[comp.org.eff.talk] Point of Sale

tmkk@ux1.cso.uiuc.edu (Scott Coleman) (01/28/91)

In article <9161@uwm.edu> levine@csd4.csd.uwm.edu writes:
>In my local supermarket the sale is scanned by the now ubiquitous
>laser scanner with, I am sure, the data being stored somewhere.  I
>noted at our last visit that the clerk was keying in our store account
>number (the number we use to speed up the check cashing process) as a
>last part of the transaction.  
>
>They now have in their computer a complete file.  Each item we
>purchased, our name and address and the like.  Who gets that
>information and for what purpose is not under my control.  Check out
>the procedure in your favorite store.

Yet another reason to pay CASH at the grocery store!



-- 
Scott Coleman                                                    tmkk@uiuc.edu

"Unisys has demonstrated the power of two. That's their stock price today."
       - Scott McNealy on the history of mergers in the computer industry.

craig@com50.c2s.mn.org (Craig Wilson) (01/28/91)

In article <9161@uwm.edu> levine@csd4.csd.uwm.edu writes:
>In my local supermarket the sale is scanned by the now ubiquitous
>laser scanner with, I am sure, the data being stored somewhere.  I
>noted at our last visit that the clerk was keying in our store account
>number (the number we use to speed up the check cashing process) as a
>last part of the transaction.  
>
>They now have in their computer a complete file.  Each item we
>purchased, our name and address and the like.  Who gets that
>information and for what purpose is not under my control.  Check out
>the procedure in your favorite store.
>+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
>| Leonard P. Levine                    e-mail levine@cs.uwm.edu |

I am curious.  Does anyone know, from experience, what the record layouts look
like for these supermarket databases?  I find it hard to believe (not
impossible, just hard)  that 'every' transaction is recorded with respect to
purchaser, item, time, date, item cost, ambient temperature, etc.

How big are these databases?  And what kind of equipment do they run on?

I guess, I would like a more technical description of what is taking place in
these instances.


Craig S. Wilson           |    Democracy      |uucp path under construction.
Com Squared Systems, Inc  |    is not  a      |craig@c2s.mn.org
2520 Pilot Knob Road      |    spectator      |(612) 452-9522 voice
Mendota Heights MN 55120  |      sport.       |(612) 452-3607 fax

jkonrath@silver.ucs.indiana.edu (jon) (01/29/91)

In article <1991Jan28.131402.29179@com50.c2s.mn.org> craig@com50.c2s.mn.org (Craig Wilson) writes:
>In article <9161@uwm.edu> levine@csd4.csd.uwm.edu writes:
>>In my local supermarket the sale is scanned by the now ubiquitous
>>laser scanner with, I am sure, the data being stored somewhere.  I
>>noted at our last visit that the clerk was keying in our store account
>>number (the number we use to speed up the check cashing process) as a
>>last part of the transaction.  
>>
>>They now have in their computer a complete file.  Each item we
>>purchased, our name and address and the like.  Who gets that
>>information and for what purpose is not under my control.  Check out
>>the procedure in your favorite store.
>>+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
>>| Leonard P. Levine                    e-mail levine@cs.uwm.edu |
>
>I am curious.  Does anyone know, from experience, what the record layouts look
>like for these supermarket databases?  I find it hard to believe (not
>impossible, just hard)  that 'every' transaction is recorded with respect to
>purchaser, item, time, date, item cost, ambient temperature, etc.
>
>How big are these databases?  And what kind of equipment do they run on?
>
>I guess, I would like a more technical description of what is taking place in
>these instances.
>
>
>Craig S. Wilson           |    Democracy      |uucp path under construction.
>Com Squared Systems, Inc  |    is not  a      |craig@c2s.mn.org
>2520 Pilot Knob Road      |    spectator      |(612) 452-9522 voice
>Mendota Heights MN 55120  |      sport.       |(612) 452-3607 fax

