The Cardinal Nation blog

Brian Walton's news and commentary on the St. Louis Cardinals (TM) and their minor league system

The Comprehensive Cardinals Correa Chronicle on Houston Hacking

Because I have followed the St. Louis Cardinals – Chris Correa – Houston Astros hacking story closely for so long, I decided to distill my notes into a detailed timetable. Given the understandable fatigue that many have for the subject, what follows will not be for everyone.

At least, this detail may be useful as a future reference, as it brings together information from a wide variety of publicly available articles and documents as sourcing material. However, I decided to stop short of footnoting each line item, of which there are 47.

 

2009: Chris Correa is hired by the Cardinals as a quantitative analyst.

11/17/11: MLB announces the approval of the sale of the Houston Astros to businessman Jim Crane and the 2013 move of the club from the National League Central (same division as St. Louis) to the American League West Division.

12/7/11: Cardinals VP Jeff Luhnow is named Astros general manager. A number of Cardinals front office and uniformed personnel follow him to Houston, including Sig Mejdal, named Director of Decision Sciences. Correa was not among them.

12/21/11: An Astros employee illegally accessed a Cardinals server, according to a January 2017 allegation made by Correa.

Correa-200-7472Jan 2012: Allegedly using the password turned in by Mejdal along with his computer when leaving St. Louis, Correa begins accessing Mejdal’s Astros personal email account, and continues to do so for 2 ½ years, according to court records. When Mejdal moves to Houston, he creates a new password that is “almost identical” to the one he used with St. Louis, according to court documents. In these documents, Mejdal is called a “rival” of Correa’s.

2012: Correa is promoted to Manager of Baseball Development.

3/24/13: First date in which court documents indicate Correa accessed Houston’s Ground Control system using Mejdal’s account information. (Count 1 of 5)

4/3/13: Correa accesses the Astros’ prospective player draft list, ranked in preferential order, along with reports from three Houston talent evaluators. He also reviews Astros notes and medical records on Marco Gonzales, who the Cardinals took in the first round two months later, and another prospective draftee.

4/30/13: Correa reviews Astros scouting reports and suggested bonuses for another potential draftee.

6/5/13: Correa returns to the Astros’ ranked list of draft prospects and views the Astros’ page for the Cardinals, their main scouting page and notes relating to trade discussions with the Cardinals. The draft begins the next day.

6/8/13: On day 3 of the draft, Correa again accesses the Astros’ rankings of available players and detailed reports on two players. (Count 2 of 5)

7/31/13: Correa accesses Astros’ internal trade notes at least 14 times up to the July 31 non-waiver trade deadline. (Count 3 of 5)

Nov-Dec 2013.  Correa again accesses Astros’ internal trade notes before the annual MLB General Managers’ Meetings and Winter Meetings.

Late 2013: Correa is promoted to the director level, as Director of Baseball Development.

3/9/14: The Houston Chronicle publishes an article about the Astros’ Ground Control system, including an image of the site’s URL.

3/10/14: The Astros change the site’s URL, re-set all user passwords and send email notices to affected users. Correa accesses Mejdal’s email account to learn this new information (Count 4 of 5) and re-enters the system using Luhnow’s credentials. There, he views 118 pages of potential draftee rankings, scouting evaluations, analytics reports on top available pitchers and Houston’s evolving draft board for that June. (Count 5 of 5)

3/11/14: Correa accesses the task page of the Astros analytics department, which lists their current projects.

3/27/14: Correa accesses the system to review Astros trade discussions with other teams and reports on development of players currently in Houston’s minor leagues.

3/30/14: 10 months of Astros internal emails outlining trade discussions, from June 2013 through March 2014, are anonymously placed onto the sites Anonbin.com and Pastebin.com. It is later determined Correa is the source.

May 2014: The Astros become aware of unauthorized access into their systems and notify MLB security, who inform the FBI.

6/26/14: A very positive article about the Astros and their analytic prowess, praising Luhnow and Mejdal, was published by Sports Illustrated. Investigators believe Correa was jealous.

6/27/14: Correa unsuccessfully tries to access Ground Control representing five different Astros employees.

6/28/14: This is the last date in which court documents indicate there is proof that Correa accessed Mejdal’s email account. Correa is looking for passwords so he can re-enter Ground Control. He finds two minor league players’ information, but they have only limited access. Correa tries 23 password combinations of 10 different Astros employees in his attempts to get in.

