Tag Archives: security

BioTrackTHC To The Rescue: Contingency Plan for Washington

By Aaron G. Biros
1 Comment

According to a press release published this morning, BioTrackTHC successfully implemented their Universal Cannabis System (UCS) in Washington State, a temporary solution for the state’s seed-to-sale cannabis tracking system, while the new system is yet to be deployed.

BioTrackTHC had a contract with Washington State for four years, which expired just weeks ago at the beginning of November. Back in June, after a few minor hiccups, the state announced that MJ Freeway would be the successive software platform used for the state’s seed-to-sale traceability system.

The deadline for the new software to be ready for deployment was set for November 1st, when the BioTrackTHC contract would expire and the MJ Freeway contract would begin. Between when the contract was awarded and the deadline for implementation, MJ Freeway made headlines for a series of security hacks and systems failures. Subsequently, MJ Freeway said they could not deliver the software platform until January of 2018, leaving a two-month gap where businesses have no state-mandated software to use for the tracking system.

The contingency plan that the state laid out consisted of business owners manually inputting data in excel spreadsheets. When first pressed for a Band-Aid solution, representatives of BioTrackTHC cited security concerns related to MJ Freeway’s hacks as reason for being hesitant to extend their contract through the interim period.

In an open letter to the Washington cannabis industry back in October before the end of their contract, Patrick Vo, president and chief executive officer of BioTrackTHC, laid out an explanation for what went wrong and provided an alternative solution, essentially a private sector version of their government-mandated traceability software system.

The open letter to the Washington cannabis industry, written by Patrick Vo

Announced this morning, the new system, UCS, is being used by over 1,600 of the 1,700 cannabis licensees in Washington. The UCS has so far submitted 39,000 individual excel spreadsheets to the Washington State Liquor and Cannabis Board (WSLCB). “After the WSLCB announced that their replacement system would not be ready in time and that the only other option was for all 1,700 licensees to submit their seed-to-sale data via manual spreadsheets, BioTrackTHC created the UCS—a privatized clone of the government system—within a few days and deployed it minutes after the termination of the old system to minimize the impact on all licensees,” reads the press release.

The UCS allows business owners to streamline data recording, instead of manually entering information into spreadsheets. It is also integrating with 3rd party software competitors such as WeedTraQR, GrowFlow, Mr. Kraken, TraceWeed, GreenBits, S2Solutions and DopePlow. “After the WSLCB’s announcement, we knew that we had only a few days to provide a universal system to which the whole industry could submit compliance data and enable communication across the supply chain between licensees and their seed-to-sale system,” says Vo. “Our priority was to ensure that licensees could continue to operate in the absence of a government seed-to-sale system. Not having that system in place could have left Washington licensees vulnerable to noncompliance in a variety of ways, not to mention the potentially crippling volume of extra work needed to manually track a business’ entire inventory.”

Washington State’s new traceability software system by MJ Freeway is expected to deploy in January of 2018.

KIND Financial Launches Canadian Payment Solution

By Aaron G. Biros
1 Comment

KIND Financial, a technology and compliance software solutions provider in the cannabis industry, is launching a new e-commerce and payment processing platform in Canada. According to the press release, they are partnering with a Canadian bank to launch the KIND Seed to Payment platform, which is essentially an e-commerce gateway integrated with their compliance software, KIND’s RegTech platform.

David Dinenberg, founder and CEO of KIND Financial

David Dinenberg, founder and CEO of KIND Financial, says this is an approach to help alleviate the cannabis industry’s banking woes. “We’ve been very focused on a global vision and taking a strategic approach towards solving the cannabis industry’s largest problem – banking,” says Dinenberg. “Not only have we built a broad portfolio of finance and compliance solutions with a high-level of technical sophistication, but we’ve made a strong commitment to security and compliance, which is evident through our partnership with Microsoft.” A little over a year ago, they entered a partnership with Microsoft to utilize their cloud-based solutions for government traceability software.

