Evan Schuman's StorefrontBacktalk

Connecticut state legislators have backed off a plan–pushed by bank lobbyists and opposed by retail groups–to make retailers who are found to be at fault in data security efforts pay all bank costs, according to this fascinating Hartford Business Journal story.

Despite lobbyist arguments that TJX was merely a victim of the cyber thieves who orchestrated the data heist, Connecticut state Sen. Bob Duff wasn’t buying it. “I still blame TJX. They should be blamed, they should be sued, they should be fined,” he said.

But Duff did yield to the argument that such a bill would financially desrtroy small retailers and ultimately backed off. The Hartford Business Journal story gives us a great–and rare–peek behind the scenes at one state’s legislative maneuverings.…

The Staples Businesss Depot, which bills itself as Canada’s largest supplier of office supplies, is launching an RFID trial to test realtime inventory tracking, the chain announced Thursday.

The retailer said it plans to “tag thousands of items that will be dynamically tracked in real-time–at long range– from entering into store inventory, to store shelves, through to completion of the sales transaction,” according to a statement. “In addressing privacy concerns, the RFID tags are not concealed on the items and are re-usable. They are physically detached when the item is sold to the customer at a Staples Business Depot store.”…

In a psychologically fascinating "grass is always greener on the other side of the firewall" scenario, states see the industry's PCI as the perfect security standard. And retail CIOs are salivating for Sarbanes-Oxley-like controls.

This comes to mind as we look at two aspects of the PCI world this week. Recent reports about PCI have raised questions about how many retailers are truly PCI certified as well as problems with PCI administration itself, including conflicts of interest, inconsistent enforcement and retail confusion. But several states, including Minnesota and Texas, want to make PCI their state's legal requirement for retailers operating within their borders.

After months of investigation, the state of Connecticut sued Best Buy on Thursday and accused the chain of tricking customers with two identical-looking web sites in its stores, the only difference being one had higher prices.

"Best Buy treated its customers like suckers, not patrons to be prized," said Connecticut Attorney General Richard Blumenthal. "Best Buy gave consumers the worst deal: a bait-and-switch-plus scheme luring consumers into stores with promised online discounts, only to charge higher in-store prices."

This week, Minnesota became the first state to mandate PCI requirements for retailers who want to be protected from banks and credit unions for data breach losses.

The Plastic Card Security Act kicks in in August, according to this St. Paul Pioneer Press story. Minnesota is not likely to be the last state to put its weight behind PCI, with Texas, Massachusetts and Nevada–among others–heading down similar paths.

“It’s a credit-card world. If you’re in business in this day and age, you have to be able to accept credit-card and debit-card transactions,” Buzz Anderson of the Minnesota Retailers Association, which opposed the bill and argued for pushing back the penalty deadline, told the newspaper. The penalties from Visa and MasterCard can run to hundreds of thousands of dollars, he added, and act as a significant deterrent. Those penalties, he said, “would drive most small businesses out of business.”…

Industry efforts to set precise security standards have frustrated proponents with a patchwork of contradictory interpretations, auditors selling the services they're critiquing and frustrated retailers who can't jump through infinite hoops forever.

Said David King, CIO of Regal Cinemas: "This used to be the climate that we all lived with before Enron. (Accounting firms) not only did the audits, they also did taxes and evaluated risks. One division created revenue for another division."

As both technology and market demand are allowing retailers to truly customize, many of those merchants must start the painful and expensive integration process, says a new Forrrester Research report.

The promise of personalization—where stores in one neighborhood would have entirely different merchandise than one in a nearby neighborhood with a different customer mix—is nothing new. Retailers have been adding technology to their stores for years to test it out, in many different ways.Read more...

Leveraging existing Wi-Fi investments and applying it to asset tracking is behind an expect sharp and ongoing increase in Wi-Fi RFID tag shipments, according to a new report from market analyst firm In-Stat.

"Despite some hurdles to overcome, Wi-Fi RFID tag shipments will grow at more than 100 percent annually through 2010," In-Stat said. Added In-Stat analyst Daryl Schoolar: "Historically, one of the key weaknesses of this market has been the short battery life of asset tags," but technology advancements are making "multi-year battery life now a reality."

The $81 billion European retail chain Metro Group is moving ahead with its Asian RFID supplier program, promoting a kick-off program today for 30 partners at the Hong Kong Science & Technology Park.

