Cannabis News

If the headline looks familiar, well, that’s because it is.

Cannabis lounges, where patrons can smoke a joint, rip a bong, vaporize a dab or do just about anything else you can think of with the plant, appeared to be a certainty as part of a Las Vegas ordinance back in 2017—and then again in 2019. They’ve been talked about for over four years in the entertainment capital of America.

But this time around, after years of setbacks and political meddling from the rival gaming industry, a bill at the Nevada State Legislature is on track to settle the score once and for all.

Assembly Bill 341 would pave the way for an unlimited number of lounges to open across the state, in counties where local governments allow cannabis businesses to operate. That includes in Sin City, where over 40 million tourists visited each year before the COVID-19 pandemic.

“This would really open the floodgates for something marijuana users have wanted for a long time,” said Assemblyman Steve Yeager, a Democrat from Las Vegas who sponsored the bill. “And there’s a social equity part to it where we’re not restricting this just to licensed dispensary owners.”

Yeager, in his third term at the state’s biennial legislature, has felt the frustration himself. Long considered the heir apparent to former State Sen. Tick Segerblom, who was known as Nevada’s “Godfather of Marijuana,” Yeager watched as the fledgling industry offered all of its spoils to a tiny group of anointed business owners, most of whom were lawyers, doctors, casino operators, lobbyists and former public officials.

Less than 100 groups control almost all of the industry, as the state capped dispensary licenses from the adult-use program’s inception in 2017.  Many of the companies are also vertically integrated, meaning dispensary owners also hold the lion’s share of production and cultivation permits. Disproportionately left out have been women and racial minorities, the latter group of which was most harmed by cannabis prohibition.

The new bill runs so contrary to the state’s years of meticulously restricting licenses and hand-picking operators that many dispensary owners are wondering if opening a lounge is even worth the investment.

“You have to figure out if you can make any money with them,” said David Goldwater, owner of Inyo, a dispensary located just over a mile from the Las Vegas Strip. “There’s going to be a ton of new competition.”

Goldwater, whose shop was one of the first dispensaries to open back in 2015, said he has no plans to open a lounge right away.

But those who plan to roll the dice on a new lounge say they plan to carve out a niche for themselves to survive. It’s not much different than other businesses in Sin City, which rely on gimmicks, glitz and glamor to earn visitors’ dollars.

Lissa Lawatch, general manager at Oasis Cannabis, is preparing a beach-themed lounge in hopes of luring tourists from the Strip a block away. Similar to the world-famous “beach clubs” found at a slew of neighboring resorts, the 4,000-square-foot cannabis lounge—set for an adjacent room next to the Oasis retail floor—plans to offer guests “a paradise in the desert.” That means live music, beach balls and seashell décor, among other tropical amenities.

“We’re going for a place that’s super chill so people can connect with their own vacation,” Lawatch said.

Anyone who buys cannabis at Oasis will be able to use the lounge, though Lawatch and company haven’t yet determined a time limit for their guests. Most prospective lounge owners plan to offer either a paid membership plan, where people can visit as often as they’d like, or a one-time entry with product purchases at the dispensary.

To make money, Oasis’ lounge will likely have a cover charge and rental fees for customers to use bongs and other paraphernalia, Lawatch said. Oasis also plans to cap the amount of time customers can hang out, so they’re not intoxicated when they hit the road.

“There’d have to be a limit, I mean, they even put limits on sushi bars,” she said. “You have to find a way to make sure people aren’t driving home roasted.”

Oasis is one of the few Vegas cannabis businesses located near the Strip. It opened in 2015 and was grandfathered through a 2017 regulation that banned cannabis companies from opening within 1,000 feet of a casino. Most other dispensaries are miles away from the famed Las Vegas Boulevard and consider at least 85% of their clientele to be locals.

Off-Strip dispensary reps believe lounges will be their golden ticket to finally reeling in more out-of-towners. Locals can legally smoke inside a private residence as long as they own it or have permission from their landlords. But tourists still have nowhere to go.

Instead of trying to discreetly consume in their rental cars, hotel rooms or on the street, visitors will opt for the peace and comfort of a legal consumption venue, the reps have said. The lounges will also benefit people in apartment complexes or housing where owners don’t allow cannabis.

