The Nord Stream blasts turn Europe’s seabed into a security problem

The first public warning came from Denmark’s energy authorities on 26 September: pressure had fallen in a Nord Stream 2 pipeline, gas was escaping southeast of Bornholm and ships should keep clear. By the end of the week, four leaks had been identified across Nord Stream 1 and 2. Seismic records indicated explosions. An infrastructure problem had become a suspected attack before investigators could inspect the damaged pipes.

On 28 September, the EU said available information pointed to a deliberate act. NATO’s North Atlantic Council followed the next day with a statement describing sabotage and promising a determined collective response to deliberate attacks on allied critical infrastructure. Neither statement named a perpetrator. That omission reflected the central limitation of the public evidence: governments could identify a type of event before establishing who was responsible.

The pipelines run from Russia to Germany beneath the Baltic Sea, and the damage lies in the Danish and Swedish exclusive economic zones. Neither system was delivering gas to Germany when the leaks occurred. Nord Stream 1 supplies had already stopped; Nord Stream 2 had never entered commercial operation. Both nevertheless contained pressurised gas, which was now entering the sea and atmosphere.

For Europe, the immediate shock was therefore larger than the loss of a running supply line. The explosions demonstrated that a submerged asset could be disabled in a region crowded with commercial shipping, military activity and the energy connections on which governments were increasingly relying. Norway promptly increased security around its own installations. The task was to protect what still worked while finding out what had happened.

Four leaks, two explosions, no public attribution

Denmark and Sweden set out their initial assessment in a letter dated 29 September to the UN Security Council. They reported two explosions on 26 September and damage producing four leaks, two in each country’s exclusive economic zone. The seismic magnitude suggested force equivalent to several hundred kilograms of explosive. Their assessment ruled against an ordinary accident without presenting a completed forensic account.

Those findings leave several distinct questions. The number of visible leaks is not necessarily the number of charges or the number of people involved. Seismic signals can help establish timing and scale, but they do not identify a vessel, diver or command authority. An investigation will need to connect physical evidence at the sites with movements and communications before responsibility can be established.

The geography complicates the response. An exclusive economic zone gives a coastal state particular rights and responsibilities, but it is not identical to territorial waters. Denmark and Sweden have direct interests in the damage and environmental consequences; Germany is the receiving country; companies own and operate the assets. Security, maritime administration and criminal investigation consequently do not fall neatly under one institution.

The safety problem also comes before the inspection problem. Gas bubbling to the surface creates risks to shipping and aviation in the immediate area. Restricting access protects people, while the continuing release makes work around the damaged structures harder. A delay in examining the seabed should not automatically be interpreted as an unwillingness to investigate when the site itself is hazardous.

The EU and NATO chose language that kept protective action separate from attribution. Their statements supported investigation, condemned deliberate damage and warned against further attacks. They did not invoke a completed finding that a named state had attacked an ally. That distinction preserves room for a response based on evidence rather than requiring governments to defend an early accusation if later information contradicts it.

Russia denied responsibility and the issue moved rapidly into international accusation. At the Security Council on 30 September, representatives disputed motives and possible perpetrators. The UN briefing stressed that it relied on public information and that inspections had yet to establish exactly what happened. A claim made in the Council is evidence of a government’s position; it is not, by itself, evidence that the claim is true.

There are obvious reasons why different governments might see strategic consequences in the destruction. There are equally obvious dangers in treating a perceived benefit as proof of authorship. A defensible account at the end of September can say that the damage is being treated as sabotage. It cannot identify the people who planned it, how they reached the pipes or who authorised their actions.

The gas had stopped. The politics had not.

Nord Stream 1 had become a central instrument in the summer’s confrontation over energy. Russia reduced flows and eventually kept the route shut, while European governments accused Moscow of using supply as political pressure. The absence of deliveries before 26 September means the explosions did not suddenly subtract an equivalent volume from that day’s German consumption. The storage and replacement-supply problem already existed.

Nord Stream 2 carried a different history. Germany halted its certification process on 22 February after Russia recognised the separatist-held territories in eastern Ukraine. The decision interrupted a project that had divided European governments long before the full-scale invasion. Supporters had presented it as an additional commercial route; opponents argued that bypassing transit countries would increase Russia’s leverage and weaken Ukraine.

Damage to the pipelines now changes the range of future choices. Political leaders cannot assume that restoring a diplomatic relationship would allow flows to restart through the same infrastructure on demand. Repairability, cost and legal responsibility all require assessment. The physical uncertainty makes an already unlikely return to the pre-war energy relationship harder to describe as a simple reversal of policy.

This is a different effect from an immediate shortage. Energy markets price expectations as well as current deliveries. If governments and companies believe other infrastructure could be vulnerable, they may pay more for flexibility, insurance or alternative routes. The security premium can spread to assets that remain undamaged, particularly when replacement capacity is limited.

The warning reaches beyond Russian supplies. Europe is trying to diversify towards Norwegian gas, liquefied natural gas and more interconnected electricity markets. Those alternatives also depend on pipelines, terminals, cables and compressor stations. Moving away from one supplier reduces a political dependency, but it does not eliminate the physical concentration of critical equipment.