OK, I used to work in a department store that had a rather advanced POS
system.  My department wasnt scanned (its hard to run a lawn tractor over
one of those counters) but our database was similar. in our 'base, all
it held was a 20some letter description, a big/small ticket toggle, and
a price.
the idea of the storage of these items is about ludicrous, and is totally
irrelevant.  At a grocery store with an average of 2000 transactions a 
day, and an average of 30 or so items (these are guestimates) it would
take thousands of dollars of disk space to store the relatively useless
data.  and the correlation: its like thinking your unix computer stores
your phone number when you use chfn; you can tell your personal life to
someone using the talk command; therefore the system automatically stores
your personal life when you use talk.
half the time, they cant even keep the damn database updated; you think
theyd take the time to store what kind of dog food you buy?

(interesting side story: ive seen an 18 HP lawn tractor that had a price
in the database of $00.02.....i was gonna buy 10 of em...)

jon

-------------------------------------------------------------------------------
Jon Konrath, Consultant                         jkonrath@silver.ucs.indiana.edu
IUSB Computing Services                       ap202093@natasha.iusb.indiana.edu
                                                  jkonrath@rose.ucs.indiana.edu
still under repair!                             jkonrath@sbway.iusb.indiana.edu

jgd@Dixie.Com (John G. DeArmond) (01/29/91)

craig@com50.c2s.mn.org (Craig Wilson) writes:

>I am curious.  Does anyone know, from experience, what the record layouts look
>like for these supermarket databases?  I find it hard to believe (not
>impossible, just hard)  that 'every' transaction is recorded with respect to
>purchaser, item, time, date, item cost, ambient temperature, etc.

>How big are these databases?  And what kind of equipment do they run on?

>I guess, I would like a more technical description of what is taking place in
>these instances.

As the ex-project manager for just such a system (until I quit in disgust.),
let me add some facts.  

YES, not only every transaction but every detail record of every
transaction is recorded.  The record layout is typically very simple and
compact.  The UPC code of the item, your "frequent buyer" number and a
time stamp is stored by the intelligent cash register. The back-end
processor for the cash-register is equipped with what is known as
"demographics" software that collects these detail records together  into
transaction records and stores them on embedded hard drives for 
collection.  Where the data goes from there depends on the particular
data collector.  Both PCs and small Unix systems are used to collect the
data from the POS BEP and forward it to a central collection site.  The
data may go through one or more regional concentration centers on its 
way to the mainframe.   

At the mainframe site, the computer is typically an IBM 40XX connected to
a large disk farm.  The one I was involved with filled an entire floor
of a high-rise.  Once on the mainframe, the data is massaged according
to the requirements of whomever is buying the data.  What is interesting
is that the same people who are involved in this activity are the ones
who are also involved in the banking and insurance industries.  That 
Sunday night steak really COULD cost you on your life insurance premium.

The biggest player in the game is CitiBank.  They record every detail that
they can get their hands on.  Ever wonder why they push the CitiCards 
so heavily?

There are people who pooh-pooh what is going on.  They are not the ones
who actually know what is going on.  Very sophisticated lifestyle 
computer models are being constructed that will tell anyone with the 
bucks more about you than likely you yourself know.  They will know how
much you make, where you live, what you buy, when you buy, your driving
and eating habits and your health-care habits.  Much of this has
already happened quietly behind the scenes.  If you value your privacy
AND/OR your ability to buy affordable insurance AND/OR the right to be
left alone by the government (IRS), you had better wake up and smell
the roses.  1984 has long past and the big brother future  is here NOW.

What can you do?  Here are several steps:

*	Protest loud and long.  We've killed Lotus Marketplace; we can kill
	other privacy invasions.

*	Take the protest to the local level.  Badger your grocery store manager
	and his manager.  Demand to know exactly what kind of and how much
	data is being collected.

*	Never, but NEVER use a check cashing card, a frequent buyer card,
	or any other device that will let a vendor associate your purchase 
	with your identity.  If you use a credit card, make the vendor simply
	write "merchandise" on the credit slip.  DO NOT let them swipe your
	card into a POS terminal.  The outboard authorization terminals are
	somewhat OK, in that they only record a total.

