Nord Stream Pipeline Attack: Who Blew up Nord Stream?

Lesen Sie diesen Text auf Deutsch

German
investigators would really like to talk to the Ukrainian man living in a
single-family home in the northwest of Kyiv. His name is Rustem A., a
41-year-old businessman who owns several companies, including a pig farm and a
heat pump manufacturer. Specifically, the Germans want to ask Rustem A. about
an attack that shocked the world one year ago. On September 26, 2022,
perpetrators blew up the Nord Stream 1 and 2 natural gas pipelines running
along the floor of the Baltic Sea. The authorities in Germany think Rustem A.
might be able to tell them a few things about the attack.

Ukraine is at
war, which means that for German officials, investigations in the country are
out of the question. Journalists, however, have no such constraints. The path
to Rustem A. leads past the Kyiv TV Tower and through a park to a housing
estate. It is guarded by a security service, and the entrance is located behind
a metal gate standing two-and-a-half meters high. When reporters from DIE
ZEIT and from German public broadcaster ARD appear at the gate and inquire
about Rustem A., a security woman refuses to let them pass. So, an attempt is
made to reach him on his mobile phone.

A man with a
deep voice answers, speaking Ukrainian. “Why should I speak to you?” he asks
imperiously, before then offering to agree to an interview for $5,000. When the
reporters ask about Nord Stream, though, he abruptly changes his tone: “Do you
know prostitutes?” Rusten A. snarls. “When I think of journalists, I think of
prostitutes, you understand? And I don’t meet with prostitutes.” He then brings
the conversation to an end.

Twenty minutes
later, a black BMW pulls up in front of the metal gate. The window slowly
lowers. Rustem A., a pale man with short-cropped hair and prominent cheekbones,
is sitting at the wheel. He stares at the reporters and curses, this time in
Russian: “Are you kidding me?” The car then disappears through the gate.

It still isn’t
completely certain what this man may have had to do with the attack. What is
clear, however, is that the sailboat the perpetrators appear to have used to
bring the explosives to the Baltic Sea crime scenes was paid for through a
company ascribed to him. Also clear are the stakes: The attack on the Nord Stream pipelines is more than just a case of criminal sabotage. In Western
capitals, the search for the perpetrators is considered to be both highly
sensitive and extremely political. Both the Chancellery in Berlin and the White
House in Washington are closely monitoring developments, new findings are
guarded as state secrets, silence has been imposed on insiders and a task force
in the Chancellery has even been set up to investigate possible media leaks in
the case. Investigations are currently underway in several countries at the
same time, but nowhere have they progressed as far as they have in Germany,
where the chief federal public prosecutor has taken charge of the case.

The dearth of
information shared with the public, however, has triggered rampant speculation
in some quarters. In the heated atmosphere surrounding the war, the Nord Stream
case has become an obsession for a surprising number of people. It’s like John
F. Kennedy’s assassination or the attack on the World Trade Center: In numerous
internet forums, amateur detectives discuss their conjectures about who is really
behind the attacks. No theory seems too far-fetched and articles with
conspiracy narratives are shared hundreds of thousands of times. Forensic
details are discussed with all their possible ramifications. The case has
become a question of faith.

The Russians
did it, believe many ardent Ukraine supporters.

The Americans
did it, believes the award-winning U.S. journalist Seymour Hersh.

Does the real
trail not lead to Kyiv after all? Is the Ukrainian Rustem A. a strawman acting
on behalf of another country, or the victim of an operation to frame him for
something he had nothing to do with?

Or were the
Ukrainians behind it after all? DIE ZEIT and the German public
broadcasters RBB and SWR first reported evidence of possible Ukrainian
involvement in March 2023.

Three nations,
three possible suspects, three potential scenarios. Depending on which of them
ultimately prevails, the discussion about the war could shift significantly.
So, who blew up Nord Stream? What role did businessman Rustem A. play? And what
about the other men, whose possible involvement in the crime has first been
revealed in this joint report compiled by DIE ZEIT, ARD the Süddeutsche
Zeitung, Expressen, NOS/Nieuwsuur, Intelligence Online, FrontStory and
Delfi?

A Group of Sailors

It’s summer
2022, the heart of the peak sailing season, with yachts sailing from port to
port all across the Baltic Sea, when an email arrives at Mola Yachting on
Germany’s Rügen island. Mola Yachting rents out vessels in several different
harbors, and the email includes a request for a 15-meter sailing yacht to be
used for a cruise. The request comes from a Google account registered in the
United States, though a check of its digital imprint will later reveal that it
was in fact sent from a computer in Ukraine.

Renting a
sailboat is not much different than renting a car: You need proof of identity
and a license for piloting pleasure craft. Attached to the email received by
Mola Yachting is information on two of the sailors who intend to charter the
boat. Accordingly, the skipper’s name is “Mihail Popov,” a Bulgarian according
to his identity document. A Romanian passport is issued in the name of “Stefan
Marcu.” The documents are both counterfeits.

