Thursday, December 29, 2016

Cyber-Attack on Nevada’s MMJ Program Registry


Nevada’s medical marijuana application system leaked the personal information of nearly 12,000 registry applicants. The state shut down the medical marijuana portal on Dec. 8 after a “problem” was identified and opened an investigation into the issue, a state spokeswoman said last week.
Those vulnerabilities were corrected and the division was “given the go ahead” to restore the online portal on December 15th 2016.
Then after becoming aware of the most recent data breach, the state has just closed the medical cannabis establishment portal for the second time this month. The portal houses those documents, as well as medical cannabis cardholder information. Nevada’s medical cannabis program uses BioTrackTHC seed to sale software system.

“The entire portal has been taken down,” Division of Public and Behavioral Health Administrator Cody Phinney said in a news release Wednesday afternoon.

A spokesperson for the Nevada Dept. Health and Human Services, which runs the medical marijuana application program, told technology news site ZDNet that the website was pulled offline to limit the vulnerability. Each eight-page application calls for the person’s social security number, driver's license number and full address in addition to details like height, weight and eye color, ZDNet reported.

A glitch in the state’s medical cannabis program portal on Nevada’s government website made all information on the thousands of applications accessible to the entire internet. Security researcher Justin Shafer first discovered the site’s vulnerability — which allows anyone with either a legitimate application or the correct web address access to the revealing PDFs — after a simple Google search.

The spokesperson for the Nevada Dept. Health and Human Services  added that the leaked data was a "portion" of one of several databases.

The state’s medical cannabis program website portal reports the following:

ONLINE PATIENT REGISTRY TEMPORARILY DOWNOur apologies, the online patient registry is temporarily down.  It will be restored as soon as possible.  While the online patient registry is down, renewal applications can be requested by the means listed below: 1.       Email a request to:  mmregistry@health.nv.gov2.       Fax a request to: 775-684-32133.       Mail a request to: 4150 Technology Way, suite 101, Carson City, NV 89706

Nevada legalized medical cannabis in 2000 with uses limited to cancer patients and those with HIV and AIDS as well as other chronic conditions. In the most recent election, the Silver State joined California, Massachusetts and Maine in legalizing marijuana for recreational purposes.

Related Story:

Tracking BioTrackTHC.

Photo Credit: BioTrackTHC
By Jason Barker (Medical Cannabis Patient & Organizer -LECUA Patient’s Coalition Of New Mexico)
BioTrackTHC’s primary focus is a point-of-sale software system for medical and recreational cannabis. The system includes compliance with state regulations, and it says it enables streamlined grow facility location tracking, inventory tracking, patient management, point-of-sale system and account reporting.  

Established in 2010, BioTrackTHC hopes to be global leader in cannabis traceability technology. As providers of both business management and government oversight software, BioTrackTHC provides experience necessary to navigate regulations and enforce compliance across varying landscapes according to their website.

BioTrackTHC is a division of Bio-Tech Medical Software, Inc. A Florida based company founded in 2007, for development of biometric e-prescribing software system for hospitals, healthcare providers, and pharmacies to track pills like opioids. BioTrackTHC charges it’s more than 1,600 clients, with software costs from $250 to $1050 a month for use, plus a $1,500 set-up fee of its software depending on the size of the cultivation facility and dispensary. Data entry requirements are intense enough that BioTrack recommends every business hires another full-time employee to keep up.

With offices now in Denver, Colorado, and Washington state whose team members boast over 50 combined years in the medical industry. “This vast level of knowledge offers us a significant edge in the cannabis market. We have been developing software to advance industries and patient rights for nearly a decade and now we are ready to bring that same level of understanding and determination to the cannabis industry.” -Steven Siegal, CEO. Now, operating in over 20 different states and in 4 countries.

BioTrackTHC has recently been under fire from cannabis growers and dispensary owners in several states. Those who pay thousands of dollars a year for the software service, still say it could be significantly improved.

Tai Saito, the compliance and warehouse manager for Buddy Boy Farms in eastern Washington state, said a major problem for his company – which pays roughly $430 a month to BioTrackTHC for its commercial version – is that it doesn’t automatically sync with the free platform. That means an employee has to manually synchronize the two systems on a weekly basis to ensure that the inventory the farm is entering is also updated in the state system. That was a glitch he didn’t realize until a state inspector asked about it, “We could have been written a violation due to some technical issue in BioTrack that we had no idea about,” he said in a March 2016 interview with MJBizDaily.

Department of Health officials in Washington state report on their web site in early July 2016 that some third party commercial traceability software systems are requesting patient information. Such as: conditions, history, and notes. In other words, that there had been a potential breach of patient confidentiality within a week of the patient database's launch, which is what the department spent a year and a half assuring residents of Washington would not happen.

At a recent August training session for ‪‎BioTrackTHC‬ held in Eureka, California, the instructor spelled “‪‎Humboldt”‬ wrong (he forgot the D), his response when this was pointed out - "I didn't think people in Humboldt could read!"...

A few medical cannabis dispensaries in Albuquerque, New Mexico have even had days where they had to close early due to BioTrackTHC software operational issues. I saw first hand, working in a dispensary in Albuquerque, of the software program issues and how it even caused a delay in availability of medical cannabis products for patients.  And recently in New Mexico, an increasing number of medical cannabis patients with the new BioTrackTHC microchip ID card, have had problems being told they have exceeded allowable limits or “units”. Thus, being prevented from buying medicine when they should be allowed to.

These problem with the seed-to-sale providers, like BioTrackTHC, is that they all require extensive data entry. Often the data entry needs to be duplicated to be entered into the state system, which is sometimes not integrated. Add to that the logistics of managing an all cash business, and you have the makings of the nightmare that is a growers or dispensary owner’s life. Not to mention the challenge of using an inventory system for a product that evaporates and falls off without any sale or theft. T-shirts rarely evaporate, so they are either on the shelf, sold, or stolen. Cannabis, however, will evaporate while it’s in the safe storage waiting to be sold — like Houdini with a skunk smell.

Addressing these challenges with a much needed user-friendly software update is a must for BioTrackTHC. Along with a better understanding of the Emerald Triangle and the crucial role it’s played in cultivating the industry it now does business in.   And easing integration between programs to index and track licensed cannabis farmers’ plants to make sure none go missing on their way from grow facility to dispensary to medical patient. That requires effectively tracking the barcodes affixed to the plants, as well as making sure the data can be exported to business software programs such as QuickBooks or Excel.

These kinds of controls are designed to keep cannabis business owners on the right side of the law, and also let them run the rest of the business knowing these systems are in place. For example, if cannabis needs to be tested for heavy metals,  mold, and bacteria before sold. The system will not allow the product to be placed on a updated manifest for sale, unless it has valid test results associated with it. One may argue that there is no real market for this level of sophistication needed for a simple plant. The cannabis industry already has more technology than almost any industry out there as it developed under prohibition.

A few other POS business systems listed on Google for the cannabis industry include Greenbits and MJ Freeway. Another app tool, FlowHub, includes the ability to use iPhones and iPads to scan bar codes.