In the first half of September 2022, a Greek-flagged tanker sailed eastward from the Dutch port of Rotterdam, into the Baltic Sea and a busy channel plied by dozens of ships weekly en route to major German, Russian, and other Baltic ports.
Marine traffic tracking data showed the tanker stopped east of a Danish island, drifted for nearly a week in the same location, then continued its journey east.
About two weeks later, a series of undersea explosions erupted at nearly the same location, destroying parts of the Nord Stream 1 and 2 pipelines, major conduits for Russian natural gas deliveries to Germany and points beyond in Europe.
The revelations about the tanker and its route were made initially by a Finnish newspaper and then last week in an investigative report by Denmark's public broadcaster.
Along with revelations that German police had searched a yacht chartered in a German port by people who reportedly showed Ukrainian passports, the details provide new pieces to the mysterious puzzle of what caused the undersea blasts and who might be responsible – but fall short of a solution.
Here's what you need to know.
What Exactly Happened With The Pipelines?
For years, the Russian-backed pipelines had been a point of contention between Europe and the United States, which warned that they deepened Europe's dependence on Russian energy. Ukraine also was a loud and persistent critic of the project; Kyiv stood to lose valuable revenues from Europe-bound Russian pumped gas through Ukraine's sprawling pipeline network.
Gas supplies had been curtailed since the beginning of Russia's large-scale invasion of Ukraine in February 2022, which led to a drastic shift by nearly all European countries away from Russian energy. The pipelines were not operational at the time of the explosions, but they did contain gas.
On September 27, Swedish scientists said they had detected seismic waves from explosions a day earlier that were pinpointed to a site on the Baltic seabed more than 100 meters beneath the surface.
Denmark's military later released video of a bubbling swirl of gases on the sea surface over the site.
Western authorities eventually concluded that the pipelines had been partially destroyed by explosives. U.S. officials called the blasts sabotage and European authorities later said that the sophistication of the incident -- in particular the depths at which the explosives would have been placed -- pointed to a state actor with access to complex diving equipment and detonators.
And There's A Greek Tanker Involved?
Last month, the Finnish newspaper Verkkouutiset published a report based on marine tracking data; like airplanes, most commercial ships around the world carry transponders that allow parent companies or maritime insurers or law enforcement agencies to track their whereabouts.
The data homed in on the Minerva Julie, a 183-meter Greek-flagged oil and chemical tanker that departed the North Sea port of Rotterdam on September 2. It sailed into the Baltic, north of the Danish island of Bornholm, and three days later it stopped moving eastward.
For the following week, the tracking data shows, the ship drifted back and forth, with engines on and off, in close proximity to the site where the blasts erupted two weeks after that.
According to the Danish broadcaster TV 2, the ship drifted within 500 meters of the site several times and passed over the pipelines more broadly 29 times.
The ship then continued east, stopping in Tallinn, the Estonian capital on September 14, and then later sailing to St. Petersburg, Russia.
Maritime experts said it was not necessarily unusual that a ship would stop mid-journey and drift in one location for some time -- for example, awaiting new sailing orders from corporate owners.
In a response to a request for comment, the Athens-based owner of the Greek tanker, Minerva Marine, confirmed that the ship had drifted in the location detailed by marine data and said it had been awaiting voyage orders.
"Once voyage orders were received, the vessel proceeded to her next port of call, Tallinn, Estonia," it said in an e-mail to RFE/RL after the initial publication of this article. "Drifting in a sea area awaiting voyage orders is standard shipping practice and there was nothing unusual in this instance."
TV 2 also highlighted previous reporting from Russian journalist Aleksandr Nevzorov that said one of the co-owners of Minerva Marine had met in the past with top Russian officials, including President Vladimir Putin. And Ukrainian officials have asserted the company has shipped Russian coal and oil in violation of European Union sanctions.
Russia has denied it was behind the blasts.
What Were German Authorities Doing With the Chartered Yacht?
This past January, German federal authorities searched a cruising yacht that had been chartered in the German post of Rostock. The ship was later identified as the Andromeda, a 15-meter cruising yacht.
The search of the yacht, German investigators said in a March 8 e-mail to RFE/RL, was conducted based on suspicions that "the vessel in question may have been used to transport explosive devices" involved in the explosions.