Mola Yachting
reserves a Bavaria Cruiser 50, a sailing vessel that can sleep up to 10, has
two refrigerators and an oven, and is moored in the Hohe Düne marina in
Rostock’s Warnemünde district. The interior is simple – dark gray seat
cushions, wood paneling, a navigation table. The ship is tied up in one of the
rear berths on Pier G.

The Plan

.zg-autoplay-video.zg-visual-article__fullwidth-forced video { max-height: none !important;
} @media screen and (min-width: 48em) {
.zg-autoplay-video.zg-visual-article__fullwidth-forced { max-width: none !important;
}
}

According to
the company’s schedule, it will be the yacht’s last charter of the year. At the
end of September, the weather on the Baltic Sea turns rough and unpleasant.
Witnesses will later recall a white van driving up in the harbor and seeing men
unloading equipment from the vehicle and hauling it on board the boat.

On September 7,
2022, sometime before 2 p.m., images from a webcam show the yacht leaving the
harbor and heading out to sea. The vessel’s name: Andromeda.

The First Warning

When did the
idea arise of sabotaging Nord Stream and, thus, intervening in global politics?
Three months before the Andromeda sailed out into the Baltic Sea, in the
second week of June 2022, a Dutch military intelligence officer wrote a report
on the basis of intelligence provided by an informant. The report stated that a
military commando of six people intended to blow up Nord Stream 1, the older of
the two pipelines through which cheap natural gas from Russia began flowing
directly to Germany in 2011. The second pipeline, Nord Stream 2, had only been
completed for nine months at that point. But because of Russian President
Vladimir Putin’s invasion of Ukraine, the pipeline never went into operation.

The classified
report also included details of the act of sabotage allegedly being planned.
The men were apparently planning to set out from a port in Sweden, disguising
themselves as scuba divers supposedly headed to a shipwreck lying at the bottom
of the Baltic Sea near Nord Stream 1. They would use a diving vessel and have
an additional rubber boat with them. In addition to standard diving equipment,
they would also be carrying a compressor and helium, a gas that divers mix in
at depths of 40 meters or more. The report claimed the attack would take place
just a few days hence, on June 19, 2022, immediately following a major NATO
exercise in the Baltic Sea called “Baltic Operations.” According to that
timeline, part of the commando would already have had to have been underway,
even as the report was being written. And it would have entailed the involvement of an “unspecific unit of the Ukrainian army.”

Ukrainian
President Volodymyr Selensky knows nothing of the plan, the man who tipped off
the Dutch claimed. But the source did provide the name of the man to whom the
soldiers were supposedly reporting: Valeriy Zaluzhny, a detail first reported
by the Washington Post. Zaluzhny is the commander-in-chief of Ukraine’s
armed forces and a number of successes in turning back the Russian invaders
have been attributed to his strategy. Time magazine last year included
him in its list of the world’s 100 most influential people.

When assessing
the informant’s claims, the Dutch did not exclude the possibility of a “rogue
unit,” a wing of the Ukrainian army potentially acting on its own authority.
However, if Ukraine’s top soldier actually did give the order to destroy Nord
Stream 1, it would likely be a case of state-sponsored terrorism.

It’s not hard
to identify possible motives. There are few things that represent the failure
of Germany’s Russia policy better than these two pipelines. Huge amounts of
Russian natural gas used to flow west through Ukraine, and the government in
Kyiv collected billions in transit fees. For Ukraine and other Eastern European
countries that have long felt threatened by Russia’s power politics, Nord Stream must seem like an underhanded deal made by the Germans with Putin. In
the early summer of 2022, the German government scrambled frantically to line
up expensive replacements for the sudden lack of Russian gas. Who knows,
perhaps Berlin would ultimately be tempted to approach Putin after all, and to
force Ukraine to negotiate – and to then put Nord Stream back into operation?
Why not break this bond that still ties Russia and Germany?

As the
informant’s warning makes the rounds at Dutch military intelligence, officials
are so alarmed that they inform the CIA. Through interviews with sources from
several European countries and the U.S., it is possible to reconstruct what
then took place. The research has been supplemented by the “Pentagon Leaks,”
secret CIA and U.S. Army documents that a U.S. soldier, who has since been
arrested, posted in a chat room on the internet, including an American summary
of the report from the Netherlands, elements of which DIE ZEIT has been
able to examine.

