The Chris Moeller Archives

Aaron's Swartz and the St. Louis Cardinals

Under the Computer Fraud and Abuse Act, it is illegal to access a computer without authorization. Within the scope of this sprawling, unfocused law, you have committed a felony if you download too much information even from a website that you are authorized to use. If you violate one of the rules on that online service agreement that you agreed to in the pop-up box, but didn’t actually read, that's a felony. If you lie about your age on an internet dating site, you have probably committed a felony because you have violated the service agreement of that site.

CFAA was passed by Congress in 1986, which, alone, should tell you much of what you need to know about its relevance to today’s world of computer crime. The only thing that’s changed about it during the three decades of advanced technology since is the increased size of the punishments for violating it. Misdemeanors have become felonies. This is the law that Reddit co-founder and member of the Internet Hall of Fame, Aaron Swartz, broke when he downloaded academic journal articles from the MIT network. He faced a million dollars in fines, 35 years in prison, and asset forfeiture when he committed suicide in 2013.

It’s also the law that former St. Louis Cardinals baseball scouting director Chris Correa broke when he accessed the password-encrypted Houston Astros’ player scouting records in 2013 and 2014, and now has been sentenced to 46 months in prison. That’s a staggering penalty for an online “assault” that was not malicious and apparently did not seek to harm the Astros, but then so was Swartz’s. The New Yorker has called the CFAA “the worst law in technology.”

Correa testified that he believed his predecessor, Jeff Luhnow, had absconded with the Cardinals’ proprietary scouting information when he accepted the Astros’ general manager position in 2012. Correa pled guilty and was fired by the Cardinals shortly after the story came to public light. A question I have is to the people that repeat the line that “the Cardinals hacked the Astros.” If that scouting information on Jeff Luhnow’s computer belonged to him, and not the Cardinals, how does it then belong to the Astros? Correa “hacked” Luhnow, not the Astros.

But aside from that, this story, as it stretches beyond the realm of sports, is about a law that carries oversized sentences, not distinguishing between cases in respect to intent, and about a Justice Department that seems to have no sense of the weight of its actions. (Or worse, it does.)

I could launch into a defense of Correa here that compares the severity of his punishment to the punishment that inexplicably escaped Hillary Clinton, and I’m going to. Clinton will not be charged by the FBI for operating the business of the U.S. Department of State from her family's private email server, one that was and is safe from Freedom of Information Act requests. Before she was out of office, she deleted emails, and then lied about it. The decision not to prosecute has left her free to continue her campaign for the highest office in the land. This was not the same message the Obama Administration sent when it vigorously pursued whistle blowers Chelsea Manning or Edward Snowden. They both graduated to be charged under the 1917 Espionage Act. The Justice Department that pursued and punished Correa is not the one that let Wall Street bankers skate after they collapsed the global economy, nor the one that intimated that Hillary Clinton would not be charged, even though the FBI admitted it was "possible that hostile actors gained access to Secretary Clinton's personal email account" and that she was "extremely careless" in her "handling of very sensitive, highly classified information."

No, Correa got the Justice treatment that found Manning, Snowden, and lest we forget, Correa’s Major League Baseball colleague, Barry Bonds, who was pursued to the warning track for supposedly lying under oath to a grand jury involving his use of performance-enhancing drugs. (His obstruction of justice conviction was later overturned by an 11-judge panel on a 10-1 vote.)

My problem with Correa’s case, and cases like it, is that the sentencing standards are so out-of-whack as to endanger justice. We see this phenomenon today in nearly all areas of U.S. civil and criminal law. Prosecutors are permitted to seek ridiculously oppressive punishments, and it forces defendants to accept plea arrangements that they otherwise would never consider taking in lieu of their day in court. Did the outsized threat of prison prevent information from coming to light in this case? Correa threw himself on the mercy of the court, saying that he was "overwhelmed with remorse and regret for his actions," but he seems to also have been claiming initially that he, or the Cardinals, were a wronged party.

The punishment has to fit the cybercrime. Was the discovery process sabotaged by Correa’s fear of receiving the maximum possible penalty? My employer has an internet usage policy that I have been guilty of violating in the past. Accessing any online site from your work computer-- whether it be weather-related or anything-- without the consent of your supervisor, is prohibited. This policy is violated by multiple agents on a daily basis. Was I ever under the impression that I had committed a felony by doing this unsanctioned surfing? I was not. But I did, technically, because I violated the agreed-upon terms. What Correa did is a step above a violation of a service agreement. He circumvented password requirements (guessing it based on previous passwords Luhnow used). But 46 months?

From a competitive advantage, I’m hard-pressed to see much damage done to the Astros. It would seem to be at least one step above sign-stealing, although with fewer direct results on the field. There needed to be a punishment, and Correa lost his job. The results of the FBI's investigation seems to suggest that no other Cardinals' front office personnel were involved. The commissioner of Major League Baseball, Rob Manfred, gets to decide a punishment for the Cardinals organization, whether it be a fine, a loss of selections in the amateur draft, a combination of those two things or more. The Astros can have field manager Mike Matheny if they want him.

I suspect the organization will accept its punishment without fuss. But if it were me, I would fight the whole thing Tom Brady-style. The New England Patriots are actually a good comparison on this topic, and I’m not referring to Deflate-Gate, an issue that is an utter absurdity. Instead, I’m referring to the Patriots secretly videotaping the St. Louis Rams’ practice and run-through prior to Super Bowl 36 in 2002. That stunt put the Rams at a severe disadvantage in that game, yet no punishment was ever handed down after the Patriots employee that did the videotaping made a public admission, and I don’t recollect that the United States Justice Department ever got involved.

---

It’s delicious. Too delicious. Yesterday, Iowa Congressman Steve King tells MSNBC that everything that was ever good in the world came from Western Civilization and white culture. That very day ends with Melania Trump lifting entire paragraphs of her speech to the GOP Convention from Michelle Obama’s speech at the 2008 Democratic Convention. It’s just too perfect, so circular it’s a croquet ball. I’m hyperventilating. As Melania’s speechwriter might say, you can’t write this stuff.

posted by CM @ 7:59 PM