Nord Stream sabotage suspect was investigated by the Ukrainian police for ties to Russia

This research was done with the help of Sergej Maier, Markus Frenzel, and Oliver Alexander. Court records referenced here are presented after quoted passages, with links.

In Kyiv, on the 8th of November, 2022, a safe was cracked open by the Ukrainian national police. The contents were confiscated, nearly $350,000 in cash and tools for forging Ukrainian passports and state documents. The search warrant had come as part of a large-scale criminal investigation looking into a group of persons believed to be involved in a plan to bring about “violent change or overthrow of the constitutional order or seizure of state power, changes in the boundaries of the territory or state border of Ukraine”. The police suspected the safe's owner to be a part of the treasonous group. {Case No. 757/9980/22-k}

The man who hid a small fortune inside that safe in Kyiv is being investigated today for connections to another crime. He is suspected of having played a role in sabotaging the Nord Stream pipelines. The German press has reported his name as Rustem A. and released exhaustive research about his possible connection to the Nord Stream explosions via a dubious Polish company named Feeria Lwowa. Details about his having been investigated by the Ukrainian national police for a case involving treason and ties to Russia have gone unreported, until now.

The ties that bind

Some of the most well-respected news outlets inside and outside Germany have published dozens of stories over the last year that tie a Polish company named Feeira Lwowa to the Nord Stream sabotage. The findings have supported the theory that Ukraine might have played a role in the attack, including the Ukrainian military and/or government.

Recently, it was established that the money that flowed through Feeria Lwowa was put up by a man named Rustem A., who reportedly can be found in the company’s financial documents. Other names can be found there as well, such as Diana B., the owner of Feeria Lwowa. It remains unclear how much those connected to the company knew about the rental of the Andromeda or a possible sabotage plan. The fact that Diana B. and Rustem A. hold Ukrainian passports, however, has heightened the suspicion that Ukraine was somehow involved.

Others have remained skeptical about the persons surrounding Feeira Lwowa and where their alliances lie. RTL and n-tv pointed out this summer that Diana B. had traveled freely inside Russia after the Nord Stream attacks. Would someone who helped the Ukrainian government eliminate a vital Russian pipeline be allowed to travel unhindered around Russia afterward? It seems unlikely, but the revelations about evidence pointing to Diana B.’s Russian connections (including dual citizenship) did little to change the coverage of the “hottest lead” in the Nord Stream case being one of possible Ukrainian involvement.

Rustem A.’s ties to Russia might be more difficult to ignore.

Suspected traitors are raided

During a recent investigation by the Ukrainian national police, documents related to Rustem A.’s various businesses turned up—businesses ranging from pig breeding to the sale of heat pumps—as well as copies of dual-citizenship passports and business contracts with Russian firms and persons. It is difficult to know what exactly in the sprawling Ukrainian investigation references Rustem A. and what doesn’t. One problem is that many details remain redacted.

In the more than 200 court records related to the investigation, however, details can be found that confirm that Rustem A. was a suspect. The Ukrainian national police searched his property to investigate whether he might belong to a Russian-backed group conspiring to overthrow the Ukrainian government. Using various open-intelligence sources and what is known publicly, it was possible to learn more about the man believed to have handed out cash for the Nord Stream attacks and his suspected Russian ties.

Representatives of the Ukrainian criminal proceeding No. 12022000000000281 went before the courts in early April 2022—while Ukraine was heading into a second month of fighting off the full-scale Russian invasion—to request search warrants. National police had been tracking individuals they suspected of working as agents for Russia inside Ukraine’s borders and had their eye on several suspects in Kyiv. The next step would be to knock down doors.

Investigators asked judges in April of 2022 to issue warrants for police raids “to identify and record information about the circumstances of the commission of a crime, finding and seizing tools used for criminal offenses”. They requested permission to search specific addresses for, in particular, items like business contracts, bank statements, tax documents, telephone numbers, meeting plans, information about military and civil infrastructure objects, laptops, cell phones, SIM cards, hard drives, and seals and stamps, among other evidence. Repeatedly, Ukrainian judges issued the warrants needed so police could go out on raids.