The CIA
initially has doubts about the credibility of the source. The agency speaks of
a possible sabotage operation that might be “executed by either Russian or
Ukrainian actors.” Nonetheless, a decision is made to warn the Ukrainians – or,
perhaps more accurately, to stop them. Immediately. The CIA’s station chief in
Kyiv meets with either Zaluzhny, the Ukrainian commander-in-chief, or with one
of his closest associates, it’s not entirely clear which. According to
Washington, the Ukrainians dismiss the suspicions. Then, on June 19, the
predicted day of the attack, nothing happens on the seafloor. Because the
information from the Dutch was wrong? Or because the Ukrainians called off the
attack?

Officials in
Berlin are also among those who receive word of the suspicions against Ukraine.
Both the CIA and Dutch military intelligence share their reports with Germany’s
foreign intelligence service, the BND, and the Federal Office for the
Protection of the Constitution, the country’s domestic intelligence agency, in
June. German intelligence officials, however, do not consider the warning to be
particularly credible.

The upshot is
that in early September, no one has a seemingly normal white sailboat in their
sights as it makes its way northeast from Rostock, Germany, using motor power.

The Journey

With its
picturesque harbor, the small town of Wiek is a popular stopover for
recreational sailors preparing to make the crossing from Germany’s Rügen island
to Denmark or Sweden. One harbor employee, as he would later recount, notices a
yacht from Germany moored behind the harbor office, though strictly speaking,
it’s the crew that catches his eyes. He sees them carrying numerous shopping
bags almost 100 meters across the parking lot from a vehicle, without driving
it up to the boat. It seems strange to the harbor employee, as does
the composition of the group. It’s not made up of families, couples or
exclusively men, as is normally the case. Instead, it includes five men and a
woman. Six people. The same number mentioned in the classified report from the
Netherlands.

On the night of
September 8, a car is photographed by a speed trap on Rügen. It has a Ukrainian
license plate.

Apparently, the
crew of the Andromeda loaded large quantities of provisions onto the
boat in Wiek, as if preparing for an extended trip. Over the next several days,
the vessel sails in close vicinity to the pipelines. It apparently makes a stop
on the Danish island of Bornholm. And a Polish sailor on a stopover there
claims to have seen the Andromeda on September 12 on the tiny, nearby
island of Christiansø. He told the team of journalists that they were speaking
Ukrainian.

At the end of
the second week of September, heavy weather engulfs the Baltic Sea, with winds
of up to 20 knots and two-meter swells. The yacht is hunkered down in Sandhamn,
a rather inhospitable harbor at the southeastern edge of Sweden, with a parking
lot for campers and three long concrete piers jutting into the water.

An Encounter in Sweden

On the evening
of September 13, a 60-year-old amateur sailor from Bremen ties up there just
behind a yacht from Germany, apparently the Andromeda. His name is
Thorsten Bruns, and he had actually been planning a trip with companions to a
Swedish island group, as he would tell DIE ZEIT one year later. But the
weather put a halt to the trip. “We got beat up by the sea,” Burns says. Which
is why he is now in Sandhamn, seeking shelter. He is preparing dinner on his
yacht when another boat pulls into the harbor, piloted by a sailor who is
traveling solo. Mooring maneuvers are among the most delicate situations in
sailing, so sailors have a rule: You always help single sailors. But
according to Bruns’ account, the crew of the Andromeda didn’t even
notice. He says he was outraged and spoke to the crew in English from the pier.
Why didn’t they help?

Like the harbor
employee on Rügen, Bruns remembers six people, “five men and one woman.” He
says the woman was petite, with brunette hair. The two men he approached, he
says, had “military-style haircuts” and appeared to be quite fit. Bruns guessed
they were around 40 years old. He says one of the men translated the question
into an Eastern European language for the others. Then, he says, they stared
back at him in silence.

There are other
witnesses who also noticed the strange behavior of the crew in Sandhamn. One
says he saw a man, the boat’s skipper, who was rather heavy-set, like someone “who has eaten too many hamburgers.” He says he made a sullen and unfriendly
impression. This witness also remembers one or two other men, between 35 and
45, slim and in good shape. He says they rode the harbor’s shared bikes across
the pier and that they smoked.

Habor logs show
that on September 13, a boat took on 193 liters of diesel, around the amount of
fuel a yacht like the Andromeda would have consumed if it had traveled
to Sandhamn from Rügen via Bornholm and Christiansø using its motor. The
sailors paid around 500 euros for the fuel – in cash, anonymously. That
afternoon, the Andromeda headed back out to sea. Sandhamn is a good
springboard for sailing to the gas pipelines. The site of the main attack is
located around 60 kilometers from the Swedish town. And, an oil tanker named
the Minerva Julie departed on September 13.

The
Greek-flagged tanker had been cruising back and forth near the attack sites
east of Bornholm for well over a week – waiting for instructions, the shipping
company would later say. Now, it was gone – as could easily be seen by visitors
to one of the many sites in existence that document ship movements in real
time.

The weather
improved in the days that followed and the Baltic swells had calmed down.
Acceptable conditions if you are interested in diving 80 meters (260 feet) to
the bottom of the Baltic Sea to place explosives there.

