Execs at AOL Approved Release of Private Data? 156
reporter writes "The New York Times has published a report providing further details about the release of private AOL search queries to the public. According to the report: 'Dr. Jensen, who said he had worked closely with Mr. Chowdhury on projects for AOL's search team, also said he had been told that the posting of the data had been approved by all appropriate executives at AOL, including Ms. [Maureen] Govern.' The report also identifies the other two people whom AOL management fired: they are Abdur Chowdhury and his immediate supervisor. Chowdhury is the employee who did the actual public distribution of the private search queries. He, apparently, has retained a lawyer."
Poor Data (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
retained a lawyer? (Score:4, Insightful)
Re: (Score:2, Insightful)
Ask former President Clinton. Ask Bush after he concludes this term.
Re:retained a lawyer? (Score:5, Insightful)
When you're President of the United States, you don't really have any recourse when Congress (a co-equal branch) starts issuing subpoenas, nor are similar jobs readily available.
Nice bad analogy, though.
Re:retained a lawyer? (Score:4, Insightful)
Each branch only has as much power as it chooses to exercise.
Re: (Score:2)
Of course, now US District Judge Anna Diggs Taylor is being attacked, being accused of failing to recuse herself in spite of a conflict of interest [rawstory.com].
Re: (Score:2)
The US District Court exists because Congress says it does. It isn't until the Supreme Court of the United States says something (or declines to say something) that The Judiciary Has Spoken*. Accordingly, Congress can feel free to disregard a poorly-written decision that depends heavily on cherry-picked case law.
Re: (Score:2)
Now be a good little boy and go play with your toys and let us grownups have our conversation, okay?
Re: (Score:2)
Re: (Score:2)
I guess that's only improper when it involves people and organizations with whom you disagree, right?
Re: (Score:2)
Re: (Score:2)
It is almost impossible to counter the legality of her decisions becasue she didn't write one. She basicly said this is wrong, i'm finding for this side. case over.
There is no legal basis mentioned for the decision, no other case laws cited in the decision, nothing even indecating why it was wrong or what laws it specificly violated. Ju
Re: (Score:3, Insightful)
Re:retained a lawyer? (Score:5, Insightful)
Perhaps because being fired is a whole lot worse than quitting voluntarily... and more importantly, lets them avoid giving you the severance pay they would otherwise owe.
Personally, I know that if I were told by my boss to do something and then got fired for doing it, I'd be extremely pissed!
Re: (Score:2, Insightful)
At a former job, we got a contract with the Navy to put our computer system on an aircraft carrier. One employee quit rather than work on a system that would be used to help kill people. Although I didn't have any qualms about that particular application, I understood her stand.
Re: (Score:2)
Nuremberg analogy is valid (Score:2, Insightful)
Obviously they're not the same thing. But the Nurember analogy is still valid. To do a thing that you know to be wrong, that can lead to expanding the already-pervasive abuse of personal knowledge by so many large companies, is not justifiable because your boss told you to do it.
Today the "little guy's" only defense against being taken advantage of by major corporations and the governme
Re: (Score:2)
Re: (Score:2)
Re:retained a lawyer? (Score:5, Insightful)
Of course, don't let that small difference in scale dissuade you from bringing Godwin's Law into effect.
AOL did not provide any of the information necessary to identify the searchers. So while I disagree with the disclosure, this breach of privacy is on par with other acts of corporate idiocy I've seen, and based on that I would say that there wasn't any basis requiring him to refuse this order. There's no clear and compelling need to disobey an approved transfer of more-or-less anonymous data, unlike a situation where someone is ordered to kill innocent civilians by the truckful.
Finally, get a sense of proportion. Are you seriously comparing a poor privacy decision with a decision on a life-and-death matter? Tenuously exaggerated examples do not shore up tenuously supported arguments.
Re:retained a lawyer? (Score:5, Informative)
Oh, really? A couple of NY Times reporters didn't let that stop them. They used the search data to find and interview User No. 4417749, Thelma Arnold, a 62-year-old widow who lives in Lilburn, Ga. Link to story below. Bugmenot login works.
http://www.nytimes.com/2006/08/09/technology/09ao
Re: (Score:2)
Re: (Score:2)
I often Google search my own name (to look for [gasp] copyright infringement or plagiarism). Were I an AOL user whose data got released, I would certainly have been easily identified.
Re: (Score:2)
Having reporters show up at your door--even if they do not know your name--and start asking questions is PRIVACY? Perhaps on your planet, but not on this one.
Re: (Score:3, Funny)
The Clerks argument! My favorite! Was it okay to blow up the Death Star the second time, while it was being repaired? Do you think the average storm trooper knows how to install a toilet main?
