marijuana oregon seminar

On June 7, our own Vince Sliwoski will chair an all-day continuing legal education (CLE) event called The Business of Marijuana in Oregon, along with Jesse Sweet, a lawyer and senior policy analyst at the Oregon Liquor Control Commission (OLCC). This will be Vince’s fourth year presenting at the event and his third year as chair. The roster of speakers lined up for this CLE is better than any year to date, and everyone, including non-lawyers, would be well served to attend. For a full event description, including topics, speakers and registration links, click here.

Looking back over the past four years, it is amazing to see how much things have changed in Oregon cannabis. At this point, the OLCC’s recreational marijuana program is fully built out, with over 3,400 applicants now on file with the state. We are proud to call many of these Oregon producers, processors, wholesalers and retailers our clients, alongside the many investors and ancillary service providers we represent.

Sometimes, it is said that pioneers get slaughtered and settlers get rich. Now that the Oregon regulatory groundwork has stabilized, we have begun to see a second wave of entrepreneurs and investors move in on the local industry. Many of these new entrants bring skills, capital and experience from other regulated markets, while others are new to the space. Over the next year or so, we expect to see a fair amount of market consolidation throughout the Oregon cannabis industry. (See our most recent observations on the “state of the State” here).

Oregon attorneys and business owners alike need to be familiar with the unique regulatory concepts and industry dynamics that will be discussed on June 7, in order to best serve the Oregon cannabis industry. These concepts include state laws and administrative rules, developments in the highly dynamic federal sphere, and practical approaches to working with and in the cannabis industry. Attendees will hear from regulators, bankers, CPAs, and, of course, lawyers aplenty.

We hope you will join us on June 7 for an eight-hour survey of Oregon cannabis that is both broad and deep. And if you are a Harris Bricken client or a friend of the firm, please click here to request a promotional discount code, which can be applied to either the webcast, or to in-person attendance.

See you soon.

Our own Hilary Bricken will have the great pleasure of speaking at the Central Coast Wine and Weed Symposium (presented by the Wine Industry Network) tomorrow, May 10, in San Louis Obispo. While the Symposium will focus on a variety of topics covering the cross section of the wine and cannabis industries, Hilary’s panel will specifically cover “Wineries & Cannabis: What You Can & Can’t Do” in regards to the Medicinal and Adult-Use Cannabis Regulation and Safety Act (“MAUCRSA”) and its corresponding emergency rules.

The breakdown of Hilary’s panel is as follows:

On January 1st, California finally kicked it off its newly regulated adult use and medical cannabis markets, creating a plethora of business opportunities, some of which will undoubtedly impact the wine industry, both positively and negatively. However, acquiring state licenses and local approval to operate within the confines of the law can be challenging, costly and confusing, as state regulations and tax policies remain a work in progress and local commercial cannabis ordinances are different from one county and city to the next. In addition, with three separate state agencies taking on the comprehensive regulation of all kinds of cannabis businesses, understanding regulations across agencies is of the utmost importance to would-be cannabis entrepreneurs.

This interactive session, featuring leading cannabis legal experts, will address questions regarding what’s permitted and what’s not including but not limited to analyzing distribution restrictions, prohibited products, packaging and labeling, quality assurance standards, consumer protections, brand and advertising restrictions, as well as the overall temporary and annual state licensing, taxation, operational and reporting requirements, and the expected costs of and barriers to entry.

Hilary’s fellow panelists are heavy hitters in their own regard–Amanda Ostrowitz, an attorney, as well as founder and CEO of the very popular CannaRegs, and Rebecca Stamey-White, a partner at Hinman & Carmichael, LLP and a very well known and highly respected alcohol and cannabis regulatory attorney. We expect a lively and interesting discussion: Although the wine and cannabis industries don’t always get along, these two industries have a lot more in common than you might think.

For all your questions about wine and cannabis, as well as specifics regarding the regulatory challenges under MAUCRSA, we sincerely hope you can make it to the Wine & Weed Symposium!

cannabis marijuana josephine county oregon
Josephine County is ALL IN on prohibition.

For the past several months we have been following Josephine County’s efforts to regulate away its cannabis industry, specifically in rural residential zones. This saga has taken many twists and turns (see here, here, here, and here), but this week brought perhaps the biggest twist yet: Josephine County has sued the State of Oregon in a suit that could effectively invalidate its cannabis program.

