There’s now a way for journalists to verify their Bluesky accounts through their employers (while still keeping control of them)
It used to be a big debate: Who owns a reporter’s social media account — the reporter or their employer?
Okay, so it’s not much of a debate anymore. When David Fahrenthold moved from The Washington Post to The New York Times, there wasn’t really much question that his Twitter followers would follow him. These days, reporters almost always arrive at a job with a social media presence already in place, and while posting there may be part of their job, their handle is theirs. Still, it wasn’t that long ago that ownership of social media accounts was the sort of thing that fueled lawsuits.
But the industry-wide shift from Twitter to Bluesky has opened up a small new front in the IP wars. You see, “verification” on Bluesky means something different than it did on the old bird site. (Different from both the old verification — in which Twitter confirmed you were who you said you were — and the post-Elon verification, in which he confirmed you were $8 poorer every month.) On Bluesky, an account gets verified by connecting it to a web domain under the user’s control. For example, my account there is @joshuabenton.com, because I put a little piece of code on that domain name, which I own. Bluesky checked that little snippet of code and determined that I am me.
For news organizations — or any other online publisher or brand — this means it’s easy to skip past the spoofable @mynewsorgname.bsky.social and become @nytimes.com, @cnn.com, @propublica.org, @time.com, or @npr.org. And if you’re a reporter who owns your own domain name — something I’d highly recommend! — the process is fiddly but doable in minutes.
But that’s not everybody, and a few reporters are trying out a sort of middle-ground solution — becoming verified at your employer’s domain. A news organization can create a virtual subdomain at yourname.youremployer.com and use the same method to verify a reporter’s account.
The first person I saw talking about this was Dylan Freedman, who works on AI at The New York Times:
Are any journalists using handles that are sub-domains of their news organizations? e.g. "@dylanfreedman.nytimes.com".
Seems like it'd be a relatively foolproof means of verification, at the expense of being tied to your professional identity (but you can always change it later).
— Dylan Freedman (@dylanfreedman.nytimes.com) November 22, 2024 at 7:20 PM
Bluesky's clearly thought of this. You can manage many sub-domain handles at once without needing domain records for each one!
(Happy to advise any news organization interested in implementing this.)
bsky.social/about/blog/4…
— Dylan Freedman (@dylanfreedman.nytimes.com) November 22, 2024 at 7:26 PM
This is super clever and a terrific method to show verification. But it will be a long internal conversation among orgs as they come online here.
— Paul Franz (@paul-franz.com) December 3, 2024 at 9:38 AM
This was actually one of the things I strongly pushed for when I was working on Identity at Twitter, and was very disappointed we never shipped. A predecessor project to mine supposedly came very close, only to be shut down by Twitter leadership.
— Joe Fabisevich (@mergesort.me) December 2, 2024 at 4:42 PM
The first journalist I saw using this method was Tom Grundy of the Hong Kong Free Press. (Though there certainly may have been others who preceded him.) And on Monday, Dylan Freedman moved from being @dylanfreedman.com to being @dylanfreedman.nytimes.com. (See also, for example, @ericlipton.nytimes.com and @rubinafillion.nytimes.com.)
Update: I'm now @dylanfreedman.nytimes.com!
— Dylan Freedman (@dylanfreedman.nytimes.com) December 2, 2024 at 3:09 PM
congrats on your dns admin's competence
— Concoloris (@concoloris.bsky.social) December 2, 2024 at 8:59 PM
Now, because Freedman was already “verified” as @dylanfreedman.com, the advantage of adding the interstitial “nytimes” is minimal. (Just as my switching to @jbenton.niemanlab.org would be of only marginal value.) But most reporters either don’t own their own domains or don’t care to fiddle around with DNS entries, so a news outlet being able to mass-verify its journalists could have real utility. ((One other zero-cost option: using your GitHub handle.)
The other benefit is that a single account can have multiple verifications. The previous @dylanfreedman.com now just redirects to @dylanfreedman.nytimes.com — both work. And if Freedman ever leaves the Times, he can switch back to @dylanfreedman.com with no apparent penalty — or move to @dylanfreedman.teenvogue.com or wherever he lands next.
This also means that a news organization with multiple accounts can “verify” them through their original domain name. If we here at Nieman Lab launch a new vertical all about breakfast sandwiches — and don’t think I haven’t demanded it! — it could live at @baconeggandcheese.niemanlab.org and benefit from the brand association.
But this new method does bring back some of the old debates over who “owns” a reporter’s social media account. For instance: Bluesky’s verification only requires a one-time check of DNS records. But if a @joereporter.nytimes.com gets fired in six months, I doubt the Times would be thrilled for him to keep “nytimes” in his social media identity forever. It’s not clear how, exactly, a publisher would go about “unverifying” an ex-employee without having to create a new dummy account and verify it with the old identity. But that’s an edge case, and it’s a potential problem for publishers more than for journalists.
The best solution for an individual journalist seeking verification, I think, remains having your own domain name. (Bluesky will happily sell you one.) But for those who don’t want to bother — or for those publishers who want to deal with staffers’ identities in bulk — this subdomain method strikes me as a reasonable choice, one that attaches an account to a news organization while leaving the individual in control.