Cannabis Track and Trace Is A Disaster Waiting to Happen—and Not for the Reasons You Might Think

Hashish Observe and Hint Is A Catastrophe Ready to Occur—and Not for the Causes You Would possibly Assume

By Griffen Thorne, Lawyer at Harris Bricken

Most states’ regulated hashish regimes require licensed hashish firms to make use of seed-to-sale track-and-trace software program. In California, the state has contracted the complete track-and-trace program to the METRC program. The METRC program isn’t but absolutely carried out as a result of many operators don’t but have annual licenses. Our California hashish attorneys steadily help shoppers with track-and-trace compliance and preparation. We all know that almost all California hashish licensees are simply making an attempt to get a deal with on how they may use METRC and what that can require from an operational standpoint. What no one appears to be specializing in is the truth that some obvious oversights in California’s laws may result in widespread chaos for operators throughout the state.

The side of track-and-trace with the most important potential for catastrophe isn’t the truth that it’s so advanced, however quite the truth that lack of entry to the system could possibly be devastating for licensees. Every of the three California hashish businesses’ track-and-trace guidelines prohibit licensees from transferring hashish to different licensees within the occasion of lack of entry to the track-and-trace system. This successfully implies that companies need to cease doing enterprise till entry is restored—it doesn’t matter what—and every single day ready may value 1000’s of {dollars} in misplaced revenues. It doesn’t matter if the lack of entry was attributable to a licensee, a 3rd get together, and even points with METRC or a third-party software built-in with METRC.

This leads me to a post I wrote several months in the past on how knowledge breaches are more likely to ravage the hashish business. One of many issues I talked about is the potential for “ransomware” or related assaults—conditions the place hackers encrypt information and even in some circumstances lock customers out of techniques and demand cash (the ransom) in trade for giving entry again to the person.

If a ransomware or related assault causes lack of entry to a licensee’s track-and-trace software program, the licensee can be on the mercy of hackers and gained’t be capable of conduct enterprise till they both pay the ransom (which can pose authorized issues in and of itself, see here) or work out the best way to achieve again entry themselves (which can be unimaginable). If there’s an assault to and even merely unintended downtime within the METRC system or built-in purposes, that might trigger chaos for operators throughout the state.

Whereas lack of entry to the complete METRC system may occur, it’s in all probability not very probably. What’s just about assured to happen is individualized lack of entry to the track-and-trace system following routine pc incidents or malicious hacking. There’s not a lot that the business can do if METRC is breached and there’s widespread lack of entry. However there’s a lot that firms can do to guard themselves from individualized breaches or at the least decrease the harm attributable to breaches—from cyber insurance coverage to breach planning to privateness coverage compliance.

In our expertise, these are points that the common hashish firm simply isn’t even contemplating. Due to the expense and problem of complying with hashish legal guidelines, knowledge make hashish firms take a really exhausting have a look at how they function.

Hashish firms have much more to lose than common firms given the federal standing of hashish (would hashish firms wish to report knowledge breaches to the FBI?) and the truth that knowledge breaches can already be tremendously costly for firms that don’t need to spend tens (or a whole bunch) of 1000’s of {dollars} on permits and take care of Internal Revenue Code section 280E. Hashish firms ought to seek the advice of with their counsel to determine strong methods to guard themselves within the occasion of lack of entry to the track-and-trace system or from different knowledge safety issues.

Re-published with the permission of Harris Bricken and The Canna Law Blog

Source link

Post Your Comment Here

Your email address will not be published. Required fields are marked *