Starting November 1, 2017, marijuana establishments in Nevada will be required to report their product tracking information to a new system: Metrc. The notification went out to marijuana establishments on September 12, coming without warning and with very little explanation from the Department of Taxation—the state department in charge of the state’s legal marijuana regulation.
It was an especially surprising move considering that Leaf Data Systems, the current marijuana tracking regulatory system developed by MJ Freeway, has been operating for less than one year out of a five-year contract with the state.
The question for many Nevada businesses is, “Why?” There was little to no information provided in the email sent out by the state, and so, at this point, there can only be speculation. However, there are some key things to take note of.
- In December 2016, Nevada experienced a data security breach, admitting that 11,700 patient files were potentially compromised.
- In January 2017, MJ Freeway’s system went down for days, disrupting customers’ businesses across the country. As a result of this downtime, news agencies reported that more than 1,000 marijuana retailers in 23 states struggled with their sales and inventory management, some even being forced to close as a result. MJ Freeway alleged that their system was taken down by a cyberattack. When the company’s director of data and marketing, Jeannette Ward, spoke to Marijuana Business Daily about the breach, she said, “Our initial analysis indicates that this was a direct attack on MJ Freeway’s infrastructure,” and that no data was stolen.
- In June of 2017, MJ Freeway’s source code was posted on gitlab.com and discussed on Reddit pages. The code remained accessible for about four days, and while MJ Freeway claimed it was an “outdated version” and would not “impact our customers’ or patients’ data in any way” it was yet another security issue incident for the firm. On June 27, a commenter on a marijuana industry news site posted that they, along with “other Nevada Clinics,” received what appeared to be an email purporting to sell “nevada.leafdatasystems.com customer tables.” On June 29, the Nevada Department of Health and Human Services sent an email requiring all marijuana establishments to reset their login credentials to Leaf Data Systems.
As for what the state of Nevada thinks about the situation, take a look at the language used by the Nevada Purchasing Department when talking about the current MJ Freeway Leaf Data Systems contract. “The current system used by DPBH does not provide the track and trace capability, trend analysis and analytics data necessary for Taxation to effectively regulate medical and retail marijuana.”
As for the new Metrc contract, it was awarded without the typical Request for Proposal (RFP) process, citing the idea that Metrc LLC “is the only known vendor that provides a data collection system specifically for regulatory agencies…other vendors, such as MJ Freeway and BioTrack THC sell products that support both regulatory entities and the marijuana industry. This presents an inherent conflict of interest.”
The Nevada Department of Taxation is currently the only government agency to consider providing support to both regulatory entities and the marijuana industry a conflict of interest. Beyond the fact that their counterparts at the Nevada Department of Public and Behavioral Health did not hold that position when they first chose MJ Freeway, BioTrack THC holds the contracts in Hawaii, New York, New Mexico, Illinois, Puerto Rico and Delaware while MJ Freeway holds the contracts in Pennsylvania and Washington.
It will be interesting to see where Nevada goes from here. Metrc was awarded the contract for $5,000 a month for 48 months (four years) plus $480 per year in technical support per establishment (300) for a contract total of $816,000. They likely will be charging marijuana establishments on a per-tag-basis as they have done in other states.