The Poseidon Attack on Nord Stream: Part II

This image combines three images from the night 25-26 September: A P-8A Poseidon leaving Keflavik. It is turning off its transponder at 22:53 UTC (00.53 CEST). It turns on the transponder north of Scotland. At 00.03 UTC (the time of the first explosion) the P-8A is southwest of Norway. Exactly one hour after the explosion, the aircraft is close to Bornholm, Denmark. One can see the tanker aircraft BART12 in yellow that will refuel the P-8A. One can see the Sikorski helicopter hovering over the southeastern Baltic Sea.

On “FlightRadar24”, on 26 September, a US P-8A Poseidon with “masked identity” (but registered as a US aircraft) leaves Keflavik 00:30 CEST and goes towards east. It turns off its transponder at 00:53 CEST. It then passes over the Faroe Islands and turns on its transponder, passes over Shetland Islands, and then southwest of Norway at the time of the first explosion, at 02:03 CEST, at an altitude of 10,000 meters. The P-8A passes over Denmark at 02:35-02:50 CEST and goes in over the Baltic Sea, towards the southern tip of Sweden. It then turns east towards Bornholm. It passes close to the site of the first explosion, almost exactly one hour after this explosion. The same US Sikorsky helicopter is still hovering over the southeastern Baltic, at the time when the P-8A is over the Baltic Sea. The helicopter would definitely have registered the explosion. An alternative hypothesis would be that the helicopter actually triggered it.

The P-8A Poseidon enters Polish territory at about 03:15 CEST. It goes down to an altitude of 7,300 meters to be refueled for more than an hour by a US tanker aircraft BART12 (KC-135R), which is coming up from US Spangdahlem Air Base in western Germany (close to Luxemburg). The BART12 left the base (to refuel the P-8A) exactly at the time of the first explosion, at 02:03 CEST, and at the time when the P-8A was approaching southern Norway (BART12 landed again at Spangdahlem 05:45). At about 04:30 CEST, the Poseidon is refueled and went back circling over the Baltic Sea in the area east of Bornholm from the position of the detonation in the west, to the Russian Baltic Fleet Headquarters in Baltiysk further east. The P-8A is patrolling at low altitude until the transponder is turned off at 05:10 CEST. Three hours later, at 08:26 CEST, the transponder is turned on again. The aircraft is still operating at low altitude over the southern Baltic. Finally, it goes back towards Keflavik passing over the first explosion site at 09:00 CEST, and immediately after passing this position it starts to climb to 10,000 meter and follows the same route as it did when it arrived passing over Denmark and south of the southern tip of Norway and then over Shetland Islands at 10:35 CEST. It turns off its transponder at 11:25 approaching Keflavik. It then turns it on again before landing at Naval Air Station, Keflavik, where the US operates its P-8A Poseidon.

This Poseidon was patrolling the area east of Bornholm for hours in the early morning after the most devastating attack on civilian infrastructure ever. The decision about an extended operation in southern Baltic Sea, using a tanker aircraft to refuel the P-8A, preceded the first explosion, because the order to send a tanker aircraft to refuel the P-8A was given already before the first explosion took place. The P-8A departed Keflavik with the task of patrolling the area after the upcoming explosion. While the first US Poseidon from Sigonella Naval Air Station may have had the task to drop a sonar buoy that sent the signal triggering the explosion, the second US Poseidon had definitely the task to confirm the destruction of the pipeline and to probe the fallout after the explosion. This was the most serious attack in the Baltic Sea in peacetime ever.

This image is from exactly the same moment as the last image, at 01:02 UTC (03:02 CEST), but it shows the tanker, BART12, approaching the area to refuel the P-8A Poseidon. One can also see the P-8A (now in yellow) approaching Bornholm. One hour earlier, at the time of the first explosion, the P-8A was close to south Norway, while BART12, at this very moment, took off from Spangdahlem Air Base to refuel the Poseidon.

Left: The P-8A (in red) has been coming in from Bornholm in over Poland, where it has been circling for an hour while being refueled by a US BART12 tanker aircraft (in yellow). Right: The P-8A has left the tanker and gone out over the Baltic Sea. It descends to 2000 meters (shown by the light turquoise color of the trail) and then, at 03:00 UTC (05:00 CEST), it goes to the site of the explosion and turns off its transponder.

