A report from the nonprofit Tech Transparency Project (TTP) alleges that X has been selling premium subscriptions to subjects of US sanctions, including leaders of the US-designated terrorist organization Hezbollah. The TTP report identifies 28 accounts that were granted checkmarks under owner Elon Musk’s paid verification plan, evading rules that formally state they’re banned from using it. The allegations raise new questions about how strictly social media platforms should vet users — after the Supreme Court ruled just last year that the platform formerly known as Twitter was not responsible for abetting a terrorist attack.

The TTP report lists the full series of sanctioned entities that got verified on Twitter. The wide range of names includes:

TTP says most of the accounts were verified after Musk took over Twitter and began requiring paid verification. Ten were paying to keep “legacy” checkmarks they’d been granted earlier.

X didn’t offer a comment to TTP at the time of the report’s publication. But it appears to have removed nearly all the verifications, although the two gold checks still appear on Press TV’s and Tinkoff Bank’s accounts. (TTP notes that it also banned one account on the list, linked with Iran-backed militia Harakat al-Nujaba.)

In a post emailed to The Verge, the X safety account also pushed back on TTP’s claims. “X has a robust and secure approach in place for our monetization features, adhering to legal obligations, along with independent screening by our payments providers,” it reads. “Several of the accounts listed in the Tech Transparency Report are not directly named on sanction lists, while some others may have visible account check marks without receiving any services that would be subject to sanctions.” X stated that it had reviewed the report and would “take action if necessary.” TTP posted a followup thread rebutting this defense — arguing that organizations that weren’t “directly named” were still owned by sanctioned entities, and that it wasn’t clear how they’d have obtained a checkmark without a paid account.

US businesses are barred from economic transactions with people and organizations on sanctions lists. As TTP points out, X’s own policies ban buying premium subscriptions if you’re sanctioned or otherwise banned from financial dealings in the US. TTP points out that it’s possible, albeit unlikely, that X gifted the blue checkmarks to terrorist groups for free — but the ban covers “contribution” of goods and services, too. It’s also possible some unrelated party duped X’s verification program with impersonation, a widely reported problem on the service, though many of the accounts appear well established and credibly belong to their supposed owners.

Beginning in its pre-Musk days as Twitter, X was the subject of a high-profile legal fight over whether it materially supported terrorists. The surviving family of an Islamic State attack victim sued it for failing to ban accounts linked to the group, taking their case to the Supreme Court in February 2023 as Twitter v. Taamneh. But the court unanimously decided against holding Twitter responsible for “aiding and abetting” the attack. An opinion authored by Justice Clarence Thomas declared that the terrorist group’s relationship with Twitter was comparable to Twitter’s “arm’s length, passive, and largely indifferent relationship with most users.” The court applied the same logic to a similar case involving YouTube, avoiding a potentially explosive fight over online liability laws in general.

The question on the table here is different: did Twitter accept hard digital cash (even if it was only $8 a month) from people it was banned from financial dealings with? It’s an issue that’s becoming more and more relevant for social platforms, which, after years of free access, are increasingly pushing users to pay up.

But the court also made a point of distinguishing conscious collaboration from sometimes failing to enforce a stated policy on a platform with hundreds of millions of users. And X, in its favor, did appear to cull the subscriptions when it was made aware of them. Either way, there’s no legal challenge to X here at the moment — just a bad look for the company’s verification plan.

Update 6:23PM ET: Added followup statement from TTP.