The "Tag It Easy" pilot is officially part of an initiative that Metro is calling Advanced Logistics Asia (ALA), which helps consumer goods manufacturers to apply RFID labels on shipments from Hong Kong to Germany.

The $5.3 billion European chain Woolworths has switched CIOs, with CIO Stephen Bradley resigning “to pursue consulting and charity work,” according to this interesting ZDNet Australia story.

Woolworths has promoted its GM of IT, Daniel Beecham, to the CIO slot, promoting the 12-year company veteran on May 14. His first priority, the story said, will be to complete a new POS rollout across the chain.…

When the Texas assembly this month unaninously approved a bill mandating PCI compliance, it set in motion a potentially interesting retail security development.

The state bill–which still needs the blessing of the Texas state senate and the Texas governor-doesn’t directly impose penalties on non-compliant retailers, but it does shield compliant merchants from banks trying to collect damages, a protection that is explicitly missing for those can’t prove PCI compliance.

If other states take their cue from Texas, it would cerainly give additional teeth for PCI compliance programs, but it wouldn’t necessarily solve the problems that is causing so many retailers to not comply. It’s also not clear how national retailers would be impacted. Could banks simply sue somewhere outside of Texas? But if other states start to adopt, this could get very interesting very quickly.…

As mobile computing devices start invading in-store operations—both what customers bring into the stores and what the stores will hand to those customers—the very nature of in-store networking is likely to undergo a dramatic change.

Consider this scenario: A customer walks into a favorite retail outlet and grabs a handheld shopping helper from a rack near the entrance. The handheld unit can communicate with RFID-enabled smart-shelves and their tagged item-level cousins, as well as signal digital signage to change based on the CRM profile of the approaching customer.Read more...

If you're going to be in the Boston area June 5th and 6th, would love to hook up with some of you at the ERIexchange show at The Boston Convention Center.

That show is actually shaping up to be quite significant, with keynotes from BestBuy CIO Bob Willett, CircuitCity CIO Bill McCorey and Metro Group managing director Gerd Wolfram, among other notables.Read more...

One piece of legislation that is now winding its way from the U.S. Senate to the U.S. House of Representatives prohibits pharmaceuticals from using RFID in anti-conterfeiting measures, according to this interesting story in RFID Update.

Although pharma and government uses of RFID are quite distinct from retail deployments, this effort–which is far from final–does signal several things that could impact retail RFID efforts.

First, it signals that the current legislative climate is open to severe RFID restrictions, which is a foreboding trend with consumer privacy protection issues in the wings. Secondly, pharma is a potential massive user of RFID. Anything that materially reduces that is going to impact volume pricing for all RFID uses. Much of the current RFID tag price reduction projections have assumed more-than-healthy pharma deployments. All said, it’s an important piece of legislation to watch. …

I don’t typically do this, but today’s Dilbert says something so critical about CRM and performance management that it’s simply impossible to not share.…

Amazon is truly trying to make a go of the online grocery segment, and the Subscribe & Save feature it introduced on Tuesday is a good example of how. But the new program—which promises customers automatic delivery of grocery products with discounts of 15 percent and free shipping—is also an illustration of Amazon's initial weakness.

Several E-Commerce sites have tried to make a profit with grocery online, with Priceline probably the most notorious at making a big noise and a big loss. One of the few that seems to be making some serious headway is Peapod, which has the pedigree to do grocery right: It's owned by Stop & Shop.

TJX reported Tuesday that, in the three months leading up to April 28, it spent another $12 million dealing with the data breach the company announced in January. That's on top of $5 million TJX said it spend in the immediately previous three months to deal with the breach.

These figures, while not trivial, are dramatically below some industry projections of billion-plus-dollar losses. Customer loyalty—and apathy—is proving to be the key difference.Read more...

A new survey of U.S. and U.K. mobile web users shows that the number of people engaging in cellphone/PDA Internet activity is already almost one-fifth the size of their PC counterparts. The study from ComScore and Telephia found 19 percent in the U.K. and 17 percent in the U.S.

The U.K. study found 5.7 million people used a mobile device to access the Web during January 2007 compared with the 30 million people age 15 or older who accessed the Web from a PC. The U.S. figures for the same month showed 30 million opting for the PDA/Cell route, compared with 176 million U.S. PC Web users. “Similar to the Internet 10-15 years ago, men under the age of 35 are the early adopters of new technology and more likely to use mobile devices to access the Mobile Web than women or men aged over 35, ” said Bob Ivins, managing director of comScore Europe.…

A new report has emerging technology–which it defines as electronic shelf labels, RFID and self-checkout terminals–shipments hitting $238 million by next year among European retailers. That’s about 52 percent more than the $157 million worth that the Venture Development Corporation (VDC) report estimated was shipped last year.

