Sure, but people at a mall are personally identifiable. This is more like a mall full of clones,whom you can individually address but collectively not differentiate.
They were intentionally not installing a security system at their "mall" while catering to a bunch of high risk consumers (i.e. high level of knowledge addiction, know track record of MIT "hackers", etc). Since they were having identification systems for other clients in place, one could even suggest, that they had given up restricting the access towards this specific crowd.