Destruction

The first
explosive device detonates shortly after 2 a.m. on September 26, 22 kilometers
southeast of Bornholm. Seismologists initially register only a slight tremor,
and the explosion itself remains undetected for several hours. The company
operating the pipeline also notices nothing initially – until a measuring
station in Kassel, which monitors pipeline pressure, sounds the alarm. That
morning, a Danish Navy aircraft flies along the route of the gas pipeline. From
the air, the pilots discover a spot where a large amount of methane is rising
to the surface.

Each of the two
pipelines is made up of two pipes. The nighttime explosion destroyed one of
Nord Stream 2’s pipes, ripping a 10-meter-long gash into the sidewall.

Following the
initial detonation, September 26 unfolds much like any other normal day at sea.
Until evening, that is. At just after 7 p.m., another explosion jolts the
waters some 80 kilometers south of the first explosion. It is followed seven
seconds later by the next detonation. Then, eight seconds later, a third blast
strikes the same location.

Sailors on a
German freighter steaming its way through the Baltic Sea some 13 kilometers
away have front-row seats to the events unfolding nearby. The captain, alerted
to the detonations that evening by the alarmed officer on watch, would recall
that the sea seemed as if “a dense cloud lay over the surface of the water.” A
photo taken from the freighter’s bridge shows a bubbling, seething Baltic Sea
on the horizon. It’s only thanks to luck that no one died that day. If, by
chance, a ship had been gliding through the water directly above the methane
bubble, it would have sunk like a stone due to the lack of buoyancy, just as
happens to a research vessel in the film adaptation of Frank Schätzing’s novel “The Swarm,” after methane escapes from the seafloor.

The three, or
perhaps it was four, detonations on the evening of September 26 leave behind a
trail of destruction. One of Nord Stream 1’s pipes is ripped open over a length
of more than 200 meters. Video footage shot by Swedish engineer Erik Andersson
using an underwater drone shows the crater left behind by the detonation – 10
meters deep and several meters wide – along with the tangled remains of the
pipe jutting vertically from the sea floor. The other Nord Stream 1 pipe is
also heavily damaged. And a few hundred meters away, there is further damage to
a Nord Stream 2 pipe. There, the perpetrators appear to have placed the
explosive charge with clinical precision right on a seam between two pipe
sections. The resulting hole is only about one and a half meters wide, with the
rest of the pipe largely intact – likely because the pipeline was no longer
under high pressure.

Based on the
damage underwater in combination with the seismic tremors, it is possible to
estimate the amount of HMX explosive likely used. Also known as octogen, it is
highly explosive, can be detonated underwater and is used primarily for
military purposes. According to the estimate, each explosive device likely
weighed less than 50 kilograms.

The damage is
almost impossible to repair. Regardless how the political situation develops,
one thing is certain: Natural gas will not be flowing through Nord Stream
pipelines for a very long time to come. Which is in Ukraine’s interest. Or
perhaps Russia’s? Might Putin have had the pipelines destroyed because he
wanted the West to hold Ukraine responsible – and withdraw support as
punishment? Many of those promoting such a theory on the internet point to one
possible clue: the Minerva Julie, the Greek-flagged tanker that had been
sailing near the attack sites ahead of the detonations. The vessel later set
course for St. Petersburg. Was it bringing a Russian diving team back home?

Or, to cite a
second lead potentially pointing to Russia, were the perpetrators elite Russian
soldiers aboard a military convoy operating in the region in late September?
The convoy of three warships included one that was equipped with a mini
submarine.

Accusations Against the USA and Russia

.zg-autoplay-video.zg-visual-article__fullwidth-forced video { max-height: none !important;
} @media screen and (min-width: 48em) {
.zg-autoplay-video.zg-visual-article__fullwidth-forced { max-width: none !important;
}
}

Even if Russia
was initially considered the prime suspect internationally, and even if Polish
Prime Minister Mateusz Morawiecki spoke the day after the attack as if it was a
proven fact that Putin had personally approved the plan, and even if NATO – in
remarks obviously directed at Moscow – threatened the attackers with a “united
and determined response”: Investigators today largely discount the possibility
that the Minerva Julie or the three Russian warships were involved in
the attack. Among other inconsistencies, the physical distance to the crime
scenes doesn’t match up with the convoy’s coordinates. We are “following up on
the leads, but we so far have no tangible or other evidence confirming them,”
Deputy Federal Public Prosecutor Lars Otte told the Bundestag’s Internal
Affairs Committee this June.

And the U.S.?
Didn’t Washington repeatedly criticize its ally Germany for making itself
dependent on Vladimir Putin with the Nord Stream pipelines? And didn’t
President Joe Biden say something just before the Russian invasion that, from
today’s perspective, sounds like a pre-emptive admission of guilt?