The addresses stormed, by and large, were registered to businesses. Ukrainian investigators, it seems, believed the best way to sniff out persons inside their country working secretly for Russia was to follow the money. In one court document, investigators stated that “Funds received as income from conducting economic activities can be transferred to controlled offshore enterprises and transferred then to the accounts of controlled enterprises in the Russian Federation,” which, in turn, would make it possible to “finance actions committed with the aim of violent change or overthrow of the constitutional order or seizure of state power, change borders of the territory or state border of Ukraine.” Investigators estimated that between 2021 and 2022, more than 50 million dollars had flowed through companies registered on Ukrainian territory for that purpose and noted that one company “involved in the specified illegal schemes” had a founder who “is a citizen of the Russian Federation.” {Case No. 757/9980/22-k}

The national police raided several Kyiv addresses in 2022. On November 18th, according to court records, a location northwest of the city center was stormed. Police found “statutory, registration and financial and business documents, accounting and reporting documents, bank account statements, and company seals” related to multiple businesses. At least two of the companies belonged to Rustem A., according to the online resource YouControl and reporting done by Die Zeit.

Several documents confiscated, the court records state, dealt with “interaction with legal and physical entities from the Russian Federation”. Further links to Russia included “passports and certificates on the assignment of the identification code of Ukrainian citizens with dual citizenship (Russian Federation)”. {Case No. 757/19742/23-k}

The scope of the investigation included search warrants for addresses in Odesa as well.

A court document from May 2022 noted that “In the course of the pre-trial investigation, it was established that a citizen of Ukraine” had used several companies “for the implementation of an illegal scheme” in which “[they] also involved other people from the Odesa region”. The suspect in Odesa was believed to be helping the Russian army repair and build fighter jets via shell companies in Ukraine and factories in Moldova. “According to the information received,” the court documents state, “the production of the specified parts is done at factories located on the territory of the so-called ‘Pridnistrovskaia Moldavskaia Respublika’ (PMR). After their production, they are sent to the Russian Federation, where they are subsequently used during the construction and repair of military aircraft, which in turn are sent out for military operations on the territory of Ukraine.” The Odesa traitor had also been surveilled and observed as someone who “constantly crosses the border and visits [PMR], and is a documented holder of a passport issued by the Russian Federation.” {Case No. 757/12134/22}

Among the properties raided in Odesa was also a Hotel “owned and controlled by citizens of the Russian Federation”, where several seizures of evidence were made, according to court documents. {Case No. 757/13112/22-k}

But with only redacted documents to go by, how can one be sure that Rustem A. was a suspect in criminal proceeding No. 12022000000000281, the same investigation that hunted down persons with Russian ties across Ukraine?

Details from one specific raid make it possible to nail down a connection to the man believed to have played a role in the destruction of the Nord Stream pipelines.

Twelve matching digits

Rustem A.’s name was first reported last week, when several news outlets in Germany published their investigative findings to mark the one-year anniversary of the Nord Stream attacks.

Die Zeit wrote, “German investigators would really like to talk to the Ukrainian man [Rustem A.] living in a single-family home in the northwest of Kyiv” about his possible involvement in or knowledge about the Nord Stream explosions. Die Zeit ran a black-and-white illustration of Rustem A., an ominous caricature, and journalists who tried to speak with him were reported to have been attacked and confronted with lurid death threats. It was a profile of a dangerous Ukrainian, one who had likely been involved in the Nord Stream sabotage, possibly on behalf of the Ukrainian military, who appeared to be covering his tracks and dodging interviews.

Die Zeit also included minute details from an open court case, which they described in the following way: “In fall of 2022, Ukrainian authorities searched a locker belonging to Rustem A.” where they found “192,325 euros and $126,682”. It is thanks to these sums of money mentioned by Die Zeit that it can be confirmed that Rustem A. is the same person who was investigated as a part of criminal proceeding No. 12022000000000281.