*	Use cash whenever you can.  If you really need to float for a month,
	consider a cash advance on your credit card.  There are card companies
	that don't charge interest on cash advances until invoice date.

*	Avoid the use of checks whenever possible, because  many large
	banks now catalog check transactions.

*	Never give your name or your phone number to a store.  This goes 
	for Radio Shack as well as more mundane stores.  I know for a 
	fact that RS releases personal information because I've seeded 
	their database with false names and gotten junk mail.

*	If you get magazine subscriptions, specify that your name is NOT
	to be released to 3rd parties. If possible, have the magazines 
	delivered to an alias at a PO Box.  A shell company name is very
	effective.

*	Actively persecute any violators of your personal privacy.  Make
	a pain in the ass of yourself.  Make it cost the violators to 
	continue abusing you.

*	Let your congresslime know what you think.  We CAN get legislation
	to protect us but it will take popular pressure to overcome the
	financial resources of the large retailers, mass mailers and
	insurance industry.


John

-- 
John De Armond, WD4OQC        | "Purveyors of speed to the Trade"  (tm)
Rapid Deployment System, Inc. |  Home of the Nidgets (tm)
Marietta, Ga                  | 
{emory,uunet}!rsiatl!jgd      |"Politically InCorrect.. And damn proud of it  

jgd@Dixie.Com (John G. DeArmond) (01/29/91)

jkonrath@silver.ucs.indiana.edu (jon) writes:

My department wasnt scanned (its hard to run a lawn tractor over
>one of those counters) but our database was similar. in our 'base, all
>it held was a 20some letter description, a big/small ticket toggle, and
>a price.
>the idea of the storage of these items is about ludicrous, and is totally
>irrelevant.  At a grocery store with an average of 2000 transactions a 
>day, and an average of 30 or so items (these are guestimates) it would
>take thousands of dollars of disk space to store the relatively useless
>data.  and the correlation: its like thinking your unix computer stores
>your phone number when you use chfn; you can tell your personal life to
>someone using the talk command; therefore the system automatically stores
>your personal life when you use talk.
>half the time, they cant even keep the damn database updated; you think
>theyd take the time to store what kind of dog food you buy?

A little bit of knowledge is a VERY dangerous thing.

As I noted in a previous article, I was until recently, the project manager
for a development team implementing one of these centralized data collection
schemes.  I can assure you that every important detail (price, UPC, quantity,
time bought, location bought and so on) IS recorded even on old and 
primitive POS systems.  The database you describe is the master inventory
database and is completely different from the transaction database that
collects POS details.

Let's look at the loading to see if it really would take "thousands of 
dollars of disk space" to store a day's worth of transaction detail.

Let's assume a record layout as follows:

UPC		       6 bytes (always shortened in the POS to save space)
Cust ID		   12 
price          7 
quantity       2  (if more than 99, then enter twice)
timestamp      8  (varies, typical)
-------------------
			   35 bytes/detail

Your assumption of an average of 30 items is close but for capacity planning,
we planned for 5000 transactions per day.  So a day's worth of storage equals

	35 X 30 X 5000 = 5,250,000 bytes.

At a dollar a megabyte or so today, we're talking maybe 8 dollars worth of
disk storage.  In reality, there is usually some more detail stored, such
as retail vs sell price, but this puts things in perspective.

The oldest POS system we looked at collecting data from was a DataChecker
that uses mid-70s logic in an architecture similiar to a PDP-11.  Even
this machine had 2 20 mb 12" spindles onboard.   More modern systems 
easily have hundreds of MB of storage.

Connected to each of these POS systems is a general purpose computer of 
some sort.  Some  vendors supply Unix systems, others use DOS or Oasys.  
The machine may or may not be in the store.  If a store already has a
VSAT or SNA link to the store, it makes sense to connect the POS
controller to a sync modem and have the computer elsewhere. In any event,
this system is designed to offload the data from the POS as quickly as
possible and to filter out error messages and the like and to hold it 
for polling by a regional or centralized computer.  