According to the press release, the software has regulatory and security features built in, such as age and identity verification, which can help companies comply with security and chain of custody regulations. “Our mission is to ensure business and technological growth for all constituencies within the cannabis industry while ensuring full compliance with evolving regulations, and that’s why we’re thrilled to make these services available to our great neighbors in the north,” says Dinenberg. “We understand compliance will be a critical issue for some time to come, but with our solution, all providers and their partners can focus on the job at hand while keeping in line with regulatory mandates.”

KIND Financial has not done much work in Canada previously, but this could be a sign of a greater push for international expansion. “We’re excited to be working in a new country to boost the Canadian cannabis industry in a safe and regulated manner, and we look forward to expanding into other markets overseas,” says Dinenberg. The press release says the new platform is designed to work with different languages and foreign currencies, including the euro and Australian dollar, which could help Canadian producers enter emerging markets.

In addition to their announcement of the KIND Seed to Payment platform, the company also announced they will be rolling out a mobile payment system called KIND Pay, a digital payment option for consumers that will accept Visa and MasterCard. They anticipate that KIND Pay will launch before the end of this year.

How To Select The Best Monitoring System For Your Cannabis Greenhouses

By Rob Fusco
No Comments

Maintaining an environment that supports cultivation and keeps plants healthy is not an easy task. In cannabis growing, there are a variety of factors that greenhouse managers and personnel must monitor to ensure that their plants are in a healthy environment that fosters growth and development. Temperature, humidity, lighting and CO2 levels are a few of the conditions that need to be tailored to each cannabis greenhouse operation. However, it can be difficult to constantly monitor the status of your equipment and the greenhouse environment, especially after hours or during the off-season.

A remote monitoring system that’s properly selected and installed can help greenhouse managers keep their cannabis plants healthy, multiply their yields and increase return on investment. This type of system also helps operators identify patterns and trends in environmental conditions and get insight into larger issues that can prevent problems before they arise.

Cloud-based monitoring system base unit in weatherproof enclosure

Here are some tips on key conditions to monitor and what you need to consider when selecting a monitoring system for your cannabis greenhouse operation:

Temperature

Temperature plays a crucial role in any cannabis grow operation. The climate in your greenhouse must be warm enough to nurture photosynthesis and the growth of cannabis plants. Setting the incorrect temperature will significantly impact the potential yield of the plant and the rate at which it develops. A temperature too low will slow the growth of the cannabis, but too hot can lead to heat stress for your plants. The ideal temperature for a standard greenhouse is between 70 and 80 degrees Fahrenheit. However, depending on the stage of plant and desired growth densities, the temperature of the greenhouse needs to be adjusted accordingly.

Humidity Levels

Humidity directly affects plant photosynthesis and transpiration, so controlling humidity is vital in greenhouse growing. The ideal relative humidity (RH) for cannabis growth is around 60%. A low humidity level can cause water to evaporate too quickly for photosynthesis, while a humidity level that is too high can cause poor growth and possible mold and fungal disease. Monitoring the moisture content in the air of your greenhouse will help the plants during the transpiration process, increasing absorption of nutrients and overall health of the cannabis. 

Lighting

Your cannabis may be getting an abundance of natural light during the summer months, but maintaining adequate sunlight during the winter months can be a challenge. As a solution to this, many greenhouse managers equip their facilities with additional lights to supplement natural light during off-seasons or off-hours. To achieve the best possible yield, a cannabis plant in the budding stage should receive twelve hours of light each day, while other stages could require additional lighting. For example, the growth stage could require your cannabis to be exposed to sunlight for up to eighteen hours a day.

CO2 Levels

Like any other plant, cannabis requires CO2 to breathe. Greenhouse managers must set and monitor the CO2 levels in their facility to make sure that there is an adequate amount for the plants to develop, grow and be healthy. The amount of carbon dioxide required for your cannabis depends of the size of the facility and the amount of light the plants are receiving. However, a standard grow area for cannabis can maintain a CO2 range from 1000 to 1500 parts per million (PPM). A level below that threshold can result in slower growth of the plants, while a level above would lead to unused and wasted CO2.