In one of the Ukrainian court documents obtained for this research, a raid is referred to that took place on November 8th, 2022, matching the timeline cited by Die Zeit: the fall of 2022. The other match is that, according to Ukrainian court documents, exactly $126,682 and €192,325 in cash were seized during the raid, the contents of a safe busted open by police. The accurate match of both six-digit numbers makes it virtually impossible that the court documents upon which this research is based refer to someone other than the same Rustem A. profiled by Die Zeit. {Case No. 757/34844/22-k}

Excerpt of one of the court documents used for this research, where the specific sums of money confiscated in the safe raid can be found.

What is striking are the details left out by Die Zeit and their investigative partners. A broad German news consortium released several full-length documentaries, long articles, and a podcast series on the Nord Stream sabotage and a possible Ukrainian connection. Nowhere has it been mentioned that police inside Ukraine investigated Rustem A. in 2022 on suspicion of being involved in illegal schemes financed by Russia that sought to overthrow the Ukrainian government.

Also not mentioned were the other personal belongings of Rustem A. confiscated by police on November 8th, 2022. According to court documents, they seized a “relief printing machine for embossing paper or cardboard with an imprint of the stamp ‘Ukraine passport 11-13’ in a black plastic case” and official state seals for printing the words “State Tax Inspectorate in the city of Kerch of the Autonomous Republic of Crimea”.

Rustem A. didn’t only have cash in his personal safe. He had equipment that could be used to forge Ukrainian passports and Crimean tax documents.

How did Die Zeit miss this?

For months, the debate around the Nord Stream sabotage has revolved around whether a Ukrainian commando team alone bombed the pipelines or whether the Russians framed Ukraine via a false-flag operation. It is known that fake passports were used to rent the Andromeda, one of which included a photo of a Ukrainian soldier. These details were presented as evidence that the Ukrainian military possibly planned and carried out the sabotage. But the open-source court documents relating to Rustem A. raise alarming questions.

Couldn’t a man in Kyiv with access to large sums of cash and the equipment needed to forge passports have been the perfect candidate to organize a false-flag operation on behalf of Moscow? After reviewing the court documents, a Ukrainian legal expert who asked to remain unnamed believes there’s a clear precedent for such agents. “When the full-scale invasion started,” the legal expert said, “there were many persons who had kept Ukrainian passports for 20 years who were inside the country. They were planted inside Ukraine, waiting for Russian instructions. Unfortunately, we are at war, and you cannot be certain whether such a person is waiting for commands from the Kremlin.” As an example, the expert pointed to Sichi Vyacheslav Boguslaev, a businessman from Zaporizhzhia who was unmasked as a Russian agent in 2022 but had lived for decades inside Ukraine without detection.

So, what exactly went wrong in the coverage of Rustem A. by Die Zeit and others in the German media? It seems clear they had access to the same court documents publicly available and used in this research, but, in their case, possibly unredacted copies. Could it be possible reporters at Die Zeit only received a limited number of court documents relating to criminal proceeding No. 12022000000000281 and never knew the nature of the investigation?

Since the purpose of the criminal proceeding is not mentioned in every document, it is possible the details were either unknown to the German teams or overlooked.

Do the Ukrainian police have Nord Stream evidence?

Another electrifying possibility is that during the raids of Rustem A.’s safe and office, the Ukrainian national police may have inadvertently seized evidence that could be used to crack the Nord Stream case.

After the raids, Rustem A.’s lawyers tried repeatedly to convince the courts to return objects seized by the police, including his stacks of cash. It is, in part, thanks to those repeat appearances before the court, that it is possible to know the details of what exactly was collected. During the raid on the office spaces in the fall of 2022, several flash drives, password generators, and SIM cards were confiscated. A Ukrainian judge decided last month that the items should be returned to their owner, in this case, most likely Rustem A., whose companies were among those raided. Confiscated items may only be kept if it can be proven that they were used in criminal offenses, according to the Ukrainian legal code.