6/30/14: Deadspin breaks the story of the trade discussions that had been posted on Anonbin and Pastebin on March 30, receiving wide national attention. The embarrassed Astros apologize to the other 29 MLB teams. Later, the prosecutor, assistant U.S. attorney Michael Chu, wrote in Correa’s sentencing report his belief that “it must have been Correa” who leaked this information to Deadspin, though it is unclear whether he was charged for these specific actions.

Correia-200-504512/2/14: Correa is promoted to Director of Scouting, with his responsibilities including amateur scouting and the draft.

Late 2014-Early 2015: Federal investigators trace access to Astros systems to a residence in Florida used by Cardinals employees during spring training.

Feb 2015: FBI agents visit Cardinals offices at Busch Stadium, seizing computers and other records. The club is advised by its legal counsel to not initiate an internal investigation at that time, per June 2015 comments by Chairman Bill DeWitt, Jr.

May/June 2015: Correa offers to meet with MLB Commissioner Rob Manfred on two different occasions in May and June, but receives no response, according to a written statement released by Correa in January 2017.

6/8/15-6/10/15: Correa leads the Cardinals’ efforts in the 2015 First-Year Player Draft, his only draft as Scouting Director.

6/16/15: The New York Times publishes an article which is the first public indication that the Cardinals are under federal investigation.

6/16/15: Manfred says that because MLB did not have subpoena power for information and witnesses, its investigation would rely on the federal findings.

6/17/15: An attorney hired by the Cardinals asserts that “upper management”, including DeWitt Jr. and Senior VP and General Manager John Mozeliak, was not involved. Both executives affirm they were unaware until contacted by federal investigators early in the year.

6/18/15: DeWitt Jr. blames “roguish behavior” and says the team is conducting its own investigation. He explains the club did not begin its internal probe initially because they were advised by their legal counsel to avoid actions that might upset the federal investigation. Several Cardinals employees have retained private legal representation.

Late June: Correa is active in post-draft signing activity, but is soon suspended by the Cardinals. This decision is not made public until his firing.

7/2/15: Correa is fired by the Cardinals, the first individual publicly linked to the case. His lawyer insists that Correa had done nothing wrong, asserting the investigation’s focus should instead be Houston’s alleged misappropriation of Cardinals’ intellectual property.

Late 2015: During what court documents call “extended negotiations” in which “both made concessions over several months”, a plea agreement was developed which includes a “more restrained sentence”. Among the potential charges not pursued against Correa is aggravated identity theft.

1/8/16: In Federal District Court in Houston, Correa signs the plea agreement, accepting guilt for five counts of unauthorized access to a protected computer. They are listed above as (Count x of 5). Correa admits that he had masked his identity, his location and the type of device that he used. The total intended loss for all of the intrusions was set at approximately $1.7 million.

Under oath, Correa states he told “colleagues” with the Cardinals that he had found Cardinals information in the Astros’ system. No specific time frame is mentioned. Outside of court, Astros attorney Giles Kibbe makes a similar statement, saying that Correa had reported his findings to the Cardinals, who chose not to pursue the matter. That other Cardinals employees had been told by Correa that he believed Cardinals information was being used by the Astros is later corroborated by DeWitt Jr. in a radio interview in January 2017. These “colleagues” were never identified publicly and no one (other than Correa) on either club was charged with any crime.

4/27/16: Correa’s subpoena to obtain documents from the Astros, based on his statement that he had intruded in Houston’s systems while looking for information taken from the Cardinals, is denied by U.S. District Judge Lynn Hughes.

July/Aug 2016: MLB’s Department of Investigations makes repeated requests to Correa, asking him for cooperation, per a January 2017 statement by Manfred.

7/18/16: After several scheduling delays from the original April date, Correa is sentenced by Hughes to a 46-month prison sentence followed by two years of supervised release, and a fine of $279,037. Each of the five counts could have carried a maximum possible sentence of five years in prison and a possible $250,000 fine. Prosecutors had previously agreed the sentences would run concurrently.

7/21/16: Manfred warns Correa he will be placed on MLB’s permanently ineligible list if he does not cooperate with the MLB investigation.

