar buoy” into the sea during a “seemingly routine flight”.
Norway had recently taken delivery of three Boeing P–8A Poseidon aircraft but none were operational at the time. Hersh later changed his story to say the Poseidon in question was American, with an American pilot. An American Poseidon was active over the Baltic on the day of the attack but apparently not to carry out the detonation. The first explosion occurred an hour before it arrived.
A more detailed critique of Hersh’s claims can be found here. There are also critiques by OSINT analyst Oliver Alexander and the Norwegian fact-checking website Faktisk.
Hersh later mocked the Andromeda yacht theory, citing a series of naive objections from an unnamed person decribed as an “intelligence expert”. “You cannot just walk off the street with a fake passport and lease a boat,” he quoted the expert as saying, and “How does a 49-foot sailboat find the pipelines in the Baltic Sea? The pipelines are not that big and they are not on the charts that come with the lease [of the boat].”
The yacht theory, Hersh decided, was nonsense from start to finish — a work of fiction dreamed up by the CIA.
“By creating a story of deep sea divers and a crew who did not exist,” he wrote, “the agency was following protocol, and the story would have been part of the first days of secret planning to destroy the pipelines. The essential element was a mythical yacht ironically named the Andromeda — after the beautiful daughter of a mythical king who was chained to a rock, naked.”
● CHECK HERE for regular updates about the Nord Stream affair
