AOL Subscribers Sue Over Release Of Search Data

An anonymous reader points out an AP story indicating that AOL hasn't seen the end of its own public embarrassment after airing some dirty laundry on behalf of its customers. Excerpted from the story: "Three AOL subscribers who suddenly found records of their Internet searches widely distributed online are suing the company under privacy laws and are seeking an end to its retention of search-related data ... The lawsuit is believed to be the first in the wake of AOL's intentional release of some 19 million search requests made over a three-month period by more than 650,000 subscribers. ... Filed Friday in U.S. District Court in Oakland, Calif., the lawsuit seeks class-action status. It does not specify the amount of damages being sought."

With luck, this will accomplish two things:

[cunina]

1) Scaring other ISPs and related companies into better privacy safeguards

2) Hastening the timely demise of AOL

Re:With luck, this will accomplish two things:

[tymbow]

Even if they do win, it wont make any difference to data retention practices though. No one would ever rule against that because of potential use as evidence; especially with the push to mandated retention policies.

Re:

[Das Modell]

I'm not intimately familiar with the search logs, but I've seen a little of them. How are the logs tied to personal information? Do they contain IP addresses, or what?

Re:

[hords]

Each individual user, likely tracked via cookie, has a unique number that identifies all their searches. You can't tell directly who or where they are, unless their search history gives away their identity in one way or another. Some of the data in the logs can lead to very private information.

Re:

[KDR_11k]

That's how a search provider like Google would do it but AOL knows which of its IPs correspond to which users so they can tie the results to the accounts which is much more accurate than cookies (which get deleted quite often or maybe even disabled completely).

Re:With luck, this will accomplish two things:

[Richard W.M. Jones]

1) Scaring other ISPs and related companies into better privacy safeguards $80

2) Hastening the timely demise of AOL ... Priceless

Re:With luck, this will accomplish three things:

[pimpimpim]

3) making people aware of what their ISP / anyone with (or even without) a search warrant, can find out about them by just combining their non-anonymous search history.

Re:

[pilgrim23]

Learn from the Gub'mint:
1 require by law that Joe Citizen provide name address physical data, etc
2 compile list of same
3. sell it
4 apologise for any problems that arise
5 stir and repeat

Re:

[serth]

My thoughts exactly, especially your second point. AOL has been slowly going down the drain for some time now, and every action they make either contributes to thier downfall, or can (very unlikely) bring them back up again. This was obviouslly a act contributing to thier downfall. Not suprising, IMO.

Re:

[garylian]

AOL has been going down the drain since it went from a MAC only platform to one that allowed PC users. From that day, they have been all about the $$$.

Let's look at their tactics:

For years, they made it nearly impossible to discontinue their service. (I know from personal experience, where only the treat of a stop check motion to get them out of my personal checking account finally got them to stop billing me for a cancelled service.)

They effectively carpet-bombed the entire U.S. and Canada with CDs of th

Who's AOL?

[Anonymous Coward]

What is this AOL you speak of?

Re:

[larry bagina]

the company responsible for mozilla/firefox/gnutella/aolserver being open source.

Re:

[rm69990]

Netscape open-sourced their Netscape software to form Mozilla before being aquired by AOL.

Gnutella was made by Nullsoft, and after Slashdot published a story about the software, AOL yanked the download and forced Nullsoft to stop development. The protocol was later reverse-engineered.

Lllama Herders

[Anonymous Coward]

It's the company that makes Winamp. They used to be in the free backup diskette business.

Re:

[Miraba]

Have a cookie. I wish I had a modpoint.

Any laws broken?

[The Dalex]

Since search inputs are sent over the internet as plain text, and there are often warnings generated by browsers to explain that this isn't secure, I wonder if AOL has done anything illegal and/or anything that they can be sued for in civil court? It was an error that should cost them customers, but I don't see why there should be a class-action lawsuit. They did not release the names of the people searching, and anything linking the searches to the users was a direct result of the search terms they sent

Re:

[Harmonious Botch]

"...anything linking the searches to the users was a direct result of the search terms they sent across the internet in unsecured form, by choice."