The legal skirmishes began back in December, when Josephine County passed an ordinance to severely curtail cannabis production on over 16,000 rural residential properties. A group of growers appealed the ordinance to Oregon’s Land Use Board of Appeals (LUBA), raising a procedural argument (improper notice to affected properties) and two substantive arguments (the county cannot ban pre-existing lawful uses and the ordinance exceeds the county’s ability to impose reasonable time, place, and manner regulations on cannabis production). Last month, LUBA ruled against the county, solely on the procedural issue. Josephine County failed to provide proper notice of the public hearings where the ordinance was discussed. As a result, LUBA did not reach the substantive merits. As expected, Josephine County elected to appeal the procedural question.

Surprisingly, Josephine County also decided to take the drastic step of filing a lawsuit against the State of Oregon in federal court. We gave our initial take on this aggressive move in news coverage here and here. In short, Josephine County wants the federal court to:

  1. Declare that cannabis production cannot qualify as a pre-existing “lawful use” because of federal prohibition;
  2. Declare that counties can place any restrictions they want, including a full ban, on cannabis businesses because state legal regimes are pre-empted by federal law;
  3. Declare that Oregon’s medical and recreational regimes unlawfully restrict the county’s police powers in light of federal prohibition;
  4. Enjoin the State from bringing official misconduct charges against any local or county official that ignores their duties under state law.

This is a stunning overreach, as a victory could presumably give counties the ability to even ignore Oregon’s decriminalization statutes. As a county that allegedly wants to crack down on bad actors and the black market, and is apparently struggling to provide basic services, Josephine County should be welcoming law abiding, tax paying cannabis farms with open arms. Instead, I am reminded of my young daughter breaking her own toy when she doesn’t get her way.

This lawsuit raises core constitutional questions, involving states’ rights to promulgate cannabis programs despite the federal Controlled Substances Act, and over the objection of local jurisdictions. In the past, we have seen prohibitionist states attempt to invalidate neighboring states’ cannabis programs, to no avail. This may be the first time, however, that a county in an adult use state has filed such a lawsuit against its sovereign. We will be monitoring this case closely, as will the Oregon cannabis industry at large and other prohibitionist counties nationwide.

california marijuana cannabis

Tomorrow and Friday, at the DoubleTree Suites by Hilton Hotel in Santa Monica, Hilary Bricken will be chairing a CLE on California Cannabis Laws and Rules, with a specific focus on SoCal’s cannabis business and regulatory scene. The event will be produced by The Seminar Group. You can see a copy of the agenda here.

In addition to our own Jim Hunt, Julie Hamill, and Alison Malsbury, some of the featured speakers include:

Lori Ajax, Chief of the Bureau of Cannabis Control, was appointed by Governor Brown in February 2016. Prior to her appointment, she served as Chief Deputy Director at the Department of Alcoholic Beverage Control where she spent 22 years working her way up the ranks, starting at the investigator trainee level.

Fiona Ma, CPA, Board Member, California State Board of Equalization (BOE), District 2, represents 23 counties and nearly ten million Californians in her District. As one of the few Certified Public Accountants to serve on the BOE, she is a strong voice for businesses and taxpayers – taking the lead in clearing the haze around the cannabis industry by holding informative stakeholder meetings discussing key issues.

Cat Packer was appointed by City of Los Angeles Mayor, Eric Garcetti, in August 2017 as the first Executive Director of the Los Angeles Department of Cannabis Regulation. The Department of Cannabis Regulation is a newly-established city entity tasked with cannabis policy implementation and licensing commercial cannabis activity within the City.

Avis Bulbulyan is the CEO of SIVA Enterprises, a full-service cannabis business development and consulting firm that provides state licensing, management, venture opportunities, product and brand development, and insurance to entrepreneurs across the United States. He oversees corporate direction, business development and strategy, facilitating company activity in consulting, alliances and channels, marketing, investments and operations.

This seminar will cover topics directly relevant to California’s medical and recreational cannabis laws and regulations under the Medicinal and Adult-Use Cannabis Regulation and Safety Act and California cannabis businesses, including state and local licensing and approval structures, various local laws and land use issues and concerns, including in the City of Los Angeles, cannabis investment in California, intellectual property and patent registration and policing, a banking update, California hemp laws and regulation, emerging areas in cannabis commercial litigation, various real estate issues around commercial leases and property purchases for cannabis uses, taxes and the treatment of cannabis income under IRC 280E, California cannabis water rights and licensing requirements, and a boots on the ground perspective from actual cannabis operators in the State of California.