“At its core this is a bill to decriminalize marijuana use in the state,” said Chris Anderson, a government relations rep for the Apothecary Shoppe dispensary in central Vegas. “The current bans can be seen as a form of discrimination against folks that have less means.”

The Apothecary Shoppe’s lobby resembles that of a quaint hotel, complete with tall wood-grain desks and formally dressed attendants to serve its guests. Fancy menu booklets, like those found at gourmet Italian restaurants, rest on the desks underneath bright reading lamps.

Instead of checking people into a resort, though, the uniformed budtenders offer their recommendations for marijuana products. The dispensary plans to offer a similar visitor experience for its planned on-site consumption lounge if A.B. 341 gets the nod from state officials.

In the increasingly unlikely event that the bill doesn’t pass, the Silver State already has one small lounge open. The Las Vegas Paiute Tribe, playing by its own set of rules that allow it to bypass state law, has operated a small “tasting room” inside its mega-dispensary on tribal land for a couple years. There, customers can try 0.3-gram blunts of flower, take a bong rip or inhale a single dab.

It’s just a sample of what’s to come, though, if state officials can be taken at their word.

With data forecasting expert BDSA predicting that the global cannabis market will reach $56B by 2026, there is no time to waste. Whether it’s Oklahoma, New York or even Macedonia, the frenzy is on. Investment decisions are immediate, and you have to be correct out of the box. This is where an expert like Andrew Lange and his company, Ascendant Management, come in. Andrew has designed more than 1.5 million square feet of cannabis facilities and moved them into profitable production in North America and Europe. One of his active customers is Onyx Agronomics in Washington. Bailee Syrek is the director of operations at Onyx and this is the story of the key points in designing a precision cannabis facility with state-of-the-art efficiency.

Background

Andrew Lange, a navy veteran, runs a global cannabis consulting business based in Washington. With a “prove it to me” approach, he regularly tests the best new technologies in the facilities he designs. He integrates his knowledge of what works in practice into his subsequent facilities. One of his previous projects, Onyx Agronomics in Washington, started in 2014 and moved quickly into production in a retrofitted warehouse. Many of his best ideas started with Onyx, including some new innovations in the latest expansion there this month. Onyx is a tier 3 cannabis cultivator.

Bailee Syrek’s operation at Onyx currently produces 9,000 lbs. of dry trim bud per year in 8,000 square feet of canopy. She operates the state-of-the-art, clean room style, indoor grow facility around the clock, delivering 2.7 grams/watt from every square foot of canopy in her building. She runs a highly efficient facility.

Onyx has had an ongoing relationship with Ascendant Management and chose to leverage them again with their current expansion to increase their capacity further. Onyx uses a range of advanced technologies including aeroponic cultivation equipment and control software from AEssenseGrows to hit their metrics.

Precision, Quality & Consistency

“I look for ways that my clients can differentiate themselves,” says Lange. Maybe it’s his military background, but Andrew demands precision, quality and consistency in the operations he designs. “Cannabis is a just a plant really so we look for the highest performance grow methodology. I find that to be AEssenseGrows aeroponics,” says Lange. “The AEtrium Systems provides a good foundation to manipulate for grow recipes and business process. I add teamwork, communications, and operations procedures to that foundation.”

At Onyx, Bailee Syrek works closely with her channels. She invites her customers in regularly to review the Onyx cultivars and to cover their ideal requirements. These can range from bud size for their packaging to THC or terpene profiles (Yes, channels do want both higher and lower THC content for different consumers and price points). Based on that feedback, Bailee and Andrew work together to dial in the ideal grow recipe in the AEssenseGrows Guardian Grow Manager central control software. They push their target strains to optimize the results in the direction requested by their customers. For example, “How do you get the highest possible THC out of 9lb Hammer?” You’ll have to ask Andrew and Ascendant Management.

Driven by customer requests, Onyx is adding new strains to build on their innovative brand. Bailee expects to reach new levels of terpene bundles with Cheeseburger Jones, Koffee Breath, Shangri-La and OK Boomer. Utilizing Andrew’s expert knowledge, they can take typical sub-20% cannabinoid bundles and improve them using aeroponics and better controls, into standout aeroponic 30% packages.