But the user had no choise in having all his searches grouped together. The data from any single search is probably not enough to invade privacy. The data from hundreds or thousands is.

Probably civilly actionable.

[raehl]

IANAL....

AOL, like most ISPs, has a privacy agreement, which states when and how your information may be distributed. Most call this 'personally identifying' information. That would probably include search terms, especially when grouped by a unique identifier, that would personally identify you.

How AOL obtained that information (plain text over the internet or otherwise) is not relevant - if they agreed with you that they would not share it, then they can't share it.

What I'm curious to see here is most of these agreements also force binding arbitration - if that is the case here, can you even have a class action lawsuit based on the privacy agreement?

And if not, are there any actual LAWS violated here? I don't see any legal culpability. If you tell me that you like to conduct sexual relations with farm animals, and I tell someone else that you told me that you like to conduct sexual relations with farm animals, that wouldn't be actionable. And that's basically what happened here, only in a large volume: People told AOL what they wanted to seach for, and AOL then passed that information to others.

Unfortunate, yes, but there isn't any inherent legal obligation for a 3rd party to hold information you give them in confidence (with certain specific exceptions, like healthcare workers, grand juries, etc, of which AOL is none).

Re:Probably civilly actionable.

[Potor]

searching for farm sex does not necessarily mean "you like to conduct sexual relations with farm animals." it could mean any number of things, from a poorly formulated search term, to incredulity that such practices exist. the ambiguity of the dead letter is one of the reasons to oppose the sharing of such data.

That's exactly my point.

[raehl]

If telling people that you told me that you like to have sexual relations with farm animals is not actionable, than certainly telling people that you asked me about information regarding sex with farm animals isn't actionable either. (Assuming, of course, that you had actually done both, if I just made it up, then depending on the circumstances it would be actionable.)

Re:

[schwaang]

Unfortunate, yes, but there isn't any inherent legal obligation for a 3rd party to hold information you give them in confidence (with certain specific exceptions, like healthcare workers, grand juries, etc, of which AOL is none).

According to TFA, the lawsuit "alleges violations of the federal Electronic Communications Privacy Act and California consumer-protection laws."

That doesn't rule out an argument relating to whether AOL broke their own privacy policy, but it's definitely not the only thing in play he

Re:

[Hao Wu]

AOL, like most ISPs, has a privacy agreement, which states when and how your information may be distributed.

A great lawyer (yeah yeah oxymoron) once described how you can't post a "contract" on the front of your vehicle saying that you are not responsible for any pedestrians you flatten.

The point is: rules and policies are not the same as laws and legal rights. Companies try desperately to confuse those terms, and it often works.

Re:

[Guysmiley777]

...once described how you can't post a "contract" on the front of your vehicle saying that you are not responsible for any pedestrians you flatten.

Sure you can! It just won't hold up in court (trust me).

Re:

[Kaktrot]

I'm pretty sure that there is somehing in the EULA that addresses such a thing. I'm not going to read it, mind you. I assume that in the EULAs that I have read, that since personally-identifiable and non-personally-identifiable information are treated differently, that you can sue for releasing non-personally-identifiable information if the EULA states that such information will not be released.

Even if you couldn't sue for such a thing, you could make a strong case that they released personally-identifi

Re:

[db32]

People were identified by the searches. There was the old woman in FL who they were able to identify based on her searches...then showed up on her door step to interview her and she kindly explained that yes those were her searches. She also was able to demonstrate quite well why obtaining search information (see feds clamoring for it) is worthless...all of the diseases and what not that would lead you to believe she is very sick or hypocondriac...turns out she was doing research for friends. Oh well...

Wondering

[jbdaem]

first off, why anyone would enter their social into google. Also, isn't there a way to get an update on what is being searched in google at all times? I know this isn't quite the same thing as being identified with a number, but really, if people are entering their socials into aol search, most likely they are with google as well, and if my memory serves me right, there is some way to get an up to the minute/second listing of what the world is searching using google?

