AUKUS nuke submarine warning after theft of US secrets

The AUKUS alliance has been given a wake up call after a shocking spy case that has put the US on edge.

It was, in the words of a US judge, an “exceptional story right out of the movies”.

Navy engineer Jonathan Toebbe sold America’s nuclear submarine secrets to a foreign power. He made dead drops with memory cards hidden in peanut butter sandwiches and chewing gum packets. He arranged code names, crypto payments and covert operations.

There was no happy ending for the traitor who plotted against his country. The classified information remained secure and Toebbe went to jail because, unbeknown to him, the foreign spies he thought he was helping were actually FBI agents.

Jonathan Toebbe leaked documents about the Navy’s Virginia-class submarines. Picture: US Navy

But what if they weren’t? As Australia embarks on acquiring its own fleet of nuclear-powered submarines, the story of Toebbe’s espionage is not fodder for a Hollywood blockbuster, but a cautionary tale.

The sensitive data shared under the AUKUS pact will be pursued intensely by our enemies. Spoiler alert: Their mission has already begun.

On April Fools’ Day in 2020, Toebbe posted a package to a foreign government with secret documents about the Navy’s submarines and a letter which said: “This is not a hoax.”

Toebbe also included a memory card with instructions to reply through an encrypted email platform. It took until Boxing Day for “Bob Burns” – the account Toebbe set up for his foreign partner – to write back to his alias “Alice Hill”.

Toebbe expected Burns would be a military intelligence officer in Brazil, a country not identified in the court case brought against him but later named by The New York Times.

In messages he exchanged with his wife Diana, Toebbe appeared troubled by helping an adversary such as Russia or China. Brazil was not hostile to the US, but the couple hoped it would be willing to pay for the documents, having spent decades pursuing its own nuclear submarine program.

Jonathan Toebbe and his wife Diana were both sentenced to lengthy jail terms last month. Picture: Supplied

Instead, Brazil handed Toebbe’s package to the FBI, which launched a sting operation that led to him being sentenced to 19 years in jail last month.

To reassure Toebbe, the FBI had worked with the Brazilian government to leave a signal at its embassy in Washington DC, and paid him $US10,000 in cryptocurrency.

He made his first dead drop in June last year on a walk in West Virginia with his wife, who FBI agents observed was acting as a lookout. They left a memory card in half a peanut butter sandwich which contained restricted documents on the Navy’s Virginia-class submarines.

The next month in Pennsylvania, the couple left another memory card in a Band-Aid wrapper which detailed thousands of pages of documents Toebbe had smuggled out of Navy headquarters over several years.

He shared more of them in August in Virginia, on a memory card concealed in a chewing gum packet, along with a message saying he hoped to meet his handler “when it is safe”.

“Perhaps two old friends will have a chance to stumble into each other at a cafe, share a bottle of wine and laugh over stories of their shared exploits,” he said.

That meeting came by surprise when Toebbe and his wife were arrested by the FBI. She was sentenced to 21 years in jail for her role in the espionage conspiracy.

Booking photos of Diana and Jonathan Toebbe after they were arrested last year. Picture: West Virginia Regional Jail and Correctional Facility Authority

“If not for the remarkable efforts of FBI agents, the sensitive data stolen by Mr Toebbe could have ended up in the hands of an adversary of the United States and put the safety of our military and our nation at risk,” said William Ihlenfeld, the US lawyer for West Virginia’s Northern District.

The near miss highlighted how one weak link could spark a major security breach, according to Adam Meyers, cybersecurity firm CrowdStrike’s senior vice president of intelligence, who warned Australia’s adversaries were targeting “anybody with any role in AUKUS”.

In the wake of Australia unveiling its nuclear submarine plans, Meyers identified a phishing attempt by North Korean cyber-attackers who shared an Australian diplomat’s resume to target those with information about the AUKUS pact. He said Chinese hackers also took an interest through the Communist Party’s sweeping data collection regime.

“As soon as AUKUS was announced, we saw the overt reaction from nations who were not happy about it,” Meyers said.

Adam Meyers, senior vice president of intelligence at global cybersecurity firm Crowd Strike. Picture: Supplied

“The follow on … is trying to collect intelligence information about what Australia is getting and how they might be fielding it, and being able to steal the technologies.”

British Vice Admiral Martin Connell recently cautioned AUKUS would “massively increase our collective threat surface” because of the amount of “very, very sensitive information” shared between the three countries.

“We really need to take security much more seriously than we do,” the Royal Navy’s second highest-ranking officer said.

With key decisions to be made on the pact early next year, the Australian Defence Force is now on high alert.

“Nuclear-powered submarines require a robust security architecture applied across the capability life cycle – from planning, acquisition and introduction to service, to operations, sustainment and decommissioning,” a spokeswoman said.

Originally published as AUKUS nuke submarine warning after theft of US secrets