A US Navy nuclear engineer and his wife face espionage-related charges after allegedly trying to sell closely held US submarine secrets with other countries for thousands of dollars in cryptocurrency, according to the US Department of Justice.
In the case presented by federal prosecutors, the FBI posed as foreign officials to exchange encrypted messages with the naval engineer using code names, negotiate dead-drop locations, and send $100,000 in US dollars in the Monero cryptocurrency before he allegedly shared a memory card with top-secret plans inside a peanut butter sandwich, a Band-Aid and a chewing gum package.
Jonathan and his wife Diana Toebbe, a teacher, both of Annapolis, Maryland, initially pleaded not guilty to charges against them on 20 October. An indictment accuses them of conspiracy to communicate restricted data and two counts of communication of restricted data.
In February, the couple pleaded guilty to conspiring to sell restricted data. A sentencing data has not been set.
The couple was arrested on 9 October for allegedly sharing the designs of nuclear-powered warships to a person they believed was working for another country, who was actually an undercover FBI agent, according to court documents.
Prosecutors argued that the couple should remain in custody, as they pose a flight risk or “serious risk obstruction of justice,” according to documents filed in US District Court on 11 October.
Federal prosecutors did not allege that the Toebbes shared those secrets with a foreign power or that another country has obtained the information they allegedly sold, but that the couple allegedly believed to be sharing information with a non-adversarial power.
Here is what we know so far, according to the criminal complaint filed in US District Court on 8 October.
Who is Jonathan Toebbe?
The couple married in 2003, according to documents reviewed by The Washington Post, and later moved to Colorado where they worked as science teachers at a private middle and high school.
Mr Toebbe pursued an advanced degree in nuclear engineering at the Colorado School of Mines, and he left the programme for the Navy in 2012, according to the newspaper.
The couple sold their home in August 2010 and relocated to the Washington DC area, where Mr Toebbe joined the Naval Nuclear Propulsion Program, which oversees nuclear reactors used to power more than 60 vessels in the US naval fleet, The Washington Post reported.
Diana Toebbe, meanwhile, joined the faculty at Key School in Annapolis, which their two children also attended, according to the newspaper.
Mr Toebbe held an active national security clearance, proing him access to restricted data, while serving as a nuclear engineer assigned to the Naval Nuclear Propulsion Program, according to federal prosecutors.
His clearance proed him access to “sensitive design elements” and capability of US nuclear-powered warships, court documents show.
Mr Toebbe worked on naval reactors in Virginia from 2012 to 2014, and he also worked at the government research lab Bettis Atomic Power Laboratory.
He was discharged from active duty and maintained a reserve obligation termination date through 23 July, 2020. His security clearance was renewed on 25 March of that year – days before FBI agents received a package that was postmarked 1 April.
The package
In December 2020, the FBI reportedly obtained a package intercepted by authorities but intended for another country containing operational manuals and other information – all marked “CONFIDENTIAL” – in what appeared to be an attempt to establish a covert relationship, according to court documents.
It also contained an SD card and instructions for responding through an encrypted communication platform.
“Please forward this letter to your military intelligence agency,” a note attached to the package said, according to prosecutors. “I believe this information will be of great value to your nation. This is not a hoax.”
The residence of Jonathan and Diana Toebbe in Annapolis, Maryland
(AP)
The package was postmarked on 1 April, 2020, with a return address in Pittsburgh, though it is unclear why federal agents did not have access until several months later.
The SD card contained three “keys” for communicating with the sender through the encrypted email service ProtonMail.
On 26 December, 2020, the FBI sent its first message to “Alice” using the name “Bob” through ProtonMail: “We received your letter. We want to work with you. It has been many months, so we need to know you are still out there. Please respond to this message, then we will proe instruction how to proceed.”
“Alice” responded on 10 February: “Thank you for contacting me. I am still here. The co disease has made it more difficult to find chances to check this email. Let us discuss how to proceed.”
Encrypted emails and cryptocurrency exchange
On 24 February, an undercover FBI agent responded, appearing to lure the messenger in person with a “trusted friend in your country who has a gift for you to compensate for your efforts”
“Alice” replied on 5 March saying they are “uncomfortable with this arrangement.”
“Face to face meetings are very risky for me, as I am sure you understand,” the message said, according to court documents.