He uttered the
sentence at a press conference on February 7, 2022, after a conversation with
German Chancellor Olaf Scholz. “If Russia invades” Ukraine, Biden said, “then
there will be no longer a Nord Stream 2. We will bring an end to it.”

When asked by a
reporter how he planned to do that, Biden answered ambiguously: “I promise you,
we will be able to do it.” Was the American president announcing an act of
sabotage in front of the whole world?

Journalist
Seymour Hersh has accused him of precisely that. Hersh, 86, is a legend in the
journalism world, having exposed the My Lai massacre during the Vietnam War and
the orgies of U.S. Army torture at Abu Ghraib in Iraq. He’s bitingly critical
of the government and extremely suspicious. In February, he published a blog
post that made headlines around the world. He claimed that U.S. Navy divers had
placed the bombs as early as June 2022 during NATO’s “Baltic Operations”
exercise and that they had operated from a Norwegian warship. A sonar buoy
dropped by a Norwegian aircraft then detonated the explosives three months
later, he asserted. Hersh wrote that his reporting was based on a single
source, but that the source had “direct knowledge.”

Hersh is no
longer speaking publicly about his suspicions today. A few weeks after
publication of the blog post, though, he could be found sitting on the porch of
his home in Washington, in a neighborhood with beautiful front yards and
expensive restaurants that is home to diplomats, government officials and
journalists – the kind of people for whom Hersh now has nothing but contempt.
The U.S. government? Warmongers. Journalists? Sycophants or naive. Or both.

Hersh has been
shown the door by media instituations like the New York Times for his
worldview and also his controversial reporting. On this day in March 2023, it
seemed as though he was concerned merely with settling old scores. He didn’t
know much about what investigators had found at the crime scenes in the Baltic
Sea. Hersh took out his notepad and began asking the visitor from DIE ZEIT
questions.

And what about
Hersh’s single source? And the foundational rule of journalism to have at least
two sources for the version of an event that you, as the reporter, are seeking
to present? Hersh said he had known this person for a very long time and that
when you have such a history with each other, you also have to trust one
another, even on big stories.

Hersh believes
that Joe Biden and Olaf Scholz jointly invented the trail of clues leading to
the Andromeda. He believes the aim of the German investigation is merely
to distract from his own revelations. Nor is Hersh deterred by the fact that
investigators stumbled across the Andromeda long before his blog post –
or that some details, such as his information on ship and aircraft types as
well as the explosives used, don’t match up.

“An Attack on Domestic Security”

In early
October 2022, a new development emerges in the Netherlands. It appears that
military intelligence officials there have reinterviewed the informant on whose
information the initial June warning was based. The second report focuses on
the group that may have blown up Nord Stream a few days earlier and claims that
it apparently included six soldiers, “Ukrainian SOF personnel,” the
abbreviation for Special Operations Forces. In other words, a Ukrainian special
unit. The report also notes that the group had rented the boat for the attack
in Germany – in Rostock. German security staff pass the report on to government
officials, and it finds its way all the way up to the Chancellery. In other
words, by this point, at the latest, the German government is aware that the
intelligence agency of an allied country has indications that Ukraine may have
been responsible.

Did the same
crew mentioned in the first report in June initially keep their heads down
after the CIA warning, only to then strike three months later, after all? Or
was this an entirely new operation? It is a question that the Dutch can’t
answer either.

On October 10, the
federal public prosecutor general takes over the case in Germany. Among the
potential charges being investigated: “anti-constitutional sabotage.” A judge
at the German Federal Court describes the bombings as “an attack on the
internal security of the state.” It hardly gets any more serious than that. The
Federal Police and the Federal Office of Criminal Investigation (BKA) are
entrusted with the investigation.

Initially,
investigators set out in Rostock and the surrounding area to find a specialized
ship with a compression chamber for divers, due to the risks of diving to a
depth of 80 meters. But such vessels are only rented with the permanent crew
that comes along with them. In retrospect, it’s difficult to know for certain
who came up with the idea of focusing on sailing yachts – several officials
claim that they were responsible. Either way, things begin moving quickly.

Who Was on the Andromeda?

In January
2023, investigators search the Andromeda, which had been placed on a
boat cradle in winter storage on the island of Rügen. It hadn’t been cleaned
following its return. The officers find a plastic water bottle and also a “barefoot shoe,” apparently forgotten in a corner, plus DNA material. They were
also able to secure traces of HMX, the explosive found at the attack sites, on
the table in the cabin and also, according to the newsmagazine Der Spiegel,
in the toilet. Whoever returned the Andromeda was either very sloppy or
in a big rush. Or perhaps interested in laying a false trail?