For a $100 discounted entry into this two-day seminar, call The Seminar Group at 800-574-4852 and specify code FAC100 – or register online here and enter that code where specified.

Hope to see you there!

oregon marijuana cannabis
OLCC could use a technology lifeline.

Recently, we discussed the official report of the Oregon Secretary of State’s audit (the “Report“) of the Oregon Liquor Control Commission’s (“OLCC”) information technology systems, related to Oregon’s recreational cannabis industry. In our previous post on the topic, we discussed findings and recommendations relating specifically to the OLCC’s Marijuana Licensing System (MLS) and the separate Cannabis Tracking System (CTS), and whether the OLCC has sufficient technical controls in place to ensure that the MLS and CTS are supporting effective regulation of the recreational cannabis industry. Today we are going to look at the OLCC’s general information technology (IT) security concerns and disaster recovery procedures, and whether the OLCC has implemented sufficient security procedures to protect against known technical and physical threats.

The Report first lays out two “key findings” in this area:

  1. The “OLCC has not implemented an effective IT security management program for the agency as a whole.”
  2. The “OLCC has not formally developed a disaster recovery plan and has not tested backup files to ensure they can be used to restore mission-critical applications and data.”

Digging deeper, the Report paints a bit of a grim picture of the OLCC’s IT capabilities:

[W]e found that OLCC management has not implemented an appropriate security management program for all agency IT systems. OLCC does not have sufficient policies, procedures, and plans in place to ensure that computer resources are protected against known vulnerabilities and physical threats. Although this does not affect the externally hosted marijuana applications, other programs and administrative systems at OLCC may be at risk. – The Report

According to the Report, the OLCC currently does not have an up-to-date security plan, doesn’t adequately track information IT assets, doesn’t have a process to monitor for unauthorized changes or devices, cannot identify security vulnerabilities, lacks sufficient controls for physical access to OLCC sites and resources, and generally has servers and devices running on outdated platforms. None of that sounds very good.

Additionally, the Report observes that OLCC hasn’t developed an adequate recovery plan in the event of a system wide event. To be fair, the OLCC backs up its data, but hasn’t tested whether those backups can be used to restore systems, so there is no knowing whether the established backup protocol will even work.

All of these problems come back to the core issue we identified in the prior post: The OLCC is drastically underfunded for its mission. Fixing these problems will take expertise and resources that historically haven’t been dedicated to the agency. The agency’s response to the Report (the “Response”) highlights this issue. As with the issues with CTS and MLS, the Response acknowledges these general IT security problems, and notes that it is seeking additional funding from the legislature to address the Report’s concerns.

The shortcomings of OLCC’s overall IT security is not particularly surprising as OLCC continues to rely on legacy systems and generally has not modernized its agency-wide systems at the same pace as the rest of state government . . . The IT security auditor’s findings reflect a symptom of a general lack of management proficiency and capacity to maintain a focus on state requirements and practices. – The Response

In relation to these concerns, the OLCC has requested “$400,000 to replace unsupported servers and switches; and, position authority for a [Chief Information Officer] ($197,000).” Our contacts at the OLCC suggest that the legislature fulfilled this request, but we haven’t yet received official notice. In our view, the OLCC has done a commendable job in its regulation of Oregon’s recreational cannabis market over the past few years, but with so much happening on so many fronts, the agency could use additional resources. Fingers crossed.

Oregon Josephine County marijuana
Josephine County skipped a step.

In the past six months, we have closely followed the efforts of Josephine County, Oregon, to ban cannabis farming in its rural residential 5 (RR-5) zone (see our coverage here and here). Just last week we mentioned that a coalition of local growers (“Petitioners”) challenging the local ordinance finally had their day in court, presenting their case to Oregon’s Land Use Board of Appeals (“LUBA”). In brief, the challenged ordinance, adopted in December, banned marijuana production on RR-5 lots smaller than five acres, and seriously curtailed production on larger lots. The Petitioners challenged the ordinance on three grounds, alleging:

  1. The ordinance violated ORS 215.130(5) because it does not allow farms operating at the time the ordinance was adopted to continue operating. (ORS 215.130(5) essentially prohibits a county from adopting an ordinance that retroactively bans existing lawful uses.)
  2. The county failed to give mandatory notices to the owners of any properties that would be limited or prohibited from any previously allowed uses.
  3. Local jurisdictions are only allowed to place “reasonable regulations” on commercial cannabis production, and this ordinance did not qualify.

