Outside the Beltway

St. Louis Cardinals Officials Investigated For Hacking The Houston Astros

Cardinals executives were doing a little more than just stealing signs, apparently.

Doug Mataconis · Wednesday, June 17, 2015 · 11 comments

The F.B.I. is investigating the St. Louis Cardinals for apparently hacking the computer network of the Houston Astros to obtain confidential player data:

WASHINGTON — The F.B.I. and Justice Department prosecutors are investigating whether front-office officials for the St. Louis Cardinals, one of the most successful teams in baseball over the past two decades, hacked into internal networks of a rival team to steal closely guarded information about player personnel.

Investigators have uncovered evidence that Cardinalsofficials broke into a network of the Houston Astros that housed special databases the team had built, according to law enforcement officials. Internal discussions about trades, proprietary statistics and scouting reports were compromised, the officials said.

The officials did not say which employees were the focus of the investigation or whether the team’s highest-ranking officials were aware of the hacking or authorized it. The investigation is being led by the F.B.I.’s Houston field office and has progressed to the point that subpoenas have been served on the Cardinals and Major League Baseball for electronic correspondence.

The attack would represent the first known case of corporate espionage in which a professional sports team hacked the network of another team. Illegal intrusions into companies’ networks have become commonplace, but it is generally conducted by hackers operating in foreign countries, like Russia and China, who steal large tranches of data or trade secrets for military equipment and electronics.

Major League Baseball “has been aware of and has fully cooperated with the federal investigation into the illegal breach of the Astros’ baseball operations database,” a spokesman for baseball’s commissioner, Rob Manfred, said in a written statement.

The Cardinals officials under investigation have not been put on leave, suspended or fired. The commissioner’s office is likely to wait until the conclusion of the government’s investigation to determine whether to take disciplinary action against the officials or the team.

“The St. Louis Cardinals are aware of the investigation into the security breach of the Houston Astros’ database,” the team said in a statement. “The team has fully cooperated with the investigation and will continue to do so. Given that this is an ongoing federal investigation, it is not appropriate for us to comment further.”

The case is a rare mark of ignominy for the Cardinals, one of the sport’s most revered and popular organizations. The team has the best record in baseball this season (42-21), regularly commands outsize television ratings and has reached the National League Championship Series nine times since 2000. The Cardinals, who last won the World Series in 2011, have 11 titles over all, second only to the Yankees.

Law enforcement officials believe the hacking was executed by vengeful front-office employees for the Cardinals hoping to wreak havoc on the work of Jeff Luhnow, the Astros’ general manager who had been a successful and polarizing executive with the Cardinals until 2011.

From 1994 to 2012, the Astros and the Cardinals were division rivals, in the National League. For a part of that time, Mr. Luhnow was a Cardinals executive, primarily handling scouting and player development. One of many innovative thinkers drawn to the sport by the “Moneyball” phenomenon, he was credited with building baseball’s best minor league system, as well as drafting several players who would become linchpins of the Cardinals’ 2011 World Series-winning team.

The Astros hired Mr. Luhnow as general manager in December 2011, and he quickly began applying his unconventional approach to running a baseball team. In an exploration of the team’s radical transformation,Bloomberg Business called it “a project unlike anything baseball has seen before.”

Under Mr. Luhnow, the Astros have accomplished a striking turnaround; they are in first place in the American League West division. But in 2013, before their revival at the major league level, their internal deliberations about statistics and players were compromised, law enforcement officials said.

On some level, of course, one might wonder why anyone employed by the St. Louis Cardinals, who currently have the best record in baseball, would be trying to garner intelligence of any kind from the Houston Astros. Yes, the Astros are currently leading their division, which isn’t something you see from Houston very often, but they aren’t even in the same league as St. Louis anymore. The two teams don’t even play each other other this season in interleague play. At the same time, though, the information that was contained in the database that was accessed contains information such as scouting reports, statistics, and internal evaluations about players around the league that are possible trade targets that would potentially be valuable to the Cardinalrs or any other team that was in the trade market. The fact that Luhnow’s database apparently includes not just evaluations of Major and Minor League players but also players at the College and even High School levels arguably makes it even more valuable to a potential thief since it would allow them to compete for talent they might not otherwise be aware of. Added into all of that, though,  there is a personal connection:

The answer appears to be Jeff Luhnow.

