X

AOL accused of privacy violation

The online service may have violated its own policy and perhaps the law when it allegedly revealed the identity of a member to a Navy investigator.

7 min read
America Online (AOL) may have violated its own policy and perhaps the law when it allegedly revealed the identity of a member to a Navy investigator.

The United States Navy is recommending that a U.S. sailor be discharged for "Homosexual Conduct Admittance" because he typed the word "gay" on his member profile under "Marital Status."

But the sailor, Timothy McVeigh of Hawaii (no relation to the Timothy

Timothy R. McVeigh
Timothy R. McVeigh
McVeigh convicted of bombing the federal building in Oklahoma), and his attorneys said that the Navy may never have been able to legally link him with the profile if an AOL employee hadn't provided his identity to a Naval investigator, violating AOL's own privacy policy.

The Navy linked the profile to McVeigh, a 17-year veteran of the submarine force who held the rank of senior chief, after the military investigator called AOL and said he wanted to find out the identity of the person who had sent him a fax belonging to the screen name. Without identifying himself, he said an employee named "Owen" revealed the name of the account owner as McVeigh along with his state of residence, according to transcripts of sworn military testimony provided by McVeigh's advocates.

AOL spokeswoman Wendy Goldberg said AOL does not release the identity of a user unless it is "presented with a search warrant, a court order, or subpoena. Federal law prohibits release of any personal information. We take this in our members' policy very seriously.

"Our policies are all well-known by all our representatives and we believe our policies are followed by them," she added. "There is nothing in the transcript to suggest we gave out private information."

However, some who have read the transcript think otherwise.

"AOL appears to have violated its much-touted privacy policy and destroyed a subscriber's life," said David Sobel, an attorney with the Electronic Privacy Information Center. "Every AOL subscriber needs to be concerned about this incident."

The investigator said he called AOL and asked for the identity of the person who owned the screen name, according to the transcripts. The investigator, who did not identify himself, said that on September 12 an employee in "tech services" revealed to him that the owner of the account was named "Timothy R. McVeigh" and that he lived in Hawaii.

That information was enough to get McVeigh drummed out of the military. On January 5, the chief of naval personnel approved the recommendation to discharge him. Privacy advocates now are concerned about other AOL members.

AOL's policy states it will "not to disclose identity information to third parties that would link a member's screen name(s) with a member's actual name, unless required to do so by law or legal process served on AOL, Inc. (e.g., a subpoena)."

Deirdre Mulligan, a staff attorney with the Center for Democracy and Technology, said that when the Navy investigator called AOL seeking to connect the screen name with McVeigh, it also violated a federal law: the Electronic Communications Privacy Act, which requires that a government agency seeking information about an individual's online communication or subscriber information must go through an "appropriate legal process in which, at the very least, they seek an administrative subpoena."

"The military clearly violated the law," she said. "They are not just allowed to call up and say who they are and seek information about an individual."

She added that AOL may also have violated the law, which prohibits private companies from giving that information to a government agency. According to the hearing transcripts provided by McVeigh's advocates, the Navy investigator said he called AOL and asked for the identity of the person who had sent an email message without identifying himself.

That may not matter when it comes to the question of the law, she said.

"From the transcript, this person said he asked for information and it was provided without any check of who he was and his right to get information," she said.

Sobel added that this incident underscores the need for Congress to pass laws that specifically protect privacy online. He worries that online companies can collect detailed information about people, such as where they like to surf, what they like to read, what kinds of goods they purchase, and even the substance of their conversations, and then could release it.

If AOL did reveal McVeigh's identity, as the Naval investigator testified, then this instance shows how that information can be used against people.

"A lot of people come to AOL and stay on AOL because they are given the option of using their own screen names that AOL tells them are anonymous," Sobel said.

In the debate over whether laws should protect privacy, "The industry keeps saying you can't point to anyone who has been harmed by disclosure of personal information. We now have an unusual circumstance that has led to a sworn statement in a legal proceeding that demonstrates that harm. There's clear cause and effect here. It raises the point of how prevalent is this kind of disclosure. That's why every AOL subscriber needs to be concerned about this," Sobel said.

Both Sobel and Mulligan said that even if people don't care about the particulars in this case, they should worry about privacy issues in general.

"What if they had called up and asked for the identity of your kid's screen name?" Mulligan asked. "What if it was me and somebody wants to know who I was and where I live?"

AOL's Goldberg stressed that the online service takes privacy "extremely seriously," and that members should feel safe on the service.

But those involved in the case are far from comforted.

"Legally speaking, there was no proof that this was his email account," said John Aravosis, an Internet consultant helping to bring attention to the case. "This was his email account. They called AOL and AOL gave the absolute proof that this was his email account. That should never happen."

Kirk Childress, staff attorney with the Service Members Legal Defense Network, which is helping with McVeigh's defense, said that without the link between McVeigh and the screen name, the government's case would be much weaker, and they might not have been able to make it at all.

"It is doubtful to me that a court would have issued a subpoena under these circumstances," he said.

As it is, he added that people make up information about themselves all the time when they write online profiles, and someone saying anything about themselves online does not necessarily mean it is true.

Plus, he added, using a person's screen name on AOL to toss him out of the military brings the so-called don't ask, don't tell policy regarding homosexuals in the military to a new level.

McVeigh, 36, was serving as chief of the boat on the USS Chicago, the head enlisted person on a submarine, when in September he returned from a brief tour out at sea to be confronted with allegations that he had declared his homosexuality and was under suspicion of sodomy and indecent acts based solely on the AOL user profile, said McVeigh, who developed a Web page to publicize his plight.

"They removed me from my job without anything," McVeigh said in a telephone interview. "They said they would commence an investigation and [the investigator] felt she had enough information to remove me from my job."

The profile, he said, "said marital status, 'gay.' I have five different profiles. They didn't ask about any of the other screen names."

Just before he went out to sea he had emailed an ombudsman, a Navy wife who served as a contact for enlisted men sent out to sea, asking her to collect names and ages of children of the submarine crew so he could then help arrange for them to get Christmas presents, McVeigh said.

She then logged onto AOL and looked up the screen name under which McVeigh had sent the email message, he said. She found the profile with the word "gay." It also listed his occupation as the "military" and said his name was "Tim." There was no other identifying information, he said.

The ombudsman then turned over the profile to the military, McVeigh said. From there, the Navy conducted an investigation in which it linked the screen name in question to McVeigh. It also verified that McVeigh had never been married, a fact that it used as evidence, he said.

McVeigh would not discuss his sexual orientation. Saying one is homosexual is grounds for dismissal under military law.

But even if he were gay, the Clinton administration policy was not designed to seek out people who are private about it, Childress said.

"The policy was supposed to give people a zone of privacy," he said. "It was supposed to mean they weren't going to go out and hunt up information about you.

"A civilian took it upon herself to look up information and turn it in to his command," he said. "His profile didn't have his name on it. It was something that was private. It was a private communication."

To complicate matters, last night AOL canceled McVeigh's account, accusing him of writing chain letters, said his mother, Teri McVeigh. In fact, on his Web page, McVeigh offers people a way to request a letter to send to various officials, including the president. His mother said that several requests made this morning went to a dead AOL address.

Timothy McVeigh said he hasn't had time to call AOL's community action team, since he is busy trying to get reinstated in the Navy.

Services and Software Guides

VPN
Cybersecurity
Streaming Services
Web Hosting & Websites
Other Services & Software
Services and Software Coupons