A U.S. Navy nuclear engineer and his wife have been charged with selling secret information about nuclear submarines to an undercover FBI agent who posed as an operative for a foreign country, the Justice Department said on Sunday.
Court records show that Jonathan Toebbe, 42, and his wife, 45, unwittingly communicated with FBI agents and passed along sensitive military secrets, mostly on Virginia-class submarines.
The scheme nearly lasted a year, starting in December 2020, a month after the 2020 US presidential election.
The couple were arrested at a drop site on Saturday in West Virginia. They were charged with espionage and violating the Atomic Energy Act, the Justice Department said in a statement.
Toebbe held an active national security clearance through the Department of Defense, giving him access to restricted data. He would send the data to the unidentified country, labelled as 'COUNTRY1' in court documents.
However, in December 2020, an FBI official received a package that had been sent to abroad from someone trying to establish 'a covert relationship' with a representative from the foreign country.
Diane Toebbe (left), 45, and Jonathan Toebbe (right), were charged with espionage and violation of the Atomic Energy Act after leaking sensitive classified information to an unknown foreign country in December 2020, a month after the 2020 election
'The package contained U.S. Navy documents, a letter containing instructions, and an SD card containing specific instructions on how COUNTRY1 should respond using an encrypted communication platform, and additional documents,' investigators said in a court filing.
'I apologize for this poor translation into your language. Please forward this letter to your military intelligence agency,' the letter handed over to the FBI stated. 'I believe this information will be of great value to your nation. This is not a hoax.'
Later, in April 2021, Toebbe sent another package, listing a return address in Pittsburgh, Pennsylvania. That package had a sample of restricted data and instructions for purchasing additional information.
At one point, Toebbe hid a digital memory card containing documents about submarine nuclear reactors in half a peanut butter sandwich at a 'dead drop' location in West Virginia, while his wife acted as lookout, the Justice Department said.
The memory card contained 'militarily sensitive design elements, operating parameters and performance characteristics of Virginia-class submarine reactors,' according to a federal court affidavit.
Another memory card was found in a chewing gum package, the Justice Department said. After making a payment to Toebbe of $70,000 in cryptocurrency, the FBI received a decryption key for the card.
Investigators said it also had restricted data related to submarine nuclear reactors.
Toebbe received separate cryptocurrency payments totalling $100,000, according to the Justice Department.
They were charged with conspiracy and 'communication of restricted data,' according to a criminal complaint.
No attorney for the Toebbes was listed in either the court documents or the Justice Department statement.
The couple are scheduled to appear in a West Virginia federal court on Tuesday.
The FBI Retrieves Package Containing U.S. Navy Documents from LEGAT in UNIDENTIFIED COUNTRY
On or about December 20, 2020, the FBI's attaché ('LEGAT') in COUNTRY1 obtained a package representatives from COUNTRY1 had received in April 2020 through a mail carrier from the U.S. by an unidentified subject in an attempt to establish a covert relationship.
The package contained U.S. Navy documents, a letter containing instructions, and an SD card containing specific instructions on how COUNTRY1 should respond using an encrypted communication platform, and additional documents.
In the letter, the sender stated a desire to sell documents containing U.S. Navy information marked CONFIDENTIAL that included printouts, digital media files containing technical details, operations manuals, and performance reports.
The letter requested the transmission of the enclosed technical data to COUNTRY1's military intelligence agency. The sender wrote: 'I apologize for this poor translation into your language. Please forward this letter to your military intelligence agency. I believe this information will be of great value to your nation. This is not a hoax.'
The package that contained the material described above was a brown envelope with four U.S. postage stamps, a postal barcode, and a sent date of April 1, 2020. The return address was identified as a location in Pittsburgh, Pennsylvania.
A subject-matter expert at the U.S. Navy with knowledge of the documents included in the package sent to COUNTRY I informed the FBI that these documents were U.S. Government documents that contained Restricted Data.