Re:

[Kagura]

Lol, you gave me a great idea. And needless to say, google had no results for my personal SSN.

Re:

[fizbin]

Try searching without the dashes; you know, search for it in the format 333224444. You should get at least one hit from http://www.onebillionmazes.com/ [onebillionmazes.com]

Re:Wondering

[bunions]

> first off, why anyone would enter their social into google

To see if anyone out there is publishing it, so that I might send them a nasty letter?

Re:

[postmortem]

And how exactly you figure out your private data is available to whole world if not searching for it?

Re:Wondering

[pluther]

Hm. Now that you mentioned it, it got me curious so I tried it.
I entered my SSN into Google.
It replied with "-1635"

Re:

[Who235]

I entered my SSN into Google.
It replied with "-1635"

Wow, bad move telling me that, Pat.

Now that, your name (which I got from your website) along with certain other biographical tidbits I was able to glean from your resume should allow me to eventually extrapolate your real SSN.

You're getting me a jet-ski, buddy.

(I'm kidding of course.)

Re:

[merreborn]

In all seriousness:

x - y - z = -1635

0 y 100
0 x 773
0 z 10000

There are only so many solutions to that problem...

Re:

[merreborn]

God damnit slashdot! When I say "Plain old text", I mean "Plain old text", not "Please, remove all less-than characters I may have inserted, I didn't really want them"

Re:

[Who235]

It's even narrower than that.

The first three digits shoud be easy to guess if we know roughly how old he is and what state he was born in. If we had that info, I'll bet we could cut x down to 3 or 4 possibilities.

Re:

[Aguila]

It's even narrower than that.

The first three digits shoud be easy to guess if we know roughly how old he is and what state he was born in. If we had that info, I'll bet we could cut x down to 3 or 4 possibilities.

Actually, the first 5 digits can be determined based upon how old he is, and which state he was born in (assuming typical issuance at birth). The first three indicate the state (though some states have multiple triplets, which are rotated.) However, the next 2 digits are not random; they are used

Re:

[Who235]

Actually, the first 5 digits can be determined based upon how old he is, and which state he was born in (assuming typical issuance at birth).

Wow, I didn't know that.

This is becoming a pretty scary thread. I feel a little bad for having started us down this road.

If anyone steals that guy's identity and buys a jet-ski (or anything else), I'm going to kick their ass.

Don't worry original parent poster, I've got your back.

And it's pretty easy to get the last 4 digits...

[raehl]

...since so many places are always asking you for them.

Re:

[ForestGrump]

Wait, I'm confused.
My SSN is 078-05-1120 but I don't see it on the list. Help!

Grump

Re:

[ConceptJunkie]

Are you sure you were typing into Excel?

Its in the Lobby

[SeaFox]

and if my memory serves me right, there is some way to get an up to the minute/second listing of what the world is searching using google?

If I remember a Wired interview from a couple years ago, there is a large display up in Google's headquarters that displays these results in real time. Employees are able to watch the board and track the user to see what the individual actually went to (in the article an individual was Googling for suicide help, and they were able to tell he got to a site that would help

Oh...

[Greyfox]

Are there, in fact, Privacy Laws? I wasn't under the impression the US Government was particularly worked up about privacy. Certainly the EU seems to be taking a much more aggressive stance about having companies protect your data...

Besides these AOL users shouldn't get too worked up. They couldn't possibly be too concerned about what anyone thinks about them or they wouldn't be using AOL in the first place. The rest of the Internet wasn't particularly surprised at the contents of that search data -- we were all working under the assumption that everyone on AOL was searching for pictures of poo and instructions on how to murder people anyway. The data in question simply confirmed that suspicion.

Re:

[ambivalentduck]

The laws don't really seem to matter (vis a vis: Gitmo). It's more about whether or not congressmen searching for 16 year old "escorts" on AOL might be discovered by their political opposition.

