Evan Schuman's StorefrontBacktalk

Computerworld columnist Frank Hayes–a former colleague of mine from CMP and an awesome folk singer as well–has a wonderful column out about why the Wal-Mart RFID effort is still having problems.

Although some of the proprietary arguments are slightly overstated, Hayes makes a great point about how Wal-Mart’s $2 per pallet non-RFID penalty reflects a lack of understanding of why suppliers have resisted RFID tagging. It’s the software implementation costs and the fact that different retailers demand different versions. Hayes’ column is worth reading. (But not everyone seems to agree. The RFID Journal took exception to the piece, on several levels. And then some RFID Journal readers took exception to that disagreement.)…

Barnes & Noble on Wednesday (May 28) launched its mobile E-Commerce site, which is pretty much a super-slimmed down version of its regular site.

B&N Mobile includes search, store-finder, book availability and order tracking. It’s not an especially sophisticated site, but it puts the world’s largest physical world bookstore on a very short list of major e-tailers who have bothered to design a version of their site for the cellphone.…

Germany’s METRO Group is experimenting with RFID inserts to track meat and to immediately locate any product that is about to expire or that has expired.

METRO is placing the inlays into the foam meat packing trays used in their Future Store. “RFID has a key role to play in quality management for fresh food,” said Gerd Wolfram, managing director of MGI METRO Group Information Technology in a statement. “This automatic product identification technology will contribute to product quality and efficiency in our stores.”…

MasterCard Canada this summer will start a 4-month NFC-phone trial, with the backing of some of Canada’s largest retailers, including Loblaw, Petro Canada, Tim Hortons’, Pioneer Petroleum, Rabba Foods, a major NHL arena and McDonalds.

One unusual aspect of the trial is that it will eventually support more than one payment card on each phone, said MasterCard Canada’s Nagesh Devata.…

The employee has been dubbed a whistleblower and it's been suggested that TJX was wrong to have terminated the guy. In this case, I have to stand up for TJX: They were completely within their rights to terminate this employee. As for the charges themselves, those are dramatically more troubling. Read more...

So when she places the barcode-less fruit on the scale, the first fruit it displays in its list is kiwi, followed by the four fruits and vegetables that Jane typically buys. Other fruits and vegetables follow alphabetically after Jane's favorites have been displayed. Given how many fruits Jane buys each time, this shaves a precious 108 seconds off of her checkout. Read more...

But there really is no reason to wait. Why? The proof is in the tracking tools. Whether the 1.2 release of PCI DSS in October 2008 specifically addresses server, network and desktop virtualization is less important than being able to provide proof to your PCI assessor that you can control, manage and track access to card data continuously.Read more...

The grocery challenge with the theft of moist, fresh products–such as cheese–has frustrated retail loss prevention managers because such products tend to react poorly with EAS tags. Checkpoint and Sealed Air Cryovac announced Wednesday (May 21) one possible way around this issue.

Cryovac has started to integrate anti-theft labels inside the vacuum shrink bags. “The first market request to Sealed Air Cryovac was for two million packs for the protection of Parmigiano Reggiano. In Italy, for instance, Parmigiano Reggiano has a shrink rate of about 9 percent,” said a joint statement. “Initial studies have shown that this RF-EAS source tagging program may cut down inventory shrinkage of dairy products from 9 percent to 1 percent.”…

A pair of British shopping centers is experimenting with a creative way to leverage consumer cellphones. The consumers are being surreptitiously tracked by the signals emitted by all mobile devices and a database notes when consumers “enter a shopping centre, what stores they visit, how long they remain there and what route they take as they walked around,” according to a report in The London Times.

A spokesperson for the vendor behind the trials–Path Intelligence, of Portsmouth–said its equipment was just a tool for market research. “There’s absolutely no way we can link the information we gather back to the individual,” a spokesperson said. “There’s nothing personal in the data.” But their system does apparently grab a consumer’s phone’s unique IMEI number, which is found on all GSM and UMTS mobile phones. The carrier would theoretically have the data to match it to personally identifiable data.…

The RFID market has a healthy future, looking at a 15 percent compound annual growth rate over the next five years, hitting $9.7 billion by 2013, according to a report issued Tuesday (May 20) by ABI Research.

These figures highlight an RFID market that is growing “robustly,” said ABI research director Michael Liard, pointing to recent commitments from Wal-Mart’s Sam’s Club and the German retail giant Metro AG as key factors. …

Controversial RFID vendor Verichip on May 15 announced that it is selling much of the company, wants to sell the rest of it and that the company has parted ways with its CEO, Scott Silverman.

Verichip and its onetime parent company, Applied Digital, generated a lot of negative publicity for RFID with its efforts to push implantable RFID chips, including some especially controversial statements that Silverman made about RFID chips being implanted in non-citizen guest workers. The company’s sale of its XMark unit to The Stanley Works for $45 million will remove the vast majority of the company’s revenue. (RFID Update just ran an excellent look at whether such implantable RFID efforts are viable anymore.) …

Robert Russo, general manager of the PCI Council and a man who never met an acronym he didn't like (when we chatted, he tried turning QA into a verb—and he frighteningly got darn close), is trying to play down the significance of the new version, describing the modifications as "minor changes." Read more...

