Nord Stream Trials: Problems Appear in Germany’s Andromeda Story

Freddie Ponton
21st Century Wire

The Nord Stream sabotage has produced years of claims, leaks and competing theories, but only recently have two formal legal records begun to show what can be tested in court. In Germany, federal prosecutors have charged Ukrainian national Serhii Kuznietsov over the pipeline explosions. Meanwhile, in London, Nord Stream AG sued Lloyd’s Insurance Company S.A. and Arch Insurance (EU) DAC after insurers refused to pay for the damage; the Commercial Court’s judgment examined the attack in technical detail without deciding who carried it out.

The London proceedings were not intended to identify the perpetrators. Their purpose was to determine whether the insurers’ war exclusion applied. The court heard extensive forensic and operational evidence, yet many of the questions raised by Nord Stream AG’s experts receded once the judge concluded that the exclusion applied under any plausible account of the attack. The judgment settled the insurance claim without identifying the perpetrators or settling what happened at the Nord Stream blast sites on the Baltic seabed in September 2022.

The German proceedings claim to go further by identifying an alleged participant. Yet the publicly disclosed case has not established that the Andromeda was present above every blast site, matched evidence recovered from the yacht to material from the seabed, or explained how the operation was carried out.

The London court found that it did not need to identify the perpetrators, while German prosecutors have yet to prove their case against Ukrainian national Serhii Kuznietsov, whom they accuse of participating in the sabotage. More importantly, the evidence heard in London exposed why Germany’s yacht story is taking on water. Prosecutors have a boat, a crew and a theory, but no publicly demonstrated forensic bridge to the Baltic seabed.

IMAGE: Gas breaks the surface above the Nord Stream 2 leak south of Dueodde, Bornholm, on 27 September 2022. Danish Defence aircraft documented the disturbance as authorities established exclusion zones around the pipeline leaks (Source: Danish Defence/Forsvaret)

Almost four years after a series of underwater explosions tore through the Nord Stream pipelines near the Danish island of Bornholm, the German prosecution and the London insurance trial have presented two very different versions of the event before the public.

Germany claims that a covert Ukrainian military team sailed into the Baltic Sea aboard a 50-foot charter sailing yacht, dove down to four pipelines and planted charges, under orders from Ukrainian state agencies.

Conversely in London, after six weeks of deliberation—including evidence on explosives, subsea operations and the damage itself, the court ruled without deciding who carried out the attack. However, the insurance trial has introduced some compelling evidence which could potentially refine the facts of this story.

Two competing narratives

Germany’s Federal Prosecutor indicted Ukrainian national Serhii Kuznietsov in Hamburg on 30 June 2026, accusing him of coordinating the team aboard Andromeda.

On 6 July, the Commercial Court in London rejected Nord Stream AG’s insurance claim after finding that the sabotage fell within a war exclusion—a conclusion the judge could reach whether the attacker was assumed to be from Ukraine, Russia or the United States.

More crucially, the London’s judgment leaves behind a highly credible and substantial technical record, one which presents serious difficulties for the German trial’s version of events. The forensic experts examined explosions at two groups of sites, separated by roughly six and a half kilometres, and over a time window of 17 hours, rupturing three pipeline strings, and damaging a fourth, although without opening it, and leaving another area of explosive damage known as “the Dent”.

The German narrative attributes the explosion pattern to four devices weighing at least 14 kilograms each, carried aboard Andromeda and somehow placed by said divers at depths of approximately 70 to 80 metres, according to the Federal Prosecutor’s announcement.

The London experts’ analysis is much more precise and backed up by forensic data, and points to a number of technical disagreements Germany, namely about about the number of explosive charges, the nature of “the Dent”, and the mechanics of the damage, which are recorded in the materials and explosives joint memorandum.

MAP: Nord Stream Explosion Sites and the NS1 Line 2 Dent – four primary Nord Stream explosion sites near Bornholm Island, with the separate NS1 Line 2 “Dent” shown approximately 90 meters from the adjacent NS1 Line 1 rupture; pipeline spacing is schematic (Source: 21WIRE)

Much of the evidence needed to test that account remains spread across separate investigations and private surveys. Swedish and Danish authorities maintained controlled over those blast areas before Nord Stream AG was allowed to inspect them, while German material entered the London proceedings under sealed confidentiality.

Securing the crime scene became even more complicated due to the fact that a Norwegian offshore vessel known as the Normand Frontier, later spent days working across the pipeline sites for a client whose identity has not been publicly disclosed, according to the London judgment. Later in this report, we will present our own commercial  reconstruction of this vessel’s movements based on the actual AIS vessel data, and a possible motive for deploying this mystery vessel.

The story of yacht Andromeda brings together a number of disparate pieces of evidence and storylines; a secret Baltic voyage, false identities, diving equipment, and trace residues of RDX and HMX explosives, according to Germany’s Federal Court decision. Still, the public case stops short of showing how those findings correspond to the devices and the actual damage recovered from the Baltic seabed. That missing connection means that the Hamburg proceedings falls wide of the mark—because the evidence revealed in London went much further in terms of  closing the gap between the technical demands of the attack and the actual post-blast site forensics.

