The Washington State Liquor and Cannabis Board (WSLCB) Integrator Work Sessions convened agency technical staff and third-party software providers which interfaced with the State's cannabis supply chain traceability system, Leaf Data Systems by vendor MJ Freeway, an Akerna company. MJ Freeway representatives were sometimes present on the calls.
WSLCB - Integrator Work Session
(May 7, 2020)
Thursday May 7, 2020 10:00 AM - 11:00 AM
Observed
Observations
Some software integrators sought clarification from the Washington State Liquor and Cannabis Board (WSLCB) about guidance put forth by the agency prohibiting the use of Lab Result Global Identifiers by anyone except testing laboratories.
- When a cannabis testing lab performs work and reports the outcome to the MJ Freeway Leaf traceability system, the package of test result information is assigned a unique Lab Result Global Identifier (GUID) which is supposed to be associated with the cannabis product lot under test. These identifiers---also referred to as lab result codes---follow the format of all of MJ Freeway's global identifiers and are supposed to be inherited by cannabis products derived from the parent lot. In the event of sales of cannabis products involving transfers, the lab result GUID and associated documentation---which may include a certificate of analysis (COA)---are made available to the new product owner.
- As with many features of MJ Freeway, there have been and remain issues.
- Lab Result GUIDs are critically important in the design of the supply chain traceability approach requested by the WSLCB and implemented by MJ Freeway/Akerna. Samples from cannabis lots are tested by labs to ensure public health and assigned a pass or fail value. The WSLCB wanted forward progress of a lot into the supply chain to be gated by the approval of an accredited lab and enforced automatically by the traceability system. That gating functionality was not achieved until MJ Freeway's troublesome release 1.37.5 in July 2019---nearly 1.5 years after the system's introduction---after which manifests for transfer of product could not be generated without a valid Lab Result GUID.
- The WSLCB did not intend for Lab Result GUIDs to be duplicated outside of the hierarchy traced by a tested cannabis lot's derivative products - after all, the test results for one lot of cannabis should never look precisely the same as the test results for another lot. Sadly, MJ Freeway never implemented checks to ensure that Lab Result GUIDs could not be duplicated to other unrelated cannabis lots. With financial incentives to minimize testing costs and nothing structurally preventing the reuse of Lab Result GUIDs, there have been cases---perhaps many cases---of this kind of abuse. Unfortunately for the perpetrators, these instances of gaming the system were precisely documented. Although MJ Freeway was incapable of implementing dynamic checks against this abuse, the data itself tells the story.
- Unfortunately, that's not the case for the magic identifier "WAATESTE" introduced with release 1.37.5 to support retroactive attestation of lab results. In the absence of a gating function requiring labs expend time to document test results in the traceability system, thousands of cannabis products did not have an assigned Lab Result GUID in July 2019. With the release of version 1.37.5 and its gating function, those products became unmovable and unsellable. The WSLCB and MJ Freeway agreed to introduce a magic identifier, "WAATESTE", which could be assigned to any cannabis product that was missing lab results to keep the product moving. This honor system was not subsequently turned off, and products continue to be assigned the "WAATESTE" identifier nearly a year later. Some of those usages may be legitimate, but there's no way to programmatically discern this - each instance would have to be investigated individually.
- On May 1st, Marijuana Examiners Manager Kendra Hodgson announced that "labs do not have authorization from WSLCB to release the Leaf System [Lab Result] code" to licensees or third-party software integrators.
- During the May 7th Integrator Work Session, OpenTHC CEO David Busby asked for clarification about the policy change. He attested to failures in MJ Freeway which necessitated legitimate applications of the Lab Result GUID to downstream products to maintain the integrity of the traceability data structure. He also decried continued allowance for the WAATESTE identifier which he argued compromised the integrity of the traceability data structure. Abuse of the former technique could be reliably traced, whereas the latter could not. As a result, Hodgson verbally committed to allowing the software integrators to continue utilizing the Lab Result GUIDs for legitimate use cases.
- However, no commitments were obtained for rescinding the magic WAATESTE identifier - and it is unlikely the functionality will be changed. While the WSLCB's maintenance contract with MJ Freeway/Akerna allows for additional development in the event of critical issues, neither the State nor the vendor seem particularly interested in further collaboration. While vetting of some narrowly proscribed changes to MJ Freeway have been undertaken, there have been no subsequent releases nor patches of Washington's traceability system since release 1.37.5 in July 2019.