[ISN] Wal-Mart's data center remains mystery

[InfoSec News]

http://www.joplinglobe.com/local/local_story_148015054/

By Max McCoy
The Joplin Globe 
Globe Investigative Writer
May 28, 2006 

JANE, Mo. - Call it Area 71.

Behind a fence topped with razor wire just off U.S. Highway 71 is a
bunker of a building that Wal-Mart considers so secret that it won't
even let the county assessor inside without a nondisclosure agreement.

The 125,000-square-foot building, tucked behind a new Wal-Mart
Supercenter, is only a stone's throw from the Arkansas line and about
15 miles from corporate headquarters in Bentonville, Ark.

There is nothing about the building to give even a hint that Wal-Mart
owns it.

Despite the glimpses through the fence of manicured grass and
carefully placed trees, the overall impression is that this is a
secure site that could withstand just about anything. Earth is packed
against the sides. The green roof - meant, perhaps, to blend into the
surrounding Ozarks hills - bristles with dish antennas. On one of the
heavy steel gates at the guardhouse is a notice that visitors must use
the intercom for assistance.

What the building houses is a mystery.

Speculation

Wal-Mart's ability to crunch numbers is a favorite of conspiracy
theorists, and its data centers are the corporate counterpart to Area
51 at Groom Lake in the state of Nevada. According to one consumer
activist, Katherine Albrecht, even the wildest conspiracy buff might
be surprised at just how much Wal-Mart knows about its customers - and
how much more it would like to know.

"We were contacted about two years ago by somebody who runs a security
company that had been asked in a request for proposals for ways they
could link video footage with customers paying for their purchases,"  
Albrecht said. "Wal-Mart would actually be able to view photos and
video of customers paying, say, for a pack of gum. At the time, it
struck me as unbelievably outlandish because of the amount of data
storage required."

But Wal-Mart, according to a 2004 New York Times article, had enough
storage capacity to contain twice the amount of all the information
available on the Internet. For the technically minded, the exact
amount was for 460 terabytes of data. The prefix tera comes from the
Greek word for monster, and a terabyte is a trillion bytes, the basic
unit of computer storage.

Albrecht, founder of Consumers Against Supermarket Privacy Invasion
and Numbering, said she never could confirm the contractor's story.  
That is not surprising, since Wal-Mart seldom comments on its data
capabilities and operations.

A Globe request for information about the Jane data center was
referred at Wal-Mart headquarters to Carrie Thum, a senior information
officer and former lobbyist for the retailer.

"This is not something that we discuss publicly," Thum said. "We have
no comment. And that's off the record."

Skeleton crew
 
The Jane data center is an enigmatic icon to the power of data, which
has helped Wal-Mart become the largest retailer in the world, and to
the corporation's growing secrecy since founder Sam Walton's death in
1992. When Wal-Mart constructed its primary data center at corporate
headquarters in 1989, it wasn't much of a secret: It was the largest
poured concrete structure in Arkansas at the time, and Walton himself
ordered a third story.

"Not only had we completely designed it, we were under construction,"  
said Bill Ferguson, a founder of Askew Nixon Ferguson Architects in
Memphis, Tenn. "They were pouring foundations, and Sam walked across
the parking lot one Friday at the end of the day and said, 'You know,
let's add a third floor and put some people up there.'"

Ferguson said the Bentonville data center is built on bedrock and is
designed to withstand most natural and man-made disasters, but is not
impregnable. The biggest danger, he said, is the area's frequently
violent thunderstorms.

"We studied making it tornado-proof, which is difficult," he said. "We
calculated the probability of a category 5 tornado hitting it, which
was less likely than an airplane crashing into it head-on. At the
time, they decided not to."

Since then, Ferguson said, changes have been made to increase the
integrity of the structure. The data center was designed with backup
generators, fuel on site, and room and board for a skeleton crew in
the event an emergency required an extended stay.

Ferguson said his firm learned to design data centers by working with
FedEx, which also is based in Memphis, and that the 1989 Wal-Mart data
center was built so that it could communicate via any means available
- including copper wire, fiber optics and satellites.

The firm no longer works with Wal-Mart, and Ferguson said he had no
knowledge of the design or purpose of the data center in Jane. But he
suggested that Jim Liles, a Memphis engineer, might know.

Liles said he was a consultant on the Jane project, and that Crossland
Construction was the contractor, but he was reluctant to say much
else. "As far as what its purpose is, all that has to come from
Wal-Mart," Liles said.

Crossland Construction, based in Columbus, Kan., said Tim Oelke of the
company's Rogers, Ark., office had been in charge. Oelke did not
return a phone call seeking comment.

'Never saw a plan'

The data center was completed in 2004 and was part of a project that
included the Supercenter, which opened early last year, and a
warehouse. The resulting economic impact on McDonald County, known for
its rolling hills and lazy rivers, is difficult to underestimate, said
Rusty Enlow.

"Just a few years ago, one new store would have been a big deal,"  
Enlow said. "And I'm not talking about a Supercenter. Just a gas
station would have generated excitement."

Now, Enlow said, the county's tax base has doubled, and land is going
for about $2,100 an acre, about twice what it was before the project
was announced in 2001.

Enlow is chairman of the county planning commission, a body created by
popular vote in 1964 but which had not met until this month. Enlow
said he doesn't know why the commission never met, but he believes it
was because whatever problem prompted its creation was solved before
the board was appointed. He also said he's not sure the planning
commission has any real authority, or would want any (there is no
zoning in the county), but that he and the other 18 members are eager
to bring even more business into the county.