It also showed how much of the original crime scene record remained beyond the reach of the experts who testified, and how many unanswered questions still surround the authorities and vessels that reached that seabed long before the evidence was assembled for these two legal proceedings.

DOCUMENT: Nord Stream’s Unresolved Evidence: Court Records, Vessel Data and Unanswered Questions After the London Judgment and Germany’s First Indictment (Source; Author)
Nord-Streams-Unresolved-Evidence-

Two explosions, four lines

Nord Stream consisted of four large underwater pipeline strings running from Russia, through the Baltic Sea, to Germany. Nord Stream 1 had two operational strings, while the two Nord Stream 2 lines had been completed without entering into full commercial service, and the London claim concerned Nord Stream 1, even though damage to both systems formed part of the evidence.

The first seismic event was registered at 2.03am local time on 26 September 2022, and corresponded to damage south-east of Bornholm in the Denmark’s exclusive economic zone (EEZ). Nord Stream 2 Line A ruptured, while Line B suffered external damage without leaking. Seventeen hours later, at 7.03pm, a second event struck north-east of Bornholm, rupturing both Nord Stream 1 pipeline strings at locations in the both the Swedish and Danish EEZ areas, as detailed in the London judgment.

The experts in London agreed that directional or shaped charges had been used to focus explosive force against the pipes, and that the explosive was RDX-based. Their reconstruction began with an initial penetration of the pipe’s steel wall, followed by violent movement and decompression as the gas escaped, further enlarging the breaches and contributing to the extensive destruction visible during later surveys, according to the London record.

The results were not uniform. Three strings ruptured, but Nord Stream 2 Line B remained sealed despite external damage, and a later survey found another area of deformation on Nord Stream 1 Line 2, referred to in court as “the Dent”.

Nord Stream AG suggested that an anchor might have caused it, although the absence of a corresponding drag scar led the judge to find, on the evidence and following cross-examination, that it was more likely that this resulted from an explosion as part of the same attack, according to the London judgment.

This was a judicial finding on ‘anchor-versus-explosive’ causation, not an expert consensus on the precise explosive mechanism, which remains disputed between testimonies of Rigby and Pettitt/Lumley. The materials experts’ points of agreement and disagreement are set out in the materials and explosives joint memorandum, with further analysis contained in Rigby’s supplemental report and Pettitt’s supplemental report.

However, one important point was agreed on by the experts: they concluded that directional, or shaped charges were used, and that the devices were housed in pre-made sealed containers specifically designed for underwater use at depth, and that the explosives were RDX-based. They disagreed over the precise configuration. Professor Rigby considered a linear shaped charge most likely, while Dr Pettitt and Hefin Jones favoured a three-dimensional shaped charge.

At another Nord Stream 1 location, the operator described one end of the ruptured pipe as mangled and heavily deformed while the other appeared comparatively smooth. The London judgment recorded the difference without deciding what caused it, leaving an open question as to whether or not the contrast arose from the number and position of the placed charges, the direction of force, movement of the pipe, or subsequent interaction with the seabed.

Contrast this level of detail in the London case with Germany’s basic public account that makes a general reference to four charges placed on three pipeline strings, according to the Federal Prosecutor’s announcement. The London evidence describes explosive damage across four strings and includes “the Dent”—which does not fit neatly into the published German sequence. A reconstruction presented in Hamburg will therefore have to place each alleged device at a particular location and show how four placements produced the separate damage patterns recorded across two separate pipeline systems.

What London decided

The London proceeding arose from Nord Stream AG’s claim for approximately €580 million under policies covering damage to its two pipeline strings. The insurers relied on exclusions for losses connected with “war” and “acts of government”, which allowed the court to decide the case by examining whether the sabotage had the required relationship to the war between Russia and Ukraine, according to the London judgment.

IMAGE: The London Commercial Court, housed in The Rolls Building, where Nord Stream AG’s €580 million insurance claim was decided (Image Source: Wikimedia)

The court heard competing assessments of possible Ukraine, Russia and United States involvement, whose possible motives changed according to when planning was assumed to have begun. The experts disagreed about relative likelihood, and one who placed Ukraine ahead of the other candidates still could not say that Ukrainian responsibility was more likely than not, as the London court recorded.

The judge did not need to resolve those disagreements because the “war exclusion” applied under each of the principal scenarios. References to the Andromeda sailboat and the German investigation appeared as background to the insurance arguments rather than any definitive finding that a Ukrainian crew aboard the yacht had carried out the sabotage, according to the London judgment.

Some German investigative documents were disclosed to the parties under court-ordered confidentiality and remained outside the public court filings. At the same time, the London experts never received the complete findings from the early Swedish and Danish crime scene inspections, which meant that an unusually detailed examination of the attack still proceeded from only part of the evidence held by the various authorities, according to the court record.