The ruling judge based their decision to return the items on the fact that the police investigator: “did not appear at the court session, [they] did not provide evidence that such property had any relation to the criminal proceedings under investigation, in addition, the court was not provided with evidence of any action aimed at for the investigation of the seized property with the aim of proving the involvement of such property in criminal proceedings.” {Case No. 757/28861/23-k}

Another judge ruled differently. Shortly after the November 2022 raid of the safe, a lawyer on behalf of Rustem A. filed a motion to have the items returned. In that case, the judge allowed the cash from the safe to be returned, but not the machine used for forging passports or the forged official Crimean stamps. {Case No. 757/34844/22-k}

It stands to reason that those objects (or others) confiscated by the Ukrainian national police and not listed in the court documents may contain clues as to what role Rustem A. potentially played in the sabotage of the Nord Stream pipelines. The silence of the Ukrainian government when confronted with questions about Rustem A. (as noted by Die Zeit and others) may also result from the fact that the information Ukrainian national police have about him is part of an ongoing investigation.

All things considered, however, it is highly unlikely that a person investigated by the Ukrainian national police for such crimes would have worked for the Ukrainian military or had any connections at all to the Ukrainian government.

Unlike the nefarious portrait of a rogue Ukrainian that Die Zeit published, police in Ukraine viewed Rustem A. very differently. They saw him as a suspect, as a man possibly hiding secret ties to Russia. If correct, any possible involvement he had in the Nord Stream sabotage was likely coordinated from the top via Moscow, not Kyiv.

NOTE: Reporters from Die Zeit and other German publications were not contacted to respond to this research. Their comments and responses are, however, welcome and will be added to updated versions of this article.

UPDATE November 2023: Die Zeit has responded to questions about their reporting

After this article first went online, no comment or response was received from Die Zeit regarding the question of why these details in the Rustem A. case were not included in their recent reporting.

In preparation for a follow-up article (to be published soon), a concrete list of questions was sent to Die Zeit, asking about what specific information they had regarding Rustem A. at the time of their publication. Die Zeit responded.

A newspaper representative began their email with an expression of frustration about having not been contacted before the publication of my previous post. They also expressed frustration that, despite the fact that Die Zeit worked as a member of a consortium on their Nord Stream sabotage reporting, I had only addressed my questions to them and not others from the consortium.

A reporter at Die Zeit who worked on their Nord Stream sabotage coverage was contacted in late October before my official request for comment from the newspaper. They declined to discuss details but helpfully recommended I reach out to the press department of the newspaper and specified that they were who should be contacted with any questions related to the reporting done by the consortium. Another member of the team at Die Zeit who worked on their Nord Stream sabotage coverage was also contacted for comment the same day my first Rustem A. article went online. They never responded.

A representative of Die Zeit who answered my request for comment in the lead-up to this article sent several long quotes in response to my questions. I will post the entire quotes in German (the original) alongside an English translation here:

Response from a DIE ZEIT representative in German and English

I would like to briefly respond to the issue of why I did not contact Die Zeit before my previous post. Substack exists inside what is commonly called the blogosphere. My writing here is not for a newspaper or a news organization. I am also not paid for this research.

I use the word ‘research’ purposefully. Substack is a platform where I can present information—the majority of which is publicly available—factually and honestly, with the hope that it may be of use to anyone interested in the topic of Nord Stream or energy politics. Substack operates under very different rules than the obligatory ones for newspapers. It wasn’t intended to be a news outlet. It was intended to be a subscription service for receiving written texts about subjects of interest. I use it to distribute my research about topics that interest me, as many others do.

There are blurry lines between what is called research and what is called journalism. I decide on a case-by-case basis my editorial standards for what I post here, and I stick by the decision I made for my previous post regarding how I went about offering Die Zeit a chance to respond. I respect them as a news outlet and remain open to any clarifications they wish to make.