"As a result of a defect in the software program for the packet sniffer, the packet sniffer automatically deactivated whenever the compromised (Dave & Buster's) POS servers rebooted in the normal course of the operation of the servers," the indictment said. "Therefore, in order for the packet sniffers to capture data from the compromised D&B POS servers on an ongoing basis, the defendants had to regularly reactivate the packet sniffers." This group might even have had a hand in the TJX incident. Read more...

These leaders also tend to be more successful at getting business units and other departments to share the cost of PCI compliance with IT. Read more...

When TJX announced a MasterCard agreement last month to pay $24 million for data breach costs stemming from the industry’s worst payment card data breach, it was contingent on at least 90 percent of the banks agreeing.

No surprise, but TJX made that acceptance rate with room to spare, coming in at 99.5 percent, the retailer announced May 14. …

NeoCatena Networks has in the wings a product designed to stop fraudulent or bad tag data from getting into the system from the supply chain.

Applying Internet-level security to RFID is something that has not gone very far, according to this RFID Update story about the anticipated rollout. NeoCatena Networks is developing RF-Wall, an appliance to be installed between RFID readers or controllers and middleware servers, edge servers or host applications in networked RFID systems. The product acts as a firewall that authenticates RFID tags prior to allowing their data to pass into enterprise systems and also scans input to detect and block malware. RF-Wall works by using the unique tag ID to create a digital signature.…

Retailers focused on contactless payment might want to circle July 24, 2008, on their calendar. That is when the U.S. Federal Trade Commission will hold a hearing in Seattle “to explore the growth of contactless payment systems and the implications for consumer protection policy.”

Here are the details of the FTC’s hearing along with a link to submit comments electronically. There are lots of legitimate pros and cons on this issue, but the panel should at least understand the merchant’s perspective.…

As retailers continue to experiment with mobile commerce, one potential problem is when mobile customers prove to be truly mobile. Let’s say a national chain sends an E-mail blast to the cellphones of 10,000 Boston-area customers, inviting them to visit the store for a free sample on Wednesday. The chain limits the offer to the Boston area through area code and other data.

But it just so happens that there’s a huge convention in San Jose that day of the Society Of People Who Live In Boston. Your San Jose locations get flooded with people asking for their free gift, leading to a lot of baffled employees and angry customers. This observation comes courtesy of a colleague who has far too much time on his hands to think up such things.…

Examples abound: Intrusion alerts that are ignored due to lack of staff, firewalls with rules that are out of date, intrusion detection systems that have not been tuned to minimize the false positives, encryption keys that are never changed, privileged users who have permissions left over from prior projects, terminated employees who still have logins and policies that are not enforced. Fixing this stuff is not expensive, but it's not fun either.Read more...

Homa called a news conference to detail some of those planned security improvements, including Triple DES PIN encryption ("customer card information is now encrypted from the PINpad at the store register and remains encrypted while it's in our own internal network"), host and network intrusion prevention systems ("to proactively prevent malware from being installed in our systems") and better payment segmentation. Read more...

Wal-Mart executives this week promised Arkansas legislators that any product with a radio tag would be clearly labeled, as the retail giant tries to put the inventory-tracking devices on all products sold at Sam’s Clubs by 2010, according to this BusinessWeek story.

After checkout, customers would have the option of removing the labels containing the tags, Wal-Mart told the state legislators. “If a manufacturer installed the tag inside a container, workers would be able to deactivate it before a customer leaves the store,” the story said.…

A difficult to duplicate RFID chip? That’s the claim of an RFID startup, which is using MEMs resonators to create a unique signal, or “voiceprint,” which can’t be cloned and can be used to authenticate the chip, according to this RFID Update story.

“Each voiceprint is unique but falls within a defined band so separate readers do not have to be developed for each chip,” the story said. “However, MEMflakes can’t be read with RFID readers currently on the market.” …

The key argument of the report is that none of the three groups of companies involved—the card brands, the issuing banks and key retailers—is spending the dollars to create true incentives to make contactless payment work, said lead report author Bruce Cundiff, who is Javelin's director of payments research. "There is no effective value proposition for merchants and for wireless carriers," Cundiff said. Read more...

One of the most annoying parts of many a casual restaurant outing is at the end, when you just want to say “Check, please” and all wait staff seem to sense this and decide instead to join the Waitress Relocation Program.

Microsoft has decided to help (OK, they smelled money in those missing food servers) and created a device that permanently sits on the table. Redmond is backing this hardware that can take payment, print out a receipt and do it all without having to catch anyone’s eye. It allows the tip to be added (minus a deduction for subjecting you to the machine), and it can show various promotions. (OK, so having mandatory TV commercials when you’re dining out is probably not a good thing.) It also has a button to summon a manager if there’s an issue.…