A year after the attack on the Nord Stream pipelines in the Baltic Sea, it is still not clear who was behind the sabotage. Yet there are increasing indications that the attack was carried out by a Ukrainian team. Joint investigations by several European media, including NOS and Nieuwsuur, led to the identification of two people involved. According to sources close to the German criminal investigation, there is a growing conviction that the perpetrators came from Ukraine.
The joint investigation also sheds new light on the route taken by the sailing yacht from which the attack was allegedly carried out. The media also spoke to new eyewitnesses who saw the crew of the vessel.
Never before has there been an attack on European soil with such extensive material damage. The pipelines, which transported Russian gas directly to Germany, cost billions of euros. This is why, for almost a year now, German, Swedish and Danish intelligence and investigation agencies have been trying to find out who was behind the attack. The Dutch military intelligence service MIVD plays a major role in this.
At the centre of the mystery is the Andromeda - a nondescript sailing yacht that caught the attention of the German police. In September of 2022, the vessel was rented for a few weeks by a Polish letterbox company. The official suspicion is that an unknown team of five men and a woman applied explosives to the pipelines, working from the Andromeda at least a week before they exploded.
That theory is further confirmed by the discovery of powder residue on the boat's table. The residue shows HMX, a powerful explosive used mainly by the military, which works under water. It matches powder residue found on the pipeline.
Ukrainian men
European media investigations now reveal that 41-year-old Ukrainian businessman Rustem A. is behind the Polish company that paid for the lease of the suspect vessel. Little is known about the Kyiv-based man except that a company of his has been the subject of a money-laundering investigation, and that he is decidedly pro-Ukraine. The German criminal investigation team also has the man in its sights, according to sources. A. and his lawyer refused to answer any questions. A team of journalists visited his home, in the course of which he threatened them.
The booking was allegedly made from the email address of a second person, a 28-year-old man from Mariupol, Ukraine. Copies of two forged passports were sent in with the reservation form. He works for a company providing facility support to the shipping industry. German sources close to the investigation confirm that the Ukrainian is a prominent person of interest, but say they do not know whether the man was used or really involved. The man denies having sent the email.
Earlier, it became clear that one of the two fake passports shows the photo of Valeri K., a Ukrainian soldier. Conclusive evidence that he was actually involved was not found on the Andromeda: the German police compared DNA from his son, who lives in Germany, with traces on the boat, but there was no match. To whom the photo on the other passport belongs is not known. What is certain, sources say, is that phones which were used on board the boat were later also used in Ukraine.
MIVD
The role of the Dutch MIVD (Dutch Military Intelligence and Security Service) in the investigation has been crucial. While German forensic investigators were looking into the sailing vessel and its crew, MIVD received new information about the potential operators behind the attacks. Earlier investigations by NOS, Nieuwsuur and German media revealed that an MIVD source from Ukraine passed on information bout an imminent attack three months before it took place.
According to the source, an element of the Ukrainian army was planning an attack from a harbour near Stockholm. They would travel to Sweden using fake Eastern European passports, and rent a boat there. The sabotage was to take place on 19 June, under the guise of a diving expedition to a shipwreck. The Ukrainian army leadership was said to be aware of the plot. Based on the MIVD information, the CIA warned authorities in Ukraine not to carry out an attack.
Later, when an attack had taken place in September, the MIVD received new information from Ukraine. MIVD learned that the attack had been carried out by a team of six Ukrainian special forces. According to a source, the team had rented a boat in Rostock. This put German investigators on the trail of the Andromeda,
Should it turn out that a team from Ukraine is indeed involved, it would be a very uncomfortable outcome for the West. "Any deliberate disruption of the European energy infrastructure is unacceptable", the European Commission said the day after the attack . Ukraine receives military support from Western European countries and is keen to join NATO. For this reason the investigation into what happened is shrouded in extreme secrecy.
Route reconstructed
The investigation by NOS and Nieuwsuur, among others, has also made it clearer which route the Andromeda sailed. After leaving Germany, the vessel was sighted a week later in the southern Swedish port of Sandhamn. Several eyewitnesses saw the sailing yacht there. This makes it even more plausible that the boat was at the locations where the sabotage took place, as it had to sail more or less past them.
One of the eyewitnesses in Sandhamn had a minor run-in with the six-member crew as they were unwilling to help another skipper who wanted to dock. "They looked a bit like soldiers, that is, tough people, reasonably well educated, relatively young."
The skipper said he could not identify the Slavic language they spoke. As different eyewitnesses have different accounts of the language they spoke, their nationality can't be determined with complete certainty.
Meanwhile, German sources close to the investigation emphasise that although everything points to Ukraine, there is still no conclusive evidence. There is little doubt about the role of the Andromeda, but the possibility that Russia used Ukrainians to carry out an attack cannot be completely ruled out.
Apparently, people are also not fully convinced of the credibility of the MIVD sources, which nevertheless also clearly points to Ukraine. The MIVD is still investigating the facts and does not want to draw any conclusions yet, Dutch intelligence sources say.