Roughly 20 months ago, news got out the FBI and Justice Department were investigating the St. Louis Cardinals for hacking into the internal database of the Houston Astros. Former Cardinals scouting director Chris Correa was sentenced to 46 months in prison last July for what amounted to 12 counts of corporate espionage.
Monday afternoon, Major League Baseball announced it had concluded its investigation into the hacking scandal. The Cardinals have been hit with the following penalties from commissioner Rob Manfred:
- A $2 million payment to the Astros, which must be paid within 30 days.
- The Cardinals' two highest picks in the 2017 draft are being awarded to the Astros.
- Correa has been placed on the permanently ineligible list. He's banned from baseball.
The Cardinals surrendered their first-round pick to sign qualified free agent Dexter Fowler earlier this offseason, which means their second- and third-round picks will go to Houston. Those are the 56th and 75th overall selections.
"The Houston Astros support MLB's ruling and award of penalties," the team said in a statement. "This unprecedented award by the Commissioner's Office sends a clear message of the severity of these actions. Our staff has invested a great deal of time in support of the government, legal and league investigations and are pleased to have closure on this issue. We are looking forward to focusing our attention on the 2017 season and the game of baseball."
MLB says it found no evidence a Cardinals employee other than Correa hacked into the Astros' database, so no one else with the team has been disciplined. The club has been fined because ultimately, this happened on their watch. Manfred said he found Houston "suffered material harm" that is "not amenable to precise quantification."
This was an unprecedented case and it was unclear what kind of discipline MLB would hand down. It came down hard on the Cardinals and understandably so. This isn't a matter of gamesmanship. Correa wasn't stealing signs on the field. This is the executive of one private company hacking into another's information to gain an advantage. It's espionage.
"We respect the Commissioner's decision and appreciate that there is now a final resolution to this matter," Cardinals chairman and CEO Bill DeWitt said in a statement. "Commissioner Manfred's findings are fully consistent with our own investigation's conclusion that this activity was isolated to a single individual."
"This has been a long and challenging process for all of us, especially those within our baseball operations department," Cardinals GM John Mozeliak said. "We have learned a great deal along the way and we have taken additional steps to ensure that something like this doesn't ever happen again."
Over the weekend new details about the case emerged after a federal judge unsealed court documents. It turns out Correa's hacking was far more extensive than originally believed. David Barron and Jake Kaplan of the Houston Chronicle have the details:
According to the documents, portions of which remained redacted, Correa intruded into the Astros' "Ground Control" database 48 times and accessed the accounts of five Astros employees. For 2 1/2 years, beginning in January 2012, Correa had unfettered access to the e-mail account of Sig Mejdal, the Astros' director of decision sciences and a former Cardinals employee. Correa worked in St. Louis as an analyst under Mejdal, who came to Houston after the 2011 season with Astros general manager Jeff Luhnow, also a former Cardinals executive.
"(Correa) knew what projects the Astros' analytics department was researching, what concepts were promising and what ideas to avoid," said one of the documents, signed by Michael Chu, the assistant U.S. attorney who prosecuted the case against Correa. "He had access to everything that Sig Mejdal ... read and wrote."
Correa originally claimed he accessed Houston's database to see whether the Astros had stolen any information from the Cardinals. Considering he accessed the database 48 times over two and a half years, that goes beyond poking your head in to see whether some information had been stolen.
In addition to Mejdal, Correa also accessed the database using the accounts of Astros general manager Jeff Luhnow, analyst Colin Wyers and several minor-league players. He also attempted to use the accounts of former manager Bo Porter and pitching coach Brent Strom. Luhnow worked in the St. Louis front office from 2003-11.
"As we have previously stated, we did not have any of the Cardinals' proprietary information in Ground Control or our database," Astros general counsel Giles Kibbe told the Houston Chronicle. "What these documents confirm is that Mr. Correa was illegally accessing Ground Control in order to assist in evaluating players that the Cardinals wanted."
The court documents also show Correa accessed the Astros' database before the amateur draft to review the team's scouting reports and preference lists. He viewed the club's latest reports on left-hander Marco Gonzales, who the Cardinals selected with the 19th pick in the 2013 draft.
"Ultimately, Correa was not intruding to see if the Astros took any information -- rather, he was keenly focused on information that coincided with the work he was doing for the Cardinals," (prosecutor Michael) Chu concluded.
Chu wrote that even if Correa hid his activity from his Cardinals colleagues, "his access to the Astros' information was still invaluable. Before he proposed an idea, he could quietly check what another analytics-minded organization thought. He also could supplement his own ideas with the ideas of the Astros' analytics department because he knew what projects the Astros' analytics department was researching, what concepts they found promising, what ideas they had discarded."
Based on the unsealed court documents, Correa's hacking into the Astros' database was systematic over a period of more than two years, and that's why he was sentenced to prison.
