Nord Stream: What We Know

In recent days, the BBC article above, and various other reporting outlets, have presented a new narrative around who was behind the Nord Stream incidents. The latest narrative suggests pro-Ukrainian operatives were involved. Unfortunately, there is a lack of actionable information outside of speculation at this time to really assess with confidence. Roke have analysed the existing facts in order to explore this new hypothesis for further investigation.

Starting at the beginning, analysis of Sentinel-1 Synthetic Aperture Radar (SAR) data back in September highlighted the exact locations of the leaks in the Baltic, as seen below. It is then important to understand the timeline of events.

The baseline understanding of the Nord Stream incidents and the timeline of events allows for further analysis in to the latest narrative around this being a pro-Ukrainian group strike. Reporting from German investigative authorities suggests that this was an attack conducted by a team of 6 people, including divers, diving assistants and a doctor. They also claim that the boat was a yacht of Polish origin launched from Rostock on the 6th September, 2022. The boat was said to be located in Wieck (Darß) and later on the Danish island of Christiansø, north-east of Bornholm after this date, prior to the explosion.

This article provides a completely new narrative. The main point of interest here is that the Russian narrative up to this point has not suggested a Ukrainian involvement and focused around the United States. Roke analysed available data back in September regarding previous web searches on topics related to the Nord Stream incidents. On the the 28th September at 01:00 UTC, Rokeuncovered a significant uptick in searches related to search terms critical of the United States and its potential involvement in the Nord Stream Incidents. Of note, is that the search trends do not extend to wider Anti -NATO rhetoric, as search trends from the same time period showcase much higher search traffic for Russian involvement than NATO involvement. According to Google analytics, the countries of origin where these searches occurred the most were France, Germany, United States and the United Kingdom. There was reportedly very little Russian search traffic associated to any of the search terms, most likely because Google is not the most prevalent search engine. Analysis of Pro-Russian Telegram channels (translated to English) identified numerous statements claiming that the leaks had been caused by the United States. Further accounts claimed that there was a concerted effort to try and blame Russia for the incident, whilst highlighting future economic turmoil in Germany as a result of sanctions placed on Russia.

Full spectrum analysis was conducted using Automated Identification Systems (AIS) and Radio Frequency (RF) data of any vessels of interest located close to the area of incident in this timeframe.

Roke ran pattern of life analysis, including emphasis on any connection to Russian port calls as well as unusual AIS activity such as AIS gaps or manipulated positions for all vessel flag states. Back in September, Roke highlighted the Greek flagged Minerva Julie (IMO 9380831) as being present in the Baltic Sea close to the time of incident. Further analysis of the ship’s AIS activity identified a period from the 5th-13th September where the Minerva Julie conducted slow back and forth transits directly over the Nord Stream pipelines in vicinity of the leak locations. After this period of slow back and forth transits, the MINERVA JULIE headed east towards the port of Saint Petersburg, arriving alongside on the 18th September at approximately 03:12 UTC.

To identify if this activity was consistent with the MINERVA JULIE’s pattern of life, the vessels history was examined. Since February 2022 the vessel has proceeded alongside Russian ports a number of times. However, this was the first instance of the vessel proceeding alongside in St Petersburg throughout this time period. Additionally, this was the first instance where any loitering activity was observed within the Baltic Sea.

The Minerva Julie is a Greek flagged tanker owned and operated by Minerva Maritime, a company based out of Athens. Minerva ships upwards of 30% of Russia’s overseas oil trade. It is owned by the Martinos family, a member of which manages Mount Athos, a holy site for the Russian Orthodox Church. A number of significant individuals including Dmitry Medvedev and Putin himself have all visited there. Whilst this isn't evidence in itself at this stage, the company has been heavily implicated with the transit of Russian cargo and it is highly likely that the company and any subsidiary companies have close links with Russia. The Minerva Julie's track can be seen in green below and it is immediately apparent that the loiter period is directly over the site location for the leaks.

After this period of slow back and forth transits, the Minerva Julie headed east towards the port of Saint Petersburg, arriving alongside on the 18 September 2022 at approximately 03:12 UTC. The main point of interest to highlight here is the comparison with the latest narrative in the media. The investigative authorities believe the yacht in question sailed on 6th September, 2022 which would be a day after the Minerva Julie arrived in the area. This raises questions around how this operation was performed in close proximity to where the Minerva Julie was loitering, a vessel that we know is heavily linked to Russia, and was conducted without any significant warning signs to the Russian state.

Whilst these are all questions that cannot be answered without further corroborating evidence at this stage, it cannot be discounted that there is a realistic possibility that this could have been a false flag operation aimed to blame and discredit Ukraine - a tactic used before by Russia to justify their full invasion of Ukraine in Feb 2022. The other interesting part of this timeline is that the previously mentioned visit of the yacht to Christiansø is said to have happened some time between 16th and 18th September, 2022, just after the Minerva Julie departed the area for Saint Petersburg, arriving alongside on the 18th September at approximately 03:12 UTC.  

Additional analysis was conducted into all vessels in the vicinity of the incidents. In order to explore the latest media narrative, the following vessels that are all Polish yachts were identified as having AIS gaps in proximity to the Nord Stream incident locations, these gaps were all within the 5 nautical mile buffer zones of the incidents. The names of the vessels have been redacted at this time to respect the sensitivity of the ongoing investigation.

The latest narrative in the mainstream media presents a lack of actionable information outside of speculation at this time to really assess with confidence. In addition to this, source confidence has to be questioned until further information is presented. Many outlets have cited anonymous US intelligence officials with no further clarification. The biggest remaining questions are why the Russians have not suggested any Ukrainian involvement up to this point and the motive behind releasing this information now? Would a non state actor have the capability to conduct such a complicated operation undetected?

Moscow have questioned how the US could make assumptions without an investigation and the Russian narrative from the Kremlin actually suggests that this is a "co-ordinated fake news media campaign" and that those who attacked the pipeline "clearly... want to divert attention."

Roke conducted this short report to explore this new hypothesis and revisit the facts already established. What has become apparent is that there are still a number of unanswered questions required to assess with confidence whether or not this new narrative is reliable. Some findings have opened up the possibility, but a great deal of further investigation and corroboration is needed.