Cardinals identify a fall guy

The latest Hacked-Stros news.

The St. Louis Cardinals have terminated the contract of their scouting director, Chris Correa, as investigations continue into alleged hacking of a Houston Astros database.

A Cardinals’ lawyer, James G. Martin, confirmed the move Thursday, saying Correa already had been on an “imposed leave of absence.” Martin declined to comment on the reason. And he would not say whether any employee has admitted hacking the Astros, citing ongoing investigations by the club, Major League Baseball and the FBI.

Correa declined to comment.

In a prepared statement, Correa’s lawyer, Nicholas Williams, wrote: “Mr. Correa denies any illegal conduct. The relevant inquiry should be what information did former St. Louis Cardinals employees steal from the St. Louis Cardinals organization prior to joining the Houston Astros, and who in the Houston Astros organization authorized, consented to, or benefited from that roguish behavior?”

Giles Kibbe, the attorney for the Astros, reaffirmed an earlier denial that neither the Houston organization nor any previous Cardinals employees now with the Astros had taken anything proprietary from the Cardinals.

Astros general manager Jeff Luhnow, who as head of the Cardinals’ analytics department had helped build the database used here to evaluate players, has said that everything he and others did in Houston was accomplished “from scratch.”

“We stand by all of our previous comments,” Kibbe said. “We’re looking forward to the conclusion of the FBI’s investigation. I stand by all that Jeff has said on this matter.”

Correa has admitted hacking into a Houston database but only to determine whether the Astros had stolen proprietary data, according to a source with knowledge of the investigation.

Correa did not leak any Astros data and is not responsible for additional hacks that the FBI has alleged occurred, said the source.

[…]

The source said that Correa’s involvement in the hacking began in 2013, in an attempt to determine whether Luhnow or any other former Cardinals employees took proprietary data to the Astros.

Correa’s suspicions were aroused in part by a résumé in which a job seeker claimed expertise that Correa believed could have come only from working with Cardinals data, the source said.

He used an old password from a former Cardinals employee working for the Astros to access the Houston database “a few” times but did not download data, the source said. The source claims Correa located some data on the website, but did not report it to his bosses because the information was outdated and unreliable without being redone.

The source said that others must have accessed Houston’s database if federal investigators’ claims about the number of hacking attempts are correct.

See here and here for the background. The counter-charges are interesting and I suppose could be a potential line of defense in the event this ever goes to a courtroom in some fashion. Whether it might mitigate any future punishment by MLB is another matter. The Chron story adds a bit more detail.

Giles Kibbe, the Astros’ general counsel, said in an e-mail, “We stand by all of our previous comments. We look forward to the FBI concluding their investigation.”

Major League Baseball, similarly, plans to await the conclusion of the FBI’s investigation, a person familiar with the league’s thinking said. A league spokesperson did not return a request for comment.

The FBI has not commented on details of its investigation but repeated a previously issued statement: “The FBI aggressively investigates all potential threats to public and private sector systems. Once our investigations are complete, we pursue all appropriate avenues to hold accountable those who pose a threat in cyberspace.”

[…]

Washington D.C.-based attorney Peter Toren, who handles cases involving intellectual property and commercial litigation, said that were a civil case to be filed, the Cardinals might be able to allege as a counterclaim against the Astros that Astros personnel improperly used information obtained in their time as employees for the Cardinals that could be classified as a trade secret.

Major League Baseball forbids clubs from suing each other, instead directing disputes to the commissioner as arbitrator. He can then award the Astros damages.

Luhnow and director of decision sciences Sig Mejdal worked with the Cardinals before joining the Astros, for whom they launched a database called “Ground Control.” The Cardinals had their own database, called “Red Bird Dog.”

“Ground Control” includes statistics, player evaluations and, at least up until last spring, logs of trade negotiations. Those logs were posted online and widely viewed at the website Deadspin last June, prompting an FBI investigation.

As first reported by The New York Times and confirmed by the Chronicle, the Cardinals had a master list of passwords, and at least one of the Astros’ departed executives did not alter his password well enough upon departure.

While Astros amateur scouting director Mike Elias also worked with the Cardinals in St. Louis and came over to the Astros with Luhnow, a person familiar with the investigation said Elias’ log-in credentials were not at issue. It’s unclear if the log-in information of both of Luhnow and Mejdal or just one of the two was in some way utilized in accessing Astros information.

Luhnow told Sports Illustrated he knows “about password hygiene and best practices” but did not directly address whether both he and his employees followed those practices to the necessary extent. Luhnow has turned down repeated requests for comment.

“I’m very aware of intellectual property and the agreements I signed,” Luhnow told Sports Illustrated. “I didn’t take anything, any proprietary information. Nor have we ever received any inquiries from anybody that even suggested that we had.”

Regarding the use of information obtained while working for another employer, Toren said, “That scenario is probably the most common type of trade secret case. One employee moves jobs and takes information with him to a new job for his use. The question then is: Is the employee generally allowed to take with him general knowledge?”

Toren said courts have ruled that employees can use general knowledge and skills gained on one job when they move to their next employer. However, he said lines can become blurry over “the type of information that really belongs to the employer that goes beyond … and really is specific knowledge.”

I still say having a master list of passwords is a terrible idea, whether Luhnow and the others who jumped from the Cards to the Stros practiced good password hygiene or not. I can’t wait to see the FBI report. Craig Calcaterra, who is not impressed by Correa’s attorney’s claims, has more.

Related Posts:

This entry was posted in Baseball and tagged , , , , , , , . Bookmark the permalink.