On September 16, 2008, during the U.S. presidential campaign, 20-year-old University of Tennessee student David Kernell accessed Sarah Palin’s private Yahoo! Mail account by using publicly available biographical information—including her birth date and high school—to answer Yahoo’s account-recovery security question. Using the online handle “Rubico,” he read messages, posted screenshots and the account password on 4chan, and sent material to WikiLeaks. The incident exposed the weakness of relying on easily discoverable personal facts for account recovery, although the source does not report a finding that Yahoo! was legally liable or that its systems were breached beyond the individual account.
The FBI and Secret Service investigated, tracing activity through proxy logs and evidence left in online posts. A federal jury in Tennessee on April 30, 2010, acquitted Kernell of wire fraud, deadlocked on identity theft, and convicted him of unauthorized computer access and anticipatory obstruction of justice for destroying records. The obstruction conviction was upheld by the U.S. Court of Appeals for the Sixth Circuit in January 2012. Kernell was sentenced on November 12, 2010, to one year and one day in federal custody, followed by three years of supervised release, and was released on November 23, 2011.