The Onyx Vision

Bailee Syrek believes this is the most exciting time yet for Onyx. Delivering premium grade cannabis as a white label flower supplier for years, Onyx is a profitable and successful business. But even with doubling capacity every year, they are still having trouble keeping up with customer demand. Bailee wants to get to the point where she can always say yes and accept an order from their white label customers. With this objective, she again engaged Ascendant and Andrew to get beyond 15,000 lbs. of output in 2021 to make her customers happier. Beyond that basic expansion, she is also ambitious and is preparing plans for additional lines of revenue with their own proprietary flower, oil and derivative products.

“This expansion will be a new challenge,” says Syrek. “Flower production is in our wheelhouse. We have tighter operations, with the most consistent bud size, terpenes and test results in our state. These new products will require that same quality but now in new areas.”

Her Path to Leadership

Bailee started with Onyx in a compliance position that grew out of the constant demands for government licensing and reporting. In that compliance role, she had the opportunity to work a bit in every department, giving her a good understanding of all of the facility operations and workflows. All of that experience led her to eventually take over the operations leadership role. She instills care and effort to maintain the cleanest and most efficient operations possible. “With aeroponics, we don’t have to lug soil from room to room or in and out of the facility. This saves us a ton of work that we can redirect to plant health and maintenance,” says Syrek. “Medical precision and GMP quality is a given. Each room on average is 105 lights and one room manager and one cultivation technician take the room from clone/veg transfer to harvest as a two-person team.”

Bailee prides herself with results. “Medical grade precision is normal for us. We use medical grade SOPs for every aspect of our production.” Bailee has designed these guides into their control system that runs on the Guardian Grow Manager software. From sensor tracking, to performance graphs to time cards; everything is integrated in her performance monitoring.

A quality focus is very apparent in every Onyx flower room. Every watt of light energy is transferred to the pristinely manicured canopy. Naked stems feed nutrients up to the fat buds at the trained canopy surface. Fan leaves are removed and all possible energy turns into bud weight and potency. The room technician has a passion for plant health, table care and plant maintenance all the way through to the harvest bonanza.

What is the biggest challenge for Bailee as she drives the operation? Even at 105-110 grams per square foot per harvest, they are sold out. “Every customer wants to buy beyond our capacity. It is a good problem to have,” Bailee says. “Customers want our quality and love the consistency. This is the most exciting thing about our expansion. We will finally be able to make additional channels happy with high quality supply.”

This is where Andrew credits Onyx’s performance. “Most well running operations deliver 1.1-1.8 grams of dry trim bud per watt of electricity used in powering a grow room,” says Andrew. The Onyx grow formula results leave this in the dust. Running Fluence SPYDR 2i grow lights and the AEtrium System aeroponics, Onyx plants are delivering just shy of 4 lbs. per light with every harvest cycle. At 630 watts max output, that delivers ~2.7 grams/Watt, the most efficient operation he has seen. The Onyx process and execution works.

“Bailee is a great example as a professional. She builds a motivated team that executes better than her competition,” says Andrew.

At the same time, Onyx runs a highly space efficient nursery with just enough mother plants feeding energetic cuttings into the 4-layer stacked AEtrium-2.1 SmartFarms in their environmentally controlled clone room. They produce more than enough healthy clones to jump from veg to flower in the span of a week. Grow time, harvest turn time and no veg space, results in very efficient use of power in the complete operation.

Mirroring Onyx for Medical Grade Cannabis in Europe

Andrew Lange’s current passion is a green-field project in Portugal. Self-funded, Andrew says that this facility will be one of the first that is pure enough in operations to supply non-irradiated clean-room-level-quality cannabis beyond the precise standards required by European regulators. Current importers have not been able to clear the European standards for cleanliness without irradiating their buds. Other companies like Aurora have abandoned efforts to access the market due to the precision requirements. Typical methods used for fruit imports use gamma radiation to get bacterial counts down. This was tried with cannabis to sterilize buds, but the problem with cannabis is this degrades the quality of the flower.