The voyage of Andromeda

German prosecutors said that an intermediary actor obtained the Andromeda yacht by using false identity documents and specifically requested a yacht without an Automatic Identification System (AIS). Moreover, a vessel of its size had no legal obligation to transmit AIS data, and the request by the intermediary actor would have ensured that its route did not appear continuously on public vessel-tracking services.

IMAGE: The sailing yacht Andromeda in the Baltic Sea photographed during a later reconstruction voyage by German media outlets DER SPIEGEL and ZDF (Source: Der Spiegel)

Kuznietsov allegedly travelled from Ukraine through Poland and entered Germany on 4 September 2022 using a forged Ukrainian passport carrying his photograph. By 8 September, according to Germany’s Federal Court, he had joined six other people in the harbour of Wiek on Rügen, where the alleged team of seven persons consisted of a skipper, an explosives specialist, four divers and Kuznietsov as coordinator.

The German Federal Prosecutor’s announcement says they sailed towards Bornholm with diving equipment and military explosives, then placed four timed charges on three pipeline strings in both the Danish and Swedish exclusive economic zones. Each device is said to have weighed at least 14 kilograms and contained RDX and HMX. The crew allegedly returned to Rügen, where Kuznietsov left the yacht on 23 September before travelling through Poland to Ukraine, three days before the explosions.

Using a combination of data points, investigators are said to have reconstructed the voyage without a logbook, or continuous AIS track, by using harbour records, witness accounts, coastal surveillance and navigation data, according to the Federal Court decision. Those observations place a yacht carrying passengers and diving equipment along parts of the alleged route, although the published decisions do not disclose the breathing apparatus, gas mixtures, decompression equipment or other details needed to determine whether the equipment matched the dive operations described by prosecutors.

DOCUMENT: “Andromeda: The AIS Question” is a companion to the Evidence Report which examines what the yacht’s lack of continuous AIS data means, and what can and cannot be established from the remaining voyage evidence. (Source Author)
Andromeda-The-AIS-Question-Methodology-Companion-v2.1.

Nearly two years later, German authorities arrested Kuznietsov in Italy in August 2025 under a European Arrest Warrant, and he was extradited in November. The Federal Court rejected his challenge to detention the following month after finding strong suspicion at that stage of the proceedings, well before any witnesses, forensic findings and voyage reconstruction had been tested at trial.

The Federal Prosecutor’s indictment announcement accuses him of co-perpetrating an attack on civilian objects as a war crime, causing explosions, destroying structures and disrupting public services. It also alleges that Ukrainian state agencies ordered the operation. Kuznietsov denies involvement and therefore is still presumed innocent until a verdict is pronounced.

Explosives in the cabin

The strongest physical evidence disclosed so far came from the cabin of Andromeda, where investigators found traces of RDX and HMX when they examined the yacht in January 2023—some four months after the attack, according to Germany’s Federal Court decision. Their distribution suggested that the substances had been handled on a table, and because the yacht had reportedly not been chartered to another customer after the September voyage, the Federal Court considered it likely that the handling of explosives could have occurred during the relevant rental period.

MAGE: Investigators reportedly found traces of RDX and HMX on this table aboard Andromeda, but no detailed forensic match to the Nord Stream devices has been made public. (Source: RTL/ntv)

The same ruling referred to RDX and HMX on metal recovered from the explosion sites, although the published decision does not contain a comparative analysis linking the two sets of samples by formulation, manufacturer or production batch. Furthermore, it gives no laboratory profiles, quantities, degradation patterns or statistical assessment from which the strength of the claimed correspondence could be measured.

It’s important to note that both RDX and HMX are identified as types of military explosives, rather than a unique device or source. A more discriminating match could come from binders, plasticisers, impurities, relative concentrations and other features of the formulation, provided the samples were sufficiently preserved, and the analytical methods permitted such a comparison—an issue relevant to the materials experts’ disagreement recorded in the materials and explosives joint memorandum.

The public record also omits the chain of custody for the seabed metal, including its precise recovery location, the authority or contractor that found it, how it was stored and when it entered the German investigation. Investigators have therefore placed military explosive residue aboard a yacht connected to false identities and alleged divers, but the published evidence still does not yet show that the residue in question came from the devices that produced the damage examined in London.

Could the yacht have done it?

The findings in the London legal proceedings diverge greatly from what was presented in the Germany trial. The London filings established that four charges weighing at least 14 kilograms each could be carried aboard a 50-foot yacht, though even this storage-capacity premise is disputed between Haynes, who initially considered the equipment load insufficient for Andromeda in Haynes’s first report, and Reynolds, who considered it sufficient on a reduced-equipment assumption in the subsea joint memorandum. In any case, storage capacity addresses only the beginning of the alleged operation.

