Evan Schuman's StorefrontBacktalk

We looked at the top security topics of the week on Friday, in an audiocast with Avivah Litan, Gartner’s security analyst, and Chris Hinsz, the newest member of the PCI Security Standards Council, who happens to hail from Motorola. Readers can listen to the entire 30-minute audiocast or check out just the segments that interest them most: An analysis of the latest Visa PCI statistics, with thoughts on improving the credit cards themselves and the key reasons why forbidden data is still being retained; How TJX is faring after the disclosure of the retail industry’s largest data breach; The latest information about the insider security threat and how the records stolen from Fidelity National Information Services and Certegy is now at 8.5 million records, which is a lot more than was originally revealed.…

When the world's largest retailer struggles with a database issue, the numbers can be a bit daunting. It's datawarehouse, for example, is larger than 4 Petabytes. That's more than 4,096 TBytes, give or take a few million bits.

The chain has more than 6,000 stores, with some having almost a half-million SKUs each. You think your Excel spreadsheets are bad? Wal-Mart's database tables have literally 100 billion rows. The retailer's POS systems have to ring up some 276 million items—a day.

This peek into the IT operations of this $345 billion retail empire comes courtesy of a phone interview with Wal-Mart Chief Technology Officer Nancy Stewart.

Last month’s report of a LAN administrator at Fidelity National Information Services who stole 2.3 million customer records may have understated the situation, with a new SEC filing placing the number of names taken at 8.5 million.

According to a report of the filing in SecureComputing, “some of the stolen records only contained names, addresses, telephone numbers and birth dates, but about 5.7 million contained checking account numbers and 1.5 million included credit card numbers.”…

When Visa on Monday released its latest PCI compliance statistics, it showed small but steady progress, with slight increases in most areas. But it also showed that there is still a small handful of major retailers who are still retaining prohibited credit card information.

Visa stressed in its statement that the vast majority (96 percent) of Level 1 merchants—a category including virtually all of the nation's largest retailers—have written to Visa that "they are not storing sensitive account data" including credit card security codes and PINs. But given that Visa has said that there are 328 Level 1 merchants in the U.S., that four percent suggests that about 13 major retail chains aren't even claiming that they've stopped retaining that data.

For those who still argue that TJX is being bloodied by their data breach problems, here’s the latest tidbit, with a major financial firm increasining its stock price target for TJX, “encouraged by the discount retailer’s strong business trends and defensive business model.”

The Credit Suisse boost came when analyst Paul Lejuez raised his price target by $3 to $35, implying an upside of around 8 percent from Friday’s $27.31 closing price, according to this Forbes.com story. “With strong current business trends, a myriad of initiatives to continue to improve productivity and reduce the expense structure, and a defensive business model, TJX (nyse: TJX – news – people ) is well-positioned to beat expectations and outperform the group,” Lejuez wrote in a client note.…

Under the heading of "be careful what conclusions you draw," was chatting the other day with Greg Buzek, president of the IHL consulting group and one of the smartest retail observers working today, about self-checkout trends. Had written recently about IHL's self-checkout report and had questioned the Greg's suggestion that consumers love self-checkout.

Greg mentioned that beyond retail segment breakdown (grocery versus home supply, for example), a critical self-checkout area to consider is geography.

JCPenney has been experimenting with ways to bring online depth into its brick-and-mortars, with some healthy (107 percent sales boost) initial increases in test stores, according to this DMNews,com story.

The pilot–which was launched late last year in 40 stores–is interesting in that it matches some attractive numbers with bringing online into offline, but it’s unclear if the “this is different” newness factor was isolated. If it wasn’t, the sales bump might be more a result of the trial than what the chain would see in the longterm. Also, this appears to be true multi-channel–as opposed to the desirable merged channel–as the systems don’t appear to talk to each other. Still, it’s an encouraging step.…

Just to prove that it can be done, a pair of Swedish networking specialists have crafted a 40 gigabits-per-second fiber-optic connection for a Stockholm residence. To put that into context, that’s almost 14 times faster than the ceiling speed for a T3.