Yesterday, LUBA issued its opinion in favor of the Petitioners, and sent the County back to square one on the ordinance. The Petitioners deserve a hearty congratulations, but the fight is far from over. This is because LUBA kicked the case back to the County after determining that the County failed to provide the mandatory pre-hearing notices required for any proposed zoning change. As a result, LUBA did not reach the merits of whether 1) the ordinance violated ORS 215.130(5) because of its retroactive application or 2) whether the ordinance went beyond the County’s right to impose “reasonable regulations” on cannabis production. LUBA simply found that the County acted without the required public input.

By kicking the case for a procedural error, LUBA left the door open for the County to continue to pursue this or a similar ordinance. That isn’t to say that the County is going to have an easy time of it. LUBA’s Opinion requires the County to comply with the notice requirements and hold at least one more public hearing. This is no easy feat, as the County will need to issue individual written notice, by mail, to the owners of all 16,000 RR-5 lots.

Although public scrutiny will no doubt increase, we expect the County to continue to push forward in its misguided attempt to regulate away its fledging cannabis industry, as well as all the taxes and jobs that will go with it. In a County that has struggled to provide even basic services following the timber revenue dive, that seems like a shame.

Oregon marijuana josephine
Josephine County’s anti-cannabis ordinance is frozen, for now.

The last few months have been a bit of a whirlwind for cannabis producers in Josephine County, Oregon. Back in September, a coalition of producers stopped a county ordinance targeting farms in rural residential zones that would have drastically increased setback requirements, required the OLCC licensee itself to own the real property, and prohibited any farm from using private roads, easements, or owner-maintained public right-of-ways.

Celebration proved premature, as the county adopted a new ordinance on December 6, 2017 that is arguably worse. The ordinance targets all properties zoned rural residential with more than 12 mature plants and drastically curtails commercial cannabis production. For example, on rural residential lots:

  1. Cannabis production is banned on all lots or parcels of five acres or less.
  2. Cannabis production on lots larger than five acres is limited to an eighth of the size that would otherwise be allowed under OLCC rules.
  3. 100 foot setback are on all sides are required for all structures and grow canopies.
  4. The OLCC licensee must itself own the real property.

Farms hoping to avoid these requirements must have been fully licensed by the OLCC before March 6, 2018 in order to apply for a variance from these regulations.

As expected, earlier this year a group of growers filed suit against the county before Oregon’s Land Use Board of Appeals (“LUBA”). Although LUBA petitions are not easily available, LUBA issued an order on February 5, 2018 that stayed (froze) implementation of the ordinance pending further proceedings, and gives us an insight into the claims raised by the petitioners.

The petitioners were tasked with establishing 1) “a colorable claim of error in the land use decision or limited land use decision under review;” and 2) “that the petitioner[s] will suffer irreparable injury if the stay is not granted.” The petitioner met both thresholds, so let’s see how they did it.

A Colorable Claim of Error

In Thurston Hills Neigh. Assoc. v. City of Springfield, 19 Or LUBA 591 (1990), LUBA stated that the standard to establish a colorable claim of error is “not a demanding standard”. The petitioners do not need to establish they will win on the merits. Rather, they need only show “that the errors alleged are sufficient to result in reversal or remand of the decision if found to be correct.” In fact, in Thurston Hills, LUBA simply looked to whether the petitioner’s claims were “devoid of any legal merit.” In the present case, LUBA found that the petitioners claims have legal merit. Specifically, the petitioners argue:

  1. The ordinance violates ORS 215.130(5) because it does not allow farms operating at the time the ordinance was adopted to continue operating. ORS 215.130(5) essentially prohibits a county from adopting an ordinance that retroactively bans existing lawful uses.
  2. The county failed to give mandatory notices to the owners of any properties that would be limited or prohibited from any previously allowed uses.
  3. Local jurisdictions are only allowed to place “reasonable regulations” on commercial cannabis production, and this ordinance does not qualify. Note that this same argument was advanced against a similar ordinance in Jackson County but that LUBA and the Oregon Court of Appeals determined that Jackson County’s ordinance qualified as a reasonable regulation.

