"The Armed Robbery Epidemic" - NRF

By: Rob Kilpatrick, Published on Jul 06, 2017

The National Retail Federation (NRF) Protect 2017 featured a session titled: "The Armed Robbery Epidemic: How to Stay Safe [link no longer available]". IPVM attended this and shares key findings from the session.

To combat this robbery epidemic, the Loss Prevention Research Council worked with retailers to examine robbery data and surveillance video, producing a set of recommendations which they refer to as "Zones of Influence".

The presentation covered these zones and how three different retailers implemented specific technology in each zone, with presenters from:

  • Kroger: Kevin Larson, Sr. [link no longer available], Corporate Loss Prevention
  • Rite Aid: Robert Oberosler [link no longer available], SVP, Loss Prevention
  • Walmart: Russell Hinds [link no longer available], Senior Manager, Facility Security

LPRC ***** ** *********

*** **** ******* * zones ** ********* ** retail, ****** **** ******* the ***** ** ****** to ******** ******:

  • **** * ****** ** areas ******* *** ***** property, **** ** *** surrounding ************, ** **** as *** *****/*****'* ****** presence.
  • **** * ******** *** facility's ******* *** ***** to *** ***** ********.
  • **** * ****** ** the *****'* ***** *** general ******** ***** (***-********, generally **** ******** **** areas *** ******* ** zones * ** *).
  • **** * ******** ******** interior ***** ** **** value ** ******** ****** goods, **** ** ********, razor *******, ***.
  • **** * ** ******** interior ******, ********* **** tags ** ********, ***** on ******, *** ******** on *** *********, ***.

Surveillance/System *********

*** ********** ********* ******* additions ** **** ** these ***** ** ***** security ******** ***** **** believe *** ****** ** prevent ***** ********* ** reduce ***** ******, *********:

  • ****** **** ******** (****)
  • ****** ******** ******
  • ************ *******
  • ******** ***** *******
  • *** ********
  • ***** *****

Public **** ******** (**** */*)

*** ********** ********* *** effectiveness ** ********** ****** view ******** (****) ********* not **** ** *********/*****, but ********** *** *****. For *******, *** *** below ** ********* ****** a ******** *******, ****** customers *** ********* *********.

Camera ******** ****** (**** *)

********* ** **** ***, the ***** **** ** modern ******* *** ******* or ********** ***** ********* effects ** *** ******* lot ****** ********* ***** the *****. ** ****** that **** **** ********* blinking ****** **** ***** exterior ******* *** ********** effect.

Signage ** *** (*** *****)

*** ********** **** ******* and **** *** **** stressed *** ********** ** surveillance *******, ****** ** as * *** ********* to *****-** *******. **** Aid ****** **** "*** can't **** ******" **** signs ** *** ******* lot.

Smart ***** (**** *)

*** ** *** ********** mentioned***** ******* ******* ** ********** against ******* ** ******** related **** ****. ***** safes *********** ********* ** a "******* ***", **** retailers ********** ***** *********, which ** ******* *** transferred ** ***** *******. Deposited **** *** *** be ********* ** *** store, **** *** ****/******* car *******.

***** ***** **** ******* mitigate *** ****** ** armed ********* ** *** key ****:

  • ** ******* ****:****** ******** ***** ***** require ******** ** ***** cash ******** ** **** night ******* *****, ****** them * ****** ** robbers. ***** * ***** safe, ***** ******/**** ******** funds *******.
  • **** **** ** ****:******* **** *** ** counted *** ********* **** easily, ********* *** **** less **** ** *** till, ****** ** * less ********** ****** *** robbery *** ******** *** potential ****.

GPS ******** (**** *)

****** *** ******** ******* to ***** *******, ********* all ********* *** ******** as ****** *** ******** objects ***** ***** ********. Walmart **** ** ******* of ******** ****** *** batteries *** *** ********, which **** ***** ******* blocks **** **** *** thief ****** ** ****** items ** ******* *****. GPS ******** *** **** be ******** ** **** cash **** ** **** of *******.

