A first option is that the attacks could have been carried out as an underwater operation using advanced submarine technology. This implies that we are looking at a state and its navy. Although the attacks took place outside the territorial waters of the Nato members Denmark and Sweden, they could be interpreted as an act of war. The second scenario is an operation launched from a privately owned surface vessel, such as a fishing boat being used as a platform for divers or submersibles to place explosives. In this case, the attack vessel was hiding in everyday maritime traffic. This scenario points us to so called “grey-zone” tactics: an attack by a group acting indirectly on behalf of state interests. The involvement of any government will then be very difficult to verify. This scenario implies that the Nord Stream attack was likely to have been the first ever recorded grey-zone activity in the European subsea. Grey-zone tactics are increasingly common at sea, and have been associated with the Iranian Revolutionary Guards seizing ships, or the Chinese fishing fleet advancing territorial claims. Europe is effectively subsea blind. Grey-zone tactics at sea have not been extensively studied, but similar tactics are well understood in the cyber domain. In that domain it is usually a hacker group operating formally “independent” from governmental agencies that carry out an attack. The comparison to the cyber world is useful as it gives us insights into why the maritime domain is very vulnerable. The sea is more similar to cyberspace than first meets the eye. Like cyberspace, the sea is crowded with a highly complex set of state and non-state actors and multiple overlapping jurisdictions. That makes it easier to hide, and more difficult to trace and identify responsible actors. The legal ambiguities also raise the question of how to prosecute any perpetrators.