Word of the information leak spread like wildfire on the Internet when blogs began linking to a database of search queries compiled by the Time Warner-owned company over the past three months.
A research unit inside of AOL released the data — which the company maintains was supposed to remain private — in late July. Shortly after the release, blogs, lead by TechCrunch.com, began linking to the study, which consists of more than 20 million search queries.
AOL spokesman Andrew Weinsten apologized on behalf of the company.
"This was a screw up, and we're angry and upset about it," Weinstein said. "It was an innocent-enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted, and if it had been, it would have been stopped in an instant."
AOL is actively trying to determine precisely how the information was leaked to the public, Weinstein said.
According to attorney Jason Epstein, the disclosure, though embarrassing, probably did not violate AOL’s own privacy policy.
"This is more of a business snafu than anything else," Epstein said.
While AOL may not have a legal problem arising out of the leak, it certainly has created a breach of trust with its users, according to several bloggers who linked to the study.
“If you searched for something on AOL this year, you might want to think about what keywords you used and which links you clicked on," blogger Matthew Gifford said.
According to TechCrunch, none of the queries included users’ identities. However, many users conducted so-called “vanity queries,” typing in their own names.
"Combine these ego searches with porn queries and you have a serious embarrassment,” TechCrunch blogger Michael Arrington said. “Combine them with ‘buy ecstasy’ and you have evidence of a crime. Combine it with an address, social security number, etc. and you have an identity theft waiting to happen. The possibilities are endless."
The link to the actual file containing the searches in question is no longer available on AOL’s website.
In March, federal Judge James Ware ordered Google to submit 50,000 random website addresses to the U.S. Department of Justice. Many privacy experts had praised Google for taking a stand against the government’s efforts to resurrect the 1998 Child Online Protection Act. In the same case, Ware, citing privacy concerns, declined to give the government access to 5,000 Internet queries the government had requested to build a database of online search habits.
AOL’s recent leak effectively gives the world access to more than 650,000 similar queries, a CNET blog said.