Godwin already? (Score:2)
Re:retained a lawyer? (Score:5, Interesting)
That's when documenting your work is important. As a lead tester at Atari a few years ago, I was in situations that I could've been fired for except all my documentation pointed back to management. When a new boss told me to stop doing that, I told him I would not. Then it became a cat-and-mouse game for the next six months as he tried to get me fired without getting himself fired in the process. I eventually left on my own for "personal reasons" and it turned out I was the third person out of a dozen senior testers to leave that year when my boss became the department manager.
Re:retained a lawyer? (Score:5, Interesting)
- Sacked for gross incompetence
- Left after being used as a scapegoat
The point of most unfair dismissal actions is not the money, it's the CV.How about... (Score:1)
* Filed lawsuit against former employer due to wrongful termination.
Re: (Score:2)
+1 Funny (Score:2)
Re:retained a lawyer? (Score:5, Insightful)
I know of one senior guy who worked for a well known credit card company. He was brought in to cut costs. On day one all the department heads were brought in one by one. He ignored everyone's plans and spreadsheets and just gave them a slip of paper with 500k, 1 million or whatever written on it and said 'that's your budget'. A few months later he had another 35m to lose and noticed a single dept that cost that. He ordered it shut down and the staff made redundant. Within a few months the company's income was in freefall - he'd sacked their most profitable sales team. He had to go grovelling to the board to explain, rehire as many as he could at inflated salaries and was then fired. You can bet his CV reads 'Worked for xxxxx, achieved 70 million cost cuts'
Re: (Score:2)
* Sacked for gross incompetence
* Left after being used as a scapegoat
They're both equally effective at preventing you from getting hired anywhere else. The new HR director isn't going to give a sympathetic ear to your tale of scapegoatism, he or she is probably going to assume that you actually deserved the blame you got, and your story is nothing more than a save-face gesture.
Re: (Score:2)
This, of course, sucks...
Re: (Score:2)
Re:retained a lawyer? (Score:4, Funny)
Re: (Score:2)
Whatzhe goin on all 'bout, I dunno.
Re:retained a lawyer? (Score:5, Insightful)
Then, if he doesn't want to work there, he can quit. There is a huge difference in being able to tell a prospective employeer that you quit because of the culture of blame-passing, and having to tell them you were fired because you released private data to the public.
Re: (Score:2)
I recall similar defenses were raised at Nuremberg, and didn't go over very well.
Blaming the mailclerk for the mail isn't good policy.
Maybe not, but I guarantee you that every day there are dozens of mailclerks, helpdesk technicians, and professionals of all stripes who are fired for things for which they do not actually deserve any of the blame.
Re: (Score:2)
"I was just following orders" is an attempt to pass the blame. Sometimes the blame legitmately needs to be passed to those responsible, and sometimes it doesn't. Ignoring th
Re: (Score:3, Insightful)
I recall similar defenses were raised at Nuremberg, and didn't go over very well.
Shut the fuck up about Nuremburg! Releasing anonymized search data is not the same as shovelling people into ovens!
Re: (Score:3, Insightful)
That of course, is assuming that he really is as innocent in all of this as he claims to be.
Re: (Score:2)
That of course, is assuming that he really is as innocent in all of this as he claims to be.
I think "naive" is a better word in this case. Of all people, I'd expect a data mining academic to understand the potential ramifications of releasing search data. Maybe this guy's head was so far in the clouds above the ivory tower that it just didn't occur to him, but I somehow doubt it. More likely, the idea of getting a publication out was too attractive to worry about petty ethical considerations.
Re: (Score:2)
-Rick
Re: (Score:2)
Re:retained a lawyer? (Score:5, Insightful)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Wrongful termination is definitely worth going to court over. If he was working under the direct orders of top executives at AOL, he didn't do anything wrong. Had he refused to post the info, he probably would have been fired. I'm okay with the execs being fired, but he's just a guy that did what he was told.
Re: (Score:2)
However, I think that a technical person should have damn well known better than to do something like that, and I think that if such an individual was working under me, I very well might can him right along with his boss just for making a seriously poor judgement call.
Re: (Score:2)
Obviously (Score:4, Interesting)
Not at all sure about why they thought it was a good idea, they must have thought the ID numbers were sufficient to conceal identities which also shows the lack of security knowledge most executives have.
Re: (Score:2)
Yes I've seen MANY people aggregate too many variables or extremly unique variables then act surprised that it didn't really aggregate.
