AOL Blunders--User Search Data Released

Okay, first things first: this isn't one of those, "Bob left his laptop on the bus, the one with every American's personal information on it going back to the Coolidge administration, and, gee, we hope it'll be okay" things.

This was an actual decision, sad as that may seem. What happened was that America Online (a phrase rich in irony at the moment) posted files containing logs of all searches done by 500,000 of their users over the course of three months earlier this year. It was intentional.

The identities of the searchers were anonymized--that is, each user's AOL name was replaced by a unique number. Just as well, given that the data revealed is sometimes quite alarming: user 17556639, for instance, has search queries on "how to kill your wife," "wife killer," "how to kill a wife," and "poop" (this relationship of this search to the previous ones is elusive, not to say grotesque).

Well, after being angrily kicked up and down the blogosphere, AOL quickly yanked the files containing all this data--which have already been mirrored elsewhere, of course, meaning that data is just out there online, and if it can be put to bad uses, it will be.

John Battelle, search engine guru-wonk-what you will, has this reply from AOL:

This was a screw up, and we're angry and upset about it. It was an innocent enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted, and if it had been, it would have been stopped in an instant.

Aside from the general good fun to be had by kicking around AOL, there are serious issues here about identity, anonymity, pseudoynmity, data correlation, massive data being made available online--those sorts of things. Some of them require technical understanding, while others don't.

For instance, if your (or my) data is going to be published online, we're a whole lot better off if it's not published with personally identifiable information attached. Pseudonyms, folks, pseudonyms--the way we ought to be doing business online, and the way we're not doing business online.

Like cryptography itself, pseudonyms aren't magic bullets, but they sure can prevent lots of mischief.