Heads roll at AOL after search data blunder

Two AOL employees have been fired, and its chief technology officer is resigning, after the release of web search data from thousands of AOL members prompted widespread criticism of the company.

CTO Maureen Govern "has decided to leave AOL effective immediately", AOL chief executive Jon Miller wrote in an email to employees dated Monday.

Govern could not be reached for comment.

The researcher responsible for the data being posted online and the researcher's supervisor, who reports to Govern, were fired, according a source close to the matter who asked not to be identified.

Meanwhile, John McKinley, who is president of AOL Digital Services and served as chief technology officer from 2003 to 2005, will step in as interim CTO until a permanent replacement is found, AOL said.

In a separate email to AOL employees, Miller said the company would create a taskforce to develop new best practices on privacy and will look at how long search and other data should be saved.

The company is also considering tightening restrictions on access to databases containing search data and other sensitive member data, looking into ways to ensure such information is not included in research databases and adopting education programmes for employees on how to protect sensitive information, according to the email.

Miller wrote: "After the great lengths we've taken to build our members' trust and be an industry leader on privacy, it was disheartening to see so much good work destroyed by a single act. This incident took place because some employees did not exercise good judgment or review their proposal with our privacy team. We are taking appropriate action with the employees who were responsible."

AOL researchers posted the data on the user web searches to a new AOL research website last month. It then pulled it and apologised for the security breach shortly thereafter but not before other sites got hold of the data and made it searchable. AOL has been widely criticised for releasing the data.

Pam Dixon, executive director of the World Privacy Forum, said the Federal Trade Commission (FTC) should investigate whether AOL partners and others have received sensitive user data from AOL over the years.

She said: "I don't think firing employees is going to be a solution to the problem. It appears that these data disclosures were a symptom of a more systemic problem at AOL regarding data handling policies and practices. The 'tip of the iceberg' may well apply here; it will be up to the FTC to find this out, though."

It is unclear whether AOL's release of the user search data was illegal but if AOL broke the law the FTC should take action, said Ari Schwartz, deputy director of the Center for Democracy and Technology, which receives a small fraction of its funding from AOL.

Schwartz said he was not convinced of the need for new action by Congress - specifically, a bill that would restrict how long all website operators can "warehouse" consumer data. It would be preferable for the industry to come to an agreement on uniform, voluntary standards, he said.

The notion that search companies are retaining information about users' personal searches, which "should be routinely deleted", is a lingering concern, said Marc Rotenberg, executive director of the Electronic Privacy Information Center.

Rotenberg said in an email interview: "AOL could do a real service to the online community, if it would commit to permanently [deleting] all personal search details and challenge other search companies to do the same."

Elinor Mills writes for CNET News.com