Security Review: UW Bookstore
Everyone knows the bookstore sells books only after a tremendous markup. But does that really mean they can afford to employ lax security?
Consider the situation of the books department: all of the textbooks for every class in the university are housed in a single room smaller than the main Kane lecture hall. Much smaller, actually. About half of the floor space is taken up by racks of books. Under everyday conditions this is fine, because generally less than ten customers are browsing around at a given time. The problem becomes apparent just before the quarter begins, when the book room becomes so crowded that standing in the register line I sometimes think that I’m back in Disneyland, waiting for a ride on Splash Mountain.
Imagine my disappointment when I realize I’m actually in line to empty my wallet in exchange for ten pounds of paper.
All these bodies in such a small area can help to hide a malicious book-snatcher masquerading as a customer. Booknappers need simply gather target books into their backpacks and force their ways upstream around the registers and out of the store. The UW bookstore provides no substantial countermeasures.
Assets and security goals
- Asset: books. This is what the bookstore makes its money from; without the profit, there’s no point.
- Security goal: to keep the books from walking out unpaid for. Like I said, there’s really no point otherwise.
Adversaries, threats
- Students. Books are expensive, and students might not always want to pay for them.
- Competitors. There’s a used textbook reseller across the street from the bookstore. Why pay other people for books when the UW bookstore will give you them for free?
Weaknesses
Ah yes, of course. They make everything possible.
- Little space. When there are lots of people at the bookstore, the register line can back up into the book area. To compound this, there isn’t much space in the book area to begin with, so people become packed into the area. This can be leveraged to help hide malicious activity from the views of bookstore employees.
- Cameras. Security cameras may seem like a good idea (the bookstore has few), but the truth is that overhead cameras can be easily defeated by correct body positioning and by wearing clothes such as a hood and hat to hide identifying features.
- No security devices. The books don’t contain typical anti-shoplifting measures such as metal strips which, when sent through a sensor, trigger an alarm. Thus, once an attacker successfully hides a book, the attacker can walk right out.
- No bag check. If you’re wearing a backpack into the book section, you can continue to wear it. And when you leave, nobody checks its contents. All an attacker has to do is to get a book into his bag unnoticed.
Defenses
- Guards. The bookstore does post guards to watch the flow of people when it becomes crowded. However, since they don’t check bags, guards alone don’t contribute anything by themselves to overcome the weakness.
- Bag check. It may be inconvenient to shoppers and increase congestion at peak periods because customers must go to the bag check before and after purchasing, but it would increase the difficulty of concealing contraband coursework.
- Receipt check. The most powerful anti-theft device in my opinion. Before leaving the book section, customers would present their receipt and purchased books to someone who would then mark them as good to go. The customers could then exit the store. Combined with a bag check, this could greatly reduce the ease at which books can be swiped.
- Security devices. There is of course the option of retail security devices, such as hidden metal strips which must be removed before exit, unless one wants to trigger an alarm. But these would be costly to install in every book, and if used incorrectly could be easy to find and remove. I believe the receipt check is the more powerful alternative.
The risk to the bookstore from such criminal tactics is usually small, because there are usually few enough customers that the employees can track their individual movements. However, the risks greatly increase when coupled with a high congestion of bodies. The problem is that the bookstore likely makes far more money when the store is that crowded, so that’s exactly when they don’t want it to be easier to walk off with free books. This isn’t, of course, a reason for readers to now go out and take advantage of the bookstore for its foolishness and quote this article. That isn’t the intent of this review. The intent isn’t to enable attackers; it’s to point out how attackers already are enabled. That said, I don’t see the bookstore implementing new security measures soon unless they see it affecting their bottom line.
While it’s very philanthropic of the bookstore to provide opportunities for students who are less well financially endowed to obtain their sets of four hundred dollar textbooks for free, it’s not in their best interests in this case, and it doesn’t have to be this way. I believe the easiest and most effective ways to increase the determination and ingenuity required to walk out the bookstore with free books are the bag check and receipt check methods together. They would make things much more difficult. Yes, they would also inconvenience the customers, but not enough to deter them from coming. Plus it’s a reasonable to request it of the customers. Think of it this way: at ten dollars an hour, it would cost the bookstore 480 dollars to employ two people to do bag check and two to check receipts for one weekday (twelve hours). That’s not so much to ask; think of the potential for loss when the bookstore is crowded. One person per hour could walk out with a single one hundred dollar book (less than the price of the average math or science textbook) and the store would never notice. That’s twelve hundred dollars in one day that they won’t be seeing again, and with hundreds of people walking past the books each hour, it’s not too much of a stretch to imagine. The question isn’t can they afford to do it; it’s can they afford not to?
Comment by gertanya
January 16, 2009 @ 8:26 pm
The lack of security in the bookstore makes me wonder how books should be overpriced in order to still have the profit, even though some books become stolen. Seems like even with current security condition the book store has its profit. It means that the books are very overpriced and honest students pay extra money to cover the losses produced by the stolen books.
It would be great if the introduction of additional security measures could reduce the book price.
The idea of bag check together with the receipt check is very good. It can be done by providing the customers with lock boxes that they can access by themselves. At the entrance, the customer can put the bag in the lock box and lock it using a pin. This measure might be costly at first (price for the installation of the lock boxes), but in the long run it can save the book store a lot of money and might bring the book prices a little bit down.
