Tag Archives: temporary

Washington Security Breach Delays Traceability System Rollout

By Aaron G. Biros
No Comments

On February 8th, Peter Antolin, the deputy director for the Washington State Liquor and Cannabis Board (WSLCB), sent an email to licensees explaining why the transition to their new traceability system was disrupted. Last Saturday, someone gained access to the sensitive information in Leaf Data Systems, the state’s traceability software that is powered by MJ Freeway.

“A computer vulnerability was exploited on Saturday, allowing unauthorized access to the traceability system,” Antolin told licensees in the email. “There are indications an intruder downloaded a copy of the traceability database and took action that caused issues with inventory transfers for some users. We believe this was the root cause of the transfer/manifest issue experienced between Saturday and Monday.”WSLCB

The email goes on to say that no personally identifiable information was available to the ‘intruder,’ but some sensitive information was clearly accessed. That data includes route information of manifests filed between February 1st and 4th as well as transporter vehicle information including VIN, license plate number and vehicle type, according to the email.

That email leaves much to be desired. For one, they do not exactly have a solution, instead trying to alleviate licensees’ worries with a hollow inanity full of meaningless jargon: “The WSLCB and MJ Freeway continue to implement several strategies to prevent future vulnerabilities to future intrusions,” reads the email. “This includes full logging and monitoring and working with third-party entities. Since this remains an active investigation, details on security are not publicly available.” However, today the WSLCB is hosting a webinar where Peter Antolin, their IT division, the MJ Examiners unit and enforcement will be available to answer questions, according to the email.

WSLCB emailThis is by no means the first security breach that Washington and MJ Freeway have suffered. In May of 2017, Washington originally selected Franwell’s METRC as the contract partner for their traceability software system. Less than a month later in June of 2017, after a mistake in the selection process, Washington selected MJ Freeway instead of Franwell for the traceability contract. Three days later, MJ Freeway’s source code was stolen and published online. Then in September, Nevada cancelled their contract with MJ Freeway after a security breach, their services crashed in Pennsylvania and Spain, and in October it became clear that the company could not meet the October 31 deadline for their new Washington contract.

In November of 2017, BioTrackTHC, the company that held the previous contract for Washington’s traceability software, helped the state through the transition period with a temporary Band-Aid solution to hold the state over until January of 2018. A month after they expected to implement the new MJ Freeway system, the latest security breach occurred this week and disrupting the rollout yet again.

At the end of the email Antolin sent to licensees yesterday, he says there will continue to be attempts to breach the system’s security. “The bottom line is that this incident is unfortunate,” says Antolin. “There will continue to be malicious cyberattacks on the system. This is true of any public or private system and is especially true of the traceability system.” This begs a few questions: why aren’t we hearing about this kind of security breach in other states’ traceability systems? What are other companies doing that prevents this from happening? Why does this keep happening to MJ Freeway?

Open For Business: California Market Launches

By Aaron G. Biros
No Comments

California’s full legal cannabis market officially opened its doors for business on January 1st, 2018. Following a relatively short time frame when they announced the first licenses awarded less than a month ago, retail stores were open for business in counties throughout California. Customers came out in full force, with long lines on the opening day, with some hundreds deep stretching around blocks.

For the quick turn around time between implementing regulations and awarding temporary licenses, the grand opening of the cannabis market in the nation’s most populous state proceeded smoothly. Only a handful of minor hiccups associated with the launch were reported throughout the state. In the grand scheme of things, that’s a pretty good job for a new regulatory agency (The Bureau) tasked with regulating such a massive fledgling market.

One major and definitely foreseeable hiccup in the launch of California’s new medical and adult use markets was the failure to implement tracking software. According to Michael Blood with The Associated Press, licensed businesses are being asked by the California Department of Food and Agriculture to manually document sales and transfers of cannabis with paper invoices.

Los Angeles
Image: Kevin Stanchfield, Flickr

While the Department said the traceability system was implemented Tuesday, Blood says, cannabis businesses are not required to use it and will be trained on how to operate it before it becomes required to use later in 2018.