On December 23, 2020, the FBI analyzed the encryption keys that were in the SD card sent in the original envelope. There were three keys located on the SD card: Alice Hill — Public Key, Bob Burns — Private Key, and a ProtonMail Public Key. In cryptography, Alice and Bob are commonly used as placeholders in discussions about cryptographic protocols or systems. The FBI noted that the public key Alice Hill had two sub-keys. The first sub-key was used to sign and certify.
The private key Bob Burns had two sub-keys. The first sub-key was used to sign and certify. The second sub-key was used for encryption. The ProtonMail public key had two sub-keys.
ProtonMail is an end-to-end encrypted email service founded in 2013 in Geneva, Switzerland. ProtonMail uses client-side encryption to protect email content and user data before they are sent to the ProtonMail servers.
The service can be accessed through a webmail client, the onion router (also known as the Tor) network, or dedicated iOS or Android apps. The service is run by Proton Technologies AG. The company also operates ProtonVPN, a VPN service.
In my training and experience, individuals who engage in activities that they wish to keep hidden or secret, or when they wish to keep their location hidden or secret, use an encrypted email service like ProtonMail.
In addition, the FBI determined that the SD card contained metadata showing that the card had been connected to a computer with a Macintosh operating system.
On December 26, 2020, the FBI initiated the first of several emails to 'ALICE' on ProtonMail. The FBI utilized a ProtonMail account utilizing the pseudo name 'BOB.' The email stated, 'We received your letter. We want to work with you. It has been many months, so we need to know if you are still out there. Please respond to this message, then we will provide instruction how to proceed.'
On February 10, 2021, 'ALICE' responded and stated, 'Thank you for contacting me. I am still here. The covid disease has made it more difficult to find chances to check this email. Let us discuss how to proceed.'
On February 24, 2021, an FBI agent acting in an undercover capacity ('the UC') responded and stated, 'We understand the delay and hope you are well. Our experts reviewed the information you provided. We would like as sample your [US. Navy Information — Specific Sections].' We have a trusted friend in your country who has a gift for you to compensate for your efforts...
On March 5, 2021, 'ALICE' replied with the following. 'Jam uncomfortable with this arrangement. Face to face meetings are very risky for me, as I am sure you understand. I propose exchanging gifts electronically, for mutual safety. I can upload documents to a secure cloud storage account, encrypted with the key I have provided you. You can send me a suitable gift in Monero cryptocurrency to an address I will provide. 100,000 usd should be enough to prove to me that you are not an unwelcome third party looking to make trouble for me. When I have confirmed receipt of your gift, I will provide you the download link. We are both protected. I understand this is a large request. However, please remember I am risking my life for your benefit and I have taken the first step. Please help me trust you fully.'
According to public sources, Monero is a decentralized cryptocurrency that uses a publicly distributed ledger with privacy-enhancing technologies that obfuscate transactions to achieve anonymity and fungibility.
On March 18, 2021, the UC posing as a representative of COUNTRY1 wrote, 'We understand a face to face meeting would be uncomfortable. We suggest a neutral drop location. When you visit the location alone, you retrieve a gift and leave behind the sample we request. We hope to have a very long friendship that benefits mutually.'
On March 22, 2021, 'ALICE' replied. 'I understand your proposal to start a dead drop. I am concerned that using a dead drop location your friend prepares makes me very vulnerable. If other interested parties are observing the location, I will be unable to detect them. lam not a professional, and do not have a team supporting me. Jam also concerned that a physical gift would be very difficult to explain if I am questioned. For now, I must consider the possibility that you are not the person I hope you are. It would be very easy for the serial numbers of bills to be recorded. Tracking devices and other nasty surprises must be considered as well. I propose to modify your plan in the following ways:
1. I will place the sample you requested on a memory card and place it in a drop location of my choosing... I am not a professional and I am sure that publicly available information on this subject is incomplete.
2. The samples will be encrypted using GnuPG symmetric encryption with a randomly generated passphrase.
3. I will tell you the location and how to find the card. I will also give you a Monero address. This form of gifts protects both of us very well. Jam very aware of the risks of blockchain analysis of BitCoin and other cryptocurrencies, and believe Monero gives both us excellent deniability.