Andrew’s Portugal facility will be using a sterile perimeter surrounding his grow space (mothers, clones/veg, flower rooms) and harvest and processing areas (dry, trim, packaging). Andrew creates a safe environment for healthy production. A steady harvest cleaning regimen is built into his operational designs from the beginning. All operators are trained in procedures to exclude pathogens and limit all possible transmission (airborne, physical/mechanical touching, or water carried). Every area is cleaned during and between harvests. Andrew is confident he will reach a consistent level of accuracy and purity beyond European requirements because it is routine in all of his designs.

Certified Efficiency is the Message

Good Manufacturing Practices (GMP) and Good Agricultural and Collection Practices (GACP) are required for certification and access to European markets. Andrew always builds tight operations, but in this case, his Portugal facility is designed with the fit and finish to be GMP and GACP compliant from day one with advanced air filtration and air management throughout.

Automated aeroponics is a foundation technology that Andrew recommends for his facility designs. The automatic data logging, report generation, cloud access and storage make this a foundational technology. Andrew does get some resistance from cultivators that are used to the classic soil media approaches but he explains that software configurable grow recipes, precision controls, zero soil/no pests and hyper-fast growth makes aeroponics the foundation of competitive advantage. Precisely controlled medical quality precision operations are built on top of this foundation.

The initial phase of the Portugal facility is 630 lights and this facility is Andrew’s latest personal investment. From secure perimeters to modular grow rooms and highly automated equipment, this location will be state-of-the-art in terms of grams/watt yields and renewable energy with an output of 6 metric tons per year. Solar powered electricity from a 4-megawatt farm will use Tesla megapacks for storage and be grid independent.

Technology & Innovation, Onyx & Ascendant

From his first experience with AEssenseGrows aeroponics, Andrew has been able to design complete grow recipes in the Guardian Grow Manager software with very tight precision on dosage. This makes it possible to create ideal recipes for each strain (nutrition, irrigation cycles, lighting and environmental management). This frees up the operations teams to focus on plant health and execution. The nutrients, pH, CO2, temperature and humidity, follow the Guardian directions that he sets.

Working with Bailee at Onyx, Andrew is now consulting on the post-harvesting side of operations (drying, trimming, extracts and packaging). In parallel with his efforts, Bailee is optimizing THC & terpene production on the cultivation side with UV lighting (considering far-right red frequency light recipe enhancements).

That is the Ascendant Management approach to innovation. Trial, test constantly, perfect ideas in practice. Optimize the results for consistent, high-quality results. Even while driving for the personal craft touch, use automation to increase efficiency of mundane, but important tasks. With these methods, Andrew believes that the Onyx labor cost is one third of typical soil media grow operations. Zero soil aeroponics offers many benefits. Bailee’s team is able to give each plant more attention and delivery better quality. Automation is a win-win for them.

Bailee finds that constant testing is useful for two things: one, great results, and two, surface the best talent with their hand’s-on approach.

Always Finish with People

Bailee says that her staff works incredibly hard. “We are a different grow, with better ergonomics on the job, aeroponics for precision and yields, and advanced technology at the leading edge in every part of our grow. No dirt up and down stairs. People are proud to work here. We are not your dad’s grow operation.”

“We promote from within. Everyone starts as a room tech and has the opportunity to move up. Teams are isolated by rooms so there is no contamination between rooms or humans. Put in the work, and you will get promoted with expansions, and grow with the company as we take a bigger share in the market.” Female employees make up almost half of the current staff, and Bailee encourages employees to refer their friends. “Good people invite good people,” she says.

Her training program introduces the technical aspects of their unique operation, the positive expectations and career path for every new employee. The social environment is friendly with good pay and regular raises. Each new employee fills a range of roles during their 1-month training circuit and are assigned to a cultivation space under a lead as an official cultivation tech at the end of 30 days. “One thing that we do more than at other grows is constant cleaning,” says Bailee. “This is an ever-present mantra for the staff.”

