Evan Schuman's StorefrontBacktalk

The CIO needs to sells ideas upstream to senior management and sideways to line-of-business peers, convincing them that the technology is the right move and that it needs to be approved and funded. If that works, it's barely 30 percent of the battle. If the stores aren't sold on the idea, Franchisee Columnist Todd Michaud opines, the data won't be used and the project is doomed to fail. And you're to blame.Read more...

One key issue that both sides are arguing is timing. Some of the franchisees have argued that Burger King is being punitive by moving so quickly. They are pointing out that the chain's deadline was Dec. 31, 2009, and that the lawsuits started being filed within a few days of the deadline passing. Burger King argues that it has been extremely patient, having informed its franchisees of the POS upgrade rule back in April 2008--giving the stores a rather generous 20 months to arrange for and make new POS purchases. Indeed, Burger King is saying that it was even willing to give franchisees more time if they needed help raising the money, as long as they were truly trying to follow corporate's edict.Read more...

Dear StorefrontBacktalk Reader: I am truly surprised at you. Here you are, raised to be proud money-grubbing capitalists and you’re leaving cash on the table like Bill Gates at a charity reception. (And can you believe how much Bill Gates jokes have changed in the last 15 years?) We’ve been giving away autographed copies of a best-selling security book and we still have some left. All we ask is that you fill out 5 minutes’ worth of questions on a one-page survey about whether your trust your QSA.

Even if you don’t like the book, they’re selling for decent bucks on eBay even without the author’s signature. Heck, they even make a great gift for that IT staffer who didn’t get a raise last month because you really wanted him to quit. Seriously, we only have a few left and they are easy to turn into cash. Is a 5-minute survey such a lot to ask? And if you fill it out, I won’t have to come back next week and beg even more pathetically.

Read more … …

In a marked contrast to the same kinds of questions two years ago, the intent is not to ignore security. Indeed, many of the chains considering such a heretical question are already putting in place security procedures that go well beyond current PCI requirements. This isn't a safety or security issue. It's a simple CFO's ROI balance sheet, contrasting the bureaucratic and paperwork costs of dealing with the very formal PCI procedure with the limited fines and other bad things that will happen if a chain suddenly stops pursuing PCI compliance. A report released this month from Ponemon tried to quantify the cost of breaches today, but its conclusions are rather underwhelming. Read more...

The role itself is a spreadsheet of contradictions. White House jobs, especially those senior enough where the President is personally involved in the selection, are highly coveted. And yet, quite a few of the people who were approached for this particular gig rejected it. This position is supposed to get a lot of POTUS face-time. And yet, in a town known for its inflated titles (another czar anyone?), this job title is the underwhelming Cyber Coordinator. Coordinator? That's the best they could do? But there's a serious issue with this gig. Some of its applicants complained of insufficient authority. In many ways, this lack of authority problem nicely encapsulates all of the problems with IT security management today: all responsibility; no authority; not enough money; plenty of blame.Read more...

A letter from a POS vendor making the rounds warns retailers—under the headline "Information Security Advisory"—that an out-of-date OS will cause lack of compliance with PCI. The warning isn't true, but the popularity of this and related PCI claims is moving beyond annoying. Are these vendors lying or is marketing being allowed to make the claims without anyone checking? A recession drives marketers to desperate measures. (OK, so does prosperity, but let's not go there.) Read more...

But PCI is not like that. PCI has requirements that demand regular attention if merchants are to remain compliant the other 364 days in a year. CIOs and merchants who focus only on their annual PCI validation may actually find that they unintentionally make themselves more vulnerable to a costly data breach. They also make their PCI revalidation the following year more difficult, and possibly more expensive, than it has to be.Read more...

Just as certain a fact as stating that many of today’s social network sites will be gone in two years is the fact that new social sites—invariably much more niche and focused—will replace them. Hidden in plain sight within the millions of posts in dozens of languages of these huge number of sites is every trend, every individual customer profile and every hint of what customers will buy—and perhaps even their desired price range—that your chain could ever wish for. There’s only one problem: There is no simple spreadsheet-friendly way to access that data.

