A suspected foreign spy arrested in Crete last week has triggered alarm within Greek intelligence after investigators uncovered thousands of surveillance photos, among them, detailed images of cruise ships in Chania docked at Port Souda. Authorities are now probing whether the vessels, carrying thousands of tourists, were potential reconnaissance targets in a broader suspected terrorist plot.
The 26-year-old Azerbaijani national, who entered Greece on January 5 via Warsaw using a Polish residency permit, was arrested near the strategically important NATO base at Souda Bay on June 22. Greek intelligence agency EYP, working with the state police found over 5,000 photographs stored across various digital devices in his possession. Many of the images showed military facilities, Greek warships, U.S. Navy vessels.
But it was the photos of cruise ships moored in Souda that particularly raised red flags.
“These images deeply concern us. Civilian cruise vessels may have been under surveillance as potential soft targets,” a Greek security source told Realnews. “We are investigating all angles, including possible plans for future attacks or sabotage.”
The images reportedly showed multiple cruise ships visiting Souda Bay, a common stop for Eastern Mediterranean cruise itineraries. With Greece welcoming millions of cruise passengers annually, the thought of passenger ships being surveilled by a suspected foreign agent is fueling fears.
Suspicious Behavior and Tight-Lipped Defense
The suspect rented a hotel room with direct views of the Souda naval base, prepaying €1,200 in cash which is a method to avoid digital tracking. Surveillance images were reportedly taken using a professional-grade digital camera mounted on a tripod, both purchased shortly after his arrival in Athens on January 7.
Though caught off guard by the rapid arrest operation, the man refused to provide fingerprints, DNA, or access to his encrypted devices. On his laptop, forensic investigators found specialized encrypted software, believed to have been used to transmit reconnaissance immages abroad without revealing the destination or identity of the recipient.
The suspect maintained a defiant tone during questioning
“I stayed in Crete to enjoy the island, take walks, and eat ice cream,” he told both police and intelligence officers. He repeated this defense before the prosecutor, but a judge ordered his detention citing national security concerns.
Foreign Bank Card and Suspected Financiers
Authorities also discovered a foreign-issued ATM card believed to be connected to financial backers outside Greece. Investigators say he exclusively used cash locally, while withdrawing funds from the card at ATMs. This raised suspicions that the card might be linked to a foreign intelligence network.
“The card may help trace the money trail and reveal those who sent him,” said a Greek official familiar with the case. “We’re also examining whether he had contact with anyone in Athens or even tried to recruit others.”
Pattern Emerges
What makes the case even more alarming is the striking similarity to a parallel investigation in Cyprus. Just a day before the arrest in Crete, Cypriot authorities detained a 44-year-old Azerbaijani man, allegedly acting on orders from Iran’s Islamic Revolutionary Guard Corps (IRGC) to carry out surveillance of Israeli and Western targets.
According to shared intelligence, both suspects used identical camera models, memory cards, tripods, and same encrypted communication tools. The Cypriot suspect had been allegedly preparing an attack on Israeli nationals.
“This raises the possibility of a wider espionage and sabotage network operating in NATO territory,” a senior Greek defense analyst siad. “The fact that civilian cruise ships appear among the targets only amplifies the threat level.”
Greek, Cypriot, and Israeli intelligence services are now collaborating to determine whether the two men were part of the same operation and whether other agents are active in the region.
Recently Israel conducted Operation Safe Return, in which the Israeli cruise ship Crown Iris, was deployed for the emergency repatriation of citizens amid the regional conflict. With airspace closed due to Iranian missile threats, the Crown Iris was used as a maritime bridge between Cyprus and Israel.
On June 19, 2025, the ship evacuated around 1,500 foreign nationals, including Birthright Israel participants, from Ashdod to Limassol. It then returned with approximately 1,800 Israeli citizens, escorted by the Navy, safely docking in Ashdod.
Beyond this operation, Crown Iris regularly sails 3-night cruises to Cyprus and 4-night cruises to Greece, including periodic calls at Souda.
While no official advisories have been issued to cruise operators yet, several lines are reportedly reviewing port security protocols and coordinating with Greek authorities. The Souda Bay region is a routine anchorage point for cruise vessels visiting Chania, and concerns about a potential extremist interest in targeting tourists may result in increased surveillance and patrols.
