segelyacht andromeda nord stream

To revisit this article, visit My Profile, then View saved stories .

• Backchannel
• Newsletters
• WIRED Insider
• WIRED Consulting

Matt Burgess

Online Sleuths Untangle the Mystery of the Nord Stream Sabotage

It’s been six months since the Nord Stream gas pipelines were ruptured by a series of explosions, leaking tons of methane into the environment and  igniting an international whodunit . Russia, the United States, the United Kingdom, and an unnamed pro-Ukrainian group have all been accused of planting explosives on the Baltic Sea pipelines in recent months. But half a year since the sabotage took place, the mystery remains unsolved.

Digital sleuths are stepping in to help provide clarity around bombshell claims about who was behind the attacks. Open source intelligence (OSINT) researchers are using public sources of data in their efforts to verify or debunk the snippets of information published about the Nord Stream explosions. They’re providing a glimpse of clarity to an incident that’s shrouded by secrecy and international politics.

Since early February, multiple media reports have claimed to provide new information about who could have attacked the Nord Stream 1 and 2 pipelines on September 26. However, the reports have largely been based on anonymous sources, including unnamed intelligence officials and leaks from government investigations into the attacks.

First, American investigative journalist Seymour Hersh published claims that the US was behind attacks in a  post on Substack . This was followed by reports in The New York Times and German publication  Die Zeit claiming a pro-Ukrainian group was responsible. (European leaders have  previously speculated Russia could be behind the attacks, and Russia has  blamed the United Kingdom .) No country has claimed responsibility for the blasts so far, and official investigations are ongoing.

Each of the recent reports has provided little hard evidence to show what may actually have happened, while helping to fuel speculation. Jacob Kaarsbo, a senior analyst at Think Tank Europa, who previously worked in Danish intelligence for 15 years, says the claims have been “remarkable” but also “speculative” in nature. “In my mind, they don’t really alter the picture,” Kaarsbo says, adding the attacks look highly complex and would likely be “very hard to pull off without it being a state actor or at least with state sponsorship.”

In the absence of official information, OSINT researchers have been trying to plug the gaps by examining the claims of the new reports with public data.  OSINT analysis is a powerful way to determine how an event may have unfolded. For instance, flight- and ship-tracking data can reveal movements around the world, satellite images show Earth in near real-time, while small clues in the backgrounds of photos and videos can reveal where they were taken. The techniques have  uncovered Russian assassins , spotted North Korea evading  international trading sanctions , identified  potential war criminals , and  documented pollution .

Matt Reynolds

Jeremy White

Reece Rogers

For the Nord Stream blasts, there was little OSINT available. Researchers  identified “dark ships” in the area . But underwater, there are obviously limited data sources that can be tapped into—cameras and sensors don’t monitor every inch of the pipelines. “OSINT probably won’t break this case open, but it can be used to verify or strengthen other hypotheses,” says Oliver Alexander, an analyst who focuses on OSINT and has been closely looking at the Nord Stream blasts. “I do think that it’s more of a verification tool.”

Alexander and others have been examining the claims made so far. The New York Times and  Die Zeit  both published stories on March 7 claiming a Ukrainian group was behind the sabotage. (Ukraine has  denied any involvement .)  Die Zeit published more details, claiming German investigators searched a yacht rented from a company based in Poland, knew where the yacht sailed from, and that six people were involved in the operation, including two divers. All of them used forged passports, the publication reported.

The details were enough for OSINT researchers to start tracking down which yacht could have been used. Alexander, as well as contributors to the open-source investigative outlet Bellingcat, started following the breadcrumbs, narrowing down potential vessels. A follow-up  report soon named the boat under suspicion as the Andromeda , a 15-meter-long yacht. Webcam footage from the harbor where it is  believed the Andromeda was docked shows the movement of a boat around the time reported by the publications. (The Andromeda is  reportedly too small to be required to use ship-tracking systems.)  Years-old videos   and photos of the boat have surfaced. The sleuthing adds public details to the reports.

Similarly, OSINT has been used to debunk Hersh’s story claiming the United States was behind the explosions. (Hersh has  defended his article , while US officials have said it was false.) Alexander has used, among other things,  ship-tracking data to show Norwegian ships were “accounted for” and not in a “position to have placed the explosives on the Nord Stream pipeline, as claimed by Hersh.” Another detailed article from Norwegian journalists has similarly  poured cold water on Hersh’s claims , partly using satellite data.

The sabotage was always likely to be controversial and surrounded by rumors: Russia’s full-scale invasion of  Ukraine in February 2022 has heated global tensions and put pressure on diplomats around the world. There has been a whirlwind of disinformation around the blasts, further muddying the waters. Mary Blankenship, a disinformation researcher at the University of Nevada, Las Vegas, who has analyzed online conversations around the war, says the “high uncertainty and high stakes” of the incident help to fuel the spread of disinformation. 

“This is an issue that exploits existing worries, tensions, and grievances within European audiences,” Blankenship says. Initially, the earliest disinformation on Twitter about the explosions came from conspiracy theorists, Blankenship says, who shared a pre-war statement from US president Joe Biden, where he said there would be  an “end” to Nord Stream 2 if Russia invaded Ukraine . Since then, Russia and China have taken to  sharing unproven theories about the sabotage, the researcher says.

“Disinformation actors, but also official representatives of the [Russian] regime, stepped up their efforts on every news story that was published on this—however contradictory about the origins of the blast—be it a blog post by Seymour Hersh or a  New York Times article,” says Peter Stano, an EU spokesperson, adding most disinformation narratives have circled around the idea that “the US is to blame.” The EU’s disinformation monitoring project, EUvsDisinfo, has  flagged more than 150 pieces of disinformation linked to the Nord Stream explosions, including those building on Hersh’s story. “EUvsDisinfo experts also found that Moscow considers the recent materials in German-language media a hoax,” Stano says.

While OSINT is helping to provide bits of extra detail on the claims about the Nord Stream attacks, it is likely that reports debunking dubious claims reach fewer people than disinformation or claims that are hard to verify. “It does not nearly get the same level of engagement,” Blankenship says. “You can have a book’s worth of evidence for it, and they would still find a way to discount it.”

And while OSINT research can answer some questions, it has its limits and can also raise new ones. Kaarsbo, the former Danish intelligence official, and other experts have pointed out that the Andromeda is a relatively small yacht, and it may have been unable to carry the amount of explosives needed to blow the pipelines. “The Andromeda is quite likely a piece of the puzzle, but I don’t think it’s a bigger piece of the puzzle that everyone makes it out to be,” Alexander says. “I think there are a lot of the big pieces missing.” Detailed sonar imagery of the damaged pipes would help people to understand what happened underwater, Alexander adds.

Ultimately, there is still very little hard public evidence—either from governments or publicly available online—about who may have been behind the attacks. Behind closed doors, intelligence agencies likely have more data and theories on the potential culprits. However, investigators in Sweden and Denmark refused to comment on their progress, while Germany’s Office of the Federal Prosecutor confirmed it had searched a yacht and is continuing to examine for explosives. German officials have also said there could be a  chance of a “false flag” operation to smear Ukraine . And when the countries complete their investigations, there’s no guarantee they will publish their findings or evidence to back them up. The mystery continues.

You Might Also Like …

In your inbox: Introducing Politics Lab , your guide to election season

Google used her to tout diversity. Now she’s suing for discrimination

Our in-house physics whiz explains how heat pumps work

The big questions the Pentagon’s new UFO report fails to answer

AirPods Pro or AirPods Max? These are the best Apple buds for your ears

Andy Greenberg

Dell Cameron

Eric Geller

Vittoria Elliott

Peter Guest

OSINT & Analysis by Oliver Alexander

The Nord Stream Andromeda Story: What We Know and What We Don’t

A look at what we know about the recent development regarding a chartered yacht, andromeda, as well as the questions posed by this supposed series of events..

If you enjoy my content, please consider supporting my work here and on Twitter with a premium Substack subscription.

Two days ago, The New York Times published an article in which an anonymous US official suggested that the operation to sabotage the Nord Stream pipelines may have been conducted by a pro-Ukrainian group. Unfortunately this article contained very little verifiable new information with no concrete details that could in anyway be investigated further. “U.S. officials declined to disclose the nature of the intelligence, how it was obtained or any details of the strength of the evidence it contains.”

Shortly thereafter Zeit published an article with an investigation they had done providing more details. This article lays out that a group of 6 unidentified people, possibly from a pro-Ukrainian group, used high quality fake passports and chartered a yacht in Rostock on September 6th before heading to place explosives at the Nord Stream sabotage sites. The yacht reportedly made a stop in Weick and on Chrisitansø as part of the trip. The yacht was later searched by the German authorities and traces of explosives were found. The article also stated that the charter was paid for by a Polish company owned by two Ukrainians.

Over the last two days, parts of this story have been corroborated, while other parts have raised further questions. Initially we can look at the aspects of the story that can be corroborated.

The Danish newspaper Ekstra Bladet confirmed that police had conducted an investigation on the island of Christiansø and was looking for a specific vessel that was docked on the island between the 16th and 18th September.

SPIEGEL Politik released an article that gave a detailed description of the yacht involved in the investigation. In this article it is stated that the yacht was over 15 meters long, had 5 cabins, could accommodate 11 people and cost just under 3000 Euros a week to rent. They also stated that the yacht was rented out by a company from Mecklenburg-Vorpommern, Germany. This information made it possible to narrow the search down to two vessels out of the Hohe Düne marina in Rostock, rented out by Mola Yachting GmbH. These two vessels are both Bavaria Cruiser 50 yachts. These yachts are 15.57 meters long, can accommodate 11 people in 5 cabins and cost 2998 Euros a week to rent for the time period in September. Unfortunately according to the Mola Yachting website, these two yachts are not equipped with an AIS (Automatic Identification System), which means that the movements cannot be tracked using ship tracking site like MarineTraffic .

This could then be further narrowed down to the specific vessel the “Andromeda” through the help of several sources with knowledge of the investigation. This has now been publicly confirmed by the SPIEGEL . The Andromeda can be seen in this 2017 video from Yacht TV .

Knowing the vessel, a hole in the Zeit story became apparent. In the article it is claimed that the yacht was spotted in Wieck auf dem Darß on the 7th September. Looking at nautical charts of the area, this would be highly unlikely as the Wieck auf dem Darß harbor only has a depth of 1.4m while a Bavaria Cruiser 50 has a draft of 2.25m.

This inconsistency was further reinforced after Ostsee Zeitung interviewed the harbormaster at Wieck auf dem Darß where he stated that he had never been contacted by the authorities and suspected that there had been a mix-up. This left the more suitable marina of Wiek on the island of Rügen as the more likely candidate. This has today been confirmed by WELT after interviewing the harbormaster at Wiek who could confirm that they had been previously contacted by authorities regarding the situation.

This error has now been edited and corrected to Wiek, Rügen in the Zeit story, though it raises questions as to how the story went ahead with this rather large error.

The Zeit article and overall story leaves many unanswered questions including several of the points that are used to point at a pro-Ukrainian group. It is stated that the group has been professionally trained and used very high quality fake passports during the operation to protect their identity. At the same time though the boat charter was reportedly paid for by a Polish company owned by two Ukrainians leaving a very direct link back to Ukraine. It is also stated that the yacht was returned “uncleaned” after the charter, which undoubtably aided the authorities in finding explosive residue inside the boat on the table. For a highly sophisticated operation carried out with focus on secrecy and apparent subterfuge, why did the team involved decide to be so careless at this pivotal final moment as to not clean the yacht prior to returning it?

The Times wrote another piece where they state that the explosives were driven from Poland into Germany. Why would the group acquire explosives in Poland and then risk transporting it over the border to Germany and sail of out Rostock? It would have been safer and logistically easier to set sail from a Polish marina which is also closer to Bornholm and the site of the Nord Stream sabotage. This adds a large amount of increased complexity and risk for no logical reason.

Depending on the amount of explosives used in the sabotage of the Nord Stream pipeline, the size of the vessel can also be questioned. In the article by The New York Times, they mentioned a previous quote from the investigation that stated that up to 500kg of explosives was used at each Nord Stream 1 site. If this is true, that would make the use of a Bavaria Cruiser 50 to perform this sabotage very unlikely. Transporting this amount of explosive on a 15m yacht along with 6 people and large amount of tanks and equipment for the dives would be close to impossible, not to mention the task of moving this amount of explosives from the yacht down to the pipes. Even with a small amount of explosives, performing several technical dives to 80m from a yacht like the Andromeda would be very difficult and highly impractical.

The story also makes no mention of the Greek flagged crude oil carrier the Minerva Julie which circled the area around the Nord Stream 1 explosion sites between the 5th and 13th September. Coincidentally the exact same time as the “Andromeda” would have been in the area placing the charges on the pipes. Using the “Andromeda” to transport the team and possible supplies and meet up with the Minerva Julie sounds like a more plausible scenario to me.

Additionally, the locations of the Nord Stream 1 explosions are in some of the deepest water in the area directly surrounding Bornholm. Why would a non-state actor operating off a 50 foot yacht decide to place the explosives at the most difficult and time-consuming location? The vessel was relatively small and not equipped with active AIS, so there would be hundreds of more accessible locations along the pipes for the saboteurs to place the explosive charges. On top of this, blowing the pipeline towards the deepest point in the area reduces the amount of the pipeline that is flooded and as a result makes it easier and cheaper to repair. The group chose the most difficult area to perform the dive where the damage would be the easiest to repair.

The yacht story does not explain why only three of the four Nord Stream pipes were destroyed and why a single Nord Stream 2 pipe was ruptured approximately 80km away from the location of the two Nord Stream 1 explosions. This is a point I have previously tried to explain with an alternative hypothesis.

All in all, this investigation into the Andromeda adds several interesting details to the story, but also leaves a lot more mystery out there. It is interesting to note that the Russian government is strongly denying this series of events and sticking firmly with the Seymour Hersh story that I have previously debunked. Today Dmitry Peskov was quoted saying “As for some kind of pro-Ukrainian" Dr. Evil ", who organized all this, it's hard to believe in it.” This raises some questions as to why Russia is so keen to completely dismiss a scenario that implicates Ukraine in the destruction of Nord Stream.

Thank you for reading, if you enjoyed this newsletter or my content on Twitter , please consider becoming a premium subscriber to support my work.

Ready for more?

• EILMELDUNG — __proto_headline__

After the attack: damage to the Nord Stream 2 pipeline

Investigating the Nord Stream Attack All the Evidence Points To Kyiv

• Zur Merkliste hinzufügen
• Link kopieren
• Weitere Optionen zum Teilen

The Andromeda is a decrepit tub. The sides of the vessel are dented and scraped from too many adventuresome docking maneuvers while the porous pipes in the head exude a fecal stench. The 75 horsepower diesel engine rattles like a tractor and the entire boat creaks and groans as it ponderously changes course. The autopilot is broken. Other sailors hardly take any notice at all of the sloop: Just another worn charter vessel like so many others on the Baltic Sea.

The perfect yacht if you're looking to avoid attracting attention.

The article you are reading originally appeared in German in issue 35/2023 (August 25th, 2023) of DER SPIEGEL.

According to the findings of the investigation thus far, a commando of divers and explosives specialists chartered the Andromeda almost exactly one year ago and sailed unnoticed from Warnemünde in northern Germany across the Baltic Sea before, on September 26, 2022, blowing holes in three pipes belonging to the natural gas pipelines Nord Stream 1 and Nord Stream 2. It was a catastrophic assault on energy supplies, a singular act of sabotage – an attack on Germany.

The operation was aimed at "inflicting lasting damage to the functionality of the state and its facilities. In this sense, this is an attack on the internal security of the state." That's the legal language used by the examining magistrates at the German Federal Court of Justice in the investigation into unknown perpetrators that has been underway since then.

Unknown because – even though countless criminal investigators, intelligence agents and prosecutors from a dozen countries have been searching for those behind the act – it has not yet been determined who did it. Or why. The findings of the investigation thus far, much of them coming from German officials, are strictly confidential. Nothing is to reach the public. On orders from the Chancellery.

A diver with the German Federal Police's GSG9 special force

"This is the most important investigation of Germany's postwar history because of its potential political implications," says a senior security official. Those within the Federal Criminal Police Office (BKA) who are responsible for the Nord Stream case, members of Department ST 24, are even prohibited from discussing it with colleagues who aren't part of the probe. Investigators are required to document when and with whom they spoke about which aspect of the case – a requirement that is extremely unusual even at the BKA, Germany's equivalent to the FBI.

There is a lot at stake, that much is clear. If it was a Russian commando, would it be considered an act of war? According to Article 5 of the North Atlantic Treaty, an attack on the critical infrastructure of a NATO member state can trigger the mutual defense clause. If it was Ukraine, would that put an end to Germany's ongoing support for the country with tank deliveries or potentially even fighter jets? And what about the Americans? If Washington provided assistance for the attack, might that spell the end of the 75-year trans-Atlantic partnership?

German Interior Minister Nancy Faeser

Beyond that, as if more critical questions were needed, the Nord Stream attack has provided a striking blueprint for just how easy it can be to destroy vital infrastructure like pipelines. "It immediately raised the question for me: How can we better protect ourselves," says German Interior Minister Nancy Faeser. "The disruption of critical infrastructure can have an enormous effect on people's lives."

There are plenty of targets for such attacks: internet nodes, oil pipelines, nuclear power plants. One can assume that close attention is being paid in North Korea, Iran and other terrorist states on what exactly will happen now. If the perpetrators are not found, if the sponsors of the attack are not sanctioned, if there is no military reaction – then the deterrents standing in the way of similar attacks in the future will be significantly fewer.

But there are leads. DER SPIEGEL, together with German public broadcaster ZDF, assembled a team of more than two dozen journalists to track them down over a period of six months. Their reporting took them around the globe: from the Republic of Moldova to the United States; from Stockholm via Kyiv and Prague to Romania and France. Much of the information comes from sources who cannot be named. It comes from intelligence agencies, investigators, high ranking officials and politicians. And it comes from people who, in one way or another, are directly linked to suspects.

An image taken underwater after the bombing attack on Nord Stream 1

At some point in the reporting, it became clear that the Andromeda had played a critical role, which is why DER SPIEGEL and ZDF chartered the boat once the criminal technicians from the BKA had released it. Together, six reporters followed the paths of the saboteurs across the Baltic Sea to the site of one of the explosions in international waters.

This voyage on its own did not reveal the secrets of the attack, but it made it easier to understand what may have happened and how – what is plausible and what is not. And why investigators have become so convinced that the leads now point in just one single direction. Towards Ukraine.

That consensus in itself is striking, say others – particularly politicians who believe the attack from the Andromeda may have been a "false flag" operation – an attack intentionally made to look as though it was perpetrated by someone else. All the leads point all-too-obviously towards Kyiv, they say, the clues and evidence seem too perfect to be true. The Americans, the Poles and, especially, the Russians, they say, all had much stronger motives to destroy the pipeline than the Ukrainians.

Still others believe that too many inconsistencies remain. Why did the perpetrators use a chartered sailboat for the operation instead of a military vessel? Why wasn't the Andromeda simply scuttled afterwards? How were two or three divers on their own able to blow up pipelines located at a depth of around 80 meters (260 feet) beneath the waves?

The story of the operation is a preposterous thriller packed full of agents and secret service missions, special operations and commando troops, bad guys and conspiracy theorists. A story in which a dilapidated sailboat on the Baltic Sea plays a central role.

It's a chilly January day in Dranske, a town on the northwest tip of the German Baltic Sea island of Rügen. The law enforcement officials show up at 9:45 a.m. for the search, 13 of them from the BKA and Germany's Federal Police, including IT forensic experts, a crime scene investigator and explosives specialists. Their target on this morning are the offices of Mola Yachting GmbH, and they tell the shocked employees that they have a search warrant for a boat that was chartered from the premises. The punishable offense listed on the warrant: "The effectuation of an explosive detonation, anti-constitutional sabotage."

They demand to know where the Andromeda is. The technical chief of Mola tells them it is in winter storage, a few hundred meters away. He leads the group of law enforcement officials along a secluded private road to a former East German army facility, as a confidential memo documents. The Andromeda is sitting on blocks out in the open, with workers sanding down the hull. The search begins at 11:05 a.m. It lasts three days.

The investigators are lucky. Mola didn't clean the boat before storing it for the winter, and the saboteurs were the last people to charter the vessel. A plastic bottle "with apparently Polish labeling" is found next to the sink. Beneath the map table is a single "barefoot shoe." According to the BKA's search log, file number ST 24-240024/22, the officials remove the marine navigation system, a model called Garmin GPSMAP 721.

The sailing yacht Andromeda in the Baltic Sea

Christian Irrgang / DER SPIEGEL

The next day, the federal police bring two bomb-sniffing dogs onboard; they have to be hoisted up using a kind of winch. They spend more than an hour sniffing around onboard the Andromeda . With success, as forensics experts would later confirm in the lab. On a table belowdecks and even on the toilet, they are able to find substantial traces of octogen, an explosive that also works underwater.

Ever since the search of the ship on those days in January, German investigators have been certain that the Andromeda is the key to the Nord Stream case. Finally, a breakthrough.

