Kyst og Fjord used this image from The Shadow War to show that NRK manipulated their coverage of the trawler Taurus’s passage of the nuclear submarine USS South Dakota. NRK’s manipulation is the basis for the espionage charges and sanctions against Norebo. Picture from NRK.

In connection with the deliberations of the sanctions against the Russian trawler company Norebo in the Faroese Parliament,¹ the company sent a letter to the Foreign Affairs Committee.² Norebo had asked the EU Commission for access to the material on which the accusations against them of espionage and sabotage were based.

The response Norebo received was an evidence package with 18 news articles, nothing else. Several of the articles were machine translated. The EU Commission also stated that in the absence of investigative authority in third countries, the EU authorities had to rely on publicly available information, reports, press articles and the like.

Norebo included a summary of the five main allegations against them: The Norwegian public broadcaster NRK’s claim of espionage by the trawler Taurus, the allegations that the trawler Kapitan Sokolov had assisted the Chinese vessel NewNew Polar Bear in damaging the Balticconnector pipeline, the speculation that the freezer ship Belomorye had operated in a suspicious manner near the gas terminal in Nyhavna in Norway, that the freezer ship Canopus had performed suspicious maneuvering over gas pipes off the Netherlands, and that the old radios found by the Norwegian police aboard the trawlers Ester and Lira in Kirkenes could be used for espionage.

I asked the lawyer representing Norebo if they were willing to share the “evidence list” from the EU Commission. The Commission had placed restrictions on sharing the assessments they had made of the articles, but there was nothing preventing sharing the list of articles itself.

In addition to items in the summary from Norebo, I have also looked into the claim that a Norebo vessel was banned from Dutch ports due to espionage, and the accusation that Russia is running a sabotage campaign in the Baltic Sea.

The primary sources for the espionage allegations against the Norebo are the public broadcasters in Norway (NRK), Belgium (VRT NWS) and the Netherlands (KRO-NCRV/Pointer), as well as the Norwegian news outlet “The Barents Observer” and the Dutch investigative magazine “Follow the Money”. The other articles about espionage activities from the Norebo vessels are reproducing the material from these sources.

I have reviewed the articles that the EU Commission has used as evidence and it is astonishingly easy to show that all the suspicions and accusations are unfounded and wrong.

When drafting the Norwegian Sanctions Act, there were concerns that sanctions Norway agreed to join could be implemented without a sound legal basis.³ To prevent arbitrary punishment - sanctioning - the Act includes a safety valve, the opportunity for the sanctioned party to complain to both the Ministry of Foreign Affairs (MFA) and the government, as well as to file a lawsuit to be removed from the sanctions list.⁴

The EU Commission does not seem to be bothered to investigate whether the suspicions and accusations are real. Another Russian fishing company, Murman Seafood, was sanctioned on similar grounds. They filed a complaint with the Ministry of Foreign Affairs on November 14 and are prepared to take legal action, according to Deputy Director Andrey Roman.⁵

It is unlikely that the Russian fishing companies are not going to prevail if they go to court. If you want to know how I can be so sure - read on:

NRK “The Shadow War”

At the DataSKUP journalist competition in 2024, the fishing newspaper Kyst og Fjord presented work showing that NRK in the series The Shadow War had manipulated the presentation of the trawler Taurus and that NRK lacked basis for their claim that 50 Russian ships could have been engaged in espionage.⁶ We also showed that the claim that the police had found military radios on Russian trawlers was dead wrong.⁷

Afterwards, NRK quietly changed around 20 articles where they previously claimed that “NRK uncovers Russian intelligence from vessels - here the police found military radios”. This text was removed, documentation of what transpired is shown in the appendix section of the reference, a complaint sent to NRK.⁸ They also changed an article where they clarified: “In an earlier version of this article it was stated that NRK has revealed several cases of espionage from Russian vessels. The correct statement is that NRK has revealed that 50 Russian civilian vessels may have been conducting espionage in Norway.”⁹

Strangely, NRK still claimed that they had “revealed that 50 civilian Russian vessels may have been engaged in espionage”. This was despite the fact that we had documented completely normal explanations for all the AIS tracks that NRK claimed were inexplicable, and by that, reason to suspect espionage. The basis for the claim was gone, but surprisingly, it had no bearing on the conclusion. The editor just changed the justification.

To support his view, the editor used the Russian maritime doctrine from 2022 and claimed that it was a threat that many Russian sailors had Norwegian pilot certification. However, only three of the AIS tracks out of the 50 vessels that NRK claimed could have conducted espionage were from the time after the doctrine was published. These three vessels were even inspected by Norwegian authorities without any suspicious findings.⁸ The assumed threat from Russians with pilot certification was that they could use their knowledge of Norwegian internal waters in a possible future conflict.¹⁰

However, the doctrine cannot have been the cause of any espionage activity that allegedly took place before it was released. And the possible future threat from Russians with pilot certifiction cannot justify espionage that has already taken place. The editor’s reasoning is not rational.

NRK was present with the editor and a journalist at DataSKUP to respond to our criticism. They had no objections or comments to the findings. The journalist, Håvard Gulldal, said that he wished that they had knowledge of what was shown when they started the project.¹¹

NRK: The trawler Taurus

NRK published five images with allegedly suspicious AIS tracks and made great effort in making it look suspicious when the trawler passed the nuclear submarine USS South Dakota in 2022. NRK launched their own “mission” shadowing the vessel out of port and past the submarine in their own little boat.

December 2022 - USS South Dakota: “It is dark and difficult to see if Taurus has been spying on the submarine. Was this a successful intelligence operation? What is certain is that Taurus is sailing close enough to the submarine that they can see it, take pictures, or maybe even try to eavesdrop”, the NRK journalist said in “The Shadow War”.

