A watchdog group’s investigation found that terrorist group Hezbollah and other US-sanctioned entities have accounts with paid check marks on X, the Elon Musk–owned social network that still resides at the Twitter.com domain.
The Tech Transparency Project (TTP), a nonprofit that is critical of Big Tech companies, said in a report on Wednesday that “X, the platform formerly known as Twitter, is providing premium, paid services to accounts for two leaders of a US-designated terrorist group and several other organizations sanctioned by the US government.”
After buying Twitter for $44 billion, Musk started charging users for check marks that were previously intended to verify that an account was notable and authentic. “Along with the check marks, which are intended to confer legitimacy, X promises various perks for premium accounts, including the ability to post longer text and videos and greater visibility for some posts,” the Tech Transparency Project report noted.
The Tech Transparency Project suggests that X may potentially be violating US sanctions. “The accounts identified by TTP include two that apparently belong to the top leaders of Lebanon-based Hezbollah and others belonging to Iranian and Russian state-run media,” the report said. “The fact that X requires users to pay a monthly or annual fee for premium service suggests that X is engaging in financial transactions with these accounts, a potential violation of US sanctions.”
Some of the accounts were verified before Musk bought Twitter, but verification was a free service at the time. Musk’s decision to charge for check marks implies that X is “providing a premium, paid service to sanctioned entities,” which may raise “new legal issues,” according to the Tech Transparency Project.
Musk’s X charges $1,000 a month for a Verified Organizations subscription. Additionally, last month X also introduced a basic tier for $200 a month. For individuals, the X Premium tiers that come with check marks cost $8 or $16 a month.
This story originally appeared on Ars Technica, a trusted source for technology news, tech policy analysis, reviews, and more. Ars is owned by WIRED’s parent company, Condé Nast.
It’s possible for US companies to receive a license from the government to engage in certain transactions with sanctioned entities, but it doesn’t seem likely that X has such a license. X’s rules explicitly prohibit users from purchasing X Premium “if you are a person with whom X is not permitted to have dealings under US and any other applicable economic sanctions and trade compliance law.”
In all, the Tech Transparency Project said it found 28 “verified” accounts tied to sanctioned individuals or entities. These include individuals and groups listed by the US Treasury Department’s Office of Foreign Assets Control (OFAC) as Specially Designated Nationals.
“Of the 28 X accounts identified by TTP, 18 show they got verified after April 1, 2023, when X began requiring accounts to subscribe to paid plans to get a check mark. The other 10 were legacy verified accounts, which are required to pay for a subscription to retain their check marks,” the group wrote, adding that it “found advertising in the replies to posts in 19 of the 28 accounts.”
X issued the following statement on Wednesday: “X has a robust and secure approach in place for our monetization features, adhering to legal obligations, along with independent screening by our payments providers. Several of the accounts listed in the Tech Transparency Report are not directly named on sanction lists, while some others may have visible account check marks without receiving any services that would be subject to sanctions. Our teams have reviewed the report and will take action if necessary. We’re always committed to ensuring that we maintain a safe, secure and compliant platform.”
An account with the handle @SH_NasrallahEng appears to be tied to Hezbollah leader Hassan Nasrallah, the TTP report said. The account had a check mark when we first checked it earlier Wednesday, but it has since been removed.
“The account, which has 93,600 followers, posts English-language Hezbollah messages and memes disparaging Israel and the US. It was created in October 2021 and verified in November 2023, the same month that Nasrallah threatened further escalation of Israel’s war with Hamas,” the report said.
Written by Reece Rogers
Contributions by Megan Farokhmanesh
Author: Jennifer M. Wood
Author: Steven Levy
Some accounts could be impersonators taking advantage of X’s willingness to hand out check marks to just about anyone who will pay. But until it lost its check mark, the @SH_NasrallahEng account was labeled as “ID verified.” According to X, the ID Verified indicator is provided through a “verification process [focused] on ensuring that a real person with valid identification is the owner of the account.”
The Tech Transparency Project said it found blue check marks on the accounts of Hezbollah second-in-command Naim Kassem (@shnaimkassem), Hezbollah money exchanger Hassan Moukalled (@hasmokaled), and the Hezbollah-linked Al-Manar TV (@ProgTvM). None of these accounts had a check mark when we checked them on Wednesday, so X may have removed them in response to the TTP’s inquiries.
The group made claims of discovering blue check marks associated with three accounts linked to Hezbollah news site Al-Ahed and another related to Resistance Monitor, a Hezbollah account known for disseminating propaganda. It was observed that as of Wednesday, the Al-Ahed accounts on X were devoid of blue check marks, with the Resistance Monitor account having been suspended.
A verified account of Iran state media, @PressTV, was confirmed in 2016 and it had a gold check mark by Wednesday afternoon. This verification occurred long before Musk’s acquisition of Twitter, but the existence of a gold check mark suggests the possibility of @PressTV making payment to X for Verified Organization status, as per the payment tiers established by Musk. This was the indication from the TTP report. Interestingly, the check mark was no longer visible by Thursday.
Press TV represents the English-language outlet of Iran’s state broadcaster, the Islamic Republic of Iran Broadcasting (IRIB). The TTP report stated that “Press TV is a Specially Designated National subject to Iran sanctions from a 2018 executive order and secondary sanctions, according to OFAC’s database,”. The IRIB is also categorised as a Specially Designated National subjected to sanctions under the Iran Threat Reduction and Syria Human Rights Act of 2012, along with secondary sanctions.
The TTP further indicated that other accounts highlighted in its report have links to individuals or entities from Iran, Libya, Iraq, and Russia who have been sanctioned. These include news agencies, as well as groups like the Iran-supported Harakat al-Nujaba militia, designated by the US as terrorists.
One of the sanctioned individuals that had a blue check mark is “Bashar Sabawi Ibrahim Hasan al-Tikriti—a son of the Sabawi Ibrahim al-Tikriti, the half-brother and adviser to the late Iraqi leader Saddam Hussein,” the report said. That account did not have a blue check mark Wednesday.
This story originally appeared on