Evan Schuman's StorefrontBacktalk

TJX knew how "antiquated and deficient" its security efforts were and yet never told MasterCard or Visa, resulting in negligent misrepresentations. That's how U.S. District Court Judge William Young summed up what the banks are going to have to prove to win at trial in his courtroom. In an hour-long federal court hearing Tuesday in Boston, Young peppered attorneys from TJX, TJX processor Fifth Third Bank and banks suing TJX, providing a good sense of where a TJX bank trial might go. Read more...

When Gov. Arnold Schwarzenegger this weekend vetoed California's data breach bill, it was much more important than a single state's governor veto. Much more important. Read more...

The court's decision was being closely watched in E-Commerce circles because it spoke to how far federal law will go to protect online businesses from new and potentially threatening technologies. In this instance, though, the judge didn't address the E-Commerce issues in those broad terms, finding more than enough specifics in this case to justify the preliminary injunction, she said. Read more...

The proposed California law would have required retailers to protect data in a manner more demanding than current Payment Card Industry Data Security Standard (PCI DSS) requires. The current version of the bill, Schwarzenegger said, "attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers." Read more...

Singing an off-key version of “Anything You Can Do, I Can Do Better” in the general direction of SAP, Oracle has made a $6.66 billion bid for BEA Systems. The move comes on the heel’s of SAP’s announcement this week that it is paying $6.8 billion to buy Business Objects. (So it’s a couple of hundred million shy of SAP’s deal. Who said Oracle’s always careful about being accurate in its song choices.)

BEA has been under pressure from investor Carl Icahn to consider a sale of the company, according to this Wall Street Journal story.…

Waiting for EBay’s long-awaited AdContext program? Pull up a chair, as you may have a very long wait. Indeed, this is one of the lenghtiest public betas I’ve ever seen. In the early summer of 2006, EBay announced that its program to scan news stories for references to products that they have on auction, to be called AdContext.

It was supposed to ship by the end of the year. In November, that “end of year” became “January.” In December, “January” became “first quarter 2007.” In March, no timing was mentioned at all.

On Thursday, an EBay senior manager said the product was still in beta and he couldn’t even guess at a new target for launch. Guess this kind of functionality is more difficult than it seemed. At least more difficult for EBay.…

When TJX attorneys this week argued how much this settlement was going to cost them–including a one-day 15 percent-off sale for all consumers–they defended their points with plenty of numbers, so the judge could see this wasn’t made up.

But a crafty analyst at Javelin Strategy took out her own calculator and had some fun pointing out the misleading nature of the attorney’s selected financial factoids. (Note: If you hate math, you’re advised to skip the link.)…

On Monday, U.S. District Court Judge Audrey B. Collins will likely charter new E-Commerce ground on Monday from her Los Angeles courtroom, when she rules on a preliminary injunction request from Ticketmaster against a 10-person Pittsburgh ISV called RMG Technologies. The Ticketmaster case is interesting because of its non-traditional legal issues—where Ticketmaster's core argument is that it's being damaged by a potential loss of consumer goodwill—plus the fact that these are claims that couldn't happen outside of current-day E-Commerce. Read more...

"Shoppers want barcode readers on their trolleys (shopping carts) to calculate the nutritional content and tell them when they have blown their calorific budget," EDS's Sion Roberts, director of consumer industries and retail, told Reuters. Setting aside for the moment whether consumers really want to know, the bigger question is whether retailers and consumer goods manufacturers would want to pay to let them know. Read more...

Barnes & Noble is gently testing the mobile-commerce waters, as it prepares to announce a deal on Monday to sell books, CDs and DVDs, but only on BlackBerry phones.

The deal with Digby will deliver a small version of the book chain’s site—optimized for mobile, presumably—to allow faster and easier ordering. Downside: the BlackBerry version will only be updated once a day.…

But since the breach--where the credit card data of some 46 million consumers fell into unauthorized hands—the company seemed to have made PR blunder after blunder. And yet, their financial health could hardly be better. Revenue and every key metric has improved since the breach's announcement and the negotiated settlement with consumers suing TJX is likely to be approved and it's extremely favorable to TJX. Read more...

‘Tis the season to be discreet. Fa La La La….

When retailers start pushing holiday sales before Thanksgiving, consumers get annoyed. If they knew retailers were starting holiday sales weeks before Halloween, they’d go ballistic. And yet, that’s precisely what The New York Times says many major chains are doing: Celebrating The Euphenisms.

“Shattering records for an early start, Wal-Mart is cutting prices on toys in mid-October, but the company is not calling it a holiday sale. L. L. Bean has started advertising free shipping — but it is shying away from the H word. And Toys “R” Us is marketing a temporary store in Manhattan, but consumers have to study ads to find the name: Holiday Express,” the story said. Well worth a read.…

After hearing about a revised proposed consumer settlement that supplements $30 in-store vouchers with $15 checks—along with other changes, such as increasing the voucher cap from $7 million to $10 million—Young said he was inclined to approve the deal but wanted to consider the options just a bit longer. Much of the Wednesday hearing before the judge in the Boston federal courthouse focused on whether TJX could contact most of the consumer victims by mail, instead of the TJX preferred approach of advertisements and selected mailings. Read more...

SAP has agreed to acquire Business Objects in a $6.6 billion cash deal. This deal, the biggest ever for SAP, is clearly aimed at countering quite a few acquisitions from rival Oracle.