What the journalist did not say was that NRK manipulated the AIS tracks they showed and shot the footage much closer to the trawler than where the trawler actually passed to make it appear suspicious. In the article “The Spy Ships”, NRK also claimed that the coast guard vessel “KV Bison” had met with Taurus in Tromsø and escorted the vessel past the submarine.¹²

I asked the Coast Guard if “KV Bison” had sailed to Tromsø to meet with Taurus as NRK claimed. The answer was no, the vessel had not done so. The vessel sailed to Tromsø to pick up a crew member.¹³

The NRK journalist just made up the story. It would have been incredibly foolish, though, if the Coast Guard had suspected that the trawler was attempting to spy on the submarine, and then dispatched a Coast Guard vessel to escort it past the submarine so that it could spy.

All foreign vessels must obtain permission from the Norwegian Armed Forces Operational Headquarters before sailing through the Norwegian territorial waters.¹⁴ There are two sea routes out of Tromsø and if the Norwegian Armed Forces had concers about the Taurus spying on the “USS South Dakota”, they would obviously have sailed the other way, through the Malangen fjord.

In the video below from the presentation we gave at the DataSKUP competition, we show in detail the manipulation NRK carried out to make the coverage of “Taurus” appear suspicious. This has previously been covered in detail both in the article “The spy ships: NRK’s investigative journalists publishing flawed evidence of Russian espionage”¹⁵ and in Kyst og Fjord’s presentation at DataSKUP.¹⁶

The EU Commission has listed both the TV series The Shadow War¹⁷ and the Spy Ships article in German “google-translate” version in its “evidence” list.¹⁸ In addition, they have included an article from the “Courthouse News Service”¹⁹ and an IntraShip article that uses the publications from NRK as a source.²⁰

The IntraShip article specifically mention that Norebo acquired the Taurus in 2021 when they took over the fishing vessels of the Murmansk-based FEST group. The EU Commission appear to be very selective in the information they rely on in the press articles. They include all the activity of the Taurus that NRK claimed was suspicious from 2016, but ignore the information in the IntraFish article in their own “evidence pack” stating that Norebo acquired Taurus in November 2021.

The notion the NRK journalists have of the Taurus as an espionage vessel regardless of who owns it is very strange. It appear like the journalists believe that the vessel itself is haunted and doomed to be spying regardless of who the owner or the crew is.

What follows next is a brief walk-through of the allegations from NRK towards the Taurus from the period before the vessel was owned by Norebo. Maps with video and images of the AIS tracks are included in the references.

May 2021: NRK: “In the beginning of May 2021, an American nuclear submarine arrived in Tromsø. At the same time, the trawler “Taurus” was passing slowly by. First on the trip south, then when they sail north again the next day.” ²¹

Here NRK was sloppy. They claimed that the “Taurus” passed the American nuclear submarine both on its way south to Tromsø and north again the next day. This is not true. “USS New Mexico” arrived at Tønsnes, with its AIS transmitter on, after “Taurus” had passed Tønsnes on its way south. The arrival was widely covered in the Norwegian press, and the Norwegian Defense forces²² and the US Navy also published close-up photos of the submarine in connection with the visit.²³

The AIS tracks show that the “Taurus” did not slow down during its passage as NRK claimed, neither when they passed on their way south without a submarine quayside, nor when they passed on the way north again, with a submarine at the quay and with a pilot on board.

April 2021: NRK: “The red AIS tracks show that the “Taurus” has entered the Malangfjord and circled there for 24-hours in mid-April 2021.”²⁴

NRK showed tracks from “Taurus” in Malangen. Two other Russian trawlers also circled the fjord during the same period.²⁵ The weather forecast for the area on this day in April 2021 was strong gales, poor visibility and rough seas.²⁶

Following an inquiry to the Norwegian Armed Forces Operational Headquarters, they responded that the vessel had applied for permission to seek shelter in Malangen due to bad weather in accordance with current regulations. In the context of the prevailing weather conditions in the area, they considered the activity of “Taurus” to be part of normal navigation.²⁷

March 2019: NRK: “The AIS tracks of the “Taurus” show that they are sailing out of Malangsfjorden and Hekkingen a few hours after an American nuclear submarine performed a crew change here at the end of March 2019.”²⁸

“Taurus” was docked in Tromsø while the submarine performed the crew change with the MS Skaaskjær from Somarøya in the middle of the main fairway out of the Malangen fjord. The trawler arrived at the scene 9 hours after the submarine had left the area.²⁹ NRK has not given any explanation as to what kind of information they believe it is possible that the trawler may have obtained.

October 2018: NRK: “At one point, it appears that the “Taurus” interrupted the fishing and sailed directly to Ålesund. Coincidentally, there was a major NATO exercise in Trøndelag when the trawler passed.”³⁰

The AIS tracks show that the vessel continued on from Ålesund to Vegsund, a few nautical miles east of Ålesund, and then into the floating dock at the Vegsund slip shipyard³¹. NRK has not given any explanation of what they believe the vessel could have done that is suspicious. The vessel passed well outside the radio horizon of the exercise area and could not even listen to radio communications.³²

April 2016: NRK: “The red AIS tracks on the map show that the trawler “Taurus” sailed north of Andøya in April 2016. During the same period, a shooting exercise was reported in the area.”³³

In the same area, the fishing banks of Sveinsgrunnen and Malangsgrunnen, there were also similar AIS tracks from more than 15 other trawlers. The North Atlantic cod spawns here in March and April. It looks like the fishing was good and that the “Taurus” was doing what the vessel was designed for, the trawler was fishing.³⁴

January 2016: NRK claimed that the “Taurus” could be conducting possible intelligence activity when the vessel headed west towards Andøya.³⁵

The AIS tracks show that the Taurus was met by the rescue craft “RS Dagfinn Paust” outside the pilot station at Andenes.³⁶ The Coastal Administration confirmed that a pilot disembarked the vessel.³⁷

---

The “Taurus” facilitated disembarkation of a pilot off Andøya, it fished with 15 other trawlers north of Andøya, entered the floating dock for repairs at a shipyard near Ålesund, sought shelter from storms in Malangfjorden, was 9 hours too late to witness the crew change on an American nuclear submarine at Hekkinga, passed Tønsnes before an American nuclear submarine docked there in May 2021 and was not met by “KV Bison” in Tromsø harbor.