The speed is reached using a new modulation technique that allows the sending of data between two routers placed up to 1,240 miles apart, without any transponders in between, said Hafsteinn Jonsson, head of the Karlstad city network unit, according to this Yahoo News story.

To the extent that such speeds ever become practical, this could start to push the limits of hard-disk desktop space, let alone the amount of RAM needed to manage such a vast data pipe. That said, it still sounds like a fun connection to have in one’s basement.…

Contrary to some concerns that recent Wal-Mart silence about RFID means the retail giant was backing off, the Arkansas-headquartered firm is actually proceeding aggressively—and quietly, according to the latest monthly RFID report from financial management firm Robert W. Baird & Co..

“Most industry participants, and certainly most external observers, believe Wal-Mart has curtailed their RFID efforts, particularly given little in the way of new communication from the retail giant. However, we believe the primary reason for the lack of communication is the transfer of RFID responsibility to logistic operations within Wal-Mart from IT,” the report for July said. “Such a transition, along with the continued implementation of readers, is likely requiring some digestion. We view this transition as a natural progression, and are encouraged that Wal-Mart views RFID importantly enough to make it the responsibility of their day-to-day operators. We further understand that Wal-Mart has recently sent a series of letters inquiring of some vendors their lack of compliance, suggesting that their external communication efforts are targeted.”…

Is the dark cloud of multiple investigations still looming over TJX and its imfamous data breach? Yes, but it’s going to have some time to breath over the summer. While the various lawsuits and state probes continue, the threat of U.S. congressional hearings–threatened months ago–appears to be delayed until at least September, according to a congressional source who has asked that her name not be used.

Those hearings have been on the subcommittee plans for months, but have repeatedly been delayed. Although high hopes had existed for July hearings, the source said that other legislative priorities has forced “all other committement business to come to a halt.” With the August recess, that leaves September/October as the next possible timeframe. …

A hospital snack room in Michigan is an unlikely place for a fullblown item-level RFID trial coupled with biometrics, but the 24-hour needs of the facility created the need.

In this eye-opening Detroit News story, the Fast Track Convenience room at Garden City Hospital used RFID tags on all products to charge purchases by–among other methods–deducting cash value on employee ID cards. Employees who can’t grab their ID cards can instead use a biometric thumb scan. With vendor assistance, the project’s initial setup cost the hospital $25K. A story worth reading and thinking about. (Note: Look closely at the photo the paper shot on-site. Love the product-level warning label placed directly on the tag: “Remove Before Microwave Use.” More “fun with microwave oven” potential than I had anticipated with item-level tagging.)…

Tired of various challenges with RFID? A pair of Pennsylvania inventors have been awarded a patent for an RFID-like tracking system that uses light instead of radiowaves. The argument is that it would be more amenable to a crowded warehouse and that it would be less susceptable to unauthorized intercepts.

Patent 7,232,067 (Registering Multiple Similar Items with Flickers) calls for LED tags that will emit visible light, infrared, or ultraviolet. .Read more...

After more than $75 million in bogus credit card charges, several Cuban nationals in Florida have been arrested with more than 200,000 credit card account numbers, many of which came from the TJX and Polo Ralph Lauren data breaches, according to U.S. Secret Service officials, commenting on Monday's announced arrests.

The numbers were sent to the Florida defendants—who specialized in manufacturing bogus credit cards complete with embossing, logos, holograms and properly encoded magnetic strips—from a group of Eastern European residents who specialized in collecting the stolen credit card numbers, the Secret Service said.

That Eastern European group of fiduciary Fagans obtained those numbers from many different sources, but many of the numbers were traced back to two specific major retail data breaches: last year's TJX breach and a 2005 Polo Ralph Lauren breach, said a Secret Service case agent involved in the investigation and who asked that his name not be used.

