Evan Schuman's StorefrontBacktalk

A semiconductor company is suing a Dutch university to keep its researchers from publishing information about security flaws in the RFID chips used in up to 2 billion smart cards, according to this intriguing Computerworld story.

NXP Semiconductors filed suit in Court Arnhem in The Netherlands against Radboud University Nijmegen. The company is pushing the courts to keep university researchers from publishing a paper about reported security flaws in the MiFare Classic, an RFID chip manufactured by NXP Semiconductors, the story said.…

Although the question of RFID safety has been debated extensively over the years, with conflicting study results, a major new medical study released this week points to very specific electromagnetic dangers within nine inches of the transmitter.

The highly respected Journal of the American Medical Association (JAMA) found 34 electromagnetic interference instances out of 123 tests, with 22 of them rated potentially hazardous. “Interference changed breathing machines’ ventilation rates and caused syringe pumps to stop” at a distance of about nine inches, according to a story in The Wall Street Journal. This may give serious pause to some retail IT operations, who can have dozens of RFID devices in loading docks and assembly lines, in addition to trucks and even on shelves. …

A UK company is pushing retailers to use voice-recognition to authenticate purchases over the phone and online.

The Voice Commerce Group’s Voice Transact package has consumers call the service, quote a pre-arranged product code and then a series of digits dictated by the automated system. Verizon is involved in the rollout. VCG CEO Nick Ogden was quoted in E-Commerce Times saying that there are “current problems with the system, the biggest of which was interoperability between different banks’ systems and the standards used in the technology.”…

Since almost no one can afford to add another group of people with both auditing skills and IT skills, nor can most retailers afford to pay consulting firms to do this, I tend to recommend very specific PCI audit training courses for your internal audit staff. One way to do this is to send them to the same two day course that PCI auditors go through. Read more...

One of the repeated arguments made in retail data security circles is that retailers tend to have much weaker security because it’s not as much of a cultural priority as, for example, banking. So it’s a little bit consoling that the latest ATM databreach is apparently not the result of a retail breach, not the result of social engineering and the trusting bank clerk, but is the first proven incident of a bank server’s breach linked to ATM fraud.

A computer intrusion into a Citibank server that processes ATM withdrawals led to two Brooklyn men making hundreds of fraudulent withdrawals from New York City cash machines in February, pocketing at least $750,000 in cash, according to a Wired story. Although Citibank told Wired that its systems had not been breached, Citibank “warned the FBI on February 1 that ‘a Citibank server that processes ATM withdrawals at 7-Eleven convenience stores had been breached,’ according to a sworn affidavit by FBI cyber-crime agent Albert Murray.”…

At some point in the last decade, nearly every organization involved in electronic commerce did an evaluation of payment gateways. So, what's changed? Read more...

Are European retailers going to have any better luck than American retailers with consumer-facing biometric payments? The 750-store Albert Heijn supermarket chain, the largest such chain in the Netherlands, is about to find out.

While various European chains (such as Germany’s Wagener Department Stores) have enjoyed modest success with biometrics, the Albert Heijn chain’s June 17 statement said it would commit to the trial for six months.…

San Francisco-based U.S. District Court Chief Judge Vaughn R. Walker gave lawyers on both sides until June 26 to address his concerns. The judge didn't specifically say that the lawyer's fees were too high, but merely that "plaintiffs' counsel has not established the basis for its fee request," leaving himself the opportunity to potentially approve the figure if he is satisfied with a justification. Read more...

A Verizon Business security report analyzed more than 500 data breach incidents over four years and found that 73 percent started from the outside and only 18 percent were inside jobs. Read more...

The hypothetical Nordstrom example shows how much less respect is paid to the online consumer than the brick-and-mortar one. Does the inherent anonymity in the Web cut both ways? Like the site visitors emboldened by their namelessness who post comments and get into flame wars that they would never have the nerve to try in person, are E-tailers treating their customers with a disrespect that they would never dare consider in a physical store? Read more...

The 74-page settlement outlined several efforts by Ameritrade, but it did not include any cash payments to the consumers who sued the company. Among the agreements were that Ameritrade will warn consumers about investment SPAM, pay for limited security testing, seed E-mail accounts seeking violators, pay $20,000 to the Honeynet Project and $35,000 to the National Cyber Forensics and Training Alliance as well as buy some of the impacted consumers a one-year license for an Ameritrade-selected anti-SPAM software package. Read more...

