On Thursday Derrick Goold and Robert Patrick of the St. Louis Post-Dispatch reported that the St. Louis Cardinals fired scouting director Chris Correa less than a month after he had led the organization in the 2015 MLB Draft. It turns out that the Cardinals' internal investigation uncovered what the F.B.I.'s reportedly could not: the identity of a hacker. Correa confessed to having gained unauthorized access to the Houston Astros' proprietary database. Against the backdrop of previous reporting by the New York Times, Wall Street Journal, and Houston Chronicle, the revelation raises as many questions as answers. Before we delve into things, you should read Patrick and Goold's article in its entirety.
Correa, Then and Now
The Cardinals' firing of their scouting director would be a big deal no matter what. In the midst of an F.B.I. investigation into whether St. Louis front office employees committed corporate espionage by fraudulently gaining access to the Astros' proprietary database and stealing information, it's explosive. But the timing of events is important to keep in mind in situations such as these.
Correa held the position of scouting director at the time of his discharge. In that job, he reported directly to general manager John Mozeliak. However, Correa was not the scouting director until late last year when St. Louis promoted him after Dan Kantrovitz, who had held the job from 2011 through November 2014, left the organization to become assistant general manager with the Oakland A's.
Correa's promotion to the job of scouting director was the last step in a several-years climb up the front office ranks. Using the pre-Draft profile that Jenifer Langosch wrote at MLB.com (which I recommend reading), the Goold and Patrick story on Correa's firing, and Goold's Post-Dispatch article from the time of Correa's promotion to director of scouting, I put together a rough timeline of the jobs Correa held in the front office. The time periods were difficult to nail down exactly.
- Data analyst, 2009-12
- Manager of baseball development, 2012-13
- Director of baseball development, 2013-14
- Scouting director, 2014-15
The Houston Chronicle has reported that there were three breaches of the Houston database, one each in 2012, 2013, and 2014. If their anonymous sources are correct, none of them occurred when Correa was the scouting director. At least two and possibly all three of the hacks occurred when Correa was a member of management. Two may have taken place when Correa was the director of baseball development. Based on current information, we do not know the dates upon which Correa accessed the Houston database.
Player Valuation, Databases, and Motive
Correa got his start working directly under Jeff Luhnow, who later left the organization to become the Houston GM and, as Craig broke down, took St. Louis front office employees with him. From the start of his time working for the Cardinals, Correa was involved in data. Goold and Patrick write:
Among Correa’s early duties was taking statistics from college baseball and merging them with the scouting evaluations the Cardinals had in a system that was called STOUT. Later, Correa used his background in psychology and research to help the Cardinals identify and measure leadership qualities, how a player handled failure, and other traits associated with high-level success.
Langosch's pre-Draft profile of Correa, she reports:
From there, the climb was swift. After three years as a quantitative analyst in the nascent baseball development group, Correa took on a leadership role within the department. He helped develop analytical models that the Cards used to guide both Draft and player personnel decisions.
When the Cardinals promoted Correa to scouting director last winter, Goold shared:
He was promoted to manager of baseball development in 2012 and named director of the department last season, a role in which he provided statistical insights to all areas of Cardinals baseball operations.
So it seems that Correa possessed a unique knowledge of the way the Cardinals valued ballplayers and the database in which their information was stored. Remember that Michael Schmidt's New York Times article revealed the following law-enforcement theory of the case:
The intrusion did not appear to be sophisticated, the law enforcement officials said. When Mr. Luhnow was with the Cardinals, the team built a computer network, called Redbird, to house all of its baseball operations information — including scouting reports and player information. After he left to join the Astros, and took some front-office personnel with him from the Cardinals, Houston created a similar program known as Ground Control.
It contained the Astros’ "collective baseball knowledge," according to a Bloomberg Business article published last year. The program took a series of variables and weighted them "according to the values determined by the team’s statisticians, physicist, doctors, scouts and coaches," the article said.