Left: The P-8A Poseidon turns on its transponder again at 08:26 CEST after patrolling southern Baltic for three hours. It passes exactly over the site of the first explosion, still at low altitude, at 07:00 UTC (09:00 CEST). Right: Immediately after having passed the site of the explosion at a low altitude (a turquoise to light blue trail) at 09:00 local time, the P-8A climbs to 10,000 meters (dark blue to violet trail) in ten minutes. There is a Swedish Air Force exercise with six Saab SK 60 in southern Sweden and the US signal intelligence aircraft RC-135W callsign JAKE11 is passing below on its way to the Baltic States to make a three and a half full circle around the Russian Naval Headquarters in Baltiysk. 

Right: The P-8A Poseidon returning to Keflavik on 26 September over Bornholm (09:00 CEST), over Denmark, the Shetland Islands (10:35 CEST) and it is approaching Keflavik at 08:45 UTC (10:45 CEST), while soon turning off its transponder. Right: Before landing in Iceland, it turns the transponder on again and lands at Keflavik at 12:40 CEST.

Three US P-8A Poseidon at the US Naval Air Station Keflavik in November 2019 (Wikipedia).

At 06.00 CEST, two US Army signal intelligence aircraft RC-12X Guardrail with callsign YANK01 and YANK02 went up from the Lithuanian base Siauliai to patrol the area between the Russian enclave (including the Baltic Fleet Naval Headquarters in Baltiysk) in the west and the Belorussian border in the east for up to six hours. At 08:00 CEST, a large US signal intelligence aircraft RC-135W River Joint with the callsign JAKE11 leaves its base in Britain together with a US tanker aircraft KC-135T. Both aircraft continues to Poland, where the RC-135W is refueled by the tanker, and at 10:45 CEST the RC-135W goes out over the Baltic Sea close to Baltiysk. At 11:15: it is going in over Lithuania. It follows the Russian border through Latvia and Estonia up to the Bay of Finland and back down to Poland. When the RC-135W is on its way back over Estonia, a Norwegian Falcon Jet (an intelligence and electronic warfare plane) with the callsign RAVEN77 is coming in from the north. “RadarBox” flight tracking shows that it departed Oslo at 11.30 CEST. It passed Sweden just north of Stockholm, went over the Baltic Sea and the Bay of Finland, and then in over Estonia, Latvia, and Lithuania. The Norwegian Falcon Jet landed in Warsaw, Poland, at 12.07 CEST. It has, however, for some reason been removed from “Flight-Radar24”. A Swedish intelligence aircraft SVF623 leaves Linköping at 10:30 CEST and patrol the coastline back and forth from the Russian enclave (and Naval Headquarters in Baltiysk) in the south to Estonia in the north at high altitude and for three hours. Between 13.00 and 18.30 CEST, a US Army intelligence aircraft Artemis with the callsign YANK03 goes up from Siauliai in Lithuania to replace YANK01 and YANK02 that had patrolled the same area in the morning. A NATO AWACS E-3A Sentry with the callsign NATO06, leaves Britain via Poland. After being refueled by another US tanker aircraft, it goes in over Lithuania at 13:30 (just after the RC-135W had passed out). The AWACS then circles over Latvia for the surveillance in over Russia. At the same time, the British large secretive RRR9911 KC2 Voyager enters Latvia from the Baltic Sea and flies over Latvia for a couple of hours until it returns to the UK. For several hours, a US Redeye6 E-8C (surveillance and tactical command aircraft based in western Germany) and with the callsign REDEYE6 is patrolling the area south of Baltiysk. After 16:15 CEST, the RC-135W has completed 3.5 full circles around the Russian enclave of Kaliningrad and Baltiysk, before the aircraft returns to Britain, while the AWACS leaves Latvia and Lithuania for Poland and then Germany.

The Baltic Sea, southern Sweden, northern Poland and the Baltic countries at 14:46 UTC (16:46 CEST) on 26 September. Left: a RC-135W (JAKE11) circling around Kaliningrad and Baltiysk after having gone up along the Russian border to the Bay of Finland and back (with more than three times a full circle around Baltiysk). Right, an E-3A AWACS, at the same moment, after having gone up over Lithuania and Latvia to cover the Russian reactions. Over the Baltic Sea, one can see the Royal Air Force RRR9911 at Bornholm returning from circling over the Baltic States and a small Polish Hercules aircraft returning from Keflavik to Poland. All four aircraft can be seen in the same positions in both images. This is two hours before the second and larger explosion at 17.04 UTC (19.04 CEST).

