Headaches, confusion as pot industry contends with lag in tracking software

Cannabis retailers have been stocking up on extra products – and it’s not just for the pre-Thanksgiving sales rush.

A delayed launch of new software that tracks every marijuana plant from seed to sale has beset pot industry bookkeeping with problems.

The situation has caused headaches and confusion for many in the industry, with some pointing blame at state regulators and buying up extra products in case of a disruption in the supply chain. The seed-to-sale monitoring system is important because it helps demonstrate to federal authorities that legal cannabis isn’t being diverted out of state or into the black market.

Washington’s Liquor and Cannabis Board is working with a new software vendor to oversee a massive database that tracks every pot plant and product in the state. But the new system won’t be ready for about two months, and the old software provider refused to extend its contract, citing concerns about cybersecurity.

Some pot businesses now have to manually fill out spreadsheets to report required sales, handling and quality data to the Liquor and Cannabis Board – a time-consuming task in the middle of harvest season. And some worry they’ll face fines or other penalties if they fail to report that data properly.

“The state just has no responsibility,” said Sam Calvert, owner of the Spokane retail shop Green Star Cannabis. “They’re saying, ‘You have to do it whether you like it or not. And by the way, you still have to be compliant.’ ”

Meanwhile, the Liquor and Cannabis Board says the software blackout should affect relatively few of the 1,500 licensed producers, processors and retailers in Washington.

The old contract belonged to a Florida-based company called BioTrackTHC. In addition to the central database platform, the company was required to provide Washington with a free web portal that some businesses used to deliver their information.

The free service went away when the contract expired at midnight Tuesday, but BioTrack has independently maintained a version of its system so Washington pot businesses can continue exchanging data. It’s free for now, but next month, the company plans to charge businesses subscription fees of up to $50.

Brian Smith, a spokesman for the Liquor and Cannabis Board, said only about 25 percent of licensees used the free reporting tool. The rest used third-party softwares or a paid version from BioTrack and should have experienced a seamless transition this week.

Nick Burger, the owner of Fire House Productions in Hillyard, a midlevel indoor grower, said Wednesday he wasn’t aware of any local businesses that had been impacted.

“So far they’re making it relatively easy for us,” he said.

Smith said the Liquor and Cannabis Board is still able to collect the same data, just on a less-regular basis. He acknowledged it would be “a hassle” for some businesses to fill out spreadsheets and upload them to the agency’s website each week. But for the most part, he said, “it’s business as usual.”

BioTrack CEO Patrick Vo, however, said manual reporting could be a major impediment for some businesses, particularly small growers and processors.

“That is a huge, huge laborious task for anyone, and especially since this is the busiest time of year for these facilities,” Vo said.

The other option for those businesses is to invest hundreds of dollars in programs that would generate the required spreadsheets automatically. Either way, Vo said, “this is going to really affect the smaller businesses that can least afford the added expense.”

Vo also said it would be a challenge for enforcement officers to comb through the hand-reported data and quickly reconcile discrepancies. BioTrack’s software put all of that data in the same format.

“If my outbound spreadsheet has one line item where one of the serial numbers is off by one digit,” he said, “it’s going to be a lot more difficult to track that down.”

Aggressive timeline

The Liquor and Cannabis Board began accepting bids for the new contract in April. BioTrack, which won its contract in 2013, did not place a new bid, saying it was uncomfortable with some specifics of the state’s proposal.

In late May, the agency tentatively awarded the new contract to a company called Franwell, which makes a pot-tracking software called Metrc. But industry groups opposed Metrc’s reliance on radio-frequency identification tags, saying the single-use plastic tracking devices would be costly and bad for the environment.

Franwell rescinded its bid, and in mid-June the Liquor and Cannabis Board awarded the contract to its second-choice bidder, Denver-based MJ Freeway, giving the company less than five months to build its software in line with state-specific regulatory requirements.

Some have criticized the Liquor and Cannabis Board for not budgeting enough time for the transition.

“You don’t just switch from one traceability system to another until the new one is up and ready,” said Calvert, the Spokane retailer.

WeedTraQR, a Seattle-based software company that some businesses use to feed information into the state’s database, said in a blog post it would be tough to import three years’ worth of data into the new system and ensure compatibility with third-party softwares such as its own.

“Most traceability vendors felt the timeline was unattainable, and some companies opted not to apply for the contract because they viewed it as impossible,” Crystal Oliver, a Spokane County grower and leader of the Cannabis Farmers Council, a Washington industry group, wrote in an email.

Jeanette Ward, a vice president at MJ Freeway, said the company knowingly accepted a challenge and worked “aggressively” to get its system online by Halloween – the day BioTrack’s contract expired and its system was shut down.

“We knew that the specifications for that contract were a six- to seven-month project timeline,” Ward said. “We and the LCB all agreed to try really hard to make that date.”

Smith, the agency spokesman, agreed that MJ Freeway is not to blame.

“They didn’t fail at anything,” he said. “It just wasn’t enough time.”

State contracts are lucrative opportunities for companies that make pot-tracking software. Smith said Washington will pay MJ Freeway $800,000 for the setup, and then $600,000 annually.

Ward said the company is “very confident” its system will be ready at the start of 2018.

Cyberattacks

After much speculation, the Liquor and Cannabis Board acknowledged on Oct. 19 that MJ Freeway’s system would not be ready on time.

The agency asked BioTrack to extend its contract and continue operating the database for several months, but the company declined, citing concerns about emails that had circulated in September offering to sell stolen data on the pot industries in Washington and Nevada.

Vo said BioTrack had reason to believe that a sample of the stolen data was authentic, and he worried his company would be more vulnerable to cyberattacks after MJ Freeway gained access to the database.

Ward, meanwhile, said MJ Freeway had found “no evidence that data was ever actually for sale. We believe it was a hoax.”

Vo said BioTrack might have extended its contract if the Liquor and Cannabis Board could show that MJ Freeway had adequate security measures in place. Smith said the agency provided ample evidence and assurances, but BioTrack was not convinced – as Vo explained in a lengthy open letter.

“We tried really hard to get that contract extension, but the spoof email thing kept coming up,” Smith said.

This isn’t the first time MJ Freeway’s security has been called into question.

In January, an attack on the company’s system sent around 1,000 cannabis retailers in 23 states scrambling to address problems with sales, inventory and regulatory compliance, according to Marijuana Business Daily.

In June, MJ Freeway’s source code was stolen and posted on Reddit, and in September the state of Nevada dropped the company two years into a five-year contract, Forbes reported. Nevada now uses the Metrc system – which was Washington’s first choice in the recent bidding process.

And two weeks ago, another MJ Freeway outage forced retailers in some states to record all sales by hand, according to the Philadelphia Inquirer. It wasn’t clear if the outage was the result of a crash or a deliberate attack.

Ward insisted the company’s security measures are adequate.

“We are committed to providing a quality system that works well, and I think people will see that come January,” she said.