A watchdog group's investigation found that terrorist group Hezbollah and other US-sanctioned entities have accounts with paid check marks on X, the Elon Musk–owned social network that still resides at the Twitter.com domain.
The Tech Transparency Project, a nonprofit that is critical of Big Tech companies, said in a report on Wednesday that "X, the platform formerly known as Twitter, is providing premium, paid services to accounts for two leaders of a US-designated terrorist group and several other organizations sanctioned by the US government."
After buying Twitter for $44 billion, Musk started charging users for check marks that were previously intended to verify that an account was notable and authentic. "Along with the check marks, which are intended to confer legitimacy, X promises various perks for premium accounts, including the ability to post longer text and videos and greater visibility for some posts," the Tech Transparency Project report noted.
The Tech Transparency Project suggests that X may be violating US sanctions. "The accounts identified by TTP include two that apparently belong to the top leaders of Lebanon-based Hezbollah and others belonging to Iranian and Russian state-run media," the report said. "The fact that X requires users to pay a monthly or annual fee for premium service suggests that X is engaging in financial transactions with these accounts, a potential violation of US sanctions."
Some of the accounts were verified before Musk bought Twitter, but verification was a free service at the time. Musk's decision to charge for check marks means that X is "providing a premium, paid service to sanctioned entities," which may raise "new legal issues," the Tech Transparency Project said.
Musk's X charges $1,000 a month for a Verified Organizations subscription and last month added a basic tier for $200 a month. For individuals, the X Premium tiers that come with check marks cost $8 or $16 a month.
It's possible for US companies to receive a license from the government to engage in certain transactions with sanctioned entities, but it doesn't seem likely that X has such a license. X's rules explicitly prohibit users from purchasing X Premium "if you are a person with whom X is not permitted to have dealings under US and any other applicable economic sanctions and trade compliance law."
In all, the Tech Transparency Project said it found 28 "verified" accounts tied to sanctioned individuals or entities. These include individuals and groups listed by the US Treasury Department’s Office of Foreign Assets Control (OFAC) as Specially Designated Nationals.
"Of the 28 X accounts identified by TTP, 18 show they got verified after April 1, 2023, when X began requiring accounts to subscribe to paid plans to get a check mark. The other 10 were legacy verified accounts, which are required to pay for a subscription to retain their check marks," the group wrote, adding that it "found advertising in the replies to posts in 19 of the 28 accounts."
X issued the following statement on Wednesday: "X has a robust and secure approach in place for our monetization features, adhering to legal obligations, along with independent screening by our payments providers. Several of the accounts listed in the Tech Transparency Report are not directly named on sanction lists, while some others may have visible account check marks without receiving any services that would be subject to sanctions. Our teams have reviewed the report and will take action if necessary. We're always committed to ensuring that we maintain a safe, secure and compliant platform."
An account with the handle @SH_NasrallahEng appears to be tied to Hezbollah leader Hassan Nasrallah, the TTP report said. The account had a check mark when we first checked it earlier Wednesday, but it has since been removed.
"The account, which has 93,600 followers, posts English-language Hezbollah messages and memes disparaging Israel and the US. It was created in October 2021 and verified in November 2023, the same month that Nasrallah threatened further escalation of Israel's war with Hamas," the report said.
Some accounts could be impersonators taking advantage of X's willingness to hand out check marks to just about anyone who will pay. But until it lost its check mark, the @SH_NasrallahEng account was labeled as "ID verified." According to X, the ID Verified indicator is provided through a "verification process [focused] on ensuring that a real person with valid identification is the owner of the account."
The Tech Transparency Project said it found blue check marks on the accounts of Hezbollah second-in-command Naim Kassem (@shnaimkassem), Hezbollah money exchanger Hassan Moukalled (@hasmokaled), and the Hezbollah-linked Al-Manar TV (@ProgTvM). None of these accounts had a check mark when we checked them on Wednesday, so X may have removed them in response to the TTP's inquiries.
The group also said it found blue check marks on three accounts tied to Hezbollah news site Al-Ahed and one tied to Resistance Monitor, a Hezbollah account that posted propaganda. As of Wednesday, the Al-Ahed accounts on X did not have blue check marks, and the Resistance Monitor account was suspended.
An Iran state media account, @PressTV, was verified in 2016 and had a gold check mark as of Wednesday afternoon. The account's original verification was long before Musk bought Twitter, but the gold check mark "suggests it may be paying X for Verified Organization status" under the payment tiers implemented by Musk, the TTP report said. By Thursday, the checkmark had disappeared.
Press TV is an English-language channel of Iran’s state broadcaster, Islamic Republic of Iran Broadcasting (IRIB). "Press TV is a Specially Designated National subject to Iran sanctions from a 2018 executive order and secondary sanctions, according to OFAC’s database," the report said. "IRIB is also a Specially Designated National subject to sanctions under the Iran Threat Reduction and Syria Human Rights Act of 2012 and secondary sanctions."
The TTP said that other accounts listed in its report are tied to sanctioned individuals or entities from Iran, Libya, Iraq, and Russia. These include news agencies, as well as groups designated by the US as terrorists such as the Iran-backed Harakat al-Nujaba militia.
One of the sanctioned individuals that had a blue check mark is "Bashar Sabawi Ibrahim Hasan al-Tikriti—a son of the Sabawi Ibrahim al-Tikriti, the half-brother and adviser to the late Iraqi leader Saddam Hussein," the report said. That account did not have a blue check mark Wednesday.
This story originally appeared on Ars Technica.