Suspected Spy in Crete Sparks Cruise Ship Security Fears

A recent arrest in Crete has sparked serious concern among Greek intelligence agencies after a foreign national was found with thousands of surveillance photos, including detailed images of cruise ships docked at the Port of Souda in Chania. Authorities are now investigating whether these civilian vessels, which routinely carry large numbers of tourists, were being assessed as part of a larger suspected terror plot.

The individual, a 26-year-old Azerbaijani citizen, arrived in Greece on January 5 via Warsaw using a Polish residence permit. He was apprehended on June 22 near the strategically significant NATO naval base at Souda Bay. During a joint investigation by the National Intelligence Service (EYP) and Greek police, more than 5,000 images were recovered from his electronic devices. These included shots of Greek and American military assets—but notably also featured multiple cruise ships.

Cruise Ship Surveillance Raises Concerns

Security experts were especially alarmed by the photographs of cruise ships.

“These images deeply concern us. Civilian cruise vessels may have been under surveillance as potential soft targets,” a Greek security source told Realnews. “We are investigating all angles, including possible plans for future attacks or sabotage.”

The photos showed several different ships docked at Souda Bay, which is a regular stop for cruise itineraries through the Eastern Mediterranean. Given the volume of cruise traffic in Greece, the possibility of these vessels being monitored by a suspected foreign agent has heightened alarm levels.

Suspicious Behavior and Surveillance Gear

Investigators found that the suspect had booked a hotel room overlooking the naval base, paying €1,200 in cash—a tactic commonly used to avoid digital traces. He also acquired a professional camera and tripod shortly after arriving in Athens on January 7, allegedly used to take high-quality surveillance images.

Though he was caught by surprise during the arrest, the suspect refused to provide biometric data or grant access to his encrypted devices. Forensics teams found encryption software on his laptop believed to be designed for securely transmitting surveillance materials without revealing their final destination.

During questioning, he offered a casual explanation for his presence in Crete.

“I stayed in Crete to enjoy the island, take walks, and eat ice cream,” he told authorities and later repeated this claim before a prosecutor. Nevertheless, a judge ordered his detention on national security grounds.

Financial Links Under Scrutiny

Authorities also uncovered a foreign-issued bank card thought to be linked to overseas financial sponsors. While the suspect used only cash for local purchases, ATM records show frequent withdrawals using this card, raising suspicions of a connection to a broader intelligence network.

“The card may help trace the money trail and reveal those who sent him,” a Greek official said. Investigators are also exploring whether he interacted with anyone in Athens or attempted to enlist others in his activities.

Echoes of a Cyprus Case

What further elevates the gravity of the case is its similarity to an incident in Cyprus. Just one day before the Crete arrest, Cypriot authorities detained a 44-year-old Azerbaijani man accused of working for Iran’s Islamic Revolutionary Guard Corps (IRGC). That suspect was allegedly conducting surveillance on Israeli and Western assets.

Both individuals reportedly used the same model of digital camera, identical tripods and memory cards, and similar encrypted messaging platforms. Intelligence reports suggest the Cypriot detainee had been preparing to carry out an attack targeting Israeli nationals.

“This raises the possibility of a wider espionage and sabotage network operating in NATO territory,” commented a Greek defense analyst. “The fact that civilian cruise ships appear among the targets only amplifies the threat level.”

Greek, Israeli, and Cypriot intelligence agencies are now cooperating closely to assess whether the two individuals were linked and whether more operatives could be active in the region.

Cruise Ship Deployment in Recent Operations

The cruise ship Crown Iris, an Israeli vessel, played a key role in Operation Safe Return, an emergency evacuation effort prompted by recent conflict and Iranian missile threats. With airspace closed, the vessel was used to ferry passengers between Cyprus and Israel.

On June 19, 2025, the Crown Iris transported around 1,500 foreign nationals, including participants in the Birthright Israel program, from Ashdod to Limassol. It returned with approximately 1,800 Israeli citizens, safely docking in Ashdod under naval escort.

Outside of emergency missions, the Crown Iris runs short cruises in the region, regularly visiting Cyprus and Greece, with occasional stops at Souda Bay.

Heightened Security Measures Possible

Although Greek authorities have not issued formal alerts to cruise operators, some companies are reportedly reevaluating their port security measures. Given Souda Bay’s popularity as a cruise anchorage and its proximity to military installations, increased monitoring and patrols may soon follow as officials work to mitigate potential threats to tourists and civilian vessels.