LPRC - CrimeScience – COVID-19 Series: Episode 7 with Dr. Read Hayes, Tony D’onofrio, and Tom Meehan

Episode Date: May 21, 2020

On this week’s LPRC CrimeScience COVID-19 Series episode, Dr. Read Hayes (LPRC), Tom Meehan (CONTROLTEK), and Tony D’onofrio (TD Insights) discuss LPRC initiatives, the global economy, crime data, public perception, credit card fraud, physical security, spear phishing, and data breaches. The post CrimeScience – COVID-19 Series: Episode 7 with Dr. Read Hayes, Tony D’onofrio, and Tom Meehan appeared first on Loss Prevention Research Council.

Hi, everyone. Welcome to Crime Science. In this podcast, we aim to explore the science of crime and the practical application of the science for loss prevention and asset protection practitioners, as well as other professionals. We would like to thank Bosch for making this episode possible. Be a leader in loss prevention by implementing integrated solutions that enhance safety, reduce shrink, and help to improve merchandising, operations, and customer service. operations, and customer service. Bosch Integrated Security and Communication Solutions spans zones one through four in the LPRC's zones of influence, while enriching the customer experience and delivering valuable data to help increase retail profitability. Learn more by visiting Bosch online at boschsecurity.com. So welcome everybody to another episode of Crime Science, the podcast. This is another one of our special COVID-19 episodes where we're trying to pull together information and inform the LPRC community, as well as the listeners at large, what's going on from the different perspectives in a fast-moving news brief format. So,

I'm joined today again by Tony D'Onofrio and Tom Meehan and our producer Kevin Trant from the LPRC. So from the LPRC front here in Gainesville, not only were we experiencing 90 plus degrees temperatures, which is normal for about eight months out of the year here, but we are finally able to start to do a little more in our labs. We got a special clearance from the University of Florida for the UF Innovate building that the LPRC is located in with the four labs plus the SOC area, Security Operations Center lab, to come in with only a few members were given clearance and had to take very special precautions. And then only other, when we did research, we had the research participants had to be UF, faculty or staff or employees. So they've opened that up just a little bit more. You have to wear

masks. There's a lot of sanitizing stations, maintain separation, but we are now have gotten clearance. We had Bosch in here installing some new tech in the lab onC to make sure that their technology is represented in the engagement lab. And I want to put out there, if you want to contact Natanya, and it's Natanya at lpresearch.org, O-R-G. If you're looking to put your, you're a member and you want to put your technology in there. In the case of Bosch, we've got the new tech where we've got their latest cameras at both of the entry and exit points to the engagement lab with some AI on the edge and the camera itself. And it's counting people in and out of the lab. You set a saturation point to reduce infection dosing in that area.

In that lab, it's set at two humans at the same time. And so, of course, it'll count people in and out and then signal red or green and so forth. So it's just an example of repurposing technology that we're encouraging all our members to do. And so the survey, by the way, is coming out here shortly on where we've asked our retailers how they've repurposed, and I've mentioned this prior, are repurposing their people, their tactics, their technologies to leverage safer and more productive business practices. So look for that report to come out very shortly. The cluster call two, where we did a series of five calls with our retailers broken into six to eight retail chains per call went very, very well. The summary report's coming out as we speak.

Probably look for it this week, hopefully. The crime science interview we did with Dr. Fred Southwick is ready. It's been edited and approved. And again, there'll be a little summary, just a recap of what we talked about in written form coming out as well. So look for that Crime Science Podcast episode from Dr. Southwick from the University of Florida's Emerging Pathogens Institute and Infectious Disease Physician. Very in-depth discussion, really understanding the virus, you know, and how it works and then what all that means for us as we open so that we can make better, more evidence-based or

science-informed decisions. We've got some brand new episodes that have just been posted on Crime Science. Check those out, of course, again, that'll, that'll be something you want to look at and see some of the episodes that are out there, but we just released some with Eric White, talking about emergency procedures. We've talked about before with Michigan State University, talking about branding and people taking advantage of counterfeit and branding and subpar products. We understand, for example, on antibody testing, there are almost 100 tests available in the United States today. And many, many,

many of those tests may have issues with their precision and specificity. In other words, they may not catch everything or overly have a false positive or negative, or their specificity is not accurate. It might hit positive, for instance, on another type of coronavirus, a cold or something like that. So the point is, it's always buyer beware. We've heard some of the horror stories with the PPE and so on, but also name brand products. Counterfeiting is still out there. On the LPRC Innovate call, again, we have been moving now to close the gap with what's called R3, rapid response research.

