In this issue, several articles discuss the importance of the cannabis community uniting to accomplish industry-wide goals, gain legitimacy and improve communities. (See Debby Talks and this month's cover story). With that in mind, I invite you to mark your calendars for April 1-3, 2019, for the third annual Cannabis Conference, which is produced by the Cannabis Dispensary and Cannabis Business Times (CBT) staffs and a conference advisory board made up of leading cannabis retail and cultivation experts. This year’s conference will be hosted in Las Vegas and will bring together the industry’s retail and cultivation factions to discuss and advance this ever-changing industry.

At Cannabis Conference 2019, you will have the opportunity to learn from and talk with other leading dispensary owners and management, legal and regulatory experts, technology and solutions providers (in an expo hall that has tripled in size since the show’s launch in 2017), investors and cultivators. Together we will address the most pressing issues facing your businesses and help you navigate this wonderful, but challenging industry.

How We Got Here

To understand how this event evolved, it may help to know where we’ve come from. Four years ago, I co-launched CBT as a website and newsletter. The years that have followed truly have made my head spin as we have experienced exponential growth.

• CBT was acquired by GIE Media, Inc. in 2015, and we started publishing a bimonthly (2016), then monthly (starting in 2017), print magazine geared specifically toward cultivation.
• In 2017, we launched the Cannabis Cultivation Conference (now known as the Cannabis Conference) to provide a forum for face-to-face education and networking among cultivation professionals.
• In the fall of 2017, we launched Cannabis Dispensary as a bimonthly print magazine focused on dispensary operations, along with a website, social media channels and e-newsletter.
  

What’s to Come

Now, we are excited to bring together both our audiences under one roof for Cannabis Conference 2019. In addition to our cultivation education sessions, we are including extensive dispensary education tracks, as well as featuring suppliers and technology companies that provide services and solutions specifically focused on dispensaries.

These audiences—the cultivators and you, the medical and adult-use dispensaries—are the heart and soul of this industry. You create the products and bring them to market. To best serve you, we have developed a conference worthy of your time and respectful of your expertise.

This industry is not easy, but I have experienced firsthand the impact in-person events can have on businesses. You will leave with ideas, solutions to problems, a new burst of motivation, and new contacts and friends.

We are excited to open this event to you and your dispensary teams, and look forward to seeing you in Vegas! Remember: What happens in Vegas betters your business!

Noelle Skodzinski, Editorial Director | nskodzinski@gie.net

Throughout the United States, states that have legalized cannabis mandate an arsenal of alarms, surveillance cameras and security guards to protect against product diversion and armed robbery. Indeed, all of them are necessary to protect customers, dispensary staff and the general community. But as retail owners have started to realize, digitized data also holds a deep allure for a different sort of criminal.

Over the past decade, retailers such as The Home Depot, Target and Sears have fallen prey to cyberattacks that have exposed consumer information and cost a fortune in remediation. It is often said in cybersecurity that there are two types of businesses: those that have been hacked and those that will be. As the industry matures and more thoroughly embraces the internet, cloud-based software solutions and credit payments, exposure to these hacks will certainly increase.

Despite the trend toward digital data banks, few state regulations address data security for medical cannabis and almost none do for adult-use. This disregard takes place amidst a backdrop of near-constant data breaches from enterprise institutions and corporations such as Equifax, the Securities and Exchange Commission (SEC), Boeing, Sonic and the cities of Atlanta and Baltimore, just to name a few.

Cannabis businesses might think they are immune to such attacks due to their relatively modest stature. At least 1,000 retail dispensaries learned otherwise in January 2017 when a hack of cannabis compliance software company MJ Freeway’s main databases and backups momentarily paralyzed their businesses. In a 2016 poll, cybersecurity firm Symantec found that 43 percent of all cyberattacks targeted businesses with 250 employees or less. In 2015, an SEC hearing revealed that 50 percent of these small businesses went out of business within the first six months after being attacked.