"The evaluation of the seized traces and objects is ongoing," they said. "Reliable statements, in particular on the question of state involvement, cannot be made at the present time."
German media, including Der Spiegel and Die Zeit, reported that the Andromeda had been chartered by a group of six people, some of whom showed Ukrainian passports for identification, and set sail from the German port of Rostock on September 6. The entity that chartered the ship was a Polish company owned by two Ukrainians, Die Zeit said.
Investigators also found traces of explosives on a table in the yacht's cabin.
Die Zeit, which collaborated with German broadcaster ARD and other media, did not specify sourcing for its report, but said its sources were based in several countries.
The newspaper Sueddeutsche Zeitung reported on March 12 that some in the group may have shown Bulgarian passports.
The Andromeda, which is small enough to not carry marine tracking beacons, is believed to have departed Rostock on September 6 and made two stops over the following days: in another German port, Wiek, and on another Danish island, Christianso, Die Zeit and The Wall Street Journal reported. Christianso is located about 30 kilometers northeast of Bornholm.
There is no known indication of a connection between the Minerva Julia and Andromeda.
So, Who Did It Then?
That's still very much unclear.
German media have reported that not long after the explosions, an unnamed Western intelligence agency communicated to European security agencies that a Ukrainian commando group was responsible.
But according to Sueddeutsche Zeitung, the intelligence, which it said came from the CIA, was based on "intercepted Russian communications" and was discounted.
The New York Times, citing unnamed U.S. officials, reported on March 6 that intelligence suggested that a "pro-Ukrainian group" was responsible and that the explosives had likely been placed with the help of "experienced divers who did not appear to be working for military or intelligence services."
"The review of newly collected intelligence suggests [the possible perpetrators] were opponents of President Vladimir Putin of Russia, but does not specify the members of the group, or who directed or paid for the operation," the report said.
The Ukrainian government had previously denied any involvement in the explosions. The new reporting from the Times in particular prompted a retort from a top adviser to Ukrainian President Volodymyr Zelenskiy, Mykhaylo Podolyak, who repeated that Ukraine had nothing to do with the incident.
The Times of London, meanwhile, on the same day that German investigators confirmed the search of the Andromeda, pointed the finger at an "influential figure" who bankrolled the sabotage operation "involving a yacht, elite divers, forged passports and the procurement of shaped explosive charges only available to the gas and oil industry with a specific license and at great cost."
"If you looked at these details, like them going out there, with a small yacht, during September conditions, in this area, it all sounds a little bit, well, adventurous," said Julian Pawlak, a research associate at the German Institute for Defense and Strategic Studies in Hamburg.
Pawlak also cited earlier reports from European officials as saying that it would take several hundred kilograms of explosives to cause the damage observed on the pipelines.
"How this would have been done would have been interesting, well, interesting," he told RFE/RL.
"It sounds like they would be a professional group with professional IDs and all, and yet they seem to be not so professional," he said. "They leave such blind evidence on the table?"
What About Seymour Hersh?
In early February, Hersh, a prize-winning American investigative journalist, published a report in his blog on Substack that claimed the Nord Stream pipelines were bombed by the United States.
The February 8 article drew wide attention and was embraced quickly by Russian officials -- but it also drew widespread criticism for, among other things, its reliance on a single anonymous source.
Open-source researchers from Bellingcat and other investigative outfits also pointed to marine traffic data and other details to argue that Hersh's article had major holes.
In an interview published on March 13, Nikolai Patrushev, who is the head of Putin's Security Council and known for espousing conspiracy theories about the West, again denied Russia's involvement and suggested, without providing evidence, that either the United States or Britain was behind the blasts.
Others who have voiced suspicion that the United States was responsible have pointed to a statement by U.S. President Joe Biden, who just days before Russia's February 24, 2022, invasion, said: "If Russia invades, that means tanks and troops crossing the border of Ukraine again, then there will be no longer a Nord Stream 2. We will bring an end to it."
On February 8, White House National Security Council spokeswoman Adrienne Watson dismissed the allegation in Hersh's article as "utterly false and complete fiction."
Former Polish Foreign Minister Radoslaw Sikorski, meanwhile, posted a photo of the blast site on Twitter on the same day as reports first emerged saying: "Thank You, USA." He later deleted the tweet.
