Four Arrested in Stop & Shop Data Thefts

The Associated Press reports that 4 California men have been arrested and charged in a scheme to steal card numbers and PINs. They were caught trying to remove a PIN pad in a Stop & Shop store in Coventry, R.I. and are the prime suspects in a series of similar tamperings which we reported on last week.

After discovering compromised devices earlier this month, the store bolted down the keypads in all of the stores and that precaution thwarted the thieves this time. A store security officer saw the men messing with the PIN pad and called the police.

The lesson for other merchants -- consider adding bolts to your data security plan.

EU Parliment Says Central Bank Should "Swiftly" Address Data Protection

The European Parliament has adopted a resolution which admonishes the European Central Bank (ECB) for failing to enforce EU privacy laws against SWIFT (the Society for Worldwide Interbank Financial Telecommunication ) which provided data on financial transactions to U.S. law enforcement. SWIFT is a cooperative of European banks and financial service companies which provides automated systems that enable members to transfer money between and amongst themselves. On a daily basis, SWIFT handles millions of transactions -- many of them cross-border -- totalling trillions of dollars.

The story begins in June 2006 when the New York Times reported that as a part of on-going terrorism investigations, U.S. law enforcement had requested and received from SWIFT access to information on millions and millions of funds transfers made through the messaging system. SWIFT has some operations in the U.S., including a data center with a mirror of all of the transaction data. When American law enforcement served a subpoena on SWIFT seeking access to data in the U.S, SWIFT felt legally obligated to comply. SWIFT explains its actions this way:

SWIFT negotiated with the [U.S. Treasury] over the scope and oversight of the subpoenas. Through this process, it received extraordinary protections and assurances as to the purpose, confidentiality, oversight and control of the limited sets of data produced under the subpoenas. These protections go well beyond and are more stringent than SWIFT’s legal obligations.

Despite the limitations placed on the surveillance effort, the program was heavily criticized, especially in Europe and numerous investigations ensued. Because SWIFT is based in Brussels, the Belgian Privacy Commission looked into the matter and reported its findings. The Belgian report provides the best description of what exactly US officials asked for and how SWIFT responded. The Commission concluded that SWIFT should have informed European authorities of the American subpoenas before complying.

As far as the communication of personal data to the [U.S. Treasury] is concerned, the Commission is of the opinion that SWIFT finds itself in a conflict situation between American and European law and that SWIFT at the least committed a number of errors of judgement when dealing with the American subpoenas.

SWIFT, however, strongly disagreed with the Commission's conclusions. The Commission categorized SWIFT as a "data controller" while the group viewed itself merely as a "data processor." SWIFT felt the Commission had misunderstood its role in the financial transactions it facilitates and consequently placed greater obligations upon it than the law requires.

The European Parliament also conducted an investigation. The Committee on Civil Liberties, Justice and Home Affairs held a joint hearing with the Committee on Economic and Monetary Affairs on October 4, 2006 on the interception of bank transfer data from SWIFT by US intelligence agencies. In January, Members posed additional questions to the EU Commission and to the EU Council regarding their knowledge of and response to the matter. The interrogatory posed to the Council pointedly asks: "Why have the Council and the Member States been passive in an affair where their citizens' data have not been protected and where there is a suspicion of business espionage?"

On November 22, Parliament's Working Party on the Protection of Individuals With Regard to the Processing of Personal Data (often referred to as the Article 29 Working Party or WP29) issued a opinion which concluded that the provision of bank transfer data by SWIFT to US authorities violated portions of the EU Data Protection Directive. WP29 agreed with the Belgian Commission that SWIFT should be categorized as a data controller with greater obligations with regard to privacy.

The European Central Bank responded to Parliament in a January 30, 2007 letter setting out its views of the issues. The Central Bank noted that there is no viable alternative to SWIFT for many transactions. With regard to the use of SWIFT services, the ECB said it would seek the consent of individual counterparts in payment transactions before providing their information to SWIFT. In response to suggestions that it take responsibility for ensuring that SWIFT is in compliance with EU data protection rules, the ECB firmly stated that such oversight is outside of its legal authority.

On February 1, 2007, Peter Hustinx, the European Data Protection Supervisor issued an opinion stating that the European Central Bank, as a user and overseer of SWIFT as well as a policy maker, should have exercised appropriate control and supervision over the service. The EDPS requested that the ECB

urgently explore and promote appropriate solutions in order to clearly bring compliance with data protection rules within the scope of the oversight - to the extent in which lack of compliance may affect financial stability and without prejudice to the competences of relevant national or European data protection authorities - as well as to ensure that rules on confidentiality would not prevent relevant authorities from being duly and timely informed where necessary. This would ensure that on future occasions proper data protection safeguards are taken and that the current lack of transparency is avoided.