Fidelity National suffered the ultimate insider theft when an IT staffer sold about 2.3 million customer records to a marketing firm. But it's the low-tech way this techie did it that makes it interesting.

The company said that this was all orchestrated by one employee, who has thus far only been identified as "a senior-level database administrator who was entrusted with defining and enforcing data access rights." If someone wants to steal a database, that's the perfect job to have.

Despite—or is it because of?—this employee's technical expertise, intimate knowledge of the network and extreme access, he/she didn't break in, didn't do a transfer and didn't concoct such elaborate script to make data copies. "The incident does not involve any outside intrusion into, or compromise of, Certegy's technology systems," said a company statement. Here's the most fascinating part: "To avoid detection, the technician removed the information from Certegy's facility via physical processes; not electronic transmission."

The average time it takes a consumer to make an E-Commerce purchase decision has jumped from about 19 hours in 2005 to 34 hours and 19 minutes this year, according to a report that is slated to be published next week.

The report, created by a security service called ScanAlert and based on about 128 million visitors to 470 web sites, makes the reasonable conclusion that the increase is based overwhelmingly on the increase in the number of E-Commerce sites today. In theory, this allows for much more extensive—and time-consuming—comparison shopping. Comparison shopping is certainly a very good possibility, but as the novelty of E-Commerce purchases becomes more of a distant memory for most, other more innocuous options are also possible.

In court papers, SAP has now conceded that one of its units did perform “some inappropriate downloads of fixes and support documents” from Oracle.

The Tuesday acknowledgement came from SAP CEO Henning Kagermann. “Even a single inappropriate download is unacceptable from my perspective,” Kagermann said. “We regret very much that this occurred,” according to this CIO Today story. Technically, this was a violation but it’s far from clear whether Oracle suffered any true harm or whether SAP achieveved any material advantage.…

Wal-Mart this week continued its campaign to push RFID throughout the industry, with this powerful Money Magazine story adding new some details.

The piece has Myron Burke, strategy manager of Wal-Mart’s store innovations and operations group, discussing a recent visit to a Wal-Mart equipped with on-floor RFID tagging. He reported that out-of-stock signs were discovered in 66 of about 200 total product categories within its electronics section. “With RFID, Wal-Mart management can now alert those store associates to fix the problem spots,” the story said.…

Visa has in the wings its own version of number portability, in a program that will allow “consumers to carry their account numbers with them if they move up to pricier and more exclusive cards, and merchants to offer new services and benefits, such as loyalty programs, to customers,” according to this InformationWeek story. (Note that my former employer needs to look at a calendar from time to time. This July 2 story references a TJX statement from “earlier this month.” It meant “last month.” They probably just lifted it from last week’s print edition and no one on the copydesk caught it.)

The piece quoted Visa Snr. VP Jim McCarthy as saying, “This allows us to take a specific action in real time based on consumer behavior at a specific merchant and a specific location.” Calendar issues notwithstanding, it’s worth a read.…

I have to confess a certain fondness for Google, an admiration that has grown out frequent innovation and creativity. Then again, my livelihood doesn't overwhelmingly depend on the whims of Google so the idiosyncrasies of their search and other services is professionally interesting and not much more.

But to a growing legion of small and mid-sized E-Commerce players today, Google's evolving rules and exact methodologies can devastate—or make wildly successful—and these are matters where they have virtually no say.

Despite efforts by Yahoo and others in recent months, no one has come close to touching Google's overwhelming marketshare for Web search. In the olden days, this was called "cornering the market" and it was a good thing, to be congratulated in the nearest wood-paneled corporate watering hole.

With the $81 Billion Euro retail giant Metro Group having formally gone into full-fledged RFID deployment, a senior executive there says the efficiencies the chain saw in trials was too compelling to not deploy.