Personal Matters (Score:5, Funny)
You've got... (Score:1)
Mr. Chowdhury is a comedic GENIUS! (Score:5, Funny)
http://i.somethingawful.com//sasbi/2006/08/docevi
http://i.somethingawful.com//sasbi/2006/08/docevi
and of course
http://i.somethingawful.com//sasbi/2006/08/docevi
Just because they approved it... (Score:1)
Re: (Score:1, Informative)
I can entirely believe that the execs didn't know the full implications of what they were looking at, or didn't have a clear idea of what could be done with the data. I'm sure that they cared that the data was anonymized, and it *was*, just not well enough.
However, even though they sometimes like to come off as knowing what they a
think of the children (Score:5, Funny)
I bet they have a stamp that says that.
think of the *animals* (Score:2)
What should we expect (Score:1)
One good thing came from this... (Score:2)
And with this improvement in public awareness of how important it is to have private data safe-guarded and controlled, I think we'll see a little more interest in what business and government does with private data. I think that ultimately, we need to get a LOT more aggressive over the misuse of the SSN (social security number) and forever separate the
Re: (Score:2)
Which ID is used isn't the problem. The problem is that a simple ID is being used as both an ID and a password.
Internal AOL e-mails announcing new privacy plan (Score:1, Informative)
There is no privacy (Score:2)
Whereas they're probably just mad at someone for forgetting to SELL the information.
Re: (Score:2)
It just wants to be free! (Score:3, Funny)
Freeeedom! (Score:4, Funny)
Re: (Score:3, Insightful)
Is it okay to use the data anyway? (Score:2, Interesting)
"I think the release of this data is a breach of privacy and should never have been made public. But
Then they present their analysis. My question is if you are going to preach on the evils of releasing the data then do you have the moral right to analyze it? I think not.
Re: (Score:2)
This is why "free" is bad (Score:2)
The first place is of course advertising. Having people pay to push their message at the unsuspecting people that are using the service. Eventually the ads become all-pervasive and lose some of their value. Where we are today is that banner ads are almost worthless and Google has made
The Real Problem (Score:4, Insightful)
The real problem is that they shouldn't have been keeping it in the first place!
If it can harm a consumer by its release, then it can harm that same consumer by the fact that the have it in their possession in the first place. Just how is AOL that much better or more trustworthy than the world at large?
Film at eleven. (Score:2)
Bear craps in woods.
Yes Im sure they did (Score:2, Informative)
http://www.blackboxsearch.com/ [blackboxsearch.com]
Re:Possible Solution (Score:4, Funny)
Re: (Score:3, Insightful)
Not even close to that simple. AOL didn't stand to make any money off this situation. The data was provided entirely "altruistically" for the benefit of researchers.
And what are these researchers "researching"? They are studying how to make searches more relevant, among other things.
Will
Re:Possible Solution (Score:5, Insightful)
That's a bit cynical, don't you think?
If they really wanted to make the most money possible, they would have sold these logs (non-anonymized) to the scores of direct marketers that I'm sure would love to have this data. Instead, they packaged it up and tried to make it available to academic researchers. These researchers honestly just want to make better search engines that run faster and return better results. Furthermore, when academics come up with a great new idea, it gets published so that anyone can read it.
Every once in a while, someone suggests an open source search engine. Check out Nutch [nutch.org] if you want to see work in this area. However, if open source search solutions are going to be any good at all, they'll have to rely on the decades of public, published information retrieval research that's already out there.
We are entering a time when companies are capable of totally outpacing academia because they have query log data, so they know exactly what users actually do. There is no way that an academic can get this kind of data unless a company releases it. Researchers at AOL, in good faith, tried to release data so researchers could have a chance at success. Ultimately, of course, that's good for AOL since they're not in the top three search engines out there. Public research can only help raise AOL's standing by helping to level the playing field. But, it's good for you too, because you can build your open source solution based on this research too.
Yes, the release was botched, and yes, the long term user identifiers were a mistake. But don't make AOL out to be some evil company that was only out to destroy your privacy. They made a mistake!
Still motivated by money, and still despicable (Score:2)
See, just selling email addresses to the spammers doesn't actually bring _that_ much money. See the AOL idiot who exported the database and sold it to spammers. He's got, I think, some tens of thousands of dollars. That's small change for a corporation.
Even if they sold it together with the search keywords, how much do you think they'd get? Hundreds of thousands? Let's even be generous and say a couple of millions? Those guys have to think of their own pr
Re: (Score:2)
Here's a potential solution to your "industrywide problem": Stop treating us (your users) as nothing more than a market. We're individual human beings. Right now, we just look like sacks of money to you and your "research" consists of trying to extract that money from us.
If you want to be treated as a person, then limit your interactions to other people, not corporations. What the hell do you expect from a FACELESS ENTITY?
Why are people continually shocked at the behavior of corporations (which are en
Re: (Score:1, Troll)
I haven't followed this story so correct me if I'm wrong but -- the "private data" here were just search terms with no user identification, right?
