BALTIMORE - It was July 2015 when the FBI, scrambling to contain a surge in Islamic State group propaganda, first visited an Egyptian-American newspaper deliveryman in Maryland.
Agents needed to ask Mohamed Elshinawy why his phone number had surfaced in an investigation involving IS group extremists and how he came to receive a $1,000 Western Union transaction from Egypt.
During hours of questioning, Elshinawy first suggested the money was from his mother. Next, he said it was for an iPhone purchase for a friend. After being reminded it was a crime to lie to federal agents, he proceeded to tell a different story — that he had, indeed, received money from the Islamic State group but that he was actually scamming the group instead of planning an attack.
It was a pivotal moment in a monthslong FBI investigation that ended Friday with Elshinawy being sentenced to 20 years in prison on terrorism-related charges.
The case had a chilling twist: Officials say that among the roughly 150 IS-linked cases U.S. authorities have brought since 2014, this is the only prosecution they're aware of in which money was transmitted from IS group operatives abroad to someone in the U.S. The more common model is money from America being sent to fighters in Syria.
The investigation stretched from a modest townhome northeast of Baltimore across multiple continents, unveiled a shadowy network of illicit payments and shell companies, and revealed a direct link to an IS group hacker who was killed in a drone strike in Syria just before Elshinawy's arrest.
Law enforcement officials involved in the case spoke to The Associated Press about it in detail, recounting a high-intensity investigation that required constant surveillance, the scouring of money transfers and concern that funds sent to Elshinawy would fund an attack.
Brian Nadeau, a Baltimore FBI assistant special agent in charge, said the case raised a lot of red flags.
"Why is the money coming this way? Who is this person? What level are they at?" he said. The FBI, he said, "can't let someone who's receiving ISIS [Islamic State] money be out running around. Who knows if we're in the middle of it, the beginning of it, the end, and what their plan is?"
Elshinawy's lawyers didn't return messages seeking comment, but they have argued that his social media and other communications — such as his claim that he was an IS group soldier and was committed to violent jihad — were protected by the First Amendment, were not directed by the Islamic State and were merely aspirational.
Under a plea agreement, Elshinawy admitted conspiring with the IS group, but he defended himself at his sentencing hearing, saying, "I am not a terrorist," according to the .
It's not clear how close Elshinawy came to an attack, though FBI officials said they believed the threat of violence was real. Elshinawy's lawyers said in a sentencing memorandum that he was provided little to no specific direction, but Elshinawy had told authorities he was given multiple options for violence, including a suicide bombing, and images of individuals who were potential targets, court papers say.
The Islamic State group generally doesn't need to fund attacks in the U.S. given the inexpensive nature of the violence it advocates and its reliance on social media to motivate followers. But officials in this case believe jihadists exploited a personal connection: a childhood friend of Elshinawy's from Egypt who fled to Syria, joined the Islamic State, communicated with him on social media and encouraged him to pledge allegiance to the group.
His technological know-how and skill in covering his electronic tracks — he used encrypted communications applications and proxy servers — likely made Elshinawy a natural conduit, officials said.
All told, officials say, he received nearly $9,000 in money transfers, including through PayPal accounts, and used the funds for phones, a laptop and a virtual private network for communication with militants overseas.
The funds, disguised as money for printers, were routed throughout the globe in a web of wire transfers. Much of it came from a United Kingdom-based IT company run by Siful Sujan, an IS group computer hacker killed in December 2015 airstrikes in Syria.
"I think they thought they were going to just have a run-of-the-mill ISIS case, and when they pulled back the onion, they realized that [Elshinawy] was a key node," said Seamus Hughes, deputy director of George Washington University's Program on Extremism, who has written about the case.