BALTIMORE - It was July 2015 when the FBI, scrambling to contain a surge in Islamic State group propaganda, first visited an Egyptian-American newspaper deliveryman in Maryland.
Agents needed to ask Mohamed Elshinawy why his phone number had surfaced in an investigation involving IS group extremists and how he came to receive a $1,000 Western Union transaction from Egypt.
During hours of questioning, Elshinawy first suggested the money was from his mother. Next, he said it was for an iPhone purchase for a friend. After being reminded it was a crime to lie to federal agents, he proceeded to tell a different story — that he had, indeed, received money from the Islamic State group but that he was actually scamming the group instead of planning an attack.
It was a pivotal moment in a monthslong FBI investigation that ended Friday with Elshinawy being sentenced to 20 years in prison on terrorism-related charges.
The case had a chilling twist: Officials say that among the roughly 150 IS-linked cases U.S. authorities have brought since 2014, this is the only prosecution they're aware of in which money was transmitted from IS group operatives abroad to someone in the U.S. The more common model is money from America being sent to fighters in Syria.
The investigation stretched from a modest townhome northeast of Baltimore across multiple continents, unveiled a shadowy network of illicit payments and shell companies, and revealed a direct link to an IS group hacker who was killed in a drone strike in Syria just before Elshinawy's arrest.
Red flags, questions, fear
Law enforcement officials involved in the case spoke to The Associated Press about it in detail, recounting a high-intensity investigation that required constant surveillance, the scouring of money transfers and concern that funds sent to Elshinawy would fund an attack.
Brian Nadeau, a Baltimore FBI assistant special agent in charge, said the case raised a lot of red flags.
"Why is the money coming this way? Who is this person? What level are they at?" he said. The FBI, he said, "can't let someone who's receiving ISIS [Islamic State] money be out running around. Who knows if we're in the middle of it, the beginning of it, the end, and what their plan is?"
Elshinawy's lawyers didn't return messages seeking comment, but they have argued that his social media and other communications — such as his claim that he was an IS group soldier and was committed to violent jihad — were protected by the First Amendment, were not directed by the Islamic State and were merely aspirational.
Under a plea agreement, Elshinawy admitted conspiring with the IS group, but he defended himself at his sentencing hearing, saying, "I am not a terrorist," according to the Baltimore Sun.
It's not clear how close Elshinawy came to an attack, though FBI officials said they believed the threat of violence was real. Elshinawy's lawyers said in a sentencing memorandum that he was provided little to no specific direction, but Elshinawy had told authorities he was given multiple options for violence, including a suicide bombing, and images of individuals who were potential targets, court papers say.
The Islamic State group generally doesn't need to fund attacks in the U.S. given the inexpensive nature of the violence it advocates and its reliance on social media to motivate followers. But officials in this case believe jihadists exploited a personal connection: a childhood friend of Elshinawy's from Egypt who fled to Syria, joined the Islamic State, communicated with him on social media and encouraged him to pledge allegiance to the group.
His technological know-how and skill in covering his electronic tracks — he used encrypted communications applications and proxy servers — likely made Elshinawy a natural conduit, officials said.
All told, officials say, he received nearly $9,000 in money transfers, including through PayPal accounts, and used the funds for phones, a laptop and a virtual private network for communication with militants overseas.
The funds, disguised as money for printers, were routed throughout the globe in a web of wire transfers. Much of it came from a United Kingdom-based IT company run by Siful Sujan, an IS group computer hacker killed in December 2015 airstrikes in Syria.
"I think they thought they were going to just have a run-of-the-mill ISIS case, and when they pulled back the onion, they realized that [Elshinawy] was a key node," said Seamus Hughes, deputy director of George Washington University's Program on Extremism, who has written about the case.
The FBI's first interview with Elshinawy came amid heightened alertness of IS-inspired extremism, weeks after an attempted rampage at a Prophet Mohammed cartoon contest in Texas and one day after shootings at military facilities in Tennessee.
Officials say he deflected questions about the money transfer with answers they knew were untruthful. Officials say he pulled out an iPhone to display a Facebook conversation in Arabic, but the English translation he provided was clearly improvised, the FBI said.
After several hours, and an admonishment to come clean, he admitted receiving the money from the Islamic State but said he was scamming the group because he never intended to commit violence, officials said. He said that his cleverness should be rewarded and that he should be hired by the FBI to help untangle the IS group money network, officials say.
Dreams for jihad
The interviews continued over two weeks, and the results from search warrants and subpoenas yielded insights that alarmed officials further.
Elshinawy had pledged allegiance to the Islamic State group in February 2015 and, in conversations with his friend, pronounced himself ready for jihad and asked for advice in bomb-making, court papers say.
"I do not have dreams or aspirations in this world except the Jihad ... I want just to go to Jihad and be with the Islamic State," he wrote in an April 2015 message to his friend.
He responded to the unrest in Baltimore that followed the death of Freddie Gray by praising violence against police. And, the FBI says, he attempted to recruit a brother in Saudi Arabia to join the Islamic State group.
Elshinawy has been in custody since his 2015 arrest.
Agents searching his home found articles about IS attacks. His laptop held an image of a severed head next to an IS flag, and he accessed on his phone images of government buildings in Baltimore that officials believe were potential targets.
"If this turned out to be successful," said Hughes, "it would be a whole different way of looking at ISIS external operations in the U.S."