Why were shady characters using drones around the Friendship oil pipeline? Is worry about sabotage justified?

Last Tuesday, when Slovak police tried to apprehend a Ukrainian-Hungarian dual citizen in the town of Michalovce in eastern Slovakia, he tried to get away. A car chase ensued between him and the police, who eventually forced his vehicle off the road. They found a drone in the car, and a search of his nearby residence turned up more drones, SIM cards, balaclavas, wigs and maps of critical infrastructure.

Another man was also apprehended by the police. According to a briefing by Slovak Interior Minister Matúš Šutaj Eštok on Monday evening, they confiscated several surveillance devices, mobile phones, other devices used for recording sound and image, data carriers, a signal blocker, a thermal camera, night vision goggles and even bulletproof vests.

During the weekend, the Slovak authorities announced that they had discovered indications of preparations for a terrorist attack near the Friendship (Druzhba in Russian) oil pipeline, which could also concern Hungary. It may have come as a surprise to many that Slovak police subsequently released the detained men and eventually expelled them from Slovakia. One of them, a Slovak-Hungarian dual citizen, was deported back to Hungary, while the other was handed over to the Ukrainian authorities. No charges or proceedings were initiated against them.

Druzhba

The Friendship oil pipeline ("Druzhba" in Russian), built in the 1960s, is one of the world's longest oil pipeline systems. It connects Eastern and Western Europe and plays an important role in Russian oil exports. The pipeline is one of Hungary's most important oil supply routes.

The pipeline begins in Russia and passes through several countries, including Belarus, Ukraine, Hungary, Slovakia, the Czech Republic, Germany and Poland. Since it forks off into several branches, the pipeline serves refineries in both Western and Central Europe, with the capacity to transport more than 1 million barrels of oil per year. The oil is processed by the refineries of Hungary's MOL, supplying a significant part of Hungary's oil needs. The entire Hungarian section of the pipeline is operated by MOL.

The import and processing of Russian oil has been banned under EU sanctions since 2023, with only MOL and its subsidiary, Slovnaft and the Lithvinov refinery in the Czech Republic being exempted from the ban. According to international agreements, Ukraine will be able to supply Russian oil to Hungary and Slovakia until the end of 2029.

The Friendship pipeline is considered critical infrastructure because it is one of the systems whose failure could have serious consequences on people's lives, the security of the country in question or the functioning of its economy. Critical infrastructure includes electricity and natural gas networks, power plants, water-related networks (systems providing drinking water, wastewater processing, as well as flood protection systems), communications networks, data centres, internet infrastructure, airports, rail networks, motorways, ports, hospitals, pharmaceutical supply chains, banks, stock exchanges, payment systems, military installations and public administration systems.

If any of these are attacked, it could destabilise a country, as these systems are fundamental to the functioning of the economy, and any disruption to essential services could pose a direct threat to people's lives.

The report that a sabotage operation was planned or is being planned against the Friendship pipeline raises several questions:

• If the two men apprehended in Slovakia were indeed involved in the preparation of a sabotage operation, why were they released?
• If there were no criminal proceedings launched in the case, then why did the Slovak Interior Minister make such a big deal out of what happened?
• Who would have an interest in sabotaging the Friendship pipeline and why?
• How is Hungary protecting its critical infrastructure, including the oil pipeline?

When there is no proof of sabotage preparations

The two men mentioned at the beginning of this article were captured in an operation codenamed Vostok, or East. This means that they were not discovered by chance, but were likely under the surveillance of the secret services.

This is also suggested by the fact that, according to the Interior Minister, the two men used drones to enter the no-fly zone and observe the oil pipelines, but they did the same with the transformer station near Veľké Kapušany, the compressor station of the Eustream natural gas transport company and the local railway station, which is one of the largest freight wagon transfer stations in the country. In addition, they had also snooped around the thermal power plant in Vojany and other facilities, and had carried out surveillance at the Ukrainian-Slovakian border. One of them documented the loading of military equipment onto freight wagons by the Slovak armed forces at the Michalovce railway station.

Although according to the Slovak authorities, the two men were acting as part of a group, it is not yet known what kind of group or organisation this might be – assuming that the suspicions of the Slovak secret service are accurate. Apart from the fact that the men were indeed found in possession of unusual equipment, the Slovaks do not seem to have any direct evidence against them. This would also explain why they were released.