Local control regulations in California means that businesses must first seek approval from local authorities before attaining a temporary license from the state to operate. That coupled with the rolling process of awarding licenses meant that only some cannabis businesses could officially open their doors. Municipalities throughout California handle regulating cannabis differently.

The handful of adult use dispensaries with temporary licenses in the Los Angeles area received a massive influx of customers on opening day. Residents of LA came in droves to the four West Hollywood dispensaries open for adult use business.

California Rolls Out Licensing For Cannabis Businesses

By Aaron G. Biros
No Comments

Last week, the Bureau of Cannabis Control issued the first licenses for California’s new market. The first license went to Moxie, a cannabis distribution company out of Lynwood.

The search feature for the list of licenses issued so far

As of the publication of this article, the Bureau, the state authority tasked with leading the regulation of the industry, has issued 43 temporary licenses. So far, four laboratories have received licenses, along with a number of retailers, distributors, microbusinesses in both medical and adult-use markets.

The labs to receive their temporary licenses so far are pH Solutions, Steep Hill Labs, Pure Analytics and ORCA Cannalytics. Judging by the number of temporary medical and adult-use licenses awarded so far, it appears the Bureau is trying to issue a similar amount for each sector, distributing the number of licenses between the two equitably.

You can find the list of licensees here, and search between the dates of 12/15/17 to 1/2/18 to get the most up-to-date list of licenses awarded. “Last week, we officially launched our online licensing system, and today we’re pleased to issue the first group of temporary licenses to cannabis businesses that fall under the Bureau’s jurisdiction,” says Lori Ajax, Bureau of Cannabis Control Chief. “We plan to issue many more before January 1.”

According to the press release, temporary licenses are only issued to applicants with prior local authorization in the form of a license or permit from the jurisdiction where the business is. Those licenses will become effective on January 1, 2018. The temporary licenses will work for 120 days, or May 1, 2018, after which businesses will need to have a permanent license to continue operating.

More than 1,900 users have registered with the Bureau’s online system, and more than 200 applications have been submitted, according to the press release.

The various regulatory bodies in California have worked diligently for months now to roll out proposed emergency regulations, setting strict requirements for manufacturers, growers, retailers and testing labs. Manufacturing regulations, including specific labeling, packaging and processing requirements, give a good snapshot of how regulators plan to move forward. Testing requirements could also be significantly firmer, with rules for documentation, sample sizes, sampling procedures, storage and transportation.

Yet when the adult-use sales become fully legal on January 1, 2018, those regulations will not be fully implemented.

Donald Land, a UC Davis chemistry professor and chief scientific consultant at Steep Hill Labs Inc., told The Associated Press, “Buyer beware.” There will be a six-month range where existing inventory will be allowed on the shelves, products that might not meet the standards of the new rules. So dispensaries will get half a year of sales before all products have to meet the new, stricter testing requirements.

California Releases Proposed Emergency Regulations

By Aaron G. Biros
No Comments

Last week, the California Bureau of Cannabis Control released their proposed emergency regulations for the industry. The Bureau, the government agency tasked with regulating California’s cannabis industry, announced the proposed emergency regulations ahead of the highly anticipated January 2018 start date.

The Bureau also published helpful fact sheets and overview documents, providing a good snapshot of the major requirements for different types of licenses. Here are some of the key takeaways:

Temporary licenses will allow businesses to operate for 120 days while their annual license application is being processed. Not surprisingly, local jurisdictions have considerable autonomy. Getting a license seems to be contingent on first getting local approval to operate. According to Josh Drayton, communications and outreach director at the California Cannabis Industry Association (CCIA), working with local governments will be crucial to making progress. “Now that the Brown Administration has created the framework for medical and adult use cannabis, the main challenge we face as an industry is getting local municipalities to move forward with regulations,” says Drayton. “California has a dual licensing process which means that cannabis operators must receive a local permit/license/authorization before being able to apply for a state license. A majority of California cities and counties have yet to finalize their regulations which will delay state licensing.”

The initial reactions to these proposed regulations seem positive, given that this is a culmination of efforts over several years. “The California Cannabis Industry Association welcomes the release of the emergency regulations,” says Drayton. “These regulations represent years of hard work and collaboration between the administration, the regulating departments, and the cannabis industry.”