4. Once I confirm receipt of my gift, I will give you the passphrase. Your friend and I will never go to the same drop location twice. I will give you a new Monero address each time. The decryption key will be different each time. No patterns for third parties to observe. The only electronic footprints will be Proton to Proton, so there is less risk of encrypted traffic being collected for future analysis by third parties. That part is not perfect. Perhaps as our friendship develops we will change addresses periodically?'
On April 1, 2021, the UC posing as a representative of COUNTRY1 responded to 'ALICE' and stated, 'We understand your concern and appreciate the thoughtful plan... as a sign of good faith and trust we wish to pay you equivalent of 10,000 USD immediately on Monero to address you provide. Drop locations are safest and allow us to make exchanges without coming in contact and of course leave no electronic footprint... Your proposed method of memory card with encryption/passphrases is acceptable. For the small sample we requested you will receive another 20,000 USD. Once you confirm Monero address we will activate payment. Our next step will be information on drop location we have selected. This method will build trust between usfor a larger transaction in future. Our experts are interested in information you have but we insist on maintaining our discretion and security as a priority.'
On April 9, 2021, 'ALICE' wrote, 'I am sorry to be so stubborn and untrusting, but I can not agree to go to a location of your choosing. I must consider the possibility that l am communicating with an adversary who has intercepted my first message and is attempting to expose me. Would not such an adversary wish me to go to a place of his choosing, knowing that an amateur will be unlikely to detect his surveillance? If you insist on my physically delivering the package, then it must be a place of my choosing. I ask you to consider the viability of an electronic dead drop. I can establish an encrypted online storage account without providing any identifying information and without provoking any suspicion...Another possibility occurs to me: is there some physical signal you can make that proves your identity to me? I could plan to visit Washington D.C. over the Memorial Day weekend. I would just be another tourist in the crowd. Perhaps you could fly a signal flag on your roof? Something easily observable from the street, but nothing to arouse an adversaries suspicion?...'
On April 23, 2021, the UC posing as a representative of COUNTRY1 emailed the following: 'You do not need to apologize. We appreciate you being careful. That is much better than someone reckless. Your thoughtful plans indicate you are not amateur. This relationship requires mutual comfort. There is risk on both sides and we understand your need for safety assurance of who you are communicating with. As you suggest we can accommodate a signal in Washington D.C. over the Memorial Day weekend. We will set a signal from our main building observable from the street. It will bring you comfort with signal on display from area inside our property that we control and not a [sic] adversary. If you agree please acknowledge. We will then provide more instruction about the signal. We hope this plan will continue to build necessary trust and comfort of our identity.'
On May 5, 2021 'ALICE' wrote, 'I will make plans to be in the capitol [sic] over the Memorial Day weekend. It would be best to leave the signal visible for the entire holiday weekend so I can plan to pass by in the natural course of my tourist day. I may be on foot or passing by in a bus or car or bicycle, so please plan for something easy to spot.'
On May 17, 2021, the UC posing as a representative of COUNTRY1 responded and said, in part, 'We are happy to set a signal to bring you comfort and build necessary trust between us. The signal will be inside our main building from Saturday morning until Sunday evening Memorial Day weekend.'
During the weekend of May 29-30, 2021, the FBI conducted an operation in the Washington, D.C. area that involved placing a signal at a location associated with COUNTRY1 in an attempted effort to gain bona fides with 'ALICE.'
On May 31, 2021, the FBI received confirmation via the ProtonMail from 'ALICE' that the signal was received. 'ALICE' also wrote that, 'Now Jam comfortable telling you your assumption that Pittsburgh would be a convenient location for me is incorrect.. .for now I can tell you I am located near Baltimore, Maryland. Please let me know when you are ready to proceed with our first exchange. Once you have drop location details for me, I will give you the Monero address and prepare the sample you have requested.'
'ALICE' went on to request clarity of the U.S. Navy information requested by the UC posing as a representative of COUNTRY1.
On June 4, 2021, the UC posing as a representative of COUNTRY1 requested the Monero address to provide 'ALICE' a payment of $10,000 USD as a sign of good faith and trust. The UC also informed 'ALICE' that new communication instructions would be provided at the exchange location.