The nuclear submarines the “Taurus” sailed passed arrived both times at Tønsnes while the vessel was docked in Tromsø. If this was not a coincidence, the trawler must have known the time of the submarines’ arrival in advance. It would have been interesting if NRK had shed some light on how this could have happened.

As you can see, the NRK journalists did not know what they were doing.

NRK: The radios on Ester and Lira

The trawlers “Ester” and “Lira” arrived in Kirkenes in early November 2022 and were inspected by the police. On board both vessels, the police found identical, old radios. The radios were not on the bridge, but were mounted inside the vessels in a locked room. The police took pictures of the radios and sent them to the Norwegian domestic intelligence service, PST. And a “secret source” in the police, conveniently informed NRK about the discovery.

The Finnmark Chief of the Norwegian domestic intelligence service (PST), Johan Roaldsnes, said that these were findings that reinforced the suspicion that espionage was being carried out from ordinary fishing vessels. He justified this by saying that the radios could send and receive military messages and that this provided military opportunities.³⁸

The video below is an excerpt from the presentation by Kyst og Fjord at DataSKUP and show in detail how trivial it would have been for both PST and NRK to verify the information about the radios.³⁹

We uploaded the image of the radio into the Russian search engine Yandex. The search immediately showed that the radio was on display in several museums. On the “radioscanner.ru” page, the name of the radio was written; “Циклоида”, CYCLOID radio receiver.⁴⁰ Both the Cycloid model and the almost identical Sibir model were made for the Soviet deep-sea fishing fleet.⁴¹ Production of the radio began in 1975 and it was still in production when Lira and Ester were built in 1989 and 1993, respectively.

The “Fishing Industry Fleet Reference Book” was published by the Soviet Ministry of Fisheries in 1990 and contain technical data for 119 vessel types. Among them is the Ester⁴² and Lira⁴³ design, the “Atlantic 488”. A search in the book reveals that 21 of the vessel types were equipped with the “Cycloid” receiver and 32 of them with the “Sibir” model.⁴⁴ That is close to half the Soviet fishing fleet.

According to a trawler skipper with experience working on Russian trawlers, calling home by satellite phone was previously too expensive for the crews, while calls over HF were virtually free. The HF radio was therefore used extensively for this. According to Russian law, Russian crews are entitled to a separate room for private conversations.

Only Russian coastal radio stations currently listen continuously to HF emergency channels. Other countries have shut down the service because it became unprofitable. This is a paradox. Norwegian and most other countries’ ships still only had HF radio as an approved emergency communication in the Arctic and Antarctic regions when the police found the radios on Lira and Ester.⁴⁵ Iridium satellite communication was not approved until the summer of 2023.⁴⁶ In the last few years until the approval, we were completely dependent on Russian coastal radio stations to receive emergency messages from high latitudes.

Interestingly, the Commission used the same radios to accuse the Melkart-5, owned by Murman Seafood, of espionage. According to Iceland Monitor, the Melkart-5 was berthed next to one of the trawlers, the Lira, in the Faroe Islands. The EU Commission considered this sufficient to include the radios in the “evidence list” against Murman Seafood.⁴⁷

Regardless of whether it is Norebo as the EU Commission claims, or Atlantrybflot JSC and Sea Star Co Ltd that own these vessels, the radios do not give reason to suspect espionage activities. The radios were not military, they were made for the fishing fleet.

Moreover, Norebo is not mentioned in any of the articles in connection with the radios on Ester and Lira, so it is not easy to understand how the EU Commission has concluded that Norebo owns them.

VRT NWS: The trawler Kapitan Sokolov

The allegations against the trawler Kaptan Sokolov were published by the Belgian public broadcaster “VRT NWS”⁴⁸ in cooperation with Pointer, a part of the Dutch public broadcaster, KRO-NCRV.⁴⁹ The case was also reported by EUToday.⁵⁰

The articles were based on information from the Belgian Maritime Security Unit (Cel Maritieme Beveiliging), which is tasked with protecting ports and ships against illegal acts.⁵¹

They claimed that the “Kapitan Sokolov” had been spotted several times in the North Sea. The spokesperson for the organization, Thomas De Spiegelaere, said that the trawler had high-tech equipment on board that could be used both to find schools of fish and to spy with.⁵² They also indicated that the trawler could be involved in the incident in which the Chinese ship “NewNew Polar Bear” damaged the Balticconnector pipeline in the Gulf of Finland.

The Balticconnector incident

The Belgian Maritime Security Unit claimed that the AIS tracks from Kapitan Sokolov showed suspicious movements in the vicinity shortly before the damage to the pipeline occurred.

According to the AIS tracks, the trawler was sailing in Russian territorial waters in the eastern part of the Gulf of Finland, while the Balticconnector pipeline is located in the western part. It was 260 km as the crow flies between the trawler and the damage site at the time of the incident. The trawler was sheltering in the Beryozovye Strait, between the Beryozovye Islands and the mainland, when the pipeline was damaged.⁵³

The video below show this clearly.