Early in the investigation, it seemed that such a breakthrough would never come. The few leads the detectives had all turned up nothing of substance, and they had no clear indications of who the perpetrators might be. But then, a few weeks after the attack, intelligence was passed to the BKA indicating that a sailboat was involved.

To avoid causing concern and attracting unwanted attention, the investigators contacted boat rental companies in Rostock and surroundings one at a time – ultimately zeroing in on Mola and the Andromeda .

It was a rather surprising development for the public at large, particularly given that other scenarios seemed so much more likely: submersibles, specialized ships, at least a motorboat or two. But a single sailboat as the base of operations for the most significant act of sabotage in European history?

German officials were also skeptical at first. The federal public prosecutor general commissioned an expert analysis with a clear question of inquiry: "Whether such an act could be carried out with a completely normal yacht or if a much, much larger vessel was necessary." Such was the formulation used by Lars Otte, the deputy head of the Federal Public Prosecutor's Office, during a confidential, mid-June session of the Internal Affairs Committee of German parliament, the Bundestag. Speaking to the gathered parliamentarians, he stressed: "The assessment of the expert is: Yes, it is also possible with a completely normal yacht of the kind under consideration."

On September 6, 2022, the Andromeda was bobbing in the waves along with dozens of other boats in a marina in Rostock's Warnemünde district waiting to be taken out by its next renters. For the last decade, it has been plowing through the Baltic Sea every few days, with a new charter crew at the helm. The Andromeda is a Bavaria 50 Cruiser, built in Bavaria in 2012 and frequently belittled by sailors as the "Škoda of the seas." Not exactly elegant, but practical, a bit like a floating station wagon: 15.57 meters (roughly 51 feet) long and a beam of 4.61 meters, it is rather affordable for its size.

Belowdecks, it has five small cabins with space for a maximum of 12 people, if you don't mind a bit of crowding. The double berths are hardly 1.2 meters wide. By contrast, though, there is plenty of storage space and the kitchenette is relatively spacious, complete with a gas stove and a banquette surrounding a varnished dining table. A swimming platform can be folded down from the stern, making it easy to take a dip. It is ideal for divers with their heavy equipment.

A cabin on board the Andromeda

The marina Hohe Düne is located around 10 kilometers from the Rostock city center as the crow flies, a strangely lifeless place with a giant wellness hotel and a solitary pizzeria. Long piers wind their way out into the water to 920 morages, with a small wooden structure right in the middle of Pier G. Those who have chartered a yacht with Mola Yachting must register here, complete with identification, sport boat license and a 1,500-euro deposit.

On September 6, according to reporting by DER SPIEGEL and ZDF, a sailing crew checked in at the Mola shack in the early afternoon to take out the Andromeda . The charter fee had apparently been paid by a Warsaw travel agency called Feeria Lwowa, a company with no website or telephone number.

According to the Polish commercial registry, the company is headed by a 54-year-old woman named Nataliia A., who lives in Kyiv. She completed a course of study in early childhood education, but has no recognizable experience in the tourism industry. She has a Ukrainian mobile phone number. If you call it, a woman answers – before immediately hanging up once you identify yourself as a journalist. A few days later, a Ukrainian "police officer" called back, threatening the reporter with charges of "stalking," citing a rather flimsy justification. Feeria Lwowa's address in Warsaw likewise leads nowhere. There is no office and there are no local employees. It looks as though it is a shell company.

And something else would soon prove to be extremely challenging for investigators: When the saboteurs showed up at the Mola shack to check in for their rental of the Andromeda , they apparently presented a Romanian passport. It had been issued to a certain Ştefan Marcu, as official documents indicate. But who was he? Did he have anything to do with the attack?

Marcu opens the steel gate to his property wearing shorts and flipflops. It is the middle of July, a hot day in Goianul Nou, a village in Moldova just north of the capital of Chiᶊinǎu. The Ukrainian border isn't even 50 kilometers from here.

Ştefan Marcu is a sturdily built man with a deep tan and a black moustache, an engineer with his own company. A team from DER SPIEGEL and ZDF along with reporters from the investigative networks Rise Moldova and OCCRP managed to track him down. The two-story home where he lives with his family is the most attractive one on their street. Marcu stares down at the note the reporters show him, bearing the number 055227683.

Was Ştefan Marcu's passport forged?

He recognizes it immediately. He says he is a citizen of Moldova, but that the number belonged to his old Romanian passport, which expired the previous October. The last time he used the passport, he says, was in 2019 for a vacation in Romania and then, a couple months after that, for a trip to Bulgaria. He says he has no idea how his name got mixed up in the pipeline story. It's the first time he's heard about it, he insists. Aside from the reporters, nobody else has asked him about it, he says, no police officers and no intelligence agents.

After he received his new passport, he says, the woman at the office invalidated his old one. "When I got home, I burned it. I threw it in the oven," Marcu says.

But the data from his passport, officials believe, seems to have been used to produce another document, a falsified passport that was then used to charter the Andromeda . Complete with a new photo. The photo, though, is not of Ştefan Marcu, the 60-year-old from Moldova, but of a young man in his mid-20s with a penetrating gaze and military haircut. The man in the photo is very likely Valeri K. from the Ukrainian city of Dnipro. He apparently serves in the 93rd Mechanized Brigade of the Ukrainian army.

It's not possible to determine precisely when the saboteurs left the Hohe Düne marina. But the very next day, on September 7, they made their first stop just 60 nautical miles away in Wiek, a tiny harbor on the north coast of Rügen. Under normal circumstances, it is part of a long but idyllic sailing trip along the coast of Mecklenburg-Western Pomerania, past the Fischland-Darss peninsula and the island of Hiddensee.

It takes the team of reporters around 12 hours to sail this first leg of the journey, in pleasant, mid-July weather and calm seas. For most of that distance, the Andromeda is propelled by its motor, at a relatively constant clip of seven to eight knots. In a strong wind, when the mainsail can be set on the 22-meter-tall mast along with the jib, the ship can reach speeds of 10 to 11 knots.

In contrast to Warnemünde, Wiek is a solitary, isolated place, vastly different from the busy Rostock marina. Those wishing to load up their boat in Rostock have to push a handcart back and forth across long piers past dozens of other boats and crews. In Wiek, though, it is possible to drive a delivery truck right up to one of the few moorages that are large enough for a vessel the size of Andromeda . When the skipper of the DER SPIEGEL/ZDF voyage called ahead to reserve a moorage, the harbormaster asked: "Do you want the same spot as the terrorists?"

The harbor master in Wiek on the island of Rügen

The harbor master's notebook, with amounts of diesel pumped and the price

Still, during our visit, marina staffers prove reluctant to talk about the Andromeda and its stopover, at least not on the record. One of the workers who has clear memories of the sailboat's layover and who dealt directly with the crew says that the people on board seemed physically fit and familiar with each other, and that they spoke in a language he was unfamiliar with.

The crew was made up of five men and a woman, says the harbormaster, who filled up the fuel tank of the Andromeda for the saboteurs. That was during the boat's second stop in Wiek, on the return trip to Warnemünde. He wrote down the amount paid for the diesel in a black notebook, the same one he uses to record the fuel purchased by the crew of reporters.

The harbormaster flips back through his notebook and finds two entries that may have been for the diesel purchased by the team of saboteurs: one for 665.03 euros and one for 1,309.43 euros on September 22 and 23, respectively. In addition to filling the boat's tank, though, he recalls, he was also asked to fill up several canisters. One of the men paid for the fuel in cash, pulling a striking number of large-denomination euro bills out of his pocket to do so – but he didn't leave a tip.

After the first stopover in Wiek, the Andromeda disappeared for an extended period. With the help of a meter, investigators have determined that the crew didn't sail the ship and used the motor instead. Around 10 days later, the vessel apparently reappeared off the island of Christiansø, not much more than a rock jutting out of the waves near Bornholm, so small that it is sometimes called Pea Island. The port lies attractively below defensive fortifications built in 1684. The island, located near the easternmost point of Denmark, is home to hardly more than 100 residents, but it is a popular destination for day-trippers who sail over from the vacation island of Bornholm for a lunch of kryddersild .

The harbor at Christiansø in Denmark

It seems safe to say, though, that the saboteurs weren't there for the pickled herring: Christiansø is the nearest port to the site of the detonations. And a chartered sailboat doesn't stand out at all, with almost 50 vessels sailing in and out on busy days, says Søren Andersen. The chief of administration for the tiny islands, Anderson is sitting among portraits of the Danish royal family in a white-plastered building with a green door made of wood and a sign reading "Politi," police. "In December, the Danish police requested us to share all the port data" from September 16 to 18, 2022, says Anderson.

That was when the commando on board the Andromeda made a brief detour – directly south to Poland. On September 19, exactly one week before the pipelines were blown up, the Andromeda docked in Kołobrzeg, Poland, a Baltic Sea resort known for its saline springs and usually packed with tourists during the summer months. And with sailboats. The Andromeda only stayed for 12 hours.

Poland was always one of the most adamant opponents of Nord Stream 2 and vociferously demanded over the course of several years that the project be stopped. Warsaw long viewed Germany's dependence on energy from Moscow as an existential threat. It would be fair to say that Poland had a strong interest in eliminating this threat to its security right off its coastline once and for all.

In May, German investigators traveled to Poland for a "meeting at the level of the prosecutor's offices conducting the investigation," as it would later be described. One question addressed during that meeting was whether the saboteurs had received any support while in Kołobrzeg, either of a material nature, or in the form of personnel. They wanted to know if the port may have been used as a logistical hub.

The responsible public prosecutor in Danzig, from the department for organized crime and corruption, vehemently denies such a scenario when asked. "There is absolutely no evidence for the involvement of a Polish citizen in the detonation of the Nord Stream pipelines," he says. "The investigation has found that during the stay in a Polish harbor, no objects were loaded onto the yacht." In fact, he notes, "the crew of the yacht was checked by Polish border control officials" because they had raised suspicions. Perhaps because of the falsified documents used by the crew? Whatever triggered their concerns, the border control officials made a note of the personal information they had presented.

By September 20, the Andromeda had already departed from Kołobrzeg. By this time, the explosives had likely already been laid and equipped with timed detonators. Christiansø, the sailboat's previous port of call, is, in any case, the closest to the main detonation site. It is located just 44 kilometers – less than a three-hour voyage to the northeast – from the coordinates 55° 32' 27" north, 15° 46′ 28.2" east.

The Baltic Sea gets rather lonely to the east of the Pea Islands. There are fewer ferries, fewer tankers and not too many sailboats either. For miles around, there is nothing but water and sky.

There is, however, something to see on the sonar, some 80 meters below: Four pipes, each with an inside diameter of 1.15 meters, wrapped in up to 11 centimeters of concrete which keeps them on the sea floor, and a layer to protect against corrosion. Beneath that is four centimeters of steel and a coating to ensure the natural gas flows more freely on its long journey from Russia to Germany.

Nordstream 1 begins in the Russian town of Vyborg and runs through the Gulf of Finland and crosses beneath the Baltic Sea before reaching the German town of Lubmin, located near the university town of Greifswald.

The double pipeline is 1,224 kilometers long and consists of 200,000 individual segments, most of which were produced by Europipe in Mühlheim, Germany. During construction, 15 freight trains per week rolled into the ferry port of Sassnitz, where the pipe segments were loaded onto a ship. The project's price tag was 7.4 billion euros, with most of it paid for, directly or indirectly, by the Russian state.

It went into operation in 2012, sending almost 60 billion cubic meters of natural gas from the Russian fields Yuzhno-Russkoye and Shtokman, located on the Barents Sea, to Germany. In 2018, the pipeline accounted for 16 percent of all European Union natural gas imports. Nord Stream 1 was one of the most important pipelines in the world.

Then Russian Prime Minister Vladimir Putin aboard the ship laying the Nord Stream pipeline in 2010

In spring 2018, dredgers again sailed into the Bay of Greifswald to make way for Nord Stream 2, also a double pipeline. This one starts a bit further to the south, in the town of Ust-Luga, located in the Leningrad Oblast – but most of it runs parallel to the first pipeline. It was planned to carry 55 billion cubic meters of Russian natural gas per year to Germany. Taken together, the two pipelines were able to transport far more than Germany consumed each year. Most Germans were in favor of the new pipeline project, blinded to their country's growing dependency on Moscow by the cheap price of Russian gas. A 2021 survey among supporters of all political parties found that an average of 75 percent of Germans were in favor of Nord Stream 2.

Security policy experts and many of Germany's international allies, by contrast, were aghast. Nord Stream 1 had already tied Germany far too closely to Russia, they felt. And now Berlin wanted to import even more energy from Vladimir Putin's empire? The Americans, in particular, were vocal about their opposition to the project. Indeed, Washington thought Nord Stream 2 was so dangerous that it warned Germany that its completion would significantly harm U.S.-German relations.

Ukraine was also radically opposed to the new pipeline. Significant quantities of Russian natural gas flowed to Western Europe through overland pipelines across Ukrainian territory. A second pipeline beneath the Baltic would make parts of the Ukrainian pipeline network obsolete. Kyiv saw Nord Stream as a direct threat to the country.

In September 2021, Nord Stream 2 was completed, but it did not go into operation. And a few months later, the Russian invasion of Ukraine put an end to the political debate – and left Germany scrambling to free itself from dependency on energy imports from Russia as quickly as possible. The initial plan called for continuing to import natural gas through Nord Stream 1 for a time, but the second pipeline was essentially dead in the water.

For the time being, at least. But politics can be fickle, consumers and industry have a fondness for cheap energy and Putin wouldn't be around forever, would he? The four pipes lay on the seabed, ready to be put back in use once that time came.

At 2:03 a.m. on September 26, a blast wave rippled through the bed of the Baltic Sea, powerful enough to be recorded by Swedish seismographs hundreds of kilometers away. The welded seam between two segments of pipe A of Nord Stream 2 was shredded. It was a precise cleavage, likely caused by a relatively small amount of perfectly placed specialized explosive material: octogen. Exactly the same explosive of which forensics experts would later find traces onboard the Andromeda . The explosion initially ripped a roughly 1.5-meter gap in the pipe, but the gas gushing out enlarged the leak.

Seventeen hours later, at 7:04 p.m., there was another blast wave, this time 75 kilometers to the north. It was much stronger, and there were several explosions. Above water, the muffled blast could be heard several kilometers away. This time, both pipes belonging to Nord Stream 1 were destroyed: a 200-meter section of pipe A and a 290-meter segment of pipe B. A 3-D visualization based on underwater camera footage and sonar readings shows deep craters, piles of rubble and bits of pipeline sticking up diagonally from the seafloor.

Initially, nobody knew just how dramatic the situation was, not even the operators of the two pipelines, Nord Stream AG and Nord Stream 2 AG. Both companies are majority owned by the Russian natural gas giant Gazprom. Initially, they only registered a drastic fall in pipeline pressure, but technicians were immediately concerned that something might by wrong, as were military representatives in the region. On the morning of September 27, a Danish F-16 fighter discovered strange bubbles on the surface of the water, and the Danish military published the first images that afternoon: Natural gas rising up from the bottom of the Baltic had formed circles of bubbles up to 1,000 meters across on the water's surface not far from Bornholm.

An upwelling of gas from the Nord Sea pipeline after the explosions

It's not yet possible to say with complete certainty how the perpetrators went about their business. But the findings of the international investigation make it possible to reconstruct much of what took place. Data from geological monitoring stations, videos and sonar data from the seafloor provide additional clues. That data comes from a Swedish camera team and from Greenpeace, both of which launched their own surveys using underwater devices. For experts, the publicly available information paint a largely consistent picture, according to which the group of saboteurs was likely made up of six people – five men and a woman. Likely a captain, divers, dive assistants and perhaps a doctor.

According to former military and professional divers, the operation would have been possible, though challenging, with such a team. "It's pitch black down there, cold, and there are currents," says Tom Kürten. As a technical diver and expedition leader, he has been inspecting wrecks on the bottom of the Baltic Sea for many years. With the correct equipment, it is possible to dive to depths of 100 meters or more, and he believes it would be impossible to locate the pipelines without technical assistance. Indeed, with a small DownScan, a sonar device, it would be relatively simple, he says. And once the spot has been identified, all you have to do, he says, is throw a "shot line" overboard, a rope with a weight on the end that guides the divers into the depths.

For challenging dives, Kürten also uses a rebreather, which recycles exhaled air and replenishes it with oxygen for the next breath. The advantage is that no tanks are needed, and such devices also produce fewer bubbles, which can be helpful if you are seeking to avoid unwanted attention. Still, such an operation takes time. For 20 minutes spent working at a depth of 80 meters, a total of three hours of dive time is necessary, Kürten estimates. During the ascent, decompression stops are vital so that the body can adjust from the high pressure on the seafloor to the lower pressure at the surface. It's a rather complex undertaking, but certainly possible during a long trip.

Later, when German investigators undertook a closer examination of the detonation sites, specialists from the maritime division of the German special forces unit GSG 9 dived down to take a look.

However you look at it, the operation could not have been performed by amateur divers – nor by hobby sailors. When the team of reporters in the Andromeda arrived at the site above where the explosions took place, a force 5 or 6 wind was blowing, it was raining, and the swells were significant. Standard Baltic Sea weather, in other words – in which it is difficult to keep a sailboat in one spot. According to weather data, mid-September 2022 was similar for several days, though it was calmer both before and afterward.

Explosives expert Fritz Pfeiffer produced an expert opinion for Greenpeace regarding the potential destructive power of the detonations, since the environmental group was interested in knowing how much damage had really been done to the pipeline and what that might mean for the environment.

On underwater images of Nord Stream 1, Pfeiffer identified craters that he believes were created by large amounts of explosives detonating next to the pipeline. Investigators, though, think that a total of less than 100 kilograms of explosives were used and that the sudden release of the highly pressurized natural gas caused much of the damage.

Not far from the long stretches of destroyed pipes belonging to Nord Stream 1, the A pipe of Nord Stream 2 was attacked a second time – the same line that had already been severed 17 hours earlier further to the south. The pipe tore open along a length of approximately 100 meters. A so-called "cutter charge" was likely used, directly over a welded joint. Pfeiffer believes that just eight to 12 kilograms of octogen would have been necessary for such a detonation.

The B pipe of Nord Stream 2, meanwhile, wasn't harmed at all – and could easily be put into use even today. But why did the perpetrators leave one of the four pipes undamaged? There are some indications that the saboteurs confused the A and B pipes of Nord Stream 2 in the darkness and unintentionally attacked the same pipe twice.

Whatever the case, experts seem to agree on one salient fact: specialized submarines or remote-controlled submersibles were not necessary for the operation. But there are several questions to which no answer has yet been found. How were the bombs detonated? Why did so much time pass between the first explosion and the three that followed? Some experts believe that they might have had difficulties in activating the explosives – either via a delayed detonator or a remote detonator.

Perhaps the attack could have been prevented in the first place. It didn't come as a complete surprise, after all. It had been announced several months beforehand, in detail. But the warning wasn't taken seriously enough in the right places.

An encrypted, strictly confidential dispatch from an allied intelligence agency was received by the Bundesnachrichtendienst (BND – Germany's foreign intelligence agency) in June 2022. Such dispatches are hardly an anomaly, but this one contained a clear warning. It was from the Netherlands' military intelligence agency, which goes by the initials MIVD and is well known for its expertise in Russian cyberwarfare techniques. On this occasion, though, the agency's alarming information seemed to have come from a human asset in Kyiv.

The Dutch also informed the CIA – which, just to be on the safe side, also forwarded it onward to the Germans.

The confidential dispatch sketched out an attack on the Nord Stream pipelines. The plan called for six commando soldiers from the Ukraine, concealed with fake identities, to charter a boat, dive down to the bottom of the Baltic Sea with specialized equipment and blow up the pipes. According to the information, the men were under the command of Ukrainian Commander-in-Chief Valerii Zaluzhnyi, but President Volodymyr Zelenskyy had apparently not been informed of the plan. The attack was apparently planned to take place during the NATO exercise Baltops on the Baltic Sea. The content of the secret dispatch was originally reported on by the Washington Post in early June.

Ukrainian President Volodymyr Zelenskyy (left) and Armed Forces Commander-in-Chief Valerii Zaluzhnyi (right)

The BND forwarded the warning to the Chancellery, but at German government headquarters, it was deemed irrelevant. After all, it only arrived at the Chancellery after the NATO maneuver had come to an end, and nothing had happened. That is why nobody sounded the alarm, says one of the few people who learned of the warning when it arrived. Most German security officials believed the information contained in the dispatch was inaccurate.

As a result, no protective measures were introduced, no further investigations were undertaken and no preparations were made to potentially prevent an attack at a later point in time. The Federal Police, the German Navy and the antiterrorism centers never even learned of the warning.

Nor did the German agency responsible for the oversight of Nord Stream.

In the early morning hours of September 26, Klaus Müller, president of the Federal Network Agency, received a telephone call. His agency is responsible for regulating Germany's electricity and natural gas grids. Christoph von dem Bussche, head of the company Cascade, which operates 3,200 kilometers of Germany's natural gas pipelines, was on the other end of the line. According to sources in Berlin, Bussche told Müller that one of the Nord Stream pipelines had just experienced an inexplicable loss of pressure.