The opinion continues:

Furthermore, the EDPS stresses that it would not be acceptable that the architecture of the European payment systems would continue to allow and facilitate that personal data relating to any euro payment between Member States are transferred to third countries in breach of the data protection legislation and made available - routinely, massively, and without appropriate guarantees - to third countries authorities. Therefore, the EDPS calls on the ECB, in cooperation with other central banks and financial institutions, to ensure that European payment systems, and in particular the TARGET systems, are fully compliant with European data protection law.

According to The Register, the EDPS can take punitive action against the ECB, but its options are fairly limited. It could bar the central bank from using SWIFT to make payments, but given that there is no alternative for making international payments, that possibility seems remote.

Which brings us back to the European Parliament's resolution on the SWIFT controversy and, more specifically, on the ECB's role in policing data protection in the payment system. The resolution endorses the Hustinx opinion and calls on the ECB to take the following actions:

• as SWIFT overseer, to explore solutions in order to ensure compliance with data protection rules and to ensure that rules on confidentiality do not prevent information from being supplied in good time to the relevant authorities;
• as user of the SWIFT Net-FIN, to explore solutions to bring its payment operations into compliance with data protection legislation, and to prepare a report on the measures taken no later than April 2007;
• as policymaker, to ensure, in cooperation with central banks and financial institutions, that European payment systems, including the updated 'TARGET2' system for wholesale payments, fully comply with EC data protection law; calls for the ECB to provide the Parliament with the assessment of such compliance.

The ECB is supposed to issue a report in April which will presumably address Parliament's concerns.

Senate Schedules Hearings on Abusive Credit Card Practices

The American Banker reports today that Sen. Carl Levin (D-MI) has scheduled another set of hearings into credit card company abuses for
March 7, 2007. No information on witnesses is available at this time.

Levin in chairman of the Senate Permanent Subcommittee on Investigations which has focused on consumer protection in the credit card industry before. Back in 2004, the PSI looked into the topic of abusive practices in credit counseling.

Last year, Levin asked the Government Accountability Office to study and report on credit card rates and fees, how they have evolved over time, whether they are properly disclosed to consumers, whether increased fees have led to more bankruptcies and finally, how much profit the issuers were making from these fees. In September 2006, GAO issued its report which is full of interesting statistics and charts. Its conclusions in a nutshell: rates and fees are more complex; hard to tell what effect it has had on bankruptcies; notices could be improved; and, while fees are up, card issuers are no more profitable.

UPDATE

The Subcommitte has announced details of the hearings. The hearing will focus on how issuers apply interest rates and fees to credit card accounts. Witnessess from the three largest card issuers: Bank of America, JPMorgan Chase and Citibank.

Stop and Shop PIN Pad Rigging Similar to Canadian Cases

Digital Transactions reports that the Stop and Shop data breach disclosed recently appears similar to a series of Canadian crimes that took place last year. In both cases, PIN pads were modified to capture card and PIN information.

Last summer, Canadian police arrested at least 10 people they said used rigged card terminals to intercept PINs as cardholders entered them at the point of sale as part of a scheme in which they stole $4 million (Canadian) from 18,000 customer bank accounts (Digital Transactions News, June 21, 2006). In what press accounts called one of the most technologically sophisticated cases of debit card fraud yet discovered, the suspects swapped their own card readers for those installed in some 42 retail locations in the Montreal area, then used Wi-Fi connections to send PINs and card numbers to a remote receiver. With that information, they were able to forge cards and loot the associated accounts through ATM withdrawals. Similar cases of tampering cropped up in other Canadian cities last year, as well.

What liability Stop and Shop may have to customers who are harmed by the data breach will turn in part on whether the company took appropriate security measures to protect the PIN pads. Digital Transaction also reports that the security standards for some PIN pads changed at the beginning of the year.

The perpetrators may have exploited an inspection loophole in point-of-sale systems that was closed in the recent update of the Payment Card Industry (PCI) data security standards promulgated by the leading payment-card networks. Under the old PCI standards, POS equipment that did not run on an Internet Protocol (IP) operating system did not require an assessment for PCI compliance, says Scott Laliberte, IT risk group director at Protiviti Inc., a Chicago-based security firm and PCI auditor.

If Stop and Shop's PIN pads did not run on IP, then it will be more difficult for potential plaintiffs to argue that the stores were not in compliance with industry security standards.

