It appears that the Swedish and Danish Navies became aware of suspicious activities near the island of Bornholm several days before the Nord Stream pipeline was blown up. That is the conclusion from a Corporate Trust analysis of vessel movements in the days leading up to the explosions. Two American navy ships were also in the area at the time.
by Sebastian Okada
Seven weeks after the attack on the Baltic gas pipeline, the public still does not know who was responsible or what the various investigations by the governments of Sweden, Denmark, and Germany, have yielded so far. They seem to have chosen to put a tight lid on it.
In order to shed a little more light on the Nord Stream mystery, Corporate Trust analyzed vessel movements from data available on the commerical platform MarineTraffic (Professional), looking for anomalies. The platform’s data is based on ships‘ automatic identification system (AIS) transponders, basically a tracking system. It is important to note that military vessels have the ability to switch their AIS beacons on and off as needed.
The analysis shows that four days before the detonations on 26 September, the Swedish and Danish Navies seem to have been aware that something was afoot in the waters around the island of Bornholm and sent patrol boats to take a look.
These insights come on the heels of a report by WIRED magazine last Friday that satellite imagery analysis by SpaceKnow discovered two „dark ships“ – i.e. vessels with their signal transponders turned off – in one of the areas where the pipeline later exloded. Presumably, these vessels may have been involved in placing the explosives.
The Two Explosion Areas
The Fishing Grounds: Explosion site #1 is situated 40 km southeast of Bornholm, a relatively quiet area of the Baltic Sea frequented mostly by fishing trawlers from the Polish coast, small pleasure crafts, and the occasional ferry speeding through.
Off the Shipping Highway: By contrast, explosion site #2 lies 63 km northeast of Bornholm and just off a major shipping artery, a busy thoroughfare where hundreds of vessels pass through every day.
A Swedish Warship Appears
21 September, five days before the pipeline blasts, was a chilly and overcast day on the east coast of Sweden. HSwMS „Visby“ (K31) was set on a southward course. The sleek military stealth vessel, whose hull is partially made of carbon fiber, patrolled leisurely down the Swedish coastline, heading through the Kalmar Strait past the long and narrow island of Öland. Its speed was a relaxed 9 knots (17 km/h) for most of the trip – patrol speed.
The corvette eventually made a starboard turn into the bay of Karlskrona to spend the night there.
The next morning, something must have happened. The „Visby“ left Karlskrona on 22 September around 08.30 a.m. (06:30 UTC) at 18-20 knots, according to MarineTraffic data, effectively double the speed of its patrol ride on the previous day. Now it was heading southeast for Bornholm.
About halfway to its presumed destination, the Swedish warship even accelerated some more to 28 knots (52 km/h), as if it was tasked to check something out quickly. Not its top speed of 45 knots (83 km/h), but with some sense of urgency, it seems.
Had it received a radio call instructing it to search for something? Its destination apparently lay in the waters northeast off Bornholm, in a place not far from where four days later a massive detonation would rip holes into four separate Russian-German gas pipes.
On midday of 22 September, the Swedish warship sped to a location near what would become explosion site #2 four days later. (The dotted lines indicate a gap in tracking data.)
After the „Visby’s“ arrival near site #2, there is a 22-hour gap in the data until the ship reappears. (Note: Gaps like that are not unusual in marine traffic; we observed them with numerous commercial vessels as well. This occurs especially when ships move out of coastal AIS range, heading for the open sea.)
The following day, 23 September, the „Visby“ rounded the island of Bornholm, passing closely by the later explosion site #1 in the process.
After leaving the area westward, the naval corvette returned for a second look at explosion site #2 the following day, 24 September, around midday at 12:13 local time (10:13 UTC, green arrow below).
What was it that had attracted the Swedish warship’s repeated interest?
The fact is, the Swedes were not the only ones taking a look.
The Danish Patrol Boat
On the same morning of 22 September when the „Visby“ left Karlskrona seemingly in a hurry, the Danish Navy patrol boat P524 had already headed to the same waters northeast of Bornholm.
The vessel, named the „Nymfen“, was cruising slightly southwest of where the detonations would take place four days later.
The patrol boat’s movements seem to indicate a kind of search pattern. At one point, it almost came to a halt, moving at 1 knot or less (indicated by the red arrows). What information was it that brought the boat out to this location? Where did the information come from?
The fact is the „Nymfen“ was crusing in the highlighted area (blue box) between 08:17 a.m. local Swedish time (06:17 UTC) and 08:41 a.m. (06:41 UTC) — the same time that the Swedish warship „Visby“ was just leaving Karlskrona heading for the same general area. Had the Swedes received a call from the Danes? Or had the Swedish Navy intercepted a Danish radio message and decided to take a look themselves?