The cannabis industry’s advancement towards legalization continues to dominate national headlines, from the stance of incoming Attorney General Merrick Garland to deprioritize enforcement of low-level cannabis crimes, Senate Majority Leader Chuck Schumer’s continued advocacy, to the recent passing of legislation in New York, New Mexico and Virginia (the first in the South) to authorize adult-use cannabis. While these updates are likely to intrigue customers and investors alike, they are also sure to draw the attention of cyber criminals who could look at the relative youth of the industry, as well as its rapid growth, as a prime target of opportunity for nefarious acts.

In order to understand risk mitigation best practices across a wide spectrum of private sector industries, this article will first identify the current security environment in order to understand the threats, briefly highlight specific case studies and assess the risks and identify methods that individual organizations, as well as the cannabis industry as a whole, can take action to enhance security and preparedness and to develop resiliency against future attacks.

Understanding the Threats

For an industry that has operated in a largely cash-based system for much of its existence, the idea of security is not foreign. Typically, these concerns focused on physical security implementation. The topic has received plenty of coverage, including a recent article in this journal articulating Important Security Considerations When Designing Cannabis Facilities. While an audit of physical security measures is a valuable part to any all-hazards threat assessment, securing a growing online network – from email to online finances to connected devices within cannabis facilities – can pose more unfamiliar challenges. When consulted for this article, Patten Wood, a former VP of marketing for a prominent west-coast cannabis retail brand noted: “While the topic of cybersecurity is critically important to customers, businesses, and the industry at large, it isn’t top of mind for many of the cannabis companies that I’ve experienced.” Understanding what risks are present is the first step to mitigating them, so we must first discuss several common cyber threats for the cannabis industry.

• Phishing: Phishing happens when cybercriminals impersonate a trusted individual or entity, typically through email. The goal in this instance is to get the target to share confidential information or download software that can allow unauthorized access into an organization’s network. Phishing is one of the most common types of cyberattacks as it is relatively easy to conduct and surprisingly effective.

• Ransomware Attacks: Ransomware attacks are used to gain access to a computer network and then lock and encrypt either the entire system or certain sets of high-value files, which can compromise important business information, and impact client and vendor privacy. A ransom is then demanded for restoring access, but paying the ransom comes with its own risk as it doesn’t guarantee the files will be restored. 

• Cyber Extortion: Similar to ransomware attacks in their design, cyber extortion typically deals with a threat of leaking personal information and will generally demand payment in cryptocurrency in order to maintain their anonymity. 

• 

  Remote Access Threats: As 2020 has forced organizations to rethink how they conduct business and shift to more remote operations than they had in the past, it can open up several new threats. According to a survey by IT social network SpiceWorkds.com, six out of every ten organizations allow their employees to connect their company-issued devices to public Wi-Fi networks. Utilizing unsecured Wi-Fi networks opens the user up to man-in-the-middle attacks, allowing hackers to intercept company data. Unsecure Wi-Fi also brings the threat of malware distribution. An additional consideration with remote workers is the uptick in cyber attacks against remote access software referred to as remote desktop protocol (RDP) attacks. According to Atlas VPN, RDP attacks skyrocketed 241% in 2020 and we’ve seen numerous RDP attacks against critical infrastructure throughout the pandemic and across all industries.

• Internet of Things (IoT) Leaks: With IoT devices running everything from security systems to automated growing operations, the convenience has been a huge boost for the industry. Unfortunately, many IoT devices don’t have sophisticated built-in security. Another common problem is the tendency of users to keep default passwords upon installation, which can make devices easy for cyber criminals to access. Once they are inside the system, malware can easily be installed, and the actors can move laterally throughout the network.

• Personal and Medical Record Security: Many cyberattacks expose some level of personal data, whether that be customer, employee or vendor information. An extra consideration for retail operations that either treat medical patients, or medical and adult-use customers, is the additional information they must store about their clients. Medical facilities will maintain protected health information (PHI), which are much more valuable on the dark web than personally identifiable information (PII). But even adult use facilities may keep government issue ID or other additional information above that of a typical retailer, which makes the potential value of their information much more intriguing for a cybercriminal.

