After pleading guilty to five counts of unauthorized access to a protected computer in January, former St. Louis Cardinal director of baseball development Christopher Correa was sentenced to 46 months in jail in federal court and ordered to pay $279,038 in restitution yesterday. The events in question took place during 2013 and 2014, the year Correa was promoted to director of baseball operations. His charges carried a maximum jail sentence of 25 years. Correa’s sentence will begin in two to six weeks.
Prior to being sentence being announced, Correa read a letter in open court stating that he was “overwhelmed with remorse and regret for my actions.” Correa’s letter continued:
[pullquote align=”full” cite=”” link=”” color=”” class=”” size=””]“I violated my values and it was wrong … I behaved shamefully. The whole episode represents the worst thing I’ve done in my life by far.”[/pullquote]
Correa admitted to using the accounts of three Houston Astros employees in order to gain access into the Astros scouting database (called Ground Control). Correa claims that he originally gained access to the Astros’ database on suspicion that they were stealing information from the Cardinals:
Although not confirmed, one of the Astros employees may have been General Manager Jeff Luhnow, who left the Cardinals to become the Astros’ GM in 2011. Once in the database, Correa improperly downloaded a file of the Astros’ scouting list, viewed trade discussion notes and documents related to potential draft pick bonus details. Astros’ General Counsel Giles Kibbe stated that Correa accessed the Astros database 60 different times on 35 different days.
Correa was able to gain access to the database by guessing the Astros’ employees password. He used software to mask his identity, location, and the device he was using. Court documents described Correa’s “illegal access to the Astros’ computers” as follows:
“Correa illegally accessed the Astros’ computers in the following way: In December 2011, as Victim A [Luhnow] prepared to leave the St. Louis Cardinals and join the Houston Astros, he was directed to turn over his Cardinals-owned laptop to Correa – along with the laptop’s password. When Victim A joined the Astros, he re-used a similar (albeit obscure) password for his Astros’ email and Ground Control accounts. No later than March 2013, Correa began accessing Victim A’s Ground Control and Astros’ email accounts using this variation of the password to Victim A’s Cardinals laptop.”
Here’s how Correa was able to guess the password:
So who was the “scrawny” player? It was widely rumored to be former Cardinals infielder David Eckstein, although he had different ideas:
I guess Eckstein123 was NOT just enough… #thisisnotthepasswordyouarelookingfor
— David Eckstein (@DavidEckstein22) January 23, 2016
The Judge’s sentence, although not bound by any sentencing guidelines, took into account various factors including criminal history, level of sophistication, and amount of monetary damages. Prosecutors set the amount of damages at $1.7 million, which created a non-binding guideline of 36 to 48 months. Here is how they came to that valuation:
Luhnow has repeatedly denied that he or any other former Cardinals employees brought proprietary information with them to the Astros. However, Correa testified that he did find evidence of Cardinals information in the Astros’ database:
The Computer Fraud and Abuse Act (which contains the law allegedly broken here) is primarily a criminal statute, however, it does contain a civil cause of action, which could potentially open the door for the Astros to file a lawsuit seeking monetary damages against Correa. In order to succeed, they would have to prove that they suffered greater than $5,000 in damage caused by Correa by unauthorized access to protected computers. Practically speaking, it is unlikely that the Astros would go after Correa due to his uncertain financial standing.
Potential MLB Discipline
After the sentence was announced, the MLB issued the following statement:
“Now that the criminal process has been completed, Commissioner Manfred has asked the Department of Investigations to conduct a complete investigation of the facts in this matter, including requesting information from the appropriate law enforcement authorities. The Commissioner hopes that the investigation can be completed promptly to put him in a position to take appropriate action.”
The Cardinals also released a statement shortly after the sentencing stating that they “intend to fully cooperate with the commissioner’s office in connection with its investigation…” Under the MLB Constitution, Commissioner Rob Manfred has broad powers to discipline teams under the “best interest of the national game of baseball” provision. Here is the relevant language:
Manfred also has sweeping power regarding the type of discipline he can issue if he finds the Cardinals in violation of the “best interest of the national game of baseball” provision:
In the past, the MLB has hired outside groups to conduct investigations. The MLB press release (above) seems to indicate that will not be the case here and that the MLB’s internal Department of Investigations will handle the case. There is no timetable for when Manfred could issue discipline.