Erick Hendricks used a variety of clever dodges to ensure his electronic communications were secure from government surveillance, authorities say.
He switched social media modes, created new identities, even ordered those gathered for a meeting in Baltimore to remove the batteries from their cell phones so no one could track them.
Court documents filed in connection with his arrest Thursday in Charlotte on federal charges of supporting domestic terrorism describe a complex series of maneuvers used by the Arkansas native to elude detection.
But his efforts appeared to be in vain – throughout the period detailed in 2015 when the thought he was in touch with potential terrorists for the Islamic State, he was in fact communicating with a web of law enforcement operatives: an undercover FBI employee, an Ohio man arrested on a weapons charge and cooperating with agents in exchange for a reduced sentence and four confidential informants on the FBI payroll.
An affidavit by Shawn Hare, an FBI counter-terrorism agent, shows that Hendricks became connected through social media in March 2015 with an undercover FBI operative working in the Cleveland area. Hendricks had been in touch online with another ISIS supporter under surveillance by national security authorities.
Believing the FBI operative would be a good recruit, Hendricks delivered a lesson on security and gave suggestions to avoid government surveillance.
Odd user names
Over the following months, Hendricks used four unidentified social media platforms to communicate with would-be recruits and a variety of online identities including itsmehere, Sham reason, nowhaq, accepted and lovethehaqq.
Despite warning his contacts not to do anything that might arouse suspicions of Muslim activity, he also used profiles in the names of mesecret17, Abu Harb, Mustafa and hidingmyrights.
In March 2015, Hendricks contacted a North Olmsted, Ohio, man who supported ISIS online as a potential recruit. They continued contact for months, even after the man, Amir Said Abdul Rahman al-Ghazi, was arrested for buying an AK-47 from an undercover officer and charges of aiding terrorism and drug trafficking.
Al-Ghazi, who had a lengthy criminal record, agreed to cooperate with federal authorities in exchange for a lighter sentence. Agents were able to find links to Hendricks on al-Ghazi’s electronic devices.
Cell phone batteries
On March 19, 2015, Hendricks drove to the Baltimore area to meet with those he believed interested in the cause and told them about his plans to create a terror training base in the United States.
When they met, Hendricks told the other three to remove the batteries from their cell phones so they could not be tracked. But one of the people in the meeting was a confidential informant for the FBI.
In April, Hendricks told one of the confidential informants to use an anonymizing software application when communicating with others in the cell by social media. Such software allows users to conceal their internet protocol addresses, making their identity and location unknown, according to the FBI.
Hendricks told the informant not to use any “Islamic” terms without splitting them. In communicating with the FBI operative, Hendricks wrote, for example, “the brain is kh la fa,” an abbreviation for caliphate, which the FBI took to mean ISIS.
‘Secret’ meeting taped
On May 1, 2015, Hendricks returned to the Baltimore area for a meeting with a confidential informant and others. He told them that he used to be the head of a security company near the U.S. Capitol, though the FBI could find no evidence of that.
He told the informant to use counter-security measures. Hendricks did not know the FBI was observing the meeting from a distance and making an audio recording of it.
On April 23, 2015, Hendricks contacted Elton Simpson through social media. Along with Nadir Hamid Soofi, Simpson launched the ISIS-inspired attack on the “First Annual Muhammad Art Exhibit and Contest” in Garland, Texas, on May 3, 2015.
Simpson and Soofi wounded a security guard and were killed by Garland police guarding the event.
Hendricks urged the FBI’s undercover operative to attend the contest on the day of the attack and asked the operative questions about security at the site through social media.
Hendricks, who had lived in Columbia and northern Virginia in recent years, moved to Charlotte about a month ago. He was arrested by federal authorities on the west side on federal charges of providing material support to terrorists.
Justin Conrad, an associate professor who teaches on terrorism and international conflict at UNC Charlotte, said Hendricks appears to fill the “lone wolf” profile of those drawn to terrorism through social media.
“It’s pretty easy to find like-minded people on the internet,” he said.
“There’s apps popping up all the time. Law enforcement constantly has to stay on top because for a short time, at least, they can use them.”
While some of his moves seemed amateurish, Conrad said, even amateur terrorists pose a legitimate threat.
Hendricks appeared to use methods common to drug dealers to evade detection like changing user names and moving sensitive communications to applications with more security, said Leslie Wiser Jr., instructor in the department of criminology and criminal justice at the University of South Carolina.
“His references to ‘splitting’ Islamic terms is apparently predicated on an assumption about automated search tools used by the U.S. intelligence community,” said Wiser, a former FBI agent.
“Interestingly, despite his extensive precautions, the risks he took in using social media exposed him to the FBI, which used multiple confidential informants, cooperating witnesses and undercover agents to surround him, consume his time and gather evidence against him.”
Hendricks’ final contact with the FBI operative detailed in documents came May 13, 2015.
Hendricks said he was switching to a new user name: dontcatch17.
Researcher Maria David contributed.