Chris Correa, the former St. Louis Cardinals scouting director who hacked the Houston Astros, used consumer software and a password based on the name of a “scrawny” player to achieve the hack, according to a court transcript released Saturday.
The transcript also explains how prosecutors and Correa’s attorney arrived at the $1.7 million loss to the Astros that will earn Correa extra time in prison.
Most of the details of Correa’s Jan. 8 guilty plea to five counts of unauthorized access to a protected computer emerged in statements by prosecutors and team and MLB officials after the hearing.
In court, he admitted accessing accounts of three Astros employees and viewing emails and volumes of information about aspiring major leaguers.
But because he waived indictment and pleaded guilty, the hearing was not listed on public schedules and few media were present to report the details.
In court, U.S. District Judge Lynn Hughes questioned Correa closely about the details of the plea, and whether he knew the ramifications of admitting to the crimes.
Near the beginning of the hearing, Hughes asks Correa to explain about the Astros’ proprietary database of draft information — dubbed “Ground Control.” Correa does.
Hughes then asks, “And do I correctly understand that you, while working for the Cardinals, went to the Astros cloud and got their data so you could see what they were interested in and what they were planning to do with players and draft picks current or past or whatever?”
Correa admits that he “trespassed repeatedly,” but then says that it wasn’t his original intention.
He said he originally “trespassed ... based on suspicions that they had misappropriated proprietary work from myself and my colleagues.”
“So you broke in their house to find out if they were stealing your stuff?” Hughes asked.
“Stupid, I know,” Correa responded.
Correa also referenced unspecified “colleagues” later, when he said he told them about finding information he claimed belonged to the Cardinals.
His attorney, David Adler, then pointed out, “He did not go to the FBI, which is obviously what he should have done.” Nor did he write a memo, he told Hughes.
Houston and its general manager, Jeff Luhnow, formerly of the Cardinals, have repeatedly denied any suggestion that the Astros were in possession of proprietary Cardinals information.
After Correa’s plea, Astros lawyer Giles Kibbe told reporters that the Cardinals had never raised any concerns about what Correa claimed to have seen in the Astros’ database.
Cardinals officials have denied Correa’s claims.
And Matthew Schelp, an attorney for four Cardinals employees who worked with Correa, said that he was “not aware of any such information being shared with ... the Cardinals employees I represent.”
During the discussion of the loss amount, Assistant U.S. Attorney Michael Chu, who handled the hearing, listed the formula used to arrive at $1.7 million.
“But since much of the data that we looked at focused on the 2013 draft, what we did was we took the number of players that he looked at by 200 and we divided that by the number of players that were eligible to be drafted that year, and we multiplied that times the scouting budget of the Astros that year. That comes to $1.7 million,” he said.
Hughes then asked a series of questions, culminating with his question about whether $1.7 million represented “how much they spent working up their own profiles of these players and their abilities and cost and that sort of thing?”
In federal court, where Correa will be sentenced April 11, financial loss is one of the factors driving the recommended prison time — an expected three to four years. In Correa’s case, the size of the loss made years of prison time much more likely.
Correa was able to hack the database because an Astros employee used a password there that was similar to what he’d used when he worked for the Cardinals. Correa gained access to that employee’s laptop when he turned it in, court documents show.
“It was based on the name of a player who was scrawny and who would not have been thought to succeed in the major leagues, but through effort and determination he succeeded anyway,” Chu said. The Astros employee “just liked that name, so he just kept on using that name over the years.”
Correa has been released on $20,000 bail.