A Norwegian Falcon Jet DA-20 ECM (intelligence & electronic warfare) with the callsign “RAVEN77” has been following the Russian border and is landing in Warsaw at 12:07 UTC (14.07 CEST). A British intelligence aircraft RRR9911 is approaching Estonia from Latvia. An AWACS callsign “NATO06” in Latvia at the Russian border. The US Army intelligence aircraft Artemis with the callsign “YANK03” has just passed over the border to Lithuania. The US signal intelligence aircraft RC-135W with callsign JAKE11is on its way to make another full circle around the Russian enclave with its naval headquarters in Baltiysk. The US surveillance aircraft and command center REDEYE6 is approaching the enclave followed by the US tanker aircraft NACH071. The Swedish intelligence SVF623 is just leaving the area.

These three images are all from 10:48 UTC, 26 September; from left: “ADS-B Exchange”, “RadarBox” and “FlightRadar24”. The two first two show a Norwegian Falcon DA-20 ECM, callsign “RAVEN77”; a US signal intelligence aircraft RC-135W, callsign JAKE11; the NATO AWACS (airborne warning and control system), callsign “NATO06”; a US surveillance and tactical command aircraft REDEYE6; and the Swedish intelligence and surveillance aircraft SVF623. “FlightRadar24” and “RadarBox” also show a couple of Latvian planes. But “FlightRadar24” has apparently removed the Norwegian Falcon Jet. “RadarBox” shows its identity: DA-20 041 Hugin. YouTube and “RadarBox” also show the Norwegian Falcon DA-20 053 Munin arriving and leaving Cambridge on 22 September (see above). But “Flight-Radar24” does not show any of them. There must have been a reason for that. There may have been a request from an intelligence service, but nothing indicates that neither Hugin nor Munin, both retired on 30 September 2022 and replaced by the Norwegian P-8A Poseidon in 2023, had been used for dropping a sonar buoy to trigger the explosives in the Baltic Sea. In Nordic mythology, Hugin and Munin are the two ravens collecting information and sitting on the shoulders of the old Norse God Odin.

At 17:45 CEST, another AWACS, callsign “NATO40”, goes up from Geilenkirchen Air Base in Germany at the border to the Netherlands. It patrols the area east of Luxemburg at a low altitude (800 meters) and at low speed (125 kts). At 18:50 CEST, however, the AWACS suddenly goes northwards towards the Baltic. In less than ten minutes, it climbs up to an altitude of 8000 meters with a speed of 480 kts. It is accompanied by a tanker US KC-135T. When reaching the Baltic Sea at 19.30 CEST (half an hour after the second explosion), it turns off its transponder. For three hours until 22:40 CEST, it apparently covers the Baltic Sea after the most devastating explosion in the Baltic Sea ever. It must have received an order to go to the Baltic at 18:50, 10-15 minutes before the explosion took place. We have to ask why this AWACS was in such a hurry to go up to the Baltic Sea. It seems that someone had foreknowledge about the upcoming explosion at 19:03-19:04 CEST.

Left: The NATO AWACS with the callsign NATO40 approaching the Baltic Sea at 19:25 CEST (17:25 UTC) after having left its patrolling area close to Luxemburg (turquoise trail). Sunndenly, at 18:50 CEST, it increases both speed and altitude (dark blue trail) and goes straight north towards the Baltic 10-15 minutes before the most devastating terror attack ever in the Baltic Sea (see map to the right). The “red flight” passing Munich is the US P-8A Poseidon returning from Nordholz (Cuxhaven) to Sigonella, Sicily. Right: Nord Stream 1 & 2 east of Bornholm and the two positions for the explosions.

The US Seahawk (Sikorski) helicopter continued to hover in the area of the southeastern Baltic Sea outside Baltiysk until the US P-8A had left the area. On the 27 September, a NATO AWACS did also go up along the Russian border in Lithuania and Latvia, while a British RRR9912 went in over the Baltic, over Bornholm Island and back. For several days, the US RC-135 went in over Poland and Lithuania, while completing one or two full circles around Baltiysk, but not three or four as on 26 September. During the month preceding the destruction of the Nord Stream pipelines, it was a certain US-UK intelligence activity around Baltiysk but more limited compared to the massive activity on 26 September with many intelligence aircraft patrolling the area. On 26 September, there were also some Swedish and Norwegian activity. There had been two Swedish intelligence flights SVF623 and S100D Argus (Swedish AWACS with the callsign C604) covering the area from Bornholm to Baliysk on 22-24 September, while two Swedish naval vessels went to the two specific positions of the upcoming explosions. The Swedish ships had turned off their transponders for 22 hours (see main article).

Left: An AWACS E-3A Sentry over Britan, where the first AWACS came from on 26 September. The disk on the fuselage is a rotating radar dome. Right: A P-8 Poseidon dropping sonar buoys with parachute, so when the buoy hits the surface, the speed is the correct one.

