Security Issues

While users might cognitively perceive the good features of QR codes, they may not intend to use those codes unless something is confirmed. They may want to personally ensure that a QR code is secure and dependable (Shin, Jung & Chang, 2012).

As the encoded information is intended to be machine readable only, a human cannot distinguish between a valid and a maliciously manipulated QR code (Kieseberg et al, 2011).

There is a proof-of-concept phishing attack on QR codes, which is based on the idea of changing the encoded data of a QR code by turning white modules into black ones (Khalil, 2012).

Depending on whether the reader is a human or an automated program (e.g., in logistics), different scenarios are possible (Kieseberg et al, 2011).
1. Attacking Automated Process: SQL injection (executing system demands, adding a user), Command injection (installing root kits) and Fraud (changing the automated system).
2. Attacking Human Interaction: Phishing (setting up a fake website), Fraud (redirecting user to a cloned website) , Attacking reader software (command injection), and social engineering tactics (poster offering discount in a nearby shop).

Mobile Security in general is not near as thorough as one’s computer security "Fewer than 5% of people have got some form of security on their mobile devices”.

As QR Code technology is developing so is security applications. Norton already has a solution to some of the problems above, in the form of ‘Snap’. The application is simply a QR code reader but with the added advantage of the Norton virus and malicious website database that allows the smartphone to be aware of the information the code is about to access so that necessary action can be taken.

It is argued that employing a reputable service provider to hosts your code on a platform adds an element of security. “A threat assessment service is provided along with the visual identification of the provider’s name/logo which reduces the risk of it being a malicious code and signifies that it is a managed code” (Wehrs, 2012).

Legal Issues with QR Codes

QR codes originally were developed for tracking parts in vehicle manufacturing and was then standardized by the Association for Automatic Identification & Mobility (AIM), Japanese Industrial Standards (JIS) and International Standards Organisation (ISO).

QR Codes are open in the sense that the specifications of QR Codes are disclosed and that the patent right owned by Denso Wave is not exercised. It can be used by anybody free of charge as Denso has released the patent into the public domain. Data structure standard is not prerequisite for current usage (Soon, 2008).

In Ireland, there is nothing in the data protection legislation to prevent the use of QR codes. There have been various reports of misuse to the Data Protection Office of QR codes – for example, leading to malware sites (Data Protection Office, 2012). This means that QR Codes have not been tested for misuse and therefore there is no legal structure around them.

“Today's legal concepts, procedures, and structures are insufficient to keep pace with technological advance. Our legal systems need to develop to ensure that technology serves as many people as possible and disservices as few as possible” (Bach, Ivinson & Weeramantry 2001).

QR Code Printing Size/ Error Correction Levels contd.

The data shown below is - QR Code Size Specification. (Source: QR Stuff, 2011)
 Modules: Number of rows and columns of little black squares in the QR code image.
 Characters: Approximate number of characters that would normally fit into a QR code with that many modules using binary data encoding (most do) and Level L error correction.
 Scan Distance: The distance the camera is being held away from the printed QR code.

This is also one of the reasons why a QR code containing the same data will look different depending on which QR code generator you use – it depends on the error correction level being used by that particular website. Even though there is a single ISO standard for QR codes, there are variables within the ISO standard (error correction level being one of them) that will result in a different looking QR code image based on how that particular QR code creation website sets these variables.
As the data load gets higher, the modules (cells) get smaller hence a denser QR Code image (See below).

Error Correction Levels

 Error Correction Levels

QR Codes have an error correction capability where data can be restored even when substantial parts of the code are distorted or damaged.
These are maximum numbers, and the amount of text space available to you depends upon which of the four error correction schemes are used. The error correction algorithm is based upon Reed-Solomon, and comes in four correction levels.
1. Level L – 7% of characters can be restored (default)
2. Level M – 15% of characters can be restored (most often used)
3. Level Q – 25% of characters can be restored
4. Level H – 30% of characters can be restored
Level L and M are most suitable for codes found in clean environments where the code will not get damaged. Level Q and H are for dirty environments, as in manufacturing plants. The error correction level that you use will dictate the amount of text that can be encoded. For example, Level L will allow you to encode 4,296 characters, while Level H only allows for 1,852 characters.