"Whether we're talking about logs generated by network or application firewalls, intrusion detection systems, file integrity monitor tools or the operating systems themselves, I've come to the conclusion that the only people who don't hate them are the vendors who sell them. But, whether we hate them, disrespect them or merely ignore them, we need to learn to live with them." Read more...

"One thing that is true about Amazon's site is that it is very complex, utilizing numerous backend database, proxy servers, distributed application and Web servers, lots of dynamic images, etc.," said Shawn White, director of external operations at Web site performance tracking firm Keynote. "Even accessing the homepage involves complex multi-step interactions between the Web browser and a number of backend systems within Amazon." Read more...

The new proposed law—which passed both the House and Senate this week and is awaiting President Bush's signature—essentially removes the expiration date requirement of the law. So assuming the president signs it into law, the bill just got a lot easier to navigate. Read more...

MasterCard Canada this summer will start a 4-month NFC-phone trial, with the backing of some of Canada’s largest retailers, including Loblaw, Petro Canada, Tim Hortons’, Pioneer Petroleum, Rabba Foods, a major NHL arena and McDonalds.

One unusual aspect of the trial is that it will eventually support more than one payment card on each phone, said MasterCard Canada’s Nagesh Devata.…

PCI's plan to address these vulnerabilities had been delayed for two years, which has crippled compliance efforts. As the requirement is about to kick in in June, merchants are not thinking so much about PCI, unless their annual PCI compliance review date happens to coincide with the PCI 6.6 effective date. Read more...

The employee has been dubbed a whistleblower and it's been suggested that TJX was wrong to have terminated the guy. In this case, I have to stand up for TJX: They were completely within their rights to terminate this employee. As for the charges themselves, those are dramatically more troubling. Read more...

A handful of grocery chains—including PriceChopper and Wegmans—have started using CRM data to alert customers to product recalls. It’s an encouraging move to convince consumers that loyalty cards can be used to help them beyond taking 10 cents off a gallon of milk.

The program at PriceChopper—a 116-store grocery chain in New York, Connecticut, Massachusetts, New Hampshire, Pennsylvania and Vermont–is especially interesting as it uses an automatic phone-calling system to instantly and simultaneously reach out to impacted customers. Last month, the system was used to reach out to some 12,000 customers about a recall of Samuel Adams beer due to glass fragments, according to this intriguing report in the Daily Gazette, a daily newspaper from Schenectady, N.Y..…

So when she places the barcode-less fruit on the scale, the first fruit it displays in its list is kiwi, followed by the four fruits and vegetables that Jane typically buys. Other fruits and vegetables follow alphabetically after Jane's favorites have been displayed. Given how many fruits Jane buys each time, this shaves a precious 108 seconds off of her checkout. Read more...

But there really is no reason to wait. Why? The proof is in the tracking tools. Whether the 1.2 release of PCI DSS in October 2008 specifically addresses server, network and desktop virtualization is less important than being able to provide proof to your PCI assessor that you can control, manage and track access to card data continuously.Read more...

The grocery challenge with the theft of moist, fresh products–such as cheese–has frustrated retail loss prevention managers because such products tend to react poorly with EAS tags. Checkpoint and Sealed Air Cryovac announced Wednesday (May 21) one possible way around this issue.

Cryovac has started to integrate anti-theft labels inside the vacuum shrink bags. “The first market request to Sealed Air Cryovac was for two million packs for the protection of Parmigiano Reggiano. In Italy, for instance, Parmigiano Reggiano has a shrink rate of about 9 percent,” said a joint statement. “Initial studies have shown that this RF-EAS source tagging program may cut down inventory shrinkage of dairy products from 9 percent to 1 percent.”…

A pair of British shopping centers is experimenting with a creative way to leverage consumer cellphones. The consumers are being surreptitiously tracked by the signals emitted by all mobile devices and a database notes when consumers “enter a shopping centre, what stores they visit, how long they remain there and what route they take as they walked around,” according to a report in The London Times.

A spokesperson for the vendor behind the trials–Path Intelligence, of Portsmouth–said its equipment was just a tool for market research. “There’s absolutely no way we can link the information we gather back to the individual,” a spokesperson said. “There’s nothing personal in the data.” But their system does apparently grab a consumer’s phone’s unique IMEI number, which is found on all GSM and UMTS mobile phones. The carrier would theoretically have the data to match it to personally identifiable data.…