Kapitan Sokolov was built at Severnaya Verf in St. Petersburg. The vessel left the shipyard on 25 September 2023, barely two weeks earlier, to begin sea trials.⁵⁴ A sea trial is a comprehensive testing period that a newly constructed vessel undergoes before being handed over to its owner. The trials are conducted in open water and is verification that the vessel performs as designed.⁵⁵ It was the tracks from the sea trials that the Belgian Maritime Security Unit considered suspicious.

The AIS tracks gave little reason to believe in the Belgians’ suspicions. A Finnish investigation identified the NewNew Polar Bear as the culprit shortly after the incident.⁵⁶ In August 2024, Chinese authorities had performed an investigation and concluded that the “NewNew Polar Bear” had accidentally damaged the pipeline.⁵⁷

One month later, in September 2024, the case took a strange turn. The Belgian Maritime Security Unit now claimed that the AIS signals from the trawler, which they had previously considered suspicious, now also were false. However, they would not share any evidence backing this new claim.⁵⁸

It is approximately 140 km from the western end of Russian territorial waters to the site where the Balticconnector pipeline was damaged, and yet another 140 km to the site where the fiber cable between Estonia and Sweden was damaged by the anchor from the “NewNew Polar Bear”.⁵⁹ Judging from the reduction in speed of the container ship, it appears that the anchor was deployed approximately 90 km before the vessel crossed this fiber cable.⁶⁰ A total distance of almost 400 km.⁶¹

Under the cover of the allegedly suspicious and now also false AIS signals, Kapitan Sokolov must have sailed to the area where the “NewNew Polar Bear” began to drop its anchor in order to have had an opportunity to assist in the deed. And it is hardly possible to provide such assistance without boarding the vessel. The weather was bad with 5 meters waves. Even if Kapitan Sokolov had maintained its maximum speed of 15 knots, the round trip would have taken more than 24 hours.⁶² Just carrying out the voyage would have been risky before the sea trials were completed - and they had barely begun.

The Belgian Maritime Security Unit suspects that this may have happened. They have not said anything about why they believe the Russians may have created fake, but still suspicious AIS tracks. This appears utterly stupid if it is true. Neither have they explained how they believe the alleged assistance contributing to the “NewNew Polar Bear” dropping its anchor actually took place. It is hardly possible to drop the anchor without being on board the vessel. However, they will not provide any evidence.

Earlier this year, the captain of the “NewNew Polar Bear” was detained in Hong Kong for damaging the Balticconnector pipeline.⁶³

Observations in the North Sea

The sea trials of the “Kapitan Sokolov” lasted until December 2023. Then the trawler returned to the shipyard and remained there for more than a year. The AIS tracks from Global Fishing Watch (GFW) show that the trawler did not leave Russian territorial waters until April 10, 2025. It then sailed into the North Sea from the Skagerak in the Norwegian economic zone on April 15.⁶⁴ The trawler continued north along the Norwegian coast directly to Kirkenes and continued on to Murmansk and has operated in Russian waters since then.

The sea route from the Gulf of Finland to the North Sea passes through Danish waters. A review of all AIS data from the Danish Maritime Authority from September 2023 when the “Kapitan Sokolov” was launched reveal no tracks in Danish waters from the vessel until April 13, 2025.⁶⁵

No one else has reported seeing the vessel in the North Sea during this period. Yet, the Belgian Maritime Security Unit claims that the vessel had been observed several times in the North Sea a year earlier. They have not provided any evidence for this claim neither.

When Thomas De Spiegelaere made the claim in May 2024, Kapitan Sokolov had not sailed outside Russian territorial waters in the Gulf of Finland. With the exception of the transit to Murmansk in April 2025, the vessel has only sailed in Russian waters to date, according to the AIS data from GFW.

High-tech equipment

The spokesperson for the Belgian Maritime Security Unit also stated that Kapitan Sokolov had high-tech fish-tracking equipment on board that gave rise to suspicions of espionage. He said that the equipment could be used for other detection tasks than just finding schools of fish.⁶⁶

The vessel is equipped with normal fish-finding equipment,⁶⁷ a SX90 sonar from Simrad⁶⁸ and multi-beam echo sounders from Furuno.⁶⁹

The most advanced equipment, the sonar, has a range of 5,000 meters. This range can be increased to 10,000 meters, but that requires an export license. The reason for this is that US authorities consider the extended range to be a threat to national security, perhaps because it may be possible to locate submarines.⁷⁰ There is no information available to suggest that the equipment has been sold in violation of the export regulations.

In their product catalog, Simrad describes the SX90 as a workhorse. The illustration in the catalog is “F.V. Shuktara”, an older trawler from Bangladesh with the sonar installed.⁷¹ On the Facebook page of the Simrad dealer in Bangladesh, there are pictures of around 40 trawlers that since 2021 have been retrofitted with the same SX sonar as the one the Kapitan Sokolov is equipped with.⁷² Simrad has two sonar models with better performance for fishing vessels in their portfolio, the SU90 and the ST90. Several of the vessels in Bangladesh have installed the improved SU model.

The Russian Maritime Doctrine

“VRT NWS” and Pointer used the Russian maritime doctrine as justification for claiming that Russian vessels related to fishing in general, and the Kapitan Sokolov in particular had become a threat.

The articles stated that “points 84 and 85 of part 7 of the doctrine summarize this well.” And further; “civilian ships are adapted in advance, and the crews are trained to serve in wartime. And in peacetime, all fishing vessels, transport ships, and specialized ships may be used by the armed forces of the Russian Federation.” “In short: even Russian fishing boats can be at the Kremlin’s disposal at any time.”

