Astros hack case

[gunnarthor]

Wow.  The Cardinal employee who hacked the Astros system (by using Lunhow's password) was sentenced to nearly 4 years in prison.  

 

http://espn.go.com/mlb/story/_/id/17101079/chris-correa-former-st-louis-cardinals-scouting-director-sentenced-jail-hacking-houston-astros

 

 

[Mike Sixel]

Remember when people said it wasn't a crime to hack into another company's IT systems?

 

Ya, ya it is........

[SwainZag]

 

Remember when people said it wasn't a crime to hack into another company's IT systems?

 

Ya, ya it is........

 

Why wouldn't that be a crime?

[Mike Sixel]

 

Why wouldn't that be a crime?

 

No idea, but that was a lot of people here and elsewhere.....

[SwainZag]

 

No idea, but that was a lot of people here and elsewhere.....

 

Oh, I hadn't divulged into those threads.  Hacking into someone's system today is basically the same as breaking into offices and rifling through someone else's documents 30 years ago for secrets etc.  Crime in my book.

[Vanimal46]

Clearly this guy was in the wrong, and more than deserves his jail sentence. I also hope that the Cardinals get penalized for this too. Preferably where it hurts most - losing draft picks. It's not like the information Correa obtained in the hack wasn't used to help the Cardinals make decisions on their own team.... 

[ashbury]

With good behavior, he can hack into the judiciary's data server and be paroled in six months.

[Teflon]

The Cardinals took the bait just like Lunhow planned all along. That guy's an evil genius.

[diehardtwinsfan]

You know, I don't get the justice system in this country.  That Stanford swimmer got not even close to that amount of time.

 

Oh, and let's stop calling him a hacker please.  Just because Luhnow was too stupid to change his password doesn't mean that the guy who know it previously is a hacker... not exactly what I call a true cybercrime. 

 

 

[dgwills]

4 years is way too much. The guy using almost the same password for both systems was providing a lot of temptation to someone in a competitive environment. It's really not much of a hack when it's that easy. People are always happy to see long prison sentences, but they rarely ask it they're necessary. At some point it's just vindictive.

A 1 year sentence with 6 months served would be plenty. This guy would never try something like this again.

[Mr. Brooks]

4 years is way too much. The guy using almost the same password for both systems was providing a lot of temptation to someone in a competitive environment. It's really not much of a hack when it's that easy. People are always happy to see long prison sentences, but they rarely ask it they're necessary. At some point it's just vindictive.

A 1 year sentence with 6 months served would be plenty. This guy would never try something like this again.

So it's less of a crime because the victim didn't do more to protect themselves? The punishment should, at least partially, be based on how hard the criminal had to work to break the law?

And why does it matter how "tempting" it was? I imagine that to a bank robber, banks are really tempting, with all that money just lying around, waiting to be stolen.

 

The definition of hacking doesn't change just because someone is a really easy target. Sure, there are degrees of difficulty when it comes to hacking, but either way it's still hacking.

 

Yeah, on the surface, it's just baseball, what's the big deal right? But, this is a very serious crime. And, the silliness that we equate to it because it's just baseball doesn't change that.

In the eyes of the law, the reason the target of the hack doesn't, and shouldn't, matter very much. Just like I shouldn't less time if I break into your house and "only" make myself a sandwich.

 

Also, whether the sentence will deter this specific guy from ever doing it again isn't the only consideration. Punishment also has to be a deterrent against future criminals considering attempting the crime. A slap on the wrist does no good in that regard.

 

Lastly, I've seen comparisons to other crimes.

It's not that simple. Federal and State prosecutions are completely different.

The Feds don't F around. Even the most blatant criminals know not to get messed up in federal jurisdiction.

Once they decide to prosecute it's basically over. The feds have something around a 90% conviction rate. They don't lose, and they almost always get the sentence they ask for.

It may be imbalanced, and I agree that when compared to some cases of actual physical harm, it seems severe, but if it is your beef should be with the other cases for getting too light of sentences, not with this one.

[SwainZag]

 

You know, I don't get the justice system in this country.  That Stanford swimmer got not even close to that amount of time.

 

Oh, and let's stop calling him a hacker please.  Just because Luhnow was too stupid to change his password doesn't mean that the guy who know it previously is a hacker... not exactly what I call a true cybercrime. 

