On or about 16 September 2008, according to the indictment that followed, someone went to Yahoo's page for forgotten passwords and entered gov.palin@yahoo.com, the personal address of Sarah Palin, governor of Alaska and the Republican candidate for vice-president. To reset it, Yahoo asked for the holder's date of birth and ZIP code and the answer to her security question: where had she met her spouse? Her birthday was in her Wikipedia entry, and a home ZIP code is hardly a secret. The question took longer. She had met her husband at high school, the intruder learnt, so he tried variations, "high", then "high school", until "Wasilla high" let him in. By his own account the search took less than an hour. He set a new password: popcorn.
He posted it on /b/, a board of the imageboard 4chan, with screenshots of what he had seen: correspondence with friends and supporters, a list of her frequent contacts, pictures of her family. Copies reached WikiLeaks, and Gawker published some. "There was nothing there, nothing incriminating," he wrote. Another reader of the board, meaning well, logged in, changed the password again and emailed one of Palin's associates with the new one, then posted a screenshot of that email with the password showing. As others tried it, Yahoo locked the account; it and a second address, gov.sarah@yahoo.com, were later deleted. The McCain campaign called the intrusion "a shocking invasion of the Governor's privacy and a violation of law", and by Wednesday 17 September the FBI and the Secret Service were investigating.
The trail was short. The intruder had routed his traffic through Ctunnel, an anonymising proxy whose operator said he would cooperate with investigators, and the proxy had logged his IP address; he had also left an email address on the board. The day after his first post he wrote again, saying he had deleted it for fear the FBI would learn what he had done, and he deleted material from his computer. On 7 October a federal grand jury in Knoxville, Tennessee, indicted David Kernell, 20, an economics student at the University of Tennessee and the son of a Tennessee state representative, on one count of intentionally accessing the account without authorisation; the indictment was unsealed the next day. By trial it had grown to four felony counts.
The trial opened in Knoxville on 20 April 2010, and Palin gave evidence on the 23rd. On 30 April, after several days of deliberation, the jury acquitted Kernell of wire fraud, deadlocked on identity theft, reduced the felony count of unauthorised access to a misdemeanour, and convicted him of the felony of anticipatory obstruction of justice for the deletions, under section 1519, written into the Sarbanes-Oxley Act after Enron. On 12 November Judge Thomas Phillips sentenced him to a year and a day and three years of supervised release, recommending a halfway house in Knoxville; the Bureau of Prisons sent him to a minimum-security prison in Ashland, Kentucky. In January 2012 the Sixth Circuit upheld the obstruction conviction. Nothing in the verdict touched the questions that had let him in.
Every Tab in a Box
Google had prepared a 38-page comic to explain its new browser's features; copies sent to Europe arrived early, a German blogger posted a scan on 1 September 2008, and Chrome's beta followed on the 2nd. By keeping each tab in an isolated "sandbox", Google said, "we were able to prevent one tab from crashing another and provide improved protection from rogue sites". Its designers' report set out the split: a browser kernel facing the operating system, and a rendering engine, holding the HTML parser and JavaScript engine, sandboxed from the user's files. Against a year of flaws in Internet Explorer, Firefox and Safari, the authors reckoned it mitigated about 70 per cent of the critical ones that let attackers run code; plug-ins ran outside it. Within a day Rishi Narang had published a link that crashed the whole browser, every tab with it, and Aviv Raff had shown that Chrome's older copy of WebKit, lacking a fix Apple had shipped in Safari 3.1.2, could trick Windows users into running a malicious download. A beta update announced on 8 September fixed four security flaws, the crash and the cluttered-desktop downloads among them. Chrome left beta on 11 December.
Graffiti Beside the Detector
At 10:28 on 10 September 2008 the Large Hadron Collider at CERN steered its first beam round its ring. That week a group signing itself the Greek Security Team defaced cmsmon.cern.ch, a page on a machine monitoring the software of CMS, one of the collider's four large detectors. Its message mocked CERN's security staff as schoolchildren and invoked 2600, the hacker quarterly. The Daily Telegraph, which broke the story on 12 September, reported that the intruders had come within a step of the detector's control system. CERN's spokesman, James Gillies, said no harm appeared to have been done, that someone seemed to be making the point that CMS could be hacked, and that the laboratory kept a general-access network apart from a much tighter one for the systems that run the LHC. The real damage was physical: on 19 September an electrical fault vented about six tonnes of liquid helium, damaging 53 magnets; beams did not return until November 2009.
Other People's Networks
The emails claiming two of the year's bombings were traced to other people's wireless networks. On 26 July 2008, at about 6.41 pm, television channels received a claim minutes before the first of 21 blasts in Ahmedabad, which killed 56 people. Its IP address led police to a flat in Sanpada, Navi Mumbai, where investigators came to believe someone had used the flat's unprotected Wi-Fi. On 13 September, at about 6.25 pm, eighteen minutes after the first of five blasts in Delhi that killed 26 people, a second claim reached media houses in India and abroad. Prosecutors say it travelled over the unsecured Wi-Fi of an engineering firm in Chembur, Mumbai.