“Alice” suggested exchanging information through an encrypted cloud storage in exchange for a “suitable gift” in the Monero cryptocurrency in the amount of $100,000, which “should be enough to prove to me that you are not an unwelcome third party looking to make trouble for me,” the message said, according to documents.
“I understand this is a large request. However, please remember I am risking my life for your benefit and I have taken the first step,” the message continued. “Please help me trust you fully.”
In a response on 18 March, the agent offered a “neutral drop location” to exchange information and payment. A few days later, “Alice” said they were “concerned that using a dead drop location” makes them “vulnerable” and presented a compromise, in an effort to avoid detection.
Over the next several weeks, “Alice” and “Bob” negotiated a signal location in Washington DC to “gain bona fides” with the messenger, according to prosecutors.
On May 31, 2021, the FBI received confirmation from “Alice” via ProtonMail that the signal was received.
“Now I am comfortable telling you your assumption that Pittsburgh would be a convenient location for me is incorrect,” the message said. “For now I can tell you I am located near Baltimore, Maryland. Please let me know when you are ready to proceed with our first exchange.”
The peanut butter sandwich drop
On 10 June, the FBI paid “Alice” approximately $10,000 in Monero. A week later, the FBI sent instructions for a dead-drop location in West Virginia, along with an assurance that “Alice” would be paid $20,000 upon verification of the information contained in the drop.
At 10.41am on 26 June, Mr Toebbe was allegedly observed by law enforcement at the location.
At the same time, his wife Diana was “standing approximately one meter away” from him appearing “to act as a lookout” and “survey the surrounding area,” according to court documents.
FBI agents then recovered a blue 16GB SanDisk SD card “wrapped in plastic and placed between two slices of bread on a half of a peanut butter sandwich” inside a plastic bag, documents show.
A message on the card from “Alice” said: “I hope your experts are very happy with the sample proed and I understand the importance of a small exchange to grow our trust … I expect your new communication instructions will be just as clear and safe as your drop instructions.”
“Alice” proposed creating a “natural” digital footprint for orchestrating future drop sites – looking up articles like “fun things to do in Baltimore” and “stumbling” across “beautiful hikes close to home,” for example, to establish a cover.
The Band-Aid drop
On 31 July, the couple were observed traveling from their home in Maryland to Pennsylvania allegedly to make another dead drop. Later that day, the FBI recovered a 32GB SD card “ hidden in a sealed Band-Aid wrapper with a Band-Aid” inside a plastic Ziploc bag.
The SD card contained another message from “Alice” along with several files that Justice Department documents had marked as “redacted.”
“This information was slowly and carefully collected over several years in the normal course of my job to avoid attracting attention and smuggled past security checkpoints a few pages at a time,” the message said.
“Alice” also proposed that the recipient send a total of $5m in cryptocurrency in an apparent attempt to prove that the recipient was not a federal agent attempting to lure them.
“New reports confirm this is a common tactic used by US security forces to expose agents,” the message said. “Please do not be offended by this, but your generosity so far also matches exactly an adversaries [sic] likely play to entrap me.”
The chewing gum drop
On 27 August, Mr Toebbe allegedly dropped another SD card “concealed in a chewing gum package” at a dead-drop site in Virginia.
The next day, the FBI paid “Alice” $70,000 in Monero.
FBI agents discovered that the contents of the SD card “contained schematic designs for the Virginia-class submarine,” described as “nuclear-powered cruise missile fast-attack submarines, which incorporate the latest in stealth, intelligence gathering, and weapons systems technology.” Each cost roughly $3bn and are to remain in service through at least 2060, according to court documents.
“I have considered the possible need to leave on short notice,” said an attached message from “Alice.”
“Should that ever become necessary, I will be forever grateful for your help extracting me and my family,” the message said. “We have passports and cash set aside for this purpose.”
The message continued: “One day, when it is safe, perhaps two old friends will have a chance to stumble into each other at a cafe, share a bottle of wine and laugh over stories of their shared exploits. A fine thought, but I agree that our mutual need for security may make that impossible. Whether we meet or no, I will always remember your bravery in serving your country and your commitment to helping me.”
This story was originally published on 11 October and updated to reflect developments in the case.
