Evan Schuman's StorefrontBacktalk

The cascading problems were the result of Amazon's efforts to promise continuous availability of its cloud storage. That meant no downtime for maintenance windows—Amazon's network techs had to work without a net, and this time they were unlucky. But a dive into the details of the outage suggests that a cloud like Amazon's may not be worth the risk, or even offer an advantage, for big retailers—even though Amazon itself is one of the biggest.Read more...

Even Visa late last year reclassified franchises for PCI purposes, bowing to the new realities. The issue behind almost all of these incidents is the struggle around who gets to decide IT moves within a franchisee operation.Read more...

When Square simultaneously accepted a hefty Visa investment and then reversed course to match Visa’s position last week, many observers were trying to make sense of the move. What made Square so attractive to Visa? One industry observer—longtime payments power-player John B. Frank—has an interesting, albeit non-traditional, take. He argues that Visa’s affection for Square has little to do with Square and everything to do with Twitter. Indeed, Frank’s argument is that it was all about Jack Dorsey (Twitter Founder/Executive Chairman and Square Founder/CEO) and his ability to make Twitter deals happen.

“Shout out to Verifone: If it makes you feel any better, I’ve got a feeling, that Visa isn’t as interested in Square as they are in Twitter’s 200 million base,” Frank penned. “If Goliath was going to invest in David, why not a David with a PCI-certified personal POS? It’s because David isn’t really David after all. David is Goliath. Square is Jack Dorsey and Jack Dorsey is again Twitter. It’s all about P2P (person-to-person money movement) and this is Visa making a brilliant P2P investment/move.” Not so sure I buy into this very original theory, because I don’t see Visa connecting the dots with Twitter that aggressively—yet. Still, if it’s wacky and conspiratorial and it involves Silicon Valley today, well, it’s hardly wise to rule it out.…

Details of the attack were spelled out by Sony executives at a Tokyo news conference on May 1 and in written testimony to a U.S. Congressional committee on Wednesday (May 4). As with most attacks, plenty of things went wrong to give thieves their opportunity. But the timeline makes two things very clear: Sony's online store provided the opening that allowed thieves collect huge quantities of personal information on customers—including names, addresses, birth dates and E-mail accounts—and the attack depended on an unpatched hole in the E-Commerce system.Read more...

Best Buy won't say who the vendor is (except that it's not Epsilon or Best Buy's current lead E-mail marketing provider, ExactTarget), how many customers were exposed in the breach or how long ago the vendor was fired—just that the chain is taking legal action. But the situation is one that should make every retailer nervous. It's almost impossible to know for sure that an outside vendor has destroyed all copies of customer data once a business relationship ends. After all, that's extra work to put in for a client who's not going to be paying for it.Read more...

This is both good news and mediocre news. It’s good news in that major players are at least trying to tackle some of the toughest issues facing retailing today. (The other most challenging retail tech issue today—mastering social media content and marrying it with CRM data—is also being tackled this month, by Wal-Mart. Not unlike eBay's pragmatic challenges with local inventory, Wal-Mart is discovering that there's a reason social media data efforts are feared by so many in IT. It's genuinely difficult stuff.)Read more...

Automation is always about cutting out human labor, but just piling it on without fully integrating it into a store's operation is bound to generate problems—in this case, potentially huge problems. No one actually backed up a truck to haul away everything in the store. But that depended on the goodwill and honesty of customers, which is not something any chain can count on.Read more...

A blind call-center worker on April 12 sued a Maryland county government over a job downgrade and pay cut after the county merged its non-emergency call centers but didn’t preserve screen-reading technology. Yasmin Reyazuddin, a multilingual information specialist, said she researched the necessary configuration changes after the county bought Oracle’s Seibel CRM system, but when she raised questions about the switchover she was demoted, moved to a non-call center job and told her pay would be reduced. She wasn’t even allowed to try the system to see if she could use it anyway.

Wait—there’s a call-center employee who’s already using assistive technology, is capable of researching whether the new system can be made accessible (according to Oracle’s documentation, it can) and is willing to look for a workaround for any problems. And that’s the employee IT can’t figure out how to accommodate in the project plan? That isn’t an employee you bury. You loan her to IT to figure out the cheapest way to get a screen reader working and then end up collecting good publicity instead of a federal lawsuit.…

StorefrontBacktalk will launch its Premium Edition on April 18, just four days from now, on Monday. The reason we’re mentioning this again is to remind everyone that we are offering special 50 percent off pre-launch pricing. In other words, the exact same Premium service on April 18 will cost half as much on April 17. If you want to still have full access to all of our top stories (and all of the other goodies that come with the Premium subscription), doing it now is the cost-effective move.

Our site license options are also half-off during the pre-launch period (which has barely four days left). Our fear is that many readers will not focus on this until April 18, when they start running into firewalls when they try to read key stories and columns. And when they then subscribe, they won’t be able to take advantage of the pre-launch deals. The pre-launch deals were created specifically to give our long-time readers a break, so we want to make sure we do everything we can to remind everyone before it’s too late. To take advantage of our pre-launch deal, please click here.…

Epsilon is merely the latest in a series of publicized, highly embarrassing incidents for retailers where they are taking a consumer black eye for breaches, ethically questionable activities or gaping security holes that were entirely handled by third parties. Whether it's supply-chain management holes perpetrated on a multi-billion-dollar retail chain, SEO efforts against JCPenney or data-backup screw-ups that crippled the American Eagle Outfitter's site for eight days, retail IT execs are learning that as long as they are going to be blamed for what third-parties do in their names, they might as well take a much more active role in beefing up protection of all customer data.Read more...