One of the most
important arguments cited by those who believe Ukraine to be innocent is that
it wouldn’t be possible to commit such an act of sabotage using a 15-meter
yacht. A boat without any decompression chamber and no diving platform. But is
that really true? Peter Frank, Germany’s federal public prosecutor general,
himself an amateur diver, assumes that the perpetrators are professionals,
military or industrial divers trained for missions at extreme depths. Frank
told the Bundestag’s Committee on Legal Affairs that they likely lowered their
equipment, possibly including the explosive devices, into the water on ropes or
chains. And his deputy, Otte, said during his appearance before the Internal
Affairs Committee this summer that they had often been asked whether such an
attack would not require a “much, much bigger device, a bigger ship, submarine
and whatever else was mentioned.” He said his office had commissioned an expert
opinion on the subject. “The expert’s assessment is that: Yes, it would be possible
even with a yacht like the one in question here.

In other words,
the Andromeda would fit the bill. But who was on board?

The Search

An initial clue
comes from the original email sent to reserve the Andromeda.
Investigators’ inquiries reveal that it apparently originated from a Ukrainian
man around 30 years old, Maxim B. (name changed by the editors). The man seems
to be firmly on the side of his homeland. Nine years ago, shortly after the
bogus referendum to justify Russia’s annexation of the Crimea Peninsula, he
wrote on Twitter that he was speaking Ukrainian that day – he had previously
posted in Russian. He described a meeting between Putin and the pope as “Satan’s
family Reunion.”

Investigators
don’t believe that Maxim B. was on the Andromeda. He works back in
Ukraine as a kind of manager for ship crews. Was it in this role that he
initiated contact with the charter company Mola Yachting?

When DIE
ZEIT called Maxim B.’s mobile phone number, it was answered by a man who
spoke good English, but who ended the call quickly, claiming the reception was
poor. A few hours later, in a chat on a Messenger app, he patiently responded
to questions and asked a few of his own: What kind of ship exactly? Which email
address was used? He wrote that he doesn’t recall ever having reserved a yacht
like the Andromeda. “This is very surreal for me,” he wrote. His
company, he said, doesn’t operate in Germany, nor does its work involve
sailboats. Maxim B. claimed that he only heard about the attack on the Nord
Stream pipelines through media reports, adding that he didn’t know who was
behind it. Perhaps he is telling the truth. Perhaps not.

The company in
question is also the holder of the account from which the charter fee was paid.
It’s called Feeria Lwowa, a Ukrainian name that means: “Magic of Lviv”. The
firm is registered in Warsaw and claims to be a travel agency, but it’s not
actually possible to book a vacation through the company, and the photos
allegedly showing happy customers were apparently copied from the internet. The
website has since been taken down. Feeria Lwowa, it would seem, is a classic
letterbox company.

According to
the Polish commercial registry, the proprietor of Feeria Lwowa is a woman with
an address in Crimea who has both a Ukrainian and a Russian passport; though as
part of Putin’s annexation of Crimea, all residents were issued a Russian
passport, whether they wanted one or not. And the passport in question was, in
fact, issued shortly after the annexation.

Photos on
social media show the woman during a visit to Russia earlier this year,
indicating that she does have at least some kind of connection to Russia. Over
the phone, she insisted to the reporting team that she didn’t even know that
Feeria Lwowa belongs to her.

The registry
also shows a different Ukrainian woman as being the company’s head. She
confirmed as much over the phone and asked that questions be sent by email. But
she never responded – perhaps because the decisive figure behind the purported
travel agency is someone else entirely: Rustem A., the businessman from Kyiv,
who left reporters from DIE ZEIT and ARD standing in front of the metal
gate in front of his home.

The collection
of Rustem A.’s companies has stretched from Ukraine to London to Cyprus in
recent years. Some of them are real, such as the pig farm and the heat pump
producer. Other companies, though, have no internet presence, and it is
impossible to find out anything about them – no address, no customer reviews.
Their purpose remains unclear.

In fall 2022,
Ukrainian authorities searched a locker belonging to Rustem A. as part of a
different investigation. Inside, they found 192,325 euros and $126,682 along
with the stamps of three companies connected to Rustem A. – one of them from
Feeria Lwowa. In Polish commercial registry documents, Rustem A. is also listed
as the person who files the company’s financial reports to the authorities.

Both he and his
lawyer declined to answer the question as to why one of his companies would
have paid for the chartering of the Andromeda. But people close to him
say that Rustem A. paid for the yacht on behalf of a third party. If that is
true, it would make him an accessory to the commando responsible for the
attack, but not the mission’s chief planner.

In a further
telephone call with Rustem A., he said nothing and ended the conversation
quickly. And just as it seemed there was nothing left to say, he called back. “Where are you?” he screamed into the phone. “Where are you right now, you
animal? Tell me where you are!” And he then threatened: “If you call the police, I
will kill you on the spot!”