IMAGE: Could Andromeda Support the Dive Operation? Illustrative reconstruction of technical divers deploying from Andromeda. German prosecutors allege that the 50-foot charter yacht supported the Nord Stream operation; its practical feasibility remains disputed (Source: 21WIRE)

The devices had to be prepared safely, moved into the water and taken to separate pipeline strings, where divers had to locate the intended attachment points in darkness at a depth of approximately 80 meters, and secure the charges firmly enough to properly focus the explosive force against the steel. The materials experts agreed that the explosives were specifically placed at welded joints, indicating that the devices were positioned against specific structural features, rather than merely placed near the pipelines.

At 70 to 80 metres, breathing-gas consumption and decompression sharply restrict the time a diver can work on the bottom. Cold water increases the demands on thermal protection, while currents, weather and the movement of a sailing yacht further complicate the launch and recovery of divers who would likely need to resurface close to a predetermined point, as discussed in the subsea joint memorandum.

The London experts agreed that closed-circuit rebreathers using an appropriate helium-based gas could support dives to those depths, that a four-person dive team was viable, and that extensive rehearsals would have been required, according to the subsea joint memorandum. The subsea operations and equipment experts, Haynes, Jones, and Reynolds, also agreed that divers probably attached the charges by hand using strong magnets and that a small remotely operated vehicle could have assisted with reconnaissance.

However, agreeing that the attack was possible is not the same as agreeing on how it actually happened. Paul Haynes considered Andromeda too small for the diving and demolition equipment likely to have been used, and preferred an explanation involving military diving methods and, more likely than not, a military vessel depicted in Haynes’s first report.

His later supplemental report accepted that, under reduced assumptions, Andromeda could likely have carried the necessary equipment, but he maintained that the yacht remained an implausible operational platform, and stated that the reported unloading of diving equipment in plain sight at Wiek supported his view that it may have been used as a decoy. That remained his inference, rather than an established finding.

IMAGE:  The Bavaria 50’s specifications and layouts provide context for Haynes’s disputed assessment that Andromeda was an implausible platform for the alleged operation (Illustrative redrawn source: Bavaria Yachts brochure) 

Hefin Jones considered the operation consistent with state or state-supported capability, while Commander Thomas Reynolds proposed a leaner operation in which four or five experienced divers could conduct the attacks, albeit over two nights, from Andromeda while accepting greater risk, according to the subsea joint memorandum.

It is also crucial to note that the experts in the London proceedings disagreed about the number of charges. Haynes’s reconstruction assumed a minimum of nine charges across six known damage sites, while Reynolds considered smaller shaped charges and fewer dives to be sufficient, a disagreement recorded in the subsea joint memorandum. Conversely, Germany’s Federal Court referred to a German expert who considered Andromeda structurally suitable, but the published ruling does not provide a complete equipment inventory, nor any dive plan matching each alleged placement of explosives. Hence, the alleged Andromeda dive operation would need to account for items like rebreathers, breathing gas, thermal protection, and decompression. More importantly, any such report should include the number and duration of dives, the means of locating the pipelines, as well as the recovery of the divers and the initiation system.

All of this information would be required in order to determine how the charges allegedly remained underwater for several days before two groups of explosions occurred 17 hours apart.

The explosives experts agreed that two options were possible, where either digital timers or a remote acoustic firing system was used. Professor Rigby did not choose between the two, while Dr Pettitt and Hefin Jones considered acoustic initiation highly likely.

What the damage preserves

The damaged pipelines allow Germany’s account to be examined from the opposite direction, beginning with the effects on the steel and working backwards towards the construction and placement of the devices. Penetration points, fracture surfaces, fragment distribution and the orientation of deformation may reveal the position and direction of each charge, issues addressed in Rigby’s first report, Rigby’s supplemental report and Pettitt’s supplemental report.

IMAGE: Underwater inspection imagery of damage to Nord Stream 1. The pipeline’s deformation, fracture pattern and surrounding seabed may preserve evidence of how an explosive device was positioned, although the image alone cannot establish the charge design or attacker (Source: Blueye Robotics/Expressen, via CNN)

Remains of a casing, shaped-charge liner, timer, clamp or magnet could connect the blast sites to equipment found aboard the yacht, or to a particular manufacturer and procurement channel. The specific installation-jig and attachment proposal originates in chartered pipeline engineering expert Peter Lumley’s principal report, retained by Nord Stream AG, and quoted only secondhand in Pettitt’s supplemental report. Lumley’s principal report was not available for independent verification.

Nord Stream 2 Line B may contain especially useful evidence because the strike damaged the exterior without opening the pipe. In general, a device that failed to produce a full rupture may leave more of its casing, attachment system and immediate damage pattern than a successful explosion followed by rapid decompression and violent pipe movement. The corpus illustrates that principle at an NS2 Line A partial-failure site; Line B’s own damage pattern is separately discussed and disputed in the materials and explosives joint memorandum.

“The Dent” on Nord Stream 1 Line 2 offers another point of comparison. The London court treated it as explosive damage connected to the sabotage, while the public German account does not clearly identify where it belongs among the four alleged charges.