The overall lack of urgency in the face of these threats, at least in comparison to other threats, is not encouraging. When theft takes the form of armed robbery, the industry marshals its lobbyists and pushes for legislation. When it’s a data breach, most people don’t know how to approach addressing the problem.

It doesn’t have to be this way. Cannabis retailers can take some important steps on their own to prevent the most obvious attacks from derailing their businesses. Believe it or not, if Equifax, Anthem and several other powerful corporations had followed these steps, millions of records might still be held secure. Let that serve as motivation.

Knowing How to Keep a Secret

Strategies for data security change depending on whether your business hosts its IT on-site or in the cloud. Many breaches, however, start with a phishing email—a fraudulent email containing either a malware attachment, often in the form of an “urgent” document, or links to compromised websites. For instance, recently the Washington State Liquor and Cannabis Board announced a phishing scam alert in the form of a fallacious “MJ Freeway Data Request”—the first, we are certain, of many to follow.

From there, businesses may find themselves infected by ransomware, such as the infamous WannaCry or NotPetya programs, that encrypts every hard drive on a business’s network and demands a ransom, usually payable in Bitcoin, for the decryption key (a key which, incidentally, doesn’t always work). But businesses can also fall prey to any assortment of worms, trojans or viruses that can cripple systems as it steals data, crashes servers or robs CPUs of resources to mine for Bitcoin.

Again, no one must “settle” for any of this, especially in a hyper-competitive environment where no business can afford to slow down for a second. Familiarizing oneself with (and implementing) the following countermeasures can help prevent the worst, while paying for themselves in the long run.

1. Two-Factor Authentication/Single Sign-On

Two-factor authentication, or 2FA as it’s occasionally referred to, requires another form of data, usually a texted code, aside from one’s password to sign in. Single sign-on (SSO) allows for one single set of user credentials to be used across all applications a user may have on the network. 2FA creates an added layer of security that prevents a hacked password alone from gaining access. SSO provides convenience for any IT department to revoke access for a former/disgruntled employee—often a prime vector for cyberattacks.

2. Centralized Policy Management

Not everybody at your business needs to have access to all your prized documents. By developing centralized policy management, you assign levels of access to specific network users, thereby limiting it for potential intruders.

3. End-To-End Encryption

Employees take big risks with your information when they transmit it across the internet or through insecure networks. Using end-to-end encryption (E2EE) alongside a virtual private network (VPN) ensures that the information will be shielded in transit and readable only by the intended recipient.

4. Network Segmentation

Any portion of your network containing sensitive data (patient history, credit card information, etc.) should be housed on a network completely segmented from online ordering web portals, mobile apps, a Guest WiFi, etc. A good firewall is critical to these efforts. This data should also be encrypted when it is stored in digital form and not in transit (being sent across the internet).

5. Whitelists of Approved Cloud Apps

The proliferation of “shadow IT”—third-party cloud services that have not been vetted by a company’s IT department—has multiplied the amount of potential entranceways into a company’s data. As some hapless users have regretfully discovered, not every app listed on Android as “WhatsApp” (a secure messaging and free calling app) actually is the official application. Moreover, even services like Dropbox can get hacked. Developing whitelists that include only approved cloud apps can help you gain control over this hazardous sprawl.

6. Mobile Device Management (MDM)

Your employees aren’t just accessing your network on-premises—they’re often bringing their work with them to coffee shops, airports and residences. If those devices are lost or stolen, it represents a possible breach. MDM software can be installed on every mobile device—be it a smartphone, tablet or laptop—that your employees use to access the internet, so it can be tracked and potentially wiped should the worst-case scenario come to pass.

It is often said in cybersecurity that there are two types of businesses: those that have been hacked and those that will be.

7. Disaster Recovery

If you’re not keeping frequent and comprehensive backups of your data, you most likely will never be able to rebound from a ransomware attack. The free program RansomFree can help get you started on this undertaking.