 

So if I have a spare key to your house and I come in and loot the place does that make me less of a burglar than a guy who broke a window and did the same?  

 

The broad definition of a hacker is "a person who uses computers to gain unauthorized access to data."  and that is exactly what he did.

[bird]

Whether I leave my door open or force you to break and enter, your punishment should be the same.

 

If all you do is make yourself a big old PB&J, tidy up and leave instead of walking off with my priceless artwork? The judge should go real real easy on you.

 

Baseball is big business. This wasn't some hack job into someone's fantasy baseball spreadsheets.

 

But still, 4 years was a shocker to me, especially after having seen The Big Short. No one at Goldman Sachs got 4 months.

[beckmt]

Problem has been that white collar crime got very little, still 4 years and loss of career is a lot.  Hope the Cardinals are penalized big time for this.  May not have been blessed by the organization, but they probably still used the information gained by this individual.

[dgwills]

 

So it's less of a crime because the victim didn't do more to protect themselves? The punishment should, at least partially, be based on how hard the criminal had to work to break the law?
And why does it matter how "tempting" it was? I imagine that to a bank robber, banks are really tempting, with all that money just lying around, waiting to be stolen.

The definition of hacking doesn't change just because someone is a really easy target. Sure, there are degrees of difficulty when it comes to hacking, but either way it's still hacking.

Yeah, on the surface, it's just baseball, what's the big deal right? But, this is a very serious crime. And, the silliness that we equate to it because it's just baseball doesn't change that.
In the eyes of the law, the reason the target of the hack doesn't, and shouldn't, matter very much. Just like I shouldn't less time if I break into your house and "only" make myself a sandwich.

Also, whether the sentence will deter this specific guy from ever doing it again isn't the only consideration. Punishment also has to be a deterrent against future criminals considering attempting the crime. A slap on the wrist does no good in that regard.

Lastly, I've seen comparisons to other crimes.
It's not that simple. Federal and State prosecutions are completely different.
The Feds don't F around. Even the most blatant criminals know not to get messed up in federal jurisdiction.
Once they decide to prosecute it's basically over. The feds have something around a 90% conviction rate. They don't lose, and they almost always get the sentence they ask for.
It may be imbalanced, and I agree that when compared to some cases of actual physical harm, it seems severe, but if it is your beef should be with the other cases for getting too light of sentences, not with this one.

The Eighth Amendment of the United States Constitution prohibits the federal government from imposing excessive bail, excessive fines, or cruel and unusual punishments to criminal defendants who have been convicted of a crime. This means that the government cannot impose a penalty that is grossly disproportionate to the seriousness of the offense. 

This guy did not steal 1.7 million dollars from the Astro's. He looked at their scouting reports. This did not make them unusable for the Astros. The value of this information is subjective since it is really just their opinion on the value of players. No doubt it is a disadvantage to have 1 team know who you are targeting, but it's not going to stop you from obtaining any of players you want. I can not see how this disadvantage equates to a 4 year prison sentence.

If you break into my house and make a sandwich it's trespassing. If you rob me it's burglary. Intent matters when it comes to sentencing. The cost of the investigation should not. Hell, we've spent tens of millions of dollars investigating the Clintons. Does that mean they should get life in prison?

[WLFINN]

 

 

If you break into my house and make a sandwich it's trespassing.

 

 

Even if its a Dagwood............?

 

 

[Vanimal46]

 

The Eighth Amendment of the United States Constitution prohibits the federal government from imposing excessive bail, excessive fines, or cruel and unusual punishments to criminal defendants who have been convicted of a crime. This means that the government cannot impose a penalty that is grossly disproportionate to the seriousness of the offense. 

This guy did not steal 1.7 million dollars from the Astro's. He looked at their scouting reports. This did not make them unusable for the Astros. The value of this information is subjective since it is really just their opinion on the value of players. No doubt it is a disadvantage to have 1 team know who you are targeting, but it's not going to stop you from obtaining any of players you want. I can not see how this disadvantage equates to a 4 year prison sentence.

If you break into my house and make a sandwich it's trespassing. If you rob me it's burglary. Intent matters when it comes to sentencing. The cost of the investigation should not. Hell, we've spent tens of millions of dollars investigating the Clintons. Does that mean they should get life in prison?

