During the US-Israeli attacks on Iran’s nuclear facilities in June of last year, two cases of spying were discovered, one related to the NATO base at Souda and the other to military bases in Cyprus. In both cases the perpetrators were of Azeri origin and suspected of having links with Iran’s Revolutionary Guards. Another case of suspected spying at Souda has now come to light, with a 36-year-old Georgian, also of Azeri origin, being found to have photographed the movements of warships at the base in the period before the outbreak of the current war.

Apart from their similarity of ethnic background, the suspects’ methods in both Cretan cases seem to have been more or less the same. They rented a hotel room in the Kalyves area with a panoramic view of Souda Bay, and proceeded to take multiple photographs and videos of warship movements in and out of the naval base, which they then encrypted and sent to unknown sources, presumed to be Iranian.

In both cases in Crete, and the one in Cyprus, the suspects were fairly quickly identified and arrested – the Police and Intelligence Services being on the lookout for suspicious behaviour in the current times of increased vigilance. Which leads one to question why, having been caught once, they would use the same method again a few months’ later. It suggests at the least a lack of communication, at the worst a carelessness on the part of their Iranian spymasters (if such they are) about the fate of their operatives.

The current case
The current spying activity has been widely reported in both the local and national media. Because of its sensitive nature, the Police are maintaining what one source described as “radio silence ” over the ongoing investigations, with the result that media reports are fragmentary and appear to contain a certain amount of speculation. However, the salient facts, as reported by the Haniotika Nea, are as follows:

A 36-year-old man was last week sentenced to 2 years’ imprisonment and a fine of €5,000, without leave to appeal, by the Court of Summary Justice in Athens, for illegal entry into and residence in the country, while he continues to be investigated for spying activities at Souda. A Georgian of Azeri descent, the 36-year-old appeared in Athens on Monday 2nd March and during his examination by the Court, speaking through an interpreter, he claimed to be a truck driver. His activities were uncovered by the National Intelligence Service as a result of heightened surveillance at the country’s entry points and he had been under observation since his arrival at Souda on 3rd February.

The National Intelligence Service and the Police have learned that spies of the Iranian security services and especially the Revolutionary Guards have recently been monitoring the port of Souda and in particular the movements of the US aircraft carrier Gerald R. Ford. Encryption software known to be used by Iran was found on the suspect’s mobile phone, which has turned investigations towards his contacts with that country and whether he was spying for them. The Georgian spoke only only English during his stay in the Chania area, although it was established that he spoke both Persian and Arabic.
(Haniotika Nea 04/03/36)

The suspect’s movements
According to various reports in the national media, the man had flown into Athens from Düsseldorf on 3rd February and had taken another plane on the same day to Chania, where he booked a hotel room in the centre of Souda. An employee of the hotel told reporters: “His passport said he was from Poland, he was of Georgian descent. He knew 5-6 languages from that part of the world, including Turkish. He wanted to stay for a month at Aptera.”

A week later the man moved to other accommodation with a more unobstructed view of the Naval Base. According to some reports he tried to book a room at the same hotel that had been used by the Azeri suspect last June, while others say that he rented a luxury villa at Aptera.

On 24th February the accused was seen circling the port of Souda in a rented car, wearing a cap and dark glasses, and holding his mobile constantly in his hand. This was the day after the USS Gerald R. Ford had arrived at the Souda Naval Base. On 28th February, having apparently finished his mission, he returned to Athens and two days later headed for the airport, where he was arrested on the assumption that he was trying to leave the country. “I don’t understand why you are holding me, I’m a simple tourist. Why are you doing this?” he reportedly said to the Police on being arrested, later changing his story to say that he was a truck driver.

It has been established that the Georgian’s phone number was found among the contacts of the 26-year-old Azeri who was arrested for spying at Souda last June. This and the similarities of the two cases have led the authorities to surmise that the two men, as well as the person arrested in Cyprus last year, might be part of a spy ring operated by the Revolutionary Guards.

Souda a major refuelling point for US forces
The suspected spy could have gained a lot of information from the public domain, without exposing himself to suspicion, since the recent media focus on Souda has resulted in numerous reports on warship movements at the base, including ample photographic material from both press and social media sources, showing the USS Gerald R. Ford entering and leaving the base. As reported in Haniotika Nea this week, both the Air and Naval Bases are a major hub for the refuelling and provisioning of US forces:

“As indicated by increased activity since the start of hostilities on 1st March, the bases at Souda are one of the main provisioning points for US air and naval forces. Data from tracking apps suggest that a large part of the supplies used to reinforce the US and other forces pass through Souda. Dozens of daily flights have been logged at the air base, chiefly of different types of US transport aircraft to and from US air bases in Europe and the US itself. On some days there were more than 40 take-offs and landings of aircraft.

On the evening of Monday 9th March, the Spanish frigate Cristobal Colon called at the Naval Base on the way to the Eastern Mediterranean, while two other warships were seen at the base at Marathi. The Cristobal Colon has one of the most advanced air defence systems in its class, as well as Harpoon anti-ship missiles and the Sea Sparrow missile defence system.

Patriot air defence missiles as well as smaller anti-aircraft and anti-drone systems have been deployed to protect the two bases from airborne attacks.”
(Haniotika Nea, 11/03/26)

Update: According to a report in Kathimerini, another person suspected of spying was arrested in Chania on Thursday 12th March. A Polish citizen, the man had been staying for several months at Marathi beach, which is close to the Souda Naval Base, and had been taking photographs of the jetties at the base.
(Haniotika Nea, 13/03/26)