It was July 2015 when the FBI, scrambling to contain a surge in Islamic State group propaganda, first visited an Egyptian-American newspaper deliveryman in Maryland.
Agents needed to ask Mohamed Elshinawy why his phone number had surfaced in an investigation involving ISIS extremists and how he came to receive a $1,000 Western Union transaction from Egypt.
During hours of questioning, Elshinawy first suggested the money was from his mother. Next he said it was for an iPhone purchase for a friend. After being reminded it was a crime to lie to federal agents, he proceeded to tell a whole new story — that he had indeed received money from the Islamic State but that he was actually scamming the group instead of planning an attack.
It was a pivotal moment in a months-long FBI investigation. Elshinawy was sentenced Friday to 20 years in prison on terrorism-related charges.
The investigation stretched from a modest townhome northeast of Baltimore across multiple continents, unveiled a shadowy network of illicit payments and shell companies, and revealed a direct link to an ISIS hacker killed in Syria just before Elshinawy’s arrest. It also had a chilling twist: Officials say that among the roughly 150 IS-linked cases U.S. authorities have brought since 2014, this is the only prosecution they’re aware of in which money was transmitted from IS group operatives abroad to someone in the U.S.
Law enforcement officials involved in the case spoke to The Associated Press about it in detail, recounting a high-intensity investigation that required constant surveillance, the scouring of money transfers and concern that funds sent to Elshinawy would fund an attack.
Brian Nadeau, a Baltimore FBI assistant special agent in charge, said the case raised a lot of red flags.
“Why is the money coming this way? Who is this person? What level are they at?” he said. The FBI, he said, “can’t let someone who’s receiving ISIS money be out running around. Who knows if we’re in the middle of it, the beginning of it, the end, and what their plan is?”
Elshinawy’s lawyers didn’t return messages seeking comment, but they have argued that his social media and other communications — such as his claim that he was an ISIS soldier and was committed to violent jihad — were protected by the First Amendment, were not directed by the Islamic State and were merely aspirational.
Under a plea agreement, Elshinawy admitted conspiring with the IS group, but he defended himself at his sentencing hearing, saying, “I am not a terrorist,” according to the Baltimore Sun.
It’s not clear how close Elshinawy came to an attack, though FBI officials said they believed the threat of violence was real. Elshinawy’s lawyers said in a sentencing memorandum that he was provided little to no specific direction, though Elshinawy told authorities he was given multiple options for violence, including a suicide bombing, and images of individuals who were potential targets, court papers say.
The Islamic State generally doesn’t need to fund attacks in the U.S. given the inexpensive nature of the violence it advocates and its reliance on social media to motivate followers. But officials believe jihadists exploited a personal connection: a childhood friend of Elshinawy’s from Egypt who joined the Islamic State in Syria, communicated with him on social media and encouraged him to pledge allegiance to the group.
His technological know-how and skill in covering his electronic tracks — he used encrypted communications applications and proxy servers — likely made Elshinawy a natural conduit, officials said.
Elshinawy received nearly $9,000 in money transfers, including through PayPal accounts, and used the funds for phones, a laptop and a virtual private network for communication with militants overseas. The funds, disguised as money for printers, were routed through a web of wire transfers. Much of it came from a United Kingdom-based IT company run by Siful Sujan, an IS computer hacker killed in December 2015 airstrikes in Syria.
“I think they thought they were going to just have a run-of-the-mill ISIS case, and when they peeled back the onion, they realized that (Elshinawy) was a key node,” said Seamus Hughes, deputy director of George Washington University’s Program on Extremism, who has written about the case.
The FBI’s first interview with Elshinawy came weeks after an attempted rampage at a Prophet Mohammed cartoon contest in Texas and one day after shootings at military facilities in Tennessee.
Officials say he deflected questions about the money transfer with answers they knew were untruthful. At one point he pulled out an iPhone to display a Facebook conversation in Arabic. The English translation he provided was clearly improvised, an FBI official said.
After several hours, he admitted under pressure to receiving the money from the Islamic State but said he was scamming the group because he never intended to commit violence, officials said. He said that his cleverness should be rewarded and that he should be hired by the FBI to help untangle the IS money network, officials say.
The interviews continued over several weeks, and the results from search warrants and subpoenas yielded insights that alarmed officials further.
Elshinawy had pledged allegiance to the Islamic State group in February 2015 and, in conversations with his friend, pronounced himself ready for jihad and asked for advice in bomb-making, court papers say.
He responded to the unrest in Baltimore that followed the death of Freddie Gray by praising violence against police. And, the FBI says, he attempted to recruit a brother in Saudi Arabia to join the Islamic State.
Elshinawy has been in custody since his December 2015 arrest.
Agents searching his home found a box of articles about IS attacks. His laptop held an image of a severed head next to an IS flag, and he accessed on his phone images of government buildings in Baltimore that officials believe were potential targets.
“If this turned out to be successful,” said Hughes, “it would be a whole different way of looking at ISIS external operations in the U.S.”
The Associated Press contributed to this article.