Software to Regulate Legal Marijuana Is Just as Error-Prone as Other Government Software

Aaron Shepherd took a job at Greenwave Dispensary in southern Maryland in mid-May. A registered medical cannabis patient himself—he says the herb helped him kick an addiction to opioids years ago—he wanted to help others heal.

The gig proved so frustrating he quit after six weeks. Greenwave wasn’t the problem—it was Maryland’s mandatory cannabis-tracking Metrc software, which checks a patient’s prescription and purchase history at every sale. Metrc was repeatedly bogged down with user traffic, sometimes for hours. Patients sat waiting, and some who traveled some distance drove home empty-handed.

The final straw was when a woman using a wheelchair waited more than an hour to buy some cannabis, to no avail. Irritated, she and her husband left so she could get home to take her other meds, Shepherd says. “It practically put me in tears.”

Maryland is among 30 states so far that have legalized recreational or medical marijuana, and the vast majority of them require close tracking—known as “seed to sale”—of the plant. Maryland is also one of 10 states (plus D.C.) that are using Metrc, a product of Franwell. Seven others use software from Florida-based BioTrackTHC, and two, Pennsylvania and Washington, have signed up with MJ Freeway, software made by Denver-based Leaf Data Systems.

Each company helps regulators trace the cannabis moving through their borders—everything from microchipped pot plants to concentrates and buds sold at dispensaries. Retailers can generally use different software to ring customers up, but it’s on them to share the sales and inventory data with regulators to show they’re complying with state law. States have adopted the seed-to-sale model to ensure product safety and show they can keep their weed away from the larger, more entrenched black market.

But when the software doesn’t perform, the industry and its customers suffer. In 2018, in addition to rejecting patients, glitches caused by high levels of user traffic left dispensaries in Maryland unable to make transactions, costing them significant amounts of money, retail managers said. In 2017, Oregon’s marijuana growers and distributors complained of spending valuable man-hours updating inventory in Metrc and dealing with slow connections during peak harvest season. MJ Freeway’s glitches in Pennsylvania and Washington have halted commerce for dispensaries, and the company has suffered multiple hacks and securitybreaches, plus a troubled, months-delayed launch in Washington earlier this year. Before inking a deal with MJ Freeway, Washington worked with BioTrackTHC for four years, but growers bemoaned performance issues and lacking functionality.

Screw-ups with government-contracted software are nothing new. Few will forget the disastrous 2013 launch of healthcare.gov, a platform designed by 55 contractors without any coordinated leadership on the project. Companies that designed platforms to administer benefits have caused crises, like Deloitte failing to process thousands of applications for food stamps, welfare, and more in Rhode Island last year, or Accenture creating a 30,000-plus household backlog for food stamps in North Carolina because of a software glitch. Larger jurisdictions like California and Canada have dealt with the fallout from privately contracted software failing to properly deliver employees’ paychecks.

The cannabis industry, however, is using software to make its case to exist. Each state is part of a national trial experiment to show it can bring in tax dollars from a federally banned but widely used drug, all while keeping it from feeding the thriving black market. Obama-era guidancefrom 2013, since rescinded by Jeff Sessions, essentially told states that if they “implemented strong and effective regulatory and enforcement systems” to monitor their legal weed, they were safe from federal punishment. But if oversight lapses and the trials fail—such as through large amounts of cannabis leaking into the illicit economy—Sessions’ Justice Department has more of an excuse to crack down on cannabis and quash the experiment altogether.

So what are states doing to address software blunders? In July, Metrc sourced Maryland’s outage problems to an automated tool, an application programming interface, that checks each patient’s prescription limit and purchase history for every sale. The API automatically stopped patients from buying more than they’re allowed—say, a cap of 120 grams in 30 days. But Metrc said it was being used “excessively and in ways that neither Metrc nor the state had anticipated” in a July 3 memo. Joy Strand, executive director of the Maryland Medical Cannabis Commission, said disabling it would stem the disruptions.

The upside: Regulators said outages tapered off shortly after the API was removed. But Maryland disabled a tool meant to mitigate human error. Limit checks are legally required to make a sale, so dispensary staff have since been manually typing each patient’s information into a state database, all on the honor system. Skipping that step presents a new risk for diversion, in which legally grown marijuana slips into the illicit market. A dispensary can also face fines or stiffer penalties for violating state rules.

And what’s more, outages with Metrc are still happening when many patients are making purchases at once across the state, patients and retailers say. One dispensary manager said they had three outages in one week in late August and earlier this month, each lasting more than an hour and halting sales altogether.

Just last week, the state provided a temporary fix to help patients during outages. Under a new exception, dispensaries will be allowed to sell a patient a small amount—up to 12 grams of marijuana or 2.5 grams of concentrates—when Metrc isn’t working, so they’ll no longer have to turn patients away. But it still doesn’t address the overall problem: the glitches caused by overwhelming traffic.