Irreparable Injury

Because the “irreparable injury” requires an injury that cannot be compensated adequately in money damages, the petitioners focused primarily on the existing strains and customer goodwill that would disappear if the county succeeds in banning their farms. LUBA easily sided with petitioners on this point, but the question got a bit trickier because the petitioners needed to also show that the county’s conduct was “probable rather than merely threatened or feared” and that “the resulting injury must be probable rather than merely threatened or feared.”

The county argued that these negative effects on petitioners were overblown because the ordinance provided an opportunity for non-compliant properties to obtain a non-conforming use application. The petitioners cleverly noted that the OLCC will likely refuse any license renewals while a licensee is undertaking the non-conforming use process, so even participating in the process itself puts the farms at risk. The court was convinced and issued a stay.

Next Steps and Predictions

The petitioners and the county will advance their arguments at a hearing today, so we will soon find out whether this ordinance qualifies as a “reasonable regulation.” Similar arguments against Jackson County were shot down, but perhaps these petitioners have identified some nuances that will win the day. In this case, with the retroactivity and notice problems identified by the petitioner we feel comfortable putting our money on the growers.

Cannabis lawyers on social media
Please check out our cannabis posts!

Our cannabis business lawyers are always getting emails from blog readers asking them where they can be found on social media. This post is our response to all those emails and to let everyone else know that if you cannot get enough of Canna Law Blog, you can find more of us in the following places:

Facebook. We have an exceedingly popular and perpetually growing Facebook page here with more than 180,000 likes/followers. We use that site to disseminate information and to initiate discussion on a wide range of uber-topical cannabis issues. That site is meant to be a less serious than this one and the range of cannabis topics we address there is considerably wider than here. We allow for a wide range of views on our Facebook page and we delete only those comments hateful of others or that involve anyone trying to sell anything.

Twitter/Publications.  Our blog and a number of our cannabis lawyers have the following twitter accounts, with posting frequencies all over the map:

  1. @cannalawblog We use this account to tweet 2-4 times a day, mostly on important cannabis issues of general interest. This is a go-to account for current events.
  2. @cannabizlawyer. This is Hilary Bricken’s account. Hilary tweets pretty regularly and as head of our Los Angeles cannabis practice, many of her tweets have a California/Los Angeles flavor. Hilary also authors a once-a-week column for Above the Law on all things cannabis law and policy across the United States. Hilary also writes the occasional piece for Culture Magazine, too.
  3. @vince-sliwoski. This is Vince Sliwoski’s account. Vince heads up our Portland cannabis business practice and he tweets regularly on general interest and Oregon cannabis issues. Vince also writes a bi-weekly column for the Portland Mercury called Ask a Pot Lawyer, which is syndicated in the Seattle Stranger.
  4. @alison-malsbury. This is Alison Malsbury’s account. Alison focuses on cannabis intellectual property law and she splits her time between our Seattle and our San Francisco offices (with a bit of Los Angeles also). Her tweets reflect this, as they usually are on California or Washington or IP issues.
  5. @dshortt90. This is Daniel Shortt’s account. Daniel is based in Seattle and he tweets regularly about general interest and Washington State cannabis issues. Daniel Shortt also frequently contributes to The Fresh Toast, writing about cannabis legal issues.
  6. @jghunthb. This is Jim Hunt’s account. Jim focuses on federal and state taxation as they relate to cannabis businesses and his posts often relate to cannabis taxation issues.
  7. @Hbentaleb09. This is Habib Bentalab’s account. Habib is a business and regulatory attorney in our San Francisco’s office. Habib is one of the most up to date people on the constantly evolving city and local laws throughout California.

The rest of our cannabis lawyers either do not post on cannabis for social media, or post so seldom as to not be worthy of mention above, at least not yet.

Please follow us and enjoy!


marijuana prohibition
“Cannabis will eventually be legalized nationwide, but it is a lot more likely to occur in voting booths than in a court.” – Canna Law Blog, Jul 26, 2017

We’ve written extensively on a federal lawsuit filed by five plaintiffs against Attorney General Jeff Sessions challenging the constitutionality of the federal government’s continued classification of cannabis as a Schedule 1 drug under the Controlled Substances Act (CSA) (here, here, and here). While we were cautiously hopeful, the Judge dashed those hopes yesterday when he granted the government’s motion to dismiss the case, styled as Marvin Washington et. al. v. Jefferson Beauregard Sessions, III, et al.

