Evan Schuman's StorefrontBacktalk

When the world's largest retailer struggles with a database issue, the numbers can be a bit daunting. It's datawarehouse, for example, is larger than 4 Petabytes. That's more than 4,096 TBytes, give or take a few million bits.

The chain has more than 6,000 stores, with some having almost a half-million SKUs each. You think your Excel spreadsheets are bad? Wal-Mart's database tables have literally 100 billion rows. The retailer's POS systems have to ring up some 276 million items—a day.

This peek into the IT operations of this $345 billion retail empire comes courtesy of a phone interview with Wal-Mart Chief Technology Officer Nancy Stewart.

Ingrian Networks this week introduced a "60-Day Program For Compliance," that puts together PCI consulting and software "in order to bring customers into compliance in 60 days or less." Yes, Virginia, there is a devil.

In this case, the devil is in the details (as well as in an executive office at Ingrian). The Ingrian statement implies, suggests and does everything possible to suggest that it will deliver compliance "within 60 days or less." Never mind that it's reckless to make such a comment without knowing the particulars of the retailer's system and the problems that have to be remedied.

Retail security managers are nervous and some may fall for this pitch and not ask, "Does this claim make sense? Does it pass the laugh test?"

As the big Sept. 30 deadline for retailers to comply with credit card security rules, Visa and others ponder the carrot-and-stick argument.

A few days ago—on July 31—it was the deadline for some 6 million of the nation's smallest retailers to report whether they're compliant with PCI standards. It's an interesting group called Level 4.

Although it's the group that includes the smallest merchants in the U.S., many of them are not that small. It could include a retailer that makes 999,999 Visa transactions a year, including as many as 19,999 E-Commerce transactions. So it's important to remember that this group isn't solely mom-and-pop hardware stores and Oliver's Bait Shop.

Last month’s report of a LAN administrator at Fidelity National Information Services who stole 2.3 million customer records may have understated the situation, with a new SEC filing placing the number of names taken at 8.5 million.

According to a report of the filing in SecureComputing, “some of the stolen records only contained names, addresses, telephone numbers and birth dates, but about 5.7 million contained checking account numbers and 1.5 million included credit card numbers.”…

When Visa on Monday released its latest PCI compliance statistics, it showed small but steady progress, with slight increases in most areas. But it also showed that there is still a small handful of major retailers who are still retaining prohibited credit card information.

Visa stressed in its statement that the vast majority (96 percent) of Level 1 merchants—a category including virtually all of the nation's largest retailers—have written to Visa that "they are not storing sensitive account data" including credit card security codes and PINs. But given that Visa has said that there are 328 Level 1 merchants in the U.S., that four percent suggests that about 13 major retail chains aren't even claiming that they've stopped retaining that data.

Under the heading of "be careful what conclusions you draw," was chatting the other day with Greg Buzek, president of the IHL consulting group and one of the smartest retail observers working today, about self-checkout trends. Had written recently about IHL's self-checkout report and had questioned the Greg's suggestion that consumers love self-checkout.

Greg mentioned that beyond retail segment breakdown (grocery versus home supply, for example), a critical self-checkout area to consider is geography.

JCPenney has been experimenting with ways to bring online depth into its brick-and-mortars, with some healthy (107 percent sales boost) initial increases in test stores, according to this DMNews,com story.

The pilot–which was launched late last year in 40 stores–is interesting in that it matches some attractive numbers with bringing online into offline, but it’s unclear if the “this is different” newness factor was isolated. If it wasn’t, the sales bump might be more a result of the trial than what the chain would see in the longterm. Also, this appears to be true multi-channel–as opposed to the desirable merged channel–as the systems don’t appear to talk to each other. Still, it’s an encouraging step.…

The retail tendency to believe in one-size-fits-all simplicity is a failing. One needs look no further than PCI security enforcement, Web traffic analytics and retail self-checkout to see that.

But a new self-checkout study forces the issue. The study finds a tremendous success rate with self-checkout--which is fair and valid--but it didn't even consider the extreme differences between different kinds of retailers. Consider the differences between grocery chains--where self-checkout tends to be detested by consumers, who barely tolerate it--and home supply chains, where it is honestly embraced.

Are the brick-and-mortars that have materialized, hanging from the EBay empire, long for this world? This interesting AuctionBytes.com story out of London suggests they may have some hurdles.

The story details one company’s decision to shut down its EBay drop-off stores and will focus on home collection efforts. “The company’s main demographic are busy professionals who don’t necessarily have time to visit Auctioning4u’s shops and prefer the company’s handy home collection service; they want collections from their homes and business at times and dates of their choosing.” Interesting read.…

Is the dark cloud of multiple investigations still looming over TJX and its imfamous data breach? Yes, but it’s going to have some time to breath over the summer. While the various lawsuits and state probes continue, the threat of U.S. congressional hearings–threatened months ago–appears to be delayed until at least September, according to a congressional source who has asked that her name not be used.

