Possible sabotage puts Nord Stream pipelines out of use

Gas has been found to be leaking from the Nord Stream pipelines in what is being seen as an act of sabotage. On Monday night reports began to emerge of a leak on the Nord Stream 2 pipeline. This is the second of two pipelines constructed to deliver Russian gas to Germany by-passing Ukraine and Poland. A few hours later, it became clear that there had been similar incidents on both streams of Nord Stream 1 not far from the site of the Nord Stream 2 leak. And on Thursday, the Swedish media began reporting that a second leak had been detected on Nord Stream 2.

Large amounts of methane have been observed bubbling to the surface of the sea, and 5-mile exclusion zones for both shipping and air traffic (as the gas is evaporating into the air) have been established to minimise the risk of further explosions and to allow inspections to take place. The Danish energy agency warned that vessels could lose buoyancy if they enter the area, and added that there might be a risk of leaked gas igniting over the water and in the air.

Danish Defence has deployed the frigate Absalon and the environmental ship Gunnar Thorson, as well as a helicopter capacity to inspect the area. The patrol ship Rota has also been in attendance. A video taken by the Danish Defence helicopter SAR emergency services in Roskilde can be found here, and there are more pictures here.

The area affected by boil-off shown in the image is approximately 1 km in diameter.

The leaks were initially discovered by the Danish Defense F-16 repulsion response team, while German gas pipeline operator Gascade reported a pressure reduction from 105 bar to just 7 bar on its end of Nord Stream 2, alerting the German authorities to a major de-pressurisation of the pipeline. Given that it had taken weeks to pressurise the Nord Stream 2 pipes late last year, an overnight drop of this size indicated a major rupture of the pipe rather than an attempt to siphon the gas out of the pipe by Russia.

What do we know so far?

According to the Swedish Maritime Administration both leaks on Nord Stream 1 were in an area northeast of the Danish island of Bornholm, one in the Swedish economic zone and the other in the Danish economic zone. The first Nord Stream 2 leak is south of Dueodde on the southernmost tip of the island, also in the Danish zone, while the second is in the Swedish zone close to the damage to Nord Stream 1. All the leaks are in international waters.

Danish and Swedish seismologists registered two powerful blasts on Monday in the vicinity of the leaks which they said did not resemble the signals detected from earthquakes but were more like signals typically recorded from explosions. The second, larger blast was said to correspond to more than 100 kg of dynamite, and all were detected in the water not under the seabed. One was recorded at 2.3 on the Richter Scale. The first explosion was recorded at 2.03 am on Monday morning and the second at 7.04 pm on Monday evening. The warnings about the gas leaks came from the maritime administration at 1.52 pm and 8.41 pm on Monday, after ships detected bubbles on the surface.

Seismographs recorded near-silence until 00:03 GMT (02:03 local time) when there was a spike followed by a continuous “hissing” waveform, a pattern which was repeated at 17:04 GMT. The noise in the graphs after the spikes has been linked with gas exiting the pipe but this is not currently proved. The charts may be viewed here.

“We cannot rule out any possibility right now. Obviously, there is some sort of destruction of the pipe. Before the results of the investigation, it is impossible to rule out any option…This is a completely unprecedented situation that requires an urgent investigation,”
– Dmitry Peskov, Kremlin spokesperson

Swedish police have filed a criminal complaint of aggravated sabotage in connection with the discovery of the damage. Danish police are also investigating. There has been no explanation from the Russian owners of the pipes other than to say there needs to be an investigation.

All of the gas needs to escape from the pipelines before they can be inspected to assess the damage and try to determine the cause before any attempt at repairs can be made.

What might have caused the leaks?

When the news of the leak on Nord Stream 2 first emerged, there was some speculation that a construction fault might be responsible. My understanding is that the sub-sea sections of these pipes are continuous (ie not compartmentalised) and that individual sections of pipe are welded together. A weld-failure on a new pipe is not inconceivable, although it is almost a year since the pipes were pressurised in October last year. Pipeline failures are rare, and a new pipe should not experience corrosion or fatigue problems that might affect an older pipe.