The head of the Federal Network Agency must have immediately realized how important that phone call was. He called German Economy Minister Robert Habeck.

Habeck, who is also the vice chancellor, was the first cabinet member to learn of the attack on the pipelines. Sources indicate that he was just as surprised as Müller had been. Neither of them had apparently known about the warning that had been received three months before.

It had also apparently not been discussed in the German Security Cabinet, the smaller group of ministers that has been meeting regularly in the Chancellery since the Russian invasion of Ukraine. Müller, though, is the first person who should have been informed of increased risks posed to the pipeline: He is in charge of ensuring the smooth operation of Germany's numerous pipelines, and of protecting them if need be.

The U.S., by contrast, apparently sprang into action in summer 2022, even if the Americans didn't initially trust the Netherlands' source. Washington carefully approached Kyiv with a clear message: Don't do it! Abort the operation! The German weekly newspaper Die Zeit and public broadcaster ARD were the first to report on Washington's warning to Kyiv. But the message from the American's apparently wasn't taken seriously. Perhaps Washington lacked a certain amount of credibility, particularly given how clear they had made it in the past that they were deeply opposed to the gas pipelines connecting Germany and Russia.

Was there perhaps even more information that wasn't passed along? Did the well-informed Dutch military intelligence agents know even more than they shared, such as who was to be on board the ship and perhaps even from which Ukrainian unit they came from? If so, that information is no longer available. Leaving the German investigators to assemble the puzzle pieces on their own.

One lead stems from the falsified passport of Ştefan Marcu. And from the man whose photo is apparently on that document: Valeri K.

Back in June, Lars Otte, the federal prosecutor, told members of the Internal Affairs Committee at the Bundestag that investigators had been able to "almost certainly identify a person who may have taken part in the operation."

The lead takes us to a large city in central Ukraine, to an abominable Soviet-era prefab residential building on the outskirts of Dnipro. The structure has eight, not entirely rosy-smelling entrances, a bar and a minimarket called Stella on the ground floor.

On the third floor of the first entrance is an apartment that is registered to the father of Valeri K. He, too, is called Valeri – and both are members of the military, say neighbors.

Nobody opens the door, despite extended knocking. Instead, the neighbors peek out, an elderly married couple. They say that the Valeris actually live in the building next door and that they only rent out this apartment. The younger Valeri K.'s grandmother, the couple says, used to work at Stella, and suggested dropping by there.

It's stuffy inside the store, and smells of dried fish. The saleswoman says that the grandmother is now the janitor of the neighboring building. Five minutes later, Lyubov K. sets aside her broom and sits down on a bench. She's a small woman with red-dyed hair and speaks Russian. She says she doesn't want to speak with the press, but remains seated on the bench. When asked if her grandson Valeri is in the army, she says "yes." What does he do there? "I don't know." She does say, though, that her son and grandson had only been called up a few months before. The conversation remains brief, ending with the grandmother claiming that her grandson couldn't have been onboard the Andromeda because he doesn't have a passport and is unable to travel overseas.

Another neighbor, a retiree with gray curls and wearing a blue shirt, is more talkative. Her son, she says, went to school with Valeri senior and they also worked together. The two of them had taken a job at a shipyard in Turkey several years before.

Then, the neighbor says, Valeri senior embarked on a completely different career path, smuggling migrants across the Mediterranean on a sailboat. But the operation was busted and the Ukrainians involved arrested. The neighbor says that the younger Valeri K. wasn't involved though.

The neighbors don't have much to say about him. His presence on social media is also limited, apparently limited to VK, a Facebook clone that is popular in Ukraine and Russia.

The most striking thing about the younger Valeri K. is that he is a follower of the openly nationalist youth organization VGO Sokil. It offers young men training in shooting and diving.

His most recent active VK profile is under the name "Chechen from Dnipro," and it is linked to a telephone number. If you enter the number into an App like Getcontact, you can see the names under which the number is saved in other people's contact lists. Among the names for Valeri's number is: "K. 93rd Brigade."

There are also leads to his long-time girlfriend Inna H. The two apparently aren't together any longer, but they have a son together. The mother and child no longer live in Dnipro, but in the German city Frankfurt an der Oder.

They live in a gray housing block just a few hundred meters from the Polish border. There are a number of Ukrainian refugees living in the building, including several relatives of Valeri K.: Inna H., the ex-girlfriend who is the mother of his son, his younger sister Anya K. and apparently also his maternal grandmother Tetyana H.

In May, they received a visit from the police, who searched the apartment. A DNA sample from Valeri K.'s son was then compared with traces found on the Andromeda . But there was no match.

Inna H. lives on one of the upper floors of the apartment block, but the door is opened by an elderly lady when a team of reporters from DER SPIEGEL rings the doorbell. She doesn't give her name, but she looks like the grandmother, Tetjana H., in photos. She doesn't want to talk to journalists.

If people have something to say, she says, they should discuss it with the authorities.

Asked about the accusations against Valeri K., she says only: "We are a simple family, the Germans saved us. Why would we want to do them any harm?"

Officially, politicians and the Office of the Federal Prosecutor are still holding back with any conclusions. Currently, it is not possible to say "this was state-controlled by Ukraine," Federal Prosecutor Otte says. "As far as that is concerned, the investigation is ongoing, much of it still undercover."

Behind the scenes, though, you get clearer statements. Investigators from the BKA, the Federal Police and the Office of the Federal Prosecutor have few remaining doubts that a Ukrainian commando was responsible for blowing up the pipelines. A striking number of clues point to Ukraine, they say. They start with Valeri K., IP addresses of mails and phone calls, location data and numerous other, even clearer clues that have been kept secret so far. One top official says that far more is known than has been stated publicly. According to DER SPIEGEL's sources, investigators are certain that the saboteurs were in Ukraine before and after the attack. Indeed, the overall picture formed by the puzzles pieces of technical information has grown quite clear.

And the possible motives also seem clear to international security circles: The aim, they says, was to deprive Moscow of an important source of revenue for financing the war against Ukraine. And at the same time to deprive Putin once and for all of his most important instrument of blackmail against the German government.

But crucial questions remain unanswered. From how high up was the attack ordered and who knew about it? Was it an intelligence operation that the political leadership in Kyiv learned about only later? Or was it the product of a commando unit acting on its own? Or was it a military operation in which the Ukrainian General Staff was involved? Intelligence experts and security policy experts, however, consider it unlikely that Ukrainian President Zelenskyy was in on it: In cases of sabotage, the political leadership is often deliberately kept in the dark so that they can plausibly deny any knowledge later on. In early June, when the first indications of Kyiv's possible involvement came to light, Zelenskyy strongly denied it. "I am president and I give orders accordingly," he said. "Nothing of the sort has been done by Ukraine. I would never act in such a manner."

In any case, it is difficult terrain for the BKA, not only politically, but also in practical terms. The German criminal investigators cannot conduct investigations in Ukraine, and it isn't expected that Kyiv will provide much support. The German authorities have also shied away from submitting a request to Ukraine for legal assistance because doing so would require that they reveal what they know. That could provide Ukraine the opportunity to cover up any traces that may exist and to protect the people responsible. Asked whether there will be arrest warrants one day, an official familiar with the events replies: "We need a lot of patience."

Senior German government official

A Ukrainian commando carried out an attack on Germany's critical infrastructure? Officials at the Chancellery in Berlin have been discussing intensively for months how to deal with the sensitive findings of the investigation. Chancellor Olaf Scholz has also been debating possible consequences with his closest advisers. Of course, there aren't many options available to them. A change of course in foreign policy or the idea of confronting Kyiv with the findings seems unthinkable.

The situation changed in March, when the New York Times , Germany's Die Zeit and Berlin-based public broadcaster RBB first reported on the evidence pointing to Ukraine. A little bit later, the Süddeutsche Zeitung newspaper also published its own investigative report. Soon after, Jens Plötner, an adviser to the chancellor, openly addressed the articles in a phone call with Andriy Yermak, one of President Vlodymyr Zelenskyy's closest confidants. The answer was clear: Yermak apparently assured the Germans that the Ukrainian government had not been involved in the plot and that no one from the security apparatus knew who was behind it.

Few in Berlin want to think right now about what action should be taken if the involvement of Ukrainian state agencies is proven. On the one hand, Germany couldn't simply brush off such a serious crime. But suspending support for Ukraine in its war against Russia also wouldn't be an option. "Everyone is shying away from the question of consequences," says one member of parliament with a party that is a member of the German government coalition.

The fact that politicians who normally might at least speak off the record are remaining silent and simply ignoring inquiries is an indicator of just how delicate the situation is. Inquiries about the situation regarding the attack on the Nord Stream pipeline - in ministries, at party headquarters and in parliamentary offices - as to how it is being discussed within the parties or whether the government is already thinking through scenarios for the eventuality that the Ukrainian leadership knew about the operation, go nowhere.

"No," says Irene Mihalic, the first parliamentary secretary of the Green Party, there was almost no discussion about the issue before the summer legislative recess. She says her party will wait for the outcome of the investigations, and that anything else would be pure speculation.

In fact, the information available to members of parliament in this case is also extremely thin. On the one hand, the federal public prosecutor naturally provides only scant information about ongoing investigations. More importantly, the federal government is keeping all the findings under wraps. Even most members of Scholz's cabinet as well as the deputies in the Parliamentary Control Committee, which is tasked with oversight of the work of the intelligence services, don't know much more than what is publicly reported about the attack.

German Chancellor Olaf Scholz (left) with Chancellery head Wolfgang Schmidt

The gatekeeper for information flows sits on the seventh floor of the Chancellery, diagonally opposite Olaf Scholz. Wolfgang Schmidt, the chancellor's closest confidant and head of the Chancellery, maintains intensive contact with the investigators. He is also briefed each week by the intelligence services and is happy to pick up the phone to make inquiries of his own. When asked, Schmidt says he doesn't want to comment on the Nord Stream case.

Sources within the investigation say they have been amazed by the level of interest the Chancellery head has shown in the progress of the proceedings. And at the same time, how little Berlin seems to care about shedding light on this unprecedented attack on the backbone of Germany's energy supply as quickly as possible.

The BKA has three main offices. One is in Wiesbaden, where investigators deal with organized crime, narcotics offenses, targeted searches and such things. Another, in Berlin, provides headquarters for its experts on issues including Islamist terrorism. And then there's the one in Meckenheim near Bonn, in a gray 1970s, box-like building surrounded by orchards and fields, with red-tiled hallways inside. This is the place where one of the most sensational crimes in German criminal history is to be solved, and it looks like some random rural school.

This is where the BKA's State Protection Department is housed, where the investigators tasked with solving politically motivated crimes work: offenses like attacks, assassinations, espionage and sabotage. In the past, the office investigated the Red Army Faction, domestic left-wing radicals who perpetrated numerous terror attacks in Germany in the 1970s. And the National Socialist Underground, a neo-Nazi cell that killed immigrants, mostly of Turkish descent, across Germany in the early 2000s. More recently, they have been focused on the Reichsbürger movement of militant protesters who deny postwar Germany's right to exists. Now it has the Nord Stream saboteurs in its crosshairs.

The BKA's offices in Meckenheim near Bonn in North Rhine-Westphalia

The responsible department is ST 24: State Terrorism. One might assume that dozens of criminologists are working here around the clock researching, searching, and following up on every little lead.

For a time, hundreds of BKA agents were investigating the right-wing extremist madmen around Heinrich XIII Prince Reuss, who had been planning an absurd coup attempt to topple the German government. But only a handful of investigators at most have been assigned to work on the Nord Stream case on a full-time basis.

Sources in Berlin say that a small, dedicated group of skilled investigators should be sufficient. Directing more staff wouldn't be of much use anyway, they argue, since there are no large groups to observe and they aren't allowed to conduct investigations in other countries. And if necessary, more BKA people could also be called in addition to support from the Federal Police.

But the perception among investigators is that the will to solve the case is not particularly pronounced in the capital. Politically, it is easier to live with what happened if it remains unclear who is behind the attacks. The process is not being hindered, but neither is there much support from the overarching government ministries. Meanwhile, it is clear to career-oriented ministry officials that there is no glory to be had with this case. If only because the culprits will likely never have to answer for their actions in Germany. Even if they could be identified, it's very unlikely they would be extradited.

So Berlin is looking away, and that is definitely being registered in agencies where staff is constantly in short supply and procedures have to be prioritized. All of which leads to the investigation falling down the priority list.

Regardless, the BKA unit is led by a chief inspector, an experienced veteran in his mid-50s who is considered a shrewd criminologist by his colleagues.

The German investigators frequently exchange information with officials in Sweden and Poland, and traveled to Warsaw and Stockholm in the spring. However, no agreement has been reached on forming a joint procedure, called a Joined Investigation Team in legal vernacular. Ostensibly because the intelligence agencies involved don't want to be constantly sharing their information internationally.

Still, sources in all three countries involved say there is tight coordination. Swedish Nord Stream experts are acting more assertively than the Germans, and it is possible charges could be filed before the end of the year. Mats Ljungqvist, the Swedish prosecutor responsible for the investigation there, recently told Radio Sweden that he believes they may be approaching the final phase of the case.

International investigators and agents also say that all the intelligence has been pointing in one direction: towards Kyiv. At least those who are familiar with the evidence and clues.

In the rest of the world, however, alternative scenarios are still circulating – some spurred by half-baked intelligence, some by amateur military experts and others driven more by domestic political or geostrategic interests.

The American journalist Seymour Hersh, 86, caused quite a stir, for example, when he accused the U.S. of committing the attacks. He claimed that a Norwegian naval vessel had secretly transported American combat divers into the Baltic Sea. The alleged motive: To make sure Russia would no longer be in a position to blackmail Germany with gas supplies. But Hersh didn't provide any evidence to back up his theory and essential parts of his article later turned out to be false. Hersh justified his reporting by saying that the information had been supplied to him by a source in Washington. The Russian government, though, was delighted and vaunted the baseless story as proof that the U.S. was the real warmonger.

Still others claim that such theories are extremely convenient for the Russians because they distract from the fact that they themselves are the perpetrators. As evidence of this, Russian ship movements in the Baltic Sea, reconstructed by journalists from the public broadcasters of Denmark (DR), Sweden (SVT), Finland (Yle) and Norway (NRK), are frequently cited.

On the night of September 21-22, for example, the Danish Navy encountered a conspicuous number of Russian ships east of Bornholm in exactly the area of the later blasts. The automatic identification systems on the boats had been turned off and they were traveling as unidentifiable "dark ships."

The 86-meter-long Sibiryakov , a hydrographic research vessel equipped for underwater operations, was also in the area. According to experts, it often accompanies Russian submarines on their secret test dives in the Baltic Sea. Some micro-submarines also have grabber arms that can be used to perform underwater work. Tasks like placing explosive charges.

But why would the Russians blow up their own pipeline? Especially given that they could simply block it at the push of a button? Why deprive yourself of a lever that still might be useful - at least a few years down the road – to resume blackmailing a Germany that is starving for cheap energy?

It's possible to find reasons, but they are all rather convoluted. One theory holds that Moscow wanted to save itself billions in damages after it violated its own contracts by cutting off promised Nord Stream gas supplies to Germany. If, on the other hand, the pipeline had been blown up by unknown persons, it would be considered a force majeure.

The next theory, somewhat more widespread even among Berlin politicians, goes like this: Russia destroyed the pipelines with the aim of later blaming it on the Ukrainians in a way that could undermine Western support for Kyiv. The Andromeda and all other evidence pointing to Ukraine was planted by Russian agents, they say, to throw the Europeans off the scent.

The theory that it was a "false flag" operation performed by the Russians is considered probable by Roderich Kiesewetter, the security and defense policy point man for the center-right Christian Democrats in the Bundestag. Kiesewetter says it would totally fit with Russia's style to pull off an operation like that perfectly and make it look like the trail leads to Kyiv.

Public prosecutor Lars Otte

Conversely, many other intelligence experts consider it highly improbable that Russian agents, who have show a predilection in recent years of more rustic methods - such as brazen and easily exposed political assassinations - could execute such a complex deception maneuver flawlessly.

German Federal Prosecutor Otte emphasized to the Bundestag's Internal Affairs Committee that they were definitely considering the "working hypothesis" that "state-directed perpetrators from Russia" could be responsible. "Of course, we're following up on those leads as well," Otte said. "But we don't have any evidence or confirmation of that so far."

Agents tend to believe there is a different, more straightforward explanation for the Russian Navy's clear presence in the Baltic last late summer: They suspect that Moscow, like the Dutch and the CIA, was not unaware of the plans to attack Nord Stream, and that the ships were there to patrol along the pipeline to protect it from the expected sabotage.

Particularly given that Ukraine apparently had plans to attack another Russian gas pipeline. Sources within the international security scene say that a sabotage squad had plans to attack and destroy the Turkstream pipelines running from Russia through the Black Sea to Turkey. A corresponding tip-off had also reached the German government together with the first warnings of an attack on the Nord Stream pipelines

It is unclear why there was no follow-up on the suspected plot to attack Turkstream.

One man who should be in a position to know could be found standing in the ballroom of the British Embassy in Prague on a hot July morning. Sir Richard Moore, the head of Britain's MI6 intelligence service, had arrived to discuss the global situation with selected intelligence colleagues and diplomats.

Moore is probably one of the best-informed men in the world. If anyone can gain access to all the available data about what happened in the run-up to the explosions under the Baltic Sea, it's the man with the gray crew cut and narrow reading glasses. DER SPIEGEL was able to ask him a quick question about the Nord Stream attack.

It is one of the few official, and thus mentionable encounters with an intelligence service for this story. Another takes place under similar conditions with CIA head William Burns in the posh American ski resort Aspen in the Rocky Mountains. Each year, the Who's Who of the U.S. security apparatus gathers there for the Aspen Security Forum. Burns was joined by senior U.S. armed forces officials and national security adviser Jake Sullivan.

When they spoke on the record on the subject of Nord Stream, the top intelligence officials were monosyllabic. Moore said in Prague that he didn't want to interfere in the investigations of Germany, Denmark and Sweden. And in Aspen, when asked about Nord Stream, only security adviser Sullivan responded, and briefly at that. "As you know, there is an ongoing investigation in multiple countries in Europe," Sullivan said coolly. "We'll let that play out, we'll let them lay out the results of the investigation."

The British MI6 chief at least provided a bit of context. He said that we have to be prepared for the fact that underwater attacks are now part of the arsenal of modern warfare. His service therefore informs the British government about its own Achilles' heels, adding that there are quite a few of them. "Seabed warfare," as such underwater operations are called in military jargon, is not just about pipelines for oil and gas. The power lines of offshore wind farms and especially undersea internet cables are also targets – and potentially even easier to destroy since you don't need explosives, just the right tools.

On September 23, three days before the explosive charges went off, the Andromeda returned to its home port in Rostock. The saboteurs, it is assumed, packed their things, handed in the boat key at the Mola Yachting charter base and walked away via Pier G.

It was one of the most amazing twists in this criminal case, at least at first glance. Why not just sink the boat, including the explosive residue and DNA traces?

Reporters from DER SPIEGEL and the public broadcaster ZDF in July 2022 aboard the Andromeda

Presumably because the investigators would have the been on the trail of the commando much sooner than three months later, because it was precisely such anomalies that they initially searched for: things like rented dive boats. Or charter boats that had suddenly disappeared. But the Andromeda remained just one yacht for hire among hundreds, long since back in port when the seabed shook. And the saboteurs had more than enough time to leave the country and cover their tracks.

Nine months later, on a Saturday afternoon in June, German Interior Minister Nancy Faeser (SPD) was standing at the harbor quay in Rostock's Warnemünde district. In the background, the masts swayed in the marina; in the foreground the BP84 Neustadt ship towered over everything, 86 meters long, with a 57 millimeter shipboard gun. The Neustadt is the Federal Police force's newest ship. It's also in part a response to the Nord Stream attack.

German Interior Minister Nancy Faeser with Federal Police head Dieter Romann (left) in front of the vessel Neustadt .

"Increasingly, the lines between internal and external security are becoming blurred, and nowhere is that more conspicuous than here," the interior minister said. She explained that the attack showed how vulnerable we are. "The Baltic Sea has become a geopolitical hotspot."

In the background, the Federal Police Orchestra played the maritime anthem "Save the Sea." It was time for the vessel's christening. Faeser pulled on a rope and a champagne bottle swung toward the Neustadt . The bottle hit the ship's hull with a dull clonk, without breaking. A murmur went through the crowd. Sailors believe it is bad luck if the bottle doesn't break.

Correction: In an earlier version of this story, CIA-Chief William Burns was called "Richard Burns”. We corrected the mistake.

Mehr lesen über

MIG head Sir Richard Moore: a few Achilles' heels

Advertisement

Supported by

Suspicions Multiply as Nord Stream Sabotage Remains Unsolved

Intelligence leaks surrounding the sabotage of the pipelines have provided more questions than answers. It may be in no one’s interest to reveal more.

