The Only Islamic State-Funded Plot in the U.S.: The Curious Case of Mohamed Elshinawy

Most terrorism cases in the United States follow a well-worn narrative. An individual, usually young and male, reaches out looking to join the Islamic State. He connects with a supporter who feeds his dreams of committing an attack in his own backyard—or as in one case a few years ago, traveling to Syria to become one of the many soldiers of the Caliphate. The outreach out is sometimes successful in ways the young man does not intend. At times the Islamic State sympathizer is an FBI undercover agent; or other times an actual Islamic State operative whose poor tradecraft eventually connects the young man with an FBI informant for the bureau. Over months the plot takes on the contours determined by law enforcement. There is the eventual takedown: an arrest, followed by an appearance in federal district court. Since 2014, over 150 Americans have been charged with Islamic State-related offenses, and their cases are usually mundane.

But there is nothing mundane about the case of Mohamed Elshinawy. The Maryland resident was part of a multi-country law enforcement takedown over the course of a few days that spanned three separate continents, included transfers of thousands of dollars, shipping of anti-aircraft parts, and resulted with the killing of a high-ranking Islamic State attack planner in Syria. Terrorism financing cases are standard—but Elshinawy’s is the only known case in which the Islamic State sent thousands of dollars to an individual in the United States to fund an attack.

Recently, I spent three days in a nondescript Baltimore courtroom listening to prosecutors unravel a story involving a dizzying array of actors, shell companies, financial transactions, transaction-masking technologies, and a fortunately unsuccessful attack plan. The courtroom proceedings, along with the recently unsealed search warrants, illustrated in rich detail the funding scheme that distinguishes Elshinawy’s case from all other American Islamic State financing cases. Some of the more colorful characters in this narrative include a Bangladeshi entrepreneur from Wales; an Egyptian ex-con who went straight from prison to the Islamic State in Syria; and finally, the Egyptian’s childhood friend, a newspaper deliveryman from the Edgewood suburb of Baltimore named Mohamed Elshinawy.

As with most national security cases, several pre-trial motions were initially filed under seal. Even after Elshinawy eventually plead guilty in August 2017, all sentencing submissions and court orders—totaling more than 70—continue to be filed under seal. My own motion to unseal documents was summarily denied: among other things, the judge stated (incorrectly, based on my knowledge of over 150 other Islamic State-related U.S. legal cases), that is standard fare for a number of documents to be sealed in such cases. Fortunately, the court left the sentencing hearings open to the public. And while the hearings offered only a very limited window into the case, they provided detailed information on how the Islamic State finances would-be supporters in the United States and beyond

Elshinawy’s story begins with a budding tech entrepreneur: Siful Sujan, the founder of a Cardiff-based computer equipment company named Ibacstel Electronics Limited, who used his company to initiate transactions to fund attacks in the West. Sujan had renounced his ties to the Western world to live in Islamic State-held territory in Syria, where he became the “Director of the Islamic State’s computer operations.” The position, which was previously held by the late Islamic State attack-planning guru and hacker Junaid Hussain, afforded him enormous latitude within the Islamic State to engage with would-be recruits. Sujan would ultimately be described by the Department of Defense as an “external operations planner” for the group.

Sujan continued to operate Ibacstel Electronics Limited, putting the company to nefarious use. He used the business to buy drones and “bug sweeping equipment” which he shipped to Sanliurfa, Turkey, a mere 20 miles from territory held by the Islamic State in Syria during that time. Sujan utilized his expertise with computers and years of experience running an online ordering firm to ensure the equipment reached its intended destination. While he primarily purchased equipment to track aircraft—Hussain, his predecessor, had been killed by a coalition strike—he also used his company to direct attacks in the United States.

It was through Sujan, Ibacstel, and Elshinawy’s childhood friend Tamer El-Khodary that Elshinawy received $8,447.23 to commit a terrorist attack in the United States. A specific May 2015 Western Union money transfer of $1,000 from Egypt to a convenience store in Maryland set things in motion: Law enforcement followed the money trail, which led them directly to Elshinawy. The FBI watched as he picked up his remittance from the convenience store, drove to his bank, deposited $800 in his jointly owned bank account, and then transferred some of it to his wife’s account.

When confronted by the FBI about the money, Elshinawy offered an explanation: He was trying to scam some money from the Islamic State, he said, suggesting that the FBI should be thanking rather than questioning him. He admitted that he reached out to his childhood friend in the Islamic State and received money from him, but claimed it was all a ruse to attain funds to buy home furnishings. The interviewing agents were incredulous but did not yet have enough evidence to determine why Elshinawy had received this money order from an Islamic State member.