The companies said the deal—which Business Objects will recommend to its shareholders, subject to regulatory conditions—is expected to close in the first quarter of 2008, according to this Reuters story.

Reuters quoted Trip Chowdhry, a Silicon Valley based analyst with Global Equities Research, as saying the SAP deal was backward-looking. “I don’t think this is something investors should be cheering,” he said. “They are picking up the leftovers. The good companies at the right prices have already been acquired.”…

Retailers started using the credit card numbers to identify purchases with specific consumers, given that they had to store them anyway. It turned out to be a convenient link into CRM systems, especially for customers who weren't using the traditional retailer-issued loyalty card. Read more...

Retailing's most powerful lobby—the National Retail Federation (NRF)—is launching a campaign to change the way that credit cards and retailers interact. Conceding that the Payment Card Industry (PCI) procedures have simply not been effective at stopping massive retail breaches, NRF CIO David Hogan has been pushing for a radical change in tactics, one that will require Visa, MasterCard and AmericanExpress to change procedures.

"It is unlikely PCI will ever be able to keep pace with the continually-evolving sophistication of the professional hacker, or anticipate every possible variation of future attacks," Hogan said in a letter to Bob Russo, the head of the PCI Security Council. "We believe the time has come to rethink the assumptions behind PCI."

In a sign of the times for beleaguered RFID, when $8 billion apparel and home furnishing chain Dillards announced Tuesday that it was beginning an RFID pilot, it spent most of its short statement detailing various restrictions on its trial efforts. It’s sort of like announcing a brand-new hire by telling employees all of the things you won’t permit the new person to do.

The item-level RFID/Electronic Product Code (EPC) trial will feature “tags designed to be removed at the time of purchase. They are not required in the event that the customer wishes to return the garment. No link will be made between the garment information held by the tag and the customer’s personal information,” said the retailer’s ultra-happy news release.…

When U.S. District Court Judge William G. Young last week told lawyers that he had some serious concerns about the proposed TJX settlemenT, he also took issue with part of the initial proposed settlement that would allow for consumers to turn the vouchers into cash by selling them.

In a courtroom exchange with TJX attorney Harvey J. Wolkoff, Wolkoff tried to argue to the judge that EBay is an easy way for a consumer to turn the vouchers into cash.

Replied Young: “Too hard for me, Mr. Wolkoff. Too hard for me. These are consumers. People know how to cash checks. Saying ‘Go to eBay and negotiate it’ won’t cut it.” Read more.…

When a federal court judge issued rulings on Tuesday that the $60 billion retailer needed to stand trial on charges that it's Web site is not sufficiently accessible to visually-impaired shoppers, it sent a strong signal to much of the E-Commerce space.

Target has long been the most prominent opponent of forcing E-Commerce site executives to adhere to accessibility rules designed for their brick-and-mortar counterparts.

The federal judge overseeing the consumer portion of the TJX case is concerned about the proposed settlement and wants to see TJX vouchers replaced by cash.

U.S. District Court Judge William G. Young told attorneys late Thursday that he “had a lot of questions and concerns” about the settlement, which provided for wronged consumers to be given $30 TJX vouchers, according to Thomas G. Shapiro, an attorney representing some of the consumer plaintiffs who was present in the courtroom. Read more.…

Consider: In the early days of E-Commerce, a typical retailer and manufacturer might have between eight and 12 products that it is actually marketing, especially with search engine links. Today, that same company would typically be doing the same kind of Web marketing with some 12,000 products, said Tim Armstrong, who serves Google as its president of advertising and commerce for North America.

Armstrong argues that this is morphing ad budgets into operational budgets. Is a Google ad akin to a traditional piece of advertising—something that an ad budget should fund—or closer to the cost of a car dealer building a new showroom and dealership?

TJX is still retaining customer data for far too long—18 months—and for the wrong reasons, although it's current wireless efforts appear adequate, according to a report issued Tuesday by the Office of the Privacy Commissioner of Canada and the office of the Information and Privacy Commissioner of Alberta.

Even after deciding in September 2005 to move to WPA, the report said, it didn't complete the rollout until mid-January 2007, which was the exact point when TJX announced to the world the largest retail data breach ever.

The Canadian privacy officials were not pleased with TJX's encryption efforts. "There were flaws. TJX relied on a weak encryption protocol and failed to convert to a stronger encryption standard within a reasonable period of time," the report said, adding, "While TJX took the steps to implement a higher level of encryption, there is no indication that it segregated its data so that cardholder data could be held on a secure server while it undertook its conversion to WPA."

When TJX announced Friday night that it had worked out a settlement for all of the consumers lawsuits that had been filed against it, it provided an anticlimactic ending to much of this databreach saga.

But in many ways, this resolution—with a settlement offer that will cause TJX very little material pain—was inevitable. Despite the background of the most massive databreach in retail history, where credit card data of some 46 million consumers fell into unauthorized hands, TJX had virtually nothing to fear from the U.S. judicial system. Read more.…

With a $6.5 million check for attorney fees and limited $10/hour hassle reimbursements for customers, TJX announced a deal Friday to make all of their consumer lawsuits go away.

The details from the show the $17 billion retailer's attempts to address consumer injuries. But given the huge scale of this breach, the compensation to any one consumer is likely to be minimal.

TJX has agreed to compensate consumers for any time they lost "as a result of the intrusion," but those calculations will assume a rate of $10/hour. Read more.