Some concluding remarks

Seymour Hersh argued that it was a Norwegian Poseidon that had dropped a sonar buoy that sent the signal that triggered the timers of the bombs that took out the Nord Stream pipelines, but the nationality of the two P-8A aircraft operating over the Baltic Sea 22-26 September was definitely American. The first P-8A arrived from the US Naval Air Station Sigonella in Sicily and was registered as a US airplane. This could not have been a Norwegian P-8A (from Evenes northern Norway) nor a British Poseidon from Lossiemouth Royal Air Force Base in northern Scotland. The latter was also identified, not as a P-8A but as a Poseidon MRA1. “FlightRadar24” registered the British and Norwegian planes as such. The second P-8A that operated over the Baltic Sea these days was also registered as a US aircraft and came from and returned to Keflavik Naval Air Station, Iceland, from where the US Navy operates its Poseidon. This P-8A would accordingly also be a US aircraft, and the tanker aircraft that refueled it was definitely American. This latter P-8A arrived over Bornholm one hour after the explosion. Its task was rather to confirm the explosion and estimate the fallout from it.

The first P-8A could easily have triggered the explosion by dropping a sonar buoy on any of these three nights that preceded the explosions. The buoy would send a coded signal to the timers that triggered the bombs (usually the sonar buoy is dropped with a small parachute; the altitude doesn’t matter, see photo above). This P-8A passed over Bornholm plenty of times. Only a couple of people on the plane had to know about the drop. The P-8A had the capacity to drop more than a hundred sonar buoys. The fact that the P-8A turned off its transponder in the area east of Gotland could make us conclude that its “main task” on 22-25 September was in this area, but that could easily have been a cover. One might also argue that the Americans could have used the Seahawk helicopter that patrolled the area to drop the sonar buoy. The US Seahawk (Sikorsky MH-60R) had been hovering for hours and days over the southern Baltic Sea, during the P-8A’s passages over Bornholm. The Seahawk could very likely have picked up the signal from a sonar buoy dropped by the P-8A, and it would have been able to confirm the signal from the sonar buoy that would be received by the timers, which would trigger the bombs. The Americans would then know exactly when the first and second explosion would take place.

While the P-8A Poseidon is going back over Bornholm, the Sikorsky MH-60R Seahawk is patrolling the area north of Gdansk at an altitude of 700 meters for hours similar to what it did all these nights. The image is from 24 September 01:26 UTC (03:26 CEST). It also shows the P-8A approaching Bornholm while returning to Nordholz, Germany

However, the implications of this are important. A second Poseidon that is ordered to go to the area of the upcoming explosion – the most destructive peacetime attack on civilian infrastructure ever – a couple of hours before this explosion took place, indicates US collusion. When this P-8A arrives over Poland to be refueled by a tanker aircraft, which would enable it to patrol the over the Baltic Sea for hours, this points definitely to a US pre-knowledge and responsibility. When the tanker departed from its base to carry out this task, this was exactly at the time of the first explosion. This can only be explained by the need to confirm the destruction and to probe the fallout from it (see main article). The planning of this operation must have been made long before the pipelines were destroyed. This is definitely evidence of a US responsibility.

Of course, this was an extremely delicate operation, and one could easily imagine that the US wanted to use a Norwegian Poseidon that would turn off its transponder already from start to go “invisible” towards the Baltic Sea. However, if the US wanted “plausible deniability” and in the final analysis wanted to let the Norwegians “pull the trigger” as a secret contribution to a US operation, then it is not logical that the Americans show up with their own P-8A over the Baltic Sea and over Bornholm twice every night before the explosions. This does not make sense. Everyone will point to the Americans. The reason why the US would use a Norwegian P-8A would not be that Norway was more closely located. The only reason would be that the US needed “plausible deniability”, to be able to blame the Norwegians, if necessary, if something would go wrong. But then, you cannot operate a US Poseidon over the Baltic days before the destruction of the pipeline. This would rather exclude a Norwegian Poseidon or any Norwegian aircraft.

The inauguration of the Baltic Pipe pipeline on 27 September in Szczecin: Polish Prime Minister Mateusz Morawiecki, Danish Prime Minister Mette Frederiksen and Polish President Andrzej Duda, but one leader was apsent: Norway’s Prime Minister Jonas Gahr Støre, who had cancelled his participation five days earlier. He prioritized a school competition (the day before) and to look into some figures in the budget. It became impossible for him to celebrate the destruction of the Nord Stream pipeline.