On 30 September, EU energy ministers agreed emergency measures intended to reduce electricity demand and redirect some exceptional energy-sector revenues towards support. That meeting was part of the response to high prices already under way, rather than a policy invented after the explosions. The damage added a security dimension to a debate that was already testing solidarity over who should bear the costs of the winter.

For households and industrial users, these distinctions matter. A pipeline incident, a supplier’s refusal to deliver and an electricity-pricing rule can all influence a bill through different channels. Treating every price change as the direct result of the explosions would obscure the choices governments can still make on demand, targeted assistance and the distribution of scarce supply.

Norway moves to protect the replacement supply

Norwegian Prime Minister Jonas Gahr Støre announced increased security on 28 September. His government was coordinating military and civilian measures with companies responsible for oil and gas installations. He explicitly said there was no concrete indication of a direct threat to Norwegian facilities. The statement paired precaution with an effort to avoid presenting an unverified attack warning as established intelligence.

That balance is important for a producer whose exports now carry more weight in Europe’s supply system. Norway does not need proof that the same attacker plans to strike again before reviewing protection. Equally, a government that announces every precaution as evidence of an imminent threat can amplify the uncertainty it is trying to contain.

Protection requires cooperation with operators because companies hold information that governments cannot reconstruct quickly from outside: pressure readings, maintenance records, system alarms and the locations of vulnerable components. Armed forces bring surveillance and response capabilities. Police and security services investigate suspicious activity. A naval patrol is useful, but it cannot replace those other sources of information.

The scale of the seabed makes continuous physical protection difficult. Pipelines and cables extend far beyond the perimeter of any platform or terminal. A credible approach must therefore combine observation of unusual activity with the ability to isolate damage, maintain alternative routes and repair essential connections. Trying to place a guard over every kilometre would be an expensive description of an impossible task.

There is also a difficult information-sharing problem. Publishing detailed vulnerabilities would help potential attackers. Keeping all information inside each operator would prevent governments and neighbouring systems from seeing a pattern. The useful middle ground is protected exchange among companies, regulators and security agencies, with public communication focused on service continuity and confirmed incidents.

Sweden’s position illustrates the value of cooperation before formal alliance membership. It has applied to NATO but remains outside the treaty’s full guarantees at the end of September. The North Atlantic Council statement was associated with the invitees. Shared exposure in the Baltic already requires practical coordination, even while accession procedures continue.

The blast sites thus create a test of European institutions with overlapping responsibilities. NATO can coordinate military awareness and deterrence. The EU can work through regulation, cross-border markets and infrastructure policy. National authorities retain central investigative and protective roles. The response will be weaker if each assumes that the submerged location makes the problem someone else’s responsibility.

The environmental calculation is still provisional

The Danish Energy Agency initially calculated a worst-case release of about 778 million standard cubic metres of natural gas from the affected systems. It was an estimate of the gas that could escape, not a measurement of the final atmospheric release. The distinction matters because the amount remaining in the pipes, the duration of leakage and what happens to gas in the water affect the ultimate assessment.

Methane is a powerful greenhouse gas, so an uncontrolled release has consequences beyond the immediate safety zone. Yet early comparisons expressed in carbon-dioxide equivalents depend on the period over which warming is calculated and on assumptions about the quantity emitted. Presenting the agency’s worst-case figure as a completed environmental audit would give provisional arithmetic a certainty it does not have.

Environmental monitoring and forensic investigation will need access to some of the same areas for different purposes. One seeks to measure the release and local consequences; the other seeks to establish the mechanism and responsibility for damage. The evidence standards are different, and progress in one inquiry should not be mistaken for resolution of the other.

The eventual repair question has further layers. Engineers will have to assess the condition of the pipes, including the effect of seawater entering damaged sections. Owners and governments will face costs, permits and disputes about the future use of the routes. At this point there is no verified basis for declaring every line permanently unusable or promising that restoration would be straightforward.

What the first week can establish

By 30 September, the public record supports a relatively firm chronology: explosions on 26 September, multiple leaks, restrictions around the sites, European statements treating the damage as deliberate and national authorities preparing investigations. It also supports a clear list of unknowns: attribution, the operational method, the final volume released and the extent of repairable damage.

Investigators will also need to preserve the distinction between intelligence assessments and evidence suitable for legal proceedings. A government may have grounds for suspicion that it cannot disclose without exposing a source. A prosecutor must still establish a chain connecting an action to an identifiable suspect. Conflicting public messages can arise from those different standards without proving that either process has been abandoned. For now, the responsible benchmark is whether authorities can substantiate what they say, not how quickly they offer a politically satisfying name.

Governments do not have to wait for every unknown to be resolved before protecting other facilities. They do need to distinguish that precautionary work from punitive action aimed at a particular perpetrator. The first can rest on demonstrated vulnerability. The second requires a defensible account of responsibility and a political decision about what response would achieve.

The most consequential early decision may therefore be whether Europe treats the explosions as an isolated dispute about a controversial Russian project or as a warning about the infrastructure supporting its own replacement strategy. Norway’s response suggests the latter. The next evidence will come from the seabed; the immediate policy work has already moved to the assets that remain in service.