Survey measurements and blast modelling should show whether “the Dent” resulted from a separate device or from forces generated by another nearby explosion. The Claimant’s two experts’ independently modelled figures converge near 0.3–0.4 MJ, while the Defendants’ expert’s 2–8 MJ figure rests on third-party Wood/Safelane modelling whose underlying inputs were never disclosed to him, according to Rigby’s supplemental report, Pettitt’s supplemental report and the materials and explosives joint memorandum.

The first inspections

Sweden and Denmark established exclusion zones around the damaged pipelines immediately after the explosions and controlled access while their authorities conducted criminal investigations and underwater surveys, according to the London judgment. Nord Stream AG did not begin its own inspection in the Swedish sector until 29 October 2022, followed by restricted work in the Danish sector from 12 November.

IMAGE: HMS Belos Deploys the URF Submarine-Rescue Vehicle – Swedish Navy submarine-rescue ship HMS Belos (A214) handles the URF Mk II underwater vehicle. Equipped for advanced diving and subsea work, Belos illustrates the specialist capability available to Swedish authorities during underwater investigations. The photograph is illustrative and was not taken during the Nord Stream inspection. (Source: NATO Allied Maritime Command aka MARCOM, Exercise Dynamic Monarch 24, September 2024)

By then, national authorities had already examined the sites. The London judgment records that the scope and findings of the Swedish and Danish inspections were not made available to Nord Stream AG, whose experts consequently worked from surveys conducted after the original crime scene had already been entered and investigated.

Those early records may contain sonar, photographs and video showing fragments, attachment points, seabed disturbance before subsequent visits, or even physical evidence. They may also identify samples or larger objects removed during official recovery work, together with the position from which each item was taken. To further complicate the chain of custody problem, Sweden said that it transferred material capable of being used as evidence in Germany, but the public record does not provide a detailed inventory of that handover.

What was the Normand Frontier doing in the Baltic? 

Between 20 and 30 November 2022, the Norwegian offshore vessel Normand Frontier moved among locations associated with Nord Stream damage in the Danish and Swedish exclusive economic zones. Built to support complex subsea operations, Solstad’s vessel specifications identify Normand Frontier as a DP2 (Class 2 Dynamic Positioning system) offshore support vessel with ROV (Remotely Operated Vehicle) capability.

IMAGE: Normand Frontier at sea – the Norwegian offshore support vessel Normand Frontier, a DP2 platform equipped for complex subsea and ROV operations. Commercial AIS-derived records place the vessel near several Nord Stream damage locations in November 2022 (Source: Offshore Energy)

Haynes referred to Normand Frontier in Haynes’s first report as an example of the type of dynamically positioned offshore support vessel capable of supporting surface-supplied diving at approximately 75 metres. He was discussing the platform’s capability, but did not identifying the real purpose of the vessel’s later Baltic mission. Nonetheless, the comparison shows how sharply its capacity differed from that of the Andromeda.

Our investigation has managed to retrace the steps of Normand Frontier by using the actual commercial VesselFinder historical AIS-derived dataset acquired by 21st Century Wire, measured alongside the blast-site coordinates established in our investigation’s findings. VesselFinder describes historical AIS data as an archive of terrestrial and satellite ship-position data, and its AIS documentation explains the fields used in position records, including time, position, course, speed, heading, navigational status and destination.

Those coordinates are working investigative references rather than official hydrographic survey points. On that basis, Normand Frontier’s recorded movements repeatedly intersected the southern Nord Stream 2 area and the northern Nord Stream 1 area, rather than describing a single passage through the region.

The strongest conclusion is limited but material: the commercial reports place a subsea-capable vessel repeatedly close to known damage locations after the explosions. They do not disclose whether an ROV or diver was deployed at any particular coordinate, what task was performed, or whether anything was recovered.

VIDEO: VesselFinder playback showing reported AIS positions for Normand Frontier during its November 2022 Baltic mission: calling at Køge, Denmark before proceeding to the Nord Stream damage areas, moving around the southern Nord Stream 2 and northern Nord Stream 1 locations, and returning to Køge after completing that period at the sites. The track establishes Normand Frontier vessel positions and movement from November 13, 2022 until December 1, 2022 (Source: Actual VesselFinder Normand Frontier commercial AIS data acquired by 21st century Wire)

.
As shown in the video above, the vessel’s Baltic mission was bracketed by calls at Køge in Denmark. Cargo manifests, quay records, work orders and personnel lists that could show what went aboard before the mission and what came ashore afterwards have not been publicly released. A port call could involve ROV mobilisation, tooling, survey systems, project personnel, ordinary stores or other commercial activity. The position data undeniably establishes presence at and around the crime scene, but we are currently unable to confirm the cargo or related activities at the Køge harbour in Denmark. Thus, the matter is still considered to be under investigation.