Future ***********

*******, *** ********* ****** that **** **** ******* at **** ************ *** future ***:

  • ******** *****:**** *** ********* **** were ******* ** ******** pendant ***** ****** *** each ********. **** ***** enable **** ** ***** local *********** **** ******* instead ** ******* ** be ** ***** ** fixed**** ** ********.
  • **** ***** ********:**** ***'* ********* **** one ****** ********** ****** "soon" *** **** ***** "digital ********* ********". ***** an **-**** ****** ** "ping" ****** ******, *** store *** ***** *** phone's *** ******* *** "up ** */***** ** a ****." **** ********** would ***** ****** ************ of ********* ***** *** fact.

Comments (21)

"Using an on-site device to "ping" mobile phones, the store may track the phone's MAC address for "up to 2/10ths of a mile." This technology would allow easier apprehension of criminals after the fact."

The 'tracking' part sounds pretty far-fetched.  (read: marketing hype)

Let's play out the scenario.

Perp robs a CVS with his mobile phone in his pocket. (could happen)

On-site device pings this mobile phone during the commission of the robbery, capturing the mobile phones MAC address. (could happen)

Cops show up in good time, consult the on-site 'tracking device' and catch the perp counting his loot behind a dumpster in some alley less than 1050 feet away from the CVS he just robbed. (never happen)

How does this on-site device purport to 'track' a mobile phone anyway?  Without triangulation, I would think the only thing it could provide is simple distance from pinging device - not direction, and certainly not location.

Seems like a better use of this cell phone tracking gizmo would be to establish (the owner of) the cell phone was on-site at the time of the robbery.  

Also useful to tell you if the owner of the phone re-enters the store at some point in the future.

I wouldn't necessarily disagree with you. Those comments were Rite Aid's, not ours. We don't know enough about what's out there or "coming soon" to comment one way or another, though Brandon and Undisclosed #2 have good points. 

I realize that you were just reporting what they said about 'future' technologies that may or may not be rolled out.  I was just pointing out what I thought were obvious flaws in the purported stated capabilities of this future technology (i.e. 'tracking').

And to Brandons point, I would also point out that the technology can tell when a device is on-site - not whom the possessor of the device is/was. (though video might help to establish this).

The device in question is called "String Ray" and they can be extremely effective at metadata collection. If used in a Mesh-Networked Environment (IE- Deployed at multiple stores) they can track a cellphone's MAC Address/IMEI and get general location data based on the base-station that the phone connected to. 


I am aware that law enforcement in the U.S. are using stingrays - primarily because their aren't any up-to-date laws restricting their use without a warrant.  That will eventually change.

I am not aware of any private corporations that are allowed to use this same technology. This will not change (imo).

I agree. The chances of them using String Ray (IE- Cellular Based Tracking) is small due to the legal issues. That being said, if a BTLE/WiFi solution similar to Sting Ray were to be implemented you could make the case that any data collected from those type of devices would be legal because the device accepted the connection from the store.


Think Rouge APs  logging the connection of every device that connects to the free WiFi in the store. 


I got no beef with logging devices that connect to free wifi - since this is 'opt-in' - i.e. an overt act to connect and use a free service.

What I (and I think lots of other people might) have a beef with is the surreptitious logging of devices by retail outlets without requiring users to opt-in.

imo, Rite Aid is dreaming if they think they are going to be able to use the kind of tracking technology they describe as 'coming soon'.


Turn off your phone before robbing someone.

... but how will I call the getaway driver?

The more common scenario (based on discussions I have had with other companies about this) is that they are constantly logging phone MACs. In many cases with theft you are not dealing with highly logical/organized individuals, so there is a good chance the person has been at the store before and/or at other stores. They may also visit other stores after the fact.

By taking all of the phone MACs that were pinged by in-store wifi devices at the time of the robbery they can search previous video and/or video from other stores for those same MACs. From there you can potentially narrow it down to certain people, based on basic appearance data. And in some of those cases the person may have made a transaction that used a loyalty card or a credit card, both which can reveal additional detail about the person.