Soil moisture sensor

Irrigation and Soil Moisture

One way to ensure a good yield from your cannabis is to water it regularly and monitor your soil moisture. Overwatering your plants can have the same effect, if not worse, than letting the soil become too dry. Plants’ roots need oxygen to survive, unlike leaves that breathe CO2, and when the soil is waterlogged the roots can’t provide their function. The lack of oxygen interferes with the roots’ nutrient uptake and photosynthesis causing the cannabis plant to wilt. The exact moisture content of the soil depends on the size of your greenhouse, temperature and humidity. Whether you hand water or are using a drip irrigation system, being aware of your soil moisture is vital to the long-term health of your cannabis.

Air Circulation

Your greenhouse environment should mimic the ideal conditions in which cannabis plants flourish. With an indoor facility, you have the ability to control air circulation by venting hot air out and blowing fresh air in. Creating a circulation of air inside your greenhouse will increase your cannabis plant’s growth speed and yield. Additionally, an exhaust system helps control the temperature and humidity, while also preventing the invasion of mold and pests that thrive in hot, stagnant air.

Greenhouse Security

When growing something of value, like cannabis, there will always be a threat of intruders. Whether your greenhouse is in a populated area or around hungry wildlife, any intruder could be detrimental to your overall yields and profit. Remote monitoring systems can give you peace of mind and instantly alert you when there is an unwanted presence in your greenhouse.

Knowing all the possible threats to your cannabis greenhouse helps you evaluate your specific needs, and ultimately identify the proper remote monitoring system.

Selecting the Right Monitoring System

Other factors to consider when choosing a monitoring system right for your operation include:

  • Base unit and sensors
  • Wireless or hardwired sensors
  • Communications to your site (Phone, cellular, Wi-Fi, etc.)
  • Alarm notification
  • Programming and status checks
  • Data logging
  • Return on investment

Base Units and Sensors

Each condition in your greenhouse that you want to monitor requires its own input on the base unit of the monitoring system. You must match your needs with the number of inputs available. A good fit for a smaller cannabis greenhouse may be a lower-cost, non-expandable monitoring system. However, larger facilities have many monitoring points and more people to alert when there’s a problem. If your cannabis operation is poised for growth, purchasing an expandable system could add value to the initial purchase because you wouldn’t have to replace your entire system in the future.

Your monitoring system should also have an internal rechargeable battery backup to ensure continuous monitoring and alerts in the event of a power outage. It is also recommended to have each base unit in a sheltered enclosure to protect it from moisture, dirt and other hazards.

Placement of sensors is also crucial. For example, temperature sensors in your greenhouse should be placed throughout the facility. They should be next to your thermostat and in the center of your greenhouse, preferably away from direct sunlight.

Wireless or Hardwired Sensors

Remote monitoring systems offer the option to have sensors hardwired directly to the base unit or sensors wirelessly connected. A hardwired monitoring system connects the sensors to the base device with wires. Generally, trenching long distances for wires is time consuming and costly. So alternatively, a wireless system uses built-in radio transmitters to communicate with the base unit. Some monitoring systems can accommodate a combination of hardwired and wireless sensors.

Communications to Your Site

Monitoring devices that use cellular communications must be registered on a wireless network (like Verizon or AT&T) before you can send or receive messages. Because cellular devices perform all communications over a wireless network, it is important that there be sufficient signal strength at the greenhouse. It is a good idea to check the signal quality in the area before purchasing a cellular product. If the cellular network has less than desirable coverage, it is possible to install an external antenna to help increase cellular signal.

Alarm Notifications

When monitoring systems identify a change in status, they immediately send alerts to people on the contact list. If you don’t want all of your personnel to receive notifications at the same time, certain devices can be programmed to send alerts in a tiered fashion. It is important to consider the reach of the communications, so that you’ll be notified regardless of your locations. Multiple communications methods like phone, email and text provide extra assurance that you’ll get the alert. Also, note of the number of people the system can reach and if the system automatically cycles through the contact list until someone responds. Make sure the system allows for flexible scheduling so that it doesn’t send alarms to off-duty personnel.