Those hearings have been on the subcommittee plans for months, but have repeatedly been delayed. Although high hopes had existed for July hearings, the source said that other legislative priorities has forced “all other committement business to come to a halt.” With the August recess, that leaves September/October as the next possible timeframe. …

A hospital snack room in Michigan is an unlikely place for a fullblown item-level RFID trial coupled with biometrics, but the 24-hour needs of the facility created the need.

In this eye-opening Detroit News story, the Fast Track Convenience room at Garden City Hospital used RFID tags on all products to charge purchases by–among other methods–deducting cash value on employee ID cards. Employees who can’t grab their ID cards can instead use a biometric thumb scan. With vendor assistance, the project’s initial setup cost the hospital $25K. A story worth reading and thinking about. (Note: Look closely at the photo the paper shot on-site. Love the product-level warning label placed directly on the tag: “Remove Before Microwave Use.” More “fun with microwave oven” potential than I had anticipated with item-level tagging.)…

The bandwidth, input and software limits of smartphones makes even the most basic mobile purchases difficult. PayPal's market entry is a quintessential "more is less" strategy.

EBay's PayPal unit formally entered the mobile payment space Tuesday, arguing that their checkpoint gets more valuable as they reduce the number of features. (Now if only Microsoft could think that way.)

Tuesday actually marked the day PayPal issued a news release about MobileCheckout, which has been fully functional and available since June 11, a full month before the announcement, according to PayPal spokesperson Jamie Patricio.

Tired of various challenges with RFID? A pair of Pennsylvania inventors have been awarded a patent for an RFID-like tracking system that uses light instead of radiowaves. The argument is that it would be more amenable to a crowded warehouse and that it would be less susceptable to unauthorized intercepts.

Patent 7,232,067 (Registering Multiple Similar Items with Flickers) calls for LED tags that will emit visible light, infrared, or ultraviolet. .Read more...

New figures from IDTechEx, the British RFID analysis firm, predicts RFID spending to move sharply toward active tags.

Today, IDTechEx reports, active tags represent some 12.7 percent of the RFID market, a figure that it predicts will hit 26.3 percent by 2017. If cell phone RFID modules are added in, the figures get even more dramatic.…

After more than $75 million in bogus credit card charges, several Cuban nationals in Florida have been arrested with more than 200,000 credit card account numbers, many of which came from the TJX and Polo Ralph Lauren data breaches, according to U.S. Secret Service officials, commenting on Monday's announced arrests.

The numbers were sent to the Florida defendants—who specialized in manufacturing bogus credit cards complete with embossing, logos, holograms and properly encoded magnetic strips—from a group of Eastern European residents who specialized in collecting the stolen credit card numbers, the Secret Service said.

That Eastern European group of fiduciary Fagans obtained those numbers from many different sources, but many of the numbers were traced back to two specific major retail data breaches: last year's TJX breach and a 2005 Polo Ralph Lauren breach, said a Secret Service case agent involved in the investigation and who asked that his name not be used.

Noticed this interesting Bloomberg story about how well EBay's PayPal is faring against Google Checkout and *sighed* at how weak a foundation it was built on.

First, the story seems to be based on the statement that "In recent surveys, the world's largest auctioneer found that less than one out of five users of Google's Checkout online payment service was happy with it." But it doesn't say what those surveys were, who was being surveyed nor exactly what they were being asked nor when. Read more...

It’s that time of year to start thinking kindly about charities, especially if you steal credit card numbers for a living.

Symantec reports that it is seeing an awful lot of cyber thieves using charities as efficient ways to verify that their stolen numbers are valid. Traditionally, those thieves have used small retail online purchases to perform that verification function, but retailers have been cracking down on such practices while many charities are still more lax. Some charities, however, are starting get tough. The story reports that, last month, the Red Cross was forced to return nearly $7,000 that was donated in the course of 700 fraudulent transactions, said Carrie Martin, a spokeswoman for the American Red Cross.…

Fidelity National suffered the ultimate insider theft when an IT staffer sold about 2.3 million customer records to a marketing firm. But it's the low-tech way this techie did it that makes it interesting.

The company said that this was all orchestrated by one employee, who has thus far only been identified as "a senior-level database administrator who was entrusted with defining and enforcing data access rights." If someone wants to steal a database, that's the perfect job to have.

Despite—or is it because of?—this employee's technical expertise, intimate knowledge of the network and extreme access, he/she didn't break in, didn't do a transfer and didn't concoct such elaborate script to make data copies. "The incident does not involve any outside intrusion into, or compromise of, Certegy's technology systems," said a company statement. Here's the most fascinating part: "To avoid detection, the technician removed the information from Certegy's facility via physical processes; not electronic transmission."