Paragraph 84 in the doctrine states the importance and the goal of being able to incorporate and train civilian crews in advance of wartime operation. Paragraph 85 details the prioritization of maritime mobilization training and sub-paragraph 9) is the point that is the basis for the allegations of espionage activities from civilian vessels:

“85. The priority areas for improving mobilization training and mobilization readiness in the field of maritime activity are: … 9) improving the procedure for the conscription and use of transport, fishing and specialized vessels of all forms of ownership, as well as the use of port facilities by the Armed Forces of the Russian Federation, other troops, and military units conducting special operations in peacetime;”

The conscription, summons or requisition procedures are to be improved for the Armed Forces and other troops in preparation for wartime, and correspondingly, for military units conducting special operations in peacetime.⁷³

The term used in the doctrine, “специальных операции” – “special operations”, is explained in Encyclopedia Britannica: “Special operations warfare is conducted by uniformed military forces. This distinction helps to differentiate special operations warfare from activities such as sabotage and subversion conducted by intelligence agencies or internal security and policing conducted by police units”.⁷⁴ Examples include the German GSG-9, the British “Special Air Service” (SAS) and the Russian Spetsnaz.

“VRT NWS” and Pointer argue that the term “in peacetime” also refers to the use of civilian vessels and port facilities by the Armed Forces, not only in wartime but also in peacetime. However, this is a misinterpretation because it makes the explicit mention of “military units conducting special operations in peacetime” redundant, as the special operations forces are part of either the Armed Forces or the “other forces” already mentioned.

The reason for including the use of civilian vessels in peacetime in the maritime doctrine is apparently also easy to identify. On the website of the Russian Ministry of Defense, the main purpose of the Russian Armed Forces is stated as (machine translated): “in peacetime - peacekeeping missions and special operations of troops (forces) in internal armed conflicts;”⁷⁵

Perhaps not so surprising then that support for military units conducting special operations in peacetime appeared in the maritime doctrine. This information was posted on the Defense Ministry website in 2015 and remained unchanged in 2022. The possible use of special operations forces in internal armed conflicts in Russia does not give reason to neither suspect nor warn of possible espionage from fishing vessels in the North Sea.

The aforementioned points in the doctrine are very similar to the Norwegian “requisition act”.⁷⁶ It states that when the country is at war, or if the government in peacetime deems it necessary to be prepared, the Armed Forces can requisition anything they need, including vessels, with or without crew. The government can also demand that civilian enterprises in peacetime prepare themselves by mounting cannons on vessels and make other appropriate preparations.⁷⁷

The claim that the doctrine facilitates the use of civilian vessels for gray zone and espionage activities in peacetime is not correct. An observed or perceived increase in such activity cannot be inferred from what is written there.

The Barents Observer: The reefer Belomorye

The reefer (freezer ship) Belomorye experienced problems with its rudder when it was approximately 110 nautical miles west of Kristiansund on the Norwegian west coast on the night of November 24, 2024. The vessel drifted around without steering and declared an emergency.

Later that morning, the Chinese vessel “Ocean 28” was heading south further south along the Norwegian coast. West of Florø, the ship turned around and sailed northeast before it started sailing back and forth outside Norwegian territorial waters in the area west of Molde and the LNG terminal in Nyhavna. At midday on 26 November, the vessel continued its voyage south.

“Ocean 28” was sanctioned by the United States because it had been transporting modules to the Russian Arctic LNG 2 project on the Gydan Peninsula in Siberia.⁷⁸ There are no reports claiming that the vessel is suspected of espionage activities.

The next morning, on 27 November, the salvage vessel “BB Coaster” reached the Belomorye. “BB Coaster” towed the vessel in distress to Freifjorden. The tow arrived at the anchorage “Freifjorden 1” in the evening the same day.

The tracks from the Chinese and Russian vessels are closest to each other in the area just outside Norwegian territorial waters. When the tow with the Belomorye approached the territorial waters north of the area where the Chinese vessel had previously lingered, the Chinese vessel was long gone. At this time the “Ocean 28” was northwest of Haugesund. It was 230 nautical miles or 430 km between the vessels.

It is very hard to see anything that could be suspicious about the casualty, Belomorye, being towed by a Norwegian tug, north of an area that a Chinese vessel had left more than 24 hours earlier, as reported by “The Barents Observer”. Any connection between the tracks of the Chinese vessel “Ocean 28” and Belomorye lacks support in the sequence of events exposed by the AIS-data.

The Norwegian Armed Forces Operational Headquarters (FOH) provided the following information on the matter upon request:⁷⁹

“BELOMORYE declared an emergency after experiencing problems with the rudder. She was unable to sail under her own power and was towed into Norwegian internal waters pending further clarification. The Russian tug VENGERY was later given permission by Norwegian authorities to enter Norwegian internal waters to tow BELOMORYE to a Russian port for repairs. FOH considers the purpose of entering Norwegian internal waters to be legitimate for both vessels.”

Pointer: Arctic Princess - espionage in Eemshaven

The Belomorye had to turn back earlier that year while en route to Eemshaven in the Netherlands with fish because Dutch authorities no longer granted the vessel an exemption from sanctions. According to the Dutch Pointer, this was because the vessel could be involved in espionage.⁸⁰

Until this point in May 2024, Russian reefers transporting fish to the Netherlands had been granted exemptions from the sanctions upon request. Food products are not sanctioned and Russian vessels transporting fish were allowed to dock in the Dutch harbours.