Programming and Status Check

If you’re responsible for maintaining a commercial greenhouse facility, you want a system that will provide real-time status of all monitored conditions on demand. There are a few different ways to access your sensor readings. Options include calling to check status, viewing a web page, either on a local network or on the cloud, or accessing the information via an app on your mobile device. With a cloud-based system, the devices supervise themselves. This means if the internet or cellular connection goes down, the device will send an alarm to alert the appropriate personnel.

If you don’t select a cloud-based system, you will be limited to logging in through a local area network, which will allow you to make programming changes, access status conditions and review data logs. If internet connectivity is not available at your location, you will want to choose a cellular or phone system rather than Ethernet-based option.

Data Logging

Sample greenhouse monitoring data log

Data history is valuable in identifying patterns and trends in your cannabis greenhouse conditions. Manually monitoring and recording environmental parameters takes a significant amount of personnel time and detracts from other important workplace demands. However, many monitoring systems automatically save information, recording tens of thousands of data points, dates and times. Cloud-based logging provides an unlimited number of records for users to view, graph, print and export data trends.

Analyzing data samples may lend insight to larger issues and prevent problems before they arise. For example, if the data log shows power fluctuations occurring at a regular time, it could be indicative of a more serious problem. Or, if the data shows signs of a ventilation fan or supplementary lighting beginning to malfunction, they can be repaired or replaced before total failure occurs.

Return On Investment

When deciding how much you should pay for a remote monitoring system, tally up the entire cost, fully installed with additional peripherals and sensors and any labor fees for installation. Then consider the value of your cannabis plant inventory and greenhouse equipment. Finally, factor in the cost of downtime, should an environmental event shut down your operation for a period of time.

Final Thoughts

Choosing the right greenhouse monitoring system and sensors could mean the difference between life and death for your cannabis plants. Understanding the conditions you need to watch and monitoring systems’ capabilities are they best way to protect your investment.

 

MJ Freeway’s Source Code Stolen & Published Online

By Aaron G. Biros
9 Comments

Portions of MJ Freeway’s source code were reportedly stolen and posted in Reddit threads as well as on Gitlab.com, a source code hosting website. On June 15th, the account “MJFreeway Open Source” was made on Gitlab.com, and portions of the source code were posted, but have since been taken down. Source code is essentially a list of commands of a program, the basis for making improvements and modifications to a software system. Source code can sometimes contain sensitive information. To be clear, MJ Freeway does not use an open source model; their source code is the basis of their traceability software. Open source is a tool that fosters public collaboration on software development, helping identify weaknesses or areas for improvement.

When asked to comment on the matter, MJ Freeway issued the following statement:

“Last week we discovered that someone had obtained an outdated portion of MJ Freeway’s source code. This incident has absolutely no impact on our systems or MJ Freeway services, and client and patient data is not at risk. While this theft poses no risk to our clients, patients, or business operations, we take any incident involving unauthorized access very seriously and have reported it to the Colorado Bureau of Investigation.

Unfortunately, it has come to our attention that our competitors are spreading inaccurate information about the incident, including baseless claims about SSL info and the potential for client data being compromised – neither of which is true. We encourage our customers to contact us directly with any questions they may have.

We follow or exceed all relevant industry security standards and are confident that we have the most robust security measures in our industry. None of our peers come close. However, we live in a world of determined cyber-criminals and we operate in a competitive environment. Success and size makes a company a bigger target for malicious actors, as other large companies also know. We will continue to investigate and take follow-up action as we learn more about this incident.”

On Sunday, June 18th, a user by the name of ‘techdudes420’ posted in the subreddit, r/weedbiz, a thread titled “MJFreeway goes open source.” The link for that post was the Gitlab.com page where MJ Freeway’s source code was published briefly. The same user then published a second reddit post the following day with the same link to the stolen code, but this time in the r/COents, a subreddit for the Colorado cannabis community. MJ Freeway is based in Denver. That post claimed the user found the stolen source code with a quick search and that the user was banned because of that. The moderator of the thread chimed in, saying they banned the user for posting the stolen code. “We received a takedown request from the software owner stating the code had been stolen and released without permission,” says the moderator. “After investigating the matter I reached the same conclusion and removed the thread.” The moderator then updated the comment shortly after: “Edit: As for OP [original poster] ‘finding’ the code, if that were true I don’t know why he or she would have created a new Reddit account just to post the link.”