Our system design used either Telebits on dialup lines for smaller stores
or 64kb/s leased line SNA or VSAT for high volume stores.  And for POS
systems that are not amenable to detail collection, special hardware has
been built that will monitor and log the keystrokes on the POS systems. 
That this kind of money is being spent should show you how much some
people value this data.  

You are correct in saying that the individual stores do not store your
life history.  They don't need to.  All they need is your SSN, your check
cashing card number, your frequent buyer number or anything else they can
use to match the transaction data against your personal information
records on the mainframe.  The data agregators DO know this information
because they buy it from a  variety of sources including our favorite,
Equifax.  The stores then buy this filtered data back from the agregators
when needed. 

You may want to believe that "nice people" would not do these things or
that technology won't permit it but if you do, you are simply fooling
yourself.  These systems are already in place in many parts of the 
country.   Citibank is the leader; many others are scrambling for a 
piece of the pie.  The worst thing one can do is underestimate his
enemy, something you have gravely done.

John

PS:  The tricks used to get ethical programmers and managers to work 
	on such systems is the subject of a story of its own.  The lessons
	of Big Brother have been learned well.

-- 
John De Armond, WD4OQC        | "Purveyors of speed to the Trade"  (tm)
Rapid Deployment System, Inc. |  Home of the Nidgets (tm)
Marietta, Ga                  | 
{emory,uunet}!rsiatl!jgd      |"Politically InCorrect.. And damn proud of it  

cyberoid@milton.u.washington.edu (Robert Jacobson) (01/29/91)

I could be wrong, but my understanding was that, at the larger chains,
information collected via the scanners is centrally collected and 
stored, in aggregate fashion, to make wholesale purchasing decisions.
However, in many cases, specific client files are built using special
identifiers like coded coupons, checkout cards, and so forth.

Bob Jacobson

gray@s5000.RSVL.UNISYS.COM (Bill Gray x2128) (01/30/91)

In article <6178@rsiatl.Dixie.Com> jgd@Dixie.Com (John G. DeArmond) writes:
>
>*	Use cash whenever you can.  If you really need to float for a month,
>	consider a cash advance on your credit card.  There are card companies
>	that don't charge interest on cash advances until invoice date.

Amen to that, especially the advice to use cash!  One of the most
important steps people concerned with their personal freedom can take
is to get out of debt and stay out of debt.

>
>*	Avoid the use of checks whenever possible, because  many large
>	banks now catalog check transactions.

Banks and other check-handling institutions microfilm or digitize
images of every check used in the country.  This is required (and has been
for many years) by the absurdly titled Bank Privacy Act.  It is one of the
tools your humble public servants at IRS use to see whether you spend more
than you report in certain kinds of audit.

Some banks may also be matching your name/account number from your check
to the name/account number of the business that deposited it.  So if
you have written checks to Madam Sophie's Massage Parlor or Bill's
Gun Shop, it can 1.) be determined by the Feds and 2.) may be disclosable
to others (e.g., advertisers).  Point 2 is technically feasible; I do not
know the provisions of the Bank Privacy Act, but they _may_ prohibit
such disclosure.

>*	Let your congresslime know what you think.  We CAN get legislation
>	to protect us but it will take popular pressure to overcome the
>	financial resources of the large retailers, mass mailers and
>	insurance industry.

It is easy to think that this is futile.  That is defeatism.

Consider it this way:  Almost everyone I know says they would be willing
to fight and even die to gain the freedoms we (think we) have in the USA.
But perishingly few are willing to use freely available, peaceful means
to preserve those few freedoms that remain to us.

In point of fact, the most effective single thing you can do to influence
a legislator is to go visit it.  That is comparatively easy at the state
level, virtually impossible at the Federal level.

The next most effective method is a short, polite but direct _handwritten_
letter.  Typed, word-processed, or mass reproduced letters, postcards,
and phone calls are have progressively less effect.

But *any contact* has more impact than silence.