You can read it without limits. But to automate that process and to process the data in a way to get anything meaningful out of it, that’s difficult. We are deluged with products and services that are trying to solve problems that hardly anyone has ever experienced. Who will be the first to conquer this one? Many companies—including SAP and Oracle—are trying to figure it out. But they typically try to fall back on algorithms and filters. The software needed is closer to what the CIA and the NSA use to parse billions of phone calls and E-mail messages while trying to figure out plots. It’s much closer to artificial intelligence than cryptography. Military satellite technology eventually came to consumers in the form of GPS. How long will it take for AI to visit the local retail chain, where software will peruse the world to find out the best assortment to be displayed tomorrow?…

The change was for several reasons, including "some functionality in the Fujitsu software that we really liked and needed" that wasn't offered by NCR and testing that showed Fujitsu's software on NCR self-checkout units performed about 20 percent faster than when NCR's own software was loaded on its units, said Cara Kinzey, Home Depot's Senior VP of IT. Read more...

"We consider CVS and (Walgreens) to be the most advanced, as they have already implemented chain-wide computer synchronization, advanced inventory management and pharmacy workflow optimization systems," said Deborah Weinswig, from the Citi investment research and analysis group. "The warehouse clubs are considered to be the least sophisticated of the group. However, BJ and (Costco) have fewer inventory management needs as a result of their unique business model."Read more...

Michaud describes the first parent-included IT interview he did, where the mother reminded him that her daughter was trying to decide about him, too. This makes for an awkward interview, but even worse, what does it say about the applicant's independence? Their ability to lead? Are programmers expecting instant gratification, the product of an "Everyone's a winner" upbringing? A frightening column for anyone hiring for IT positions this year.Read more...

The mobile retail world has now neatly morphed into three categories: consumer-used (with true M-Commerce, mobile research from home and on the road, etc.); retailer-used (for price checks, inventory inquiries, in-aisle supply chain inquiries, etc.); and consumer-in-store (2D barcodes, price comparisons, SMS communications with the chain, watching demos, mobile research from within the store, direct payment, etc.). To make matters worse, some applications sit in multiple categories, such as a retailer-used device that is temporarily given to a consumer for checking online inventory or seeing a demo.Read more...

Maybe tokenization and end-to-end encryption are just two closely related approaches that can, when properly implemented, accomplish the same thing: minimize your total PCI scope. One thing is for sure, though: Either way, you will need to bring your checkbook.Read more...

Home Depot will spend about $60 million on more than 10,000 handheld units that are designed to help associates perform mobile checkouts, process payment cards, stock shelves and make phonecalls, according to BusinessWeek. “This is the first big customer-service tool we’ve given our associates in a very long time,” said Home Depot CIO Matt Carey.

The chain has been trialing these devices since 2008, when we reported that they were initially tested along with an RFID-based loyalty card that flagged associates when certain high-priority customers entered the store and set off a door-based reader.…

The former CIO for Limited Brands, who had spent 12 years with Ernst & Young, has been named CIO of the $15 billion, 3,100-store Gap chain. Tom Keiser, now Executive Vice President/CIO, will report to Chairman and CEO Glenn Murphy and serve as a member of the Executive Leadership Team.

“Tom brings with him a successful track record in the retail industry,” Murphy said. “Through his leadership of rolling out effective technology platforms that delivered solutions for employees, customers and stores around the world, he has consistently demonstrated how effective IT investments and execution can deliver business results.…

Well, the NRF issued its final official tally Thursday (Jan. 14): an increase of 1.1 percent. For our team, which never did better than a C- in economics class, that ain't too shabby. For the record, we knew the figures would be released about now and were fully prepared to eat crow if we had to. Glad we got it a lot closer than the NRF did. Personally, we hate eating crow.Read more...

But Grooms added: "You should try and fail really small. You test, take some risks, adjust and go back. But you really can't take that long. You can't take three years to develop an app. You must launch and learn." Roberts took the opportunity to tweak his own wording. "Fail is such a strong word," he said. "I prefer to think of it as a sub-optimal business case outcome."Read more...

On the Best Buy side, though, many attendees at the National Retail Federation (NRF) conference were wondering whether the change would have much of an impact at all. One attendee compared the move to a hypothetical apparel retailer that is furious about children working in overseas sweatshops. To put an end to it, the apparel retailer would tell the supplier, "That's it! No more. I want you to take the pink frilly tuxedos with the Mod Squad characters sewn into the chest and get them out of here and don't bring me any more pink frilly tuxedos with the Mod Squad characters sewn into the chest until your suppliers have changed their practices. You can bring me lots of other clothes, but I am now drawing the line at pink frilly tuxedos with the Mod Squad characters sewn into the chest. It's for the children."Read more...