License Distinctions

A-type licenses are for businesses in the adult-use market, while M-type licenses are for the medical market. Laboratory licenses don’t have this distinction, as they can test both medical and adult-use products.

The record keeping and security requirements seem relatively straightforward, requiring normal surveillance measures like 24-hour video, commercial-grade locks and alarm systems. The rules also lay out guidelines for disposing of waste, including securing it on the premises and not selling it.


Distributor licenses appear to have a number of compliance documentation requirements, such as arranging for all product testing, quality assurance and packaging and label accuracy. “Cannabis and cannabis products must pass through a distributor prior to being sold to customers at a retail establishment,” reads the overview the Bureau published. There is also a transport-only distributor license option. Those regulations appear to be more comprehensive than others, with a number of regulations pertaining to appropriate transportation and security measures.

Everything has to be packaged before it gets to retail; Retailers are not allowed to package or label cannabis products on premises. Microbusiness licenses will be available, which should be an exciting new development to follow as the market matures.


The state will require ISO 17025 accreditation for testing labs. A provisional license is required for a lab to operate in the short term, expiring after 12 months. Laboratory personnel are required to go in the field and do the sampling. Documentation requirements, sample sizes, sampling procedures and storage and transportation rules are also laid out.

Testing labs are required to test for cannabinoids, foreign material, heavy metals, microbial impurities, mycotoxins, moisture content and water activity, residual pesticides, residual solvents and processing chemicals and terpenoids (terpenes). Infused and edible products are required to be tested for homogeneity in THC and CBD concentrations as well. Drayton and the CCIA welcome these new testing regulations, hoping it might improve overall public safety. “We believe that these regulations will address public health issues by mandating the testing of all cannabis products,” says Drayton. “The evolution of the cannabis industry will continue, and we will continue to advocate for good policy that creates solutions for the problems that arise. I believe that we will be visiting and revisiting cannabis regulations for many years to come.”

Certificates of analysis (COA) will be required, showing whether a batch passes or fails testing requirements. Harvest batches that fail testing can be processed for remediation. “Testing laboratories are required to develop and implement a quality assurance program that is sufficient to ensure the reliability and validity of the analytical data produced by the laboratory,” reads the statement on QA and QC.

The Bureau, at the end of their regulatory overview document, lays out some possible enforcement actions, disciplinary actions and citations that could come from noncompliance. “These emergency regulations create a framework for both medical and adult use consumers,” says Drayton.  “January 1, 2018 will be the first date that adults 21 years and older will be able to purchase cannabis without a medical card.”

In the coming weeks, we’ll be breaking down and analyzing the other proposed emergency regulations that the state released. Stay tuned for a breakdown of the California Department of Food & Agriculture (CDFA) regulations on cannabis cultivation, as well as The California Department of Public Health (CDPH) cannabis manufacturing regulations.

Pennsylvania Temporary Rules for Doctors Released

By Aaron G. Biros

Pennsylvania Department of Health Secretary Dr. Karen Murphy recently released a draft of temporary regulations for physicians, asking for feedback via a survey from the medical community. “The process for a patient to obtain medical marijuana will begin with the physician, so it’s vital to ensure that our regulatory process for those physicians is open and transparent,” says Secretary Murphy. “Our focus remains to implement a patient-focused medical marijuana program that gives help to those who need it, and these temporary regulations mark an important step forward in achieving that goal.” The temporary rules, published on April 11th, outline physician and practitioner registration, patient certifications, physician training and other key regulations.

Steve Schain, Esq. practicing at Hoban law Group

In the temporary rules lie some stipulations for doctors, which seem intended to limit corruption or financial conflicts of interest. According to Steven Schain, Esq., consumer finance litigation, banking law and cannabis law expert practicing with Hoban Law Group, the market’s growth will hinge on doctor participation. “The entire program will rise and fall based on the speed in which we involve doctors,” says Schain. “If the doctors don’t certify for medical conditions and make recommendations, the market won’t go anywhere.” Pennsylvania’s program, under the current language, requires doctors to issue patient certifications, similar to what other states might call a doctor recommendation or prescription.

