MJ Freeway software firm fights cyberattacks, outages, missed deadlines and negative press

Published: Nov 2, 2017, 2:41 pm • Updated: Nov 2, 2017, 3:40 pm

By Bruce Kennedy, The Cannabist Staff

It’s been a brutal year for Denver-based MJ Freeway, the pioneering firm that creates “seed-to-sale” tracking and business software for the cannabis industry.

The company’s latest problem: a missed deadline on a big project in Washington state. It comes on the heels of multiple data breaches this year, service outages in January and October that affected shops and a dropped contract in Nevada.

Cannabis tracking inventory software may not be very sexy or exciting, but it’s an essential part of today’s multibillion-dollar legal cannabis industry. Seed-to-sale tracking ensures cannabis businesses are in compliance with state and local regulations.

The issues have tarnished MJ Freeway, which became a leader on the data side of the legal marijuana industry after it launched in 2010.

According to MJ Freeway, more than 40 percent of cannabis businesses in the U.S. now use the company’s software platforms to track issues such as inventory control in thousands of retail dispensaries, as well as growing and processing operations. Their total client base for software and consulting runs across 23 states and five countries.

Regarding the missed deadline in Washington, a Washington regulatory official said an ambitious plan to transfer the state’s tracking contract within a few short months fell short.

“We’re very pleased with MJ freeway and the work that they’re doing,” Brian Smith, spokesman for the Washington State Liquor and Cannabis Board (LCB), said in a phone interview with The Cannabist.

“They had a very compressed timeline,” he added. “They signed this contract in July and they had until (Oct. 31) to create a system.”

Washington State has a contingency plan in place to cover traceability issues between Nov. 1 and Jan. 1, when the MJ Freeway contract is now scheduled to begin.

Smith said about 75 percent of Washington cannabis licensees use a commercial, third-party system to report to the LCB. The remaining 25 percent, he said, will be using a free system where they access spreadsheets online each week.

“The information on those spreadsheets is nothing more than what they are already required to report,” he said. “They are just changing from one mechanism to the other.”

Marijuana plants sit under lights at a licensed growing facility in Arlington, Wash., in January 2015. (Elaine Thompson, Associated Press file)

Smith also addressed concerns voiced in some media reports that the transition time between now and the new start of the MJ Freeway contract could allow the system to be abused, possibly resulting in diversion to out-of-state markets.

“There are some very vocal people in the press that are saying things like that,” he said, “the marijuana press, because it’s not really been covered at all in the mainstream press. Some people are looking to make money off of this and they are saying a lot of things that people should be aware of, and careful with, as they go forward.

“If you’re a state-licensed business today, your interest is in staying compliant, not diverting product, creating a felony and trying to move your product out of state,” he continued. “So no, we think that most of our licensees, if not all of them, want to abide by the law.”

Shoring up security

For its part, MJ Freeway has pushed back against the tsunami of negative reports. Last week its founders, CEO Amy Poinsett and COO Jessica Billingsley, issued a video statement on the company’s Facebook page, saying they were “heartbroken” about the impact the outages had on their affected clients’ businesses:

“We understand our clients’ frustration and we apologize for the inconveniences,” Poinsett said in the video, which has since been removed. “We’re not in this business for short-term wins. While we’ve been first to market, we’ve also been first to stumble.”

The main issue behind the outages, according to Billingsley, is the company’s first-generation “legacy” Tracker software. That product is nearly eight years old and is being phased out and replaced by a Gen-2 product that came online last November.

More than 1,000 retail locations in 16 states and Washington D.C. were reportedly affected by the most recent outages in October and were taken off-line “to address issues,” according to Jeannette Ward, MJ Freeway’s vice president of global marketing and communications.

Industry compliance coverage

• MassRoots shake-up: In wake of abrupt CEO switch, deal to acquire CannaRegs gets nixed
• A flower’s long journey: How legal weed goes from seed to sale
• Cannabist Show: He makes infused topicals; He’s a compliance expert
• Guess who’s building Illinois medical marijuana industry? Ex-law enforcers
• Canopy Boulder ganjapreneurs face tough crowd of investors

Billingsley told The Cannabist about two-thirds of MJ Freeway’s commercial customers are now using Gen-2.

“What we need to do is to work to transition our existing, legacy customers to our new platform,” she added, “because it’s a much improved product and not as susceptible to this type of issue.”

Billingsley also stressed that there is no connection between the outages and the hacking incidents her company has faced.

In terms of those cyberattacks she said that, following the January incident, MJ Freeway transitioned all of its clients to Amazon Web Services, an on-demand, cloud computing platform. The company also instituted a number of additional security measures and began working with two outsourced, third-party security firms, Billingsley said, “to both advise, audit and test our security measures on an ongoing basis.”

“It is not an exaggeration to say that we have spent more on security in a (fiscal) quarter than most of our competitors gross in a quarter,” she continued, while adding that the cyber crimes division of the Colorado Bureau of Investigation is “actively investigating” the January hacking incidents.

As to the possible culprits behind the hacking and the source-code theft, both Billingsley and Ward declined comment due to the ongoing investigation by law enforcement.

“Hard work for the right reasons”

Billingsley said she was stunned at the media pile-on against her company this past week.

“We literally invented seed-to-sale software, patented it,” she said. “And all we do is to strive to do the right thing for our clients, to be part of the solution and to show the industry that we care.”

Ward said MJ Freeway has learned a lot from its current ordeal; lessons that other software companies should consider if they’re planning to enter the legal cannabis sector.

“I would say that serving the cannabis industry is a responsibility,” she said. “You’ve got to be prepared to work — especially if you’re serving entrepreneurs — you’ve got to be prepared to work as hard as they are, as smartly as they are, to serve their needs and be there where they are.

“At the end of the day you’re accountable,” Ward said. “This is hard work for the right reasons. Very few people are getting rich. We’re doing this because we believe in it.”

Updated Nov. 2 at 3:39 p.m. Clarification: This article has been updated to reflect that 40 percent of cannabis businesses in the U.S. utilize MJ Freeway software.

Topics: commercial cultivation, compliance, industry, inventory, MJ Freeway Business Solutions, regulations, retailers, shops, tracking Bruce Kennedy