Before questioning Elshinawy again, the FBI went to work mapping out the backers and entities behind the transfer of money from Egypt to Maryland. Eventually they unraveled the financial network: Sujan used his employee in England to send money to Elshinawy in Baltimore so that Elshinawy could carry out a terror attack. Five payments, each through PayPal, made their way from Sujan’s shell companies in Bangladesh, Turkey and the U.K through an intermediary in Egypt to Elshinawy. The young man used the payments to buy a laptop, a cellphone and a virtual private network for communications, which allowed the co-conspirators to speak with one another incognito.

Investigators found that Elshinawy reached Sujan through his childhood friend El-Khodary, a supporter of both the Egyptian Muslim Brotherhood and the Islamic State. El-Khodary been arrested in Egypt, released and fled to the Islamic State. Upon arrival, he reconnected with Elshinawy and introduced him to other Islamic State members, including those who could assist Elshinawy in U.S. operations—namely, Sujan, who had become a key English-speaking “virtual planner” for the Islamic State after the death of Junaid Hussain.

Through Ibacstel and its subsidiaries, Sujan sent money to Elshinawy. On Sujan’s say-so, Abdul Samad, the acting director of an Ibacstel subsidiary in Cardiff, allegedly remitted the monies just as he did for several other vendors. Payments made to Elshinawy were ostensibly for laser printers that were never purchased or delivered.

Elshinawy used encrypted applications such as Surespot and Telegram to communicate with Islamic State operatives. According to prosecutors, they talked “every day, for several months.” The Islamic State initially gave Elshinawy three choices: carrying out a suicide bombing, planning and executing a terrorist attack, or traveling to Syria. Elshinawy chose the attack. To ensure that the young Elshinawy could properly fund the attack while subsisting on the salary of a newspaper deliveryman, Ibacstel sent Elshinawy a little more than $8,000 in smaller increments. As one dogged prosecutor put it, Elshinawy was “on salary with the Islamic State.”

The Islamic State also directed Elshinawy to use operating systems that would allow him to render his computer inoperable in the event of capture. For the attack, they directed him to assassinate a specific person (left unnamed during the hearings) who lived in United States. When it became clear that Elshinawy lacked the ability to do so, they shifted their direction to a mass casualty attack. The Islamic State instructed him to create a Dropbox account where, according to the Justice Department and Elshinawy’s own admissions, he received “16-17 videos with step by step instructions … on how to make a peroxide bomb.”

There is no evidence that Elshinawy followed through with creating any bombs. All that is publicly known is that he searched the internet for federal buildings in Baltimore; during the sentencing hearings, the prosecutors asked the court to infer that those were his intended targets. Prosecutors also noted that the Islamic State asked for regular progress reports from Elshinawy, arguing that his searches focused on intended targets for a putative attack.

In December 2015, law enforcement officials on three separate continents closed in on the networks. In Bangladesh, local police raided the offices of an Ibacstel subsidiary. Meanwhile, the FBI was searching Elshinawy’s house in Edgewood, Md. And in the U.K., authorities were questioning the Cardiff Ibascstel director Abdul Samad along with Sujan’s brother, Ataul Haque.

A few short days later, Coalition airstrikes killed Siful Sujan in Raqqa. Combined Joint Task Force-Operation Inherent Resolve spokesperson Col. Steve Warren claimed that “now that he’s dead, ISIL has lost a key link between networks.” One day later, Elshinawy was arrested in Edgewood.

In between his first FBI interview and his arrest, Elshinawy had grown paranoid and began taking increasingly complex efforts to cover his steps. Although he used the encrypted communications network that Sujan helped him set up, a traffic stop by local police in Baltimore convinced him to take a hammer and destroy his phone. By late spring of 2015, Elshinawy was under 24/7 FBI surveillance—a step that indicates how seriously the FBI considered the threat he potentially posed. According to prosecutors, the FBI interviewed him on at least three separate occasions during the summer of 2015. When they were ready to move on Elshinawy, federal law enforcement authorities executed at least “20-30 search warrants” and the Department of Justice issued more than “300 grand jury subpoenas” to keep their case under wraps and the public safe.

As the Islamic State’s territorial reach declines, external financing schemes promoting attacks in the West could become increasingly relevant. With foreign fighters returning to their home countries, the Islamic State virtual entrepreneur who has until now mobilized with moral suasion may shift to providing financial support to the soldier lying dormant in the west. The model that failed in Elshinawy’s case may now thrive. Money sent from countries other than Syria may not trigger the same red flags for financial institutions that such transactions previously did when the money flowed from the Middle East. Companies like Ibacstel are easily established in the West, and setting up subsidiaries in countries such as Bangladesh, Indonesia and the Philippines would not be a difficult task.

Had Elshiwany’s efforts been successful, financing terror attacks within the West from abroad could have been the new blueprint. Now, with Islamic State’s loss of territory, we could easily see the group make a second try at the methodology that failed with Elshinawy. The Islamic State remains able to mobilize its army in the West, be it by providing moral, emotional or—now for the first time in the United States—financial support.