It was a bit more than just search, it was complete records of internet usage from the ISP.
If that's the case, who the hell cares?
In many cases it is simple to piece together who a user is from these records and some of the data mining potential is more than a little invasive. This is stuff like someone who routinely edits a myspace page with personally ide
Re: (Score:2)
No it wasn't, it was strictly search terms and if they clicked on a link, what link they clicked on - that's it
Re: (Score:2)
Re:Who the hell cares? (Score:5, Interesting)
You're wrong.
The IP address or user name of the person who searched has been removed, but it was replaced with a unique identifier that tracked all of the searches by the same person.
Many people search for things related to themselves. For example, if you have looked for a job in the last four years, you were foolish if you didn't search for your own name to see if your friends' blogs had descriptions of your late-night drinking binges and drug use. (You are probably foolish if you used AOL search to do this, but that's a different discussion.)
CNN ran a story where they were able to track down one older lady, just because she searched for her last name, searched for "drugstores near " or somesuch, and was the only person in her area with that name. They confirmed with her that the searches were hers. (She has a dog with problems urinating on her carpet, and she has friends with lots of diseases that she "researches" for them.) They picked someone to track down who hadn't searched for anything "naughty", but that doesn't mean they couldn't have if they had wanted to.
Re: (Score:2)
How is AOL supposed to know if a subset of data includes privacy data? A 9-digit number could be a SSN, but it could also be a phone number (not all countries use 10 or 7 digits), an ISBN (minus the check digit), or any number of other numbers. A 16-digit number (or 15 digits) isn't necessarily a credit card number. Just because someone puts an address into a search engine doesn't mean that it's their own addres
Re: (Score:3, Interesting)
Re: (Score:2)
How? By never giving it to anyone? Never getting a loan, insurance, or a magazine subscription? Always working for cash under the table and never filing taxes? Any one of those things releases your address, phone number, billing information, etc. out of your control. At some point you have to say the data has changed hands and so has the responsibility to protect it.
Sure it was dumb (was it really dumb at the time though, or are we only
Re: (Score:2)
In situations like this, there's usually more than enough blame to spread around. Sure, it's easy to just say that AOL was completely in the wrong and should have to pay for it, but that doesn't reflect the whole truth, does it?
Think of it this way, there are quite a few people who would never think of putting their own personal information into a search engine (I didn't, until this inciden
Re: (Score:2)
Have you also searched for "Pizza Hut near ?" Voila, all those others with the same name are eliminated; it is clear that the search was about you. Piece together more searches, and it becomes clear that it was you, not about you. Then anything else you have ever searched for is correlated as well.
It isn't any one search that causes a privacy concern. As ot
It's the x-refs, not the data. (Score:3, Interesting)
As a society, or at least as a subset of one, we need to discuss this. Where should the "expectation of privacy" be when one is using a search engine (or the Internet in general)? It's a very open question.
On one hand, most people I think realize that the query to the search engine is not 'private.' As in, you can go and view at any given time, all the things that are being typed in to Google. (At least you used to be able to, or maybe this was Yahoo.) At any rate, the quer
Re: (Score:2)
Maybe we should just leave it at that.
Re: (Score:2)
For example, if you have looked for a job in the last four years, you were foolish if you didn't search for your own name to see if your friends' blogs had descriptions of your late-night drinking binges and drug use. (You are probably foolish if you used AOL search to do this, but that's a different discussion.)
Why would it be foolish? AOL search is just Google, anyway.Re: (Score:2)
Yeah, it's all the creepiness of Google, but without the "do no evil" oversight. What could possibly be wrong with that?
Re: (Score:2)
Yeah, it's all the creepiness of Google, but without the "do no evil" oversight. What could possibly be wrong with that?
Ever hear the phrase "hindsight is 20/20?" And do you really think some "do no evil" corporate mantra is going to protect you until the end of the universe? I could say you're just as stupid for using Google (after all, didn't you realize that in May 2009 they're going to release all your search queries?)Re: (Score:2)
AOL search is just Google search, except that they are also your ISP and can conclusively and definitively aggregate all of your searches and assign them a unique identifier, then release them to the public.
Using Google search and clearing your cookies, you cannot be definitively matched to what you look for.
Users have been idenfitied (Score:1)
Re: (Score:2, Insightful)
Partner this up with the fact the some people may search for the name, credit card number, and social security number to see if they're posted anywhere, you have some serious privacy concerns.
Take for example, (and I'm making this up), user #5, these are his search terms:
Joe Schmo
014-56-1234
4729-1234-5678-9012
Pizza stores near 1 main str
Re: (Score:2)