We put out the criteria. We have a checklist that goes out to all the members, to the retailers, if they want to participate in that R3, then what we need, of course, is access, access, access. So we need access to take some of the 3D imagery we need, both moving or video, as well as still tour shots. And we need either live or delayed feed from cameras in the appropriate area that they need the research done. We need access to employees and so on through some of the online research capability we have. And finally, when safe, we need, of course, access to the premises.

access to the premises. So that we've kind of identified or they've identified with us, the retailer, some of the R3 or rapid response research that they would like to focus on initially. And some of those involve, you know, looking at curbside, of course, pickup, a huge area of opportunity we've discussed quite a bit here on this podcast. Buy online, pick up, or return in store is very critical. Also, low-no-touch checkout, again, in all the different forms, ways that we're looking at. So that's what we're setting up now on low-no-touch checkout, both inside and outside. And think again, it's sort of like where we have been for years at airports, where you can either check your bag outside or you check your bag inside.

And what does that look like? And how do we do it without exchanging a virus? The curbside return policies and procedures, something, in this case, we don't need access necessarily to their sites, to the retailer's premises, but rather to their people and understand what the policy and procedures are. But then we do need evidence as to what the compliance to those policies and procedures are to look for gaps and opportunities in both procedure, but also in execution or compliance. In that area, UVC lights, of course, of great interest to use to sanitize shopping carts, point of sale where there still is some low or other contact fitting rooms, stock areas, and things like that. Return to merchandise. Are there ways to more rapidly and effectively and safely sanitize for infection?

And then, of course, other pathogen spread reduction. The retailers have interest not just in the stores, but looking at the distribution centers and their offices, ways to look at the building capacity. I mentioned the technology that we've just got in our lab Friday to help meter that. You know, we know that elevated body temperature is a lag variable. Some people don't even exhibit that, that they're shedding virus, or that if they do, it's a few days in, but still can be potentially a way to screen people out that are infectious. And so we've got multiple solution partners providing that technology. We've not installed them yet, but I understand they're on the way. And the retailers want us to take a strong look at that with them,

as well as the desk in offices, as well as the point-of-sale airborne protected shields. And everybody's either seen them or used them if you're a retailer in this case um are there what are the best ways to do that now we're not engineers and certainly not emerging pathogens uh scientists uh we're behavioral scientists but uh coordinating with colleagues in those areas is what's helpful. And then finally, you know, the research continues and what we're doing is moving as rapidly as we can on some of the AI, the artificial intelligence, particularly computer vision with some technical partners. As of this point right now, Malang, we're very engaged with them and myself and then some colleagues from user experience design over in engineering

and computer science engineering. So stay tuned to what we're working on and how that looks. So another round of cluster calls will come up probably in a week and a half to two weeks and then look for other areas of opportunity on the R3 or rapid response research. We encourage you to go to the lpresearch.org website. You can poke around in there. Kevin, our producer, is working a way to get some online access so that people can at least look and tour the lab facilities virtually from the comfort of your phone or home or office. So that should be coming out. Impact 2020, if you remember,

Impact 2019, first week in October every year. Last year was sort of the last major loss prevention or asset protection conference that took place in the United States, ironically. And that's still a full go for the first week in October this year. And so it's just a matter of all 12 sessions will be virtual, digital sessions. Strategy at will be virtual and digital, but also have an in-person component. We're still trying to determine if we have 50 or 150 or 250 people

that still like to come in for impact. Is that possible? And how would we accommodate that in a really powerful way, particularly with all the new lab capability? And there's a lot of neat things to see and do if we can do it safely. And the University of Florida can accommodate that as UF works to get back in total business. All research has continued, but not necessarily on campus. And human subject research had to be dramatically curtailed. And

even our teams had to come up with ways to virtually research, have people work with us where we're not actually present with them. So that's it from the LPRC standpoint, a ton going on, a lot of action and activity with our members, both retailer and solution partner alike. And we encourage you to hit the website and talk to us at any time. With that, let me turn it over to Tony D'Onofrio. Let's talk about the world, the world of retailing and what's going on in this crazy environment. Thank you very much, Reed. So, yes, there is a lot going on. A lot of new data came out last week, and I'm going to share some of it. So I'm actually going to start again in China, partly because again, China came out first from the crisis, COVID-19. So they