However, when it became clear that both streams of Nord Stream 1 had experienced a similar de-pressurisation, the notion of a faulty weld is no longer a credible explanation since that pipeline has been operating without problems since 2012. Also, although the failures may at first glance appear to be in close proximity, they are several kilometres apart and occurred hours apart in time.

This also rules out an accident affecting both pipelines – if “something” collided with the pipes, to an extent that created this type of rupture (it does not appear that the pipes were buried, however it seems highly unlikely that an object such as a ship’s anchor could damage Nord Stream 2 and then a few hours later do the same damage to Nord Stream 1 without the crew taking action to avoid a repeat of the first incident). Also, while electricity interconnectors can be disrupted by ship’s anchors, this is much less likely for steel gas pipes with a diameter of more than 1 metre. These particular pipes are made with 4.1 cm thick steel and encased in a further 6-11 cm of reinforced concrete, so rupturing them is no small feat.

This leaves sabotage as the most likely explanation of the leaks. The Baltic Sea is relatively shallow (only about 50 m deep at the point of the leaks) and is well confined, meaning that it would be difficult to carry out such an action un-detected. It is possible that a submarine or other vessel was used to deploy divers to carry out the attacks, and while the information surrounding this is not public, these waters are heavily patrolled by NATO and monitored by the defence forces of the surrounding countries. It is likely that some of these forces have more intelligence relating to the incidents, and once they have been properly analysed, more information may become public.

“We certainly cannot rule it [sabotage] out…It is too early to conclude yet, but this is an extraordinary situation and there are three leaks, so it is hard to imagine that it could be a coincidence,”
– Mette Frederiksen, Prime Minister of Denmark

If, as seems likely, the pipelines have been sabotaged, the question is by whom? Fingers are obviously pointing at Russia, but it is unclear why Russia would blow up its own infrastructure when it can simply choose not to use it. Damaging it removes that choice and requires expensive repairs before they can be used again. Since the pipes were not in use, and not expected to be in use any time soon, there is also no clear rationale for any other country to sabotage the pipes, and if they were to do so they would risk retaliation by Russia. (Some are pointing to comments made in February by US President Joe Biden to the effect that should Russia invade Ukraine, Nord Stream 2 would be “ended” in some way, but it seems unlikely that the US would go to the trouble of blowing up infrastructure that had already been rendered inoperable through regulatory action, and he made no such comments about Nord Stream 1.)

There has been some speculation that the intention was to disrupt other infrastructure in the area such as the new Baltic Pipe, but again, this makes little sense – the Baltic Pipe is still being commissioned and is not expected to carry large volumes of gas this year or next. Also, if the idea was to disrupt other infrastructure why not target that directly?

A UK-based source told The Times newspaper that Russia could have secretly delivered an autonomous underwater vehicle (“UAV”) with a payload to separate locations on the pipelines. The UAV could have been launched off a small vessel such as a fishing boat months ago and explosive devices dropped next to the pipeline which could have been in place for months before being detonated, possibly by using noise of a certain frequency which could be dropped into the water at a time of Russia’s choosing. Russia has reacted to similar accusations by pointing out that both the pipes and the gas which is now leaking into the air are valuable assets it would not seek to waste.

Another option is that this was not the work of the Russian state but by some state-adjacent actors who wanted to put the pipes out of use in the event that Putin either changed his mind about restricting gas supplies to Europe, or was replaced by someone minded to try to restore relations with Europe. It is conceivable that such groups could have the capability to conduct such an attack (which is likely outside the capability of terrorist groups who in any case would probably have claimed credit by now if they were responsible). If such a group is behind this, it could indicate that other gas infrastructure could be at risk, such as Turk Stream or the pipelines through Ukraine and even Poland, despite the latter no longer being used to transport gas from Russia westwards.

A related theory says that Putin has done this because he fears being ousted by someone with a more conciliatory approach to the West, and wants to undermine any such strategy. This seems no less credible than the non-state Russian group theory and has similar implications for other infrastructure. Attacks by Russia on its own assets are also not likely to attract retaliation – however bizarre it may seem, it is difficult to argue with the right of nations to destroy their own infrastructure if they so choose.