Assessing the Risks

Depending on where your organization lies in the seed to sale chain, you will have different levels of risk for various types of attacks. We briefly discussed ransomware attacks earlier. Ransoms can range widely depending on the size of the organization that is attacked, but the ransom alone isn’t the only risk consideration. Businesses must also factor in the cost of downtime (an average of 18 days in 2020) caused by the ransomware when evaluating the impact to business operations, as well as reputation. While small – medium businesses are absolutely at risk, especially given their relative lack of cybersecurity resources and sophistication, a recent trend involves “Big Game Hunting” where cybercriminals are targeting larger organizations with the potential for bigger paydays. Criminals understand that big business can rarely afford major delays, and may be more able and willing to pay, and pay big, for a return to normal operations.

Below are several examples of attacks which have either directly impacted the cannabis industry, or have valuable lessons the industry can learn from.

GrowDiaries: In October 2020 researcher Bob Diachenko discovered that 3.4 million records including passwords, posts, emails and IP addresses were exposed after two open-source application Kibana apps were left exposed online. As a platform for cannabis growers around the world (who are not all growing legally), this type of exposure puts the community at great risk, and can lower user confidence in the product, as well as putting them at personal risk of harm or legal ramifications. The applications being left open is a prime example of either a lack of good cybersecurity policies, or not following through on those policies.

Aurora Cannabis: On December 25^th, 2020 Canadian company Aurora Cannabis suffered a data breach when SharePoint and OneDrive were illegally accessed. Included in the data that was compromised was credit card information, government identification, home addresses and banking details. The access point coming through Microsoft cloud software is a prime example of some of the challenges facing businesses who have an increasingly remote workforce yet still need that workforce to access critical (and usually highly sensitive) information.

THSuite: A database owned by seed to sale Point-Of-Sale (POS) software provider THSuite was discovered by researchers in December 2019. The database contained PHI/PII for 30,000 people, with over 85,000 files being exposed. The information that was left accessible included scanned government IDs, personal contact information and medical ID numbers. Clearly this gets into HIPAA territory, which can result in fines of up to $50,000 for every exposed record.

Door Dash-:As cannabis delivery apps become more prevalent, it’s good to reference how similar businesses in other industries have been targeted. In May of 2019 nearly 5 million user records were accessed by an unauthorized third party, exposing PII and partial payment card information.  

Taking Action 

On an organizational level, employee training, password hygiene and malware protection are some of the basic and most important steps that should be taken by all organizations. But, if “knowledge is power,” the best defense for any organization against cyber threats is a well-informed organization- including leadership down to the front-line employees. Excellent tools to assist in this are Information Sharing & Analysis Centers/Organizations (ISACs/ISAOs). ISACs were established under a presidential directive in 1998 to enable critical infrastructure owners and operators to share cyber threat information and best practices. The National Council of ISACs currently has over 20 member ISACs including Real Estate, Water, Automotive and Energy. ISAOs were created by a 2015 executive order to encourage cyber threat information sharing within private industry sectors that fall outside of those listed as “critical infrastructure”. Christy Coffey, vice president of operations at the Maritime and Port Security ISAO (MPS-ISAO) says information sharing enabled by the executive order is critical. “We need to accelerate private sector information sharing, and I believe that the ISAO is the vehicle.”

According to Michael Echols, CEO of the International Association of Certified ISAO’s (IACI) at the Kennedy Space Center, security experts have long understood that threat information sharing can allow for better situational awareness and help organizations better identify common threats and ways to address them. “On the other side, hackers in a very documented way are already teaming up and sharing information on new approaches and opportunities to bring more value (to their efforts).” The ongoing crisis surrounding the Microsoft Exchange Server Vulnerability demonstrates that different cybercriminal groups will work simultaneously to abuse system flaws. As of March 5^th it was reported that at least 30,000 organizations in the U.S. – and hundreds of thousands worldwide – have backdoors installed which makes them vulnerable to future attacks, including ransomware.

Below are several links to recent products that have been shared by various ISACs/ISAOs, which are provided as an example of the type of information that is commonly shared via these organizations.

If organizations are interested in learning more about enhancing their cybersecurity resiliency through private-sector led information sharing, please reach out to the newly formed Cannabis ISAO at info@cannabisisao.org.

