Evan Schuman's StorefrontBacktalk

Last Wednesday (Sept. 2), TJX struck quite a bargain and settled with the handful of remaining banks. In settling all charges with four different financial institutions—AmeriFirst Bank, HarborOne Credit Union, SELCO Community Credit Union and Trustco Bank—TJX agreed to pay $525,000 to be split between the four businesses. Was that punitive or was that something closer to a nuisance payment for the $19 billion retail chain? Punitive would generally mean covering all legal costs plus reimbursing the banks for all out-of-pocket costs and then paying them something to compensate them for the pain of the litigation. The payment specifically excluded legal fees. According to the statement TJX issued, the settlement didn't even cover all of the banks' out-of-pocket expenses let alone offer anything for their efforts. Oh and it also allowed TJX to say that it "has denied all wrongdoing." The amount enough that it was already covered in a reserve that TJX took back in the second fiscal quarter of 2007.Read more...

But what does any of this have to do with M-Commerce? A lot. If they finally get around all of the technical and logistical hurdles of M-Commerce, they will be trying to get millions of consumers to interact with their sites—via their phones—and see product lists, read reviews, watch multimedia demonstrations, interact with social sites, download PDF instruction manuals and even ask their peers for feedback on their shopping choices before consummating those purchases. That's all great, but—if successful—will it turn the Home Depots, Walmarts and Targets of the world into examples of what may become known as "The AT&T Factor"?Read more...

In the Gonzalez plea bargain, the agreed-to sentencing recommendation—which calls for at least 15 years in prison and "no more than 25 years" in prison—does not seem much more lenient than he would have faced at trial. Even with as extensive a cyber attack as these, most U.S. courts wouldn't go anywhere near "more than 25 years" in cases where no one was physically hurt and the defendant wasn't accused of real violence or threatening violence. But a jury is a tricky animal and, technically, the counts he is pleading guilty to have a cumulative maximum sentence of 193 years in prison. Read more...

"Since the government agents ultimately decide how much to actually take, this will create a powerful incentive for them to seize more rather than less: Why stop at the list of all baseball players when you can seize the entire Tracey Directory? Why just that directory and not the entire hard drive?" the panel asked rhetorically. "Why just this computer and not the one in the next room and the next room after that? Can’t find the computer? Seize the Zip disks under the bed in the room where the computer once might have been. Let’s take everything back to the lab, have a good look around and see what we might stumble upon."Read more...

Look for Gonzalez to officially plead guilty to the federal charges from Boston, primarily involving TJX, BJ's Wholesale Club, Boston Market and Sports Authority and New York, primarily involving Dave & Buster's, on Sept. 11.Read more...

At its simplest, the technique is quite easy to do, which is why it's best to be avoided. The site visitor simply modifies the URL of the page he's visiting. If the stars align, the retailer's server will cache that page, grabbing the rewritten page heading with it. The next consumer that comes along and seeks that page will likely be shown the modified page.Read more...

In the trial—conducted over 13 weeks and published Monday (Aug. 24)—looked at a non-item-level store (the control store) and one item-level store and the same limited product area (denim jeans) were examined for both.Read more...

If a retailer will invariably be declared non-compliant after a breach, what's the point of doing the assessment right? Turns out, there are quite a few points.Read more...

The Missouri law is similar to most other state laws dealing with data breach notifications, but it includes medical and health information, data the states usually don't mention because it is protected by the federal Health Insurance Portability and Accountability Act (HIPAA).Read more...

As details trickle out about how the feds supposedly broke the Gonzalez attacks against TJX, Hannaford, Heartland, 7-Eleven and tons of others, much of it focuses on a global effort to access servers and laptops overseas and doing so in countries where U.S. law enforcement cooperation is perhaps not what it should be.

Wired did a wonderful piece, summarizing federal filings in the New York part of the Gonzalez accusations (this is the Dave & Buster’s case). The story details the chase for a laptop in Turkey and the legal and police bumps along the way. Nothing new revealed for retailers trying to protect their networks, but it’s interesting background nonetheless.…

Such a drama is now unfolding with the Albert Gonzalez case, the Miami man accused of breaking into TJX, Hannaford, Heartland, Barnes & Noble, Sports Authority and a laundry list of others. Is Gonzalez the masterhead of a cyber thief ring? Was he coordinating different teams in the U.S., each group assigned to attack different retail chains? Or was he merely the pawn of an Eastern European data theft syndicate? In Dickensian terms, was he more Fagin, the Artful Dodger or even Oliver Twist?Read more...

But the indictment revealed several key contradictions with 7-Eleven and Heartland and one major retailer's security executive found the government's specifics to be a convincing indictment against PCI.Read more...

Now MasterCard is taking what can only be called a “get tough” policy, issuing larger fines and, most significantly, forcing both Level 1 and Level 2 merchants to use assessors rather than take on the task of self-assessment. But still, opines PCI Columnist David Taylor, merchants, banks, processors and service providers aren’t happy with MasterCard. They just can’t seem to get a break. After numerous conversations with companies on the receiving end of MasterCard’s “get tough” efforts, Taylor thinks it's all a difference of philosophy.Read more...

Retailers tend to get so caught up in their global rollout plans and product strategy that they often forget to look at things from the store owner's perspective. That phrase is what many franchisees hear when talking to their chain hierarchy about all the great things that the brand wants to do with detailed data from the store. “By analyzing the data that we collect from these various sources, we will be able drive sales far more effectively.” But, similar to other grand plans they have been sold in the past, franchisees are skeptical that that yellow brick road is so easy to follow.Read more...