This is our republic.  The stewardship is ours.  I believe we will be
held accountable for how well we manage it.

Bill
-- 
: gray@rsvl.unisys.com                      :                                  :
:                                           :  My gun is safer than Ted        :
: Unisys has enough problems without being  :  Kennedy's car.                  :
: blamed for my personal opinions.          :                                  :

tmkk@ux1.cso.uiuc.edu (Scott Coleman) (01/30/91)

In article <1991Jan28.204538.17471@bronze.ucs.indiana.edu> jkonrath@silver.ucs.indiana.edu (jon) writes:
>In article <1991Jan28.131402.29179@com50.c2s.mn.org> craig@com50.c2s.mn.org (Craig Wilson) writes:
>>In article <9161@uwm.edu> levine@csd4.csd.uwm.edu writes:
>>>In my local supermarket the sale is scanned by the now ubiquitous
>>>laser scanner with, I am sure, the data being stored somewhere.  I
>>>noted at our last visit that the clerk was keying in our store account
>>>number (the number we use to speed up the check cashing process) as a
>>>last part of the transaction.  
>>>
>>>They now have in their computer a complete file.  Each item we
>>>purchased, our name and address and the like.  Who gets that
>>>information and for what purpose is not under my control.  Check out
>>>the procedure in your favorite store.
>>
>>I am curious.  Does anyone know, from experience, what the record layouts look
>>like for these supermarket databases?  
>
>OK, I used to work in a department store that had a rather advanced POS
>system.  My department wasnt scanned (its hard to run a lawn tractor over
>one of those counters) but our database was similar. in our 'base, all
>it held was a 20some letter description, a big/small ticket toggle, and
>a price.

Admittedly, most stores with POS systems do it primarily for inventory
control purposes (they like to track how many of which items are sold so
they know when to order more, etc.) However, it is quite possible to store
information on who buys what. The details escape me, but just this procedure
is used by a group of people studying the effect of advertising on joe
consumer family. They have special commercials beamed directly to their home,
and each and every item they purchase is tabulated via the laser scanner POS
system at their local supermarket, and the results are correlated by the
researchers. Clearly, it CAN be done, if someone wants to badly enough. 


-- 
Scott Coleman                                                    tmkk@uiuc.edu

"Unisys has demonstrated the power of two. That's their stock price today."
       - Scott McNealy on the history of mergers in the computer industry.

johnl@iecc.cambridge.ma.us (John R. Levine) (01/30/91)

Let me tell you about a company called Information Resources, Inc.  In 1978,
they decided they wanted to do really superior market research.  So here's
what they did: They went to some medium sized cities, such as Pittsfield MA,
and made a deal with all the supermarkets in town to install POS scanners in
return for giving IRI the data collected from them.  They also signed up
local consumers into "shoppers panels," in which the shopper identified
herself (typically a her) at the grocery store with a card whose number is
entered into the register each time she goes shopping.  Each time a card is
used, it is an entry into an annual drawing for some prizes.  It doesn't
matter where in town one shops, all of the supermarkets and now all of the
drug and many other stores are online.

Furthermore, IRI has made arrangements with the local cable TV and newspaper
so that from time to time when IRI does marketing experiments, they can
substitute test TV commercials and newspaper ads for the regular ones
delivered to some of the shoppers, then use POS data to see how purchasing
behavior changes over the ensuing days.  This was a revolution in marketing
data since it got answers back in days rather than weeks or months for older
manual methods.

All this has been in place since 1980.  IRI makes no secret of what they do,
and they are quite well known in marketing circles.  The development of this
system and some other related stuff are described in the Harvard Business
School's cases number 9-583-053 and 9-584-044, available for $3.50 each.
(Call 617-495-6117 with a credit card, minimum order $10, or order through
a book store.)

-- 
John R. Levine, IECC, POB 349, Cambridge MA 02238, +1 617 864 9650
johnl@iecc.cambridge.ma.us, {ima|spdcc|world}!iecc!johnl
" #(ps,#(rs))' " - L. P. Deutsch and C. N. Mooers