Re:

[Tackhead]

> It's more about whether or not congressmen searching for 16 year old "escorts" on AOL might be discovered by their political opposition.

The AOL leaked database contains search records of 650,000 subscribers. There are 300M Americans. Statistically, one out of every 461 Americans is in the database.

At a minimum, there are several thousand present/past Congressmen/women, their spouses, and their immediate relatives. It's probable that the database contains the search records of at least one curren

Re:

[KDR_11k]

Find a list of every elite private school, country club, social club or credit union with restricted membership and try them all.

Okay, I'll just type those into AOL search and... Wait. HEY!

Blank Check Lawsuit

[MyNymWasTaken]

It does not specify the amount of damages being sought.

The amount being sought is a blank check from Time Warner.

"We want 37 kajillion dollars."

Re:

[mad_minstrel]

I don't think that many zeroes actually fit on a check.

Three?

[Who235]

Three AOL subscribers. . .

They must have been the only 3 AOLers who met both of these conditions:

a) They weren't searching for "hot kiddie lolita horse love" and were consequently unafraid of that search rearing its ugly head in open court.

b) They were aware enough of the wider internet to know their data had been released in the first place and the implications thereof.

Three? Yeah, that sounds about right.

Re:

[bronzey214]

Actually I'm going with, "The three AOL users that have the mental capacity to figure AOL's mistake = their profit"

Re:

[account_deleted]

Comment removed based on user account deletion

Lawsuit?

[slapys]

But those results made for hours of good times on various forums! I can't tell you how many times I found threads where people circled the funniest entries in red, and everyone wondered who would possibly search for gorilla pr0n or Why Their Job is So Bad. Yeah, I have no life.

I can see the settlement now...

[zen611]

1000 free hours of AOL!

Re:

[kclittle]

... and for the first 1,000,000 that settle, SIX free cases of unused AOL CDs!
-k

Re:

[famikon]

AOL CDs???

Oh!

you mean coasters!

Re:

[AndroidCat]

I use them when heating bagels in the microwave.

Re:

[StarfishOne]

Great, like I need even more AOL beer mats.. :+

Re:

[Redwin]

You've misarranged the order of the words, that should read:

1000 hours free of AOL!

The $10,000,000 question

[QuantumFTL]

My parents use AOL - have used it since 1996, IIRC. Can we attach to the lawsuit? If so, how does one go about doing that?

So what happens to the money...

[es330td]

not claimed by the people who did the lolita type searches? Even if was dumb enough to submit that in a search engine I certainly am not going to step up and say "Yep. Those are my searches" to claim a share. I guess the searcher could use the settlement to hire a criminal defense attorney though.

Re:

[chialea]

Lolita is an excellent novel, and I'm sure there is quite a bit of relevant commentary on the web.

very popular search item on AOL

[postmortem]

http://www.aolsearchdatabase.com/search.php?page=1 &textfield=&textfield2=cancel%20aol [aolsearchdatabase.com]

Re:

[LunaticTippy]

Hm. AOL must not have a very good search engine. All these searches for "cancel AOL" and none of them directed the user to anywhere in aol.com!

I can see it now: Anyone can cash in

[CrazyJim1]

They just have to prove they were the ones searching the terms. I'm not sure anyone would fess up to browsing unscrupulous websites.

I'd sue too....

[HiredMan]

I'd sue too if they outed me as user of AOL.

Damn, that would be really, really embarrassing and my l33t status would be called into question.

=tkk

AA

[rHBa]

- Hi, my name is John Smith and I have been an AOL user for 6 years...

  - Welcome John and thank you for coming. If you feel up to it perhaps you could tell us all about the first time you realised that your AOL membership was a problem?

Re:

[Jerf]

Yes. That would be worth at least 11,620 off your Slashdot UID.

A mystery revealed

[Ponzicar]

Does this mean we'll find out the identity of the guy who asked the AOL search engine "do (racial slurs) have x-ray vision?"