Correa still accessed a competitor's database and analyzed their inside information. In what world is that okay to do? The court needed to set a precedent so this kind of thing will not happen in the league again. 

[Mr. Brooks]

The Eighth Amendment of the United States Constitution prohibits the federal government from imposing excessive bail, excessive fines, or cruel and unusual punishments to criminal defendants who have been convicted of a crime. This means that the government cannot impose a penalty that is grossly disproportionate to the seriousness of the offense.

This guy did not steal 1.7 million dollars from the Astro's. He looked at their scouting reports. This did not make them unusable for the Astros. The value of this information is subjective since it is really just their opinion on the value of players. No doubt it is a disadvantage to have 1 team know who you are targeting, but it's not going to stop you from obtaining any of players you want. I can not see how this disadvantage equates to a 4 year prison sentence.

If you break into my house and make a sandwich it's trespassing. If you rob me it's burglary. Intent matters when it comes to sentencing. The cost of the investigation should not. Hell, we've spent tens of millions of dollars investigating the Clintons. Does that mean they should get life in prison?

The sentence was well within the sentencing guidelines for this crime. It is not cruel or unusual punishment.

What he took AFTER the hack is irrelevant, as that component is not what he was charged with. He was charged with the hacking.

 

In our example with the sandwich, it is breaking and entering (not trespassing), regardless of what I steal once I'm in. I might face additional charges based on the value or amount of damage that I do once I'm in, but that still doesn't change the original charge of breaking and entering.

 

Not to mention, that even the sandwich would be burglary, as I would have stolen whatever ingredients i used to make the sandwich.

 

And, who said anything about the punishment being based on how much the investigation or prosecution costs?

[Mike Sixel]

 

4 years is way too much. The guy using almost the same password for both systems was providing a lot of temptation to someone in a competitive environment. It's really not much of a hack when it's that easy. People are always happy to see long prison sentences, but they rarely ask it they're necessary. At some point it's just vindictive.

A 1 year sentence with 6 months served would be plenty. This guy would never try something like this again.

 

Wow, I thought blame the victim only happened to raped victims. Just. Wow.

[dgwills]

 

The sentence was well within the sentencing guidelines for this crime. It is not cruel or unusual punishment.
What he took AFTER the hack is irrelevant, as that component is not what he was charged with. He was charged with the hacking.

In our example with the sandwich, it is breaking and entering (not trespassing), regardless of what I steal once I'm in. I might face additional charges based on the value or amount of damage that I do once I'm in, but that still doesn't change the original charge of breaking and entering.

Not to mention, that even the sandwich would be burglary, as I would have stolen whatever ingredients i used to make the sandwich.

And, who said anything about the punishment being based on how much the investigation or prosecution costs?

I was referring to the assertion that federal crimes have higher conviction rates and longer sentences. This is largely do to the resources they use in the investigations. Personally I do not think sentences should be based on anything other than the crime committed.

The sandwich analogy was not started by me and is no doubt flawed, but yes that crime would also be breaking and entering. My point is that the severity of the crime committed absolutely should be the main consideration in sentencing.

The federal governments stance on hacking is hard for me to understand. They have extremely harsh sentences for citizens who are convicted of it yet they know that the Chinese government has teams of people who spend everyday attempting to hack American company's. They take very little action against them. If the act of hacking in and of itself is such an egregious offense then they no doubt they should of imposed harsh sanctions on them long ago. 

[Brock Beauchamp]

The guy isn't a hacker any more than I'm a hacker when I discover a clueless tech person before me left the server password as "root".

[dgwills]

 

Correa still accessed a competitor's database and analyzed their inside information. In what world is that okay to do? The court needed to set a precedent so this kind of thing will not happen in the league again. 

If that is the reasoning behind the sentence then the punishment should be execution. Keep in mind that I still think he should of been convicted of a felony. I just think four years is unnecessary. The guy isn't really a danger to society, so I don't really see the reason for it. 

[Vanimal46]

 

The guy isn't a hacker any more than I'm a hacker when I discover a clueless tech person before me left the server password as "root".

I guess I'm not understanding why the difficulty of a password qualifies as hacking or not hacking. If the password for my bank account is "password" and someone steals my money, it's still hacking, no?

[Brock Beauchamp]

 

I guess I'm not understanding why the difficulty of a password qualifies as hacking or not hacking. If the password for my bank account is "password" and someone steals my money, it's still hacking, no?