• Share full article

By Erika Solomon

Erika Solomon traveled to Copenhagen and the island of Christianso in Denmark, as well as to the ports of Rostock and Wiek in northern Germany, to report and write this article.

Listen to This Article

Open this article in the New York Times Audio app on iOS.

Russian and Danish naval vessels that disappear in the Baltic Sea, days before an underwater pipeline blast. A German charter yacht with traces of explosives, and a crew with forged passports. Blurry photographs of a mysterious object found near a single surviving pipeline strand.

These are the latest clues in the hunt to reveal who, last Sept. 26, blew up most of the Kremlin-backed Nord Stream pipelines, some 260 feet below the Baltic Sea, that were once the largest supplier of Europe’s natural gas.

Nord Stream

pipelines 1 and 2

Sites of leaks

Christianso

Kaliningrad

Just a few weeks ago, New York Times reporting on new intelligence, along with German police findings reported by the German media, suggested a possible solution to the Nord Stream puzzle: pro-Ukraine operatives renting a German pleasure boat and pulling off a fantastical covert mission.

Since then, a flurry of new findings and competing narratives has sown distrust among Western allies and presented an opening for Russian diplomatic pressure that has raised the geopolitical stakes in Europe’s Baltic region.

Nowhere is the tension felt more strongly than among the 98 residents of Denmark’s Christianso — an island so tiny, you can walk across it in 10 minutes. Living just 12 nautical miles away from the blast site, everyone from the herring pickler to the inn chef sees skies and waters filled with foreboding.

“Before the blast, no one talked about Nord Stream. I didn’t even know how close we were until it happened,” said Soren Thiim Andersen, governor of Christianso. “Afterward, we all felt exposed. We were all wondering: What really just happened here?”

The pleasure boat at the center of the German investigation, the Andromeda, docked at Christianso’s stone harbor after being chartered in the northern German port of Rostock on Sept. 5 and making an overnight stop at Wiek, a more obscure north German port with no security cameras and little oversight.

A local port worker, who asked not to be identified because of ongoing investigations, told The Times that he remembered the visit unusually well: He had repeatedly tried to speak to the crew, first in German, then English. Instead of attempting any kind of reply, in any language, one man simply handed him the docking fee and turned away.

The Andromeda now sits in dry dock overlooking the Baltic Sea, its innards pulled out by investigators. Three German officials told The Times that the investigators had found traces of explosives on the boat, and discovered that two crew members had used fake Bulgarian passports.

That hunt led back to Christianso, where Mr. Andersen, the governor, said that in December, the Danish police had him write a Facebook post, instructing residents to send photographs of the harbor or boats from Sept. 16 to Sept. 18, around the time the Andromeda is believed to have docked. Investigators arrived a month later to interview residents and check the photos.

Christianso locals scoffed at the idea a 50-foot pleasure yacht could pull off such a spectacular attack — and so have naval experts from Germany, Sweden and Denmark.

They argue that even with skilled divers, it would be extremely challenging for a six-person crew to plant the explosives needed on the seabed some 262 feet below, and create blasts registering 2.5 on the Richter scale.

“Knowing how the explosion would work, with the sea pressure at those depths — you need very specialized knowledge. How do the physics play out?” said Johannes Riber, a naval officer and analyst at Denmark’s Institute for Strategy and War Studies, who called it a “James Bond” theory.

Whether the Andromeda was a decoy or part of a broader mission, he said, remained unanswerable. But the most plausible attack, he said, required an undersea drone or mini submarine to plant the explosives, and either naval or professional underwater drilling vessels.

Mr. Riber and others also pointed to photographs of the aftermath — pipes bent backward, cracks and craters on the seabed — as traces of a massive bomb, something in the range of 1,000 to 1,500 kilograms.

“This was not a few pieces of plastic explosives,” Mr. Riber said. “That is a powerful explosion at play.”

Yet one pipeline expert and a professional diver who was part of the team that laid the Nord Stream 2 pipelines last year disagreed. Both the expert and the diver, who works regularly in the Baltic Sea, insisted a small plastic explosive could do the job, as long as it was placed near a seam of the pipeline. They asked not to be identified because they were speaking without authorization from Nord Stream.

“It is like lighting a match next to a leaking gasoline pump — the gas is all you need,” said one diver.

By the end of March, Russian diplomats threw up yet another twist: They revealed that in February, Nord Stream 2 had hired a vessel to inspect its pipelines and discovered an unidentified object next to a seam of its sole undamaged strand, about 19 miles from the explosion sites. The company alerted both Russia and Denmark, which controls the waters in which the object was spotted.

Even under pressure from Vladimir V. Putin’s top foreign policy adviser, who summoned Denmark’s chargé d’affaires in Moscow, Denmark initially resisted offering much information to the company or Russia, aside from publicly releasing a blurry photo of a 12-inch-long cylinder, covered in algae.

Last week, Danish authorities allowed Nord Stream 2 to observe their dive to recover the object — releasing photographs of a now cleaned-off dark cylinder. Denmark’s ministry of defense said it might be part of a maritime smoke buoy.

But Russia’s ambassador to Denmark, Vladimir Barbin, told The Times that experts in Moscow believed the cylinder was part of an explosive device.

“The continued secrecy of the ongoing investigation by Denmark, Germany and Sweden, as well as the refusal to cooperate with Russia, undermine its credibility,” Mr. Barbin wrote in a statement to The Times.

And Mr. Putin himself continues to use the incident to pressure Denmark to back Moscow’s demands for a joint international investigation. On April 5, he warned the situation in the Baltic Sea was becoming “turbulent in a literal sense.”

Even as Moscow pushes for a joint probe, other findings are pointing fingers back at Russia.

The German news website T-Online worked in late March with an open-source investigator, Oliver Alexander, to present the paths of six Russian vessels whose names were given to them by what they described as an “intelligence source from a NATO country.”

Their findings showed the boats disappeared from satellite signals on Sept. 21 — around the time Christianso residents spotted vessels that disappeared from their apps — after veering off course from a publicly announced Russian maritime exercise.

That information could match an early lead that one German official told The Times was explored late last year by Germany’s intelligence services who had also tracked Russian vessels from naval exercises, but were unable to bridge an approximately 20-nautical-mile gap between where some veered off course and the sites of the blasts.

The open source investigation also discovered a Danish naval ship, the Nymfen, which had sailed toward the same area as the Russian vessels in the hours after they disappeared. It too had turned off its signal upon reaching the site.

A day later, a Swedish fighter jet took an unusual flight path over the area, followed by a Swedish naval vessel that lingered near the spot where the Nord Stream 1 pipelines later exploded.

The researchers argued that perhaps these forces went to check the site — hinting that some countries may know more than they have said thus far.

Denmark is the most tight-lipped, but security sources who spoke on condition of anonymity told The Times that Danish and Swedish investigators have been wary of the latest German findings, and feel a sense of pressure to counter that narrative.

On Thursday, Mats Ljungqvist, Sweden’s senior prosecutor in the case, told the Swedish newspaper Norrkopings Tidningar that although his probe had not ruled out nonstate actors, only a “very few companies or groups” could have done it, and that a state actor still seemed most likely.

And he hinted his team came across some red herrings in the course of their investigation: “Those who carried this out were careful with the traces they left behind,” he said.

Privately, Swedish, German, and Danish officials argued that investigators have reasons not to share findings, which can reveal their intelligence capabilities. Allies have also grown wary after a string of Russian espionage and infiltration cases in Europe — including one within Germany’s spy agency.

Nor may it be in anyone’s interest to share: Naming a culprit could set off unintended consequences.

Claiming Russia was behind the attack would mean it had successfully sabotaged major critical infrastructure in Western Europe’s backyard, and could spark demands for a response.

Blaming Ukrainian operatives could stoke internal debate in Europe about support for their eastern neighbor.

And naming a Western nation or operatives could trigger deep mistrust when the West is struggling to maintain a united front.

“Is there any interest from the authorities to come out and say who did this? There are strategic reasons for not revealing who did it,” said Jens Wenzel Kristoffersen, a Danish naval commander and military expert at the University of Copenhagen. “As long as they don’t come out with anything substantial, then we are left in the dark on all this — as it should be.”

Reporting was contributed by Christopher F. Schuetze in Berlin, Jasmina Nielsen in Copenhagen and Christina Anderson in Stockholm.

Audio produced by Tally Abecassis .

Our Coverage of the War in Ukraine

News and Analysis

A day after securing a new term in a rubber-stamp presidential election, President Vladimir Putin of Russia said he would not back down in Russia’s war against Ukraine .

With additional American aid still in doubt, Lloyd Austin, the U.S. defense secretary, called for “creative, adaptable and sustainable ways” to continue arming Ukraine  and praised European allies who were trying to bolster Kyiv’s military.

Ukraine fired a volley of exploding drones  at Moscow and other targets on the final day of Russia’s presidential vote, the local authorities said, continuing a flurry of attacks timed for the election .

Symbolism or Strategy?: Ukrainians say that defending places with little strategic value is worth the cost in casualties and weapons , because the attacking Russians pay an even higher price. American officials aren’t so sure.

Elaborate Tales: As the Ukraine war grinds on, the Kremlin has created increasingly complex fabrications online  to discredit Ukraine’s leader, Volodymyr Zelensky, and undermine the country’s support in the West.

Targeting Russia’s Oil Industry: With its army short of ammunition and troops to break the deadlock on the battlefield, Kyiv has increasingly taken the fight beyond the Ukrainian border, attacking oil infrastructure deep in Russian territory .

How We Verify Our Reporting

Our team of visual journalists analyzes satellite images, photographs , videos and radio transmissions  to independently confirm troop movements and other details.

We monitor and authenticate reports on social media, corroborating these with eyewitness accounts and interviews. Read more about our reporting efforts .

U.S. had intelligence of detailed Ukrainian plan to attack Nord Stream pipeline

The discord leaks | the cia learned last june, via a european spy agency, that a six-person team of ukrainian special operations forces intended to sabotage the russia-to-germany natural gas project.

Three months before saboteurs bombed the Nord Stream natural gas pipeline, the Biden administration learned from a close ally that the Ukrainian military had planned a covert attack on the undersea network, using a small team of divers who reported directly to the commander in chief of the Ukrainian armed forces.

Details about the plan, which have not been previously reported, were collected by a European intelligence service and shared with the CIA in June 2022. They provide some of the most specific evidence to date linking the government of Ukraine to the eventual attack in the Baltic Sea, which U.S. and Western officials have called a brazen and dangerous act of sabotage on Europe’s energy infrastructure.

The European intelligence report was shared on the chat platform Discord, allegedly by Air National Guard member Jack Teixeira. The Washington Post obtained a copy from one of Teixeira’s online friends.

The intelligence report was based on information obtained from an individual in Ukraine. The source’s information could not immediately be corroborated, but the CIA shared the report with Germany and other European countries last June, according to multiple officials familiar with the matter, who spoke on the condition of anonymity to discuss sensitive intelligence operations and diplomatic discussions.

The Discord Leaks

The highly specific details, which include numbers of operatives and methods of attack, show that for nearly a year, Western allies have had a basis to suspect Kyiv in the sabotage. That assessment has only strengthened in recent months as German law enforcement investigators uncovered evidence about the bombing that bears striking similarities to what the European service said Ukraine was planning.

Officials in multiple countries confirmed that the intelligence summary posted on Discord accurately stated what the European service told the CIA. The Post agreed to withhold the name of the European country as well as some aspects of the suspected plan at the request of government officials, who said exposing the information would threaten sources and operations.

Ukrainian officials, who have previously denied the country was involved in the Nord Stream attack, did not respond to requests for comment.

The White House declined to comment on a detailed set of questions about the European report and the alleged Ukrainian military plot, including whether U.S. officials tried to stop the mission from proceeding.

The CIA also declined to comment.

On Sept. 26, three underwater explosions caused massive leaks on the Nord Stream 1 and 2 pipelines, leaving only one of the four gas links in the network intact. Some Biden administration officials initially suggested that Russia was to blame for what President Biden called “a deliberate act of sabotage,” promising that the United States would work with its allies “to get to the bottom of exactly what ... happened.” With winter approaching, it appeared the Kremlin might have intended to strangle the flow of energy, an act of “blackmail,” some leaders said, designed to intimidate European countries into withdrawing their financial and military support for Ukraine, and refraining from further sanctions.

Zelensky, in private, pushed for bold attacks inside Russia, leak shows

Biden administration officials now privately concede there is no evidence that conclusively points to Moscow’s involvement . But publicly they have deflected questions about who might be responsible. European officials in several countries have quietly suggested that Ukraine was behind the attack but have resisted publicly saying so over fears that blaming Kyiv could fracture the alliance against Russia. At gatherings of European and NATO policymakers, officials have settled into a rhythm; as one senior European diplomat said recently, “Don’t talk about Nord Stream.”

The European intelligence made clear that the would-be attackers were not rogue operatives. All those involved reported directly to Gen. Valery Zaluzhny, Ukraine’s highest-ranking military officer, who was put in charge so that the nation’s president, Volodymyr Zelensky, wouldn’t know about the operation, the intelligence report said.

Keeping Zelensky out of the loop would have given the Ukrainian leader a plausible way to deny involvement in an audacious attack on civilian infrastructure that could ignite public outrage and jeopardize Western support for Ukraine — particularly in Germany, which before the war got half its natural gas from Russia and had long championed the Nord Stream project in the face of opposition from other European allies.

While Gazprom, the Russian state-owned gas conglomerate, owns 51 percent of Nord Stream, Western energy companies, including from Germany, France and the Netherlands, are partners and invested billions in the pipelines. Ukraine had long complained that Nord Stream would allow Russia to bypass Ukrainian pipes, depriving Kyiv of huge transit revenue .

The intelligence summary says that the Ukrainian military operation was “put on hold,” for reasons that remain unclear. The Ukrainians had planned to attack the pipeline on the heels of a major allied naval exercise, known as BALTOPS, that ran from June 5 to 17, 2022, according to the report.

But according to German law enforcement officials investigating September’s Nord Stream bombing, key details emerging of that operation line up with the earlier plot.

For instance, the Ukrainian individual who informed the European intelligence service in June said that six members of Ukraine’s special operations forces using false identities intended to rent a boat and, using a submersible vehicle, dive to the floor of the Baltic Sea and then damage or destroy the pipeline and escape undetected. In addition to oxygen, the team planned to bring helium, which is recommended for especially deep dives.

German investigators now believe that six individuals using fake passports rented a sailing yacht in September, embarked from Germany and planted explosives that severed the pipelines, according to officials familiar with that investigation. They believe the operatives were skilled divers, given that the explosives were planted at a depth of about 240 feet, in the range that experts say helium would be helpful for maintaining mental focus.

Investigators have matched explosive residue found on the pipeline to traces found inside the cabin of the yacht, called Andromeda. And they have linked Ukrainian individuals to the rental of the boat via an apparent front company in Poland. Investigators also suspect that at least one individual who serves in the Ukrainian military was involved in the sabotage operation.

A collaboration of German media organizations previously reported the suspected involvement of the Ukrainian military service member.

IAEA chief pushes plan to secure nuclear plant in Ukraine

The June plot differs from the September attack in some respects. The European intelligence report notes that the Ukrainian operatives planned to attack the Nord Stream 1 pipeline, but it makes no mention of Nord Stream 2, a newer line. The intelligence report also says that the saboteurs would embark from a different location in Europe, not Warnemünde, a German port town on the Baltic, where the Andromeda was rented .

The CIA initially questioned the credibility of the information, in part because the source in Ukraine who provided the details had not yet established a track record of producing reliable information, according to officials familiar with the matter. The European service, a trusted U.S. partner, felt that the source was reliable.

But despite any reservations the CIA might have had, the agency communicated the June intelligence to counterparts in Germany and other European countries, officials said. The European service also shared it with Germany, one person said. German intelligence personnel briefed lawmakers in Berlin in late June before they left for their summer break, according to an official with knowledge of the closed-door presentation.

Officials familiar with the European report conceded that it is possible that the suspected Ukrainian plotters might have been apprised that the intelligence was shared with several countries and that they may have changed some elements of the plan.

But the report from the European intelligence service isn’t the only piece of evidence pointing to Kyiv’s role in the pipeline bombing.

The Post previously reported that governments investigating the explosions uncovered communications that showed pro-Ukrainian individuals or entities discussed the possibility of carrying out an attack on the Nord Stream pipelines. Those conversations took place before the attack, but were only discovered in its aftermath, when spy agencies scoured data for possible clues, a senior Western security official said.

Despite waiving Trump-era sanctions on the Russia-to-Germany natural gas pipeline as an attempt to mend fences with Berlin, the Biden administration had long harbored concerns about Nord Stream and did not shed tears over its September demise.

After months of pressure from Washington, the German government halted final authorization of Nord Stream 2 just days before Russian forces invaded Ukraine in February 2022, surprising many U.S. and European officials who had worried that Berlin would find Russia too important an energy source to sever ties. At the time of the attack, the pipeline was intact and had already been pumped full with 300 million cubic meters of natural gas to ready it for operations.

Nearly a month before the rupture, the Russian energy giant Gazprom stopped flows on Nord Stream 1, hours after the Group of Seven industrialized nations announced a forthcoming price cap on Russian oil, a move intended to put a dent in the Kremlin’s treasury.

Officials have said that the cost of repairing the pipelines would run into the hundreds of millions of dollars.

While U.S. intelligence officials were initially skeptical of the European reporting, they have long been concerned about aggressive operations by Ukraine that could escalate the war into a direct conflict between Russia and the United States and its NATO allies.

In February of this year, on the eve of the war’s first anniversary, Ukraine’s military intelligence agency agreed, “at Washington’s request,” to postpone planned strikes on Moscow, according to another intelligence document leaked on Discord. That incident illustrated a broader tension that has existed throughout the war: Ukraine, eager to bring the fight to Russia’s home turf, is sometimes restrained by the United States.

Officials in Washington and Europe have admonished Ukraine for attacks outside its territory that they felt went too far. After a car bomb near Moscow in August killed Daria Dugina , in an attack that appeared intended for her father — a prominent Russian nationalist whose writing had helped shape a Kremlin narrative about Ukraine — Western officials said they made clear to Zelensky that they held operatives in his government responsible. The attack was seen as provocative and risked a severe Russian response, officials said.

Ukraine has persisted with strikes inside Russia, including drone strikes on an airfield and on targets in Moscow that U.S. officials have linked to Kyiv.

Samuel Oakford, Isabelle Khurshudyan, Michael Birnbaum and Greg Miller contributed to this report.

The Washington Post and “ Frontline ” partnered to investigate Jack Teixeira’s alleged leak of classified U.S. intelligence on the Discord chat platform . The new documentary, “The Discord Leaks,” premiered Tuesday, Dec. 12 and is available to watch on PBS streaming platforms and washingtonpost.com .

The suspected document leaker: Teixeira, a young member of the Massachusetts Air National Guard, was indicted on six charges . Interviews with people who knew Teixeira offer the most detailed account yet of how he allegedly leaked classified information and his motivations. Discord’s rules and culture allowed a racist and antisemitic community to flourish, giving Teixeira an eager audience unlikely to report his alleged lawbreaking.

How the leak happened: The Washington Post reported that the individual who leaked the information shared documents with a small circle of online friends on the Discord chat platform. The Air Force disciplined 15 members of the Air National Guard after an internal investigation found that a “lack of supervision” helped enable Teixeira. This is a timeline of how the documents leaked .

What we learned from the leaked documents: The massive document leak has exposed a range of U.S. government secrets, including spying on allies, the grim prospects for Ukraine’s war with Russia and the precariousness of Taiwan’s air defenses . It also has ignited diplomatic fires for the White House. Here’s what we’ve learned from the documents .

• Work & Careers
• Life & Arts

Become an FT subscriber

Limited time offer save up to 40% on standard digital.

• Global news & analysis
• Expert opinion
• Special features
• FirstFT newsletter
• Videos & Podcasts
• Android & iOS app
• FT Edit app
• 10 gift articles per month

Explore more offers.

Standard digital.

• FT Digital Edition

Premium Digital

Print + premium digital.

Then $75 per month. Complete digital access to quality FT journalism on any device. Cancel anytime during your trial.

• 10 additional gift articles per month
• Global news & analysis
• Exclusive FT analysis
• Videos & Podcasts
• FT App on Android & iOS
• Everything in Standard Digital
• Premium newsletters
• Weekday Print Edition

Complete digital access to quality FT journalism with expert analysis from industry leaders. Pay a year upfront and save 20%.

• Everything in Print
• Everything in Premium Digital

The new FT Digital Edition: today’s FT, cover to cover on any device. This subscription does not include access to ft.com or the FT App.

Terms & Conditions apply

Explore our full range of subscriptions.

Why the ft.

See why over a million readers pay to read the Financial Times.

International Edition

Nord Stream sabotage one year on: What to know about the attack

Investigators from Germany, Sweden and Denmark remain tight-lipped while speculation and theories abound.

A year has passed since explosions rocked the Nord Stream pipelines , cutting off a major route for Russian gas exports to Europe and fuelling geopolitical tensions already at a fever pitch after Russia launched a full-scale invasion of Ukraine in February 2022.

