Evan Schuman's StorefrontBacktalk

No one in retail would argue with the statement that there isn’t today—and never will be—perfect security. Given the cat-and-mouse game that retailers play with cyberthieves, coupled with the fact that the professional thieves take breaking into retail systems a lot more seriously than most retailers take protecting them, there’s little doubt why.

The argument that won’t die, though, is that security would be a lot better if responsibility shifted away from retailers and onto the banks. The CIO of the National Retail Federation, David Hogan, has been one of the first and most vocal advocates of that approach. The credit card brands won’t hear of it.

Then there are those who advocate a Chip and PIN approach—such as the one being deployed in the U.K. and about to be rolled out in Canada—as much more secure than our current system. Again, the card brands poo-poo the idea.

Remember the zero liability controversy? That’s the theory that an unintended consequence of zero liability programs is that they start the domino effect that has sharply crippled retail security efforts. (The short version of the theory is that by taking away the fraud pain from consumers, they continue to shop with retailers with weak security, which takes away any ROI justification for that chain’s CFO to spend more on security.)

This all came up earlier this week as I was talking with a reader, who happens to coordinate security activities at a Fortune 50 retailer. We were talking about Hannaford and some related security issues and I mentioned the unintended consequence theory. He paused and asked what made me think it was unintended.

Cynical I am, but not paranoid. Well, at least not that paranoid, I thought. Then again, is it coincidental that Visa, Mastercard and the others just about always end up on the other side of the security argument? Could it truly be that they have some kind of a long-term strategic incentive to keep security looking good, but not too good? I was skeptical.

The security exec then asked an annoyingly thought-provoking question: What do you think would happen if retailers were given perfect encryption? Answering his own question (because I certainly wasn’t able to do it), he painted a picture of retailers who would use their perfectly-protected data and would confidently let it ride atop the public Internet. At that point, paying for the private security tunnels of a Visa or MasterCard would no longer be essential.

The credit card brands would then turn into entirely marketing organizations. Yes, they’re close to that today, but the interchange fees pay for all of that. Without it, alternative payment players—with true value-add for retailers—would become powerful and the brands would be in a dramatically weaker position.

Remember how Microsoft initially feared the Web and how AOL should have feared it? Is that how Visa views perfect—or close to perfect—encryption? I’m not certain that I entirely buy into this theory, but the next time one of the card brands resists a security improvement initiative, I’m likely to briefly see it in a very different light.