Federal investigators say one of the Phoenix gunmen who attacked a Sunday gathering in Texas that dealt with depictions of the Muslim Prophet Muhammad was in contact with at least three known ISIS sympathizers in the days before.
Two weeks before the controversial event in Garland, Texas, the FBI and Homeland Security warned that it "carries the risk of being targeted by violent extremists."
The advisory, sent to the law-enforcement agencies across the country, said supporters of ISIS and like-minded terror groups "have posted links to the contest announcement on Twitter, urging retaliation."
Investigators say Elton Simpson, one of the gunmen who attacked the event, was reading those posts.
They say he followed a suspected British ISIS recruiter, known as al-Britaini, and an ISIS sympathizer who calls himself al-Amriki. And they say he was communicating with an American now believed to be in Somalia, Mohammed Hassan, who specifically called for attacking the Texas event.
A week before the attacks, Simpson sent a Tweet to Hassan that said, "DM me," an invitation for private direct messaging.
Researchers who track extremists online say Simpson was deeply immersed in jihadist tweets from sympathizers around the world.
Permanently shutting down Twitter accounts that espouse violence is virtually impossible, says Harvard's Jessica Stern. But, she adds, it's worth the trouble.
"What happens is when Twitter takes down accounts, the jihadists open new ones," she said. "But it takes some time for followers to find the new accounts."
Monitoring Twitter messages has tipped off the FBI to many of the 39 people arrested in 13 states in recent ISIS-related terror cases.
But officials say it's a huge chore, with more than 5,000 people following the kind of radical Twitter accounts Elton Simpson did.