It is also not surprising that the unusual items found with the men were in themselves insufficient to warrant a criminal prosecution. Unlike in Hungary, these devices, which are good enough to be used in intelligence operations, are commercially available in Slovakia. They may not necessarily be professional grade military equipment, but are in any case gadgets that "resemble" professional equipment. It is for this very reason that Hungarian private investigators often go to Slovakia to buy devices for use in their work, such as "spy pens" or even jamming devices like the ones found on the men who were just apprehended. In other words, the mere possession of these devices does not prove that sabotage was being prepared.

However, the mere fact that there is insufficient evidence and no charges have been brought against the men involved does not in itself undermine the credibility of the reports about the alleged preparation of sabotage. The Slovak Interior Minister also alluded to this on Saturday, when he said that the case had an intelligence, counter-intelligence and a criminal law dimension, and that these were distinctly separate. Šutaj Eštok also said that the threat of a terrorist attack remained and that the security of the Slovak section of the pipeline had therefore been stepped up.

Prevention

The intelligence, counter-intelligence and criminal strands of the case can indeed be separated, and there is a reasonable explanation for this, which lies in the difference between the mindset of the police and the intelligence services.

To put it very simply: while the primary task of the police is to catch the perpetrator of a crime and obtain the evidence necessary for prosecution, the objective of the intelligence services is to create a situation where there is no possibility of a(n anti-state) crime being committed. This also means that they may need to intervene in the chain of events before there is sufficient evidence against the persons concerned.

The latter may have been true in this case. The Slovak secret services were likely aware that, even though they could not prove it, the men involved were not gathering data just for fun. And although the evidence available was not sufficient to prosecute them, the Slovak intelligence service wanted them removed from circulation anyway – even at the risk that they might later sue the Slovak state for damages on account of being innocently dragged through the mire.

On the other hand, if the secret services knew that the case would not stand up to criminal prosecution and the people concerned were released, why did the Minister of the Interior still publicise the terrorist threat? A possible and most likely explanation is that the Slovaks wanted to send a message.

This would suggest that the Slovak secret service is convinced that those involved were indeed engaged in the preparation of a planned sabotage operation. If this is the case, the Slovak counter-intelligence was not only trying to "eliminate" the two men, but also to send a clear message to those behind the plan. This could be a group, an organisation or even a foreign state – but we will come back to that later. By publicly reporting on the event, the Slovak Interior Minister sent a signal to those on the other side that, even if they have plans for some sort of sabotage, they should not bother trying. That's why publicity was needed.

In addition, of course, there may have been political reasons for the Slovak government to release a piece of information that governments typically prefer to keep secret. And why would this be in their interest? For example, so that the Slovak cabinet, which is just as critical of Ukraine as the Hungarian government, could demonstrate the threats faced by the two countries whose leaders have been perceived as pro-Russian due to their approach to the Russian-Ukrainian war. It is no wonder that the Slovak opposition also made a political issue of the matter, expressing disbelief at the interior minister's statement.

Naturally, the otherwise far from insignificant piece of news was immediately picked up in Hungary by the government-friendly Magyar Nemzet, but it does not seem that the Hungarian authorities are making too much of a fuss about the Slovaks' warning. The Prime Minister's Cabinet Office merely reacted by saying that "Hungary is in constant contact with the Slovak authorities, and the measures required in such situations have been taken". At the same time, the Hungarian police said that no related criminal proceedings were pending. The National Police Headquarters also said that the police "are continuously conducting a risk analysis with regard to facilities linked to critical infrastructure which are important for the national economy and, if warranted, will take the necessary measures".

The police's response indicates that they are constantly monitoring critical infrastructure. But there is nothing extraordinary about this. As with other pieces of critical infrastructure, the complex protection of the Friendship oil pipeline is carried out by several national services. These include the secret services, as well as the police and even the defence forces," a source with insight into the protection of critical infrastructure told Telex.

The pipeline is under constant protection

The expert, who spoke on condition of anonymity, said there are constantly functioning surveillance systems along key sections of the pipeline and key installations are being guarded. At the same time, the possibility of drone surveillance is filtered out by constant and strict monitoring of the airspace, which is the responsibility of all NATO member states anyways.

Sensors have also been installed along the pipeline to monitor pressure fluctuations, potential leaks or external interference. Additionally, the automated systems in place are designed to detect any problems relatively quickly.

