Spy drops, submarine secrets and peanut butter sandwiches: What we know about alleged Navy espionage case

A naval engineer and his wife tried to exchange military secrets for cryptocurrency using drop sites and encrypted messages, FBI claims

A US Navy nuclear engineer and his wife have pleaded guilty to allegedly trying to sell closely held US submarine secrets to an unnamed foreign government for $100,000 in cryptocurrency.

Prosecutors say the FBI posed as foreign officials to exchange encrypted messages with the naval engineer using code names, negotiate dead-drop locations, and send tens of thousands of US dollars in the Monero cryptocurrency before he allegedly shared a memory card with top-secret plans inside a peanut butter sandwich, a Band-Aid and a chewing gum package.

Jonathan and his wife Diana Toebbe, a teacher, both of Annapolis, Maryland, were arrested after performing a “dead drop” in West Virginia in October 2021.

Mr Toebbe is accused of at first sending a package of secret information about Virginia-class nuclear submarines to a foreign government, which in turn was handed it over to US federal agents.

The FBI then ran a months-long undercover operation in which they contacted Mr Toebbe and “bought” secret documents from him that he was able to access with his security clearance.

The couple pleaded guilty in federal court in West Virginia on 27 September 2022, to one felony count each of conspiracy to communicate restricted data. The pleas came a month after a previous plea agreement was rejected by a judge in the case.

Under the latest plea agreement, they would face a maximum of life imprisonment and a $100,000 fine. Prosecutors have said they will seek a sentence at the lower end of the guidelines for Ms Toebbe.

Prosecutors had previously asked for Mr Toebbe to get between 12 and 17 years behind bars, and three years for his wife.

But that was rejected by US District Judge Gina Groh, who called sentencing options put forward by prosecutors as “strikingly deficient” given the alleged crime.

If the court does not accept the latest plea deal the couple will be able to withdraw them and go to trial in January 2023.

Who is Jonathan Toebbe?

The couple married in 2003, according to documents reviewed by The Washington Post, and later moved to Colorado where they worked as science teachers at a private middle and high school.

Mr Toebbe pursued an advanced degree in nuclear engineering at the Colorado School of Mines, and he left the programme for the Navy in 2012, according to the newspaper.

The couple sold their home in August 2010 and relocated to the Washington DC area, where Mr Toebbe joined the Naval Nuclear Propulsion Program, which oversees nuclear reactors used to power more than 60 vessels in the US naval fleet, The Washington Post reported.

Diana Toebbe, meanwhile, joined the faculty at Key School in Annapolis, which their two children also attended, according to the newspaper.

Mr Toebbe held an active national security clearance, providing him access to restricted data, while serving as a nuclear engineer assigned to the Naval Nuclear Propulsion Program, according to federal prosecutors.

His clearance provided him access to “sensitive design elements” and capability of US nuclear-powered warships, court documents show.

Mr Toebbe worked on naval reactors in Virginia from 2012 to 2014, and he also worked at the government research lab Bettis Atomic Power Laboratory.

He was discharged from active duty and maintained a reserve obligation termination date through 23 July, 2020. His security clearance was renewed on 25 March of that year – days before FBI agents received a package that was postmarked 1 April.

The package

In December 2020, the FBI reportedly obtained a package intercepted by authorities but intended for another country containing operational manuals and other information – all marked “CONFIDENTIAL” – in what appeared to be an attempt to establish a covert relationship, according to court documents.

It also contained an SD card and instructions for responding through an encrypted communication platform.

“Please forward this letter to your military intelligence agency,” a note attached to the package said, according to prosecutors. “I believe this information will be of great value to your nation. This is not a hoax.”

The residence of Jonathan and Diana Toebbe in Annapolis, Maryland (AP)

The package was postmarked on 1 April, 2020, with a return address in Pittsburgh, though it is unclear why federal agents did not have access until several months later.

The SD card contained three “keys” for communicating with the sender through the encrypted email service ProtonMail.

On 26 December, 2020, the FBI sent its first message to “Alice” using the name “Bob” through ProtonMail: “We received your letter. We want to work with you. It has been many months, so we need to know you are still out there. Please respond to this message, then we will provide instruction how to proceed.”

“Alice” responded on 10 February: “Thank you for contacting me. I am still here. The covid disease has made it more difficult to find chances to check this email. Let us discuss how to proceed.”

Encrypted emails and cryptocurrency exchange

On 24 February, an undercover FBI agent responded, appearing to lure the messenger in person with a “trusted friend in your country who has a gift for you to compensate for your efforts”

“Alice” replied on 5 March saying they are “uncomfortable with this arrangement.”

“Face to face meetings are very risky for me, as I am sure you understand,” the message said, according to court documents.