However, despite official investigations in three countries, the question of who is responsible for the act of sabotage remains unanswered.

Keep reading

Putin calls ukraine role in nord stream blasts ‘sheer nonsense’, russia may demand compensation over nord stream blasts: diplomat, un security council turns down request for nord stream inquiry, nord stream sabotage probe turns to clues in poland: report.

Without hard evidence, many theories have emerged pointing the finger at Ukraine, Russia or the United States, all of which have denied involvement.

Here is what we know about the Nord Stream attack:

What happened to the Nord Stream pipelines?

On September 26, 2022, several underwater blasts ruptured three of the four pipelines comprising Nord Stream 1 and Nord Stream 2, spewing vast amounts of gas into the Baltic Sea near Bornholm, Denmark.

Russian energy giant Gazprom halted flows through Nord Stream 1, the main conduit for Russian natural gas to Germany, amid disputes over the war in Ukraine a month earlier.

The newly completed Nord Stream 2 twin pipelines never opened as Berlin pulled the plug on the project days before Russian troops entered Ukraine on February 24, 2022.

The 10-billion-euro ($10.6bn) Nord Stream 2 had long been opposed by Ukraine, the US and Eastern European countries which feared it would give Russia too much influence over Germany’s energy security.

Diplomatically sensitive investigations ongoing

The blasts occurred in the economic zones of Sweden and Denmark , so both countries launched investigations into the incident. So far, they say the explosions were deliberate, but they have yet to single out who was behind the blasts.

Germany also launched an investigation with federal prosecutors searching a yacht in January that might have been used to transport the explosives. They seized objects from the vessel and found traces of explosives.

They have refused to comment on media speculation that a team of five men and one woman chartered the Andromeda yacht from Rostock port to carry out the operation.

“The identity of the perpetrators and their motives” remains the subject of ongoing investigations, Germany’s prosecution office told AFP news agency.

The fact all three countries have kept a tight lid on their investigations is unsurprising, according to analysts, given the potential diplomatic fallout of what they might uncover.

The theories: A pro-Ukrainian group, Russian naval ships, and a US plot

Investigative journalists have been carrying out their own research to solve the Nord Stream whodunnit, leading to sometimes sensational, if unconfirmed, reports.

Dutch military intelligence warned the CIA of a Ukrainian plan to blow up the pipelines three months before the attack, Dutch broadcaster NOS and Germany’s Die Zeit and ARD reported in June. The Washington Post made a similar claim.

Ukraine’s President Volodymyr Zelenskyy has repeatedly denied his country was behind the sabotage.

“I would never do that,” he told Germany’s Bild newspaper, adding he would “like to see proof”.

In March, The New York Times wrote that US officials had seen intelligence indicating a “pro-Ukrainian group” was responsible, without Zelenskyy’s knowledge.

German media have focused on the Andromeda, with reporters from Der Spiegel magazine and broadcaster ZDF recreating the journey they believe was made by the six-person crew.

According to their reporting, a forged passport used to hire the sailboat leads back to a Ukrainian soldier, while the charter fee was paid by a company registered in Poland with ties to a woman in Kyiv.

In June, The Wall Street Journal reported Germany was trying to match DNA samples found on the vessel “to at least one Ukrainian soldier”. The Journal also said evidence found in the investigation included data from Andromeda’s radio and navigation equipment, satellite and mobile phones, and Gmail accounts allegedly used by the perpetrators.

Danish media have reported a Russian naval vessel specialised in submarine operations, the SS-750, was photographed near the site of the blasts days before the attack.

US investigative journalist Seymour Hersh reported in February the US was behind the blasts and that Norway assisted . It was dismissed as “fiction” by the White House.

Was it a false flag operation?

Experts have not ruled out a “false flag” operation by Russia, with clues deliberately placed to pin the blame on Ukraine.

Andreas Umland, an analyst at the Stockholm Centre for Eastern European Studies, said he sees Russia as “the most likely” culprit.

Any suspected involvement by Kyiv in an attack on Europe’s energy infrastructure could threaten the support of allies, which would benefit Russia.

At the same time, the destroyed pipelines could help Gazprom avoid compensation claims for undelivered gas, even though the company was reluctant to keep the taps open before the blasts.

Moscow may have sought “to kill two birds with one stone”, Umland said.

The Kremlin has strongly denied responsibility.

Moscow blames the US

Russia has alleged the US was behind the attack, noting the sabotage “occurred after the repeated threats  to the Nord Stream by the leadership of the United States”.

In March, Russian President Vladimir Putin dismissed the argument that Kyiv was behind the explosions, instead laying blame on the US .

“Who is interested? Theoretically, the United States is interested in stopping the supply of Russian energy to the European market and supplying volumes of its own,” he told an interviewer.

“Such an explosion, so powerful and at such depth, could only be conducted by experts backed by the entire potential of a state that has relevant technologies,” said Putin.

Things you buy through our links may earn Vox Media a commission.

Who Really Blew Up the Nord Stream Pipeline?

New clues keep surfacing, and the most recent appear to implicate ukraine..

On September 26, 2022, a series of deep-sea explosions rocked the Nord Stream and Nord Stream 2 natural-gas pipelines along the bottom of the Baltic Sea near the Danish island of Bornholm. The bombings severed three of the Nord Stream project’s four underwater pipelines, which had been built to transport a direct supply of natural gas from Russia to customers in Western Europe — though none was in operation at the time of the bombing thanks to tensions over the war in Ukraine . More than eight months later, multiple countries continue to conduct their own investigations into the sabotage, and while the mystery of who targeted the pipelines remains unsolved, there are growing indications that Ukraine was behind the sabotage. Below is what we know about the prime suspects and latest developments.

Ukraine allegedly planned covert attack on Nord Stream, U.S. warned it not to

Three months before the bombing of the pipeline, the U.S. was informed by a European intelligence service that Ukraine had planned to use a small team of divers to conduct a covert attack on Nord Stream, according to U.S. intelligence documents shared online by Jack Teixeira , the National Guard airman accused of leaking U.S. intelligence secrets on Discord chat servers. The Wall Street Journal reports that the CIA had been tipped off about the plan by Dutch military intelligence and that in June 2022, the U.S. warned Ukraine not to target the pipelines. The CIA later told allies the plan appeared to have been called off, but per the Journal , that conclusion might have been premature:

Weeks later, in August, the CIA informed at least seven different NATO allies that Ukraine no longer appeared to be plotting to sabotage the pipelines and that the threat had diminished, European officials said. Those officials now believe Ukraine hadn’t canceled the original plan but had modified it, selecting a new point of departure and tapping an alternative military officer to lead it.

Ukraine has repeatedly denied any involvement in the bombing. “I believe that our military and our intelligence did not do it, and when anyone claims the opposite, I would like them to show us the evidence,” President Volodymyr Zelenskyy said in a recent Bild interview . Per the Washington Post , the would-be saboteurs involved in the initial Ukrainian plot that was discussed in the leaked U.S. intelligence documents planned to keep Zelenskyy out of the loop so he would have plausible deniability.

The saboteurs might have been based in Poland

According to a June 10 Wall Street Journal report , German investigators have been examining evidence that a Ukrainian sabotage team they suspect was responsible for the bombing used Poland as a base of operations:

The probe by Germany’s Federal Criminal Police Office is examining why the yacht they believe was used to carry out the operation journeyed into Polish waters. Other findings suggest Poland was a hub for the logistics and financing of  last September’s undersea sabotage attack  that severed the strongest bond tying Berlin to Moscow. Poland, which is conducting its own inquiry, has struggled for months to learn what Germany is investigating.

German officials told the Journal they have found no evidence, at least not yet, that the Polish government was aware of the operation. The investigation has uncovered a lot more about the movements of the sailing yacht they believe the saboteurs used, however:

German investigators have fully reconstructed the entire two-week long voyage of the Andromeda — the 50-foot white pleasure yacht suspected of being involved in one of the biggest acts of sabotage on the continent since World War II — and pinpointed that it deviated from its target to venture into Polish waters. The previously unreported findings were pieced together with data from the Andromeda ’s radio and navigation equipment, as well as satellite and mobile phones and Gmail accounts used by the culprits — and DNA samples left aboard, which Germany has tried to match to at least one Ukrainian soldier … German investigators say they are also looking into why the yacht was rented with the help of a travel agency based in Warsaw that appears to be part of a network of Ukrainian-owned front companies with suspected links to Ukrainian intelligence, according to people familiar with the investigation.

The multiple-vessel theory

The Washington Post reported on April 3 that German law-enforcement officials believed the still-unknown saboteurs might have used multiple vessels to carry out their operation. German investigators’ earlier theory was that a small team of perpetrators used a rented 50-foot sailboat, the Andromeda , to plant explosives on the two pipelines. But as their investigation progressed, they began to suspect the boat might have been used as a decoy, and U.S. and European officials are also now skeptical that the Andromeda played a key role. One major reason for the doubt is the craft’s size and capabilities, per the Post :

Experts noted that while it was theoretically possible to place the explosives on the pipeline by hand, even skilled divers would be challenged submerging more than 200 feet to the seabed and slowly rising to the surface to allow time for their bodies to decompress. Such an operation would have taken multiple dives, exposing the Andromeda to detection from nearby ships. The mission would have been easier to hide and pull off using remotely piloted underwater vehicles or small submarines, said diving and salvage experts who have worked in the area of the explosion, which features rough seas and heavy shipping traffic.

Also according to the Post , investigators have confirmed that traces of military-grade explosives found during a search of the Andromeda in January matched the explosive used on the pipelines — but that the evidence might have been planted aboard the boat. Some investigators also doubt that a team skilled enough to blow up the pipelines while evading detection would be sloppy enough to leave that evidence behind, while others believe it was possible they were indeed that careless.

In early March, The Wall Street Journal reported that several large questions remained unanswered regarding the possible use of the Andromeda:

A key operational question investigators are looking into is whether the small boat could have carried the explosives and other supplies needed and whether the six people known to have been aboard would have been enough to carry out the attack, the German government official said. Another possibility is that the boat was part of a larger operation. They are also asking whether the mission was state-sponsored or a private effort, the official added.

It appears those concerns were justified. Investigators reportedly came to focus on the Andromeda after getting a tip from a western intelligence service, then ultimately theorized that a team of six people — five men and one woman — carried out the sabotage using the yacht, which had been hired by a Polish-registered company investigators believe was controlled by a wealthy Ukrainian. The team apparently used forged passports and embarked in the rented yacht on September 6 from the German port city of Rostock. The yacht later docked at a harbor without nighttime surveillance cameras in Wiek on the German island of Rügen, then visited the tiny Danish island Christiansø, which is very close to the site of the pipeline bombings.

German officials have publicly warned against forming conclusions based on the details revealed in media reports.

What is the mysterious object?

Denmark has reportedly found , and is in the process of salvaging, a mysterious object next to one of the damaged Nord Stream 2 pipelines. The Switzerland-based pipeline operator, Nord Stream 2 AG, has agreed to a request from Danish authorities to help identify it — though Denmark has already said the object may be a maritime smoke buoy, Bloomberg reported on March 26.

Was it some pro-Ukraine group?

In early March, the New York Times reported that U.S. officials had recently seen new intelligence suggesting that a pro-Ukraine but not necessarily Ukraine-backed group was behind the sabotage. According to the Times , the unnamed U.S. officials who have reviewed the intelligence said the group was likely made up of Ukrainian and/or Russian nationals who were opponents of Russian president Vladimir Putin but there was no evidence of direct links between the saboteurs and Ukraine’s leadership. (Ukraine has repeatedly denied any involvement in the bombings.) The divers in the saboteur group were not currently working for military or intelligence services, but they might have been trained by them in the past, according to the intelligence.

The Times also reported that “U.S. officials who have been briefed on the intelligence are divided about how much weight to put on the new information” but are now more optimistic that European and U.S. intelligence agencies will be able to get to the bottom of what happened.

A Washington Post report on the intelligence added that “a senior western security official said governments investigating the bombings uncovered evidence that pro-Ukraine individuals or entities discussed the possibility of carrying out an attack on the Nord Stream pipelines before the explosions.”

What about a false-flag operation?

U.S. and German officials have continued to emphasize that it remains possible the sabotage was disguised to look as if it were perpetrated by someone else. Ukrainian officials have stressed this possibility as well — naming Russia as the likely sponsor — but no evidence has been put forward to support the theory. If it had been a false flag, it’s conceivable any government could have been behind it.

Why not Russia?

After the sabotage, Poland and Ukraine immediately fingered Russia as the culprit, and both the U.S. and other NATO allies speculated as much themselves. U.S. and European intelligence agencies have reportedly been unable to find any conclusive evidence of Russia’s involvement, however. It also remains unclear what Russia would have had to gain from disabling its own pipeline, which it helped build and had already shut off.

Or maybe it was the United States all along?

Amid Russia’s buildup on the Ukrainian border in early February of last year, President Biden warned that “If Russia invades … again, then there will no longer be Nord Stream 2. We will bring an end to it.” Some have interpreted that statement as a kind of advance admission of guilt, including American investigative journalist Seymour Hersh , who last month published a report on his Substack alleging the U.S. had conducted a covert strike on the pipelines. Hersh’s supposed bombshell, which was quickly endorsed by Kremlin officials and Russian state media, primarily relied on what appeared to be a single unnamed source who, Hersh wrote, had “direct knowledge of the operational planning” for the sabotage. The White House has rejected his post as “complete fiction,” and some members of the open-source intelligence community have detailed numerous holes in Hersh’s assertions.

The Intercept’s Jeremy Scahill offered a more open-minded reading of the allegations, noting that Hersh might have screwed up the facts but not the premise. Scahill points out that the U.S. has authorized and then lied about numerous covert actions throughout its history and that recent disclosures to the media about intelligence pointing to Ukrainian partisans may be an example of “narrative washing.” At this point, however, there is no evidence linking the U.S. to the sabotage.

• foreign interests
• unsolved mysteries
• nordstream pipeline
• war in ukraine

Most Viewed Stories

• Inside the Craziest College-Admissions Season Ever
• Why Won’t Rich Republicans Loan Money to Upstanding Businessman Donald Trump?
• Kate Middleton Was Spotted in Public, With Video to Prove It
• How Screwed Is Trump?
• The Eric Adams Smash-and-Grab

Editor’s Picks

Most Popular

• Inside the Craziest College-Admissions Season Ever By Jeffrey Selingo
• Why Won’t Rich Republicans Loan Money to Upstanding Businessman Donald Trump? By Jonathan Chait
• Kate Middleton Was Spotted in Public, With Video to Prove It By Margaret Hartmann
• How Screwed Is Trump? By Kevin T. Dugan
• The Eric Adams Smash-and-Grab By David Freedlander

What is your email?

This email will be used to sign into all New York sites. By submitting your email, you agree to our Terms and Privacy Policy and to receive email correspondence from us.

Sign In To Continue Reading

Create your free account.

Password must be at least 8 characters and contain:

• Lower case letters (a-z)
• Upper case letters (A-Z)
• Numbers (0-9)
• Special Characters (!@#$%^&*)

As part of your account, you’ll receive occasional updates and offers from New York , which you can opt out of anytime.

The Most Consequential Act of Sabotage in Modern Times

The destruction of the Nord Stream pipeline curtailed Europe’s reliance on Russian gas. But who was responsible?

This article was featured in the One Story to Read Today newsletter. Sign up for it here .

I. A Small Earthquake

At 2:03 a.m. on Monday, September 26, 2022, at the bottom of the Baltic Sea, an explosion tore open one of the four massive underwater conduits that make up the Nord Stream pipeline. The pipe, made of thick, concrete-encased steel, lay at a depth of 260 feet. It was filled with highly compressed methane gas.

Pressure readings would show a sudden plunge as compressed gas screamed through the breach at the speed of sound, tearing the pipe apart and carving deep craters on the seafloor. Gas escaped with enough force to propel a rocket into space. It shot up and up, creating a towering geyser above the surface of the water.

There was no one in the vicinity—the middle of the sea in the middle of the night—to see or hear any of this, but the event registered with the force of a small earthquake on seismometers 15 miles away, on the Danish island of Bornholm. Because the explosion had occurred in Danish waters, Denmark dispatched an airplane to investigate. By then, the geyser had settled into a wide, turbulent simmer on the surface. The Danish Maritime Authority ordered ships to steer clear. Airspace was restricted. A pipeline executive in Switzerland, where Nord Stream is based, urgently exchanged information with officials in Denmark and other countries.

Nord Stream had been built in two phases, NS-1 and NS-2, each consisting of two pipes labeled A and B. The pipes, with an internal diameter of about four feet, reached across 760 miles of seafloor from Russia to Germany. Given the pressure readings and the location of the surface turbulence, the ruptured pipe appeared to be NS-2A.

No one knew yet what had happened. There were innocent explanations—none of them likely, but some certainly plausible. The pipeline may have sprung a leak on its own. Or some accident or natural event may have disturbed the sea bottom. The area around Bornholm is prone to small earthquakes, and the Baltic Sea is littered with explosive debris . It was heavily mined during the Second World War and, at war’s end, became a dumping ground for unused munitions. Efforts to clear the seabed continue, and live ordnance is often detonated in place. Fishing vessels trawl the bottom—sometimes leaving scratches on the surface of pipelines—and occasionally set off an old mine or bomb. On a typical day, Swedish seismologists detect dozens of underwater explosions, some accidental, some deliberate. But the Nord Stream pipes were built to withstand such blasts and had been placed in lanes painstakingly cleared of hazards.

Any thought that the break was an accident vanished at sunset, when new explosions on the pipeline were recorded, 17 hours after the first one. It would eventually be determined that there were three of them , and that they occurred about 50 miles northeast of the initial blast and about 50 miles east of the Swedish coast, near the edge of that country’s maritime economic zone with Denmark. The blasts scattered several 26-ton, 40-foot-long segments of pipeline on the seafloor. At this northern site, there were witnesses. An officer aboard a German cargo ship, the Cellus, saw what seemed to be the surface eruption from an underwater explosion; the captain of the ship, looking for himself, later reported “something that appeared like a dense cloud” above the water. A photo taken several minutes after the first sighting captured a bubbling swell of gas-infused seawater, which calculations from the digital image showed to be nearly 200 feet high and more than 1,000 feet wide.

Now, with two blast sites—a southern site, with a single explosion, and a northern site, with three explosions—it was clear that someone had attacked Nord Stream, the biggest natural-gas delivery system from Russia to Western Europe ever built. NS-1 had opened in 2011 and had been delivering cheap Russian gas to Germany for a decade. Construction on NS-2 was started in 2016 and finished in 2021, and was filled with gas to prepare for launch. For reasons that were not apparent, only three of the four Nord Stream pipes had been hit—a fact that would intrigue investigators. If the goal was to disable Nord Stream, why leave one of the pipes intact? Had a preset bomb failed to explode?

Together, the four Nord Stream pipes had been capable of supplying as much as 65 percent of the European Union’s total gas imports. Not everyone had been happy about this. The United States feared that Europe’s reliance on Nord Stream would give Russian President Vladimir Putin too much economic leverage. The pipeline promised cheap energy for Europe and decades of revenue for Gazprom, the state-owned Russian energy giant with strong ties to Putin. The pipeline would also reduce the value of older gas pipelines in Eastern Europe, notably the system owned and operated by Ukraine.

After Russia’s invasion and occupation of Crimea, in 2014, resistance to Nord Stream stiffened. The United States imposed a mounting series of sanctions against Russia’s energy sector. So did European nations. Last year, despite the anticipated financial strain on Europe, President Joe Biden was able to gain a promise of European support as Russian armies massed to invade Ukraine once again. German Chancellor Olaf Scholz agreed to prevent NS-2 from opening if Putin attacked. In February 2022, at a White House press conference with Scholz, Biden warned, “If Russia invades … there will no longer be a Nord Stream 2. We will bring an end to it … I promise you we will be able to do it.” This warning was reiterated in equally plain terms by top members of his administration.

When the war came, NS-2’s pipes stayed shut, and severe multinational economic sanctions were imposed on Russia . Putin responded by gradually choking off the flow of gas from the older NS-1 (“maintenance reasons” were cited), which drove up energy prices in Europe—precisely the scenario foreseen. According to some estimates, energy prices in the EU quadrupled. In the summer of 2022, Putin shut down NS-1 completely. By September, the war seemed deadlocked. As winter approached, pressure to deal with energy issues began to grow in Europe.

Leon Aron: The sanctions against Russia are starting to work

The four underwater explosions on September 26 made any debate over Nord Stream moot. The attack on the pipeline—without loss of life, as far as we know—was one of the most dramatic and consequential acts of sabotage in modern times. It was also an unprecedented attack on a major element of global infrastructure—the network of cables, pipes, and satellites that underpin commerce and communication. Because it serves everyone, global infrastructure had enjoyed tacit immunity in regional conflicts—not total but nearly so. Here was a bold act of war in the waters between two peaceful nations (although Sweden and Denmark both support Ukraine). It effectively destroyed a project that had required decades of strenuous labor and political muscle and had cost roughly $20 billion—half of that money coming from Gazprom, the other half from European energy companies. The attack was a financial blow to Russia and upended the EU’s energy planning and policy.

