AOL admits to privacy lapse

America Online (AOL) today is admitting that a customer service representative divulged private information about an AOL member to a Navy investigator, in violation of the online service's own privacy policy.

The investigator used the information to order the member's discharge from the Navy for allegedly admitting he was gay. AOL initially said it was "confident" that its privacy policy was followed.

Today the Navy and the AOL member, Navy Senior Chief Timothy McVeigh (no relation to the Oklahoma City bomber), faced each other in a Washington court hearing in which McVeigh accused the Navy of violating the federal Electronic Communications Privacy Act (ECPA) when its investigator requested the information without identifying himself or obtaining a court order or subpoena.

The Navy today delayed McVeigh's discharge orders until midnight Friday. Judge Stanley Sporkin is expected to rule before then, McVeigh's attorney, Christopher Wolf, said this morning, following the hour-long hearing.

In less than a month, this case has gone from relative obscurity--McVeigh and his friends were sending out email to anyone who seemed interested--to the international media spotlight, where McVeigh is fielding calls from reporters from around the globe.

The core of the case hits two important legal challenges and with them, two very raw nerves in the American psyche: privacy in the electronic age and President Clinton's policy on gays in the military.

Lawyers and privacy advocates say this case could set an important precedent because it is the first time a governmental body has faced a court challenge for violating a provision of the ECPA that prohibits the government from obtaining "information pertaining to a subscriber" without a court order or subpoena.

"We think this case is profoundly important to Internet users," Wolf said. "If the government can illegally obtain private information and use that against the subscriber, it's a serious concern for any Internet user."

AOL released the information to a Navy investigator after the investigator, Joseph Kaiser, called an AOL service representative and asked for it. Kaiser, according to his own sworn testimony, never identified himself. He had called AOL because he wanted to legally link McVeigh with a member name from which McVeigh had sent email.

The profile attached to the member name had listed the word "gay" under the "marital status" section of the online form. It also had identified the member as "Tim" from Honolulu, Hawaii. Navy officials, who based the entire discharge on the screen name, have publicly said they felt they had enough evidence to link McVeigh to the screen name without having the AOL representative verbally confirm his identity on the telephone. But a Navy attorney said in testimony obtained by CNET's NEWS.COM that she did need the confirmation to link McVeigh to the screen name.

Today, while AOL acknowledged its representative had made a mistake, it said it would not happen again. "This was a case of human error under very unusual circumstances," AOL said in a statement. "We want our members to know that their privacy is of paramount importance to AOL and we take our responsibility to protect it very seriously. We will do everything we can to maintain that commitment."

AOL stated that along with reinforcing its existing privacy policies, which guarantee that private information will never be divulged, it is "instituting additional measures that will reinforce our privacy policies and procedures to our member services representatives."

AOL also took the offensive, accusing the Navy investigator of violating the ECPA by not divulging his identity or the purpose of his call and then misleading the customer service representative "into confirming information the Navy already possessed about Senior Chief McVeigh, both by failing to disclose his identity and purpose and by portraying himself as a friend or acquaintance of Senior Chief McVeigh's."

AOL has sent letters of protest to the Navy over the issue.

The author of the military's "don't ask, don't tell, don't pursue" policy, Charles Moskos, also filed court documents on behalf of McVeigh, saying that if the Navy violated the ECPA "by seeking confidential information from an online service provider illegally, the case against McVeigh should be dropped."

As for McVeigh, he said today that he still is fighting for the same thing: to get his job back and continue with his military career. "I think the judge is going to fairly review the case, which is what I've been asking for all along," he said.

He also said that his case "speaks for the disregard the Navy has given to the policy."

McVeigh has not commented on his sexual orientation. A service member can be discharged for saying he is gay. But his actual orientation is irrelevant to the case. When asked how he feels about the Navy's policy, he answered carefully, "If there's going to be a policy, then it should be followed."