Ink Tags: My Security Review from HW1
For my security review, I have chosen to cover the anti-theft devices that are commonly used at retail clothing stores, which I believe are called “ink tags”. I am basing this information from personal experience (I briefly worked for a clothing store a while back) and also from this entry on wikipedia: http://en.wikipedia.org/wiki/Retail_loss_prevention.
Summary:
Ink tags are used very commonly at clothing stores in an attempt to prevent theft. It’s a somewhat sizable piece of beige-colored plastic that’s pinned onto every single article of clothing at the store. The removal of this plastic is relatively hard to do so with force. And, more specifically, if it’s not taken off with the provided special device (which the stores stock), the glass vials inside the tags break and spill ink onto the clothing, presumably ruining it.
Assets/Security Goals:
- The obvious assets are the clothes that the stores stock. They want to prevent people from taking it without paying money since their businesses rely on this.
- The ability for shoppers to shop effectively and safely. This is more subtle, but the stores need to ensure that, for example, the tags wouldn’t falsely trigger and spill ink onto valuable customers.
Potential Adversaries/Threats:
- A typical shoplifter. The thief could still just take the clothing and wear it with the tag still on there, or, if it was later taken off incorrectly, with the ink stains. Wikipedia also describes a method in which people try to cover the holes the ink spills out from with duct tape, thereby reducing or eliminating the amount of ink that spills onto the clothing.
- An employee or ex-employee. An employee with access to the device could take the tag off safely and steal the piece of clothing.
Weaknesses:
- Though the mechanism will likely deter potential thief’s from otherwise stealing, it does very little (perhaps even absolutely nothing) to prevent them from actually taking the merchandise. However, the motives to want to do such thing seems illogical (steal clothing but not wear it, or, wear clothing with an ink tag still on or with ink stains).
- As I already mentioned, the ink can perhaps be blocked from spilling onto the clothing by covering up the holes.
Potential Defenses:
- In a way, the defense is that the affected clothing will be of no use to the thief. Also, stores should pair this device with other security measures like sensors that sound an alarm or security cameras.
- Make the holes small enough and plentiful enough so that they cannot be seen, making it impossible to block the ink. This is apparently already being implemented in the newer (?) devices.
Risk Analysis:
To begin, I would say that the monetary value of the asset is relatively small. The costs of producing and shipping for most clothing is cheap. And since we’re dealing with just clothes, there’s no confidential data or the like that we’re losing (the clothes aren’t exclusively designed to be unique products to exist as one, but instead designed once and then massively reproduced cheaply). The probabilities of the threats and vulnerabilities seem low as well. Given the state of our society’s ethics and enforced laws, most people wouldn’t even consider shoplifting. and the small percentage of people that would will be deterred from doing so since, from their perspective, the likeliness of successfully benefiting from stealing to the risks are bad. I would say the only exception is maybe for the employees who would have an easier time removing the ink tags. This is why I believe other security measures should also be in place like having security cameras.
Conclusions:
More recently, the retail industry’s goal has been not necessarily to prosecute thief’s but instead to simply prevent it from happening in the first place. This is due to many companies being sued for falsely accusing people of theft (as an example, I heard of a story about how one employee ran after a thought-to-be thief and tackled them to the ground). I believe that the retail industry has successfully been able to do this with the use of ink tags (along with other devices) by making the potential reward for the thief very small as compared to the risks involved.
Comment by David St. Hilaire
January 13, 2008 @ 2:27 pm
Another thing to consider:
While ink tags do normally provide a deterrent against shoplifting, ingenuitive shoplifters have found ways to remove some types of ink tags without damaging the clothing, resulting in a mini arms race between the ink tag manufacturers and the shoplifters. However there is another way to remove the ink tag without any technical knowledge, by asking the sales clerk. While rare, I have had the experience of buying an article of clothing only to realize that the clerk forgot to remove the ink tag. By returning to the nearest store from the same chain (which may not be anywhere near the store from where I bought it) with receipt in hand, it is not difficult to have the customer service representative remove the ink tag.
Thus shoplifting on a small scale can be done by finding a receipt discarded by another customer and shoplifting some of the items on that receipt from one store and returning them to another to have the tags removed (though the shoplifter would need to convince the clerk that the items were a gift since he/she couldn’t prove identity.) Or by purchasing one item and shoplifting several more of the same item, the shoplifter could use the receipt at other stores from the same chain to get the ink tags removed.
Until items can be uniquely correlated with receipts, this method will continue to work. However a shoplifter could only pull this stunt so many times before they would run out of stores that didn’t recognize them.
My sister informed me that stupid shoplifters try a variation of this, but they are usually thwarted by the lack of a receipt or sometimes the fact that her store did not even carry the brand that they claimed to have purchased there.