reported that retail sales last week and their retail sales were down 7.5%. But actually, that is a major improvement. So January, February, retail sales were down 20.5%. retail sales were down 20.5%. In March, they were down 15.8%. So in April, the recovery is underway. In other words, the curve has turned up and they were only down 7.5%. So they're underway back up. And in fact, a friend of mine who has a consulting firm in Shanghai shared some pictures online of retail in Shanghai. And he shared a picture of a long line in front of Chanel of people waiting to get into luxury Chanel buying. So that is good news for retail. And also he shared some pictures of restaurants being filled. So retail is coming back online in China. And again, they were one of the first. The U.S. also reported retail sales last week, and they were down 16.4%,

one of the worst. And that follows March, which was down 83%. And U.S., retail sales are extremely important because 68% of the $21.5 trillion economy are from personal expenditure. So retail needs to come back for the U.S. economy to come back. So it's very, very important for that to happen. But I did see some really good data in terms of for optimism, in terms of the return of U.S. Some of it is that going into the crisis, household debt was very low, so consumers had strong financials. The stock market is actually up since it went down at the beginning, and it's been going up, and partly because the stock market is foreshadowing that we're going to come out of this crisis. So investor optimism is that we're going to get through it.

Recessions have actually been getting slower over time. And so the anticipation is this one should be a slow one. And then the government has jumped in much more aggressively this time than even the financial crisis of 2008. So this time the stimulus, very heavy stimulus, 3 billion plus came in within eight weeks. The last time it took about 80 weeks to get a stimulus to respond to the financial recession. So much more aggressive response from the government, and hopefully that'll set us on the right track going forward. There is a lot of concern on the consumer side post-COVID-19. More are going online.

I've seen anywhere from 47% to grocery, 61% jumping online to buy. 39% were unable to find everything they needed. 25% have not been receiving orders on time, so things have been late. 27% were not offered the order fulfillment options they wanted. 73% started to care about the country of origin, and that's actually 36% for the first time. And that gives you a few hints in terms of where the world heads next in terms of how supply chains are going to evolve going forward. A big focus this past week has been on looking at safety and how when malls reopening exactly to what Reid was just talking about, working in fitting rooms and all those

kind of things, how are consumers feeling about malls versus the rest of retail? There was an interesting study that came out from First Insight that actually ranked the different sectors, and malls came out last in terms of where consumers actually felt the safest. Second to last were department stores. Where consumers feel the safest are in grocery stores, number one, in drugstores, number two, and in big box retailers, number three. But malls came out last. And in fact, when they dug deeper in terms of why you're concerned about malls, 65% of women do not

feel safe trying on clothes in a dressing room. 78% of women do not feel safe testing beauty products and 66% do not feel safe working with a sales associate. And to give you an idea how big this safety concern is getting for the first time I actually saw a website that actually ranks retailers based on their contactless pickup, their mask required for associates, mask required by customers, traffic limitation. It's shopsafety.co, and it actually ranks and gives you a score, an overall score, a grade,

in terms of how safe is your chain to actually go shop at. And I think the highest score in the last one that I saw was actually from Target, which got an A-. Also interesting this week was some new data on retail crime trends. So during COVID-19, assault and battery, domestic abuse, use of firearms, and burglary all went up from previous year because of the pandemic in the U.S. And the chart was originally, I saw it actually in the D&D Daily. So I want to give credit to Gus to keep publishing that information. And then finally, I actually did a general retail podcast earlier this week, and I actually shared what new habits I thought were going to get cemented

in the consumer behavior post-pandemic. And the first one that I said, the move online will continue, but it's not going to be as big as everybody thinks. And again, I've shared some of this data in a previous podcast. The forecast for this year is that online sales will get to 21% of total retail sales versus the initially projected 19%. And the reasons, again, are that online experiences are still mediocre. Consumers are social and they want to get together. And it's expensive for retailers to actually run e-commerce.

So that's number one. Number two, contactless commerce will accelerate and that will be driven by things like computer vision, smart shelves, RFID, artificial intelligence, machine learning, and even facial recognition. Number three, curbside retail is here to stay. And in fact, it's going to accelerate. The top three places retailers want to invest next is figuring out better how to do home delivery, how to do curbside checkout, and how to do contactless payment. Number four, grocers and restaurant models are going to merge and you're going to see really grocers turn more into restaurants in terms of providing a lot more takeout foods. That's one of the other trends that I'm seeing. And then the final one, you're starting to see basically consumer product manufacturers getting into the direct-to-consumer business.