Another explanation that has been suggested to me by a colleague (and has since appeared in the FT) is that this could be a means of terminating the gas supply agreements associated with Nord Stream. These agreements are now with Gazprom’s Russian business rather than Gazprom Germania which was nationalised by the German Government last year. The status of these agreements is unclear – Gazprom has claimed that a combination of technical issues and sanctions have prevented it from supplying gas through Nord Stream 1 since the end of August. Physical damage to the pipes could constitute force majeure, but not if this was a deliberate action by Russia.

“By disabling the pipelines, Russia is protecting Gazprom from legal claims over its non-delivery of gas to its European customers…It allows the company to trigger force majeure clauses in its contracts,”
– Andriy Kobolyev, former chief executive of Naftogaz

Force majeure would terminate Gazprom’s obligations under the contracts and draw a line under any future ship or pay obligations, so there could be a rationale forcing this termination, but this relies on a belief that Gazprom would eventually have to compensate its EU buyers under the ship or pay clauses. That is a big “if”…it is not at all clear that Gazprom would recognise its obligations or acknowledge the outcome of any arbitration. It would also assume that no-one could prove the sabotage, if that’s what it is, was carried out by Russia, which might be ambitious given the location.

Of course, most of this is pure speculation. No-one has taken responsibility for the actions, and it is unclear who received benefit from two dormant pipes being physically out of use rather than just politically out of use. It is also unclear if Russia will seek to repair the pipes and if so how long this might take, particularly in light of sanctions. But I would be keeping an eye on the other pipelines just in case this is not an isolated incident.

Other infrastructure may be at risk

Earlier in September, Norwegian state oil and gas company Equinor raised concerns about drone activity around at least three of its platforms in the North Sea. Other sources have linked observations of unknown drones with the Gullfaks C field, the Johan Sverdrup platform and the Snorre A field. These fields are some distance apart – Gullfaks and Snorre A are located around 140 km west of Florø, Johan Sverdrup is located 140 km west of Stavanger. All three platforms produce oil, but the Gullfaks field also supplies gas to Europe. More recently a foreign drone was also observed in the Sleipner area on Saturday and another was seen just 50 metres from the Heidrun platform on Tuesday.

“We have observed unidentified drones at a few of our installations. The observations have been reported to the Norwegian authorities,”
– Eskil Eriksen, press officer at Equinor

Drones operating this far out to sea are thought to be sent up from boats. The incidents have been reported to the Norwegian police, and it is thought that data from marinetraffic.com, a service that provides positional data for maritime traffic, may make it possible to trace the vessels associated with the drones. Defence sources indicate a state actor is most likely behind the drone activity, with Russia a possible suspect. It is feared that the drones are engaged in mapping activity in possible preparation for military actions in the North Sea.

Russian armed forces have had operational plans for sabotage actions in the North Sea and other parts of the Norwegian continental shelf in place for decades according to Aldrimer.no, a Norwegian online journal specialising in defence and national security. The unknown drone activity at Gullfaks C, Johan Sverdrup and Snorre A has apparently been within the safety zone of 500 metres around the platforms. The latest activity was at the Gina Krog oil and gas field, around 30 km northwest of the Sleipner field in the North Sea, also within the 500 m safety zone.

While in theory the drone activity could be associated with the Norwegian military or its allies without the knowledge of civilian authorities, this is considered less likely.

British-based Norwegian gas expert Morten Frisch told BBC News on Wednesday that security in the Norwegian North Sea had been increased in February. These most recent incidents have seen security boosted further, and on Thursday the Norway announced that its military would be deployed to protect offshore infrastructure against possible sabotage.

Norway’s Petroleum Safety Authority (“PSA”) is urging oil companies to increase vigilance over unidentified drones flying near Norwegian offshore infrastructure, warning they could pose a risk of accidents or deliberate attacks, including risk to helicopters transporting offshore workers, the potential to be an ignition source in areas with explosion hazard, or they could be used for deliberate attacks.

Drones have previously been used to attack Saudi oil refineries, so the threat they pose is real. In response to recent events, countries around the North and Baltic Seas are increasing security, and the EU has said it will retaliate in the event of attacks on its energy infrastructure.

