Evan Schuman's StorefrontBacktalk

In addition, many Gen Y shoppers have never known—or believed they had—any privacy, so they are dramatically more willing to give up or sell personal data in exchange for something they see as having value. Their attention span is short, their multi-tasking skills are high and many find the idea of paying for software quaint and old-fashioned. They can prioritize how they pay (Paypal's popular) over how much they pay as well as how they want to interact with businesses--in as many ways as possible: text on their phones, IM on their laptops, posts for them on MySpace, video pitches on YouTube and avatars in SecondLife. Read more...

Unlike some of Forever 21's fellow retail chain victims in the so-called TJX Breach case—including TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority and DSW—Forever 21 now says that wardriving was not involved in its breach and that the data was accessed directly from the corporate data center. Read more...

A second defendant in the so-called TJX Breach case—which also had at least seven other major retail chains as fellow victims—pleaded guilty Monday (Sept. 22), this time to charges of conspiracy, unauthorized access to computer systems, access device fraud and identity theft.

The accused, Christopher Scott, a 25-year-old Miami resident, pleaded guilty after prosecutors said they could prove that he was paid $400,000 for assisting a retail wardriving scheme. Scott’s plea follows the Sept. 11 guilty plea of fellow Miami resident Damon Patrick Toey.…

On Friday (Sept. 12), Forever 21 issued a statement saying that the chain had been wirelessly breached repeatedly between Mar. 25, 2004, and Aug. 14, 2007, and that thieves "accessed older credit and debit card transaction data for approximately 98,930 credit and debit card numbers," including about 20,500 card numbers taken from one particular store in Fresno, Calif. Read more...

Merged channel and E-Commerce issues will be the fighting words of the day at Retail Perspectives 2008 in Montreal on Monday (Sept. 22), where StorefrontBacktalk will be speaking and moderating discussions on those topics plus PCI, in-store strategies, supply chain and global tactics.

Panelists include IT execs from Build-A-Bear, Tesco and Reitmans, and confirmed audience participants include JC Penney, Jones Retail, Brookstone, Carters, Fortunoff and Casual Male. We would love to see you there.…

After a one-year trial, Walgreens has now officially committed to making its 600,000-square-foot distribution center in Anderson, S.C., fully RFID automated with a system that alerts employees before they load a shipment on the wrong truck bound for retail locations throughout the Southeast.

The setup also automatically sends ASNs out as products leave the center, according to this wonderfully detailed RFID Journal story. “The RFID system is designed to alert employees when a tote has been moved to the wrong dock door, and when it is being loaded in the incorrect order. For instance, often a truck will transport multiple shipments to several stores and needs to have the goods loaded in the order in which they will be delivered.”…

In a filing on Thursday, U.S. Attorney Michael Sullivan told U.S. District Court Judge William G. Young that "There is forensic and/or testimonial evidence that the defendant and his co-conspirators hacked into numerous other businesses, which have not yet been publicly identified." Read more...

A U.K. firm has developed an on/off “switch” for RFID cards that could protect cardholders from being hacked. The cardholder activates the RFID transmission by squeezing the card between his thumb and forefinger when it must be scanned by a reader, according to this story from Dark Reading. The patented polymer-based technology comprised of metal particles is embedded into a circuit and gets built into a smart card during the lamination process. When compressed, it acts as an RFID signal conductor. “The difference is that RFID is always on and being interrogated, but this is always off until the instant you want it read,” the story said.

The approach from Peratech has good potential, as the biggest security risk for contactless payment cards is a thief wirelessly interrogating the card while standing nearby. But the approach—which the firm said would cost “cents, not dollars” per card—may not be much more than potential, as no one has yet agreed to use the technology in card manufacturing. With the razor-thin card margins today and an utter lack of consumer demand for better security, it’s unclear if those few pennies could be justified.…

How so? PCI's jurisdiction is limited to payment data and, therefore, it phrases most of its guidelines and requirements in those terms. So a retailer that uses appropriate encryption, firewall and intrusion detection systems only on systems that directly handle payments would be compliant and praiseworthy. But with today's networked systems, cyberthieves seek out soft spots in the network just so they can somehow get inside. Read more...

Wal-Mart on Wednesday (Sept. 3) launched what it dubbed the Walmart Smart Network—a series of next-generation digital-ad systems—to 2,700 stores. The funky aspect of this rollout is that all 27,000 screens will be centrally controlled via an Internet Protocol Television connection.

In theory, this will allow content to be adjusted based on a virtually endless list of criteria and could be tweaked on a per-store, per-screen and time-of-day basis, said officials with Wal-Mart, who seem to be unsure when they’re Wal-Mart and when they’re Walmart. (Both were used.) “Every screen and every message has a purpose and we will be analyzing point of sale data on an ongoing basis,” said Stephen Quinn, chief marketing officer, Walmart Stores, U.S..…

Campbell also backed encrypting data as it is sent to banks, even over private networks. There's little question that both moves would improve security, but the cost and change required will also make them almost impossible to deploy. As TJX execs know better than anyone, market forces to push such change are essentially non-existent. Read more...

A retail IT lesson from the world of politics? Maybe. Web tracking firm Keynote studied the text message blast sent by the U.S. presidential campaign of Barack Obama, the one in which his campaign promised to tell supporters his VP selection before it was broadly announced.