“Alice” suggested exchanging information through an encrypted cloud storage in exchange for a “suitable gift” in the Monero cryptocurrency in the amount of $100,000, which “should be enough to prove to me that you are not an unwelcome third party looking to make trouble for me,” the message said, according to documents.

“I understand this is a large request. However, please remember I am risking my life for your benefit and I have taken the first step,” the message continued. “Please help me trust you fully.”

In a response on 18 March, the agent offered a “neutral drop location” to exchange information and payment. A few days later, “Alice” said they were “concerned that using a dead drop location” makes them “vulnerable” and presented a compromise, in an effort to avoid detection.

Over the next several weeks, “Alice” and “Bob” negotiated a signal location in Washington DC to “gain bona fides” with the messenger, according to prosecutors.

On May 31, 2021, the FBI received confirmation from “Alice” via ProtonMail that the signal was received.

“Now I am comfortable telling you your assumption that Pittsburgh would be a convenient location for me is incorrect,” the message said. “For now I can tell you I am located near Baltimore, Maryland. Please let me know when you are ready to proceed with our first exchange.”

The peanut butter sandwich drop

On 10 June, the FBI paid “Alice” approximately $10,000 in Monero. A week later, the FBI sent instructions for a dead-drop location in West Virginia, along with an assurance that “Alice” would be paid $20,000 upon verification of the information contained in the drop.

At 10.41am on 26 June, Mr Toebbe was allegedly observed by law enforcement at the location.

At the same time, his wife Diana was “standing approximately one meter away” from him appearing “to act as a lookout” and “survey the surrounding area,” according to court documents.

FBI agents then recovered a blue 16GB SanDisk SD card “wrapped in plastic and placed between two slices of bread on a half of a peanut butter sandwich” inside a plastic bag, documents show.

A message on the card from “Alice” said: “I hope your experts are very happy with the sample provided and I understand the importance of a small exchange to grow our trust … I expect your new communication instructions will be just as clear and safe as your drop instructions.”

“Alice” proposed creating a “natural” digital footprint for orchestrating future drop sites – looking up articles like “fun things to do in Baltimore” and “stumbling” across “beautiful hikes close to home,” for example, to establish a cover.

The Band-Aid drop

On 31 July, the couple were observed traveling from their home in Maryland to Pennsylvania allegedly to make another dead drop. Later that day, the FBI recovered a 32GB SD card “ hidden in a sealed Band-Aid wrapper with a Band-Aid” inside a plastic Ziploc bag.

The SD card contained another message from “Alice” along with several files that Justice Department documents had marked as “redacted.”

“This information was slowly and carefully collected over several years in the normal course of my job to avoid attracting attention and smuggled past security checkpoints a few pages at a time,” the message said.

“Alice” also proposed that the recipient send a total of $5m in cryptocurrency in an apparent attempt to prove that the recipient was not a federal agent attempting to lure them.

“New reports confirm this is a common tactic used by US security forces to expose agents,” the message said. “Please do not be offended by this, but your generosity so far also matches exactly an adversaries [sic] likely play to entrap me.”

The chewing gum drop

On 27 August, Mr Toebbe allegedly dropped another SD card “concealed in a chewing gum package” at a dead-drop site in Virginia.

The next day, the FBI paid “Alice” $70,000 in Monero.

FBI agents discovered that the contents of the SD card “contained schematic designs for the Virginia-class submarine,” described as “nuclear-powered cruise missile fast-attack submarines, which incorporate the latest in stealth, intelligence gathering, and weapons systems technology.” Each cost roughly $3bn and are to remain in service through at least 2060, according to court documents.

“I have considered the possible need to leave on short notice,” said an attached message from “Alice.”

“Should that ever become necessary, I will be forever grateful for your help extracting me and my family,” the message said. “We have passports and cash set aside for this purpose.”

The message continued: “One day, when it is safe, perhaps two old friends will have a chance to stumble into each other at a cafe, share a bottle of wine and laugh over stories of their shared exploits. A fine thought, but I agree that our mutual need for security may make that impossible. Whether we meet or no, I will always remember your bravery in serving your country and your commitment to helping me.”

Plea-deal rejected and re-submitted

On 27 September 2022, the couple pleaded guilty in federal court in West Virginia on Tuesday to one felony count each of conspiracy to communicate restricted data. The pleas came a month after a previous plea agreement was rejected by a judge in the case.

Under the latest plea agreement, they would face a maximum of life imprisonment and a $100,00 fine. Prosecutors have said they will seek a sentence at the lower end of the guidelines for Ms Toebbe.

Prosecutors had previously asked for Mr Toebbe to get between 12 and 17 years behind bars, and three years for his wife.

But that was rejected by US District Judge Gina Groh who called sentencing options put forward by prosecutors as “strikingly deficient” given the alleged crime.

If the court does not accept the latest plea deal the couple will be able to withdraw them and go to trial.

This story was originally published on 11 October 2021 and updated to reflect developments in the case.