The lower the error correction level, the less dense the QR code image is, which improves minimum printing size.
 The higher the error correction level, the more damage it can sustain before it becomes unreadable.
 Level L or Level M represent the best compromise between density and ruggedness for general marketing use.
 Level Q and Level H are generally recommended for industrial environments where keeping the QR code clean or un-damaged will be a challenge.

QR Codes - Technical Details

 A QR Code is a matrix code developed and released primarily to be a symbol that is easily interpreted by scanner equipment. It contains information in both vertical and horizontal directions, whereas a classical barcode has only one direction of data (usually the vertical one). Compared to a 1D (1 Dimensional) barcode, a QR Code can hold a considerably greater volume of information: 7,089 characters for numeric only, 4,296 characters for alphanumeric data, 2,953 bytes of binary (8 bits) and 1,817 characters of Japanese Kanji/Kana symbols.

Finder Pattern (1): The Finder pattern consists of three identical structures that are located in all corners of the QR Code except the bottom right one. Each pattern is based on a 3x3 matrix of black modules (red in diagram for illustration purposes) surrounded by white modules that are again surrounded by black modules. The Finder Patterns enable the decoder software to recognize the QR Code and determine the correct orientation.

Separators (2): The white separators have a width of one pixel and improve the recognisability of the Finder Patterns as they separate them from the actual data.

Timing Pattern (3): Alternating black and white modules in the Timing Pattern enable the decoder software to determine the width of a single module.

Alignment Patterns (4): Alignment Patterns support the decoder software in compensating for moderate image distortions. Version 1 QR Codes do not have Alignment Patterns. With growing size of the code, more Alignment Patterns are added.

Format Information (5): The Formation Information section consists of 15 bits next to the separators and stores information about the error correction level of the QR Code and the chosen masking pattern.

Data (6): Data is converted into a bit stream and then stored in 8 bit parts (called codewords) in the data section.

 Error Correction (7): Similar to the data section, error correction codes are stored in 8 bit long codewords. (discussed later)

Remainder Bits (8): This section consists of empty bits if data and error correction bits can not be divided into 8 bit codewords without remainder.

The entire QR Code has to be surrounded by the so-called Quiet Zone (also called the buffer zone), an area in the same colour shade as white modules, to improve code recognition by the decoder software.

Smartphones in Ireland

RedC (a market research company) puts Irish household smartphone ownership at 49% of the population in 2011, but predicts it will accelerate to 71% by the end of the current year (2012). The statistical breakdown from these figures show 62% Male and 38% Female of smartphone ownership with 25-49 years olds making up over half of this.

A Google commissioned research shows how vital smartphones are when consumers are searching for local services – 89% seek out local businesses and 90% take action, such as making contact or transacting business
.
Smartphone operating systems can also affect scanning results. For instance some QR Codes may lead to an app store that is not dedicated to your phone operating system. E.g. If you phone is an Android and you scan a QR Code that leads you to the ‘Apple’ market, the scan is void and will not take you any further. It is important for marketers to realise this if they are promoting an app download via a QR Code. The main two operating systems are seen below.

This QR Code on the Absolut Vodka Bottle below scans. However, the user (Android) gets a blank page with the following written in small writing on the top: “you do not have permission to open this page”. This is a QR Code scan fail. The reason this Code did not scan effectively is because the QR Code only led to an App Store dedicated solely to an iPhone user. In this case, the company should not have used a QR Code or have used two QR Codes to suit the two main smartphones that is Android and iOS (Apple).

Below, Sligo Jazz Trail has embraced both of the major phones operating systems.

QR Code Measurement

QR Code Measurement

QR Codes can assist the marketer in bridging the gap between offline and online. “QR Code is one of the few alternatives that enable consumers to transfer from one medium to another, more or less instantaneously – one of the most suitable tools for multichannel marketing. For instance, they can be used to measure the effectiveness of a print advertisement in a newspaper. Asking the customer to scan the code and if they do they will receive a money-off coupon for example. This can ultimately help measure the offline success a particular campaign especially since the effectiveness of print advertising is almost impossible to measure.

Paul Crosbie, Managing Director from Metro Herald said: “This will give our newspaper a unique product and service that we can offer directly to advertisers and agencies. Metro Herald’s audience is a perfect fit for QR codes due to the high level of smartphone ownership and the regularity with which our readers access the internet via their handset”.