There may have been more daring capers, but one recently retired U.S. military commander, a man who has held senior appointments and is knowledgeable about the Baltic region, couldn’t help but acknowledge what he called the “coolness factor” of the Nord Stream attack. Cool , because whoever did it managed to achieve total surprise and leave few traces behind. Indeed, more than a year later, nobody knows for certain who was responsible, although accumulating evidence has begun to point in a specific direction. Officials from Sweden, Denmark, and Germany would answer none of my questions. Nor would officials at the White House, the Office of the Director of National Intelligence, or the Pentagon comment on the record, beyond denouncing the act as sabotage. Sweden, Denmark, and Germany have initiated criminal investigations, but very little has emerged about the conduct of any of these probes. That has surprised some journalists, who are used to a leakier status quo. None of the relevant investigating authorities has announced a clear finish line, although Swedish officials have expressed the hope that a decision on whether to bring charges could be made by the end of the year.

“Nobody really wants to clear it up,” suggested the Swedish diplomat Hans Blix, who at 95 is one of his country’s most honored citizens. A former minister of foreign affairs, he is best remembered in the U.S. for contradicting President George W. Bush’s claim that Saddam Hussein had stockpiled weapons of mass destruction in Iraq. (Blix was in charge of the United Nations’ monitoring effort there, and his skepticism proved well-founded.) I met him in his spacious apartment in central Stockholm, moving with the help of a walker—“this condition is not just old age,” he explained, but a consequence of tick-borne encephalitis. His mind was as fresh and independent as ever. We considered various theories about the Nord Stream sabotage—the Russians did it; the Americans did it; the Ukrainians did it. “I end up not convinced of any conclusion … yet ,” Blix told me, echoing what he had said in an earlier email. He smiled and added, “And is not that the wish of all parties?”

II. Gas as a Weapon

Nord Stream was an astonishing engineering feat, even if the details of its creation attracted little of the world’s notice. The oceans and seas are threaded with cables and pipelines. Few people give much thought to how they got there. Nord Stream took a quarter of a century to build. Initial planning studies for a new gas pipeline under the Baltic Sea were launched in 1997, when Gazprom joined forces with a Finnish oil company, Neste. This was the era when Boris Yeltsin, then the Russian president, was making boozy trips abroad to sell the capitalist West on the boundless opportunity of investment in his country.

Engineers determined that a direct pipeline from Vyborg, northwest of St. Petersburg, to Lubmin, on the north coast of Germany, would be commercially and technically feasible. The project had broad support: Many European companies wanted in. Compared with coal and oil, natural gas was relatively cheap, safe, and clean. Nord Stream seemed to herald a new era. Russia was at long last joining the peaceful, cooperative commonwealth of Western Europe. Construction of the pipeline began in 2010.

The underwater environment was challenging. The bottom of the Baltic Sea is rocky and irregular. Pipe had to be laid across hundreds of miles of subsea terrain without disturbing the marine ecosystem, disrupting the fishing industry, or destroying historically valuable wrecks. The Baltic’s low salt content is hostile to wood-boring shipworms, so even ancient sunken vessels tend to be well preserved , and the seabed is a prized hunting ground for marine archaeologists.

One man who has specialized in underwater work in the Baltic is Ola Oskarsson, a retired Swedish naval demolition diver. Oskarsson lives on his own small island, Keholmen, south of Gothenburg, on Sweden’s west coast. The island, a rock outcrop, once held a ship-repair business and still has on its west side an idle crane and a slip for hauling vessels out of the water. Oskarsson’s big house is paneled with rough-hewn pine and stained with tar, and has wide windows that look out across the sea.

Oskarsson has a lifetime of experience on and below the water, first for the Swedish navy, then running a business specializing in underwater research, surveying, and exploration. He is weathered and fit in his 70s, tall and blue-eyed, with a trim gray mustache and bright-white chin whiskers. He is an animated storyteller. Once, not content to simply describe for me the breach of the Nord Stream pipes, he jumped onto his front deck to rig an experiment with a pressurized hose, showing how an underwater pipe might have reacted to a sudden rupture.

At the time Nord Stream was being conceived, Oskarsson’s company, MMT (Marin Mät Teknik), was still relatively small. It had one ship and 50 employees. Word of a big Baltic pipeline project spelled opportunity, so he and his business partner traveled to Switzerland, where the NS-1 project had set up shop, to pitch themselves for the underwater surveying and mapping. As Oskarsson recounted, they were informed that all such work had already been taken care of by a Russian company. They were on their way out the door when his partner asked, out of curiosity, “Have you found any mines?”

“No,” came the answer. “Why do you ask?”

Astonished, the Swedes explained what they knew about the dangers lurking on the Baltic seafloor—and MMT was hired. The company expanded to seven ships and 350 employees. In the course of their work, the MMT survey teams found 400 unexploded mines .

They and other teams on the project found plenty else, too: sunken World War II submarines, and a wreck that may have been eight centuries old. Oskarsson was enthusiastic about his work. As he saw it, MMT was not only making money but helping to narrow the Cold War divide and preserve the Baltic Sea’s historic and environmental integrity.

Laying the pipeline has been likened to building a railroad underwater. Swaths of seafloor had to be swept of hazards; occasionally holes and depressions had to be bridged. The pipes themselves were fabricated on shore in segments and shipped out to “lay barges”—flat vessels longer than a football field. Studded with cranes and crawling with hundreds of workers, the barges served as platforms on which prefab segments were welded together, end-to-end. The seams were coated with expandable polyurethane foam to minimize potential snags. When that was done, the ever-lengthening pipes were eased off the barge at a carefully calibrated angle toward the water. The steel pipe, encased in concrete, had to be flexible enough to bend from the barge to the water, yet strong enough to contain highly pressurized gas and to withstand any shocks from outside. As the barges slowly advanced, the pipelines slipped into the sea until they settled on the bottom.

A fleet of ships and helicopters supported the barges, delivering crews, equipment, tools, and food. Work continued day and night. The first of the two NS-1 pipelines began delivering natural gas from Russia to Europe in 2011, the second in 2012.

Meanwhile, preliminary work had begun on a parallel pair of pipelines, NS-2. But the political climate was changing. Putin, reelected to a third term , was aggressively consolidating his autocratic rule and installing himself as leader for life. He was also throwing Russia’s military weight around. As prime minister, in 2008, he had overseen the invasion of Georgia, and when he retook the presidency, he occupied Ukraine’s Crimean Peninsula. Democracy in Russia vanished. Opponents and critics of Putin’s regime were harassed, jailed, and sometimes killed. Russia’s cheap natural gas was no longer seen as a friendly bond but as a weapon—a way for Putin to pressure the EU. Some investors and governments may once have resisted (and resented) American arguments against the pipeline, but after the invasion they curtailed their involvement .

David Frum: Putin’s big chill in Europe

Oskarsson cut his own company loose before the NS-2 was even finished. He had met Putin once, at a ceremonial event for NS-1 around the time of its opening. Leaders from the surrounding nations had all been gathered. As Oskarsson recalls, he was standing with Angela Merkel, Germany’s chancellor at the time, when Putin arrived with an entourage of seven bodyguards. Putin is short, and seemed to have deliberately picked bodyguards who were even shorter. Merkel commented, “Snow White and the seven dwarfs.” The breaking point came years later, when, according to Oskarsson, his company was subject to an extortion demand in return for a contract on a different pipeline project. Oskarsson told the Russians, “We don’t pay bribes.”

By September 2022, Nord Stream, this hopeful project, the proud achievement of engineers who had spent much of their careers on it, sat primed and poised on the sea bottom, fully pressurized and waiting, an international rem non voluerunt —a thing not wanted.

III. Blaming the Bear

In the absence of facts, speculation and misinformation rule. At the time of the Nord Stream attacks, many people assumed that blowing up pipelines at the bottom of the sea would require the prowess of a big, modern navy with sleek submersibles, skilled divers, and very large bombs. So the two prime suspects immediately became Russia and the United States. Both countries have denied any involvement , but, under the circumstances, wouldn’t they?

Working 260 feet underwater can be challenging. Visibility is zero (divers work with lights) and the water pressure extreme (about 115 pounds per square inch). Nitrogen under such pressure becomes narcotic, so the air breathed by divers is mixed with helium to lower the exposure. Ascending to the surface without the aid of a recompression chamber or a diving bell requires divers to pause multiple times on the way up to allow their bodies to adapt. Both the Russian and American navies have the personnel and the specialized technology to conduct sophisticated deep-sea operations as needed. An autonomous submersible might even obviate the need for much diving. Among the other nations with a big navy—the United Kingdom, Iran, India, China—none had much of a motive to attack Nord Stream.

Russia, in the words of the Foreign Policy columnist Emma Ashford, writing in June 2023, “ seemed to be the most obvious candidate .” Putin, according to this logic, had blown up his own pipeline primarily to punish Europe for its solidarity with Ukraine. Further—a Putinesque twist—if suspicion could be quietly cast on Kyiv, then support for Ukraine might itself be undermined.

This explanation was immediately popular in Sweden. There was no direct evidence for it, and the Kremlin called such suspicions “stupid,” but journalists and amateur sleuths found suggestive patterns in Russian ship movements in the Baltic during the days and months prior to the blasts. Specifically, they identified military vessels that had lingered near the blast sites during the summer. That said, Russian naval traffic is common in the area.

“Of course, in Sweden, the automatic reaction from the press or the media was that the Russians did it themselves,” Mattias Göransson told me. Göransson is the founder and editor of a popular literary and journalistic Swedish magazine called Filter . He is also the author of a book titled The Bear Is Coming! , which examines (and pokes fun at) his country’s preoccupation with its unfriendly neighbor to the east. “It’s very counterintuitive,” he said of the finger-pointing at Moscow, “but it’s a foolproof argument”: If you can’t explain some Russian act or behavior rationally, then you can always say, “‘But you know the Russians. You never know how they think’ … It’s very funny in a way.”

Funny or not, the theory was developed in a ponderous three-part Scandinavian public-television documentary, Putin ’s Shadow War , which aired last April and May. It didn’t present any solid new evidence, just speculation and a menacing litany of aggressive acts by Russia. But the contention gained broad traction, and not just in Scandinavia.

“Nobody benefits from this except the Russians,” Ben Hodges, a retired lieutenant general who commanded the U.S. Army in Europe until 2017, told me. “Not only does it serve as a potential wedge”—between Ukraine and its Western supporters—“but it also sends a message, even if it doesn’t have Kremlin fingerprints on it yet, to the Scandinavian countries that their energy infrastructure is very vulnerable, that it can be destroyed.”

Many EU nations had stood with Ukraine when Russia invaded, and Kyiv has relied heavily on their economic and military support. In the spring of 2022, Germany was weighing whether to supply state-of-the-art Leopard combat tanks to Ukraine. Feeling newly threatened by Russia, Finland joined NATO and Sweden ditched a more than 200-year tradition of neutrality to apply for membership. So perhaps Putin was sending a message: There was a price to pay for poking the bear.

But the logic is strained. Russia was hurt more by the sabotage than any other nation. It had spent billions to build the pipeline and theoretically stood to profit from it for years to come. Why would Putin destroy it when he could simply keep it shut? The Ukraine war will not last forever. That said, the retired U.S. military commander and senior appointee observed, “A lot of things they’re doing just don’t pass the sanity check.”

A former CIA officer, who spent decades at the highest levels of intelligence-gathering, characterized the Russia theory to me as “too complicated,” especially if it involved trying to pin the sabotage on Ukraine. He went on: “If you’re in Moscow and you’re going through all of this … you’re going to know that you’re going to be blamed, right? Even if you can blame the Ukrainians, you know you’re going to be blamed. So, it doesn’t make any sense.”

Emma Ashford, in her Foreign Policy column, ended up dismissing the possible Russian motives for an attack on the pipeline as “weak.” Although some observers still hold to the theory, Russia is an unlikely suspect.

IV. Next on the List

One can almost see the movie—the dark suits and cornpone accents in a shadowy glass room in Washington. Like Russia, the U.S. has the military know-how to mount sophisticated undersea operations, and it had a motivation that had been articulated by the president himself. America is also everyone’s favorite hidden hand when it comes to international skulduggery .

The suspicion that the U.S. was involved in the sabotage was given a big boost in some minds by the celebrated journalist Seymour Hersh. In February, Hersh published on his Substack a confident and detailed article titled “How America Took Out the Nord Stream Pipeline.” He presented the account simply as fact. Hersh’s history of blockbuster revelations about episodes of American wrongdoing—among them, the My Lai massacre in Vietnam and the torture of prisoners in Iraq—gave his story weight. But some of Hersh’s recent work has raised questions. Relying heavily on one unnamed source, his 2015 article about the killing of Osama bin Laden , published by The London Review of Books , flatly contradicted every other account of the mission, including my own and those of mission participants.

Hersh’s account of the Nord Stream sabotage appeared also to have relied heavily on a single unnamed source, and a remarkable one at that. The source provided accounts of top-secret meetings at the Eisenhower Executive Office Building, secret meetings of CIA and NSA working groups, and planning sessions in Norway, as well as specific details of the mission itself, including tools and methods.

According to Hersh, the decision to bomb the pipeline was made by Biden in early 2022. After months of indecision, it was carried out by American divers schooled at the Naval Diving and Salvage Training Center in Panama City, Florida, who had “repeatedly practiced” placing explosives on pipelines. The mission was staged in Norway, where that country’s naval experts chose the precise spots to place bombs on each of the four pipes. A Norwegian Alta-class mine hunter was used as a platform for the dives, which were made during a regular NATO exercise called BALTOPS 22 , which employed “the latest underwater technology.” There would have been plenty of warships in the Baltic Sea to provide cover. A research exercise was invented as a facade. The bombs were planted in June and ultimately triggered by a signal from a sonar buoy dropped on September 26 by a Norwegian P-8 surveillance plane on a routine flight. In an interview with Berliner Zeitung , Hersh elaborated, saying that eight bombs had been planted, which made sense: two bombs on each pipe, for redundancy.

It was a neat, authoritative play-by-play. For anyone inclined to suspect the U.S., it offered a plausible scenario of what America might have done. No conflicting information was presented. But it broke down in the details. Ship movements near the blast sites during the naval exercise didn’t add up, and no Alta-class mine hunter had taken part. Independent flight-tracking data showed no record of a Norwegian P-8 flight in the area on September 26. Hersh maintained that eight explosives had been placed on the pipes, but there appear to have been only four explosions. He also reported that NATO Secretary General Jens Stoltenberg, himself Norwegian, had been cooperating with U.S. intelligence since the Vietnam War, when the 64-year-old statesman was still a child. Hersh dutifully reported the White House response: “This is false and complete fiction.” He received a similar response from the CIA.

The Hersh article has been analyzed and criticized by a number of knowledgeable investigators . My own military and intelligence sources were unanimous in discounting the idea of American responsibility. These are people who have hands-on experience with covert U.S. military missions over many decades. In previous interactions, they have responded to sensitive questions they didn’t want to answer with “No comment.” In those instances where they have agreed to share information with me, it has always been correct.

“I’m at a loss to know who actually did it, other than the fact that we didn’t do it,” the retired U.S. military commander told me.

The former high-ranking CIA officer, a man who can draw on long experience in the White House Situation Room, from which covert operations are often launched, was unequivocal: “Without a doubt, the United States did not do this. There is no way the Biden administration would. If it was the Trump administration, it might be a different story. But there’s no way that Biden would ever sign off on doing something like that.”

The logic was clear. One of the triumphs of Biden’s presidency has been rebuilding NATO and repairing ties with Europe that were strained during Trump’s tenure. And one of Biden’s proudest achievements is the international coalition that keeps Ukraine supplied with war-fighting matériel. The bonds of that partnership are not sturdy. They have been sustained by aggressive persuasion. Would Biden put all of that in jeopardy? No matter how carefully a covert mission like an attack on Nord Stream is executed, history shows that the truth will come out, usually sooner rather than later. If the U.S. were discovered to have attacked a major piece of its allies’ energy infrastructure, the information might shatter his coalition. And why risk it? The pipelines were already idle. There is also, despite the Hollywood cliché, an inbred reluctance in the U.S. military and intelligence community to conduct missions that might trigger strong political blowback.

From the January/February 2024 issue: Anne Applebaum on how Trump will abandon NATO

Russia had blamed the United States for the blasts immediately, and when Hersh’s story came along, it was embraced by Putin and his Russian media. It was also embraced by right-wing American pundits with their own political agendas. Tucker Carlson, still a Fox News host at the time, emphatically pronounced Hersh correct: “So many details in here. It is not possible that it’s not true. It is true!”

When the story appeared, it represented the only detailed narrative explanation of exactly what had happened, and for that reason alone many people were swayed by it. And Hersh has expressed no doubts. But in light of the broader context, America, like Russia, seems to be an unlikely suspect.

Neither Big Navy theory is convincing: For different reasons, both Russia and the U.S. would have little to gain and much to lose. Meanwhile, facts have emerged that offer a very different perspective.

V. The Andromeda Connection

Ola Oskarsson, the diver and surveyor, viewed initial speculation about the bombing with a more practiced eye than most. In addition to his military service, when he handled explosives underwater, and his Nord Stream service, when he helped locate 400 mines in the pipeline’s path, he has supervised commercial underwater operations in the Black Sea, the North Sea, the South China Sea, the Indian Ocean, and Lake Victoria. He has surveyed almost all of the undersea power and telecommunications cables in the Baltic at one time or another. He helped find and remove old listening devices from the ex-Soviet submarine base near Paldiski, Estonia, after the U.S.S.R.’s collapse, in 1991. Over the years, Oskarsson has maintained close friendships with military and commercial divers, and he knows that world as well as anyone.

He also maintains friendships with journalists, who prize his expertise. And he had been telling them that certain widespread assumptions about the Nord Stream bombing were mistaken. The explosives did not have to be all that large, he maintained, and breaching a gas pipeline would not require the most advanced technology on the market. In other words, you wouldn’t need Big Navy resources.

Oskarsson has no direct knowledge of the Nord Stream attack, but he does have suspicions. “I think I know pretty well how it was exploded,” he told me. He believes it was done by “a little sea group, two to six people in a rubber boat”—a Zodiac, say, launched from a fishing vessel or private yacht as a base of operations. His scenario starts with a standard vessel large enough to take half a dozen people on a cruise. Most Swedes live on or close to the water, and there are hundreds of thousands of privately owned boats in the country. Its 2,000-mile coastline is notched and dotted with a seemingly endless series of inlets and small islands—indeed, the capital city, Stockholm, is itself a cluster of 14 islands. You can smell water from just about everywhere except the pine forests of the interior. Large vessels are closely monitored, but tracking the multitude of small fishing boats and yachts is impossible. A vessel being used as a platform for the attack need not even have anchored over the submerged pipes, whose exact position is well known; it could have stayed some distance away and launched a Zodiac at night. A line dragged along the seafloor would snag a pipe and provide a dive rope. Descending, divers wearing rebreathing apparatus could stay submerged for hours. Military-grade explosives, small enough to be carried in a backpack, could then be affixed to the concrete shell of the pipes. The operation would likely have required as many as four dives, one for each pipe, depending on the number of divers involved. And it would have been strenuous. But if the crew rested on the larger vessel during the day, it would have been doable. This approach also had the virtue of being simple, inexpensive, and completely inconspicuous.

And evidence exists to support this scenario. Although officials in Sweden, Germany, and Denmark have said little about their ongoing investigations, journalists both in and outside the region have pieced together a story similar to Oskarsson’s basic idea from government sources and determined legwork.

On March 7, The New York Times reported that American intelligence officials had come to suspect that divers from a pro-Ukrainian group had sabotaged Nord Stream. That report prompted a consortium of journalists from Germany, Sweden, and Denmark—brought together by Georg Heil, a journalist who works within Germany’s public-broadcasting conglomerate—to rush ahead with the first in what would be a series of reports in German news outlets and on regional TV stations. They had been accumulating information for months and had hoped to flesh out their findings in greater detail before publishing, but the Times article forced their hand.

They offered a lot more than the Times. Their reporting linked the bombing to a small crew of divers working off a yacht—a private vessel that had made a stop at a marina in Wieck am Darss, a German port on the southern edge of the Baltic. The boat carried a group of six: a captain, two divers, two diving assistants, and a doctor. Passports presented by the crew proved to be fake. When the boat was returned, it was found to contain traces of an explosive. All this information had come from sources cultivated within the German police. A subsequent article by the magazine Der Spiegel named the boat: Andromeda.

The consortium of journalists had in fact known the name since January—and not only from German sources. The team’s Danish reporter, Louise Dalsgaard, was able to confirm that authorities in Denmark were also interested in Andromeda. Fredrik Laurin, a prominent and respected Swedish journalist whose work is featured on a 60 Minutes –like program on Swedish public television called Mission: Investigate , was determined to find the boat—not an easy task when dealing with multiple jurisdictions and proprietary record-keeping.