Eh, maybe technically but not really. Illegally accessing a network is a crime but this is the equivalent of someone stealing a television you left on your front lawn. Yes, the perpetrator should be charged with theft but some responsibility falls on the "victim" for being an idiot.

[Comrade Bork]

This guy just got sentenced to 4 years of probable rape while AP gets a slap on-the-go wrist foe beating his child. Why don't they just strip him of his assets and give him a felony. That ends his way of life just as effectively.

[Mike Sixel]

Just because we sentence men way too gently for what they do to women and children does not mean we should not sentence criminals like we do......it means we should sentence men more harshly, imo. These comparisons are off......just like our society.

[diehardtwinsfan]

 

So if I have a spare key to your house and I come in and loot the place does that make me less of a burglar than a guy who broke a window and did the same?  

 

The broad definition of a hacker is "a person who uses computers to gain unauthorized access to data."  and that is exactly what he did.

 

I think you need to re-read what I was said.  I said I didn't get the justice system (given the punishment the Stanford swimmer got for rape).  Think about that for a second. Drug and rape a girl who is passed out... 6 months... wouldn't want to ruin the kids life after all.  Re-use a password and leak a bunch of embarrassing information that has little long term consequence (and yes, long term consequence should have an impact on the penalty assigned).. 4 plus years.  It just doesn't compute.

 

I also said that to stop calling him a hacker.  That's not what he is. 

 

I work in IT for a living and have a security background.  I don't have too much of an issue with him receiving punishment as he broke the law.  Then again, hackers have gotten off on some interesting technicalities (one that comes to mind is the system owner using a welcome banner instead of a warning banner when accessing a system). 

 

That said, given the laws MLB is exempt from, why they aren't being asked to police this themselves is a separate issue altogether.

[Mr. Brooks]

I think you need to re-read what I was said. I said I didn't get the justice system (given the punishment the Stanford swimmer got for rape). Think about that for a second. Drug and rape a girl who is passed out... 6 months... wouldn't want to ruin the kids life after all. Re-use a password and leak a bunch of embarrassing information that has little long term consequence (and yes, long term consequence should have an impact on the penalty assigned).. 4 plus years. It just doesn't compute.

 

I also said that to stop calling him a hacker. That's not what he is.

 

I work in IT for a living and have a security background. I don't have too much of an issue with him receiving punishment as he broke the law. Then again, hackers have gotten off on some interesting technicalities (one that comes to mind is the system owner using a welcome banner instead of a warning banner when accessing a system).

 

That said, given the laws MLB is exempt from, why they aren't being asked to police this themselves is a separate issue altogether.

Why do you keep saying it's not hacking?

 

The official definition of hacking is:

Use a computer to gain unauthorized access to data in a system.

 

I admit I'm not an expert so tell me what I'm missing based on that definition of hacking?

[d-mac]

 

The guy isn't a hacker any more than I'm a hacker when I discover a clueless tech person before me left the server password as "root".

 

Password: Guest

 

https://cdn.meme.am/instances/51394709.jpg

 

 

[diehardtwinsfan]

 

I was referring to the assertion that federal crimes have higher conviction rates and longer sentences. This is largely do to the resources they use in the investigations. Personally I do not think sentences should be based on anything other than the crime committed.

The sandwich analogy was not started by me and is no doubt flawed, but yes that crime would also be breaking and entering. My point is that the severity of the crime committed absolutely should be the main consideration in sentencing.

The federal governments stance on hacking is hard for me to understand. They have extremely harsh sentences for citizens who are convicted of it yet they know that the Chinese government has teams of people who spend everyday attempting to hack American company's. They take very little action against them. If the act of hacking in and of itself is such an egregious offense then they no doubt they should of imposed harsh sanctions on them long ago. 

 

To be fair, there are issues with cross boarder prosecution, and most hacking falls under that umbrella.  Internationally, nothing has really been done which makes it even more difficult...  But if you want have some fun, the broad definition could give fits in lots of areas, such as high frequency trading where companies like JP Morgan and GS use technology to front run large trades so they can mark them up. 

 

And yeah, let's not talk about everything that caused 2008.  No one has been prosecuted for that at all, despite the fact just about every person in America was impacted by those crimes.