In a nutshell, the plaintiffs sought a ruling that the continued classification of cannabis has no rational basis because cannabis clearly has a medical use. (Recall that the standard for Schedule I includes “no currently accepted medical use in treatment”). Although this is certainly true, it was not enough to win the day due to a few insurmountable and incredibly frustrating procedural hurdles.

Exhaustion of Administrative Remedies

Generally, parties must exhaust available administrative remedies before they can seek relief in federal court. The Judge found that these plaintiffs failed to exhaust an available remedy under the CSA: Interested parties can petition the DEA to reclassify drugs after an on the record hearing. 21 USC Section 811(a). If the parties receive an adverse ruling, they can seek judicial review of the DEA’s determination in an appropriate state circuit court.

Because the plaintiffs failed to follow this administrative procedure, the Court determined that dismissal was warranted.

Precedent Requires Dismissal

Although the case was dismissed for failure to exhaust, the Judge’s order states that “[e]ven if the Court were to reach the merits of plaintiffs’ rational basis claim, I would be bound by precedent to reject it.” The Judge then notes that the Second Circuit has upheld the constitutionality of the CSA, which is binding on the Judge, as has every other court that has reviewed it.

The Judge states that “[e]ven without the benefit of precedent, it is clear that Congress has a rational basis for classifying marijuana in Schedule I, and executive officers in different administrations have consistently retained its placement there.” In other words, because of potential harm caused by cannabis consumption, it can’t be said that Congress’ initial decision to classify cannabis as Schedule I was irrational at the time.

Classification Cannot be Unconstitutional if there Remains an Administrative Option to Modify Classification

Tying back to the exhaustion of remedies issue, the Court further explains that “any constitutional rigidity is overcome by granting the Attorney General, through a designated agent [the DEA], the authority to reclassify a drug according to evidence before it and based on the [Schedule I criteria]. There can be no complaint of constitutional error when such a process is designed to provide a safety valve of this kind.”

It must be incredibly frustrating for these plaintiffs, as the Judge at the hearing and in the order to dismiss recognized that cannabis has an accepted medical use. How then, can it remain as a Schedule I drug which requires a “high potential for abuse, no currently accepted medical use in treatment, and a lack of accepted safety for use of the drug under medical supervision”? Unfortunately, this Judge believes his hands are tied.

The Equal Protection Claim Based on Racial Animus was Also Dismissed

In connection with this lawsuit, the Cannabis Cultural Association (CCA), brought claims on behalf of its members that the scheduling of cannabis violates the Equal Protection Clause because it was passed with racial animus. The Judge also dismissed this claim on procedural grounds, holding that the CCA and its members did not have standing to bring this claim because a favorable decision was unlikely to redress the CCA members’ injuries, which were based on the negative effects of previous cannabis convictions. These plaintiffs failed to establish that a favorable decision would undo their prior convictions.

In looking at the merits, the Judge also found insufficient evidence that Congress originally included cannabis as a Schedule I drug because of racial animus. Although the plaintiffs pointed to numerous statements made by the Nixon administration to that effect (see here for a particularly egregious example), the Judge said that these statements would not support a finding that Congress acted with discriminatory intent.

As we said when this case was filed, “though it will be interesting to watch this lawsuit proceed, it seems unlikely it will be the vehicle that finally ends federal prohibition. Cannabis will eventually be legalized nationwide (we see that happening within five years), but it is a lot more likely to occur in voting booths than in a court.” So get out there, vote, and hold your representatives accountable. Congress has to act.

Oregon marijuana cannabis
OLCC audit results were nothing to write home about.

Earlier this month, the Oregon Secretary of State’s office released a formal audit report (“Report”) of the Oregon Liquor Control Commission’s (OLCC) information technology systems as they relate to Oregon’s recreational cannabis regulatory enforcement. The Report, titled “Oregon Liquor Control Commission: Cannabis Information Systems Properly Functioning but Monitoring and Security Enhancements are Needed“, focused on two separate but related issues: 1) the OLCC’s Marijuana Licensing System (MLS) and Cannabis Tracking System (CTS), and 2) general IT security concerns and disaster recovery procedures. The Report and the OLCC’s formal written response (“Response”) paint a picture of an underfunded agency doing its best to establish appropriate procedures and processes in the face of a unique emerging marketplace, unexpected demand for licenses, strict statutory deadlines, an an ever-changing regulatory framework. It is also apparent that the Secretary of State and the OLCC worked well together during the audit process, as each party complements the other on transparency, professionalism, and common courtesy.