Wal-Mart this week continued its campaign to push RFID throughout the industry, with this powerful Money Magazine story adding new some details.

The piece has Myron Burke, strategy manager of Wal-Mart’s store innovations and operations group, discussing a recent visit to a Wal-Mart equipped with on-floor RFID tagging. He reported that out-of-stock signs were discovered in 66 of about 200 total product categories within its electronics section. “With RFID, Wal-Mart management can now alert those store associates to fix the problem spots,” the story said.…

Visa has in the wings its own version of number portability, in a program that will allow “consumers to carry their account numbers with them if they move up to pricier and more exclusive cards, and merchants to offer new services and benefits, such as loyalty programs, to customers,” according to this InformationWeek story. (Note that my former employer needs to look at a calendar from time to time. This July 2 story references a TJX statement from “earlier this month.” It meant “last month.” They probably just lifted it from last week’s print edition and no one on the copydesk caught it.)

The piece quoted Visa Snr. VP Jim McCarthy as saying, “This allows us to take a specific action in real time based on consumer behavior at a specific merchant and a specific location.” Calendar issues notwithstanding, it’s worth a read.…

A key division of the Albertsons grocery chain officially abandoned its loyalty card program on Wednesday, officially saying that it wanted customers to be relieved of the burden of having to show a card to get discounts. Unofficially, the program got pulled because grocery managers weren't bothering to use the data.

To be fair, the decision for the Albertsons group that handles some 78 stores in Arizona, New Mexico and El Paso, Texas (Albertsons has any other groups for other geographies) was complicated. First, the chain's history has been marked by a strong and consistent resistance to any kind of CRM/loyalty program, with Albertsons being one of the last of the major retailers to launch a loyalty program when it tried it out in 2003. The chain is now going to try and push its new lack of a loyalty card as a reason for customers to shop there. But the truth is that the chain never saw a viable return-on-investment from the program. Why? As one Albertsons official—who asked to remain anonymous because of a fondness for a continuing paycheck--said on Wednesday, "The data was being collected but it wasn't being used."

Electronic payment vendor CyberSource has agreed to purchase fellow e-payment player Authorize.net for $565 million in cash and stock, the companies announced Monday.

Steve Rowen, a research analyst at Retail System Research in Miami, Fla., said the merger of these two players is not in and of itself earth-shattering or surprising, but the size of the deal does reveal a lot about retail interests.

"CyberSource acquiring Authorize.Net is a highly logical move. Is it an industry-changing deal? Not at all," he said, but a deeper look at the metrics behind data-theft suggests an importance lying elsewhere surrounding this $565 million deal.

In Sunday's New York Times, there's this intriguing piece talking about how E-Commerce sales are quickly running out of steam. Perhaps "intriguing" is the wrong word for it. A more apt term might be "dangerous" or "out-of-context" or ..... nah, I think I'll stick with "dangerous."

The piece is not dangerous because it reveals some deep, dark secret. It doesn't, not does it claim to. It's dangerous because it perpetuates the misguided—but commonly held—belief that online and offline retail efforts today are distinct. Even worse, it seems oblivious to the rapidly-increasing influence that each has on the other.

The story is built on stats showing a sharp decline in online sales. But those statistical issues are not the key problem with the Times story. The problem is that it still sees online and brick-and-mortar as rivals. The reality is that we are just starting the age of the merged channel.

Often transmitting unencrypted confidential customer data over weakly-protected connections, retailers risk privacy and create backdoors for cyber thieves. And yet, no one's giving the merchants much of a choice.

The best theoretical way to deal with these tests would be to use specially-created data that is not linked to any actual customers and is designed solely for the purpose of these kinds of tests. To date, no one has spent the time—nor the money—to create such data. That leaves retailers with few options and most use real customer data. Many in the retail industry see this as a recipe for security disasters.

"Some 90 percent of the retailers out there don't even realize how big a problem test data security is because they don't know the test environment," said David Taylor, president of the PCI Security Vendor Alliance. If auditors knew what to look for, "you could easily have 75 to 85 percent of retailers fail on this criterion alone."

For those of you who may be near Philadelphia next week, I'll be delivering the Keynote Address at a PCI Summit in the city of brotherly contempt on Thursday. For the moment, let's set aside the very legitimate question of why they asked me to keynote, given that it's hard to imagine scraping the bottom of the speaker barrel any more pathetically than to ask an ink-stained journalist to talk.

That's actually literal. A few weeks ago, I didn't check my pockets carefully and did the clothes washing with a blue pen still embedded. Voila! The perfect shirts to wear in full ink-stained wretch mode. Wretch Wear! I was delighted by the discovery. My wife much less so. Then again, I've been relieved of clothes washing for awhile so this might be seen as a win-win.