Moving Forward

When implementing these technologies, dispensary owners should understand they are not just protecting their businesses, but building a solid foundation for future growth. Data security is just one component of a comprehensive IT infrastructure, and its overall health and ability to scale with you can either make or break your business. This will ultimately demand a managed approach to your IT that is fully integrated into your larger business model. For this, you will need either a Chief Technical Officer (CTO) who knows how to manage an IT department or a managed IT service provider who understands both your business objectives and how to design a tech backbone that corresponds with your ambitions.

However, when it comes to data security, no business can afford to wait until it starts going national. If you want to survive, you’ll need to expand your definition of security to include both your physical and digital assets, and to plan for resiliency.

Eric Schlissel is the CEO of GeekTek, a national, managed IT/cybersecurity firm headquartered in Los Angeles, Calif.

Burdensome regulations surrounding cannabis production, sale and use in various states have caused serious headaches for many cannabis entrepreneurs. The high levels of regulatory attention (from both state regulators and U.S. Drug Enforcement Administration officials) attached to the mandatory “seed-to-sale” tracking programs in states that legalized cannabis have not helped matters.

While crucial to compliance efforts, these mandatory systems significantly amplify the burden on cannabis businesses. Government regulators are watching the burgeoning commercial cannabis industry with eagle eyes. They want to know where every plant is grown, exactly when it is transported, where it is processed into extracts and edibles, and who purchases it from medical or recreational dispensaries.

Since cannabis remains a Schedule I narcotic, states continue to regulate it heavily in an effort to ensure that the federal government does not come crashing down on their programs, that products are not diverted into the black market and are kept away from children, and that prohibitionists have no window of opportunity to argue against the merits of legalized cannabis. In trying to achieve those goals, regulators sometimes miss the mark and create rules that make little sense. Look at California, where regulated retail cannabis is subject to track-and-trace laws, yet consumers can grow six plants at home without oversight and people who purchase retail cannabis can share it with others—once they exit the dispensary. It’s a conundrum: On one track, cannabis is treated like a dangerous controlled substance, with mandatory track and trace. On the other, people can grow it at home with relative freedom.

What’s Out There

Track-and-trace regulations are usually excessive and complicated to follow, in part due to the lack of well-functioning tracking systems. The state-regulated adult-use cannabis industry is barely five years old, and companies providing track-and-trace software for the industry are struggling to keep up with demand. A few companies are taking the lead at the retail level, providing increasingly productive point-of-sale (POS) systems for dispensaries. But each system comes with positives and negatives, as these systems are like toddlers still learning to walk in an industry that is already sprinting.

Treez, for example, partnered with a well-known California dispensary, Garden of Eden, to design software to suit the needs of its retail clients while meeting California’s track-and-trace program requirements. (Full disclosure: the two California dispensaries I operate, Magnolia Wellness and Hi Fidelity, both use Treez.)

Another example is Meadow’s POS system, which is built on the strengths of its CEO, David Hua. Hua was instrumental in bringing famed Silicon Valley incubator/seed accelerator Y Combinator into cannabis—Meadow was Y Combinator’s first cannabis-based startup.

Neither Meadow nor Treez are equipped to track the entire supply chain, though. Frankly, seed-to-sale tracking for cultivation, manufacturing and distribution is still in its infant stages. Some early systems seeing success include Trellis, funded by Snoop Dogg’s Casa Verde Capital, and Kudu Exchange, a new system taking a chunk of the California market. Several of the POS systems do incorporate some form of additional tracking, but the cannabis industry still has to patch together compliance, using separate tracking systems to meet the regulatory needs.

Cons of Current Tracking Systems

Then there’s Metrc—an actual seed-to-sale tracking system designed to feed all data into one system so states can track each seedling through its life cycle and at every step along the way until it is sold at a dispensary. Alaska, California, Colorado, Maryland, Michigan, Montana, Nevada, Ohio, Oregon and Washington, D.C., all use Metrc to track their state’s cannabis. Each individual POS or seed-to-sale tracking system used by cultivators, processors and dispensary owners in those states is required to drop data directly into Metrc. That said, California’s rollout of the Metrc system (which was scheduled for July 2018) has been delayed due to launch challenges.