Measurement of all marketing methods is vital to what works in a particular organisation. QR Codes can be measured and can provide the marketer with much more knowledge about its customers than ever before. Colm Grealy, CEO of DRG said the results from recent campaigns with Metro Herald show that mobile marketing has exponential advantages for advertisers, ad agencies, retailers and traditional media publishers. “The opportunities for those in the digital media, marketing and advertising industry are extensive. QR codes enable customers to get information instantly whilst giving advertisers valuable customer information for future promotions”.

Good user experience and compelling content

 Good user experience and compelling content

Throughout this blog, there has been some good examples of effective QR Code usage. The better the content in the outcome, the greater likelihood the user will have a good experience.
Total Produce is one of Europe’s largest fresh produce marketers. The companies research has shown that that the majority of consumers are interested in knowing more about the fresh produce items they purchase. As a result the company has announced the launch of new ‘Smart pack’ packaging with QR barcodes that allow consumers access immediate relevant information on the fruit or vegetable. For example, a QR code accompanying a pitahaya (dragon fruit) will direct the consumer instantly to a three-minute video explaining how to prepare and serve the fruit. This example demonstrates that the company have done the research and have not just pushed useless content onto their consumers.

In late 2010 The Ethical Bean Coffee Company started adding QR codes to their ads on the train. When customers scan the QR Code with their smartphone cameras, a coffee menu pops up on their screens. They can then order a cup of coffee on the train and have it waiting when they arrive at one of Ethical Bean’s shops. According to CEO Lloyd Bernhardt, business has doubled since then, with Bernhardt adding “We catch people who are on the go and don’t have a lot of time”. This example offers consumers a unique experience and gives them added benefit by offering a quick order service.
Ensuring a good user experience and offering compelling content will enable the population of QR Codes to be maximised so that they will have mutual benefits for consumers and business.

Consumer Buyer Behaviour & Education

Consumer Buyer Behaviour
In a recently released survey (January 2012), Cisco found that 74 per cent of consumers turn to the web to conduct research before making a purchase in store. The findings place a premium on digital content marketing campaigns that can help answer shoppers’ questions and point them in the direction of a brand. Moreover, Cisco found that 45 per cent of shoppers enjoy using their mobile device to research products online while in stores. Shoppers have more options than ever in terms of educating themselves prior to making a purchase. In addition to providing info that could encourage purchases, content boosts Search Engine Optimisation (SEO) standings and makes it easier for consumers to find a business through search.
A survey conducted by Chadwick Martin Bailey and iModerate Research Technologies, into the amount of people that use QR codes and what they are using them for found that 18% of smartphone users made a purchase after scanning. They also discovered that 21% of users that scanned the QR code then shared this information with someone else.

Education
As with all new technology, the onus is on the user and also the provider to progress the learning.
While the concept is simple enough – see a code, scan it with your smartphone, users simply don’t know how to use QR codes. As much as poorly placed codes are an issue, users aren’t always ready to scan a code when they see it!
Marketers need to keep their customers informed, maybe giving online tutorials on their website or instructions next to their QR Code to help consumers understand the procedure of scanning.
If a marketer is looking to place a QR code on a product or magazine page, then there should be a call-to-action informing consumers what application is needed to scan the code – or even instructions on how to scan it. Programs offering clear instructions on how to use mobile bar codes can drive participation up by 500 to 800 percent!
“Most phones do not come with QR readers pre-installed. If an individual wants to scan a QR code, he or she will need to get a special app to do so. How are people supposed to find this out, considering most QR codes are presented without context and there is no standard app associated with the technology?”.
It is necessary therefore not just to provide instruction on how to scan but additionally where one could access the application where a QR Reader can be downloaded.

QR Codes - Psychology and Behaviour

Psychology and Behaviour
Perhaps one key to understanding consumer behaviour and QR codes lies in psychology and behaviour. By looking at how people act and react to QR codes, industry could better create campaigns that are more precisely tailored to customer preferences (Shin, Jung & Chang, 2012).
Shin, Jung & Chang in their study ‘The Psychology of QR Codes’ determined that users are more likely to be influenced by interactivity in their decision to accept QR codes. The components of interactivity are (1) responsiveness, (2) user control and (3) connectedness. They determined that QR codes with more positive perceived interactivity values have a greater influence on quality, which results in a greater influence on usefulness and ease of use, leading to intention and actual usage behaviour of QR codes.