A Big Puzzle

Several weeks
later, in mid-September 2023, Rustem A. sent journalists a graphic out of the
blue. It showed Russian warships, several of them marked with a red X,
including a submarine that the Ukrainians had recently sunk. Rustem A. wrote
that news coverage should also include reports about successes achieved by the
Ukrainian army. Ukraine’s military achievements, it seems, are important to
him.

A Check in Poland

On September
19, 2022, one week before the explosives detonate, the Andromeda sails
into the Port of Kołobrzeg, a Polish city located not too far from the German
border. The harbormaster recalls a crew member coming into his office to pay
for a berth for the night. He says he was a bit surprised by the fact that,
even though the man had arrived on a German vessel, he spoke with an “eastern
accent”. So either Russian or Ukrainian inflection. He says he then informed
Polish border protection officials.

And Polish
officials, as they would later say, do, in fact, check the crew out and note
down the names of several men, all allegedly Bulgarian. They also record the
name of the skipper, “Mihail Popov.” At this moment, the border officials are
closer to the suspected perpetrators than any investigators have come, before
or since.

Which makes it
all the stranger how eager Polish officials and politicians have been to dispel
any suspicions focused on the Andromeda. “We have no doubts that there
was no explosive material on this boat, on this yacht,” Stanisław Żaryn,
secretary of state at the Chancellery of the Prime Minister in Warsaw, told ARD
in an interview. As far as he knows the voyage had a “purely touristic character,”
Żaryn claimed. “There was nobody in the group who had anything close to
military or sabotage-related training.”

How would he be
in a position to know? Do Polish investigators have more information about the
commando than they have said? Did the inspection in Kołobrzeg actually turn
something up? Poland was among the countries most vehemently opposed to Nord Stream. Might the financial support for the attack have been routed through a
letterbox company in Warsaw because the planners were certain that the Polish
authorities would seek to cover up such an act?

The keys to
clearing up who was behind the attack could very well lie in Poland. Allegedly,
there is even video footage of the crew in existence. But how reliable is
evidence provided by Poland given all the attempts at diversion? An
investigation request filed by German police in the spring in an attempt to
secure evidence, in any case, was ignored by the Polish authorities for several
months.

It all amounts
to myriad questions, narrative gaps and difficulties. And yet the individual
pieces of the great Nord Stream puzzle that investigators have managed to
collect do provide an initial, preliminary image. It is still blurry, but its
outlines can be identified.

There is Maxim B., the Ukrainian crew manager who is apparently the man behind the email
address that was used to reserve the Andromeda.

There is Rustem A., the Ukrainian businessman whose company paid the Andromeda charter
fee.

There are the
mobile phones that investigators believe the crew of the ship used. They were
tracked in Ukraine after the attack.

When it comes
to “Mihail Popov,” the skipper, investigators are certain that he was on board
the Andromeda. They have been not yet been able to determine his real name.

Valeriy
Zaluzhnyi, the commander in chief of the Ukrainian military, the same man who
denied to the CIA in June 2022 that there were any plans to attack the Nord Stream pipeline, now declines to discuss the attack on the pipeline. Nobody in
the entire Ukrainian government is interested in talking either. Requests for
comment from DIE ZEIT sent to Volodymyr Zelenskyy, Foreign Minister
Dmytro Kuleba, the director of military intelligence, the Presidential Office
and to Andriy Melnyk, the former Ukrainian ambassador to Germany – a man who
usually isn’t shy about speaking in public – all went unanswered.

And then there
is the young man whose photo made its way into the Romanian passport, a copy of
which was sent to Mola Yachting. This “Stefan Marcu” looks exactly like the man
in photos on social media, usually shown in uniform and sometimes posing with a
machine gun: Valeriy K. has an angular face and thick eyebrows. In one photo,
he is holding a baby in his arms and smiling into the camera. He is fighting on
the front lines, said Valeriy K.’s grandmother in Dnipro in eastern Ukraine,
where the family lives and where ARD reporters visited her. She said she hadn’t
heard from him for several months.

Valeriy K.
apparently served in the 93rd Mechanized Brigade, one of the toughest and most
effective units in the Ukrainian army, say experts. His former girlfriend has
found a new home with their child in a prefab concrete residential building in
the German city of Frankfurt an der Oder. When reporters rang the doorbell, a
family member said through the closed apartment door that Valeriy is innocent
and that there had been a “misunderstanding.”

In the
meantime, Valeriy K. had German officials informed via video that he had
nothing to do with the attack. Perhaps his photo had been stolen and placed in
the falsified passport. Or perhaps he’s lying.

What Now?