When I met with him in Gothenburg, Laurin told me that he had contacted a young woman, the daughter of an old sailing friend, whom he knew had worked as a harbormaster on Germany’s north coast. He figured she knew more than any journalist did about boats, ports, and rentals on that side of the Baltic. She was happy to be consulted; the project sounded exciting—perhaps a little too exciting, because she didn’t (and still doesn’t) want her name connected with it.

When I spoke with her by phone, she seemed pleased with her contribution. She and Laurin had made the assumption that Andromeda was probably a yacht—possibly a Bavaria, a very popular sailing vessel on the Baltic. A motorized vessel big enough for a six-person crew would be more likely to attract attention, as would a large purchase of diesel fuel, which it would need to travel across more than 100 miles of sea from the German port to the blast locations. A sailboat would not need that much fuel and, on the water, “would look like a charter tourist who is just lost, or swimming,” she said.

Because the harbor depth at Wieck am Darss was too shallow for a sailboat with a Bavaria’s draft—the consortium journalists would prove to have been mistaken about the location, and later published a correction—the young woman guessed that the Andromeda was likely chartered elsewhere. She started calling companies to ask if they had a vessel by that name. She was having fun. She had to have a reason for the ask, and worried that the truth might spook the people she called. So she played stupid. She knew that the boating communities of north Germany were still almost exclusively male, and decided that pretending ignorance would suit their expectations.

A typical conversation went like this:

“I want to rent a boat this year, and my friends, they rented a boat called Andromeda last year,” she would begin, explaining that her friends had been “so happy with it.” Then she said she didn’t know any details about the boat, even whether it was a motorboat or a sailboat.

“Well, a sailing boat usually has a mast on it,” one of the charter officials told her.

She quickly found what she was looking for. A 50-foot Bavaria called Andromeda had been rented from Mola Yachting, on Rügen, a German island north of Wieck am Darss. And it fit the bill: It had a galley and could sleep up to 10. There was no telling if the authorities had already learned all this, but Laurin spread the word.

In May, Süddeutsche Zeitung , the German newspaper, published “The Fog Is Lifting,” a detailed account of Andromeda’s possible role. Subsequent stories chronicled its doings during September 2022. Many of the stories carry the name Holger Stark (among others), one of the most consequential journalists investigating the Nord Stream attack. According to these reports , the request to Mola Yachting for the Andromeda charter had come from a Google account that appeared to be American but that had actually originated in Ukraine. The yacht had been sighted at ports around the Baltic on a voyage that lasted a little over two weeks. A witness at Rügen remembered five men and a woman who stood out among the usual mix of families and couples renting a yacht for a pleasure cruise. They were seen loading a lot of equipment onto the boat, which a harbor webcam had captured moving out to sea on September 7.

Andromeda was again noticed during a stop at Bornholm, the Danish island near the southern explosion site, and near Christiansø, a tiny island closer to the northern site. Then, two weeks before the blasts, the yacht reportedly sheltered during heavy weather in Sandhamn, a small harbor on the Swedish coast, about 40 miles from the northern site. A German skipper had a slight run-in with its crew, a dispute over boating etiquette, and described two of the men as middle-aged but fit, with military haircuts. He spoke to them in English, which he said was translated by one of the crew into a language that to him sounded Eastern European. A second witness in Sandhamn described the boat’s captain as heavyset and unfriendly. The crew bought some diesel fuel, paying cash in euros, and left on September 13 as the weather calmed. Six days later, Andromeda arrived at the Polish city of Kołobrzeg, closer to the southern site, where the first explosion would occur.

Andromeda had been chartered through a travel agency in Warsaw registered to a woman with a Ukrainian address, and Die Zeit , the German weekly newspaper, tracked down a man associated with the company in Kyiv . Identifying him only as “Rustem A.,” the reporters found that he owned a string of companies, some of them real, some of them without an internet presence or a real-world address. He reacted, when contacted, not with surprise, but with anger. He refused to cooperate and insulted and threatened the journalists. Meanwhile, using the passport photos obtained from the boat-rental company, together with facial-recognition software, journalists had tentatively identified one member of the Andromeda crew as a Ukrainian soldier. (The soldier denied any involvement .)

Additional information became public in June, when The Washington Post revealed the existence of a secret report received by the CIA the previous summer, months before the blasts, outlining a Ukrainian plan to sabotage Nord Stream. According to the Post, the Dutch Military Intelligence and Security Service had warned that Ukraine was planning an attack using a small team of divers.

The contents of the Dutch memo were brought to light when Jack Teixeira, a young U.S. airman assigned to the intelligence wing of the Massachusetts Air National Guard, allegedly began showing off his access to classified documents to a members-only server on Discord, a social platform popular with gamers. Teixeira was arrested this past April , and has pleaded not guilty to multiple federal charges. Some of the posted files were subsequently obtained by The Post . The newspaper’s first detailed account of material related to Nord Stream noted that, according to Dutch intelligence, Ukraine’s plan had originally been set for midsummer 2022, but had been delayed. Six Ukrainian operatives with fake passports would travel to Stockholm, where they would rent a boat and a submersible vessel. They would deliver the bombs, blow up the NS-1 pipeline, and depart undetected. (No mention was made of NS-2.) It said the operation was supervised by Ukrainian General Valery Zaluzhny, the country’s top military commander, but that President Volodymyr Zelensky would not be informed. The details in this summary did not agree with every detail in the findings of the journalistic consortium and other reporters, but the resemblance was clear: a crew of six and a boat.

The accumulation of information pointed circumstantially to Ukraine, or at least a group of Ukrainians. Ukraine has denied involvement repeatedly. “I am president, and I give orders accordingly,” Volodymyr Zelensky said in June, in an interview with the German publishing company Axel Springer, following up on the reports about Andromeda. “Nothing of the sort has been done by Ukraine. I would never act that way.”

But Ukraine had a clear motive. The attack delivered a punishing and enduring economic blow to Russia, which daily rains shells and missiles on Ukrainian cities . By mid-2022, Ukraine had fought off Putin’s initial thrust and taken back much of the territory seized in March. It had hit Russian ships on the Black Sea. Soon it would down part of the Chonhar road bridge, the main Russian link to occupied Crimea; its drones and covert units would be striking Russian targets far from the battlefronts. Knocking out Nord Stream also preserved the value of Ukraine’s own gas pipelines, which have continued to deliver Russian gas to Western Europe even as war has raged. Russia has reduced the flow to a third of prewar levels, but the pipelines still earn important revenue for the embattled nation.

Anne Applebaum: The West must defeat Russia

Ukraine does not have a large navy, or anything comparable to the advanced undersea technology that Russian and the U.S. can deploy. But it has demonstrated tenacity and ingenuity—certainly enough to charter a yacht with a Zodiac and send skilled divers down 260 feet with small bombs. This is where things stood one year after the blast, with the United States and Russia still considered suspects by many, but with evidence tilting more strongly to Ukraine.

VI. The Mistake

Solving the Nord Stream mystery has been the province not only of journalists but also of amateur investigators (and conspiracy theorists) who have been active online. Most just offer opinion or conjecture. Some tap expertise that journalists don’t possess. The very rare ones combine expertise with detective work—actual reporting—in the real world. Few people have produced more useful information about Nord Stream—including a possible explanation for why one of the pipes remained unharmed—than a man named Erik Andersson, a well-to-do retired engineer in Gothenburg.

His career began at Volvo, which has its headquarters there. Andersson has a precise mathematical mind and an itch for complex problem-solving. He was drawn to the challenge of scheduling—whether of production or personnel—and a software product he helped build was useful enough that outside companies began approaching Volvo for help. Among them were major international airlines, such as Scandinavia’s SAS and Germany’s Lufthansa. Volvo at first allowed Andersson to put his skills to work creating timetables for the ever-moving army of pilots and crews that commercial air fleets require. He was eventually able to spin off a new company, Carmen Systems, dedicated to the airline work. The software Carmen developed has since become widely used. In 2006, a Boeing subsidiary purchased the company for $100 million. Andersson stayed on for a decade, then retired: wealthy but slightly aimless. Ease didn’t suit him. He took on a few engineering projects and became a philanthropist, an investor, and something of a gambler. At heart he remained a nerd, and he still had that problem-solving itch.

Andersson found an outlet for that itch in conspiracy theories. He was drawn into a murky online world that revolves around topics such as Russiagate, the Steele dossier, and the origins of COVID. Politically, he is on the right. He likes Donald Trump, and in 2016, finding the odds attractive, he bet and won big—$300,000—on the results of the 2016 American presidential election. He has intimated online that he thinks the 2020 election was stolen. Andersson also understands, as he told me, that “going on social media and launching your opinions” is “not good for your health.”

He began conducting actual research. Andersson was intrigued by the Nord Stream mystery, and particularly taken with Seymour Hersh’s rendering of events. He could see that most mainstream media were skeptical of Hersh’s account, but he himself was inclined to believe that the U.S. was behind the explosions. With time and money at his disposal, he decided to begin where detectives usually do, by examining the crime scenes, looking to verify Hersh’s story. Last May, he chartered a boat, bought an undersea drone, assembled a crew, cruised out to the blast sites, and performed his own forensic inspection.

I met Andersson in his airy, high-ceilinged apartment in Gothenburg’s historic center. He is now 63, a sturdy man with a ruddy countenance and short, unruly white hair. His dress shirt was untucked and his pants were wrinkled; his manner was fidgety but patient. My questions were generally broader than the intricate, technical issues that preoccupy him, and I had to keep reeling him up from the depths. Before him on a long table Andersson had unfurled large maps of the Baltic, annotated with his own notes, as well as small plastic models of the undersea blast areas showing deep craters and scattered segments of the Nord Stream pipes. The craters were carved, Andersson suspects, by the force of the escaping methane.

Andersson’s reports on Substack are clearly written and convincing, and they have earned the respect of knowledgeable journalists. Indeed, I had been led to Andersson by Fredrik Laurin. Much of Andersson’s work is based on input from specialists in a variety of fields, and it is taken seriously by people who have experience with the Baltic pipeline. Andersson’s findings tell a story, one that, contrary to his original intention, is at odds with Hersh’s.

Hersh had maintained in an interview that eight bombs were set on the pipeline, and that only six had gone off. In a follow-up Substack article , he referred only to “the one mine that has not gone off”—presumably meaning a mine placed on the undamaged pipe, NS-2B—and nodded at the idea that it had been retrieved covertly by the U.S. Navy afterward. If Hersh still believed that there had been eight bombs or mines—he did not specify a new total in his follow-up—then that suggested there had been seven explosions.

Investigation or inspection by Andersson and others showed clearly that there had been four explosions and strongly suggested that they had been caused by just four bombs. There were four gas plumes: one large one at the southern site that had erupted early in the morning, plus two large ones and one very small one at the northern site, from the explosions 17 hours later. The timing and location suggested that the small plume came from a pipe that had already been depressurized by the initial blast; in other words, two bombs had been placed on the same pipe. Why would the saboteurs leave one pipe, NS-2B untouched, and put two bombs on NS-2A? The answer, as Andersson came to see it, was that they made a mistake. If he was right, then the smaller blast site would yield the best clues about the number and size of the bombs because, unlike at the other three blast sites, there would have been no subsequent catastrophic outflow of gas.

We don’t know whether official investigators have come to this same conclusion, but Andersson’s underwater drone seemed to confirm its accuracy. The first blast on NS-2A—the early-morning one, at the southern site—had done catastrophic damage; the second blast on NS-2A, at the northern site, had simply poked a neat hole in the pipe. There had been no violent burst of escaping methane, just a relative trickle that made its way steadily up to the surface—the small plume. The neat hole also confirmed that the explosive charge used was relatively modest—compact enough to have been carried in a backpack.

Without consulting the perpetrators, there is no way to know why the northern bombs went off 17 hours after the southern one, and there is no way to know whether bombs were placed at the northern site first or the other way around. But it isn’t hard to imagine why there were two separate blast sites. If performed in the simplest way, by divers off a Zodiac, the work would likely have required a series of descents over several nights, and it could have been interrupted—and the boat forced to move—for any number of reasons: bad weather, say, or fuel or supplies running low. Maybe there was just a need to rest. But this is mere speculation. What does seem clear, from all the evidence, is that the divers made a mistake: They put two bombs on the same pipe.

How did they get confused? If the divers were using magnetic compasses, the readings could have been affected by the steel pipeline itself or by a high-voltage underwater cable that lies only about 1,000 yards from Nord Stream at the northern location. That said, in these circumstances, experienced divers would have preferred a sonic device to a magnetic compass. There are plenty of other reasons why divers might have gotten disoriented. Working at such depths is inherently difficult. But the mistake is noteworthy—a piece of what might be called negative evidence. It points away from a Big Navy operation, conducted off a warship with divers who had repeatedly conducted practice runs planting explosives on pipes. In such a scenario, there would also have been no need for a second site. The bombs could all have been planted in a single dive. Weather and supplies would not have been issues.

Andersson’s findings, along with reports about the meandering Andromeda and its crew of six, told a different story.

VII. A Taboo Is Broken

The idea that world-changing events are guided by secretive actors with meticulous plans can be oddly reassuring. It reduces the troubling randomness of reality. Someone in power orders a thing to be done, and it is done.

In his Nord Stream story, Hersh describes a tidy process: an order from Biden, a collaborative effort with Norway, a warship deployed as a platform, and a team of U.S. Navy divers with the best military technology available. This scenario conforms with ideas of a hidden American guiding hand. But in life, things rarely work so smoothly. The Zodiac version is messier: an order from an unknown source, a rented sailboat, a Polish travel agency linked to a snarly Ukrainian, a somewhat noisy crew of divers who left witnesses all over the Baltic, a mission that needed to be paused and then picked up again, and then, possibly, a crucial mistake. Hersh’s version apparently comes from a single unnamed but very knowledgeable source. The messier version comes from scattered, disconnected, unpredictable sources in different places, most of them on the record, each yielding different bits of the story. The messier version leans toward Ukraine.

The Washington Post and D er Spiegel added weight to a possible Ukraine connection in November , when they coordinated the publication of separate articles that told the same broad story, based on shared reporting. The articles named a central player in the sabotage mission—a Ukrainian colonel, Roman Chervinsky. The authors based their stories on “officials in Ukraine and elsewhere in Europe, as well as other people knowledgeable about the details of the covert operation.” Chervinsky, who denied his involvement in a statement from his lawyer, is a decorated veteran of his country’s special-operations forces who, the reporters said, “is professionally and personally close to key military and security leaders.” He reported to Major General Viktor Hanuschak, who “communicated directly” with Ukraine’s top military commander, General Zaluzhny. The article said that Chervinsky handled “logistics and support” for a six-person team that dove from a rented sailboat to place the explosives. The mission was undertaken, the reporters said, on orders from senior Ukrainian military officers who report to General Zaluzhny. This did not necessarily mean that Zaluzhny himself gave the order. Chervinsky is currently under arrest for allegedly abusing his military authority by conducting an unauthorized mission, different from the Nord Stream one (an allegation that he also denies).

So President Zelensky might be telling the truth when he says he never ordered an attack. The Dutch memo to the CIA noted that he would not be informed. Such a mission might have been undertaken on orders from Zaluzhny alone, even in defiance of a hard no from the president. Given the stated U.S. opposition to the pipeline, it’s not inconceivable that there could have been quiet acquiescence from Washington. Such things can be conveyed by a nod or a wink. It is also possible that the mission skirted Ukraine’s military chain of command entirely. A wealthy patriot—someone like, say, Rustem A., believing that Nord Stream’s destruction might benefit his besieged country—might have contracted with someone like Chervinsky to charter a boat and hire a diving team without asking permission from anyone. Such a person might well have assumed that the penalty for success in his own country would likely be gratitude, if not acclaim.

Until there is some formal resolution, unofficial findings and theories are all we have. But the evidence at the scene of the blasts is well documented . A military-like crew aboard the Andromeda definitely wandered in the vicinity of the explosion sites, behavior that may of course turn out to have an innocent explanation. Then there is the explosive residue found on Andromeda. Hersh, for his part, contends that the Andromeda voyage and the explosive residue are part of a carefully constructed ploy designed to steer investigators away from the truth. If so, given the variety of sources and methods used to reconstruct Andromeda’s voyage, it would be a remarkably intricate confection. If the official investigations do identify Ukrainians as the perpetrators, as I suspect they will, many of those inclined to believe the Russia theory or the America theory will hold to their opinions. People tend to believe what they wish to believe, and theories are bound up with political ends.

That said, there are also ample reasons why many are not eager to assign blame—even if, in the end, investigators will have to come to a conclusion. Officially naming Russia, the U.S., or Ukraine as the saboteur would have sticky political consequences all around. The belief that Russia might have carried out the attack has already helped swell military spending in Scandinavia, spending that some in the region oppose. If Russia is shown to be behind the attack, that opposition could lose traction. Identifying Russia as the perpetrator would also put Germany on the back foot: Germany had seen Russia as a partner, and German companies had invested in Nord Stream. Because Germany is now aligned with the United States and Ukraine in resisting Putin’s invasion, pinning the attack on the U.S. or Ukraine would pose its own difficulties. If Ukraine is responsible, it would make that country appear singularly ungrateful, because European arms and ammunition have kept it in the fight . Blowing up a major piece of energy infrastructure in the middle of the Baltic would feel like a betrayal. At the same time, it would make Russia look weak and ineffectual, unable to defend a marquee infrastructure project on its doorstep. The Biden administration, which has worked strenuously to rebuild its alliance with Europe and to rally its support for Ukraine, would appear coldly calculating and two-faced if it was behind the sabotage.

Whoever is blamed, European outrage will likely be muted. Time passes, and memories are short. The environmental damage was minimal. Estimates vary considerably, but the amount of methane released, thought by some to be one of the largest single emissions ever to have occurred, is a small fraction of annual natural releases of the gas . The loss of Nord Stream inflated energy costs for a time, but today they are below where they were before Russia’s invasion of Ukraine. Workarounds were quickly found. Western Europe, it turned out, had alternatives to Russia’s natural gas.

“The European Union had prepared in earnest for supply disruptions from Russia since 2009, when a Russian cut-off of gas flows to Ukraine forced Bulgaria, an EU member state, to cut off industrial consumers of gas,” wrote Mitchell Orenstein, a University of Pennsylvania professor of Russian and East European studies, in a 2023 article published by the Foreign Policy Research Institute. “Most of these measures did not attract public attention, because of their highly technical nature.” The energy grids of member countries were linked, so that a production slump in one could be offset by others. A pipeline connector between Greece and Bulgaria was opened to allow natural gas to flow from Azerbaijan through the Trans Adriatic pipeline. New terminals were built in Poland, Lithuania, and Germany to enable liquefied natural gas to be imported from the United States and elsewhere.

The loss of Nord Stream also gave a big push to the EU’s green movement, which seeks to replace fossil fuels with renewable-energy sources. Putin was awarded first place in Politico ’s “Class of 2023” —a list of top environmental “power brokers.” Taking note of suspicions that Russia had blown up its own pipeline, Politico observed : “Vladimir Putin has done more than almost any other single human being to speed up the end of the fossil-fuel era.” Politico was poking fun, but it should not be forgotten that, whoever was behind the actual bombings, Putin is ultimately responsible for them. He started the war that made Nord Stream a target.

Repairing Nord Stream will not be as simple as putting the shattered pieces back together. In the days and weeks after the blasts, water gradually pushed into the broken pipes, reducing the outflow of methane until the water pressure from outside equaled the gas pressure inside, and stopped the flow. Repairing the pipes—if the effort is even attempted— would be time-consuming and costly . With the EU’s energy priorities shifting away from fossil fuel, repairs might very well never happen.

A year after the blasts, Hans Blix was less worried about the future of the pipeline than about the precedent set by its destruction. Pipelines and electric cables “wire our continents together,” he said the afternoon we met. He wondered if “it was a warning that those who did it could do it in other situations.” He stepped back for a measure of perspective: When you have wars, he said, the restraints come off—but not all of them. “Belligerents may have some common interests still,” such as the exchange of prisoners or the export of grain, interests that can be defined. “The partial [nuclear]-test-ban agreement: That was also a common interest.” Generally speaking, underwater infrastructure has been seen as a common interest, too; but, he said, “maybe that taboo is broken.”

Whatever the official findings, there is a good chance in the end that no one is ever likely to be brought to account for the attack. This is no small thing. A $20 billion engineering feat, built over decades by thousands of skilled workers—a wonder of the modern world—might well rest forever, inert and flooded, at the bottom of the sea.

• International edition
• Australia edition
• Europe edition

Key details behind Nord Stream pipeline blasts revealed by scientists

Researchers in Norway reveal further analysis of 2022 explosions as well as a detailed timeline of events

Scientists investigating the attack on the Nord Stream pipelines have revealed key new details of explosions linked to the event, which remains unsolved on its first anniversary.

Researchers in Norway shared with the Guardian seismic evidence of the four explosions, becoming the first national body to publicly confirm the second two detonations, as well as revealing a detailed timeline of events.

The recently discovered additional explosions took place in an area north-east of the Danish Baltic island of Bornholm about seven seconds and 16 seconds after the two previously known detonations.

