The Race to Find the Nord Stream Saboteurs

The Nord Stream gas pipelines are colossal pieces of infrastructure. Running more than 1,200 kilometers from Russia, across the Baltic Sea to Germany, the pipes can carry up to 110 billion cubic meters of gas, enough for 26 million homes. The Nord Stream 1 pipeline alone is constructed of 202,000 huge pieces of piping. Each section is 12 meters long and contains piping that uses around 4 centimeters of steel, which is covered with 11 centimeters of concrete. The pipes are not built to break.

So when the pressure in one of the Nord Stream pipes dropped on June 26, alarm bells started ringing. Danish authorities told ships to steer clear of the pipes as methane gas was bubbling into the sea. Hours later, two more leaks were detected, one in Nord Stream 2 and a second in Nord Stream 1. Now, authorities are suspecting foul play. “We are not talking about an accident,” Mette Frederiksen, the Danish prime minister said.

Ursula von der Leyen, head of the European Commission, believes the leaks may be a result of “sabotage” and said any “deliberate disruption” of energy infrastructure will “lead to the strongest possible response.” NATO officials agree; the US has pledged its support to help Europe find out what happened. However, the incidents have raised fears about attacks on critical infrastructure and the security protections in place around systems that can provide the world’s fuel. The incident comes on top of Russia reducing its supply of gas to Europe, with large parts of the continent facing winter energy crises.

While officials have indicated the leaks may have been caused deliberately, very little evidence about the attacks has emerged so far. Military flights over the region show gas bubbling at the surface more than a kilometer wide, and Swedish seismic experts say they are convinced explosions took place after they recorded tremors equal to a magnitude 2.3 earthquake.

Fingers immediately pointed at Russia, which partly owns the pipes. Ukraine has said it is a “terrorist attack,” and German newspaper Der Spiegel reported that the CIA warned German officials about possible attacks against Baltic pipelines several weeks ago. (Right-wing commentators in the US and one Polish MP accused the US of being involved after President Joe Biden said, in February, he would “put an end” to Nord Stream 2 if Russia invaded Ukraine.)

“It’s a very classic Russian hybrid warfare approach,” says Hans Tino Hansen, the CEO of Risk Intelligence, a Denmark-based security firm that deals with maritime issues. Hansen says if Russia did attack the Nord Stream pipelines it would show they have “complete deniability.” Because Russia partly owns the Nord Stream infrastructure, it makes people question why it would be behind any attacks against it. (The Kremlin claimed suggestions it is behind the leaks are “stupid.) “They are showing that they can attack seabed energy infrastructure, with the pipelines, which then sends the signal that they can attack and destroy any energy infrastructure in Europe,” Hansen says.

Investigators across Europe, including intelligence agencies, will now be trying to piece together exactly who and what caused the apparent explosions. This is likely to involve multiple steps, such as examining what data is held about the area, including seismic data and other sensors, checking whether any communications around the incident have been intercepted, and examining the pipelines to see if there are any signs of intentional destruction.

Neither of the pipes is operational—Nord Stream 1 was paused for repairs in August and Nord Stream 2 has not officially opened after Germany pulled support for it ahead of Russia’s full-scale invasion of Ukraine in late February—but both pipes are holding gas. All three leaks happened relatively close to each other, near the Danish island of Bornholm, in the Baltic sea. The island is surrounded by Denmark to the west, Sweden to the north, and both Germany and Poland to the south. The leaks are in international waters, but also sit in both Denmark and Sweden’s exclusive economic zones. “It’s quite shallow, around 50 meters on average in this region,” says Julian Pawlak, a research associate at the Helmut Schmidt University and the German Institute for Defence and Strategic Studies.

Security sources have speculated if the attacks were deliberate, they could have been conducted by unmanned underwater drones, involve mines being dropped or planted by boats, been carried out by divers, or even from within the pipes themselves. “We still don’t know what the origin is of those explosions or where they came from—if they originated from the outside or if they originated from the inside of the pipelines,” Pawlak says. In a process called “pigging,” cleaning and inspection machines can be sent down the pipes from Russia in the direction of Germany. It’s possible pigging was repurposed to carry out an attack.

Back in 2007, before the first Nord Stream pipeline was constructed, a review of the project by the Swedish Defence Research Agency (FOI) warned about potential explosions around the pipe, in the context of terrorism. “Despite its concrete coating, a pipeline is rather vulnerable, and one diver would be enough to set an explosive device,” its report said. “However, the impact of such an assault would probably be rather modest and most likely a minor incident of this type would not result in a large explosion.”

"They [Russia] have the capability for subsea warfare, with the divers, but also with mini-submarines and drones,” Hansen says. However, confirming any responsibility isn’t necessarily straightforward. The relatively shallow depth of the area around the Nord Stream pipes means it is unlikely that any large submarines would have been operating nearby, as they would be easy to detect.

Pawlak says any vessels in the area could potentially detect others that may have caused the damage. Undersea sensors could equally spot something in the area moving, but it is unclear where any of these systems are. “It’s still not the case that all of the Baltic Sea is filled up with sensors and that NATO knows every movement,” Pawlak says. “On the surface, but especially on the seabed, it’s still not possible to know, at every time, at every place, what’s moving, what’s going on.”

However, the Nord Stream incidents draw into focus the protections that are placed around critical infrastructure. In recent years, cyberattacks have shut down the US Colonial Pipeline, cutting off fuel supplies. And ahead of Russia’s full-scale invasion of Ukraine, its military hackers used the country as a cyberwarfare testing ground, shutting down power grids with their code.

Undersea infrastructure can be particularly vulnerable to damage—either from natural causes, such as earthquakes, or physical attacks. Since the Nord Stream pipes burst on Tuesday huge volumes of gas have poured into the sea, potentially causing an “unprecedented” environmental impact. "As we—and many others—have been saying for many years, we need to address the security of energy infrastructure and also everything subsea,” Hansen says. This includes the myriad of internet cables stretching thousands of kilometers around the world and keeping billions of people online.

In January, the head of the UK’s armed forces warned that Russian submarines have been threatening subsea cables. “Russia has grown the capability to put at threat those undersea cables and potentially exploit those undersea cables,” Admiral Tony Radakin said.

Hansen says there are two starting points for protecting subsea infrastructure: first, building out ways to detect faults and issues with equipment automatically and then also making sure there is equipment, such as underwater drones, that are able to scramble to sites to inspect them when damage has happened. Those steps may already be underway, with Norway’s prime minister saying the country will up the military protection of its energy infrastructure.