Pew Research Center: What Americans Pay For -- and How

The Pew Research Center just released the results of a survey it conducted last Fall regarding what kind of expenses people are paying for and how they make those payments. They spoke with 2000 people by telephone and asked them about their daily purchases and monthly bills, whether they used cash or checks or cards, whether they followed a budget and if they had ever experienced debt problems. The results are quite fascinating.

To pay for everyday purchases, people use: Cash 37%, Debit 31%, Credit 16%, Checks 15%
For monthly bill paying, people use: Checks 54%, Online 28%, Cash 15%

Debit card use was higher among younger people whereas checks were more popular with the over 65 crowd. 18-29 year-olds rely primarily on cash (52%) for everyday living expenses.

I've excerpted two of the numerous charts from the report:

BoA, VISA Sued for Patent Infringement by Every Penny Counts

Bank of American and VISA were recently sued by Every Penny Counts, Inc. which alleges that BoA's "Keep the Change" program infringes upon its 1995 patent for a "Method and system to create and distribute excess funds from consumer spending transactions." When a participant in "Keep the Change" makes a purchase with his or her debit card, the Bank "rounds up" the amount deducted from the card holder's account to the nearest dollar and then puts that extra change into a savings account. In the UK, the idea has been copied by Lloyds TSB.

Last summer, BusinessWeekOnline did a big write up on how BoA, wanting to bring in new accounts, hired "an innovation and design research firm" to "conduct ethnographic research on boomer-age women with children." Women with children apparently have a tendency to round off entries in their checkbooks to an even amount, and they have a hard time saving money. Taking this important information, BoA

put together a team of product managers, finance experts, software engineers, and operations gurus and held 20 brainstorming sessions. The team generated 80 product concepts, boiled them down to 12, and overwhelmingly favored one: rounding up the financial transactions of consumers and transferring the difference to their savings.

The final little twist to this story is that at least one report in the blogosphere suggests that BoA filed for a patent on the "Keep the Change" idea itself.

Stop & Shop Data Breach -- POS Devices Tampered With

The Boston Globe reports that point-of-sale (POS) devices at several Stop & Shop locations in Rhode Island and Massachusetts were tampered with allowing thieves to steal credit and debit card information and PIN numbers. Stop & Shop issued a public letter to its customers about the incident and published Frequently Asked Questions on its website. While the Stop & Shop FAQs state that "no fraudulent transactions relating to debit or credit cards used at these store locations have been reported to Stop & Shop," the Boston Globe story says that a "bank notified Quincy, Mass.-based Stop & Shop this week that illegal purchases were made."

So far, no information on the make or model of the POS devices or how they were tampered with. If litigation ensues, one wonders if the hardware manufacturer will brought into the fight.

TJX Class Action Lawsuits

At this point in time, there are 5 class action lawsuits filed against TJX and, in some cases, its acquiring bank Fifth Third. Four of the cases attempt to assert claims on behalf of all individuals whose personal information was compromised by TJX. The fifth case (Amerifirst) asserts claims on behalf of all financial institutions which issued credit and/or debit cards that were compromised by the TJX data breach. The cases are summarized in the chart below.

Plaintiff(s)	Defendant(s)	Court	CA number	Filed
Wood,Willoughby	TJX, Fifth Third	N.D.Ala.	07-cv-00147 (RDP)	01-19-07
Miranda, Farley, Jenkins	TJX, Fifth Third	D.P.R.	07-cv-01075 (FAB)	01-26-07
Mace	TJX	D.Mass.	07-cv-10162 (WGY)	01-29-07
Amerifirst Bank	TJX, TJ Maxx, Fifth Third	D.Mass.	07-cv-10169 (JLT)	01-29-07
Gaydos	TJX, Fifth Third	D.Mass.	07-ca-10215 (WGY)	02-05-07

For some reason, not all of the columns in the chart are viewable on the blog. You can view the entire chart here.

I'll post the complaints as well as an analysis of each case in the next few days.

The Economist Announces the End of the Cash Era

The cover of the February 17-23, 2007 issue of the The Economist announces "the end of the cash era" with a cute graphic of dinosaurs made of coins and bills. In an editorial, the magazine acknowledges that the trend of electronic payments replacing cash transactions is unstoppable, but urges that payment systems be designed to preserve anonymity. A second article explores new technology for making payments by smart card and mobile phone. Interesting details on new products in Europe and Asia. The article focuses mostly on technology, but the last few paragraphs address the primary business issue -- who is going to control (and make money) from these transactions: banks, card associations, wireless companies. The editorial is available on-line but requires a subscription.

The article is available for free.

Identity Theft is Down. Who Knew?

