When an FBI task force busted into the apartment of 27-year-old US man Garrett Grimsley the police found a half-encrypted laptop and an AK-47 with over 300 rounds of ammunition.
Hours earlier, Grimsley, under the online pseudonym "Spark_Pure", used what he believed to be an anonymous messaging application called Whisper to make Islamic State-inspired terror threats from his home in Cary, North Carolina. Now, he is sitting in federal custody.
According to an affidavit of FBI agent Andrew Mauer, filed on 20 February, Grimsley used the free application to make a threat the day prior. The chat service, available on IOS and Android, allows users to post publicly or privately but also has a geo-location feature built-in.
For standard users, this is used to see public posts close to their location – creating a sort of social network – but for Grimsley, it would prove to be his downfall. On 19 February, he published a warning: "Salam, some of you are alright, don't go to Cary tomorrow."
A user, now described as a cooperating witness (CW), responded: "Why – what's happening in Cary tomorrow?" to which Grimsley said: "For too long the kuffar have spit in our faces and trampled our rights. This cannot continue. I cannot speak of anything. Say your dua [prayers], sleep, and watch the news tomorrow. It will only be the beginning."
After being reported to the FBI, agents were quick to act. They contacted Whisper, which proceeded to hand over a slew of personal, identifying, information on the suspect. This included his geo-location data, an IP address and even what type of phone he was posting from. It was an iPhone.
Agents then approached Time Warner Cable to gain more information on the suspect's IP address, ultimately coming back with the name Garrett Grimsley. The rest was simple, an arrest warrant was issued by law enforcement and a raid was conducted.
Police investigators, upon searching the apartment, found a computer with several Facebook private messages open between Grimsley and a user called "Tim Tam" in which the "Spark_Pure" messages had been pasted. In one chat, Tim Tam said: "I swear to god you're going to get a swat team."
Other comments referenced propaganda spread by the Islamic State, including a video called "Soldiers of Allah" and a magazine called "Dabiq". One message stated: "The FBI will understand I am only reading Dabiq for the pictures, right?"
Based on the legal filings, it was during one lengthy conversation with Tim Tam that the suspect spotted an approaching police vehicle and realised what was happening, then beginning to encrypt his hard-drive. "Holy f**k, I'm actually going to get raided," he wrote.
When FBI agents raided the apartment, the computer read as 63% encrypted with hours left on the clock. The pair discussed deleting previous chats and even the Whisper app. At one point the logs show Grimsley saying "hurry up van is outside" to which Tim Tam replied: "You're f**ked kiddo."
It's a clear message for wannabe jihadis, serious or not: online anonymity is not always as it appears.
Whisper's own policy warns it may "disclose information or content to US governmental entities without receiving legal process when Whisper believes, in good faith, that an emergency involving a danger of death or serious physical injury to any person requires disclosure without delay."
The FBI said Grimsley now faces up to five years in prison and a $250,000 fine and will appear before a federal judge in Raleigh, North Carolina, on February 24. FBI task force officer Mauer said he was charged with "transmitting a threat in interstate commerce to injure the person of another."