DOCUMENT: Normand-Frontier-AIS-Position-Extract-Oct-Dec-2022 is an hourly AIS position extract for Normand Frontier, 1 October–31 December 2022. The VesselFinder report records reported UTC time, position, course, speed, heading, navigational status and declared destination. It does not establish underwater activity, mission purpose or client identity.
Download the complete Normand Frontier AIS position report (.xlsx)

AIS Limits

The commercial AIS-derived dataset contains gaps during the vessel’s work around the pipeline areas. Such gaps may result from receiver coverage, missed transmissions, aggregation intervals, data processing or interruption aboard the vessel, and VesselFinder’s AIS documentation describes the categories of AIS-derived fields rather than proving the cause of any individual gap.

The dataset alone cannot establish whether or not the Normand Frontier’s AIS transmitter was deliberately deactivated during that period. Determining the cause would require raw AIS broadcasts, independent coastal-receiver records, bridge logs, dynamic-positioning records and relevant voyage-data systems. Accordingly, the periods are described as reporting gaps and are not treated as proof of concealment.

Greenpeace at the site

Greenpeace Germany conducted an independent inspection near the Nord Stream 1 damage area in the Swedish exclusive economic zone on 24 and 25 November. Its expedition deployed a remotely operated vehicle and collected water and sediment samples. The team encountered and photographed Normand Frontier at the site, independently confirming the specialist vessel’s physical presence during its mission.

Greenpeace later asked F. Pfeiffer of the Bureau for Environmental Geology and Safety Research to analyse its underwater footage. In Pfeiffer’s report, he noted that he had no metal, water or sediment samples for chemical or metallographic analysis, while darkness and limited coverage restricted his conclusions.

Within those limits, Pfeiffer interpreted the filmed damage as the result of a large external explosion acting from a short distance. His most consequential observations concerned impressions suggesting that sheets of metal or cylindrical objects had recently lain on the seabed and been removed, along with loose material and an irregular depression that might have resulted from displacement of an explosive charge, according to Pfeiffer’s report.

However, the report could not identify the objects, establish that they had been removed, or determine who was responsible. Currents, blast displacement, sediment conditions, official recovery work or later survey equipment could each have affected the scene. The observations therefore can only raise a documentation question rather than proving a ‘clean-up’.

The clean-up dispute

The possibility that material evidence had been removed from the blast sites became a point of disagreement among the London experts. In Haynes’s first report, Haynes said that every explosive sabotage leaves evidence and expected that a state operation would include a post-explosion clean-up phase.

In the subsea joint memorandum, Jones treated the absence of attributable explosive components as one feature consistent with a deniable, state-supported operation, while Reynolds’s written report considered a return to the sites unnecessary. The timing creates an evidentiary issue, but not proof of removal.

All the parties who attempted to access to the crime scene did so under very different conditions. For instance, Swedish and Danish authorities had already entered the sites, while Nord Stream AG’s access remained controlled. While Greenpeace was only able to record ambiguous seabed impressions, the Normand Frontier was able to conduct a capable subsea mission—but whose detailed orders and recovery inventory remain outside the public record. Mission orders, ROV tracks, sonar files, unedited footage, dive logs, tooling records and object inventories would show whether the vessel inspected the sites, recovered material under authority, or performed another task. Chain-of-custody records would identify if any samples or fragments collected were ever transferred to any national investigation.

The companies behind the vessel

Solstad Offshore owned or operated Normand Frontier, while Omega Subsea had an industrial collaboration with Solstad involving ROV systems, equipment and personnel. Investigation materials indicate that two work-class Schilling Robotics ROV systems were associated with the vessel during 2022, and Omega Subsea’s Robotics page describes its Solstad collaboration and ROV systems.

Ocean Infinity had previously chartered Normand Frontier and maintained commercial and personnel connections within the same subsea-services network. Those relationships identify companies with relevant capability, but do not establish who commissioned the November mission. At present, no charter party, purchase order or project directive obtained for this investigation proves that Ocean Infinity hired Normand Frontier for Nord Stream, or that Omega Subsea personnel operated its ROVs at the sites.

In addition, US Coast Guard cutter USCGC Hamilton WMSL-753 was present in the wider Baltic Sea during this period, while Danish, Swedish and German vessels had also operated around the damaged pipelines. Their proximity may reflect monitoring, security, deconfliction or cooperation, but it does not establish that the United States or NATO controlled Normand Frontier.

Køge’s recent use for military deployments also requires care. Earlier security arrangements at the port do not show that Normand Frontier’s calls formed part of any NATO mission.

One crime scene, several archives

The Nord Stream evidence is now distributed among institutions with different powers and interests. Sweden and Denmark controlled the sites and retain files from investigations they closed without naming a perpetrator, while Germany holds the criminal case, according to the German Federal Court decision and Federal Prosecutor’s announcement.

Nord Stream AG and its contractors possess private survey material, and the London court proceedings generated expert reports and confidential disclosures. Meanwhile, the vessel operators retain mission records, and governments control naval surveillance and intelligence reporting. No public inventory joins those materials or shows which authority holds each sample, fragment, image and acoustic record.