Wal-Mart's initial move will include 23 Pennsylvania stores, using the state's own self-serve wine kiosks. These kiosks have had mixed results, with some wine enthusiasts pushing back against the machines. But those are not legal issues and, believe me, these machines offer enough such issues to keep entire law firms gainfully employed.Read more...

But instead of trying to shore up the popular but aging SecurID system, there's a better way for RSA to go: It could just publish the hashing algorithms and convert its SecurID users to mobile devices that could be updated on-the-fly at any time. That would eliminate all the advantage gained by the thieves who stole RSA's secrets, while making things more secure for SecurID users.Read more...

Sean Bunner, HSN's Operating VP, echoed Kinzey's sentiment. "It's such an early channel to get so granular. There's some overall trend stuff we're more interested in, like 'what category of merchandise are they purchasing?' From what we've seen, mobile is significantly different than Web or, for us, TV," he said. "But even within mobile, between mobile Web and apps. You see pretty significant shifts in categories, so we then have to get into CRM activity to see 'Why is that?' Do you want to merchandise that store differently?"Read more...

The patent itself is fairly straightforward, in that the system assumes software will activate the group of cards by scanning (or keying in) the first card number, along with the number of cards sought. The patent spoke of variations of this approach: "The point-of-sale device can request a confirmation of the last number in the pack of cards. Thus the clerk can either swipe or hand key in the number of the last card that makes up the pack of cards," the patent filing said.Read more...

Google has reached into users' mobile devices at least once before to delete apps in the name of security. Most users may not mind—certainly not as much as, say, Amazon reaching into their Kindles to delete mistakenly published e-books. But for retailers that want to use an Android device as a point-of-sale unit, the ability of a vendor—or any outsider—to modify the device by long distance could make getting a QSA's approval impossible.Read more...

Achieving PCI compliance in a cloud-based environment will involve some intense negotiations between the merchant and its cloud provider. If a merchant is neither willing nor able to dig into the details and maybe do a little arm wrestling with its provider, moving a payment application to the cloud is not for that merchant. Negotiating a detailed, comprehensive service level agreement (SLA) will be perhaps the most important single step to achieving PCI compliance in the cloud. But before you can even begin to develop an SLA, a merchant needs to understand who does what. That is, the first thing you need to know is which services will be provided by the cloud provider and which are the merchant's responsibility.Read more...

The IT issues—which Crocs apparently did not dispute—never played a crucial role in the arguments, with the judge throwing out the case because he said the shareholders couldn't prove that senior management lied about these matters. That said, it's educational how close a linkage the shareholders drew between routine IT issues and critical financial shortcomings. Excel spreadsheets, for example, were blamed for product shortages and surpluses.Read more...

The majority—if not the vast majority— of recent StorefrontBacktalk stories will still be available to read for free. So will our highly moderated discussion forums, which won't waste your time with spam and vendor pitches. But readers who aren't Premium subscribers will only be able to see the very beginning of Premium stories and columns—and they won't have any access at all to the Premium forums, private discussion groups, monthly reports or the archives of StorefrontBacktalk stories that are more than 30 days old.Read more...

It's called Beyond The Story because our discussion forums thus far have been limited to comments on individual stories. And we policed those comments strictly, making sure that they were indeed about the story they were attached to and that they were non-promotional, non-offensive and respectful. (Well, as respectful as IT professionals debating RFID, PCI, CRM and Mobile are likely to get. We don't seek miracles here.)Read more...

That's definitely not the kind of problem any retailer wants when it comes to payments processing. You expect that a startup will have to build a customer base, service infrastructure and even technology from the ground up. None of which is easy. But Square's story turns out to be one that mixes friendship, betrayal, electronics, glass blowing, legal shenanigans and Rashomon-like conflicting stories. In short, way more drama than retailers want from a vendor, even one with interesting technology and the promise of cutting the cost of payment-card processing. When it comes to payments, boring would definitely be better.Read more...

This sort of retro attack (it's like the Pong of computer break-ins) would be charming, except that it's growing rapidly. A year ago, almost no attackers used Telnet. But by the third quarter of 2010 (the last period for which Akamai has released data), Telnet attacks had jumped to one out of every six attacks.Read more...

The clues are in the mismatched description on Target.com for the product, which the small print describes as the "PlayStation Move sharp shooter." It turns out there is a new add-on for the PlayStation with that name. According to Sony, its list price is $39.99 (which matches the Target.com page) and it is scheduled to be available in February (which matches the description on Target's page that reads, "Arriving soon! Order now for shipment in 2 to 4 weeks").Read more...

Timothy Kasbe, a celebrated IT exec who arrived at the chain in February 2009 after having served as the CIO of India's largest retail chain, quietly left the company early last month. Very quietly.Read more...

Walt's first request is for the PCI Council to publish a full, one-year schedule of training sessions. The Council's training programs are excellent. Because of that, they are very popular and fill up quickly. As of this writing, the Council has not yet posted future training classes on its Web site. When that list is posted, Walt's wish is that it be a complete schedule for all 2011 courses. Read more...

The ability to quickly scale up processing power is one of the chief attractions of cloud computing, and there's no doubt it works in at least some cases. For example, Amazon's ability to ramp up capacity via the cloud doesn't just keep the E-tailer rock solid during the holiday peak; it also probably keeps it going in the face of denial-of-service attacks. Still, getting everything in the cloud working correctly to handle a sudden surge isn't as easy as cloud boosters make it sound—and Tesco is Exhibit A.Read more...