They suggest that QR codes are not only perceived as a commerce channel, but also as a social venue through which users can interact with other users. This means that QR code activity entails more than seeking information; it is perceived to be a social activity comprising entertainment, education and socialisation.
The study also concluded that subjective norms (an individual’s perception of whether important people think the behaviour should be performed) plays a role in behaviour. They found that enhanced feelings of social influence will result in improved perception of usefulness and ease of use through service use and content.
They suggest that future codes be designed to exploit the high relevance and great importance of word-of-mouth as a means of inducing user participation.

Recent Independent Research by Chadwick Martin Bailey (CMB) also looked at consumer behaviour which discovered that most respondents (46%) scanned a QR Code out of Curiosity (CMB, 2011).
One recent theoretical treatment of curiosity is the "knowledge gap". A knowledge gap can be defined as the difference between two quantities: what a person knows and what he or she would like to know. Curiosity arises when people become aware of the existence of a knowledge gap in a particular domain or when they encounter novel or inconsistent stimuli (Berlyne 1954, 1960), stimulus ambiguity or incongruity (Hehb 1949), or stimuli that violate their expectations (Hunt 1963). These situations highlight their knowledge deficiencies (Loewenstein 1994). Awareness of a knowledge gap produces an aversive feeling of deprivation or discomfort that can be alleviated only by obtaining the information needed to close the gap, which consequently produces an intense desire to modify the existing knowledge structure (Berlyne 1960) (Menon and Soman 2002). In short, the curiosity arousal means that people inherently want to know more about QR Codes and feel deprived if they are not part of or belong to its arrival.

QR Codes as a mobile marketing channel

In Ireland we are fast catching on to the fact marketing both to and from mobile phones is the most effective person to person form of marketing available. Research shows that almost one third of Irish businesses are using QR Codes as a mobile channel. The question asked was "Which of the following does your company have?" and was answered by 274 people, 88% of whom are either full members or associate members of the Marketing Institute of Ireland. The 30% is a significant proportion and one that will probably increase in the near future. In February (2012), MasterCard created 130 jobs in Ireland in mobile payment technology which uses QR codes as a method of payment “MasterCard chose Ireland as a place to expand our presence because, from our vantage point, we see consumers moving toward a world beyond cash, shopping and paying for the things that matter to them in ways that best fit their needs and lifestyles with a simple tap, click or touch in-store, online or on a mobile device".

Prior to starting a marketing campaign that involves QR codes, marketers should first determine their goals, use consumer behaviours to determine placement of the codes, ensure value and a good user experience that delivers compelling content, include consumer education within their marketing strategies, and set low expectations at first.

Mistakes with QR Codes

Obvious mistakes are not uncommon even among leading brands and agencies: in 75% of cases the landing pages are not mobile optimised (ScanLife, 2012). This means that when the user scans the code, it will bring them to for instance a website that is difficult to see as it is not formatted for mobile phone use. This is cumbersome and essentially not user friendly.

Another common mistake is the poor use of direct codes (i.e. the URL is directly encoded in the QR code): Love film for example, printed one million DVD envelopes with a code that couldn’t work because of a typo in the encoded URL. Moreover, most QR codes just lead to a website, when in reality they could do much more, such as inviting users to engage with advertisers through emails, twitter, etc. 

Marks & Spencer’s used the black and white matrix in one of their promotional campaigns and referred to them as QR Codes when in fact they were using another type of code called a Data Matrix Codes (See image).

“We’re trialling QR codes as an innovative new way to communicate with our customers. As this stage it’s only on our Food to Go freshly squeezed juices".

This does not help QR Code popularity and unfortunately it is not an uncommon mistake. This inevitably makes it a difficult task for consumes to attain a grasp of the Codes when the marketer cannot distinguish between the two.

There are clear differences between the QR Code and Data matrix code such as the notable 3 large squares on the corners of the QR Code but some similarities in form and colour exist though Data matrix codes tend to be smaller in size.

QR Code/MS Tag/ Data Matrix Code

Initially rivalry subsisted between QR Codes and Data Matrix Codes but the world of marketing embraced QR Codes. Data Matrix codes prevail mainly for logistics, shipping and billing purposes. Other codes have also been created that compound the adoption barrier to already fledging consumer behaviour such as MS Tags. Though MS Tags appear different to the black and white squares they harness huge investment. It is not surprising that companies want to get on the bridge that embraces offline and online but it threatens a universal simple system.