So PepsiCo just announced two new direct websites where you can go and order your snacks. So you no longer have to go to the store to order. And PepsiCo is more than Pepsi. They own 23 brands that are worth a billion dollars or more. They own 23 brands that are worth a billion dollars or more. And they include things like Lay's, Doritos, Lipton, Quaker Cereals, and even Ocean Spray. I mean, a whole bunch of different brands. So now for your Doritos, you no longer have to drive to the store. You can actually order it online from one of their snack websites.

And then Unilever actually said that they're going to get into the same game. They had sales of, they had small sales of six to 7% prior to the pandemic online. It's now jumped to 36% of sales going direct to consumer via online. And they announced that they also are planning to set up basically more direct-to-consumer

online business going forward. And in closing, I'd like to close with good news. The last day that I saw actually yesterday is that all of the U.S. is reopening, and all states except for Kentucky, which is opening this week, they're in various stages already of reopening. And even Apple is in the process of opening 25 of their U.S. stores. So retail is coming back in the U.S.,

so good news. So I think we're headed in the right direction. And with that, I'm going to hand it over to Tom. Well, thank you, Tony. And I'll have a couple repetitive points, but I'll try not to get into deep detail because you covered them so well. One thing, I'm going to start with some physical security trends just to talk about and just a reminder of good physical security hygiene. camera systems and all of your hardware in store to just ensure that it's working. A lot of these systems by design were implemented to be used. And when things get turned off or things aren't used for a long time, there are sometimes some software challenges that occur. So it's just a good reminder to take that look at your physical security hygiene. And if you're looking at ePVMs, putting batteries in your remote, going up, making

sure they're plugged in, making sure that your DVRs are clean and functional. This also leads me to the next step of there has been some reports as stores reopen and they have service-related issues that some folks are showing up in store locations that are actually not service technicians to try to get into that physical network. This is not a new anomaly, but what is occurring now is you have folks posing as service technicians going to stores and saying, I'm helping making sure that the store gets up on its own. So this is a real risk, especially considering a lot of retailers built zero trust environments where their POS systems, if they weren't used for 30 days, needed to be put back on the network. So there are some

retailers that know they need technicians to come in to get ready. And unfortunately, the bad guys are talking about it on the dark web and some forums and going in and trying to plug peripherals into networks. So that's something that, while I think it's probably right now a small risk, it's certainly a risk. The other thing I'll say about physical security or physical assets in the store is that there has been a reported increase of counterfeit money. And this has to do with there is this perception that money is more dangerous than it was before. And so folks don't want to handle it as much. So the counterfeit have increased. As you know, I'm heavily involved in the financial sector. And

we've heard a pretty large cry out that because people are not touching the money, if they don't have an electronic method to screen it, that there's been an increase. One of the challenges with everything going on, a lot of those balancing activities and things that happen in corporate offices are delayed. So I think those are all really important keys to talk about. I think I've talked about on every single podcast that we've done in this special edition is the expectation of increased credit card fraud. of increased credit card fraud. As we all pivoted to online credit card processors and companies alike, banks had to adjust their models in real time. And the reality is that everybody wants to take payments in and models generally take several months to learn what a customer's activity is. And this is an event that caused everybody's activity and behavior to change

overnight. So there is an anticipated huge spike in credit card fraud as a percent to sales. So it is relative in the sense that if your sales are significantly down, the percent would be up. But there is numerous reports out now that this is about the time when people are starting to do chargebacks from the first initial. So there'll be an increase. Again, I think it's important to say it's relative to sales that, you know, when your sales are down, this should be a it's a bigger impact because of that in-store sale. So those are kind of my my physical, you know, in-store things. And I just wanted to kind of talk about some cybersecurity awareness type things that we do every week. One thing that is coming up pretty regularly now is, you know, the need as we work from home and your children are home with you being homeschooled, the need to spend the time with the children. And it's the new norm and it's

a new age of having the difficult conversation with kids about the internet and things you can and can't do. There are a whole slew of targeted attacks, and these are targeted spear phishing where people are going after, where, and this is pretty common, but changes with being at home, where folks are looking at high levels, C-level executives who have children, and as opposed to targeting them with phishing and targeting them with attacks, are going in through channels like TikTok and social media channels, utilizing the children to get into information. So this is something that I think existed before, but not at the level it does today.

