AOL Exposes Search Data On 658,000 People

AOL on Monday admitted exposing the personal search data of 658,000 people, and issued an apology for what it called a "screw up."

AOL, a unit of Time Warner Inc., made the information available for download through its research site. The people were randomly chosen among users of AOL's search engine from March through May. Each record was stripped of the person's screen name, which was replaced with a number.

While its unclear how long the information was available, it was on the site at least since Saturday and taken down on Sunday.

"This was a screw up, and we're angry and upset about it," AOL spokesman Andrew Weinstein said in an emailed statement. "It was an innocent enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted, and if it had been, it would have been stopped in an instant."

The incident brought a swift and angry response from the blogosphere, which questioned why AOL would post the same kind of data that Google Inc. earlier this year had fought in court to withhold from the U.S. Department of Justice."The utter stupidity of this is staggering," Michael Arrington wrote on his blog TechCrunch.

Bloggers reported that the 2-gigabyte file provided by AOL included among the search queries personal information such as people's names, addresses, social security numbers and telephone numbers. Weinstein said that while there was no personally identifiable data provide by AOL with the records, "search queries themselves can sometimes include such information."

"It was a mistake, and we apologize," the spokesman said. "We've launched an internal investigation into what happened, and we are taking steps to ensure that this type of thing never happens again."

Even if the names of search engine users are withheld, privacy advocates argue, what people scour the Web for can sometimes provide enough information for employers or friends and family to identify them. The search data could also be used by law enforcement to begin investigations based on what looks like illegal activity, even though there's no evidence that a crime has been committed.

Bloggers listed examples of search queries they said were taken from the file. For example, a person with the number 491577 searched for "florida cna pca lakeland tampa," "emt school training florida," "low calorie meals," "infant seat," and "fisher price roller blades," according to Adam D'Angelo, who was a student of California Institute of Technology. The school said he was no longer a student.

Other examples included person 39509 who searched for "ford 352," "oklahoma disciplined pastors," "oklahoma disciplined doctors," and "home loans;" and 545605 who searched for "shore hills park mays landing nj," "ceramic ashtrays," "transfer money to china," and "capital gains on sale of house."D'Angelo also claimed to have found search queries for illegal drugs and other terms that may interest law enforcement.

AOL said the released data included about a third of a percent of the total U.S. searches conducted through the AOL network during the three-month period. AOL, quoting Web metrics firm ComScore Networks, said its network had 42.7 million unique visitors in May, so the data covered about 1.5 percent of the search users that month.

The disclosure followed by five months a federal court ruling in San Jose, Calif., that drastically scaled back the amount of information the Justice Department sought from Google. The DOJ was seeking the search data in its efforts to revive the 1998 Child Online Protection Act that was struck down by the Supreme Court.

The Justice Department sought similar information through subpoenas sent to Yahoo Inc., Microsoft Corp.'s MSN and AOL. The three companies complied with the request.