Online Sleuths Untangle the Mystery of the Nord Stream Sabotage

Alexander and others have been examining the claims made so far. The New York Times and Die Zeit both published stories on March 7 claiming a Ukrainian group was behind the sabotage. (Ukraine has denied any involvement.) Die Zeit published more details, claiming German investigators searched a yacht rented from a company based in Poland, knew where the yacht sailed from, and that six people were involved in the operation, including two divers. All of them used forged passports, the publication reported.

The details were enough for OSINT researchers to start tracking down which yacht could have been used. Alexander, as well as contributors to the open-source investigative outlet Bellingcat, started following the breadcrumbs, narrowing down potential vessels. A follow-up report soon named the boat under suspicion as the Andromeda, a 15-meter-long yacht. Webcam footage from the harbor where it is believed the Andromeda was docked shows the movement of a boat around the time reported by the publications. (The Andromeda is reportedly too small to be required to use ship-tracking systems.) Years-old videos and photos of the boat have surfaced. The sleuthing adds public details to the reports.

Similarly, OSINT has been used to debunk Hersh’s story claiming the United States was behind the explosions. (Hersh has defended his article, while US officials have said it was false.) Alexander has used, among other things, ship-tracking data to show Norwegian ships were “accounted for” and not in a “position to have placed the explosives on the Nord Stream pipeline, as claimed by Hersh.” Another detailed article from Norwegian journalists has similarly poured cold water on Hersh’s claims, partly using satellite data.

The sabotage was always likely to be controversial and surrounded by rumors: Russia’s full-scale invasion of Ukraine in February 2022 has heated global tensions and put pressure on diplomats around the world. There has been a whirlwind of disinformation around the blasts, further muddying the waters. Mary Blankenship, a disinformation researcher at the University of Nevada, Las Vegas, who has analyzed online conversations around the war, says the “high uncertainty and high stakes” of the incident help to fuel the spread of disinformation. 

“This is an issue that exploits existing worries, tensions, and grievances within European audiences,” Blankenship says. Initially, the earliest disinformation on Twitter about the explosions came from conspiracy theorists, Blankenship says, who shared a pre-war statement from US president Joe Biden, where he said there would be an “end” to Nord Stream 2 if Russia invaded Ukraine. Since then, Russia and China have taken to sharing unproven theories about the sabotage, the researcher says.

“Disinformation actors, but also official representatives of the [Russian] regime, stepped up their efforts on every news story that was published on this—however contradictory about the origins of the blast—be it a blog post by Seymour Hersh or a New York Times article,” says Peter Stano, an EU spokesperson, adding most disinformation narratives have circled around the idea that “the US is to blame.” The EU’s disinformation monitoring project, EUvsDisinfo, has flagged more than 150 pieces of disinformation linked to the Nord Stream explosions, including those building on Hersh’s story. “EUvsDisinfo experts also found that Moscow considers the recent materials in German-language media a hoax,” Stano says.