That message didn’t quite work out politically, as CNN broadcast the choice hours before the text blast was supposed to start. As a result, the campaign immediately triggered the blast, which didn’t work well, either. About 50 percent of people who subscribed to receive the text message from the Obama campaign regarding the VP pick may not have received it “in a timely fashion and perhaps not at all,” Keynote said. Does this mean Common Short Code SMS messaging won’t work for large national blasts? Not necessarily. But if you’re relying on getting your data out to prospects, it’s probably a good idea to vote for a different transmission method. …

Has Amazon decided what it wants to be when it grows up? More to the point, are there indications that it has now decided that one thing it does not want to be is yet another thin-margined retailer?

One tech blogger is arguing that Amazon wants to get as far away from retailing as possible by examining its hiring choices surrounding Kindle and Amazon’s Web Services. Interesting reading.…

TrustCo, which operates more than 100 banks nationwide, filed the lawsuit in the New York Supreme Court against TJX in July, saying that it had never been invited to participate in the initial group of banks suing TJX. This bank's accusations mirror the other banks' charges, namely that TJX "breached its duties" by allowing the intrusion. TJX replied that it was the bank's own fault.Read more...

But the changes confirmed by the PCI Security Standards Council this week—which have been circulated among members for the last few weeks—provide few other substantive changes, delivering the mild tweaks and updates the council has publicly promised.

The document lists some 30 changes to the current PCI Version 1.1 and PCI officials promise that the official and final version—now slated for release on Oct. 1, a few weeks earlier than originally expected—will include yet more changes.

Still, the document provides a fairly detailed peek into the council's thinking. The most significant change is language that addresses the much-maligned WEP and tried to balance conflicting member interests, from those who argued that such a weak security approach should be banned as soon as possible and their opposite numbers, who spoke to the cost and effort that retailers would need to deploy to make the change.Read more...

When the PCI Security Council this week detailed a bunch of changes it will include in PCI 1.2, what might be more worthy of note is what they didn’t address.

There were technical issues—such as segmentation and tokenization—that didn’t get referenced, but also policy issues. Why isn’t there a more clear-cut appeal process, for retailers who believe their assessor is improperly interpreting the rules? Today, the council will try and address technical questions, but that rarely involves overruling an assessor. Visa has been known to get involved with a retailer who has an assessor complaint, but that’s a very rare occurrence. Read more.…

This concept is being trialed right now by Germany's $81 billion Metro Group, in a project with Procter & Gamble.Read more...

"Numerous apparel companies have reported increased sales of as much as 20 percent using RFID to monitor shelf stock levels," the report said. "In 2008, IDTechEx research finds that 38 percent of the money spent on RFID in retail is specifically for apparel tagging." Read more...

"The criminals have been going into shops claiming to be engineers working on the terminals," said Una Dillon, head of card services at the Irish Payment Services Organization Staff. "Staff are used to their bank officials coming to update terminals so unfortunately they have been able to do that." Read more...

These days, when U.S. government officials want to ask questions about privacy and data security, it’s never clear if they want to protect consumers’ privacy or learn the best way to violate it themselves. But retail execs who want hints can drop by a Sept. 22 hearing at the U.S. Federal Trade Commission’s Washington, D.C., headquarters. Those who can’t personally attend can do so virtually.

“Workshop participants will discuss the increasing prevalence of contactless payment devices in everyday consumer transactions, including credit card purchases and public transit, as well as the growing use of item-level tagging in the retail sector,” said an FTC statement. “The workshop will examine consumer awareness and education initiatives regarding these developments; security and privacy threats and proposed solutions; and emerging technologies and practices that may shape the marketplace in the coming years.” True enough, but there’s a reason these D.C. sessions are called “hearings” and not “listenings.” …

Retailers who are worried about RFID security problems will have more details available to them now that a federal judge has killed a gag order on MIT students who had identified flaws in Boston’s contactless RFID subway cards.

Ten days ago, a judge ordered three MIT students to not discuss research they had done about RFID security problems with the Boston subway system. On Tuesday (Aug. 19), U.S. District Judge George O’Toole Jr. killed that order, ruling that discussing the papers would not violate computer fraud laws. “The MBTA ultimately is trying to silence some uncomfortable truths that these students uncovered,” Cindy Cohn–one of the attorneys for the students–told The Boston Herald. “They brought an action against three college kids rather than address the problems in their own house.” Countered an attorney for the Boston subway: His organization merely ” wanted the students to refrain from revealing details about the security problems publicly until the MBTA has time to correct the flaws.” How long did he think that would take? Five months.…

Some are questioning, though, whether the chain's lower priced approach might limit the number of consumer phones that can access the related content. Read more...

On Monday (Aug. 11), the $3.8 billion Jones Apparel Group became the latest retailer to launch an RFID item-level trial, albeit a conservative one, testing it at "a couple" of the 221 stores it operates under the Nine West name, said Norm Veit, executive VP of Management Information Services at Jones. Read more...

At least one RFID vendor is arguing that they are. That vendor, SimplyRFID, is arguing that read distance targets that used to be 10 feet are today as far as 40 feet.

“In the last year or two, RFID performance has definitely gotten a lot better. It used to be 10 feet [read range] was the goal, and you’d be happy to get 12,” Simply RFiD president Carl Brown was quoted saying in an RFIDUpdate story. “Now we’re seeing 20 feet without any issues at all. You can even have the tag in strange orientations and you’re still going to get the read. This technology is moving fast. Antenna, readers, cables, tags are all changing every six months.” The story details how they arrived at their figures. Not so sure it’s all realistic, but the details make for some interesting reading.…