Good QR Code uses - IRELAND

The possibilities of QR Code applications (usage) are plentiful. They are used on business cards, magazines, product packaging, billboards, t-shirts, brochures, and greeting cards to name but a few.
Once scanned they can produce a money-off coupon, open a website address, play a video, display an image or even dial a phone number. The outcomes are extensive and some are extreme.

Aer Lingus in 2011 used a QR Code in a recruitment campaign for their Cadet Pilot Training Programme. Here they used the code in an advertisement and once scanned brought the user to a You Tube video of a young man and woman talking about their process in the cadetship and made it very inviting for the user to apply for position. This was an effective use of the code which brought the Aer Lingus brand to life, engaged with the reader and delivered value added digital content from traditional print media.

BBDO, a worldwide advertising agency developed a special QR glass for Guinness that when it was filled with the black stuff would produce a QR Code and hence when scanned give the opportunity for social media engagement.

QR Code Development

QR Code Development
In 1970, IBM developed UPC (Unique Product Code) symbols consisting of 13 digits of numbers to enable automatic input into computers. These UPC symbols are still widely used for Point-Of-Sale (POS) system. In 1974, Code 39 which can encode (symbolise) approximately 30 digits of alphanumeric characters was developed. Then in the early 1980s, multi staged symbol codes where approximately 100 digits of characters can be stored such as Code 16K and Code 49 were developed. In the recent years, requests had mounted for symbols which could store more information and represent languages other than English. To enable this, a symbol with even higher density than multi staged symbols was required. As a result, QR Code, which can contain 7,000 digits of characters at maximum, was invented.

QR Codes in Marketing (brief intro)

For the marketing manager, the possibilities are endless. QR Codes are a new way to reach the busy consumer. Offline marketing material such as brochures, flyers, posters, newspapers adverts can now be all measured. This is a crucial factor in any marketing campaign. It can reassure the marketing manager that money was wisely spent (or not) on a particular campaign. Not only does it count how many times the code has been
scanned, it can also produce information such as location of scan (if GPS is enabled), what time approximately it was scanned, the volume of unique users, and what operating system the consumer was using (Android/iPhone).
Promotional campaigns can now get a new lease of life – you can entice the consumer to scan the code to receive a free coffee, a money-off voucher or be entered into a competition.
QR Codes can also be linked to any Social Media accounts such as Facebook and Twitter which may help augment the number of fans or followers.  QR Codes can help build relationships by providing insight into the users of QR codes (analytics) but more importantly by giving easy access of information to your consumer or potential consumer such as reviews, maps, ratings, contact information or a direct link to your website.

How to scan?

Requirements to scan a QR Code for the user are that they have a mobile phone with a built in camera; an internet connection (in most cases) and a QR reader application (free to download). The user then selects the QR Code application on their phone where a scanning function becomes active. The user must then position their phone over the QR Code so that the camera can scan it. Once the QR Reader acknowledges this it automatically scans the code and brings the user to the outcome. If you have disabled your internet connection it will still scan (in most readers but not all) and save the potential outcome for you until internet access is available. The user can find the list of scans in their scan history. However, some QR Readers will not scan the code at all if no internet connection is available.

A great feature of QR-Codes is that you do not need to scan them from one particular angle. QR-Codes are capable of omnidirectional (360 degree’s) high-speed reading. QR-Codes scanners are capable of determining the correct way to decode the content within the QR-Code due to the three specific squares that are positioned in the corners of the symbol

INTRO (part one)

The ‘Quick Response’ (QR) Codes were introduced by the Japanese Company Denso-Wave in 1994. Their initial use was that the matrix barcode (or two-dimensional code) could be scanned to quickly locate and track a vehicle part. This technology which requires no license fee is now administered by many companies throughout the world; it has a plethora of uses and has become a new mobile marketing tool.
A QR Code is unique from other black and white matrix codes in that it has three large squares (finder patterns) positioned in three corners easily identifying it as a QR Code. QR Codes can be created in different colours in keeping with your brand and in fact can contain a company logo but the three finder patterns still exist. They are called Quick Response codes in that the information can be downloaded at a high speed.

A QR Code

A coloured QR Code with a company logo.

Welcome to my blog about QR codes - an Irish perspective.