“While in the near term, traditional technologies will still dominate the market, these emerging technologies are expected to experience long-term growth due to technology refresh cycles, increasing end-user comfort levels (as a result of field-proven ROI with these technologies), and rapid price erosion in order to remain competitive,” said Andrew Nathanson, Director of VDC’s Automatic Identification and Data Collection Practice. “In order for the market to reach its full potential, retailers must view these emerging technologies as a mechanism for strategic pricing, inventory control and management, and a method in which to improve customers’ in-store experience — not merely a replacement for traditional technologies.”…

As Yahoo prepares to shutter its North American auction business and phase out its photo service, it raises the question of whether Yahoo is growing up.

The four most dominant Web players—Yahoo, Google, EBay and Amazon—also happen to be among the industry's veterans. But among them, Yahoo—founded in Jan. 1994—has the most experience, followed some 19 months later by Amazon (July 1995) and then EBay (Sept. 1995). Google didn't show until three years (Sept. 1998) after EBay. Given how all over the map they've been recently, is it now time for business maturation? And will Yahoo take the lead?

For those who still cling to the Tinkerbell belief that consumers will shun any retailers who are shown to not protect their data, TJX’s latest sales figures will deliver a rude awakening.

This concept is not new, as ample evidence already existed that consumers don’t really care about security, but when TJX reported Thursday that its April sales increased another 2 percent, to $1.28 billion, the conclusion became unavoidable. More importantly, for the thirteen weeks ended May 5, 2007, sales reached $4.2 billion, a 7 percent increase over last year’s $3.9 billion. Even with those healthy increases, TJX CEO Carol Meyrowitz said the sales were below her expectation, mostly because of weather. If they were going to feel a consumer backlash, it would have been evident months ago, let alone now.…

The ongoing lawsuits against major retailers for printing prohibited information on credit card receipts is allowed to proceed, with judge describing a key retail defense "absurd" and "bizarre."

U.S. District Judge Gary Allen Feess shot down the retailer's arguments that the law is confusingly worded. "Adidas attempts to obfuscate this plain meaning by advancing two 'competing' interpretations that border on the absurd. First, Adidas contends that the statute could be read to 'allow a business to print the credit card's expiration date on the receipt so long as no more than the last 5 digits of the card appear.' Second, Adidas argues it could be read so that the phrase 'last 5 digits' modifies both 'card number' and 'expiration date,' and thus that a business would be in compliance so long as it truncated the card number and printed only the last five digits of the expiration date. Each interpretation is bizarre," the judge wrote.

When Visa released the latest stats on how many retailers are complying with PCI security rules, many large retailers don't even seem to be trying anymore.

Visa itself puts an even more favorable spin on the figures, with a statement from Visa attributed to Eduardo Perez, vice president, Payment System Risk, Visa USA, saying, "Among the top merchants, which account for over half of Visa's transaction volume, the majority are either fully compliant or working toward eliminating any deficiencies."Read more...

Amazon fired off lovely rhetoric in December, but it surrendered in the conference room. As one lawyer put it, Amazon said in December "This is extortion" and in May, said "And we're paying it."

The issues and the symbolism couldn't have been more the quintessential old versus new battle. IBM is no stranger to nasty fighting and is a company that sees something beautiful about a well-executed stealth patent. That's where a company files a patent and sits on it—quietly—to see if anyone uses the approach and if that company happens to have any money. Think of it as a Patent Speedtrap.

IBM and Amazon today announced that that they come to terms–undisclosed, naturally–on patent issues, with Amazon forking over to IBM “an undisclosed amount of money” and agreeing to “a long-term patent cross-license agreement.”

This is quite a trip from the Amazon rhetoric in December, when Amazon officials said that IBM over-reaching to an epic degree.

“IBM’s broad allegations of infringement amount to a claim that IBM invented the Internet. If IBM’s claims are believed, then not only must Amazon.com pay IBM, but everyone conducting electronic commerce over the World Wide Web (indeed, every Web site and potentially everyone who uses a Web browser to surf the Web) must pay IBM a toll for the right to do so,” court papers filed by Amazon in December said. The original IBM lawsuit raised questions of obviousness, which were addressed by …