The chain has informed all of its suppliers that they need to ship all RFID pallets to Metro fully RFID tagged by October 1, 2007, said Gerd Wolfram, an IT managing director for the chain.

One of the key hurdles to full-scale RFID deployments with U.S. retailers has been low read accuracy rates, but Wolfram said that wasn't what his people found in European testing. "It's not a problem at all on the pallet level," he said, adding that pallet-level read rates were "about 100 percent."

background-image: url(“/images/copy/Pier1.jpg”); background-repeat: no-repeat’

In an against-the-trend move, Pier 1 will shut down all of its online operations, focusing solely on select physical locations.

“We are exiting all non-Pier 1 stores activities,” Pier 1 president and CEO Alex W. Smith told Wall Street analysts on the company’s first-quarter conference call, according to an Internet Retailer story. “We are exiting the e-commerce and catalog business.”

The move may not be permanent, however, according to a report from Marketwatch, which quoted Smith as saying that pier1.com will continue, but purely for marketing. “We’re not saying this is forever,” Smith said. “We’re just saying this is where we need to be today.”

Although the trend is a push toward a unified merged channel–combining online and offline–when having to choose one over the other, online is typically seen as being less costly to operate. The other major retail chain to have similarly pulled back has been TJX, which pulled back from its E-Commerce efforts for T.J. Maxx and HomeGoods in late 2005. But there’s a connection: Alex Smith had been a Senior VP at TJX when TJX pulled back from E-Commerce and this is the same Smith who today runs Pier 1.…

In what is being billed as the largest production rollout of RFID in Europe, the $81 billion retail giant Metro Group has gone live with its wireless strategy.

The Germany-based chain has long been in the lead of RFID thinking and strategy globally, although it's efforts to date have been limited trials. "We are moving RFID out of the innovation labs and into working retail stores," said Gerd Wolfram, an IT managing director for the chain.

Metro, which will reportedly be using RFID products from Reva Systems in the rollout, will start with about 200 locations of its Metro Cash & Carry, Real stores, and the Metro Group distribution centers.

When looking at CRM programs, many retailers today focus on what they can do and not what their prospects want them to do.

Nothing radically new here, but i just stumbled upon this great Microsoft commercial about the consumer-retailer disconnect. When you see the guy with the “advertiser” shirt, think ‘retailer” and this really works. Sorry that it happens to be a vendor commercial, but even Microsoft can make a valid point from time to time.…

A key division of the Albertsons grocery chain officially abandoned its loyalty card program on Wednesday, officially saying that it wanted customers to be relieved of the burden of having to show a card to get discounts. Unofficially, the program got pulled because grocery managers weren't bothering to use the data.

To be fair, the decision for the Albertsons group that handles some 78 stores in Arizona, New Mexico and El Paso, Texas (Albertsons has any other groups for other geographies) was complicated. First, the chain's history has been marked by a strong and consistent resistance to any kind of CRM/loyalty program, with Albertsons being one of the last of the major retailers to launch a loyalty program when it tried it out in 2003. The chain is now going to try and push its new lack of a loyalty card as a reason for customers to shop there. But the truth is that the chain never saw a viable return-on-investment from the program. Why? As one Albertsons official—who asked to remain anonymous because of a fondness for a continuing paycheck--said on Wednesday, "The data was being collected but it wasn't being used."

Sometimes, it’s the simplest ideas that can solve the biggest problems. Consider the supply-chain global outsoutcing issues with clothing. A huge concern is the lack of accuracy of garment measurements.

Enter a a tiny device called an e-tape. I have to give credit to legendary retail analyst Paula Rosenblum, who has now launched her own firm called Retail Systems Research and who started raving about e-tape.

What it does is take the measurement from the garment and wirelessly send it to a PC. So what? Assuming the person doing the measuring places the device properly, this unit sidesteps most of the common errors, such as reading the measurement incorrectly or writing it incorrectly. It also avoids language issues frequently encountered overseas. Not bad for a handheld device.…