Tag Archives: Washington State Liquor and Cannabis Board

Washington Security Breach Delays Traceability System Rollout

By Aaron G. Biros
No Comments

On February 8th, Peter Antolin, the deputy director for the Washington State Liquor and Cannabis Board (WSLCB), sent an email to licensees explaining why the transition to their new traceability system was disrupted. Last Saturday, someone gained access to the sensitive information in Leaf Data Systems, the state’s traceability software that is powered by MJ Freeway.

“A computer vulnerability was exploited on Saturday, allowing unauthorized access to the traceability system,” Antolin told licensees in the email. “There are indications an intruder downloaded a copy of the traceability database and took action that caused issues with inventory transfers for some users. We believe this was the root cause of the transfer/manifest issue experienced between Saturday and Monday.”WSLCB

The email goes on to say that no personally identifiable information was available to the ‘intruder,’ but some sensitive information was clearly accessed. That data includes route information of manifests filed between February 1st and 4th as well as transporter vehicle information including VIN, license plate number and vehicle type, according to the email.

That email leaves much to be desired. For one, they do not exactly have a solution, instead trying to alleviate licensees’ worries with a hollow inanity full of meaningless jargon: “The WSLCB and MJ Freeway continue to implement several strategies to prevent future vulnerabilities to future intrusions,” reads the email. “This includes full logging and monitoring and working with third-party entities. Since this remains an active investigation, details on security are not publicly available.” However, today the WSLCB is hosting a webinar where Peter Antolin, their IT division, the MJ Examiners unit and enforcement will be available to answer questions, according to the email.

WSLCB emailThis is by no means the first security breach that Washington and MJ Freeway have suffered. In May of 2017, Washington originally selected Franwell’s METRC as the contract partner for their traceability software system. Less than a month later in June of 2017, after a mistake in the selection process, Washington selected MJ Freeway instead of Franwell for the traceability contract. Three days later, MJ Freeway’s source code was stolen and published online. Then in September, Nevada cancelled their contract with MJ Freeway after a security breach, their services crashed in Pennsylvania and Spain, and in October it became clear that the company could not meet the October 31 deadline for their new Washington contract.

In November of 2017, BioTrackTHC, the company that held the previous contract for Washington’s traceability software, helped the state through the transition period with a temporary Band-Aid solution to hold the state over until January of 2018. A month after they expected to implement the new MJ Freeway system, the latest security breach occurred this week and disrupting the rollout yet again.

At the end of the email Antolin sent to licensees yesterday, he says there will continue to be attempts to breach the system’s security. “The bottom line is that this incident is unfortunate,” says Antolin. “There will continue to be malicious cyberattacks on the system. This is true of any public or private system and is especially true of the traceability system.” This begs a few questions: why aren’t we hearing about this kind of security breach in other states’ traceability systems? What are other companies doing that prevents this from happening? Why does this keep happening to MJ Freeway?

Washington Selects Franwell’s METRC for Traceability Program

By Aaron G. Biros
No Comments

The Washington State Liquor and Cannabis Board (WSLCB) announced today they plan to choose Franwell as their technology partner for the state’s cannabis seed-to-sale traceability system. While the release states they have not yet officially awarded them the contract, it says Franwell is the apparent successful vendor (ASV) to replace their current system. “An ASV is the procurement term used for the highest scoring, responsive vendor,” says the press release.

Rick Garza, director of the WSLCB, says they plan on making a number of changes that they couldn’t under their current contract. “Over the last four years we have learned a lot about this industry, including aspects to the industry that were unknown when the current traceability system was implemented,” says Garza. “We need a system that will grow and flex with Washington’s maturing marijuana system.”

Seven companies submitted bids for the new contract and the agency narrowed that down to three finalists, each of which gave presentations and demonstrations on their software products to WSLCB staff last week. They also worked with folks in the cannabis industry, selected by trade organizations, that provided input on the requests for proposal. Those industry stakeholders that participated with input will get a demonstration of the new software system in early June.

They plan on transitioning to the new system no later than October 31, 2017. Franwell’s METRC product is currently used in Colorado, Oregon and Alaska.