Andhra Pradesh Police have placed 13 Indian Navy personnel among 18 suspects in a Pakistan-linked espionage probe and arrested two persons, including a naval employee posted at Visakhapatnam, under Operation Firewall-2026.
The Counter Intelligence Cell (CIC) of the Andhra Pradesh Police said the module was allegedly in contact with Pakistan-based intelligence operatives and was collecting and passing sensitive information on naval and defence establishments, including locations in Visakhapatnam, through encrypted channels. The operation, conducted on 1 October 2026, followed a case registered on 2 September. Twelve counter-intelligence teams carried out searches across 10 states and Union Territories — Andhra Pradesh, Kerala, Maharashtra, Karnataka, Gujarat, Goa, Delhi, Tamil Nadu, Chhattisgarh and Bihar — in coordination with state anti-terrorism squads, naval officials and local police. Electronic devices were seized under due procedure.
Of the 18 suspects, 13 are naval personnel. Police have not named the remaining persons. Two arrests have been made after their roles were prima facie established. Investigation against the other 16 continues. The CIC has said further details will be disclosed only at an appropriate stage, citing the requirements of the inquiry and national security.
Annam Sai Varaprasad, a civilian contract driver engaged for naval officers, was arrested in Visakhapatnam. Police allege that he shared sensitive and classified information on naval and defence establishments with a Pakistan-based operative and received money for it. He was remanded to judicial custody until 14 October and lodged in the District Jail, Visakhapatnam.
Pradeep Mukherjee (also rendered Mukharjee in some police-linked reports), a naval employee attached to the Visakhapatnam naval base, was arrested in Coimbatore, Tamil Nadu, while attending a training course at INS Agrani. Reports place the arrest on 3 October. He is 31 and joined the Navy in 2014, according to accounts citing investigators. Police allege that he shared a one-time password to activate a WhatsApp account for a Pakistan-based operative, remained in communication with such operatives, and passed sensitive information on naval and defence establishments. An Andhra Pradesh team obtained a transit warrant, brought him to Vijayawada, and produced him before the jurisdictional court. He was remanded until 14 October and lodged in the district jail at Vijayawada.
Some reports, including accounts in The Times of India and Firstpost, state that Mukherjee was allegedly cultivated through a social-media honeytrap, with fake profiles used to move contact from Facebook to encrypted WhatsApp. That detail is not set out in the CIC statement quoted by Hindustan Times, which limits the official allegation to the OTP, communication with operatives, and sharing of defence-related information. The precise content passed to the handlers has not been made public.
The case at the Counter Intelligence Police Station, Vijayawada, has been registered under the Official Secrets Act and the Bharatiya Nyaya Sanhita, including provisions on waging war against India and conspiracy to commit offences against the State. Some reports also cite the Unlawful Activities (Prevention) Act.
The probe is centred on the Visakhapatnam naval establishment, headquarters of the Eastern Naval Command, a base that supports fleet operations and the Ship Building Centre associated with India’s nuclear-powered ballistic missile submarine programme. Police have described the alleged activity as an espionage conspiracy prejudicial to national security. They have not stated that classified nuclear or operational plans were compromised, and no such claim should be treated as established.
The Navy has not issued a detailed public statement in the reports available so far. With 13 serving personnel still under scrutiny and digital and financial trails being examined, the scale of the alleged breach remains open. Both arrested men are in judicial custody until 14 October, and the CIC has said the investigation into the wider module is continuing.