I was not at NRF, and the Rite Aid guy may have truly been referring to some much newer technology for tracking mobile phones, or he may have been referencing technology already in use elsewhere that he just did not have a lot of first-hand experience with yet.


I believe what you describe about MAC address is at least part of what he was talking about. He definitely mentioned tracking subjects for "2/10ths of a mile", though. 

I am really curious how they plan to accomplish getting the MAC Address/IMEI of the device. I had a conversation with UD1 about it above and he brought up the legality of the situation, but it sounds like what they are describing is a commercial version of what the government is already using.

I'm not sure if they will capture IMEI or not. Getting the mac of the wifi adapter is pretty easy though.

I imagine you could get IMEI data if you setup in-store pico-cells, particularly if they were designed to sniff/log IMEI data, but I'm not sure it is worth the overhead of carrying cellular call traffic on your store's internet connection.

It might also be feasible with in-store "signal boosters", similar to those used in dense buildings to provide better reception in those buildings.

I believe IMSI ID (GSM networks) is broadcast from the phones un-encrypted. Not sure about IMEI.

Either way, I think there are a few means of capturing a unique identifier from customer-carried mobile devices. It is likely not 100% accurate or reliable, but may be sufficient to use to solve some percentage of robberies (not to mention track other data, like frequency of customer visits, etc.).

The Stingray devices are specifically designed to intercept calls, and provide a means to listen in. I can see legal issues for those, as you are getting access to encrypted data that the user would not expect to be available to 3rd parties. Capturing broadcast data from the phone may be different, particularly if that data only identifies the hardware, and not the user/holder.


I'd say Brian is on the money with what the retailers are doing and planning. That's already happening on a large scale right now - and not just "opt in" WiFi users - basically anyone who has their mobile device WiFi on (and in some cases those who have their Bluetooth enabled). This is happening in many malls and large retail centers, as described in this HBR paper from 2014.

Head to any of the big retail analytics providers (RetailNext, Cisco Meraki etc) and you'll see what they're doing - most of this is being sold to marketing departments but the integration with security is coming, and that's where the integration with video surveillance / access control gets interesting.

The basic device detection is done without opt-in, as Ruckus describe in one of their white papers "In a typical retail environment, a very high percentage of
shoppers will have Wi-Fi enabled devices and between 50-70% of them are likely to have their Wi-Fi turned on, so will be able to be anonymously tracked via the Wi-Fi infrastructure".

Here's one example of a basic primer blog on it. Worth noting that Bluetooth is also used, and can be more effective (in another country I know they use Bluetooth sensors to sample and monitor vehicles along roads, and they found it more reliable to detect than WiFi seeking in that application).

As to the tracking to 2/10th of a mile, that seems high unless they're talking about inside a mall or other network outside the store itself...

When I read it, I assumed they were talking about pre-paid phones they sold....

It seems everyone carries a phone today, especially the bad guys. Leaving a retrievable electronic signature in a store, a bank, or some other location where they have this technology, and where a crime just occurred, will give investigators a tremendous tool to track down a criminal. An investigator could submit the data to cell provider databases for ping location history, which may correlate to other locations where similar crimes occurred. 

Good points (pro and con) regarding the cell phone tracking. That noted, I have a question and a point. First, what cameras (besides dummy devices) have blinking lights?

Regarding loss prevention in general, technology will help. However, the biggest difference will be made through educating store employees about what to do (and what not to do) regarding armed robberies and shoplifting. Too often, there is no set policies and/or training for the minimum wage workers that are at the point of loss. The policies should be vetted by experienced security professionals and communicated often to employees. Training should be done at initial hire and regularly to re-enforce the importance and bring in changes in approach and highlight new threats.

As technology integrators, we often overlook the importance of the human element...which is often the difference between making the technology effective or rendering it useless.


David Coughlin


Here is why we need to rethink camera positions.  Although many are afraid to install audio due to regulations, the audio does provide a lot more insight into the perpetrator than the video.

The video shows a possible witness, that helps!

I wonder if detectives would think to capture a log of any attempts to connect to the motel wireless?  I could see this guy leaving his phone on.