The economic gas wars are set to continue

While the physical damage to Nord Stream is having a muted impact on the markets due to not changing the near term energy balance, there are elevated concerns about the EU’s ability to source gas for storage injections next summer. At the same time, there is also news relating to the pipelines through Ukraine, with Russian threats of sanctioning Naftogaz in the same way that sanctions on the Polish pipeline operators ended exports to Europe via the Yamal route.

Earlier this year the Ukrainian state gas company, Naftogaz, and Gas Transmission System Operator of Ukraine (“GTSOU”) declared force majeure on gas flows entering the Sokhranivka entry point in the occupied territories of eastern Ukraine amid concerns Russian occupants were stealing transit gas. In light of the fact that Sokhranivka was under the control of the Russian armed forces, and therefore not under the control of the Ukrainian gas authorities, Naftogaz offered transit through the Sudzha entry point at no additional cost. Not only did Gazprom refuse this exchange, it also reduced the volumes it was already delivering at Sudzha, meaning it has only been delivering about 40% of its contracted quantities since June.

Naftogaz considers that it has provided the required transit services, and that Gazprom has refused to make use of them, and therefore cannot rely on the force majeure to escape its payment obligation. It has therefore initiated arbitration proceedings against Gazprom stating that “funds were not paid by Gazprom, neither on time nor in full” for gas transit. Gazprom has said that Naftogaz had no “appropriate reasons” to reject its obligations to transit gas via the Sokhranovka entry point.

“Gazprom considers Naftogaz of Ukraine filing an appeal an unfriendly step and continuation of unprincipled behaviour by the Ukrainian company, and further attempts by Naftogaz of Ukraine to achieve consideration of the dispute at the International Court of Arbitration could lead to Russian agencies of government authority having all grounds to introduce sanctions against Naftogaz of Ukraine and include it on the list of sanctioned entities. This will mean in practice a ban on Gazprom fulfilling obligations to sanctioned entities under concluded deals, including carrying out financial transactions,”
Gazprom

Gazprom has rejected all Nafotgaz’s claims and said that Russia may introduce sanctions against the Ukranian company if it continues to pursue the arbitration. This would mean that Gazprom would be prohibited from paying transit fees to Ukraine. Currently, 42 mcm of gas per day is being transported through Ukraine to the EU.

It is this news rather than the damage to the unused Nord Stream pipes that is likely pushing European gas prices higher…TTF closed at €207 /MWh on Wednesday, up from €174 /MWh on Monday but well below the high of €347 /MWh in late August, while NBP closed at 471 p/th on Wednesday, up from 241 p/th on Monday, but also far below the highs of 800 p/th seen in late August.

What can we expect next?

In the short term we are likely to see more speculation and accusations as to the causes of the explosions, but it may be some time before there is real clarity. I expect military analysts are combing through their surveillance data to discover exactly what happened and when. Many commentators are saying that this should be a wake-up call regarding the vulnerability of energy infrastructure – this should not really be news.

It has long been acknowledged that hostile actors such as Russia have the capability to interfere with sub sea communications infrastructure, so it is not a great leap to targeting energy infrastructure. The drone activity reported in the North Sea is of particular concern given the region’s importance since the reduction in Russian gas supplies. Although there have so far been no public reports of suspicious activity in the UK North Sea or close to LNG infrastructure, both would also have serious consequences for the European gas market.

While a country blowing up its own assets in international waters may be baffling, blowing up another country’s assets in that country’s territory would be an explicit act of war and a significant escalation. It may be that part of the reconnaissance is to determine whether such acts can be carried out un-detected or at least in a way in which responsibility cannot be proved. A small amount of deniability might be all Russia/ any other hostile actor needs to feel “safe”, but that does not guarantee that any targeted country would not retaliate anyway.

Economically, in the short term there will be limited impact since neither pipeline was delivering gas to Europe and realistically there was no expectation that either would operate any time soon. But the risk of sanctions against Naftogaz and the potential that other infrastructure could be targeted will make both the energy markets and politicians nervous. Still, the market reaction has been far more muted than when Nord Stream 1 failed to re-open in August and prices are well below the levels seen then.