That fragmentation had limited consequences in London because the court could decide the insurance dispute without choosing among the principal attribution scenarios, according to the London judgment. However, any criminal prosecution of a named defendant requires a more exact account of the evidence, including material held abroad or privately that could contradict the reconstruction offered by German prosecutors.

The possible diversion

The alternative reading of Andromeda begins with much of the evidence Germany regards as incriminating. Ukrainian personnel may have chartered the yacht, used false identities, carried some diving equipment, and possibly handled military explosives while taking part in an operation connected with the Nord Stream incident, but those facts alone do not determine what role the yacht actually played in the explosions.

It could have carried the team responsible for the principal demolition, as prosecutors allege in the Federal Prosecutor’s announcement. A wider operation could also have used it for reconnaissance, transport, a secondary placement or the creation of a discoverable trail while another platform handled the most demanding parts of the operations. That hypothesis has internal logic, but no disclosed deployment order, communication or physical evidence presently proves it.

The later presence of Normand Frontier and Hamilton cannot fill that gap because their documented activity occurred after the explosions. Their relevance concerns access to the damaged pipelines after the fact, and the completeness of the evidentiary record—not participation in the original attack.

It’s crucial to note that a forensic match between material found on the Andromeda and the material and devices used against the pipelines would strongly support the yacht’s direct involvement and weaken claims that this operation was deployed as a decoy. Such a detailed match between Andromeda, the devices and the damage would have left little room for a “diversion hypothesis”. In other words, if the yacht carried the same explosive formulation, attachment systems and initiation components recovered from placements mapped across the damage sites, the physical evidence would establish its role far more strongly than mere sightings or generic residue alone.

In the end, both the London Commercial Court trial and the German prosecution did not establish a forensic match between the Andromeda and the explosive devices used against the pipelines. This dearth of evidence could be described as “the Andromeda gap”.

The alleged Ukrainian order

The indictment adds another claim that must be proved separately from the mechanics of the attack by alleging that Ukrainian state agencies ordered the operation, according to the Federal Prosecutor’s announcement. Kuznietsov’s military background, the alleged crew’s composition, false documents and military explosives may support an inference of state involvement, but an inference does not identify the authority that ordered the mission or the chain through which any instruction reached the accused.

Evidence could come from communications, financial records, military documents, intelligence, witness testimony or proof that an agency supplied personnel, explosives, identities and logistical support. The public indictment announcement does not identify that evidence in detail.

The distinction affects both responsibility and the war-crime charge. Germany’s Federal Court rejected the defence’s immunity and combatant-privilege arguments at the detention stage and treated Nord Stream as civilian infrastructure. Hamburg must now decide whether the prosecution can prove the alleged state order and Kuznietsov’s personal role at trial.

What Hamburg must resolve

London established that directional, RDX-based charges struck the Nord Stream systems at separate locations and produced several forms of damage, according to the London judgment. Germany has connected Andromeda to false identities, divers, a reconstructed Baltic voyage and military explosive residue, while alleging that Kuznietsov coordinated a Ukrainian state operation, according to the Federal Court decision and Federal Prosecutor’s announcement.

The remaining work lies in bringing those two bodies of evidence together. The equipment documented aboard the yacht must support the dives described by prosecutors, the initiation system must explain charges left underwater for several days and detonations separated by 17 hours, while four alleged placements must account for the three ruptures, the damaged fourth string and “the Dent”.

The seabed evidence should identify the construction, orientation and attachment of the devices and permit comparison with the explosives and equipment associated with Andromeda. Its chain of custody must also account for the early Swedish and Danish inspections, later operator surveys and the November mission by Normand Frontier.

Germany may hold records that answer these questions, including confidential material unavailable in London and evidence transferred by Sweden or Denmark. Until those records are tested in court, the public case establishes a suspicious operation around Andromeda more clearly than it establishes the yacht’s exact function in the destruction of the pipelines.

Hamburg will have to determine whether the traces found in the cabin lead continuously to the damage on the seabed, and whether the evidence collected there remained complete and reliable as it passed through several authorities, contractors and underwater missions before reaching the prosecution.

Editorial note on coordinates and attribution

All geographic proximity statements in this draft use the blast-site coordinates previously established in the investigation materials, including the southern Nord Stream 2 area, the northern Nord Stream 1 locations, the Nord Stream 2 B-line damage area, the Dent and the location described in those materials as “Bomb 6.” They are labelled and treated as investigation-material coordinates, not official survey coordinates. A vessel’s recorded presence near a location does not establish participation in the September attack, the deployment of subsea equipment, evidence recovery or coordination with any government. Commercial position reports establish reported position and time only. AIS reporting gaps are not described as deliberate shutdowns without corroborating transmitter, receiver and bridge records.

Methodology and evidentiary record

This investigation was assisted from an early stage by Swedish engineer Erik Andersson. As expert reports and other documents from the London proceedings became available to non-parties through the court’s public-access system, Andersson obtained official copies for a fee and shared them with us before either the London judgment or the German indictment had been published. He later assembled the publicly available material in an online archive and continues to report on the case through his Substack and on X as @Erkperk.

