Spy drops, submarine secrets and peanut butter sandwiches: What we know about alleged Navy espionage case

A US Navy nuclear engineer and his wife face espionage-related charges after allegedly trying to sell closely held US submarine secrets with other countries for thousands of dollars in cryptocurrency, according to the US Department of Justice.

In the case presented by federal prosecutors, the FBI posed as foreign officials to exchange encrypted messages with the naval engineer using code names, negotiate dead-drop locations, and send $100,000 in US dollars in the Monero cryptocurrency before he allegedly shared a memory card with top-secret plans inside a peanut butter sandwich, a Band-Aid and a chewing gum package.

Jonathan and his wife Dianne Toebbe, a teacher, both of Annapolis, Maryland, were arrested on 9 October for allegedly sharing the designs of nuclear-powered warships to a person they believed was working for another country, who was actually an undercover FBI agent, according to court documents.

“The complaint charges a plot to transmit information relating to the design of our nuclear submarines to a foreign nation,” Attorney General Merrick Garland said in a statement.

The charges allege violations of the Atomic Energy Act. The Toebbes were set to make their first court appearance in the Northern District of West Virginia on 12 October.

Federal prosecutors did not allege that the Toebbes shared those secrets with a foreign power or that another country has obtained the information they allegedly sold, but that the couple allegedly believed to be sharing information with a non-adversarial power.

Here is what we know so far, according to the criminal complaint filed in US District Court on 8 October.

Who is Jonathan Toebbe?

Mr Toebbe held an active national security clearance, providing him access to restricted data, while serving as a nuclear engineer assigned to the Naval Nuclear Propulsion Program, also known as Naval Reactors, according to federal prosecutors.

His clearance provided him access to “sensitive design elements” and capability of US nuclear-powered warships.

According to court documents, Mr Toebbe worked on naval reactors in Virginia from 2012 to 2014. He also worked at the government research lab Bettis Atomic Power Laboratory.

He was discharged from active duty and maintained a reserve obligation termination date through 23 July, 2020. His security clearance was renewed on 25 March of that year, days before FBI agents received a package that was postmarked 1 April.

The package

In December 2020, the FBI reportedly obtained a package intercepted by authorities but intended for another country containing operational manuals and other information – all marked “CONFIDENTIAL” – in what appeared to be an attempt to establish a covert relationship, according to court documents.

It also contained an SD card and instructions for responding through an encrypted communication platform.

“Please forward this letter to your military intelligence agency,” a note attached to the package said, according to prosecutors. “I believe this information will be of great value to your nation. This is not a hoax.”

The package was postmarked on 1 April, 2020, with a return address in Pittsburgh, though it is unclear why federal agents did not have access until several months later.

The SD card contained three “keys” for communicating with the sender through the encrypted email service ProtonMail.

On 26 December, 2020, the FBI sent its first message to “Alice” using the name “Bob” through ProtonMail: “We received your letter. We want to work with you. It has been many months, so we need to know you are still out there. Please respond to this message, then we will provide instruction how to proceed.”

“Alice” responded on 10 February: “Thank you for contacting me. I am still here. The covid disease has made it more difficult to find chances to check this email. Let us discuss how to proceed.”

Encrypted emails and cryptocurrency exchange

On 24 February, an undercover FBI agent responded, appearing to lure the messenger in person with a “trusted friend in your country who has a gift for you to compensate for your efforts”

“Alice” replied on 5 March saying they are “uncomfortable with this arrangement.”

“Face to face meetings are very risky for me, as I am sure you understand,” the message said, according to court documents.

“Alice” suggested exchanging information through an encrypted cloud storage in exchange for a “suitable gift” in the Monero cryptocurrency in the amount of $100,000, which “should be enough to prove to me that you are not an unwelcome third party looking to make trouble for me,” the message said, according to documents.

“I understand this is a large request. However, please remember I am risking my life for your benefit and I have taken the first step,” the message continued. “Please help me trust you fully.”

In a response on 18 March, the agent offered a “neutral drop location” to exchange information and payment. A few days later, “Alice” said they were “concerned that using a dead drop location” makes them “vulnerable” and presented a compromise, in an effort to avoid detection.

Over the next several weeks, “Alice” and “Bob” negotiated a signal location in Washington DC to “gain bona fides” with the messenger, according to prosecutors.

On May 31, 2021, the FBI received confirmation from “Alice” via ProtonMail that the signal was received.

“Now I am comfortable telling you your assumption that Pittsburgh would be a convenient location for me is incorrect,” the message said. “For now I can tell you I am located near Baltimore, Maryland. Please let me know when you are ready to proceed with our first exchange.”

The peanut butter sandwich drop

On 10 June, the FBI paid “Alice” approximately $10,000 in Monero. A week later, the FBI sent instructions for a dead-drop location in West Virginia, along with an assurance that “Alice” would be paid $20,000 upon verification of the information contained in the drop.

At 10.41am on 26 June, Mr Toebbe was allegedly observed by law enforcement at the location.

At the same time, his wife Dianna was “standing approximately one meter away” from him appearing “to act as a lookout” and “survey the surrounding area,” according to court documents.

FBI agents then recovered a blue 16GB SanDisk SD card “wrapped in plastic and placed between two slices of bread on a half of a peanut butter sandwich” inside a plastic bag, documents show.

A message on the card from “Alice” said: “I hope your experts are very happy with the sample provided and I understand the importance of a small exchange to grow our trust … I expect your new communication instructions will be just as clear and safe as your drop instructions.”

“Alice” proposed creating a “natural” digital footprint for orchestrating future drop sites – looking up articles like “fun things to do in Baltimore” and “stumbling” across “beautiful hikes close to home,” for example, to establish a cover.

The Band-Aid drop

On 31 July, the couple were observed traveling from their home in Maryland to Pennsylvania allegedly to make another dead drop. Later that day, the FBI recovered a 32GB SD card “ hidden in a sealed Band-Aid wrapper with a Band-Aid” inside a plastic Ziploc bag.

The SD card contained another message from “Alice” along with several files that Justice Department documents had marked as “redacted.”

“This information was slowly and carefully collected over several years in the normal course of my job to avoid attracting attention and smuggled past security checkpoints a few pages at a time,” the message said.

“Alice” also proposed that the recipient send a total of $5m in cryptocurrency in an apparent attempt to prove that the recipient was not a federal agent attempting to lure them.

“New reports confirm this is a common tactic used by US security forces to expose agents,” the message said. “Please do not be offended by this, but your generosity so far also matches exactly an adversaries [sic] likely play to entrap me.”

The chewing gum drop

On 27 August, Mr Toebbe allegedly dropped another SD card “concealed in a chewing gum package” at a dead-drop site in Virginia.

The next day, the FBI paid “Alice” $70,000 in Monero.

FBI agents discovered that the contents of the SD card “contained schematic designs for the Virginia-class submarine,” described as “nuclear-powered cruise missile fast-attack submarines, which incorporate the latest in stealth, intelligence gathering, and weapons systems technology.” Each cost roughly $3bn and are to remain in service through at least 2060, according to court documents.

“I have considered the possible need to leave on short notice,” said an attached message from “Alice.”

“Should that ever become necessary, I will be forever grateful for your help extracting me and my family,” the message said. “We have passports and cash set aside for this purpose.”

The message continued: “One day, when it is safe, perhaps two old friends will have a chance to stumble into each other at a cafe, share a bottle of wine and laugh over stories of their shared exploits. A fine thought, but I agree that our mutual need for security may make that impossible. Whether we meet or no, I will always remember your bravery in serving your country and your commitment to helping me.”