Luhnow was part of the wave of “Moneyball”-style executives who revolutionized baseball front offices at the start of the century.

A Penn and Northwestern graduate who had worked in consulting, he joined the Cardinals in 2003 despite having no baseball experience. After facing some initial skepticism, he started hitting home runs. He oversaw the team’s draft beginning in 2005 and showed an uncanny knack for finding talent.

Among the eventual major leaguers he drafted in his first three years were Colby Rasmus, Allen Craig, Daniel Descalso, Jaime Garcia, Jon Jay, Luke Gregerson and Chris Perez. From 2005 through 2007 St. Louis drafted 24 players who became major leaguers by 2011, more than any other team.

In the years that followed, he drafted Matt Carpenter, Trevor Rosenthal, Matt Adams, Lance Lynn, Kolten Wong and many others.

Luhnow’s international signings included pitchers Fernando Salas of Mexico and Eduardo Sanchez of Venezuela. The Cardinals played in three World Series and won two in his years there.

But in December 2011 he left the Cards for a promotion to general manager of the Astros, at that time a division rival and the worst team in baseball. Luhnow took along Sig Mejdal, a former NASA engineer; his title is director for decision sciences. Mejdal applied work he had done at NASA on astronauts’ decision making to improve the team’s drafting.

It is not known for sure what motivated the hacking that is alleged. Anger over Luhnow’s departure, or lingering bitterness over his time in St. Louis, where he was a polarizing figure, may have been a cause. Law enforcement officials say that the Cardinals could have suspected that Luhnow had taken proprietary information with him to Houston.

But the goal might also have been access to Ground Control, a vast database of Luhnow’s unquestioned baseball knowledge.

So what we appear to be looking at here could be a combination of revenge on the part of some Cardinals executives against Luhnow either for the way things operated while he went to St. Louis or the fact that he left and took his knowledge with him to Houston. The fact that the Cardinals executives who did this were apparently able to break into the network because neither Luhnow and those who came with him to Houston used the same network passwords that they did in St. Louis likely made this whole thing a lot easier, and it raises yet again the issue that the weakest link in network security is, usually, the end user. If this is, as some have suggested, a matter of revenge against Lunhow that suggests that this wasn’t a team-wide effort on the behalf of the Cardinals. If there’s evidence that the effort went beyond this handful of guys, though, then this could be a big problem for a franchise that has historically had a fairly decent reputation in the sports world.

Over at ESPN, legal analyst Lester Munson seems confused as to why what the Cardinals are being accused of would be a crime:

Q: Is it actually a crime to hack into the data and the files of a Major League Baseball team?

A: It’s certainly ethically questionable, but whether it is a crime is far less certain. It appears that Cardinals’ front office officials succeeded in obtaining information on Astros prospects and trade strategies. But for a federal prosecutor to charge Cardinals executives with “unauthorized access” to computer information or theft of proprietary, non-public information, the prosecutor must be able to show that the information was the work product of significant efforts by Astros officials and, more importantly, was not available elsewhere.

In addition to showing that the stolen information was not otherwise available, the prosecutor must be able to show that Cardinals executives knew they were committing a crime. If the Cardinals’ activity was just a dirty trick or an attempt at getting even with a former colleague, the hacking might not qualify as a crime. The prosecutors will face a difficult decision when they decide whether to file charges or, instead, decline to prosecute. It is easy to envision a federal prosecutor deciding that there are more important cases to prosecute.

Orin Kerr at The Volokh Conspiracy does an excellent job of pointing out to Munson that what the Cardinals are accused of doing here, if proven in court, would be a violation of at least two Federal statutes that make it crime to access a computer or computer network without permission and provides that the offense becomes a felony if, among other things, was the committed for personal or commercial advantage or if the value of the material accessed exceeds $5,000. Based on the descriptions of what is being investigated, it seems fairly obvious that one or more of this enhancements that brings the offense from a misdomenor to a felony could potentially apply here. Additionally, the Astros and Major League Baseball may have private civil causes of actions against the Cardinals organization or individual executives and, of course, the MLB itself would have its own disciplinary actions against executives or even the entire team if the evidence warrants it. Some commentators have compared this to the Patriots “Spygate” scandal, but the difference is that what the Patriots did wasn’t something that could potentially land people in Federal prison. This has the potential to be a fairly serious story that will resonate well beyond the sports pages and a segment or two on ESPN.