The response was aimed at the networks. Arrests followed from late September, and the Delhi case file lists a Wi-Fi hotspot finder and a radio-frequency signal detector among the equipment recovered. Mumbai police were reported in early 2009 to be training officers to look for open networks and to warn their owners, citing section 149 of the Code of Criminal Procedure, the power to prevent a cognisable offence. In February 2009 the Department of Telecommunications told internet providers to give every subscriber a login and password and to secure the Wi-Fi at customers' premises, with public hotspots to sign people in by SMS or photo identity. Critics said such rules tracked users rather than securing networks. A survey reported in December 2010 still found 17 per cent of Mumbai's 200,000 networks unprotected, and that month the claim for a bombing in Varanasi came through a disc jockey's open connection in Vashi.
Apple's Genius learns from other people's libraries
On 9 September 2008, in San Francisco, Apple added Genius to iTunes 8: given any song, iTunes built a playlist from the owner's library of songs that "go great together", in Apple's phrase, while a sidebar suggested music to buy. Switched on, Genius sent details of the library anonymously to the iTunes Store, to be combined with knowledge gathered from millions of other users and run through Apple's own algorithms; the results came back so iPods could make playlists offline. On 2 September Google had given Picasa Web Albums name tags, built on technology from Neven Vision, bought in August 2006: once a few faces were named, clustering gathered other pictures of the same people, and the tags were private by default. On 30 September Google Translate went from 23 languages to 34, and from 506 language pairs to 1,122, its systems trained on vast amounts of text. Genius left the iOS Music app in 2016, and the stations Apple Music offered in its place drew on Apple's catalogue rather than the listener's own.
McAfee buys Secure Computing; Norton slims down
On 22 September 2008 McAfee agreed to buy Secure Computing of San Jose for $5.75 a share in cash, about $465 million in all once its preferred shares were redeemed and its cash deducted. McAfee, strong on the desktop and in network intrusion prevention, would gain the Sidewinder firewall, Webwasher and IronMail gateways for web and email, and TrustedSource, a reputation service; it projected combined network security revenue of just under $500 million a year. On 9 September Symantec had released Norton AntiVirus 2009 and Internet Security 2009 in America, after an engineering review prompted by complaints that its software slowed computers. Con Mallon, a product marketing director, acknowledged that Norton was seen as "big, fat and slow"; Symantec said the suite now installed in about 53 seconds, against four to five minutes for the 2008 version, ran in about 7 MB of memory and, through Norton Insight, skipped files whose hashes showed them unchanged or already trusted. Sidewinder went to Forcepoint with Stonesoft's firewall in January 2016.
⏳ Time capsule — September 2008
- On 6 September, at a meeting in Vienna, the 45 members of the Nuclear Suppliers Group granted India a waiver from their rules, opening its way to civilian nuclear technology and fuel from other countries. The exemption was one of the stages the India–US civil nuclear agreement had to pass.
- On Monday 15 September Lehman Brothers filed for Chapter 11 bankruptcy protection, holding more than $600 billion in assets. It remains the largest bankruptcy filing in American history.
- On 23 September, in New York, T-Mobile unveiled the G1, built by HTC and the first phone powered by Google's Android: a touch screen that slid aside to reveal a QWERTY keyboard, a trackball for one-handed use and the Android Market for applications. It was due in American shops on 22 October at $179 with a two-year contract.
- On 28 September, from Omelek Island in the Kwajalein Atoll, SpaceX's Falcon 1 put a 165-kilogram dummy spacecraft into low Earth orbit at the fourth attempt, after failures in 2006, 2007 and August 2008. It was the first privately developed rocket fuelled entirely by liquid propellants to reach orbit.
No longer an authenticator
Within the week Ed Felten of Princeton noted that Gmail already switched its security question off unless an account had gone five days without a sign-in. The studies followed: in May 2009 researchers at Microsoft and Carnegie Mellon found acquaintances guessing 17 per cent of answers, and in 2015 Google found 40 per cent of its English-speaking American users unable to recall theirs. Since NIST's guidelines of June 2017, security questions are no longer an acceptable authenticator; for a password reset, its published answers say, they "would leave the account vulnerable to takeover". By then the answers were loot: they figured in the celebrity iCloud thefts of August 2014 and the IRS breach of May 2015, and the theft Yahoo disclosed in September 2016 took them, some unencrypted.
The month's other mechanisms aged differently. Chrome's design held: at Pwn2Own in March 2010 it was the only browser left standing, and in March 2026 StatCounter estimated its share of browsing on personal computers worldwide at 75 per cent. Open Wi-Fi turned from a hiding place into a hunting ground when Firesheep listed strangers' sessions in October 2010. The Chembur network was still being argued over eighteen years on. In a bail appeal decided on 7 July 2026, the defence told the Delhi High Court that the firm's own witness had learnt of the alleged intrusion from the police and the media and could not recall his IP address; the court found a prima facie case, refused bail and repeated the Supreme Court's order to finish the trial within eight months.