Ben Curren, CEO of Green Bits, whose point-of-sale platform is used by about half of Maryland’s dispensaries, says that, rather than remove the safeguard of the API, the state should pay for an extra server or bandwidth with Metrc to address the traffic glut. Colorado did so proactively in December 2017, preparing to handle increased server traffic in the future, regulators say.

In July, Strand told me that Maryland and Metrc were working on “a long-term solution” but had “nothing specific” to share. She acknowledged human error is inevitable in a manual process but assured that “we’re going to work with the dispensaries” if they’re found to have made a mistake. Asked for comment, Metrc Executive Director Scott Denholm said in an email that the company doesn’t discuss specific state programs.

Numerous Washington state cannabis businesses and observers have remained wary of MJ Freeway after the system’s flawed kickoff. It was “hands down, perhaps second only to the launch of healthcare.gov, the worst product launch that I’ve ever seen,” said Gregory Foster, a representative for the Cannabis Alliance industry group on the state Liquor and Cannabis Board’s Traceability Advisory Committee. While MJ Freeway spokeswoman Jeannette Horton says there wasn’t “any period where anyone couldn’t do business” in the days after the launch, some shops and growers said the software was muddling shipping orders, causing delays and supply issues for stores and costing producers revenue.

Furthermore, MJ Freeway’s platform in Washington doesn’t help growers manage inventory, so they must now use third-party software that reports data into the tracking system. Nick Cihlar, co-owner of the grower Subdued Excitement in Ferndale, Washington, has seen discrepancies with strain names, product types, and stock tracking. “We have no way of knowing if our current inventory is accurate.”

Washington and MJ Freeway released a software update in late August that regulators say should address frustrations. The state is now proceeding with added caution: MJ Freeway could face penalties if it doesn’t meet deadlines for three more software updates this year, Liquor and Cannabis Board spokesman Brian Smith said. The state and MJ Freeway recently renewed their contract, but it was for six months instead of a full year.

Colorado, the first state to sell legal recreational pot, has been a comparative success story since its industry launched in January 2014. The state uses Metrc, and Kyle Lambert, deputy director of the Department of Revenue’s Marijuana Enforcement Division, says he’s unaware of “any kind of system shutdowns or interruptions for any period of time” since then. He credits Colorado’s solid record with software in part to the state’s Metrc user group, which brings together reps from the state, Franwell, licensed businesses, and affiliated software providers. (Oregon also maintains a Metrc user group.)

Colorado hasn’t dodged complaints altogether, of course. Dispensaries grumbled early on about having to manually enter sales figures into both Metrc and their own point-of-sale software, costing time and labor and risking human error. But Lambert says the state, Metrc, and third-party firms fixed that issue by automating the task through an API. (Colorado hasn’t faced the same problems as Maryland because they use slightly different systems, due to different state regulations.)

Another lingering thorn: Metrc requires growers in all 10 client states and D.C. to buy radio-frequency identification tags to track plants. The tags cost 45 cents per plant and 25 cents per batch, according to the company’s website, and can only be used once. That adds up for growers. Marijuana Enforcement Division Director Jim Burack acknowledges the grievances, but says they ensure product safety and protect public health.

Other industries like food and pharmaceuticals have proven they can reliably trace their products, pushed by federal policymakers and consumers to improve supply-chain tracking. Pointing to agricultural sectors’ working traceability systems, Foster remains optimistic that cannabis will eventually catch on. “Once there is increased consumer awareness and organized pressure, it’s going to have to be a problem that is solved to everyone’s satisfaction.”

And while the industry may not be able to draw the same caliber of tech talent and investment as other sectors right now—“well-known corporations that do this kind of work … would never touch a contract like this because it’s marijuana,” Smith says—seed-to-sale is still in its infancy. There will be even more trials as other states legalize. The federal government will eventually be pressured to step in and set uniform rules for tracking cannabis.

“You have to ask yourself, what in the hell is gonna happen when it goes nationwide?” says Donald Morse, chairman of the Oregon Cannabis Business Council. “How are we gonna track a delivery from Oregon to Indiana if Indiana is using a different system than Oregon?”

As important as it is for seed-to-sale platforms to serve the industry, patients and customers are the backbone of this whole legal pot idea. At best, a software outage is inconvenient for the casual user in a recreational-friendly state. At worst, it betrays the patient who uses marijuana as medicine.

Dustin Dixon of Catonsville, Maryland, falls in the latter group. He uses marijuana to treat insomnia, anxiety, and depression. He usually looks to flower—the weed medium you’re likely most familiar with—and sometimes picks up half-ounces to save time on runs to the dispensary. He waited out several backups with Metrc this summer, including one that lasted an hour, eating up his entire lunch break.

He says the recent change allowing dispensaries to sell small amounts of cannabis when Metrc is bogged down is “a positive step in the right direction” and “definitely shows [regulators] do care” about Maryland’s roughly 59,000 (and counting) registered patients. But it’d be even better to see the state address underlying technical issues with Metrc altogether, he says.

This article originally appeared in Future Tense, a collaboration among Arizona State University, New America, and Slate.