On Tuesday morning, the New York Times reported that the FBI and Justice Department prosecutors are investigating employees of the St. Louis Cardinals for hacking into the database of the rival Houston Astros, which, if true, would represent a serious case of corporate espionage. Last summer, Deadspin scandalized Major League Baseball by publishing leaked information from the hack, including detailed trade negotiations. The reason the hack was so damaging—and embarrassing—to the Astros is because the database, nicknamed “Ground Control,” is the centerpiece of the team’s operations. As Astros General Manager Jeff Luhnow told me last summer, “Ground Control is the repository of all our baseball knowledge.” Then he gave me a demonstration.
I’d arrived in Houston the last week of June to write a Bloomberg Businessweek feature story on Luhnow, a former McKinsey consultant, and his data-driven approach to baseball, of which Ground Control was the crown jewel. In light of the news that the FBI investigation is targeting the Cardinals, I went back over my notes and interview transcripts, and two things immediately jumped out.
First, the Times reports that law-enforcement officials believe vengeance may have motivated the hack. Luhnow was a polarizing (though successful) front-office official for the Cardinals before jumping to the Astros in 2011. His unorthodox methods clearly rubbed some Cardinals officials the wrong way. I asked him if there had been any memorable clashes. “None that I can really talk about publicly,” he replied. “I mean, I think you would expect some resistance. Most of it was very professional. But every once in a while there would be something that I would consider unprofessional.” Luhnow admitted that he had acquired the nicknames “Harry Potter” and “The Accountant”—a knock against his fixation on data and his lack of a baseball background—and tried to respond with good humor by bringing a magic wand to the Cardinals’ draft room. Judging by the apparent perpetrators of the hack, plenty of bad feelings remained.
My second takeaway was that Ground Control, though a dazzling piece of technology, represented a huge security risk. The motto in Houston’s front office was “In God We Trust—All Others Must Bring Data.” To make sense of it, all that data was funneled into Ground Control. “It took us a full year to map out the plan and start building it,” Luhnow told me. “The original idea was if I'm sitting at my desk and I receive a call from any general manager in baseball, and he wants to talk—you know, ‘I'm interested in this player of yours and who do you want from my organization in return?’—that I can, without having to hang up and get back to them in two hours, with a few keystrokes look at their entire organization. I've got our scouting reports. I've got the medical reports. I've got a valuation system. I can look at our player and say, ‘OK, if I'm going to be giving up four units of value in this player, how do I get four-plus units of value back from him?’ [I can tell him], ‘I'll take these three guys in exchange for that guy.’”
If the Cardinals had access to the Astros’ valuation system, they could obviously do an immense amount to undermine them, from drafting players they desire to undercutting them in trade deals to knowing their game plans ahead of time when the two teams faced off. In terms of corporate espionage, it’s tantamount to stealing the secret formula for Coke. In terms of professional sports, it makes a deflated football look like jaywalking.
Looking back, the aspect of Ground Control that Luhnow was most excited about—its easy accessibility—may also have been a vulnerability. “We have it available on our laptops, desktops, and PDAs,” Luhnow told me. “We've even gotten to the point where our strength and conditioning guy, who we hired from Cleveland, he developed an app together with our guys up here for our players during the offseason. It's a pretty cool app. ... I’ve got it on my phone.”
I asked him about security. Couldn’t an employee get hired away by another team and take proprietary data with him? “Well, first of all, we take as many measures as we can to protect the information, and we do that by limiting who has access to what information. We can tell if someone is trying to take data. I mean, it exists on the servers. You can access it. You can look at it. It's not something you could say, ‘Oh, I'm going to go download all the projections for the next four years onto a zip drive and get out of here.’ You can't do that. We've got it protected. And we also have logs of who is on and who is not.”
According to the Times, investigators believe that Cardinals employees suspected Luhnow of having taken “proprietary baseball information” when he left the organization for the Astros and that this might have motivated the hack. As it happens, I asked Luhnow about this last summer and he denied it. “There is an ethical obligation when people leave,” he told me. “I mean, I left St. Louis and took no information with me. Sig [Mejdal, the Astros’ director of decision sciences] left St. Louis and took no information with him. All you're allowed to take is residual knowledge that's in your head. Obviously, that's a lot of knowledge in the case of Sig and less so in my case.”
“But, you know,” he added, “we were able to come over here and start from scratch. Everybody wants to, at some point in their career, be able to start from scratch. And I got an opportunity to do that here. I think that is ultimately going to enable us to accomplish our goal more quickly than we would have, had we come into an incumbent situation that we had to work around.”
At the time we spoke, the Astros were mired in the league cellar. A few weeks later, the Ground Control hack spread the team’s closest-held secrets across the Internet. It was a miserable episode for Luhnow, who had to call fellow GMs to apologize. He may find some solace if the Justice Department brings charges. But he’s probably found some already, since the Astros currently sit atop the American League West in first place.