In addition to their own cybersecurity analysis, a spokeswoman for MJ Freeway says they will be performing a third party audit and analysis this week as well. When that information becomes available, we will update this article.


Update: Multiple sources have reported that portions of MJ Freeway’s source code are still available online on torrent sites like PirateBay.

Ask the Expert: Straight Talk on Safety, Defense and Security, Part II

By Aaron G. Biros, Bruce E. Lesniak, Lezli Engelking
1 Comment

In this week’s Straight Talk on Safety, Defense and Security, we answer a reader’s question about traceability in quality processes and offer some practical advice for building a safety and security strategy. Travis Lodolinsky from Gleason Technology submitted this week’s question. For a response, we sit down with Lezli Engelking, founder of the Foundation of Cannabis Unified Standards (FOCUS), to help answer your questions. If you have questions about safety, defense and security in cannabis, please ask them in the comments section below and we will address them in the next edition of Straight Talk on Safety, Defense and Security.

T. Lodolinsky: How are safety processes being tracked in the industry to ensure regulations and quality assurance are being uniformly enforced throughout?

Lezli Engelking: In related industries, such as herbal products or pharmaceuticals, the FDA has created guidelines, or current good manufacturing processes (CGMP) that control for the quality, consistency and safety of the products being produced. Businesses must be certified by independent third parties to demonstrate they are following CGMP to protect public health and consumer safety. CGMP is a proactive approach to quality assurance. A basic tenant of CGMP is that quality cannot be tested into a product after it is made; quality must be built into the product during all stages of the manufacturing process. One common misconception is that CGMP only covers the process of manufacturing itself. CGMP actually covers all aspects of the production process including materials, premises, equipment, storage, staff training and hygiene, how complaints are handled and record keeping.

Because cannabis is federally illegal in the US, the FDA has not developed cannabis-specific CGMP guidelines, so lawmakers do not have the benefit of having those guidelines available to base regulations on. So to answer your question, state cannabis regulations do not track processes and procedures used by cannabis businesses to control for safety or quality because they do not have the federal guidelines. Instead, most state cannabis regulations currently take a reactive approach to safety, mandating only for testing of the final product. While testing is an extremely important and valuable part of any quality management program, just analytics is not enough.

This is precisely why FOCUS was created and how they assist business owners and regulators, while fulfilling the mission of protecting public health, consumer safety and safeguarding the environment. The FOCUS standards are a cannabis-specific system of guidelines (cannabis-specific current good manufacturing practices) to ensure products are consistently produced according to quality standards. FOCUS provides detailed guidance and independent, third party auditing services for all key aspects of the cannabis industry including cultivation, extraction, infusion, retail, laboratory, security, packaging, labeling and sustainability.

CannabisIndustryJournal: What advice can you offer to cannabis businesses for product safety, defense and security prior to standardization?

Bruce E. Lesniak: Businesses that make products infused with cannabis (I call these businesses “plus one” companies because they produce products that include one more ingredient than traditional food products), require a carefully written master plan that specifically addresses the unique qualities, sensitivities and critical areas of the business. When building a comprehensive plan I address three questions:

  • Why (identify the why, this is your preventative, overarching strategy)?
  • How (addresses the “why question” with products, services and training)?
  • What (what is your reactive strategy that addresses actions and activities to be performed in the event of a breech)?

First and foremost, consumer-facing businesses must safeguard their products to the public. One product recall or illness related incident could spell disaster. Build your plan correctly the first time. Contact an industry expert to review your facility and help build and implement your plan. This will save you money by quickly exposing vulnerabilities and providing corrective measures specific to your business needs and requirements. Even though product safety and defense are closely related to security and should share a complementary strategy, product safety and defense are unique (due to standards and regulations), and should be treated as such.