Investigators believe that Cardinals personnel, concerned that Mr. Luhnow had taken their idea and proprietary baseball information to the Astros, examined a master list of passwords used by Mr. Luhnow and the other officials when they worked for the Cardinals. The Cardinals employees are believed to have used those passwords to gain access to the Astros’ network, law enforcement officials said.
This portion of Schmidt's story squares with Patrick and Goold's report on the information the Cardinals coerced out of Correa:
The source said that Correa’s involvement in the hacking began in 2013, in an attempt to determine whether Luhnow or any other former Cardinals employees took proprietary data to the Astros.
Correa’s suspicions were aroused in part by a résumé in which a job seeker claimed expertise that Correa believed could have come only from working with Cardinals data, the source said.
He used an old password from a former Cardinals employee working for the Astros to access the Houston database "a few" times but did not download data, the source said. The source claims Correa located some data on the website, but did not report it to his bosses because the information was outdated and unreliable without being redone.
Thus, it appears that Correa believed an individual or individuals who left the Cardinals front office for Houston must have stolen intellectual property when they did so and used it when developing a database for the Astros. He gained access to the Houston database using a list of old passwords and found information that supported his suspicions, though it was old and outdated. Because it was obsolete, Correa did not report the theft up the St. Louis chain-of-command. This is somewhat in line with Luhnow's statement to Sports Illustrated after the Times story hit, that any information from another team would quickly become obsolete and be of little use to the person who took it.
Is there another hacker or two?
Per Goold and Patrick, Correa denies taking any information from the Houston database, let alone subsequently posting it online for the world to see. Perhaps Correa's denial is a lie and he did in fact steal the Astros' internal information and post it online as an act of vengeance against Luhnow and his underlings for stealing information from the Cardinals. But if Correa is telling the truth, this story is far from over. The 2014 leak of internal Houston trade documentation, Schmidt's reporting in the Times, and the information in Patrick and Goold's article combine to indicate that Correa is not the only individual who gained access to Houston's database. At least one other person did so, stole information, and posted it online. Only time will tell whether the Cardinals' internal investigation or the F.B.I.'s criminal inquiry is able to identify any additional culprits.
Did Astros personnel steal intellectual property from the Cardinals?
Another revelation in Goold and Patrick's article is the fact that the Astros may not have clean hands in this scandal. I've avoided diving too deeply into this angle previously because no matter how unethically any Houston personnel behaved, it does not justify a Cardinals employee responding in kind or committing a criminal act. Nonetheless, it appears more likely now than ever that Astros personnel stole intellectual property of the Cardinals, which adds another dimension to this scandal.
Correa claims that he had suspicions about Houston personnel stealing from the Cardinals so he conducted a rogue investigation unbeknownst to his superiors. In doing so, he found data that proved his suspicions correct. Correa's attorney issued the following statement on Thursday, as reported by Patrick and Goold:
"Mr. Correa denies any illegal conduct. The relevant inquiry should be what information did former St. Louis Cardinals employees steal from the St. Louis Cardinals organization prior to joining the Houston Astros, and who in the Houston Astros organization authorized, consented to, or benefited from that roguish behavior?"
This makes the situation all the juicier and the story potentially much larger. If Luhnow or an employee or employees that he hired away from St. Louis stole the Cardinals' proprietary information—whether it be regarding players or something else—it would likely violate contracts they had with the Cardinals. It is likely not a criminal act per se, but it nonetheless demands an inquiry. If the Astros stole from the Cardinals, the perpetrators should be punished. Will Houston ownership respond in the way that St. Louis chairman Bill DeWitt Jr. did and conduct an internal inquiry? Will MLB investigate the Astros for stealing the Cardinals' information? Both should. We'll see if either does.
Correction: The original version of this post attributed the Post-Dispatch article to only Goold. It has been corrected to reflect Patrick's reporting on the story.
FanDuel
SBN and FanDuel have entered into an exclusive partnership regarding daily fantasy baseball. Wacha at home against the Padres. Play FanDuel here.