Evan Schuman's StorefrontBacktalk

Wal-Mart isn't in the trucking business any more than its suppliers are, and just squeezing out a little savings in fuel costs would be a wasted opportunity. By stretching its supply-chain perimeter though, Wal-Mart will get much better control over the inventory coming in: when it arrives, how it arrives and how quickly it can be turned around. And that's all about IT.Read more...

Conway can imagine a few scenarios, but none seems to be the answer. This issue is important to every retail CIO, so we need to understand what Chip-and-PIN will and won't do, in addition to what the business case, if any, is for the U.S. and other markets to convert from magnetic stripe to Chip-and-PIN cards.Read more...

On Monday (May 24), Yahoo CEO Carol Bartz took to the stage in New York City at a TechCrunch event and participated in an on-stage interview. The exchange was lively and interesting, with Bartz speaking about Yahoo’s plans and innovation efforts. But near the end of the interview, when asked again about Yahoo’s innovations versus Apple, Bartz answered in a way not typical for the CEO of a $6.5 billion publicly held company: She told interviewer Mike Arrington to “f-ck off” and then added “this time, I meant it.” (That particular exchange happens near the very end of this video clip.)

Bartz has a well-deserved reputation for direct (some might say salty) language, but most CEOs pull back a little in a videotaped interview in front of a large audience. Her remark wasn’t made in the heat of anger, so we can assume it was a calculated comment. If you look at shorter clips from the event, Bartz comes across as defensive. But in the context of the complete interview, her unhappiness is clearly based on repeated comparisons with Apple and despite her having given a lengthy list of Yahoo’s innovations.…

In this week's PCI column, Walter Conway makes an eloquent argument that chains must take special care to protect their data when changing processors. But Walt only briefly touches on the responsibility issues involving those processors. In PCI Requirement 12.8, the PCI powers-that-be mandate that the retailer properly manage the service provider, but they don't say what happens if the service provider does something wrong anyway.Read more...

Are you still responsible under PCI Requirement 12.8 for managing a service provider when you no longer have a relationship with that provider but it still has your data? Aside from PCI considerations, if a service provider--think tokenization vendor or loyalty program manager—simply goes out of business, how will you get your data back? Read more...

The upshot: The search giant has now decided to end its entire WiFi survey. And that's exactly the wrong lesson to learn from an incident like this.Read more...

But one very popular news community—called Topix—tried an impressively horrible idea and got slapped down for it by the attorneys general of 23 states and U.S. territories.Read more...

While the co-owner of this family-owned scoop shop said he likes the RFID technology, he's fonder of the push nature of his current flavor updater--where he tells his customers what he has--rather than the pull nature of a system in which his customers tell him what they want. When does customer feedback become too much?Read more...

"You never use the PAN on the handset. Never, never," said an official with the security company that discovered the hole.Read more...

The fact that Visa, along with a three-year-old Texas startup called DeviceFidelity, issued a news release and almost immediately tried to retract it is telling. Then again, the fact that Visa thinks it's possible today—in the age of Google cache and umpteen sites that seem to like publishing verbatim news releases—to take back a release after it's published is itself a very revealing statement.Read more...

Unless you are an L2 merchant who plans to self-assess, advises PCI Columnist Walt Conway, you could find yourself overpaying for a certification that you don't need.Read more...

He figured that being 60 pounds overweight and having absolutely no real experience in any of the three sports was a perfect metaphor for some of his IT projects. How different could a Triathlon possibly be, after all, from a global IT deployment that is ludicrously underbudgeted with ridiculously unrealistic goals, which the board somehow believes? Read more...

The law specifies that the post-breach game won't fly in the state of Washington: A retailer "will be considered compliant, if its payment card industry data security compliance was validated by an annual security assessment and if this assessment took place no more than one year prior to the time of the breach. For the purposes of this subsection, a [retailer's] security assessment of compliance is nonrevocable."Read more...

As Blippy's recent data breach problems make clear, this is new territory. Two distinct issues are at play here: security protection against fraudulent transactions (essentially PCI) and privacy/identify-theft concerns involving companies that leverage consumer transaction histories. Making this scenario much more delicate is the fact that consumers themselves are often giving these third-party vendors permission to share their data.Read more...

To be fair, that's not necessarily a bad thing. Google today has the largest slice, by far, of the search engine pie. New Hitwise stats released Wednesday (May 5) give Google 71.4 percent of the search market, compared with 14.96 percent for Yahoo, 9.43 percent for Bing and 2.18 percent for Ask. (Interestingly enough, of those four engines, Google is the only one that gained marketshare from March to April. Ask, meanwhile, lost a painful 37 percent in that same month.)Read more...

The value—and extreme value it is—comes from a search engine finding products that simply cannot be found otherwise. Read more...

A key provision of the proposed bill (nerdy detail: This is a draft of the legislation circulated for comment. It has yet to even be officially introduced) is to restrict information given to a retailer from being distributed to an outside business, such as a marketing firm that sends spam or junkmail. That's politically safe territory. But the wording is sufficiently vague to raise other concerns.Read more...

In our increasingly strange new world of social networking and mobile commerce, a whole range of unexpected places will need to deal with PCI DSS. This week's example is Blippy, the social exhibitionism site that last week posted more than just some members' purchases online. It also posted their payment card numbers for the world to see.Read more...

The incident raises questions about the credibility of customer comments, in addition to all the difficulties today of doing much of anything anonymously.Read more...

We here at StorefrontBacktalk are looking to add to our stable of columnists. (Or should that read, “add to our unstable columnists?”) Specifically, we’re looking for some of retail’s most insightful and opinionated E-Commerce thinkers to form a rotating group for a weekly column on various E-Commerce efforts. The goal is to have each columnist deliver only perhaps one column a month. (To be clear: The columns—and not the columnists—are to rotate.)

The qualifications are flexible, but the ideal columnist is a retailer who has focused on E-Commerce for enough years to have strong opinions about what works and what doesn’t and who is willing to share those views with the world. If you’re interested, we’d love to hear from you! Please E-mail Evan at eschuman@storefrontbacktalk.com.…

On Friday (April 23), the 723-store Barnes & Noble book chain added yet another layer: A mobile device that acts very differently when it happens to be inside one of the book chain's stores.Read more...

All of these companies have quickly admitted their current—to be charitable—accuracy deficits. Milo executives, for example, agreed that their engine needs a lot of work. But they also stressed their efforts in improving inventory accuracy. Although that is certainly important, it should be a Phase Two goal. If someone is asking for a "green vest to wear" and the results are showing videos, books, a glow-in-the-dark safety light and a top response of "Nerf Dart Tag Fury Fire Blasters" (actual search target and results from Milo's engine), the fact that it may be accurate in knowing the number of Nerf Dart Tags a toy store has isn't very helpful.Read more...

InternetEvolution points out a legal quandary: many concerts prohibit cameras. Given that iPhones—along with other smartphones—include cameras, could they be banished?Read more...

Visa already has lots of access to lower cost security options, and the world's largest payment card brand has even better access to huge retailers. We didn't say affectionate access, but it is access nonetheless. No, this deal is partially about E-Commerce and mostly about Mobile Commerce, with perhaps a few million dollars worth of PayPal paranoia thrown in.Read more...

There's no small amount of irony that Amazon—which has a well-earned reputation of leveraging every piece of customer information in any way possible to boost sales—is the one making this privacy argument. It's as though Amazon is channeling a classic line from Animal House: "He can't do that to our pledges. Only we can do that to our pledges."Read more...