8/23/16: Correa’s counsel informs MLB that Correa will neither provide any information, nor answer questions.

8/30/16: Correa reports to a Federal penitentiary in Maryland.

1/25/17: Three key case documents are unsealed by Hughes, enabling MLB to complete its investigation. These documents provide significant details in the case which had not been made public to that point. (Many of these details are included in the prior timeline.) Points include reference to Correa having made 48 intrusions into five different Astros employees accounts over 16 months and the fact that the Astros had changed email systems, making it impossible to know how many times Correa accessed Mejdal’s account.

1/30/17: Manfred announces his findings, both to address the Astros’ claims for compensation from the Cardinals and to sanction the Cardinals and Correa for the latter’s illegal activities. Manfred orders the Cardinals to pay $2 million in damages to the Astros, and surrender to Houston their two top remaining picks in the 2017 amateur draft, #56 and #75 overall. Correa receives a lifetime ban from baseball for his unwillingness to cooperate with the MLB investigation.

1/31/17: Correa releases a statement via family members, reiterating his claim that the Astros accessed proprietary Cardinals information and accuses MLB of applying sanctions “arbitrarily”. He asserts the Cardinals were not the ones that “benefited from unauthorized access”. Correa wrote that he offered to meet twice with Manfred – in May and June 2015 – but was ignored. (He does not explain why his stance regarding cooperation had reversed in 2016, but it seems clear the key difference is that he had already accepted a guilty plea by then.)

1/31/17: Later that same day, Manfred reacted in writing, explaining why MLB did not want to interview witnesses, including Correa, in 2015. Manfred also provided the details from July and August 2016 noted above, outlining Correa’s refusal to cooperate with the MLB investigation, which led to his permanent ban from baseball.

Follow me on Twitter.

5 Responses to “The Comprehensive Cardinals Correa Chronicle on Houston Hacking”

  1. blingboy says:

    I am sure we will hear another perspective once Correa is released, and probably after his period of supervised release. Of particular interest will be Correa’s claim that he found evidence of illegal use of proprietary info by the Astros and why the Cardinals chose not to pursue it. Obviously, to pursue it would have raised questions about what Cardinals higher ups knew and when they knew it. It seems pretty clear Correa was promoted at least once after making his findings known. That would be hard to spin. Better to let it slide. Or so they thought.

    • Brian Walton says:

      We know Correa told colleagues of his suspicions. We don’t know when, but it is reasonable to guess it was probably early on. We don’t know what evidence he shared, if any, in support. If he told others he was illegally accessing Houston’s systems, that would seem to be a problem. But if he stopped short of telling his co-workers he was breaking the law, then one can understand why the Cards probably decided it wasn’t worth the mess that would be caused by accusing the Astros of something they probably could not prove.

      When all is said and done, how could anyone prove exactly what Correa told his colleagues? If Correa said he told them “black” and they said he told them “white”, who is telling the truth? It is just “he said, she said”. Unless Correa and his colleagues agreed on what he told them, and it included news of illegal activity, there is no reason to continue on that path.

      Consider this. It is the second half of 2015. The Feds have the evidence to convict Correa and confront him with it. One has to assume he is not going to withhold any shred of information that can help him. That would certainly include all proof he gathered over the prior 2 1/2 years on the Astros’ alleged illegal actions. The only item he shared with the public was one access into St. Louis’ system two weeks after Luhnow quit. But let’s assume he had more to show the FBI. I am not a legal expert as to know whether the Feds were allowed to act on his evidence gathered illegally and if so, how deep they dug. But we do know they made the decision to not charge any Astros with any crimes.

      Then, in April 2016, Correa asked the court for access to emails of various Astros employees to try to support his assertion they took Cardinals information. His subpoena request was denied.

      Either Correa did not have enough substance or the Feds (including investigators, prosecutors and judge) refused to act on allowable evidence of Astros employees’ crimes. I know which of the two I think is more likely.

      P.S. Further, there was no reason for MLB to investigate the Astros. The Cardinals did not lodge a complaint against them and the Feds did not find any Astros employees chargeable for any illegal activity. By the time MLB was ready to talk with Correa, he refused. They would have had nothing to go on.

  2. blingboy says:

    Brian, I did want to mention that your headline writing skills are really coming around.

Leave a Reply

You must be logged in to post a comment.