How X Became a Safe Harbor for Militant Narratives

In late January 2026, a mass migration of families from Pakistan’s Tirah Valley, a remote and mountainous enclave in the Khyber region, materialised into two opposing stories. One was of civilians worriedly moving through the snow, trying to reach provisional registration centres. The other comprised online messages attempting to shape global perceptions of their plight.

The first is a humanitarian crisis. Chanceholders in Tirah were registered by authorities as comprising some 10,000 families, or roughly 70,000 people, nearly half of the total population of the valley, who fled amid fears of an impending security operation.

The second story is the digital version of events. On X, the platform formerly known as Twitter, amplified grievance discourses and versions of events significantly contradicted official and local reporting, while recycling narratives that, according to several open source investigators and regional monitors consulted for this piece, spread coded rhetoric that lowers the threshold to radicalisation. At the heart of this cacophonous ecosystem lies an account regionally referred to as Nukta, an alias which research teams assert has repeatedly played a role by publishing content that glorifies violence and casts Pakistan’s security institutions in an adverse light.

The issue with this account goes far beyond any single post. Rather, it represents a platform whose moderation structure has been undermined at precisely the moment an information war has intensified across and around Pakistan, with serious ramifications for civilian populations.

The Human Cost: Numbers and Testimony

Relief authorities and local administrators say tens of thousands of people have been displaced, many of them in neighbouring Bara, arriving with little more than their bags. Registration efforts, expanded by officials in light of the scale of the crisis, have struggled to keep pace with both humanitarian needs and political debate over the causes of the movement. Provincial leaders have publicly challenged federal claims that the displacement was “voluntary,” citing deadlines, mosque announcements, and an atmosphere of coercion that left many families with little choice but to leave.

Videos and testimonies circulating online, partly drawn from collections to which the BBC is subscribed, show families visibly exhausted and shivering, their fear shaped by cold, the sudden loss of shelter, fire, and livelihood. Women and children testify to the human cost of an exodus that does not allow it to be framed as a voluntary choice. These raw human accounts now compete in the digital space with social media posts that reinterpret the displaced as “foreign infiltrators,” or portray the clearance of the valley in neutral, if not celebratory, terms. The result is a disputed truth: people are fleeing, but what the world believes to be driving the exodus is increasingly shaped by feed algorithms.

Nukta as a Reference Point: Messaging, Tone, and Reach

The account known as Nukta does not operate as an open recruitment channel. Instead, it employs strategies consistent with modern influence operations, including persistent portrayals of the state as “illegitimate,” romanticisation or normalisation of violent resistance, and selective amplification of videos and claims that erode public empathy for displaced civilians.

At the time of research, South Asia–focused online investigators informed the author that Nukta used content consistent with messaging historically employed by militant actors: delegitimising the state, justifying armed groups, and undermining sympathy for victims when such sympathy conflicts with political objectives. Analysts say such messaging is dangerous precisely because it occupies a grey zone between grievance expression and political speech, making it less likely to be removed while gradually nudging audiences toward acceptance of violence.

Geolocation and temporal analyses by independent open source investigators, with the necessary caveats regarding probabilistic attribution, suggest behavioural markers consistent with activity originating outside Pakistan. These include posting-time patterns and cross-network amplification from accounts previously associated with broader or Central Asian language influencer spaces. Whether these patterns reflect direct state sponsorship, diaspora activism, or covert militant networks, the immediate effect is the same: the amplification of narratives that further destabilise an already fragile security environment.

Platform Responsibility: X’s Eroded Moderation Engine

Understanding how a single account can exert disproportionate influence requires examining the platform context. Since its acquisition by Elon Musk, X has dramatically altered its approach to content moderation, reducing trust and safety staffing, shifting toward a report-driven model, and repeatedly restructuring regional capabilities. Multiple outlets have documented sustained losses in moderation capacity, with staffing reductions leaving X with only a fraction of the moderation resources it once maintained.

These structural shifts have tangible consequences. Extremist and grievance-based messaging spreads faster than it can be contained. Non-English signals, coded rhetoric, and synchronised micro-amplification are significantly harder to detect without regional teams and proactive threat intelligence. Organisations monitoring violent extremist use of technology platforms warned last year that the risk environment was escalating across South Asia and Central Asia, with groups increasingly “testing” narratives on mainstream platforms before migrating audiences to closed channels.

Disinformation as a Force Multiplier

Disinformation is not an abstract problem, but a force multiplier in conflict zones. In Tirah, where reporting is often obscured, operations are secretive, and political blame collides, selective fact curation combined with inflammatory framing exerts powerful political effects. These dynamics can delegitimise humanitarian appeals, harden public attitudes, and justify further securitised responses under the guise of “clearing out foreign elements.”

Several independent fact-checking platforms have reviewed posts from the Nukta account and publicly debunked them as disinformation.

What X Could Do and What It Hasn’t

Platform policy already prohibits praise for extremist violence and coordinated disinformation campaigns in most cases. The weak link is enforcement. When narratives are coded as political grievance or framed ambiguously, automated systems and lean moderation teams are less likely to intervene. Public reporting suggests X has not provided meaningful transparency on how regionally specific threats and language-based radicalisation are prioritised. In cases such as Nukta and similar accounts, civil society researchers report little public explanation when accounts remain active despite repeated reporting.

Accountability requires three measures: stronger regional language moderation, proactive threat intelligence, and transparent disclosure regarding investigations into anonymised accounts that spread extremist narratives. Transparency must include public metrics showing how platforms address violent radicalisation in non-English contexts. Until platforms treat these functions as core safety responsibilities rather than ancillary costs, the information ecosystem surrounding Tirah’s crisis will remain a threat multiplier. The voices of those who fled will continue to be contested, drawn into an online conflict they never chose to enter.