Truth and lies.
Perpetrators and victims. The remains of two pipelines 80 meters below the
surface of the Baltic Sea. Today, one year later, it is impossible to rule out
with complete certainty that Russia or the U.S. had something to do with the
attack, or perhaps even Poland. It is a case that could take unexpected twists
at any time – such as possible evidence of the Russians laying a false trail to
Valeriy K. in Ukraine. Or that they may have manipulated Rustem A. and others.
Or that Russians were also part of the Andromeda crew, whoever they may
have been working for. On the other hand, there would have to be quite a large
number of such twists. And there would have to be myriad false trails laid,
such as a report delivered to intelligence agents from the Netherlands several
months before the attack. Is such a perfectly executed plan really realistic?

The Trace to Ukraine

It has now been
established with almost complete certainty that the Nord Stream pipelines were attacked
from the Andromeda. “We have good reasons for believing that this yacht
was used for the crime,” Federal Public Prosecutor Lars Otte told German
parliament’s Internal Affairs Committee.

Based on what
can be surveyed at the moment, most of the clues lead not to Washington or
Moscow, but to Kyiv. Since the end of 2022, there has been a memo in the files
of Germany’s Federal Public Prosecutor General naming an “unknown special unit
of the Ukrainian army” – though officially, it is still an investigation into
unknown perpetrators. In any other case, such a situation would be unthinkable.
The Federal Public Prosecutor General is independent, but the office does take
into account the difficulties facing the federal government. And in a case
involving Ukrainian defendants, Berlin would have to take action: by summoning
the Ukrainian ambassador, expelling intelligence officials or military attachés
– or even putting diplomatic relations on ice.

But a war is
going on, and different standards apply to Ukraine than Russia and Russian
defendants. The German chancellor has remained silent on the issue, as have
members of his cabinet. But for how long can they pretend nothing has happened?
Whenever the public debate once again turns to the need for new arms deliveries
to Ukraine, the issue looms in the background. It contributes to the cautious
tone adopted by Scholz when discussing possible deliveries of Leopard tanks and
Taurus cruise missiles. Can you really provide military backing to a country
whose military may have destroyed infrastructure that supplies Germany with
natural gas? The official line in Berlin is that the government is waiting for
the final results of the investigation. Internally, though, it is considered a
certainty that Germany will continue providing arms. The aim is to disconnect
the Nord Stream case from military support for Ukraine.

In spring, when
DIE ZEIT, the ARD program “Kontraste,” the ARD
Hauptstadtstudio and public broadcaster SWR first went public with evidence
pointing to Ukrainian involvement in the attack, Jens Plötner, the chancellor’s
foreign policy adviser, called Andriy Yermak, the head of the Office of the
President of Ukraine. According to people familiar with the phone call, Plötner
told the Ukrainian that an investigation was underway in which suspicions were
pointing to Ukraine. The German government, Plötner added, is neither able nor
willing to influence the investigation. Yermak apparently answered by saying
that nobody in the Ukrainian government ordered such an attack, but they would
of course cooperate with the investigation. Thus far, that cooperation has remained
nothing more than promise.

In the
meantime, the German government has sent a precautionary message to the
Ukrainians that they should be reserved in their denials of involvement. Who
knows what German officials may yet find.

And perhaps the
plan to eliminate European dependence on Russia and its natural gas was
originally far more ambitious. Perhaps even aimed at infrastructure beyond Nord Stream.

Four days
before the explosions in the Baltic Sea, on September 22, 2022, the news agency
Bloomberg reported that Russian security officials claimed to have foiled “a
planned Ukrainian attack on infrastructure” through which Russia supplies gas
to Turkey and to Hungary and Serbia. A spokesman claimed that Russia had
defused two bombs and arrested suspects who had wanted to destroy TurkStream,
Nord Stream’s sister pipeline in southern Europe. According to the Russian
Embassy in Berlin, one of the suspects is a 28-year-old Russian who had worked
for Ukrainian security agencies. It seems as though nationality doesn’t mean
all that much in this case.

In public, the
report was largely ignored, but it likely got the attention of the CIA and the
Dutch military intelligence agency. The mysterious informant who had told the
Netherlands about the planned attack on Nord Stream had also said something
else: That the Ukrainian military was also planning to strike TurkStream, and
that “the same unit” was involved as in the Nord Stream plot.

One attack
failed, but the other did not. On September 23, three days before the
detonations, a 15-meter yacht sailed into the Höhe Düne harbor in Rostock’s
Warnemünde district. The Andromeda was returning to the place where
everything had started two-and-a-half weeks earlier.

The next
morning, Mola Yachting employees set out to complete the return formalities.
They found a few dents and scratches on the swim platform on the stern – the
place from which the divers likely entered the water. But there was no one left
to ask, the sailors didn’t even pick up the damage deposit for the charter.
Abandoned, the Andromeda was just bobbing in the harbor. The crew must have
left the vessel and disappeared under the cover of darkness.

With additional
reporting by Ingo Malcher

Translated By
Daryl Lindsey and Charles Hawley

Director of Photography: Tina Ahrens