Shoppers often judge a store by its window display. But these days, they should be more concerned about what could be leaking out the window than what's in it.
Millions of customers who shopped at stores owned by TJX Inc. such as T.J. Maxx and Marshall's found out the hard way: Hackers parked outside used a laptop and antenna to capture data from the company's wireless network, enabling them to breach TJX's computer systems and over several years steal credit-card numbers and other information on 45 million consumers.
While it's a headache for shoppers, it's proving to be an expensive lesson for the retailer, costing it millions of dollars and making it the target of numerous lawsuits.
Now an Owings Mills company says it has a solution: a transparent window film that prevents such data from getting out at all.
ASTIC Signals Defenses LLC's SD1000 film is made up of 21 layers of metal and metal oxide structures, each layer just one ten-thousandth of the thickness of a strand of hair.
Applied to the interior surface of glass, the film not only keeps data from leaking out but also blocks 99 percent of ultraviolet and infrared rays and makes the glass shatterproof, according to the company.
Up to now, the film had been restricted to government use - "the three-letter agencies," in the words of Ron Waranowski, co-owner and managing director of Signals Defenses, who said he couldn't say more because the work is classified.
But with the development of a next-generation product for Uncle Sam, the company is able to sell SD1000 film on the commercial market. That's the same pathway followed by many now-common technologies, including GPS, the global positioning system developed in a Johns Hopkins lab for military use.
Encrypting data is not enough to deter hackers, Waranowski said.
"I call it 'security by denial,'" said Waranowski, a former defense contractor. "We're saying, don't even let them look at it."
The idea for the window film came from the government itself, Waranowski said.
Waranowski's partner and president of Signals Defenses, Deron Simpson, was in the window tinting business in 1998 when he got a call from officials at the National Security Agency. He was asked to work with a Martinsville, Va., company, CPFilms Inc., now owned by St. Louis-based Solutia Inc., to develop a window film that would protect wireless data.
An early version of the company's product was installed in the E-ring of the Pentagon two weeks before it was hit by a hijacked jet in the Sept. 11, 2001, terrorist attacks. A few months later, realizing there could be a significant market for the product, the principals incorporated the company.
Signals Defenses and CPFilms share patents on the use of the technology. With just four employees, self-funded and privately held Signals Defenses decided to license the manufacturing and marketing rights for SD1000 to Solutia for the commercial market, primarily for financial institutions and hospitals that must protect sensitive data.
The two continue to improve the government product, and have produced a stronger, third-generation film called SD2500.
"Companies spend millions of dollars on their IT networks but they don't realize their wireless data is going out the window," said Caryn Crump, general manager of CPFilms North America.
"There has been a huge proliferation of wireless products, and with that proliferation, you have a greater need for protection," she said.
While the TJX case made headlines, most wireless breaches don't, said Jay Foley, executive director of Identity Theft Resource Center, a San Diego-based nonprofit that helps victims.
For example, people using a wireless connection at a hotel could have their data stolen by another wireless user, but victims won't realize it until some time later, he said. By the time they find unauthorized transactions on their credit-card or bank statements, it's highly unlikely they will link the breach back to their hotel stay, he said.
While encryption technologies work, Foley said, many companies don't invest enough to fully protect their data - often because they don't know how much protection they need until it's too late.
"What is TJX's focus?" he said. "Selling clothes and making money."
Foley believes products like Signals Defenses' window film work but should serve as a piece of an overall security program.
Protective glass and film is a growing market, with products that can withstand hurricane-force winds, earthquakes and bullets, said Scott Haddock, president of the Protective Glazing Council. The products range in price depending on the level of protection.
"It's not an inexpensive method right now but as the market develops, the price will come down," he said. Waranowski estimates SD1000 costs between two and three times the cost of regular tinted window film.
Such products first gained notice after the 1995 Oklahoma City bombing, Haddock said, when more of the dead and injured were wounded by flying shards of glass than the actual bomb, and again when American embassies in Africa were hit. The Clinton administration asked the glazing council to advise it on how to protect government buildings from bombs and other types of sabotage.
"In the past, those buildings were considered soft targets," said Haddock, whose Prince Frederick company, GlassLock Inc., sells Signals Defenses products, among others. "There was no reason to think they would be targets for a bombing. And the terrorists knew it."
His company has outfitted two dozen buildings owned by the Environmental Protection Agency, which the agency feared could be threatened by eco-terrorists. On behalf of the glazing council, Haddock said he is advising the New York Police Department and developers on designing buildings in Manhattan.
Jeff Green, chief executive of XLNT Tinted Windows of Owings in Calvert County, said he installs Signals Defenses products and others for government customers "every week."
He said it may take the commercial sector some time to catch on because protective window film is a "big ticket item," but government demand should remain strong. He said the General Services Administration, the government's acquisition arm for equipment, services and real estate, now requires even leased buildings to have glass that can withstand a bomb blast, he said.
"9/11 really launched our business in this sector," Green said.