• Presence near a damage location is not evidence of participation in the September 2022 attack.
• Post-explosion vessel activity is discussed as possible access to the seabed, not attribution of the original sabotage.
• Capability is not treated as proof of tasking, charter, deployment or recovery.
• The indictment and detention decision state allegations and procedural findings; Kuznietsov denies involvement and remains presumed innocent.
• The London judgment resolved insurance coverage without identifying the perpetrator.

Source Notes

Public primary sources and investigation-material dependencies:

1. London Commercial Court judgment. Nord Stream AG v Lloyd’s Insurance Company S.A. and Arch Insurance (EU) DAC, EWHC 1685 (Comm), approved judgment, 6 July 2026. Open source
2. German Federal Court decision. Federal Court of Justice, Third Criminal Panel, decision of 10 December 2025, StB 60/25; official press release. Open source
3. Federal Prosecutor indictment announcement. Federal Prosecutor’s Office, “Indictment Filed Regarding the Nord Stream Gas Pipelines Explosions,” 2 July 2026. Open source
4. Greenpeace underwater record. Greenpeace Germany, full underwater footage recorded 25 November 2022; the accompanying description states that Beluga II used an underwater drone and collected 40 water and sediment samples. Open source
5. Greenpeace/Pfeiffer written analysis. F. Pfeiffer, Bureau for Environmental Geology and Safety Research, analysis of Greenpeace underwater image material. Open source
6. Normand Frontier specifications. Solstad vessel page for Normand Frontier, including vessel dimensions, DP2 capability and crane information. Open source
7. Omega–Solstad ROV relationship. Omega Subsea Robotics describes the 2022 industrial collaboration and identifies Schilling HD ROVs integrated aboard Normand Frontier. Open source
8. VesselFinder historical AIS data. VesselFinder describes historical AIS data as a terrestrial and satellite ship-position archive available as a paid data product. Open source
9. VesselFinder AIS documentation. VesselFinder explains AIS response fields, including position, course, speed, heading, navigational status and destination. Open source

Expert reports and memoranda

The expert reports and joint memoranda listed below were obtained as official court copies by Erik Andersson, shared with the author and later made publicly accessible through his archive.

1. Paul Haynes, Subsea Operations, expert report for the Defendants, 31 October 2025.
2. Paul Haynes, Subsea Operations — Supplemental, expert report for the Defendants, 18 February 2026.
3. Reynolds, Jones and Haynes, Joint Memorandum — Subsea Operations, 17 February 2026.
4. Lumley, Rigby, Pettitt and Jones, Joint Memorandum — Materials & Explosives Science, 23 January 2026.
5. Peter Pettitt, Materials & Explosives Science — Supplemental, expert report for the Defendants.
6. Sam Rigby, Explosives Science, expert report for the Claimant, 28 November 2025.
7. Sam Rigby, Explosives Science — Supplemental expert report for the Claimant, 17 February 2026.

Investigation-material notes

IM-1 — Vessel-position reconstruction. Statements about Normand Frontier’s movements from 20–30 November 2022 rely on the commercial AIS-derived dataset and reconstruction held in the investigation materials. The data establish reported position and time only; they do not establish deployment of divers or ROVs, recovery of objects, mission purpose, client identity or government coordination.

IM-2 — Coordinate basis. Geographic-proximity statements use the southern Nord Stream 2 area, northern Nord Stream 1 locations, Nord Stream 2 B-line damage area, Dent and “Bomb 6” coordinates established in the investigation materials. They are working investigative references, not official hydrographic survey coordinates.

IM-3 — AIS reporting gaps. The commercial dataset contains reporting gaps. Without raw broadcasts, independent coastal-receiver records, bridge logs, dynamic-positioning records and voyage-data systems, the gaps cannot be characterized as deliberate transmitter shutdowns.

IM-4 — Expert-report status. Statements attributed to Paul Haynes and Thomas Reynolds are identified as positions in written reports where they were not called as trial witnesses. Jones’s clean-up position is identified as appearing in the joint memorandum. Lumley’s installation-jig proposal is available only through Pettitt’s secondhand characterization because Lumley’s principal report was unavailable for independent verification.

IM-5 — Unpublished operational records. Statements that mission orders, ROV tracks, sonar, footage, dive logs, tooling records, cargo records or recovery inventories have not been publicly released describe the reviewed public record, not proof that such records do not exist.

READ MORE NORDSTREAM NEWS AT: 21st CENTURY WIRE NORDSTREAM FILES

SUPPORT OUR INDEPENDENT MEDIA PLATFORM – BECOME A MEMBER @21WIRE.TV

VISIT OUR TELEGRAM CHANNEL

21st Century Wire is an alternative news agency designed to enlighten, inform and educate readers about world events which are not always covered in the mainstream media.

Source: https://21stcenturywire.com/2026/08/14/nord-stream-trials-problems-appear-in-germanys-andromeda-story/