When will law enforcement be able to request phone GPS information from sites that track it like Facebook?

Read this IPVM report for free.

This article is part of IPVM's 6,541 reports, 882 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

US GSA Explains NDAA 889 Part B Blacklisting on Jul 31, 2020
With the 'Blacklist Clause' going into effect August 13 that bans the US...
Deep Sentinel Presents Crime Response For Business on Jun 11, 2020
Deep Sentinel presented its anti-intrusion and live response for home and...
HID Presents Mercury Security & Aero Access Controllers on Aug 25, 2020
HID presented Mercury Security & Aero Access Controllers at the 2020 IPVM...
SenseB4 Presents Cloud Network Device Monitoring on Jun 09, 2020
SenseB4 presented its cybersecurity and network health monitoring products at...
Axxon Presents VMS 4.4 and AI Behavior Analytics on May 20, 2020
AxxonSoft presented its VMS 4.4 and AI behavior analytics at the April 2020...
SIA Coaches Sellers on NDAA 889B Blacklist Workarounds on Aug 05, 2020
Last month SIA demanded that NDAA 899B "must be delayed". Now that they have...
Axis Compares Fever Camera Sellers to 9/11 on Sep 18, 2020
Axis Communications, the West's largest surveillance camera manufacturer, has...
VergeSense Presents People Tracking Sensor on Jun 04, 2020
VergeSense presented its people tracking sensor and social distancing...
Startup Solink $17 Million USD Fund Raise Expands To Mass Market on Jun 24, 2020
Solink has raised ~$17 million USD, a sizeable round for the company that...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...
Defendry Presents AI Active Shooter Security System on Jul 14, 2020
Defendry presented its Active Shooter security system at the May 2020 IPVM...
Anyvision Presents AI Facial Recognition and Mask Detection on Jun 08, 2020
AnyVision presented its AI facial recognition and mask detection at the May...
Uniview Deep Learning Camera Tested on Jul 14, 2020
Uniview's intrusion analytics have performed poorly in our shootouts. Now,...
The Guide To The NDAA Video Surveillance Ban / Blacklists on Aug 24, 2020
This 25-page guide provides a reference to the NDAA ban and blacklist. The US...
Startup Rhombus Presents Cloud Managed Physical Security on Sep 02, 2020
Rhombus Systems, a closed camera, analytics and cloud VMS alternative to...

Recent Reports

New Products Show Fall 2020 continues tomorrow with Genetec, Milestone, Avigilon, Microsoft and more! on Sep 29, 2020
IPVM's sixth online show continues tomorrow and will feature New Products...
Avigilon / Motorola VS Virtual ISC West on Sep 29, 2020
ISC West has historically been so dominant that no player would think of...
Dartmouth College Deploys K3 Temperature Screening on Sep 29, 2020
While Dartmouth College has a $6+ billion endowment, the College has bought...
Hanwha AI Object Detection Tested on Sep 28, 2020
Hanwha has added detection and classification of people, cars, clothing...
Favorite Access Control Manufacturers 2020 on Sep 28, 2020
200+ Integrators told IPVM "What is your favorite access control management...
OnTech Smart Services Partners With Google and Amazon To Compete With Integrators on Sep 25, 2020
A pain point for many homeowners to use consumer security and surveillance is...
The Future of Metalens For Video Surveillance Cameras - MIT / UMass / Immervision on Sep 25, 2020
Panoramic cameras using 'fisheye' lens have become commonplace in video...
Hikvision Sues Over Brazilian Airport Loss on Sep 24, 2020
Hikvision was excluded from a Brazilian airport project because it is owned...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations are at an all-time low, optimism about relations...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
IP Networking Course Fall 2020 - Last Chance - Register Now on Sep 23, 2020
Today is the last chance to register for the only IP networking course...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Norway Council of Ethics Finds Hikvision Human Rights Abuses "Ongoing" on Sep 23, 2020
Hikvision's involvement in "serious human rights abuse" in Xinjiang is...
IPVM Camera Calculator User Manual / Guide on Sep 23, 2020
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The...