Comment by vincez
January 16, 2009 @ 8:27 pm
While all of the points made in this Security Review are true, I don’t think the UW Bookstore has a different level of security than similar retailers. While of course retailers want to minimize theft, combating it can quickly become more expensive than the actual cost of the items lost. An important difference I see between retail security and cyber-security is that you can put an exact value on the merchandise in a retail store, but not so with private data. You cannot bring down a retail store by finding a security vulnerability, but you can certainly do this with a computer system attack.
I’m sure the UW Bookstore follows standard retail procedure and performs inventories periodically. This will give the exact value of the assets lost, and from there the determination can be made as to whether the cost to improve security will actually save money overall. As it happens, losses from customer theft are typically quite small. The vast majority of theft in retail stores is actually done by employees. I would be most interested to know what security vulnerabilities the bookstore has against internal theft. I have a strong feeling that the bookstore knows about these security issues and are willing to eat the cost of losses from external theft as it is likely less costly than improving security, and again, the store is not losing any secret data or being hurt in any way other than the specific dollar loss of the texts stolen.
Comment by Kevin Wallace
January 16, 2009 @ 9:34 pm
My understanding is that it’s illegal for store employees to detain you for refusing to submit to such a search, unless it’s a membership-based store such as Costco. I don’t often shop at such stores, but the times that I have, I’ve never had any problems saying “no thanks” and walking right past the receipt checker with my (purchased) merchandise. It puzzles me that stores still institute policies like this.
Comment by jap24
January 16, 2009 @ 10:05 pm
It seems to me that the bag check and receipt check defenses would cause more problems for the store. As the author mentioned, the most vulnerable times are when there are large crowds in the store. Further delaying students from leaving by performing these checks would make the crowds even worse, and perhaps drive away potential customers (who could go to that store across the street the author mentioned). The author also states that security guards are not likely to be effective and installing security devices in the books could be too expensive. The bookstore has probably already considered the problem, and decided that the profit-maximizing course is to operate as they do now.
Comment by lidor7
January 17, 2009 @ 3:45 am
I don’t know the details, but from what I understand, the law doesn’t enable retailers to do much about shoplifters. I hear a lot of store policies regarding shoplifting prevent employees from making accusations or confronting a customer that is suspected of or known to be shoplifting. Some of the time employees are told just to simply to follow the shoplifter out to the parking lot and take down their license plate number.
And as someone said, checking the receipt is technically not enforceable, but you’d have to be a real jerk to refuse showing your receipt.
What’s interesting is that these textbooks are worth so much, but I don’t know about everyone else, but I don’t treat them as $100 assets once I’ve bought a textbook. For example, a graphing calculator is about $100, or maybe a cheap cell phone or mp3 player. Most people are more likely to leave their textbook unattended than $100 electronics, yet the value is technically the same. But even better, there’s a place just three blocks away that will buy the textbook from you.
It seems to me, a thief could easily make lots of money by stealing textbooks or backpacks with textbooks in them. And as far as I know, there’s no system in place to prevent a thief from easily reselling the book back to the bookstore.
Comment by mcam
January 17, 2009 @ 6:13 pm
Bag and receipt check does NOT prevent internal theft. UW bookstore doesn’t really get a lot of traffic until the start of a new academic quarter or finals week (where student can sell back their books for discounted prices). I would would imagine that during high traffic times, bookstore would hire temporary employees to get things going. Now, where would you find employees for for two-three weeks? Well, the University of course! So okay, the bookstore will do bag/receipt check. But when will they really need to have two people standing by the doors to do so? —> high traffic time. Where would they find people to fill those positions? —> people from the university. K. Yeah having the check might prevent potential shoplifters from trying… But what happens when they do catch one? Also, how effective would bag/receipt check be if the employee is letting a few of his buddies walk out of the store with stacks of textbooks?
On to a different point: the bookstore makes BUTT LOAD of money off of books. We all know that. Introducing bag/receipt check might prevent shoplifters from doing their business, but it would certainly create a lot of hassle for other honest customers. Dude, the bookstore is a retail business. And in retail, the customer is always right. While the bookstore wants to protects its asset, it also wants to satisfy its customers too. What do the students want? Get in and get out! It’s already a pain to drag my ass down to the bookstore, squeeze between people and shelves to find my books, and wait in a HUGE long line to pay and get out… I certainly do not need to be bothered anymore or take any more time. Customer retention is important too. If you make the customer experience amazing, they’ll come back. So… My point is, the bookstore is already making a lot of money of of the students, the profit they make from legitimate sales usually covers the loss from theft. Introducing security checkpoints might prevent this loss in the first place, however it creates a dissatisfying customer experience and therefore risking losing loyal customers in return. This maybe a reason WHY the bookstore doesn’t do bag/receipt checks.
Comment by eyezac
January 19, 2009 @ 12:15 pm
I always thought the real money went to the publisher, not the retailer. Does the U Bookstore really mark up textbooks more than other books? I don’t see how they could afford to; they already have so much competition from Amazon, that place across the street, etc.
It’s the publisher who has the leverage to dictate unfair prices. Once a college department decides to use a particular text for one of their courses, that text’s publisher’s competition suddenly evaporates (I wonder if the publishers provide the universities with any incentives for choosing particular contractors–er, textbooks…).
Anyway, this has been my understanding of how things work, but someone please correct me if I’m wrong about this! Also, sorry if this is slightly off topic.