Good

[T.Hobbes]

AOL's releasing of the data was a very good thing, in that it raised people's awareness of the sheer quantity and potentially embarassing nature of search-engine records. With this data being made publically availible, people can now make informed judgements regarding the tradeoff between privacy and national security (or whatever justification is used for the retition of this data).

This sort of lawsuit had to happen at some point; better soon rather than later, and, better that it come out of the incompetance of search-engine administrators rather than the abstract fears of the privacy-inclined.

Re:

[kfg]

. . . all the slashdoters can kiss my ass.

You first.

KFG

AOL's response

[Anonymous Coward]

810565: Online privacy laws
810565: privacy lawyers
810565: Online privacy
810565: EFF online privacy
810565: lawsuit online privacy search
810565: sex with domesticated animals
810565: pictures of sex with domesticated animals
810565: privacy data retention
810565: privacy search data
810565: privacy search data law

Uhoh

[theskipper]

Speaking of legal problems, a few months ago in AOL search I entered "George Bush", "buffoon" and "retarded chimp" in sequence.

Does anyone think this could get me sent to Guan

Re:

[FinchWorld]

If anything it should get you some sort of award.

Playing it out...

[nilbog]

This will be really interesting to watch. I mean, AOL has dirt on everyone - I can imagine it will be hard to have a court case against them when AOL can come back and say "Oh here you are searching for child porn, illegal song downloads, etc." Unless they don't have anything to be ashamed of I can see it being a very difficult case for the plaintiffs.

Re:

[KokorHekkus]

This will be really interesting to watch. I mean, AOL has dirt on everyone - I can imagine it will be hard to have a court case against them when AOL can come back and say "Oh here you are searching for child porn, illegal song downloads, etc." Unless they don't have anything to be ashamed of I can see it being a very difficult case for the plaintiffs.

Such low blows could very well work on a singel individual... but if applying that to a whole group of people then there's bound to be one or two that will

I can see the plaintiffs now...

[cyberfunkr]

"Yeah, see, my name is Joe Blow and I was trying to find my sister's MySpace page. Her name is Lolita. I know she used to work at a race track so I did a search for her: Lolita Blow Job Horses. What's so wrong with that? Now give me my share of the settlement."

"Unspecified Damages"

[slughead]

It does not specify the amount of damages being sought.

It'll be a drop in the bucket compared to something that would actually hurt AOL, lawyers will be able to buy more yaughts, and no 'victim' will actually get anything significant out of the deal.

Haven't we seen enough of these class action suits to know how it goes already?

Re:

[Prof.Phreak]

...lawyers will be able to buy more yaughts, and no 'victim' will actually get anything significant out of the deal.

Which defeats the whole purpose of such a case... but eh, lawyers have to be lawyers. `victims' (if they can be called that) will get a CD-ROM that lets them use AOL for 1500 hours!

This is just BS by lawyers. I really think search corps should release such data all the time (google anyone?). If folks think it invades their privacy, well then... welcome to the Internet!

I found that data pretty

Bush will support AOL ...

[IanDanforth]

The justice department will file a friend of the court brief urging the judge not to impose any limitations on data retention. In fact, while a monetary penalty for releasing the information is in play, the idea that they could shorten or in anyway affect the retention of data is so contrary to the desires of people like Rumsfield and Gonzales that it will never happen.

Privacy is anathma to control and this administration loves control.

use a search proxy

[talledega500]

its so-oo-oo simple. http://www.blackboxsearch.com/ [blackboxsearch.com]

the searchings of a random user...

[elmarkitse]

816597 aol
816597 aol evil
816597 sue aol
816597 lawyers to sue aol
816597 evil french free pc
816597 aol sucks
816597 make money by suing aol
816597 class action lawsuit
816597 cookies
816597 hide porn from girlfriend
816597 clear cache
816597 stupid aol
816597 games for people from the midwest
816597 Adult bookstores near Dayton, OH
816597 fake ID
816597 search for embarrassing stuff online
816597 have my innermost thoughts and desires posted online for the world to see
816597 ?????
816597 Sue AOL - PROF