In May 2024, the Dutch Minister of Infrastructure and Water Management wrote a letter to the President of the Parliament in response to questions directed to the Minister of Defense from the representative Kahraman.⁸¹ Kahraman referred to a Pointer article from 4 May.⁸² The article pointed out that the Russian reefer, “Arctic Princess”, also owned by Norebo, had been berthed in Eemshaven and unloaded fish at the same time as the container ship New Amsterdam was unloading military equipment. The equipment had been used by the Dutch armed forces during the NATO exercise Nordic Response in Finnmark in northern Norway.⁸³

Kahraman asked if the Minister of Defense could confirm whether there had been any espionage incidents in Dutch waters involving Russian fishing vessels. He also asked what the Minister of Defense would do about these vessels having access to Dutch ports.⁸⁴

In her response to Kahraman, the Minister of Defense, Kajsa Ollongren, said that unlike the port of Den Helder, Eemshaven was not military, although the port was occasionally used for military purposes. When that happened, it was assessed whether special measures were necessary because military activity and transport were not always secret. In particular, she mentioned that when transferring material for exercises, it was a point in itself that the activity was visible. And, they were fully aware of the possibility of espionage activities, the defense intelligence service, the MIVD, had warned about this for a long time.⁸¹

The Minister of Infrastructure and Water Management stated in his letter that a request for an exemption from the sanctions by a Russian vessel to unload fish would not be granted.⁸⁵ The reason for this was increasing geopolitical tension and announced tightening of European sanctions, he wrote.⁸⁶ Espionage was not mentioned as a reason for not granting an exemption in the letter.

The AIS tracks of the Belomorye shows that the vessel arrived west of IJmuiden in the Netherlands on the morning of 16 May and began its return voyage the same evening, without having been in port.

The Organization for Security and Co-operation in Europe, OSCE, consists of 57 states, including the Netherlands, Norway and Russia.⁸⁷ According to the organization’s regulations on confidence- and security-building measures, exercises involving more than 9,000 soldiers must be notified at least 6 weeks before the exercise begins. The notification must include, among other things, the total number of tanks, the number of armoured vehicles and the number of artillery units and rocket launchers from each participating country.⁸⁸

The Nordic Response exercise, from which the ship New Amsterdam unloaded military equipment when Pointer believed that the Arctic Princess might have been spying, involved 11,000 soldiers. The exercise had been notified through the OSCE, so the Russians were already informed of what equipment the Dutch had used.

There is no basis for suspecting espionage against a transport where the cargo manifest had already been given to the suspect, and which the Dutch defense authorities wanted transparency about, according to the Minister of Defense. The Dutch authorities did not justify the refusal to grant Belomorye an exemption from the sanctions for delivering fish with fears of espionage, that was something Pointer wrote based on their own assumptions.

Also, it would be rather reckless if the Dutch military carried out covert operations in plain sight in a civilian port without taking precautions, regardless of whether Russian vessels were present in the port at the time or not.

Follow The Money: The reefer Canopus

The investigative magazine “Follow The Money” (FTM) published an article in June last year with the title “Almost 200 Russian ships suspected of spying in the North Sea”.⁸⁹ The article showed AIS tracks from two Norebo vessels, the reefers Canopus and Sirius.

In the article, FTM included a video with AIS tracks from the Canopus where they wrote that: “The Canopus shows suspicious behavior. The vessel lay for several days near Vlieland, above two pipelines. Then the signal is lost and the ship shows up 71 kilometers north of Terschelling.” At the end of the video they wrote that “The AIS data turns out to be wrong, according to port authorities. It is a false alarm”.

AIS data acquired from “Astra Paging” shows more of the Canopus’s voyage than the FTM article did.⁹⁰

The tracks showed signs of being incorrect from around 07:00 (UTC) on the morning of July 12, 2018. It looked like the vessel lay still for just over 8 hours, before at approximately 15:15 it sailed east for 2 hours to a location just inside the territorial waters of the Netherlands where the vessel lay still for five days before the track jumped to the quay in Velsen.

At the same time as the tracks started to look strange at 07:00 and showed the vessel at rest, the estimated time of arrival (ETA) included in the AIS data was adjusted from 12:00 on July 12 to the invalid time of 24:60. When the arrival time was adjusted again to a valid time at 15:15, the position data started updating again, but with a systematic error: The tracks continued from the location where the vessel was located when the error occurred.⁹¹

By moving the AIS tracks from the time after they started moving again when the invalid ETA was adjusted to a valid time, and until they jumped to the dock in Velsen, by the distance between the position reported just before the jump and the position at the dock immediately afterwards, it turns out that the vessel had continued its voyage at a speed of around 9 knots and was approaching IJmuiden when the tracks showed movement again at 15:15.⁹² The tracks show that the Canopus sailed into IJmuiden, through the “Zuiderbuitenkanaal” and into the “Middensluis” at 17:00 and docked on the north side of the lock. A quarter of an hour later it continued through the Noordzeekanaal and docked in the “Zijkanaal A” in Velsen-Noord at 20:00 local time on 12 July, just north of the intersection of the streets Velserkade and Platformweg.

The pipeline that FTM thought Canopus was laying still over was in reality the quay in Velsen.

In the morning two days later, the vessel moved to a berth about 300 meters further south along the canal.

The tracks then show that the vessel left the quay in Velsen on the morning of July 18 and sailed back through the Noordzeekanaal. At 13:20 it entered the “Middensluis” where it lay on the south side of the lock for around 20 minutes before sailing further out through the Norderbuitenkanaal, out into the North Sea and then north along the Norwegian coast to Tromsø.