Two questions:

Firstly, why would the Americans use their own P-8A Poseidon, when they usually prefer to use someone else’s aircraft for the purpose of “plausible deniability”? Why did the US operate their own Poseidon in this very public way? It had been much more logical if they had used a cover, a Norwegian Poseidon (see main article). But let us look at the chronology. Perhaps someone in Norway claimed that they were not ready for the operation. The three P-8A Norway had received from the US Navy in Spring 2022 had had technical problems. They needed specific lubricating oils from the US Navy. Nothing could be bought on the European market. The early training with the Norwegian aircraft could not start until June, three months after schedule. During the summer vacation from late June to early August, there may have been less opportunities for training. In late August, in mid-September and a week later, the Norwegians made some shorter tours with two P-8A to Finnmark in the north, to areas around Evenes and one to mid-Norway and one to southern Norway. Norway would not yet have had a crew able to fly its own aircraft. Perhaps some Norwegians wanted to use this fact to limit their involvement. To participate in this kind of operation would be in sharp conflict with traditional Norwegian policy. To destroy the Nord Stream pipelines would definitely be a declaration of war against Russia and against an allied, Germany. But if Norway backed out, the US would then have to go for a “Plan B” to use their own P-8A Poseidon, which would even physically point to the United States. This would also explain why a US Hercules aircraft, a week before the US three-night operation over the Baltic Sea 22-25 September, had to go seven hours from Sigonella to Andenes (northern Norway) and back. Someone in the US Poseidon crew at Sigonella had to go physically to fetch the very delicate sonar buoy from the Norwegians under supervision of US officers coming in on a US Poseidon aircraft from Keflavik. At least does this explanation make sense of some very strange American flights.

The fact that the pipelines were taken out the day before the inauguration of the Norwegian-Polish pipeline (the “Baltic Pipe”) must be explained in one way or another, and it is a fact that one couldn’t, from a Norwegian point of view, have chosen a day worse than this. To destroy the Nord Stream pipeline the day before the inauguration of the Baltic Pipe was the “ultimate insult” to Norway. The participation of the Norwegian Prime Minister Jonas Gahr Støre at the Baltic Pipe inauguration on 27 September would appear as a celebration of the destruction of Norway’s major gas competitor (see main article). Perhaps someone, perhaps even Prime Minister Støre himself had backed out, and said that Norway was “not ready for the task”, because the US had handed over their P-8A too late. On 22 September, five days before the inauguration ceremony for the Norwegian-Danish-Polish “Baltic Pipe” in in Szczecin in Poland, after an almost full day tour with the US Secretary of the Navy Carlos Del Toro at the US Norfolk Naval base outside Washington and after his meeting with US State Secretary Anthony Blinken, Støre cancelled his participation. Perhaps the date, the day before the inauguration in Poland, was chosen to really punish Norway.

Secondly, why did the second aircraft need to refuel over Poland? The P-8A Poseidon is said to have a ferry range of 7,200 km without refueling. To fly from Iceland to the southern Baltic Sea and back did not necessitate refueling. Therefore, to circle for hours over the southern Baltic in the night and early morning would already have been part of the plan, and the tanker aircraft that departed from its base in the western Germany, actually exactly at the time of the first explosion, was obviously tasked with refueling the P-8A for an extended operation. This would have been decided beforehand. The P-8A left Keflavik for the Baltic Sea almost two hours before the first explosion took place in order to confirm the destruction of the pipeline, to probe the fallout from the explosion and perhaps also to survey the southern-southeastern Baltic Sea in an attempt to find a Russian submarine or ship in the vicinity that one possibly could blame for the takeout. The only credible reason for the P-8A to circle for more than four hours over the southern Baltic Sea, in the night and early morning hours, after the single most devastating sabotage operation ever, would be that this aircraft was going to probe this sabotage. The P-8A patrolled the area east of Bornholm at a low altitude, for hours, and immediately before returning to Keflavik, after the aircraft passed over the site of the explosion for the last time, it climbs to 10,000 meters in ten minutes and returns the same way as it had arrived. Its task must have been to confirm the destruction and to probe the area. The plan for the P-8A in the Baltic Sea, including the plan to refuel the P-8A for this very task, was definitely made long before the first explosion took place.

We can now conclude: two US P-8A Poseidon operated over the Baltic Sea these days (one on 22-25 September and another on 26 September). While the first Poseidon may have dropped the buoy that triggered the explosions, the second Poseidon was definitely in the Baltic to confirm the destruction of the Nord Stream and to investigate the fallout from the explosion. The plans for this operation must have been made a long time before the pipelines were destroyed. This is almost certainly evidence of a US responsibility.

The Norwegian role was perhaps less prominent than Seymor Hersh’s sources have told him.