Metrc uses an open application processing interface (API), which allows different software platforms to communicate in a common language. However, the system, like many comprehensive tracking systems, is complicated and requires that everyone in the supply chain use Metrc-supplied tracking labels for all plants and products as they make their way to consumers. This can create issues, as waiting to receive the proper labels can cause weeks of delays. Another problem is that existing tracking systems used by cultivators, retailers and manufacturers are not always compatible with Metrc. Simply put, the open API does not match, rendering the systems ineffective. Certainly this is not the fault of Metrc, as its competitors in the space, including BioTrackTHC and MJ Freeway, are under no obligation to assure their customer-facing POS systems match with a competitor’s.

As my buddy, a licensed cultivator near Las Vegas, told me, “I have [spent] hundreds of hours updating and creating transfers, ... adjusting entries and just fixing discrepancies.” He advises operators to designate one reliable employee to be the Metrc point person, advice that would seem to benefit operators dealing with any seed-to-sale tracking system. “You need someone to develop a relationship with a tech support person,” he says, so that you can reach someone directly in case of a problem and not have to wait for a response from customer service, which can take upwards of 72 hours.

Having recently attended California’s state-mandated Metrc training, I’m concerned about the burdens created by this new state-mandated system. This is marijuana after all, not heroin. By insisting on treating cannabis as a dangerous substance, and making states place such burdensome requirements on operators, the federal government encourages a long-lasting underground market—as many operators simply are not equipped to work with complicated compliance systems. In my opinion, states need to rethink the importance they place on seed-to-sale tracking, which only fuels the continuation of years of stigma around marijuana.

Cannabis should be regulated based on its potential to harm public health and safety, treating it similar to alcohol at worst. Alcohol is not tracked from seed to sale; why should cannabis be? While states obviously must walk a delicate line between establishing their own laws that run counter to federal law, seed-to-sale tracking alone is not the answer.

Serial entrepreneur Pete Kadens was already onto his second mega-successful business —the commercial solar energy installations company SoCore Energy—when a colleague, Ben Kovler, called him with a proposition: to launch a cannabis business in the wake of Illinois Gov. Pat Quinn’s 2013 decision to sign into law the Compassionate Use of Medical Cannabis Pilot Program Act, which would allow medical marijuana in the state.

Kadens, though he’d recently sold SoCore to Edison International and signed a contract to stay on as an executive, jumped at the chance. As he describes, it was a question of morality, not opportunity.

“The reason I was interested is—truth be told—not because I have an intimate connection to the plant, but because … I have an anthropological fascination with poverty,” Kadens says. “What I have learned is that of all the permutations of poverty, the vast majority of the people—with whom I have interfaced—have gotten there because of some non-violent drug crime.” He wanted to change that.

“With so many communities crushed by the war on drugs, we believe that we have a moral imperative to not only help rebuild these communities, but also to help the individuals who have suffered rebuild their lives through gainful employment opportunities,” Kadens explains.

“When I have the opportunity to invest my own money in this mission, I’m like, ‘I’m in,’” he says.

“But when we wrote that first six-figure check, I told my wife, ‘You might as well burn this money because we will never see it again.’” Kadens wasn’t sure they’d win a license, let alone build a successful brand. “And she said, ‘Then why are we doing this?’ And I said, ‘Because this is the right thing to do,’” regardless of whether they’d win a license.

Not only did Kadens and Kovler snag a license and launch Green Thumb Industries (GTI), they have since successfully opened 13 dispensaries in five states, most under the name RISE, with another seven expected to open by December. The company has also secured 25 additional licenses across the country, and those dispensaries are slated to open in 2019.

The 13 existing dispensaries opened as medical facilities, though many are incorporating recreational as state laws shift. For example, its two Nevada dispensaries (Carson City and Spanish Springs) converted to include adult-use in January, following Nevada’s decision to legalize recreational marijuana beginning July 2017. This July, Massachusetts dispensaries will be able to legally sell recreational cannabis, and RISE’s Amherst store is prepared.