The difference between the dataset FTM used and the data provided by Astra Paging is interesting. FTM stated that they used data from Global Fishing Watch (GFW).⁹³ I contacted GFW to ask if there was reason to suspect a vessel of wrongdoing simply because data was missing from their database. They replied that they collected data from various sources which was not exhaustive, and that even if the vessel was included in the sources, their filtering could cause vessels they had in their internal database not to be part of the publicly available product.⁹⁴

If you look for AIS tracks from the Canopus from the GFW today, all the data from July 11 to July 18, 2018 is missing. Both the erroneous data during the approach that FTM considered suspicious, and the data from the port stay and the voyage out of Velsen have been filtered out.

Hidden away on a Github page, FTM describes the method they used to identify suspicious vessels. In short, they created a list of Russian vessels that had already been mentioned by other media outlets in connection with gray zone activity and sanctions. They combined this with some simple technical criteria such as deviations from normal routes, AIS signals disappearing, etc. They then collected information about the location of infrastructure and measured the distance to vessels that were nearby.⁹⁵

They also comment that it is very difficult to determine whether AIS data is missing due to errors, or whether they have been turned off intentionally, and that the data they used had quality problems that led to false alarms.

Finding it difficult to determine whether what they found was truly suspicious, they manually inspected some of the findings and discussed them with experts. According to FTM, this did not imply that the vessel was guilty of anything, only that it was exhibiting behavior that was worth investigating further. However, strangely enough, they did not examine any of the findings they made in detail themselves.

Based on the criteria the journalists themselves constructed, they made the headline “Almost 200 Russian ships suspected of spying in the North Sea”. But, that was not what they had found. What they found was “almost 200 tracks from Russian ships for which the journalists had no immediate explanation”.

Others using the same method can use the list from FTM when looking for Russian vessels mentioned in the media. A method where unconfirmed and erroneous suspicions can be used again and again. A vessel that has once been mentioned cannot get rid of the accusation because the method does not include a search for information that can refute the suspicion.

But, as you can see here, such information is not difficult to find.

Financial Times: Sabotage in the Baltic Sea

In October 2023, the Chinese container ship “NewNew Polar Bear” dragged its anchor on the bottom of the Baltic Sea into the Gulf of Finland.⁹⁶ The anchor damaged a gas pipeline and three fiber cables, one of them was Russian.⁹⁷ In November, just over a year later, the Chinese bulk carrier “Yi Peng 3” did the same thing and the anchor damaged two fiber cables.⁹⁸

One month later, the anchor of the oil tanker “Eagle S” damaged four fiber cables and one power cable between Finland and Estonia,⁹⁹ and at least one Russian fiber cable, possibly two, between St. Petersburg and Kaliningrad.¹⁰⁰ And one month after that, the bulk carrier Vezhen dragged its anchor on the bottom and damaged yet another cable.¹⁰¹

The EU Commission has included an article from the Financial Times (FT), “Inside Russia’s Shadow War in the Baltic Sea”, in its “evidence package”. The article is focused on the possibility that the events in the Baltic Sea could be Russian sabotage.¹⁰² The article shows images of the Finns boarding the “Eagle S” from a helicopter and Finland’s Foreign Minister is quoted as saying that the incident “is part of the aggression and threat that Russia poses to our way of life.” The word sabotage is used 26 times in the article.

The article states that the incidents took place over a period of 17 months. It was published in early March, 17 months after the first incident and more than a month after the fourth incident involving the bulk carrier Vezhen. However, only three vessels were mentioned, the incident with Vezhen was omitted.¹⁰³

A bit more than a week after Swedish authorities seized the Vezhen, the vessel was released and the sabotage charges were dropped. State Prosecutor Mats Ljungquist told Expressen that they had a film showing the incident. It shows that there is no one nearby when the anchor is dropped.¹⁰⁴

The investigation found that there were three different locking devices connected to the anchor. Two were out of order and the last one broke. It is not possible to open the anchor lock from the bridge by pressing a button, it can only be opened manually. The film showed a huge wave hitting the vessel and a shower of sparks as the lock broke and the anchor sank to the bottom. The crew did not notice that the anchor was released, the vessel went on autopilot and compensated the speed. No alarm was triggered.

The case brought by the Finnish prosecutors against three of the crew of the “Eagle S” was dismissed by the Helsinki District Court. The Finnish authorities lacked jurisdiction, the case should be handled by the flag state, the Cook Islands, under the United Nations Convention on the Law of the Sea (UNCLOS).¹⁰⁵ Neither the district court nor the prosecutors found evidence indicating that the anchor had been intentionally dropped to damage the cables.¹⁰⁶ The district court also noted that the case did not meet the legal requirements for sabotage or aggravated sabotage because there was no interruption in neither power supply nor communications. The prosecutor has appealed the decision to dismiss the case.¹⁰⁷

The Swedish Accident Investigation Board participated in the Chinese investigation of the “Yi Peng 3”, but found no evidence that the anchor had been intentionally released.¹⁰⁸ The Chinese investigation is still ongoing.

The result of an internal investigation by the Chinese authorities was that the “NewNew Polar Bear” damaged the Balticconnector pipeline due to an accident caused by bad weather.¹⁰⁹ However, the Estonian prosecution does not recognize the investigation report as evidence.¹¹⁰ In May 2025, the captain of the “NewNew Polar Bear” was detained in Hong Kong.¹¹¹ He is charged with damaging the pipeline and subsequently sailing without an anchor. Finnish authorities continue to cooperate with the Chinese authorities in the investigation.¹¹²

Vessels dragging anchors without being aware of it is nothing new.