Only authorised personnel are allowed to access key points on the pipeline, such as pumping stations and storage tanks. In addition to armed guards and camera systems, security also includes the screening of employees, and the secret service also has human resources that act as a kind of warning mechanism. The latter is also important so employees who might pose a risk – for example because their lifestyle might make them vulnerable to blackmail – can be filtered out.

Protecting the Friendship pipeline is not only Hungary’s responsibility. Hungary is partnering with other countries to this end, in particular Slovakia and Russia, but the EU also provides support for the protection of critical infrastructure. Whose interests it would serve to attack the Friendship pipeline, whether on the Slovakian or the Hungarian arm of the pipeline, is another question.

The Friendship pipeline has been attacked before

There has been an attempted sabotage of the Friendship line before. On 10 May 2023, a filling station on the oil pipeline was attacked in the Bryansk region of Russia, on the border with Ukraine. According to the announcement of the Russian Transneft company at the time, explosive devices were used in the attack. Three empty oil storage tanks were damaged in the incident, but no oil spill occurred and no one was injured.

The purpose of the attack was probably to politically destabilise the region and disrupt Russian energy exports. Earlier, in March 2023, explosive devices were found near another pumping station in the same region, which also indicated preparations for sabotage. So far, no information on the alleged perpetrators of the attacks in the Bryansk region has been made public, with details probably classified or linked to ongoing investigations.

Prior to the outbreak of the Russian-Ukrainian war in February 2022, apart from the Israeli intelligence services, only the superpowers – Russia and the United States – typically dared to carry out sabotage operations, subversion, disruption, acts of terrorism or even assassinations abroad for political or military interests.

It is also noteworthy that the men apprehended and then released in Slovakia are dual citizens. In their operations abroad, the secret services prefer to use dual citizens. The case of the recent Lebanese pager blasts is a good example of this, where the two individuals who were later identified by the press and then disappeared turned out to be Hungarian-Italian and Norwegian-Indian dual citizens.

And carrying out operations abroad is definitely not a deterrent for the Russian secret services. They have carried out the most murders and sabotage operations abroad. On 16 October 2014, for example, Russian secret agents blew up an ammunition depot in the Czech Republic just a few kilometres from the Slovakian border. The fact that at the time, the authorities regarded the explosion as an accident and that Russia's involvement in the case was only discovered years later also points to the professionalism of the operation. Two people were killed in the blast, but this was only discovered a month later, as the bodies of the victims were burnt beyond recognition.

In the spring, Thomas Haldenwang, head of the German domestic intelligence services, (Federal Office for the Protection of the Constitution) warned that the risk of state-sponsored activities of sabotage had increased across Europe. Shortly before his announcement, two German-Russian dual citizens suspected of planning attacks on military and logistical targets in Germany on behalf of Russia were arrested in Germany. Around the same time, two men were charged in the UK for setting fire to a warehouse guarding aid supplies destined for Ukraine. In the Czech Republic, the Minister of Transport said that the Russians had tried to destroy the Czech railway's signalling system.

While the Ukrainian secret services have not been known to use such methods in the past, since the war has been going on, there have been repeated suggestions that they have carried out similar operations abroad. At the same time, the situation is further complicated by the fact that in the intelligence game, even the Russians may have an interest in planning sabotage operations that point to Ukrainian perpetrators – thus damaging Ukraine's image.

In the case of the blasts on the Nord Stream 1 and Nord Stream 2 pipelines two years ago, the suspicion that the perpetrators were Ukrainians is quite pronounced. The two pipelines, through which Russian natural gas would have reached Germany, were damaged on 26 September 2022 by a series of explosions at the bottom of the Baltic Sea, near the Danish island of Bornholm. Shortly after the explosions, leaks were detected in four locations on the pipelines. The blasts damaged the gas pipelines that supplied an important part of Germany's gas supply, thus dealing a major blow to Germany's energy supply.

As we reported at the time, the German prosecution issued an arrest warrant in August for a Ukrainian citizen, Volodymyr Z., shortly after the Wall Street Journal named the Ukrainian leadership as the masterminds and perpetrators behind the bombing. The Germans have so far identified two suspects, but the identity and motives of the other perpetrators remain unclear, as does the question of whether there was a state mastermind behind the sabotage. Thus, so far, the investigation has not ruled out the possibility that the operation was carried out by persons not connected to a state or state-sponsored groups, but the final evidence has not yet come to light.