And certainly when you have children home in lockdown who have virtually changed their life from a school perspective to be online, there is risk there. And I think our children are actually probably, in some cases, more cyber savvy than some of us because they've grown up on devices. But it's a real important reminder to have those conversations about sharing of information, what's appropriate, what's not appropriate, what should never be shared. And the same conversation I have with everybody is the clicking on links conversation. That leads me to my next point is that there is an increase in data breaches. This is a factual number. There are several statistics out. The FBI actually just released a report saying that they expect to see a huge spike in data breaches. And again, that has to do with the need to go from some of these zero trust

environments to open end environments. So you had network infrastructure that was in place that had very secure channels that are now being left open purposely to maintain the business channel. So there's a rapid addition of new hardware that, you know, leaves very little time for cybersecurity professionals to address it. Reid alluded to some of the solutions that are coming out. Some of those solutions are from very are using existing hardware and applying software differently. Some of the solutions to address COVID-19 are new hardware. So anytime you put a new piece of hardware in there, there is a potential risk.

Well, today, we don't really have that time to test it because if you're looking at opening your store or not, you're going to put that hardware in. So there's that also present. And then there's an unprecedented amount of users using remote type technology that hasn't in the past that was forced to. So those are all leading to an increase in actual data breaches today. The kind of scary part, and I'm not a doomsdayer at all to say, is that what we don't know about is more concerning.

What we know about is generally not the problem. It's what we don't know about. And based on everything that we're seeing, we're seeing a lot more than that. The WHO had an issue where they leaked, they had a credential leak of 25,000 emails. This was more of a politically motivated thing. But this is something that probably wouldn't have occurred before.

But with everybody remote, it really runs through and changes the landscape. And then I'll kind of leave with the cyber threats are evolving rapidly. And the cyber criminals are leveraging really everything that's occurring in COVID-19 to deceive people. They're really significantly taking advantage of the cloud adoption that we're all faced with, both in a business and a professional standpoint. So now it's more important than ever to just take those extra steps and the extra time to do your due diligence to check. Unfortunately, this is going to be the new norm for the cybersecurity world where as we have to rapidly evolve to buy, align, pick up, and store in more internet type or connected type solutions, there will be risks that didn't occur before. So I think that's important

to know. And I'll leave you with this thought of that. I think I mentioned this last call. Every week we're seeing reports of new domain and new addresses, email addresses, and actually websites and servers going up directly related to COVID-19. There was over 1.2 million domains registered with key words related to COVID-19 last week.

And just about 15% of those were immediately identified as fraudulent. And the belief is that around 40% of them have some sort of malicious intent. So I think Reid alluded to this. I know everybody has before. everybody has before is if you're buying any type of solution or hard good, whether it be a mask, a PPE, a hand sanitizer, or a technology solution, you really have to at this point, even if you're moving rapidly, take a little bit of time to identify whether the company is And one of the simplest things is to kind of try to find a trail or a history of a company was born yesterday that

should raise red flags if they don't have a parent company. And that's all I have. And everybody stay safe. Over to you, Reid. Thank you very much, Tom. Fantastic. And thank you, Tony, as well. Really good, insightful information. It's nice to get an idea of what is going on. It's very helpful around the world, how things are looking, what are the trends and patterns. I did see that Northern China, they're sort of dealing with a potential second wave in one particular area, but feel they've got it contained so far. So I can imagine, again, there's a preview there, but they're continuing to operate, even though they put in some more lockdown

measures there. And so I keep seeing these breakdowns and breakouts. One thing that I have been hearing from our physician friends is that, you know, when we look at infection rates, that we want to look at the infection percentage or rate, not just the number of infections, infection percentage or rate, not just the number of infections, particularly as testing itself continues to ramp up, particularly the quick testing, the PCR type. More testing, we're going to have more infections determined or detected. So look at that infection rate. And so in counties in Texas and other places that have been fairly aggressive at opening in hopefully safe staged ways, it looks like you're seeing infection rates are remaining stable or even declining while infections themselves are going up because the testing has been continually dramatically

ramped up. So important for all of us to always normalize data, put things into context by the same token. You want to see if things go the opposite way or stay the same. And that's what we always do in any type of research to understand the effects of measures that we might take. So everybody, I want to echo our speakers here. Be safe. Stage things. Do things as well as you can. We're here for you. Please go to our website, as I mentioned.

Reach out. Let us know what you need. But thank you to everybody from the LPRC. Have a great week. Thanks for listening to the Crime Science Podcast presented by the Laws Prevention Research Council and sponsored by Bosch Security. If you enjoyed today's episode, you can find more Crime Science episodes and valuable information at lpresearch.org. The content provided in the Crime Science Podcast is for informational purposes only and is not a substitute for legal, financial, or other advice. Views expressed by guests of the Crime Science Podcast are those of the authors and do not reflect the opinions or positions of the Laws Prevention Research Council.