A background check on the day of hiring cannot detect a post that will be published two and a half years later.
The case of the United Airlines pilot who, according to an N12 report of 21 October, was barred from Israeli airspace, shows why an organisation's responsibility continues after hiring.
The attached report examines two questions: what could be found in open sources before he started work in November 2022, and what was published later in his employment.
In the sources checked, no negative content from before hiring was found.
Content supporting the Iranian regime and its missile programme was found in posts from June 2025, about two and a half years later.
The report also analyses a capture of a story from October 2025 in which the song Boom, Boom, Tel Aviv can be heard. The song praises the missile attack on the city.
The story was deleted after the exposure, and its attribution to the account was checked using a capture kept by a third party and a cross-check with content that remained on the profile.
The screen showed only Boom boom :). The meaningful message was in the soundtrack. A check limited to the text would have missed it.
Finding the account also took more than a name search: the full name did not appear on the profile, and the attribution was based on cross-checking professional details against other sources.
But not every published claim was substantiated. The check found no evidence of support for Hezbollah or for the 7 October attack. Nor did it find indications of intent, planning or a threat to commit violence. Origin, religion and language were not defined as "red flags".
In my view, this is part of the professional responsibility in a background check: to be precise both about what we found and about what we have no basis to determine.
A relevant finding justifies clarification and a risk assessment, and it needs to be examined in the context of the role and of all the information.
These are three things I recommend that security and HR managers take from the case:
• Define which roles require a periodic check of public information, and how often, according to the sensitivity of the role and the scope of the employee's access and authority.
• Make sure the check also covers stories saved to highlights, reposts and videos, with an understanding of the language and the context. A name search and reading captions may leave significant information out.
• Decide in advance who verifies a finding, who assesses what it means for the role, and how to conduct a fair clarification with the employee.
Collecting information is useful only when there is a clear process for handling it.
I am attaching the full report, with the sources, the cross-checks and the limits of the review.
The question I suggest every organisation ask: if relevant information about an employee in a sensitive role appears tomorrow, who is supposed to identify it, and who is responsible for handling it?