In 2002, the container ship Aconcagua severed three of the four cables that then connected the United States to Europe on a voyage from Philadelphia to New York. The captain mistakenly believed that the reduction in speed from the anchor the vessel was dragging was due to strong winds.¹¹³ In 2008, an oil tanker dragged its anchor for 300 kilometers and damaged six cables off Sicily. A report from British Telecom shows that vessels dragging their anchors without realizing it had damaged 13 cables from 2007 to 2010 in the waters around the United Kingdom alone.¹¹⁴ That’s more than three cable breaks a year.

In the “best practice” guide for governments, the International Cable Protection Committee (ICPC) state that statistics indicate that approximately 70 percent of the damage to submarine cables is caused by fishing activities and anchor damage. The first item on the list of anchor-related damage is “improperly-stowed anchors, which release or fall overboard and can be dragged for great lengths along the sea floor, damaging cables along the anchor’s path”¹¹⁵

Back to the Financial Times article, why didn’t they mention Vezhen?

A likely explanation is simply that the film showing that the incident was an accident did not fit the story they wanted to tell about possible Russian sabotage.¹¹⁶ This is one of the prerogatives of the media, they can choose what they want to present to support their view. The editorial staff is not obligated to be objective.

The EU Commission justified the use of press articles as the basis for the accusations against Norebo by saying that they lacked investigative authority. Both Sweden and Finland are EU member states that conducted investigations in connection with the cable breaks in the Baltic Sea.

The Commission used an article from a US paper as evidence and apparently ignored the Member States’ investigations. This give reason to suspect that the Commission only was looking for material supporting its conclusion, that Russia is conducting a sabotage campaign in the Baltic Sea, and ignored evidence refuting it. It is also worth noting that no Norebo vessel is mentioned in connection with the investigations.

Such selective use of sources is not compatible with the Norwegian sanctions regulations. These regulations aim to prevent arbitrariness, not encouraging it, as the EU Commission’s course of action necessarily does when measuring out punishment based on unverified media articles.

Whats next?

The EU Commision justified the sanctions by saying that vessels operated by Norebo had shown movement patterns that were inconsistent with regular economic practices and fishing activities. The vessels were allegedly repeatedly in proximity of critical infrastructure and military installations. The movement patterns had been linked to a Russian state-sponsored surveillance campaign by both Member States and authorities in third states.

The campaign allegedly used trawlers to conduct espionage missions directed against civilian and military infrastructure. This, according to the regulation, facilitated future sabotage operations in both the North Sea and the Baltic Sea. Ships owned by Norebo had also been equipped with technology that could be used for espionage and a Norebo vessel had been denied entry to Dutch ports due to espionage. Norebo had received several loans from a Russian state-owned bank and the EU believed that the Russian maritime doctrine allowed the Russian armed forces to use civilian ships in peacetime.¹¹⁷

According to the regulation, this showed that Norebo supported Russian state activity that undermined the security of the EU, several member states and third countries, by engaging in activities aimed at disrupting critical infrastructure.

The primary sources for the espionage allegations against the Norebo are the public broadcasters in Norway (NRK), Belgium (VRT NWS) and the Netherlands (KRO-NCRV/Pointer), as well as the investigative Dutch magazine “Follow The Money” and the Norwegian outlet, “The Barents Observer”. The other articles about espionage activities from the Norebo vessels are reproducing the material from these sources.

NRK’s accusations against the trawler Taurus were based on the journalists’ own work. The accusations NRK conveyed about military radios aboard the trawlers Ester and Lira came from the Norwegian intelligence service. If the EU Commission had bothered looking for material that refuted NRK’s findings, they would have found it.¹¹⁸

KRO-NCRV/Pointer, the Dutch public broadcaster, suspected that the Russian reefer Arctic Princess was spying on the unloading of military equipment based on the journalists’ own work. The Belgian Maritime Security Unit was the source of “VRT NWS” and KRO-NCRV/Pointer’s espionage accusations against Kapitan Sokolov. Dutch “Follow The Money” was itself the source of the suspicions against Canopus.

The third country the Commission mention where the EU lacks investigative authority is Norway. The rest of the information about the suspected espionage activity comes from sources in the EU member countries Belgium and the Netherlands. There is no lack of EU investigative authority in those countries.¹¹⁹

However, the EU Commission nevertheless chose to let the press be the judge.

It was the Norwegian public broadcaster, NRK, that was first out and showed the way with the speculative journalism based on suspicions and confirmation bias in overdrive. NRK singled out the Norebo trawler Taurus and manipulated the presentation in the Shadow War to make things look suspicious. The accusations from NRK are the main basis for the sanctioning of both Norebo and Murman Seafood. It appears like the NRK coverage paved the way and encouraged and emboldened the other editorial teams to follow suit.

The espionage allegations from NRK, Pointer, “VRT NWS”, “Follow the Money” and “The Barents Observer” are both erroneous and unfounded. The allegations should have been investigated in a responsible manner before they were used for punitive measures.

The only item on the commission’s list that has not yet been discussed here is the loan in Sberbank. The reason for that is simple. A loan is not sabotage or surveillance, it is not a threat to critical infrastructure and therefore it cannot undermine security.

It is unlikely that the newspaper articles will hold up as evidence if Norebo takes legal action against Norway to be removed from the sanctions list. It will be very interesting if Norebo follows Murman Seafood’s example and complain to the Ministry of Foreign Affairs in accordance with Section 6 of the Sanctions Act, and at the same time prepares legal action.¹²⁰

It is also hard to see how a small country like Norway will benefit from replacing law and order with arbitrary justice measured out by editors and journalists. The Norwegian government is therefore dangerously close to conducting self-harm when it follows the EU Commission and supports the arbitrary regulatory governance that is the basis for the sanctions.

The NRK series The Shadow War has become Norwegian foreign policy. It is both very embarrassing and very dangerous.

References