The audit was initiated to determine whether:

  • the OLCC has sufficient technical controls in place to ensure that the MLS and CTS are supporting effective regulation of the recreational cannabis industry; and
  • the OLCC has implemented sufficient security procedures to protect against known technical and physical threats.

Today we will focus only on issues raised relating to the MLS and CTS.

Marijuana Licensing System (MLS) and Cannabis Tracking System (CTS)

The Report and the Response provide an interesting look at how these two independent but related systems came to exist. When Oregon passed Measure 91 and then HB 3400 (2015), the OLCC was charged with creating and enforcing a regulatory framework for an entirely new industry with tight deadlines and insufficient resources. The OLCC reasonably decided that the only practical solution was to hire third-party contractors to provide Software as a Service (SaaS) solutions. The OLCC hired the company that created Colorado’s seed-to-sale tracking system to customize Colorado’s system to serve Oregon’s needs, resulting in the CTS, an online portal that allows OLCC licensees to input data about harvests, sales, etc. The OLCC hired a separate company to create its license application and renewal software, the MLS.

After hiring these vendors, OLCC was forced to repeatedly overhaul these systems in response to extensive legislative rewrites to the recreational program in 2015, 2016, and 2017. In recognition of these difficulties, the OLCC requested funding for a full time Chief Information Officer in the 2017 legislative session, but was denied. The Report and the Response both highlight the importance of filling this position, and the OLCC will be asking for additional funding from the legislature again this session.

In a nutshell, the CTS is Oregon’s licensee portal where licensees are required to self-report information about inventory, transfers and sales. The MLS is the OLCC’s online system for tracking license applications and licensee status.

We identified several weaknesses associated with OLCC’s new IT systems used for marijuana licensing and tracking. They include data integrity and maturity issues, and insufficient processes for managing marijuana computer programs and vendors. Until these issues are resolved, the agency may not be able to detect noncompliance or illegal activity occurring in the recreational marijuana program. – The Report

The Report identifies five general weaknesses in the CTS and related enforcement:

  1. the CTS relies on self-reported data that is inherently susceptible to inaccuracies;
  2. the CTS allows users to enter measurements in either metric or imperial resulting in additional errors;
  3. existing licensees are potentially abusing a policy that allows new licensees to introduce cannabis into the recreational regime from any source;
  4. inadequate data quality hampers the OLCC’s ability to monitor the Oregon market as a whole;
  5. the OLCC lacks sufficient trained staff for regular on-site inspections.

Even with the additional staff, OLCC may not be able to ensure an appropriate amount of scrutiny for marijuana businesses. Both Alaska and Nevada have approximately one inspector for every 18 recreational marijuana licenses. Currently, Oregon only has one inspector position for every 83 recreational marijuana licenses. – The Report

The Report also notes that the OLCC doesn’t take sufficient steps to monitor their third-party SaaS providers, has inadvertently stored test data in the active MLS database, and has insufficient controls over user accounts. Finally, the Report notes that the MLS and CTS are not set up to automatically update each other. For example, a licensee with revoked status in MLS could still have active status in CTS.

In its Response, the OLCC generally agrees with all of the Report’s findings and states that, subject to obtaining additional funding from the legislature, it will work diligently to implement the Report’s recommendations. The OLCC refers to the MLS and CTS as “state-of-the-art imperfection” and notes that while issues exist, the CTS system has already identified thousands of discrepancies that have led to investigative and enforcement actions, and that even bad data is meaningful.

Citizens and policy makers need to know that as important as the issues identified in this audit are, the OLCC is not dependent on the CTS system alone to identify licensees that are attempting to use the state system as a cover for diversion. The CTS system is one fundamental tool for successful enforcement and compliance . . . the audit recommendations focus on improving the overall effectiveness of the system which the audit acknowledges is properly functioning. – The Response

The take away here is that the CTS system is not broken. It is currently helping to limit diversion and promote public safety, but like any system, it can and should be improved. On the whole, the public and licensees should expect that the OLCC will be implementing regular, random on-site inspections to support the CTS, and refining the CTS system to eliminate opportunities for confusion or deliberate deception. Hopefully the legislature will recognize the importance of a robust and technically effective OLCC to the industry as a whole, and will provide the OLCC with sufficient funding to retrofit its systems and hire a Chief Information Officer.