BALTIMORE (AP) " It was July 2015 when the FBI, scrambling to contain a surge in Islamic State propaganda, first visited an Egyptian-American newspaper deliveryman in Maryland.
Agents needed to ask Mohamed Elshinawy why his phone number had surfaced in an investigation involving ISIS extremists, and how he came to receive a $1,000 Western Union transaction from Egypt.
During hours of questioning, Elshinawy first suggested the money was from his mother. Next he said it was for an iPhone purchase for a friend. After being reminded it was a crime to lie to federal agents, he proceeded to tell a different story " that he had indeed received money from ISIS but was actually scamming the group instead of planning an attack.
It was a pivotal moment in a months-long FBI investigation that ended Friday with Elshinawy being sentenced to 20-years imprisonment on terrorism-related charges.
The case had a chilling twist: Officials say that among the roughly 150 ISIS-linked cases U.S. authorities have brought since 2014, this is the only prosecution they're aware of in which money was transmitted from ISIS operatives abroad to someone in the U.S. That inverts the more common model in which money from America is sent to fighters in Syria.
The investigation stretched from a modest townhome northeast of Baltimore across multiple continents, unveiled a shadowy network of illicit payments and shell companies and revealed a direct link to an ISIS hacker who was killed in a drone strike in Syria just before Elshinawy's arrest.
Law enforcement officials involved in the case spoke to The Associated Press about it in detail, recounting a high-intensity investigation that required round-the-clock surveillance, the scouring of bank records and constant concern that money sent to Elshinawy would fund an attack.
Brian Nadeau, a Baltimore FBI assistant special agent in charge, said the case raised a lot of red flags.
"Why is the money coming this way? Who is this person? What level are they at?" he said. The FBI, he said, "can't let someone who's receiving ISIS money be out running around. Who knows if we're in the middle of it, the beginning of it, the end, and what their plan is?"
Elshinawy's lawyers didn't return messages seeking comment, but they have argued that his social media communications " such as his claim that he was an ISIS "soldier" and was committed to "violent jihad" " were First Amendment-protected and merely aspirational.
Elshinawy had admitted conspiring with ISIS under a plea agreement, but he defended himself at his sentencing hearing, saying in a statement "I am not a terrorist," according to the Baltimore Sun.
It's not clear how close Elshinawy came to an attack, though FBI officials said they believed the threat of violence was real. Elshinawy's lawyers said in a sentencing memorandum that he was provided limited or no specific direction, but in statements to the FBI, he said he was given multiple options for violence and images of individuals who were potential targets, court papers say.
ISIS generally doesn't need to fund attacks in the U.S. given the inexpensive nature of the violence it advocates and its reliance on social media to motivate followers. But officials in this case believe jihadists exploited a personal connection: a childhood friend of Elshinawy's from Egypt who fled to Syria, joined ISIS, communicated with him on social media and encouraged him to pledge allegiance to the group.
His skill in covering his electronic tracks " he used encrypted communications applications and proxies " likely made Elshinawy a natural conduit, officials said.
Given that bond, said one official speaking on condition of anonymity, "He doesn't even need to be vetted, he was already vetted."
All told, officials say, he received nearly $9,000 in money transfers, including through PayPal accounts, and used the funds for phones, a laptop and a private VPN network for communication with militants overseas. The funds, disguised as money for printers, were routed throughout the globe in a web of wire transfers. Much of it came from a United Kingdom-based IT company run by Siful Sujan, an ISIS computer hacker killed in December 2015 airstrikes in Syria.
"I think they thought they were going to just have a run-of-the-mill ISIS case, and when they pulled back the onion, they realized that (Elshinawy) was a key node," said Seamus Hughes, deputy director of George Washington University's Program on Extremism, who has written about the case.
The FBI's first interview with Elshinawy came amid heightened alertness of ISIS-inspired extremism, weeks after an attempted rampage at a Prophet Mohammed cartoon contest in Texas and one day after shootings at military facilities in Tennessee.
Officials say he deflected questions about the money transfer with answers they knew were untruthful. At one point, officials said, he pulled out an iPhone to display a Facebook conversation in Arabic, but the English translation he provided was clearly improvised, the FBI said.
After several hours, and an admonishment to come clean, he admitted receiving the money from ISIS but said he was scamming the group because he never intended to commit violence, officials said. He said his cleverness should be rewarded and that he should be hired by the FBI to help untangle the ISIS money network, according to court papers.
The interviews continued over two weeks and the results from search warrants and subpoenas yielded insights that alarmed officials further.
Elshinawy had pledged allegiance to ISIS in February 2015 and, in conversations with his friend, pronounced himself ready for jihad and asked for advice in bomb-making, court papers say.
"I do not have dreams or aspirations in this world except the Jihad...I want just to go to Jihad and be with the Islamic State," he wrote, according to court papers.
He responded to the unrest in Baltimore that followed the April 2015 death of Freddie Gray by praising violence against police. And, the FBI says, he attempted to recruit a brother living in Saudi Arabia to join ISIS.
Elshinawy has been in custody since his December 2015 arrest. Agents searching his home found articles about ISIS attacks, and his laptop held images of the severed head of an American in captivity and government buildings in Baltimore that officials believe were potential targets.
"If this turned out to be successful," said Hughes, "it would be a whole different way of looking at ISIS external operations in the U.S."