GTI also has dispensaries in Maryland and Pennsylvania and is looking to expand into Florida. It recently won five licenses in Ohio, too. “We are very pleased with the outcome of the Ohio dispensary awards,” Kadens says. “The fact that we won the max number of licenses—five—is a testament to the exemplary track record we have of serving patients and communities around the country.”

Through all that, GTI’s home base remains Illinois. It is headquartered there, and it’s where the company launched its first dispensary in 2015. At that time, Kadens’ contract with Edison International was ending, and it was the perfect time, he says, to make cannabis his priority. To that end, he initiated a conversation with Kovler about expanding the brand nationally.

“I said, ‘What about taking this concept and scaling it?’” Kadens recalls. He made the full-time leap to cannabis when his partner challenged him to take up the task himself. “At that time, we had two grows and one dispensary, and probably 30 employees,” he says. “We’ve grown by dramatic proportions since then.”

Today, GTI has seven vertically integrated production facilities with a total of roughly 400,000 square feet of cultivation canopy, and employs 400 people. “It’s a big operation, with a lot of real estate and a lot of capacity in terms of what can be produced,” Kadens says. “One of the key areas of focus for me and our executive team is continuous improvement every single day. The goal was always to produce consistent and trustworthy product—you just never want to have a letdown, or hear that a consumer has had a bad experience with your flowers or edibles.”

“We integrate the community into our name because our goal is to have a very close connection with our community. We want our facilities to be a gathering place—like home—for the members of that community.” Pete Kadens, director/CEO, Green Thumb Industries

The dispensaries have a strong focus on community and customer service, too. Most dispensaries under the GTI umbrella are called RISE, with a nod to the store’s location tagged on at the end. There is RISE Erie, RISE Bethesda, and so on. “We integrate the community into our name because our goal is to have a very close connection with our community,” Kadens says. “We want our facilities to be a gathering place—like home—for the members of that community.”

Each RISE is fitted with vibrant lighting and the company’s bright color scheme. “The [employees] are cordial and nice, and it feels like a very collegial atmosphere,” Kadens describes. “I hate to use a cliché, but it’s kind of like ‘Cheers,’ where everybody knows your name.”

Like ‘Cheers,’ RISE dispensaries are meant to be friendly. “Dispensaries around the country are a lot to take in,” Kadens says. “There are a lot of undereducated consumers out there, and the menus are massive. ... The care specialists don’t spend a lot of time with consumers because there are a lot of transactions to be done.” That said, he adds, “we like to do things a little bit differently. We like the time to be well spent and feel like a connection is developing … between the consumer and the care specialist. We like people to feel at home and very welcome.”

RISE’s medical dispensary origins come in handy at its now-recreational stores. Designed to help medical patients, the adult-use dispensaries still have cubicles where customers can enjoy privacy while they speak to the store’s care specialists. “We still find that the most important relationship is … between the care specialist and the consumer, and whether that’s a patient who’s under the medical platform or an adult-access consumer, it’s still very important to us,” Kadens says.

Even those without diagnosed medical issues and medical cards “want to have that … connection with the care specialist,” Kadens continues. “The interaction is one-on-one and it’s confidential. We do not want to be a crazy transactional place—we don’t want our dispensaries to look like a McDonald’s line. That doesn’t feel very community-like.”

A Worthy Cause

For Kadens, philanthropy is a primary concern. That’s why GTI is committed to helping non-violent drug offenders clear their records, as well as earn the ability to have gainful employment, including at RISE dispensaries. (In many states, people with drug records cannot work in cultivation facilities or dispensaries, so GTI is unable to hire them unless their records are first cleared.)

This commitment echoes Kadens’ belief that many people are impoverished because of minor, non-violent drug offenses, and that by changing that cycle, poverty could be greatly reduced.