Last week Javelin issued a study on identity theft it conducted for Wells Fargo, VISA and Checkfree. They found the number of people reporting they have been victims of identity theft has gone down in recent years. Javelin calculated the number of cases of fraudulent use of personal data (such as credit card numbers or social security numbers) per year as follows:

• 10.1 million cases in 2003
• 8.9 million cases in 2005
• 8.4 million cases in 2006

Their conclusions are based on data gathered by a telephone survey. It will be interesting to see whether the TJX incident has any effect on this trend.

Massachusetts AG to Lead 30 State Probe Into TJX Data Breach

Massachusetts Attorney General Martha Coakley announced her office will lead a multi-state civil investigation into the recent data breach at TJX Companies, parent to TJMaxx, Marshalls, HomeGoods and a number of other well known retail chains. Coakley has asserted control of the investigation because TJX is based in Framingham, MA. Eweek.com reports that 30 other states have joined the probe.

The Massachusetts Bankers Association reports that thieves have made fraudulent use of credit and debit card information from the TJX incident in Florida, Georgia and Louisiana, as well as in Hong Kong and Sweden. Nearly 60 banks in Massachusetts have been contacted by the card associations and told that information about their card holders was disclosed. Banks are notifying their customers and in many cases are reissuing cards.

The fact that card holders and banks are (allegedly) able to trace particular fraudulent transactions back to a particular data breach by a particular corporation means the TJX matter is going to be very significant. It is the first big case in which people harmed by a data breach will be able to identify and then, of course, sue the company responsible for the disclosure of their personal information. Will there be class action lawsuits? Oh, please! Half a dozen have already been filed and my guess is that's just the start. More info on the class action litigation in a future post.

A Confusing, Convoluted Victory for DataTreasury

DataTreasury Corp. scored a victory of sorts before the U.S. Court of Appeals for the Federal Circuit, announcing today that the appellate court affirmed a lower court's ruling dismissing DataTreasury's patent infringement case against Electronic Data Systems Corp. (EDS). That's right -- the court dismissed DataTreasury's suit against EDS and DataTreasury counts that as a victory. Here's why:

DataTreasury holds several patents which purport to cover the process of storing and sharing images of checks over the internet. The company claims that its patents are integral to the implementation of Check 21 -- the recently enacted law which allows banks to clear checks by sending images of the documents to each other rather than the paper itself. DataTreasury has made quite a name for itself by suing lots of banks and financial service providers for patent infringement. JPMorgan Chase, Citibank, Bank One, Wells Fargo, Zions, First Data, RDM, NetDeposit and, of course, EDS have all received a summons from DataTreasury. Even more surprising than the fact that this little company would take on the big dogs is how successful its strategy has been. Many of the defendants, including the normally ferocious rottweiler JPMorgan Chase, have settled with DataTreasury and even more corporations have lined up to pay licensing fees in order to avoid litigation.

So what explains DataTreasury's jubilation at having its case against EDS thrown out? You need to know one other fact. DataTreasury actually had two lawsuits against EDS going at the same time. The case that was dismissed was filed in Federal District Court for the Northern District of Texas (N.D.Tx). The second case was filed in Federal District Court for the Eastern District of Texas (E.D.Tx). Northern? Eastern? Does it really make a difference? You bet it does. Plaintiffs who file patent infringement suits in the E.D.Tx win more often than plaintiffs in any other Federal court in the country. If it has to be sued for patent infringement, EDS wants to be in any court other than the Eastern District. When the judge in the N.D.Tx dismissed the case before him in favor of the case in the E.D.Tx, EDS quickly appealed to the Federal Circuit. By affirming the Northern District decision, the appellate court is forcing EDS to proceed in the hostile Eastern District.

To further complicate matters, we should recognize that many commentators believe the DataTreasury patents are invalid and unenforceable. To be patentable, an innovation must be "novel" and "nonobvious." In other words, it should be something new and surprising and not an old idea or something that immediately pops to mind. Sending images of documents over the internet is not a particularly earth shattering break through, even if the documents are checks. Further, earlier patents and industry publications suggest that DataTreasury didn't come up with the process first. Critics of DataTreasury got a major boost in December 2006 when the Patent and Trademark Office (PTO), following a reexamination of DataTreasury's primary check imaging patent, concluded that it failed to meet the standards for patent protection. DataTreasury vowed to appeal the decision.

Barring a successful appeal to the Supreme Court, DataTreasury’s case against EDS will go forward in the Eastern District of Texas where the juries rarely fail to enforce a patent. It will be interesting to see what they do with a patent that even the PTO agrees isn’t valid.