"It seems with the opening of that store there has just been a lot of
activity," he said. "McDonald County has always been a poor county,
but we are in an excellent position now. We're a friendly place, and
we're open to things."
 
Wal-Mart, Enlow said, had created a business synergy that was helping
the county of 22,000 shed its hillbilly stereotype.

Enlow was director of the McDonald County Economic Development Council
when Wal-Mart quietly began scouting for land. Only after the land had
been bought south of the then-unincorporated community of Jane was it
announced that the project was Wal-Mart's, and even then, plans for
the data center were closely held.

"I never even saw a plan on it," Enlow said.

But Enlow said he watched during the construction of the data center,
and that it appeared to be a single-story building that was built
"like a bunker," with mounds of earth piled against the sides. He
later was told that it would employ 15 to 20 people, and that the
building was for data storage.

To facilitate the project, the Missouri Department of Transportation
agreed to widen Highway 71 to four lanes from Jane to the Arkansas
line; a grant was used to expand the public water district; and the
Army Corps of Engineers approved a request to fill in a small portion
of wetland along Bear Hollow Road.

Meanwhile, the village of Jane incorporated.

In April 2005, Wal-Mart used the 160,000-square-foot Supercenter to
demonstrate its micro-merchandising capabilities as part of a media
conference. Employees demonstrated hand-held Telxon (pronounced
Tel-zon) computers, which resemble hand scanners but hold a year's
worth of a particular store's sales history on every item. The devices
help store managers decide what to stock.

Bananas are Wal-Mart's best-selling produce product nationwide, but at
Jane, the top seller was lettuce, Supermarket News reported after the
event.

'Secretive'

Bill Wilson, McDonald County presiding commissioner, said he has never
been inside the green-roofed data center, and that to his knowledge,
only one county official has: Assessor Laura Pope.

"I had to sign a document saying that I wouldn't talk about what's in
there," Pope said. "I've never been in a situation to tour anything
like that before. I don't want to be secretive about it. Basically, it
houses computer equipment."

Pope said she had never been asked to sign a nondisclosure agreement
before in her job as assessor, and that she didn't keep a copy. She
said she didn't appraise the building and equipment, but rather came
to an agreement with Wal-Mart on what it was worth.

They agreed that the data center would be worth $10.7 million at fair
market value, she said. The equipment inside the center was judged to
be worth nearly three times as much: $31.7 million.

The taxes that Wal-Mart paid last year on the data center totaled just
more than $500,000: $128,091 for the real estate and $373,091 for the
equipment.

Pope said she did not place a value on the data stored at the
building. At an estimated worth of $42.4 million, is the Wal-Mart data
center at Jane important enough to the infrastructure of the state -
or the country - to be on Missouri's list of critical assets?
 
Paul Fennewald, Missouri Homeland Security coordinator, said the list
is confidential, and that he could neither confirm nor deny that the
Jane building is on it. He did say that the list includes 4,000 to
4,500 sites across the state.

'Retail surveillance'

Albrecht, the consumer activist, said that when the contractor came to
her with the story about Wal-Mart wanting to biometrically identify
customers through video, one of the reasons given was to help law
enforcement.

"You could search for all sales of a particular kind of rope and get a
photo of who bought it," she said. "On the other end, you could
research all of the purchases of a particular individual, even if they
paid in cash."

Albrecht is the co-author of "Spychips," about the use of RFID, or
radio frequency identification devices, by the government and
corporations to track individuals. She lives in Nashua, N.H., and is
getting ready to receive a doctorate of education in consumer
education.

"To the best of our knowledge, the only consumer-level item that is
(RFID) tagged at Wal-Mart are Hewlett-Packard products and some Sanyo
television sets," she said. "Now, the privacy implications of that are
fairly trivial, because you're not going to be walking down the street
carrying your printer box in your back pocket."

But in 2003, she said, Wal-Mart did two experiments using RFID on
smaller items: razor blades and lipstick.

At Brockton, Mass., Albrecht said, the company used a surveillance
camera on a shelf that was linked to chips in packages of razor
blades. When someone picked up a package, she said, the shelf camera
would be activated. Another camera would take a mug shot of the
customer at the checkout stand.

At Broken Arrow, Okla., she said, the company linked devices in
packages of lipstick that triggered a camera that allowed the lipstick
manufacturer to watch consumers on live video.

The experiments apparently were aimed at decreasing theft or for use
in merchandise research, she said. "Since 1999, I've been working on a
phenomenon called retail surveillance, which is a whole panoply of
technologies that are being secretly deployed," she said. "I think
most people, when they learn about these technologies, are quite
disturbed. There's a sense that when you enter a retail space, you
should retain some degree of privacy."

But, Albrecht said, there's a push among retailers to collect as much
information about their customers as possible - and to keep the
lower-profit individuals, known as "barnacles" and "bottom-feeders,"  
away.

"There's a lot of hand-wringing about how we can find out even more
about our customers," she said. "And to the extent that Wal-Mart may
be creating the ability to monitor consumers by RFID and identify them
by video, I'm extremely concerned. ... If that's the case, they would
need that kind of data storage."

Wal-Mart's stand on RFID

"Electronic product codes (EPCs) can best be described as the next
generation of bar codes. Unlike current bar codes, which only share
that a carton contains product XYZ, EPCs can identify one box of
product XYZ from another box of product XYZ.
 
"This is possible because EPCs are powered by radio frequency
identification or RFID. EPCs do not track customers. ... EPCs assist
retailers in more closely monitoring where products are as they move
from manufacturers to warehouses to a store's backroom.

"This helps us do a better job of having the right products on the
shelves when you come to buy them."

Source: www.walmart.com