On June 8, 2021, 'ALICE' wrote that, 'For maximum security it is very important that you do not send Monero to the same address twice.' 'ALICE' then provided the FBI with a payment address. 'ALICE' then went on to state, 'I will place information you have requested~ encrypted, on a memory card along with the address for the second payment you offered in a plain text file. After I confirm the second payment I will provide you with the decryption passphrase using the new communication method. Jam also excited to continue our relationship...'
On June 10, 2021, the FBI paid 'ALICE' approximately $10,000 USD in Monero cryptocurrency.
On June 17, 2021, 'ALICE' thanked the FBI for the first payment and stated that he/she was, 'eagerly waiting for your instructions.'
On June 18, 2021, the UC posing as a representative of COUNTRY1 emailed 'ALICE' to provide detailed instructions on servicing a dead drop location in Jefferson County, West Virginia to occur on June 26, 2021.
The UC discussed instructions regarding the next payment to 'ALICE' as well as additional assurance that 'ALICE' would be paid $20,000 upon the sample verification and authenticity of the information provided at the drop location.
On June 23, 2021, 'ALICE' sent the FBI a confirmation email stating, 'I understand your instructions and am ready to move forward.'
On June 26, 2021, at approximately 10:41 a.m., the FBI observed JONATHAN TOEBBE physically service a dead drop location in Jefferson County, West Virginia.
Records show that JONATHAN TOEBBE is a government employee working as a nuclear engineer for the United States Navy and holds an active Top Secret Security Clearance through the United States Department of Defense and an active Q clearance from the United States Department of Energy.
On the same date and time, the FBI also observed JONATHAN TOEBBE's spouse, DIANA TOEBBE, standing approximately one meter away from JONATHAN TOEBBE during the servicing of the dead drop location.
Based on my experience and training, it appeared that DIANA TOEBBE assisted JONATHAN TOEBBE during the dead drop operation. DIANA TOEBBE appeared to act as a lookout for JONATHAN TOEBBE during the drop and survey the surrounding area.
Thereafter, DIANA TOEBBE signaled to JONATHAN TOEBBE to proceed on a trail after JONATHAN TOEBBE completed the drop. Records show that DIANA TOEBBE is a faculty member and humanities teacher in Annapolis, Maryland. Both JONATHAN TOEBBE and DIANA TOEBBE reside in Annapolis, Maryland.
Following the servicing of the dead drop location, both JONATHAN TOEBBE and DIANA TOEBBE were observed walking through a more populated area near the location of the dead drop. From my experience and training, it appeared that both JONATHAN TOEBBE and DIANA TOEBBE were conducting surveillance detection routes, meaning that they were moving in a way to attempt to detect whether they were being surveilled or followed.
In total, the FBI observed JONATHAN TOEBBE and/or DIANA TOEBBE arrive in the location of the dead drop at approximately 9:44 a.m. and depart the location at approximately 11.22a.m.
During this approximate time frame, the FBI observed a vehicle registered to JONATHAN TOEBBE parked in a visitor's lot.
Later on the same date, June 26, 2021, the FBI recovered a blue 16GB SanDisk SD Card left by JONATHAN TOEBBE at the dead drop location. The SD card was wrapped in plastic and placed between two slices of bread on a half of a peanut butter sandwich. The half sandwich was housed inside of a plastic bag.
On June 28, 2021, 'ALICE' sent a ProtonMail message, providing the Monero address for payment. On the same date, the FBI electronically paid 'ALICE' approximately $20,000 USD in Monero.
On June 29, 2021, 'ALICE' provided the password to the FBI in an encrypted ProtonMail message. The FBI subsequently opened the provided SD card and provided the contents to the U.S. Navy subject matter expert. The U.S. Navy determined that multiple documents on the SD card contained Restricted Data. Specifically, the U.S. Navy subject matter expert determined that several of the documents contained militarily sensitive design elements, operating parameters, and performance characteristics of Virginia-class submarine reactors.
The SD card contained the following typed message from 'ALICE':
I hope your experts are very happy with the