Using information from seismic stations in northern Europe and Germany , including the Swedish National Seismic Network and Danish stations on Bornholm, seismologists deployed advanced analysis techniques to observe and pinpoint the blasts.

Seismologists at Norsar, Norway’s national data centre for the comprehensive nuclear test ban treaty (CTBT), told the Guardian they had so far found a total of four explosions – one south-east of Bornholm and three north-east of the island.

Two clear seismic events, named Event S and Event N, were identified on 26 September 2022, soon after the attack. The first, on Nord Stream 2, occurred at 02:03:24 (UTC+2), and the second, on Nord Stream 1, at 19:03:50 (UTC+2).

Norsar said there could potentially be further explosions buried in the data.

The explosions made holes in both Nord Stream 1 pipelines and one of the Nord Stream 2 pipelines. By November last year, Swedish investigators had confirmed that the breaches were caused by man-made explosives.

Investigations are continuing, but officials quoted in the US and German press have said the evidence points towards a Ukrainian-backed group, or a pro-Ukrainian group operating without the knowledge of the leadership in Kyiv.

German investigators have focused on a 51ft rental yacht called the Andromeda, which was hired by a mysterious crew of five men and one woman, at least some of whom were travelling on false passports.

Der Spiegel, which recreated the Andromeda’s journey , quoted investigators as saying the evidence all pointed at Kyiv’s involvement. There is debate, however, over whether a small crew of divers operating from a pleasure yacht would have been capable of carrying out the difficult, deep and slow dives necessary to place the explosives.

A leaked US defence document, reported by the Washington Post , showed the CIA had been tipped off by an allied European agency in June 2022, three months before the attack, that six members of Ukraine’s special operations forces were going to rent a boat and use a submersible vehicle to dive to the seabed using oxygen and helium for breathing, in order to sabotage the pipeline. But the leaked US document said the planned operation had been put on hold.

Other reports in the Scandinavian media have pointed to a cluster of Russian ships, with their identifying transponders turned off, in the vicinity of the blast sites in the days before the explosions.

The Nord Stream pipelines are operated by two companies, Nord Stream AG and Nord Stream 2 AG, both majority-owned by the Russian state energy company Gazprom. Nord Stream 1 and 2 are both twin pipelines, and together they bring up to 110bn cubic metres of gas annually from Russia to Germany.

Nord Stream 1 went into operation in 2012. Nord Stream 2 was completed in September 2021 but has never transported any gas. From the outset it was mired in controversy in the face of adamant opposition from German allies, in particular the US and Poland, who both believed the Germans were making themselves and much of the rest of Europe hostage to Russian energy supplies.

The US made clear that bilateral relations would be badly affected if Nord Stream 2 went into operation. Once the full-scale invasion of Ukraine began, all talk of opening the pipeline was shelved.

The newly discovered events, named NB and NC, took place about seven seconds and 16 seconds after the event previously known as Event N, which they now refer to as NA.

Investigations by Denmark , Sweden and Germany are understood to be planned for publication in a joint study with Norsar. Authorities for all three countries declined to comment on the investigations.

In July, the UN security council heard investigators had found traces of undersea explosives in samples from a yacht, but that they were unable to reliably establish the identity or motives of those involved or whether it was the work of a specific country.

Using information from a number of seismic stations in northern Europe and Germany, including the Swedish National Seismic Network and the Danish stations on Bornholm, seismologists used advanced analysis techniques to observe the additional two explosions.

According to their calculations, the second and third explosions (NA and NB) were 220 metres apart from each other (with the third west of the second) and the fourth was several kilometres south-west of the second.

Andreas Köhler, a senior seismologist at Norsar, said the distance between NA and NB “fit very well with the distance between both pipelines of Nord Stream 1 at the westernmost gas plume location northeast of Bornholm.” Nord Stream 1 and Nord Stream 2 both have two pipelines each.

The location of the final explosion, however, is less clear because there are less station observations. “This best fits an explosion on the Nord Stream 1 pipeline , but we cannot exclude a location at Nord Stream 2,” said Kohler.

Analysis of the source mechanism from the signals showed they were generated by explosive devices.

Based in Kjeller, near Oslo, Norsar monitors events across the world including nuclear testing in North Korea, the impact of CO 2 storage on the Norwegian continental shelf and conflict zones such as Ukraine.

It takes 10 minutes for shock waves to reach them after a nuclear test in North Korea, with location accuracy of 150-200 metres, leading to the claim that it is “10 minutes from Kjeller to North Korea”.

The war in Ukraine has marked a significant breakthrough for Norsar in terms of the potential use of seismology in conflict monitoring. “The technology that is used to find explosions the other side of the globe can also find explosions closer to home,” said its chief executive, Anne Strømmen Lycke.

It started monitoring Ukraine for the Civil Radiation Authority due to concerns of radioactive landfall over Norway after the 1986 Chernobyl disaster. It monitors bombing around the power plant on a continuing basis and has been able to contribute evidence to the UN truth commission.

In June, its scientists were able to confirm the time and location of reports of two explosions at the Kakhovka dam using data from seismic stations in Romania and Ukraine.

“It’s amazing, the accuracy of the observation and the use of it. The UN truth commission for Ukraine has contacted us to ask us to verify some events, among them the Kakhovka dam, so they are interested in having these cold data as basis for their considerations.”

Norsar is also investigating whether its technology could be used in the future to monitor ceasefires.

“We know that we could see, based on frequency content and signal difference, between different helicopter types and likely also different weaponry types,” Strømmen Lycke said.

“And that could be something to verify and then you could actually monitor and trace after unravelling who did what. I suppose that is why the UN truth commission is interested in these things.”

• Nord Stream 1 pipeline
• Nord Stream 2 pipeline

Most viewed

Swedish prosecution likely to conclude Nord Stream pipelines investigation amid unidentified suspects

T he same German media outlets, as quoted by dw.com, convey that Mats Ljungqvist, the prosecutor heading the investigation into the assault on the Nord Stream pipelines, plans on ceasing the proceedings. The same rationale is reiterated, "Most likely, the Swedish authorities were not able to identify any specific suspects in their country," we learn. This decision is anticipated in the upcoming days.

Will the Swedish investigation into Nord Stream be dropped?

Meanwhile, the investigation carried out by the German prosecutor's office will persist simultaneously . The local services show a keen interest in the broken pipe fragments, which the Swedish military recouped from the Baltic Sea shortly after the confirmations of explosions in the fall of 2022, as reported by "Sueddeutsche Zeitung."

The investigators aim to juxtapose the traces of explosives identified therein with those found by German officers on the Andromeda yacht. The German authorities say these findings are the "strongest indicator that could lead to the perpetrators."

Based on the German prosecutor's discoveries, it seems plausible that Andromeda was contracted by a Ukrainian citizen in September 2022 and paid for from the accounts of a Polish company, also owned by a Ukrainian.

The six-person crew of the yacht embarked on their journey from Rostock, Germany. " Suspicion arises that a group of divers may have planted explosive devices on the Nord Stream pipelines . The yacht made multiple stops at the Danish island of Christiansø, Sandhamn in Sweden, and Kołobrzeg in Poland," according to the "Sueddeutsche Zeitung" announcement.

Germany and Sweden undertook rigorous information exchanges throughout the investigation. The Swedish prosecutor visited the Federal Prosecutor's Office in Karlsruhe, Germany, while German investigators recently visited Stockholm to discuss evidence reachable for the ongoing German investigation.

"Unlike the Swedes, Poland has continuously impeded collaboration with German investigators," as "Sueddeutsche Zeitung" highlights.

Despite repeated inquiries, the Polish authorities have shared minimal information with their German counterparts, and that too, after significant delays. Up till now, Poland seems to have withheld any surveillance footage from the port in Kołobrzeg, which might provide fresh insight about the crew of the Andromeda, the newspaper added.

The investigation conducted by the German Attorney General's Office and the Federal Criminal Police Office (BKA) addresses the intentional explosion as an act of sabotage against state security.

Germany persists in Nord Stream pipeline attack probe: traces lead to Ukrainian connection

A twist in the Nord Stream sabotage case? "Washington Post" alleges to hold evidence

A repeat of Nord Stream? Finland suspects that Russia hit the gas pipeline

Denmark investigates yacht linked to Nord Stream blasts

The Reuters Daily Briefing newsletter provides all the news you need to start your day. Sign up here.

Additional reporting by Johannes Birkebaek; Editing by Jacob Gronholt-Pedersen

Our Standards: The Thomson Reuters Trust Principles. , opens new tab

Dengue outbreak in Argentina on track to break records

A major outbreak in Argentina of dengue, a mosquito-borne illness that can be fatal, is on track to smash previous records, reflecting wider worry around South America where warmer and wetter weather has led to a surge in cases.

Ukraine? Im Check: Wer hat Nord Stream gesprengt?

War es die ukraine : im check: wer hat nord stream gesprengt.

Die ganze Welt fragt sich: Wer hat die Nord-Stream-Pipelines gesprengt? War es die Ukraine? Antworten im Faktencheck.

Nord Stream: War es die Ukraine?

Usa oder russland : im check: wer hat nord stream gesprengt.

ZDFheute-Backgroundcheck

Mehr zu den nord-stream-anschlägen.

Verdächtige Segeljacht gefunden : Nord-Stream-Anschlag: Die Rolle der Andromeda

Politik | frontal : Doku: Der Fall Nord Stream

Politik | frontal : Reaktionen auf Nord-Stream-Recherchen

Nord-Stream-Anschlag : Saboteure nutzten wohl gestohlene Identität

• aller au contenu principal
• aller au menu de navigation
• aller au moteur de recherche
• aller à la page Direct radio

Enquête franceinfo Sabotage des gazoducs Nord Stream : l'ambassadeur d’Ukraine à Londres soupçonné d’être impliqué dans l’explosion

Christiansoe est une petite île de 22 hectares située en mer Baltique, à mi-chemin entre la Pologne et la Suède. C’est une réserve d’oiseaux migrateurs, sur laquelle vivent moins de 100 habitants. Un endroit qui d’habitude n’attire pas l’attention, sinon de quelques rares touristes. Et pourtant, en 2022, alors que l’été touche à sa fin, l’Otan y conduit des manœuvres militaires. Un navire scientifique russe croise dans le secteur, tandis que des avions de surveillance suédois survolent la zone. Sans doute parce qu’au large de ce petit bout de terre reposent sur les fonds marins plusieurs tuyaux d’une importance vitale : les gazoducs Nord Stream 1 et Nord Stream 2 qui acheminent le gaz russe vers l’Allemagne.

Un mystérieux voilier

La zone est d’autant plus sensible qu’avant l’été 2022, la CIA a reçu une information émanant d’un service de renseignement néerlandais en contact avec une source à Kiev. L’agence américaine est informée qu’une équipe de plongeurs munie d’un véhicule sous-marin a prévu de faire sauter le gazoduc Nord Stream 1 durant le mois de juin. En fait, ce sont quatre explosions qui se produiront. Mais plus tard, le 26 septembre 2022, et sur les deux gazoducs : Nord Stream 1 et 2.

Trois enquêtes seront ouvertes : en Allemagne, en Suède et au Danemark. Et les soupçons vont rapidement se porter sur un voilier baptisé L’Andromeda , qui a été aperçu dans la zone peu avant les explosions. Plusieurs éléments semblent le désigner. D’abord l’incohérence de son parcours. Le bateau a navigué une première fois dans la zone, avant d'opérer un demi-tour pour effectuer une escale en Pologne, puis il est revenu au large de Christiansoe.

À bord, se trouvait un équipage de six personnes, cinq hommes et une femme, qui avaient embarqué dans le port allemand de Rostock. Lorsqu’ils sont revenus à quai, ils ont étrangement accosté de nuit, sans récupérer leur caution, alors que la location leur était facturée 3 000 euros la semaine. Des analyses effectuées par la police scientifique montreront plus tard qu’il y avait à bord des traces de HMX, un puissant explosif.

La piste ukrainienne

Plusieurs indices vont ensuite mettre les enquêteurs sur la piste de l’Ukraine. D’abord, les portables et les téléphones satellites de certains membres de l’équipage vont "borner" dans ce pays. Ensuite, la location du voilier a été réglée par un Ukrainien, Rustem Abibulayev. Cet homme d’affaires possède plusieurs entreprises en Ukraine, dont une exploitation porcine. Et même si son nom n’apparaît pas dans les organigrammes, il est aussi à la tête de trois sociétés polonaises qui, selon toute vraisemblance, lui permettent de réaliser de discrètes transactions à l’étranger. C’est l’une de ces sociétés, Feeria Lwowa, qui a loué L’Andromeda .

Morgane Fert-Malka, du site spécialisé dans le renseignement Intelligence Online , a tenté d’interroger Rustem Abibulayev. Mais lorsqu’elle se présente avec une autre consœur devant sa résidence de la banlieue de Kiev, les choses dégénèrent. "On entend un bruit de moteur derrière nous. Rustem Abibulayev sort de sa BMW x3, raconte-t-elle. Il se jette sur moi, me prend le téléphone des mains et commence à le piétiner. Il demande à ma collègue d'ouvrir son sac pour voir s'il n'y avait pas un enregistreur. On refuse. Je fais la courte échelle à ma collègue qui grimpe par-dessus une barrière en tôle coupante. Poussée par l’adrénaline, je me hisse à mon tour en m'ouvrant la main droite au passage."

L’incident en restera là, mais la piste ukrainienne se précise d’autant plus que l’équipage de L’Andromeda disposait de faux passeports bulgares et roumains. Or, "c'est le service de Kirilo Boudanov (le chef des services secrets ukrainiens) qui a procuré les faux passeports utilisés par l'équipage, affirme la journaliste . Ils ont été achetés auprès d'autorités criminelles de Roumanie et de Bulgarie pour des sommes allant de 20 à 30 000 euros par document."

Tchervinski, un bouc émissaire ?

À l’automne 2023, nos confrères du Washington Post et du journal allemand Der Spiegel font clairement état de la thèse d’un sabotage ukrainien, désignant même un commanditaire de l’opération : Roman Tchervinski, un haut gradé du commandement des opérations spéciales, qui s’est fait un nom en s’engageant contre les Russes au Donbass et pour avoir tenté de capturer des mercenaires de Wagner. "Ce que nous comprenons de ce que nous disent nos sources, explique Shane Harris du Washington Post, c'est que Roman Tchervinski était le coordinateur de l'opération Nord Stream. Il s'est occupé de sa logistique. C'était une sorte de manager plutôt qu'un acteur de l'explosion elle-même."

Mais pour Morgane Fert-Malka, membre d’un collectif de journalistes d’investigation européens créé pour enquêter sur cette affaire, cette thèse ne tiendrait pas. Car Roman Tchervinski est aussi un homme qui a provoqué une catastrophe peu avant le sabotage du gazoduc. Il a organisé un projet de défection d’un pilote russe qui devait livrer son avion aux Ukrainiens. Or, non seulement le pilote n’est jamais arrivé, mais l’aérodrome Kanatova qui était censé l’accueillir a été détruit par un bombardement. L’opération se soldera par un mort et 17 blessés.

"Roman Tchervinski avait conduit l'opération catastrophique du pilote russe quelques semaines seulement avant Nord Stream 2, relève Morgane Fert-Malka. Alors que la planification de l'opération Nord Stream 2 battait son plein, on l’aurait confiée à quelqu'un qui vient de causer une catastrophe et qui, quelques mois plus tard, sera déféré à cause de cela devant un tribunal militaire ?" La thèse d’un Roman Tchervinski organisant le sabotage de Nord Stream lui semble d’autant moins plausible que l’homme est un proche de l’ancien président Petro Porochenko, et qu’il a pris publiquement des positions anti-Zelensky. "Jeter Tchervinski sous le bus, c'est une manière de brouiller les pistes", affirme-t-elle. Précisons qu’après le fiasco de l’opération de défection du pilote russe, Roman Tchervinski a été placé en détention provisoire. Il est aujourd’hui poursuivi par la justice ukrainienne pour abus de pouvoir dans le cadre de cette affaire.

Valeri Zaloujny en arrière-plan

La piste privilégiée désormais est donc plutôt celle d’un homme clé du régime : Valeri Zaloujny, l’ex-chef d’état-major de l’armée ukrainienne. Une figure très populaire qui a été limogée le 8 février 2024 par le président Zelensky et remplacé par Oleksandr Syrsky. Au moment des explosions, il dirigeait les forces spéciales. C’est un homme qui avait à la fois l’oreille de Volodymyr Zelensky (même si leurs relations se sont dégradées par la suite) et de puissants soutiens outre-Atlantique. "Valeri Zaloujny a été formé aux États-Unis. Il a énormément de contacts avec les Américains" , relève Romain Gubert, spécialiste du renseignement au Point.

Les Britanniques eux aussi l’apprécient. Ils l’avaient repéré dès sa sortie de l’académie militaire. En juin 2014, Valeri Zaloujny, alors colonel et jeune major de sa promotion à l’université nationale de la défense ukrainienne, se voit remettre l’épée de la reine du Commonwealth par l’ambassadeur de Grande-Bretagne en Ukraine. Depuis, les relations se sont renforcées entre les forces spéciales des deux pays. Après l’invasion de la Crimée, Boris Johnson, alors Premier ministre, souhaite que les commandos ukrainiens soient formés par des Britanniques. Ils utilisent d’ailleurs les mêmes équipements que les nageurs de combat du SBS, le Special Boat Service britannique. Après avoir été écarté de l’état-major en février dernier, Valeri Zaloujny a été nommé ambassadeur d’Ukraine au Royaume-Uni le 7 mars 2024. Un rôle clé pour Kiev dans sa guerre contre la Russie. Selon la source néerlandaise qui a alerté la CIA de l’imminence d’un sabotage, les plongeurs soupçonnés d’avoir saboté le gazoduc prenaient leurs ordres auprès de lui. L’intéressé, tout comme le président Zelensky, ont toujours démenti toute implication de leur pays dans le sabotage. Mais "les spécialistes du renseignement à qui j'ai parlé sont d'accord, explique Shane Harris du Washington Post . Selon eux, ce n'est pas le président Zelensky qui a autorisé ou ordonné cette opération. Mais ça ne veut pas dire qu'elle n'a pas été conduite par des militaires. C’est une opération menée sans instruction explicite du président, ce qui lui permet de nier qu'il a joué un rôle là-dedans."

Un message aux Européens ?

Le sabotage du Nord Stream présenterait donc des similitudes avec l’affaire du Rainbow Warrior , le bateau de Greenpeace coulé par une explosion des services français en Nouvelle-Zélande, qui avait fait un mort en juillet 1985. À la différence que dans l’affaire Nord Stream, il n’y a pas eu de victimes, et d’autres pays alliés étaient, selon toute vraisemblance, informés de ce qui allait se passer. Le fait que Washington n’ait jamais accusé les Russes du sabotage, alors qu’il s’agissait de l’hypothèse la plus vraisemblable et que la Pologne, comme beaucoup d’autres pays, dénonçait Moscou, renforce cette thèse.

"Une de mes sources m'a dit que le pays qui avait le plus intérêt à détruire ce gazoduc, c'est l'Ukraine, confie le journaliste américain Shane Harris . L'Ukraine avait un intérêt à détruire une infrastructure qui était utile à la Russie." Ce que confirme Thierry Bros, professeur à Sciences Po Paris et spécialiste de la géopolitique du gaz. Selon lui, "la Russie avait une position extraordinaire avec ses gazoducs. Elle inondait le marché européen du gaz et en fixait les prix. Sans ces tuyaux, elle n'a plus la capacité de le faire" . Le sabotage de Nord Stream ne serait donc qu’une des multiples formes prises par la guerre en Ukraine. Un prolongement de sa résistance sur un autre territoire. Une façon aussi de dire aux Européens, et aux Allemands en particulier, qu’ils devaient cesser d’être dépendants des Russes pour leur approvisionnement en énergie. Afin d’être plus libres de soutenir un pays qui, et en dépit de sa possible implication dans le sabotage, demeure une victime dans la guerre que lui mène la Russie.

Bibliographie : Le Piège Nord Stream , Marion Van Renterghem (Ed. Les Arènes), 2023.

Alerter la cellule investigation de Radio France :

Pour transmettre une information à la cellule investigation de Radio France de manière anonyme et sécurisée, vous pouvez cliquer sur alerter.radiofrance.fr

Partager : l'article sur les réseaux sociaux

L’actu à 18h30

Tous les soirs, recevez l'essentiel de l'actualité

Découvrez nos newsletters

les mots-clés associés à cet article

• Enquêtes franceinfo
• Etats Unis d'Amérique
• Guerre en Ukraine
• Faits-divers
• Les choix de la rédaction

Commentaires

Connectez-vous à votre compte franceinfo pour participer à la conversation.

Toute l’actu en direct et en continu, où et quand vous voulez.

• Sauvegardez vos articles à lire plus tard
• Recevez les alertes uniquement sur ce qui vous intéresse

Tout France Info, et bien plus. Sauvegardez vos articles à lire plus tard et filtrer l’actualité qui vous intéresse