According to Schain, other states with similarly worded regulations experience a lack of physician participation, and tepid market growth at best. “If you look at New York, New Jersey or Maryland, they run into issues where there just is no incentive for doctors to participate,” says Schain. “If you look at the existing language of the regulations, there is no financial incentive for doctors to get involved, they can’t charge for a recommendation, which is good and bad.”

“The good part is it reinforces that doctors can’t really be a financial backer of a grow operation or a dispensary,” says Schain. Under the current language, physicians can’t solicit, accept or offer any form of compensation from any patient, prospective patient, caregiver or anyone involved in a medical cannabis business if they intend to register with the Department to issue patient certifications for cannabis. “Some doctors thought this would be a cottage industry for them, it’s not.” Doctors are also not allowed to advertise as a practice issuing patient certifications for cannabis. “Another benefit of the language in the proposed regulations is the continuing care of a physician,” says Schain. “They want the people doing the bulk of referring or recommendations to be primary care physicians. Those are the people doing most of the recommendations, as it should be.” 

Those rules contrast starkly with what many are familiar with in California’s regulations where doctors could advertise freely and charge fees without the need for ongoing care. “Looking at previous regulations in a state like California, where there were no requirements for ongoing care, we saw doctors making a business out of writing recommendations for cannabis,” says Schain. “The PA regulations are much stricter, which I think is great.”

In addition to those preventative measures, the temporary rules require physicians to actively use the Prescription Drug Monitoring Program. This means doctors must consider a patient’s history of controlled substance prescriptions to see if that might impact their medical cannabis use. Doctors have to take this into account before issuing or modifying a patient certification. The rules also provide for a 4-hour training course, required for all physicians seeking to register as a practitioner who can certify patients for medical cannabis use. The Department of Health expects the program will be fully implemented by 2018.

Pennsylvania Temporary Rules for Growers & Processors Released

By Aaron G. Biros
No Comments

Last week, Pennsylvania Department of Health Secretary Dr. Karen Murphy announced the formation of temporary regulations for cannabis growers and processors in the state, according to a press release. Those temporary rules were published on Saturday, October 29. Secretary Murphy asked for public comment on developing regulations for dispensaries as well.padeptofhealthlogo-768x186

The PA Department of Health published the new set of temporary regulations this past Saturday, outlining “the financial, legal and operational requirements needed by an individual to be considered for a grower/processor permit, as well as where the facilities can be located.” The regulations also discuss tracking systems, equipment maintenance, safety issues, disposal of cannabis, tax reporting, pesticides, recalls and insurance requirements. “One of our biggest accomplishments to date is the development of temporary regulations for marijuana growers and processors,” says Secretary Murphy. “We received nearly 1,000 comments from members of the community, the industry and our legislative partners.”

The general provisions published on Saturday outline the details of the application process, fees, inspections, reporting, advertising and issues surrounding locations and zoning. The temporary regulations for growers and processors delve into the minutia of regulatory compliance for a variety of issues: including security, storage, maintenance, transportation, tracking, disposal, recall, pesticides and packaging and safety requirements. A list of pesticides permitted for use can also be found at the bottom of the rules.

PA Department of Health Secretary Dr. Karen Murphy
PA Department of Health Secretary Dr. Karen Murphy

The document discusses the regulations for performing voluntary and mandatory recalls in great detail. It requires thorough documentation and standard operating procedures for the disposal of contaminated products, cooperation with the Department of Health and appropriate communications with those affected by the recall.

The department has yet to release temporary regulations for laboratories and dispensaries, but hopes to do so before the end of the year. “I am encouraging the public – and specifically the dispensary community – to review the temporary regulations and provide us with their feedback,” says Secretary Murphy. “The final temporary regulations for dispensaries will be published in the Pennsylvania Bulletin by the end of the year.”

Since Governor Tom Wolf signed the medical cannabis program bill into law in April 2016, the state has made considerable progress to develop the program, including setting up a physician workgroup, public surveys for developing temporary rules and a request for information for electronic tracking IT solutions. The PA Department of Health expects to implement the program fully in the next 18 to 24 months.