Banks not accepting industry money complicates normal business operations and security planning, causing retail operations to handle and store large sums of cash. I asked industry expert and security professional, Tony Gallo of Sapphire Protection LLC, what is the single most important piece of security equipment you are currently providing for the retail and dispensary owner? “Design an air tight policy of handling money,” says Gallo. “Remove money often from cash registers and place it into the best safe for your application!”

Spend time familiarizing yourself with all things product safety and defense (there are volumes written on food safety and food defense, thus the “plus one” reference). This a great starting point and protecting the consumer protects your business. When it comes to designing your security application, consult an expert! Take into account that the cannabis industry is unique due to its “plus one” ingredient. Therefore you need to build your security systems, applications and policies to systematically protect your employees, facility, suppliers, transportation, manufacturing, distribution, warehousing, supply chain and brand.

Ask the Expert Series: Straight Talk on Safety, Defense and Security with Bruce Lesniak

By Aaron G. Biros, Bruce E. Lesniak
3 Comments

This is the first part of a series dedicated to understanding more about defense, security and safety as they relate to the cannabis industry, the importance of having standards and some tips for cannabis business plans. Over the next few weeks, we will hear from multiple industry pioneers discussing those topics and offering practical solutions for problems that many cannabis businesses face daily.

Inconsistent laws across multiple states created a fragmented network of regulations for cannabis. Some third parties are filling the gaps between the industry standards and state regulations. The Colorado Marijuana Enforcement Division (MED) and the Washington Liquor and Cannabis Board’s i-502 rule provide guidance on regulations surrounding packaging and labeling, advertising, pesticide use, retail and other areas.

Still there are many opportunities to fill the gaps. The Foundation of Cannabis Unified Standards (FOCUS), is an independent non-profit founded to develop some consistency in standards governing public health, consumer safety and the environment. In cultivation, the third party certification, Clean Green Certified, works to provide some guidance for growing cannabis organically based on USDA organic standards. For laboratories, Washington’s regulations provide some guidance, but organizations like FOCUS, the American Association for Laboratory Accreditation (A2LA) and the Cannabis Safety Institute seek to fill the gaps in laboratory standards along with the ISO 17025 requirements.

Security and defense is one particular area of the cannabis industry that still needs a benchmark for businesses to follow. In this series, we sit down to discuss security, defense and safety with Bruce Lesniak, president of the Food Safety and Defense Institute and member of the oversight committee for the establishment of standards in the cannabis industry in conjunction with FOCUS.

Cannabis Industry Journal: What changes do you see coming to the cannabis industry related to product safety, defense and security? 

Bruce Lesniak: As in every industry that provides a public consumable product, the primary objective is to protect the consumer by providing products that are consistently safe. The largest change coming to the cannabis industry will be the implementation of enforceable, nationally uniform standards across all states and all product lines. I believe that the standards and regulations developed for the cannabis industry will mirror those of the food industry. Companies are already busy working to develop this uniform standard, one such group is FOCUS. Founded by Lezli Engelking, FOCUS works with diverse professionals from regulatory, quality assurance, medical, law enforcement, business, research, and the government officials, medical and research professionals along with subject matter experts from numerous business disciplines across the industry to develop impartial, comprehensive, cannabis specific standards that will be presented for adoption by state and federal governing bodies. Lezli summarizes the FOCUS Mission as “ To protect public health, consumer safety, and safeguard the environment by promoting integrity within the cannabis industry.” Look for more on this in our next Ask the Expert update, on CannabisIndustryJournal.com or you can contact Lezli Engelking at FOCUS here: 866-359-3557 x101.


This series will highlight important issues involving security, defense and safety in the cannabis industry. Next week, Bruce, along with cannabis security professional, Tony Gallo of Sapphire Protection, will provide some advice on what companies can do to improve their master business plan. Stay tuned for next week’s Part II of Ask the Expert: Straight Talk on Safety, Defense and Security with Bruce Lesniak.