By the time the „Visby“ arrived near explosion site #2 around 01:00 p.m. local time (11:00 UTC), the Danish patrol boat „Nymfen“ had already left for the nearby port of Nexø on the island of Bornholm.
Whatever the case may have been, a third military vessel was in the area that was in a good position to detect any suspicious activities at site #2 on 22 September:
U.S. Aircraft Carrier
The „USS Kearsarge“ (LHD-3) looks like a small aircraft carrier, but it is actually categorized as an amphibious assault ship. It carries dozens of landing crafts, helicopters, and attack aicrafts; several thousand troops from a US Marines detachment; and various types of sensors, such as air and surface radar and friend/foe identification systems. It is a floating military base and has been used for staging numerous special operations, including the rescue of a US fighter pilot from Serb-controlled territory in 1995 and fighting insurgents during the Libyan civil war in 2011.
Its capabilities, in short, are substantial.
The „Kearsarge“, listed in the MarineTraffic data as „USGOVERNMENT VESSEL3“ (MMSI: 368702000), had been in the Baltic Sea since May 2022, according to news reports. It participated in several joint military trainings and excercises that took place over the course of early summer with NATO and the militaries of Sweden and Finland. After these excercises, the warship stayed in the Baltic until September, when it began making its way back to her home base in Norfolk, Virginia.
On 21 September, the „Kearsarge“, carrying 4,000 troops and other personnel, was heading west and slowly passed within a few dozen miles of the area that five days later would become explosion site #2. It was a accompanied by the USS „Arlington“ (MMSI: 369970719), an amphibious transport dock.
The next day, 22 September, when the Swedish „Visby“ and Danish „Nymfen“ went out to presumably look at something in the waters northeast of Bornholm, the „Kearsarge“ and „Arlington“ were already heading west and leaving site #2 behind them. But their sensors and radars may have been covering even what lay to their stern.
Equipped as they were, did their electronic reconnaisance systems detect anything unusual in thier vicinity on 21 or 22 September? It appears that the American vessels were in a prime position for it.
The „Kearsarge“ has manwhile returned to Norfolk, Va., where it docked on 13 October, according to media reports. The USS „Arlington“ also returned stateside, to New York City.
Context
In a surprising twist, the Russian army has meanwhile accused the United Kingdom of being „involved“ in the destruction of the pipeline. Russia claims it was the same British military specialists who allegedly helped Ukraine attack Moscow’s Black Sea Fleet with flying drones recently.
Also noteworthy is that Swedish investigators had found an underwater drone armed with explosives in 2015 already. It was sitting on the ocean floor next to Line 2 of the Nord Stream pipeline, according to a report by a little-known industry journal. A German author, Bernhard Trautvetter, highlighted this fact recently and questioned why this was not being discussed in German media, since it clearly enlarges the circle of suspected nations beyond Russia. Was this a training run or an actual mission that was aborted at the last minute? Were appropriate steps taken to investigate the incident and increase security of the pipeline?
With the investigating governments remaning completely silent, the question is who was in a position to detect suspicious operations in the waters east of Bornholm. Were other nations on alert but the Scandinavians?
Stay tuned for part II.
Author’s Notes
In the timeframe we focused on, between 21 and 26 September, we did not find any suspicious vessel movements around the site of explosion #1, southeast of Bornholm, in the data available on MarineTraffic. We neither identified ships that lingered near the first blast site for some time, nor any vessels of military origin passing by the area of site #1 in that timeframe.
The publicly available data we had access to is almost certainly only a partial view of all the vessels that were actually active in that part of the Baltic. Vessel traffic provided on commercial platforms is generally limited to those who choose to broadcast their position on open sources (AIS), while military vessels have ways of turning off such transmissions. In the case of a special military operation, such as this must have been, the operatives may even have used vessels which do not send out any location signals at all (see related WIRED reporting). On the other hand, if the special forces who perpetrated the attack used an unobtrusive commercial vessel for cover, like a tugboat or fishing trawler, they may have been broadcasting a signal after all. We simply do not know. Either method is conceivable to have been used in this case.
Full disclosure: The author is by no means a naval investigator or military expert, but instead an investigator of white-collar crime. The facts of the vessel movements described here speak for themselves, however. As far as the context of sabotage operations in general, military experts were consulted before this piece was written.
The author:
Sebastian Okada heads the investigations department at Corporate Trust Business Risk & Crisis Management GmbH, an international security consultancy based in Munich, Germany. He has been an investigator for 18 years.
Ph: +49 (89) 599 88 75 80
intelligence@corporate-trust.de
Corporate Trust Sicherheitsblog 