Former St. Louis Cardinals executive Christopher Correa was sentenced Monday to 46 months in prison for illegal incursions into the Astros’ computer database, wrapping up a case of sports-related cybercrime that a federal judge summed up as plain, old-fashioned theft.
Correa, 35, will report within two to six weeks to begin his sentence imposed by U.S. District Judge Lynn Hughes, who accepted the government’s recommended sentence in the wake of Correa’s guilty plea in January to five counts of illegal access to a protected computer.
Now the case moves into the hands of Major League Baseball, where commissioner Rob Manfred will decide if the Cardinals will face sanctions because of Correa’s actions in 2013 and 2014.
Manfred also might be asked to consider a heretofore undisclosed element: that Correa intruded into the Astros’ system 60 times on 35 days, far more the five reported cases to which he pleaded guilty, according to an Astros official.
Correa, who was the Cardinals’ director of baseball development, was alternately counseled and lectured by Hughes before a crowded courtroom that included several members of his family.
As Correa read a letter apologizing to the court, the Astros and his family, Hughes told him to face his family and “look at them when you say that. Don’t tell me.”
“I apologize to my family for the pain and suffering I’ve caused,” Correa said. “I will work hard to regain your trust. I stand before you a different person than the one” who committed the crime.
But even as Correa admitted his wrongdoing, Hughes interjected his own descriptions of the defendant’s actions: “intentionally, over a long period of time, stupidly.”
Hughes also addressed Correa’s contention at the January plea hearing that he accessed the Astros’ player database because he suspected the Astros possessed information proprietary to the Cardinals.
“There was discussion about what a bunch of awful people the Astros are, and all that well could be true,” Hughes said. “But you’re back to middle school when the teacher said, ‘Did you throw that eraser?’ and you said, ‘Bobby did, too.’
“I hope it didn’t work then, because it’s not going to work now.”
In his letter read to the court, Correa was contrite and apologetic and did not address his previous allegations about the Astros.
“I broke the law. I violated my values, and it was wrong,” he said. “I behaved shamefully. This episode represents the worst thing I have done in my life by far … and I am overwhelmed with remorse and regret.”
Hughes said the victim in this case is “trust in American society” and compared Correa to one who falsifies medical records or uses cybercrime to clean out bank accounts.
He said cybercrime “makes it harder for honest people to go about their daily lives, and I’m not talking about people like (Astros owner Jim Crane) and the big shots. A lot of peoples’ lives are adversely affected by the additional cost it takes to defend themselves against people like you.”
Hughes told Correa to “make some sound choices” and avoid jealousy, anger, lust, envy – “all those things that are why people do things they shouldn’t do. Get those under control.”
Houston attorney and former prosecutor Philip Hilder, who predicted Correa would face as much as four years in prison, based on federal sentencing guidelines, said the actual 46-month term was higher than he expected for a first-time offender.
“It is within the guideline range but a bit higher than anticipated for a first-time offender,” Hilder said. “Usually, a defendant in a similar situation would receive a sentence on the lower end of the range, but here a bit more time was given in order to use this as a teachable anti-hacking lesson that will act as a deterrence to others. This being a high-profile case worked against Mr. Correa.”
U.S. Attorney Kenneth Magidson said he was pleased with length of the sentence. Correa could have been sentenced to a maximum of five years in prison on each count, although prosecutors agreed in return for his guilty plea that sentences would be served concurrently.
“This is a serious federal crime,” Magidson said. “It involves computer crime, cybercrime. We in the U.S. Attorney’s Office look to all crimes that are being committed by computers to gain an unfair advantage. … This is a very serious offense, and obviously, the court saw it as well.”
Correa’s attorney, David Adler of Houston, had no comment on the sentence.
Astros general counsel Giles Kibbe, who also attended the hearing, described Monday as a “sad day for baseball” and emphasized that the Astros were the victims of Correa’s unauthorized access into a computer database that included scouting reports and other information.
Referring to Correa’s statements in January, he added, “I don’t know what Mr. Correa saw in our system or what he thinks he saw in our system, but what I can tell you is that the Astros were not using Cardinals proprietary information.”
Kibbe, for the first time, also acknowledged that Correa’s intrusions into the Astros’ computer system were more frequent than the instances set out in the information to which he pleaded guilty – 60 intrusions over 35 days, he said, from March 2013 through June 2014.
In addition to prison time, Correa also faces two years of supervised release and a fine of about $279,000.