Bluesky has a hidden danger for disinformation

In addition to my role as a consultant here at Núcleo, I developed a tool called @projeto7c0 to keep track of the integrity of politicians' timelines on Twitter, monitoring and keeping records of posts deleted by public officials.

Politicians across all the political spectrum were constantly deleting tweets for a variety of reasons – often to avoid accountability for unfortunate posts. Fact-checkers used my project's data to verify the credibility of screenshots shared all over the internet.

As many Brazilians – including politicians and influencers (mainly left-leaning) – began to occupy new spaces on Bluesky, in a gradual but apparently stable migration movement (especially after X was blocked in Brazil), new challenges inherent to all scalable social networks started to surface.

Many issues were already reported on, such as problems with sexual exploitation content and misinformation, while others weren't. One of them, which I will discuss, deals with the temporal integrity of timelines.

PROTOCOL. Before explaining the potential impact on the disinformation scenario, I first need to make a brief introduction on a detail around the protocol used by Bluesky.

The AT Protocol treats each user as an independent source of information, while the timeline is just the aggregate of these sources. To make it even clearer: each user owns their own data, and they are just compiled and displayed by apps compatible with the protocol (like Bluesky).

This allows users to have greater control over their own data, but also means they can exercise great manipulation power if they want or know how to do it. The expanded control over user's data even allows the development of solutions for converting tweets to Bluesky posts while preserving the original posting date.

By analyzing how this feature works, I have noticed the possibility of making retroactive posts on Bluesky – that is, creating posts today with dates from the past.

Where lies the danger

Now I can explain why I consider this to be dangerous.

Nothing prevents me from creating, with a retroactive date, a comment about football fraud, for instance. This post would appear in my timeline as if it had been made during a game's halftime, for example, and would be indistinguishable from another regular post.

Since nothing stopped me from doing this, that's exactly what I did in the post below:

In my test, I have used an example of football betting, but there are implications for elections, stock markets, and any other activity where pretending to have prior knowledge (or even being able to access insider information) is relevant both to cause distrust and to pretend to have more knowledge than one actually has.

Consider a scenario where an investment coach publishes some post with stock recommendations with perfect hindsight of the market, or a politician who denounces a voting scheme by posting the result of an election before it occurs. The potential for damage here is significant, with still unknown repercussions.

What can be done

Fortunately, this problem has a solution – at least that's what Bluesky's documentation suggests.

All posted information is recorded using a data structure called Merkle Tree, which uses cryptographic hashes to ensure data integrity. This structure records the order in which data is submitted to the protocol.

Thus, I believe two changes are necessary for Bluesky:

1. the first is simply a way to label actions that are performed out of chronological order, thus ensuring that users know which posts were retroactively placed on Bluesky;
2. the second is that every account created on the AT protocol must perform some synchronization activity with other network nodes, ensuring that the first valid action has a current date.

With these two changes, I believe the network would prevent the use of this liberty of date manipulation from feeding fake news machines. I would be good if something would be done before others realize the destructive potential of retroactive posts.

There is a labeler created by a BlueSky developer to tag posts with incorrect dates (you can subscribe here @backdate.mozzius.dev), a great solution to mitigate the issue for people who work with fact checking.

Lucas Lago holds Bachelor's and Master's degrees in Computer Engineering, and has researched software reliability for many years. He develops and maintains open-source projects focused on transparency and fighting misinformation.

Edited by Sérgio Spagnuolo