GTI also recently held a job fair in Massachusetts, welcoming more than 400 people and 50 potential employers. Attorneys were also on site to help previous drug offenders clear their criminal histories. “That is how change starts,” Kadens says. “And then one day we can eventually hire them.”

Keeping It Straight

If maintaining dispensaries in several states sounds as if it might be confusing, it is. “Every market is so idiosyncratic—they’re all unique, provincial fiefdoms,” Kadens describes. In Maryland, for example, you can’t sell edibles—and in Pennsylvania, flower sales were initially prohibited and only begin this summer.

“In Massachusetts, there is no home delivery, but in Nevada there is,” Kadens says. “In Pennsylvania, we have to keep years of surveillance data ..., but in Nevada it’s 90 days. And in Pennsylvania, if you have anything more than a summary offense, we can’t hire you—in Maryland, it has to be a felony [to make a person un-hirable]. So every state has its own thing that we have to be clearly aware of, and it is tough to manage. And that is just one thing that makes this business so complex: It’s very tough to scale it [across the country].”

Branding is also difficult to keep straight, Kadens says. For example, RISE has its own packaging, but that packaging might need to include a tamper-proof sticker in one state, but not in another. GTI and RISE work with an external branding team that “understands our brand standards and how to apply them across the markets,” Kadens says. “These people work within the regulatory framework and make sure that our brand is as consistent as possible, working to maintain the color scheme, the look, the feel and the energy.”

The A-Team

Kadens credits his staff with the company’s interstate success. “I would never be so brazen as to say we’re the best operator or the best grower. But I’ll tell you this: I’d put our hiring system and protocols up against any other company in the country. We take it so seriously and we’re so thoughtful about every person we hire.”

In fact, Kadens personally approves every company hire. “We have a process called ‘The Gauntlet,’ and I am the final approver on The Gauntlet,” he says, “and it’s in place to ensure that every single person on the payroll—down to someone who is a $13-an-hour trimmer at one of our production facilities—meets all of our eight cultural standards.”

Kadens says those standards are the “secret sauce” to GTI’s success, so he would only divulge a few of them. The first standard he sets for potential employees, Kadens says, is the use of good judgment. “We want people who have shown time and time again that they use good judgment,” he describes. Another standard is, as Kadens says, “embracing your inner weirdo. We want people to be themselves. We want people to be authentic. We don’t want phonies and disingenuous people. We want to really know people so we know how to manage them.” That plays into the last standard Kadens was willing to share: Employees at GTI must use “excessive honesty” at all times at work.

“All it takes is one person—I don’t care if they’re an intern or an hourly laborer or a senior executive … to screw up an entire company,” Kadens explains.

Staying Social

Another way GTI and RISE stay connected to the community is through social media platforms such as Twitter and Instagram, and sites such as Leafly and Weedmaps. And GTI is adding team members to specifically handle social media.

“We do want to be responsive to consumers’ concerns and questions, so we have people … on our outlets in charge of responding in real time,” Kadens explains. For him, that means within two hours—never more.

Social media is “a great way to access the community and really engage people and create some noise and show people what our culture is like,” adds Matt Yee, GTI’s market president for Massachusetts. “We get feedback and get people excited on social media. And overall, when everyone has a smartphone in their pocket, it’s an incredible resource for us.”

GTI and RISE also make an effort to provide as much information on their websites and social media platforms as possible, from sharing industry news to educational materials. “People are insatiably curious and under-educated,” Kadens explains. “Consumers trust people who provide them with education.” In that sense, then, by providing guides and news online, GTI and RISE are bettering its relationships with customers, too.

“This isn’t like a widget—you’re putting this in your body,” Kadens explains. “This is something that is going to … affect my central nervous system and my brain. I want to understand how it works,” Kadens says. “So we want to use every single format possible to educate our under-educated consumers.” Kadens adds, “... The more we educate them, the more we build that bond of trust between us and our consumers.”

Jillian Kramer is a New York City-based freelance journalist.