With social networking becoming a critical tool in the E-Commerce director arsenal—whether that’s Facebook, MySpace, YouTube or Twitter—the power of a tiny piece of programming called a URL shortener is something that retailers would rather not leave to chance. Given how easily the tools can be used to secretly ship a customer to an unintended Web address, security is a factor, too.

With this in mind, Web site uptime firm Pingdom tested them against each other. For speed, the fastest to the slowest were ls.gd, Bit.ly, Ow.ly, Su.pr, TinyURL, Twurl, Tr.im, Cli.gs and the slowest—by a decent margin—was Snipurl. But the report also looked at reliability: “Perhaps even more important than how fast these services are (many would argue a few hundred milliseconds in load time won’t make a huge difference) is how reliable they are. Once a short URL has been created, how much can you trust that it will work and keep redirecting to your target site?” The reliable ranking, from most to least, was Ow.ly (the only tested service that suffered zero downtime), Bit.ly, Su.pr, TinyURL, ls.gd, Snipurl, Cli.gs, Twurl and Tr.im.…

Many of the wording changes are subtle. For example, the revised document says the standards apply to persons "who own or license personal information about a resident" of Massachusetts. The prior version of the sentence said the regs apply to those who "own, license, store or maintain" the personal information.Read more...

But the more important question raised in the report is whether those merchants have an unrealistic sense of how vulnerable they are to data breaches. The problem is that the report didn't sufficiently track who said what, making it impossible to determine whether any one merchant's appraisal was legitimate or not.Read more...

Instead, the U.S. M-Commerce space is floundering as merchants drag their feet deploying purchase-capable mobile sites or find their mobile initiatives stalled by an avalanche of obstacles beyond the anticipated mountain of incompatible platforms and mobile browsers. The problems encountered are legion. They include a vacuum of standardization for everything from design, programming, payment processing and even URL naming to fears about carrier conflicts over the types of permitted content and a Catch-22 business strategy about how much, and when, they should embrace M-Commerce.Read more...

Going through the ritual of filling out shipping and payment forms on a regular E-Commerce site is annoying enough, but being forced to do that same dance on a mobile device can be downright cruel. But a true M-Commerce site must allow visitors to not only find products with their mobile devices but to also buy them. That forces retailers to choose from among four not-especially-attractive checkout options.Read more...

That's because data security may be a high priority in the abstract, but compared to “keeping the business running” types of concerns, it typically drops off the bottom of the list of things to spend money on. Why? Because small businesses do not believe they are going to have a data breach.Read more...

This begs the question: How does an IT department successfully deliver retail technology that meets the needs of both a franchisor and the chain? Both sides need to change the way they think about large-scale IT projects. StorefrontBacktalk's new Franchise IT Columnist Todd Michaud contends that this is a lesson that shouldn't be ignored by non-franchise chains, too, as today's reality of Web-enabled, mobile-fueled, social-network-infested high-turnover low-margin is forcing everyone to play by very different rules or to die not trying.Read more...

Payment processors seem to be all marching to the same end-to-end encryption tune, although each is arguing that its version is different. Following Heartland’s announcement of an end-to-end encryption effort for its customers by the end of the year, EPX and RBS separately this week announced their own versions.

EPX on Monday (Aug. 10) offered up a version that tries to meld encryption and tokenization (“We’re disputing that encryption is the safest way to go,” said EPX COO Matt Ornce. “The sooner you can get it tokenized, the better”) while RBX on Tuesday (Aug. 11) announced that it would be using VeriFone’s VeriShield Protect as its end-to-end for encrypting payment card data. …

"The noncompliance assessment structure now contains escalating assessments per violation within a calendar year," said the document sent to members earlier this summer. "Maximum assessments for initial noncompliance for Level 2 and Level 3 merchants have increased to $25,000 and $10,000, respectively. Furthermore, the $500,000 annual aggregate maximum for acquirer noncompliance assessments related to program noncompliance has been discontinued."Read more...

Heartland Payment Systems on Tuesday (Aug. 4) said it spent $32 million this year paying for costs related to the major data breach it disclosed in January, including $22.1 million to cover fines from key payment card brands and a settlement offer. Heartland did not say how the $22.1 million was split between the fines and the settlement offer, but it did provide clues.

For example, the breach costs of just the second quarter came to $19.4 million and it said that the “majority” of those costs was for the settlement offer, suggesting that the settlement was more than $9.7 million. Legal fees make that precise calculation tricky as well as the lack of a percentage of that majority. “The remainder of the expenses and accruals related to the Processing System Intrusion recorded in the three and six months ended June 30, 2009 were primarily for legal fees and costs the Company incurred for investigations, remedial actions and crisis management services,” Heartland said.…

At the end of July, Network Solutions revealed a massive breach, impacting some 574,000 consumers and more than 4,300 retailers. So to their marketing department, what a better time to proclaim a new commitment to quality?

In a note sent July 29—just days after the breach was disclosed—the marketing team was positively ecstatic: “On or around August 1, 2009, much of the hard work we’ve been doing to improve your overall Network Solutions experience will be on full display.” Probably a bit more candid than anticipated. An equally good line from the letter: “We‘ve received an overwhelming amount of valuable feedback which is driving a reinvention of our company.” That has got to be the world’s best marketing phrasing to describe an angry mob.…