Forrester Research on Monday (Jan. 11) said it was seeing light at the end of the retail IT tunnel, with a conclusion that “the tech downturn of 2008 to 2009 is unofficially over.” It predicts the IT market in the U.S. will grow by 6.6 percent in 2010 and the global IT market will rise by 8.1 percent in U.S. dollars. Wondering if Forrester isn’t always optimistic in mid-January? Well, the firm predicted (just about one year ago) a dire year for 2009, with slow economic improvements in the second half of 2009. So it pretty much nailed that one, giving us yet more reason to believe Forrester’s new optimistic report for 2010.

Forrester Analyst Andrew Bartels cites “growing evidence that an economic recovery started in the U.S. and other countries in Q3 2009.” He also predicts the data will show “a small increase in buying activity or, at worst, just a small decline” taking place during the fourth quarter, adding that “the pieces are in place for a 2010 tech spending rebound.” Forrester predicts the good times will come slowly but “pick up steam later in the year, with computer equipment [especially PCs and storage] and software leading the way, and IT consulting services following.”…

According to a copy of a report that Discover prepared about its initial trial results, 69 percent of those participating in the Zip trial wanted the sticker hidden. "The pilot management team was impressed by the creativity demonstrated by participants in finding various ways of hiding stickers under the phone’s protective case ("skin”), under the battery cover and other unseen yet convenient locations."Read more...

At the National Retail Federation (NRF) show this week, several vendors were pitching payment card readers (and other peripherals) that could attach to a smartphone, thereby converting it into a POS device. Some of the readers are already PCI PTS approved. With one of these and a Blackberry, merchants can move the POS from a fixed counter to anyplace inside – or even outside – their stores. And the best part is that merchants can have this wireless capability for a price far less than current wireless POS devices offered by most manufacturers. PCI Columnist Walt Conway can think of several merchants he works with that will be looking at these devices very seriously. But, he argues, the PCI implications are complicated.Read more...

But the bleeding won't stop there. HPS has yet to reach agreements with Discover, MasterCard or others. The Visa agreement, described in a filing with the Federal Securities Exchange Commission (SEC), calls for HPS to take out a $53 million loan to help it pay $59.22 million to Heartland Bank and KeyBank National Association, two of its sponsor banks. Visa will pay back to the banks $780,000 in fines it collected from them after the breach.Read more...

There's an interesting provision that turns a programmer into a criminal if the program permits usage beyond the Nebraska limits. "Intentional or grossly negligent programming by the programmer that allows for the storage of more than the age and identification number shall be a Class IV felony." Turning a careless programmer into a felon? I can just see new indemnification clauses being demanded by every programmer who is being aggressively recruited. What about shareware or freeware? Good luck tracking down which open-source programmer wrote that particular portion of a Linux program. ("Hey, Brenda, what's the term for grossly negligent programming in Nebraska?" "An Oracle upgrade." Rimshot.)Read more...

Why? As Michaud was walking the aisles of this week's National Retail Federation (NRF) show, several vendors told him: “We help our partners by offering a completely outsourced solution so that IT is no longer a bottleneck to achieving the results they deserve." Michaud writes: "Whoa there, Silver; hold on a second. In every organization that I have worked for, the demand for the IT department has always been greater than the supply."Read more...

But as long as you're coming, we'd love to ask you to drop by some of the StorefrontBacktalk events and do what our readers do best: yell at us. The first shouting opportunity will be at the RetailROI event at the Marriott East Side (Lexington and 49th) on Saturday at 2:45 PM. This charity event (www.retailroi.org) is designed to raise money for global orphan care and adoption support. But to do that, we get geeky for awhile. Our panel is on retail security and it starts at 2:45 PM and features the CIO of the world's largest restaurant group: Delaney Bellinger from Yum Brands (Pizza Hut, KFC, Taco Bell and Long John Silver's, among others). Also on the panel are two of our esteemed columnists (Franchisee Columnist Todd Michaud and PCI Columnist Walt Conway) plus Mark Rasch, the former head of the U.S. Justice Department's high-tech crimes division.Read more...