Proponents of cannabis legalization sold voters on a closely scrutinized and tightly regulated market. Monitoring every cannabis plant from seed to sale would enable regulators to prevent out-of-state diversion, safeguard product safety and ensure collection of the lucrative taxes legal cannabis promised. Beneath the unblinking gaze of the state, black markets would wither and a fully transparent new industry would step into the light. Outsourced software would provide this compliance panopticon known as “track-and-trace.” Skeptical citizens and querulous prosecutors alike could rest assured.
Predictably, attempts to deliver this brave new world have instead created a chimera of regulation, big data and state-sanctioned monopolies. The result has been increased burdens on cannabis businesses, intolerable risk to consumers and harm to competition.
As states opened the bidding, big technology companies shied away. Instead, three smaller providers filled the vacuum and now dominate the track-and-trace niche. Two Florida companies, Franwell (developer of the Metrc system) and BioTrackTHC, now account for 22 of the 25 state contracts awarded.
Track-and-trace contracts are (of course) lucrative and multi-year. Use of the systems is mandatory for all cannabis market participants and means capturing and reporting line item detail on every cannabis transaction into one central database. Noncompliance means hefty fines and exclusion from the market.
The transactional burden alone is overwhelming for businesses already struggling with new compliance rules. Take, for example, California’s stutter-step implementation of state licensing and track-and-trace. Permanent license holders (of which there are yet few) must enter all transactions into Metrc. Temporary license holders need not. The result has been data entry bottlenecks as downstream permanent licensees spend hours manually backfilling upstream blanks — sometimes by simply making up transactions, simultaneously satisfying the Metrc system’s demands and defeating its purpose. In some cases, permanent licensees have refused to deal with temporary licenses holders.
Additionally, cybersecurity threats loom large and menacing, as they do over all modern business. Yet in the cannabis industry, states’ insatiable appetite for collecting all available data in third-party systems poses additional risks. The value of the product and the cash moving throughout the cannabis supply chain make related data especially valuable to criminals. That track-and-trace is mandatory for the industry to function makes the systems especially attractive targets for hackers’ ransomware or denial-of-service attacks.
In 2017 and 2018, a series of high-profile breaches of the MJ Freeway track-and-trace system highlighted the danger. Separate cyber-attacks crippled Washington’s and Pennsylvania’s entire supply chains; a third attack stole personal information of thousands of Nevada medical cannabis patients. And in 2018, an audit in Oregon concluded that its cannabis regulators failed to perform adequate due diligence of Franwell’s security measures before awarding it the state’s track-and-trace contract.
Moreover, the weak oversight evidenced by system vulnerabilities increases the likelihood of federal intervention in states incapable of preventing illicit market diversion as promised. And a zealous prosecutor is only a subpoena away from terabytes of evidence of millions of drug deals — a fact that is also increasingly realized by local authorities keen to collect unpaid taxes and fees promised them under legalization. The requirement on businesses to gather and maintain all of this information makes them targets too, necessitating additional insurance, IT and legal costs.
The track-and-trace incumbents, insulated by cushy state contracts and the difficulties replacing them would pose, face little market pressure to improve. They are, after all, the only game in town. So entrenchment deepens and the market power that comes with a state-sanctioned monopoly can next be used to grow stronger in other markets. For example, in addition to Metrc, Franwell alone sells the physical RFID tags that must accompany every physical shipment entered into its system. BioTrackTHC, in addition to its track-and-trace system, competes in the open market for point-of-sale software used in dispensaries while also controlling the technology required to integrate the two.
“Tying” is the term used in unfair competition law when a company leverages its dominance in one market to force consumers to buy its products in another market where it would otherwise have to compete. “Ties” can be accomplished through pricing, restrictive contracts with customers or by erecting barriers to entry for competitors. This restricts competition and consumer choice and enables the domineering firm to make unfair profits.
Lawsuits challenging such conduct are possible, but difficult to win (shoes have always been sold with their laces). Nevertheless, recent, more sophisticated theories around software, particularly given the dominance of a few tech giants in the modern economy, are gaining traction and may provide a legal slingshot to the small and innovative.
Most commentators have counseled patience while states roll out new track-and-trace systems and iron out the bugs. But there is little reason to think cannabis regulators will deliver different results from what we’ve seen in other well-intentioned, public-private technology deals: higher costs, more risks and less competition.
Anthony Phillips is a San Francisco-based attorney with the law firm of Gordon & Rees. He has advised California cannabis businesses since 2016. He can be reached by email at aphillips@grsm.com. Gordon & Rees has more than 900 lawyers in offices in all 50 states.