If the headline looks familiar, well, that’s because it is.

Cannabis lounges, where patrons can smoke a joint, rip a bong, vaporize a dab or do just about anything else you can think of with the plant, appeared to be a certainty as part of a Las Vegas ordinance back in 2017—and then again in 2019. They’ve been talked about for over four years in the entertainment capital of America.

But this time around, after years of setbacks and political meddling from the rival gaming industry, a bill at the Nevada State Legislature is on track to settle the score once and for all.

Assembly Bill 341 would pave the way for an unlimited number of lounges to open across the state, in counties where local governments allow cannabis businesses to operate. That includes in Sin City, where over 40 million tourists visited each year before the COVID-19 pandemic.

“This would really open the floodgates for something marijuana users have wanted for a long time,” said Assemblyman Steve Yeager, a Democrat from Las Vegas who sponsored the bill. “And there’s a social equity part to it where we’re not restricting this just to licensed dispensary owners.”

Yeager, in his third term at the state’s biennial legislature, has felt the frustration himself. Long considered the heir apparent to former State Sen. Tick Segerblom, who was known as Nevada’s “Godfather of Marijuana,” Yeager watched as the fledgling industry offered all of its spoils to a tiny group of anointed business owners, most of whom were lawyers, doctors, casino operators, lobbyists and former public officials.

Less than 100 groups control almost all of the industry, as the state capped dispensary licenses from the adult-use program’s inception in 2017.  Many of the companies are also vertically integrated, meaning dispensary owners also hold the lion’s share of production and cultivation permits. Disproportionately left out have been women and racial minorities, the latter group of which was most harmed by cannabis prohibition.

The new bill runs so contrary to the state’s years of meticulously restricting licenses and hand-picking operators that many dispensary owners are wondering if opening a lounge is even worth the investment.

“You have to figure out if you can make any money with them,” said David Goldwater, owner of Inyo, a dispensary located just over a mile from the Las Vegas Strip. “There’s going to be a ton of new competition.”

Goldwater, whose shop was one of the first dispensaries to open back in 2015, said he has no plans to open a lounge right away.

But those who plan to roll the dice on a new lounge say they plan to carve out a niche for themselves to survive. It’s not much different than other businesses in Sin City, which rely on gimmicks, glitz and glamor to earn visitors’ dollars.

Lissa Lawatch, general manager at Oasis Cannabis, is preparing a beach-themed lounge in hopes of luring tourists from the Strip a block away. Similar to the world-famous “beach clubs” found at a slew of neighboring resorts, the 4,000-square-foot cannabis lounge—set for an adjacent room next to the Oasis retail floor—plans to offer guests “a paradise in the desert.” That means live music, beach balls and seashell décor, among other tropical amenities.

“We’re going for a place that’s super chill so people can connect with their own vacation,” Lawatch said.

Anyone who buys cannabis at Oasis will be able to use the lounge, though Lawatch and company haven’t yet determined a time limit for their guests. Most prospective lounge owners plan to offer either a paid membership plan, where people can visit as often as they’d like, or a one-time entry with product purchases at the dispensary.

To make money, Oasis’ lounge will likely have a cover charge and rental fees for customers to use bongs and other paraphernalia, Lawatch said. Oasis also plans to cap the amount of time customers can hang out, so they’re not intoxicated when they hit the road.

“There’d have to be a limit, I mean, they even put limits on sushi bars,” she said. “You have to find a way to make sure people aren’t driving home roasted.”

Oasis is one of the few Vegas cannabis businesses located near the Strip. It opened in 2015 and was grandfathered through a 2017 regulation that banned cannabis companies from opening within 1,000 feet of a casino. Most other dispensaries are miles away from the famed Las Vegas Boulevard and consider at least 85% of their clientele to be locals.

Off-Strip dispensary reps believe lounges will be their golden ticket to finally reeling in more out-of-towners. Locals can legally smoke inside a private residence as long as they own it or have permission from their landlords. But tourists still have nowhere to go.

Instead of trying to discreetly consume in their rental cars, hotel rooms or on the street, visitors will opt for the peace and comfort of a legal consumption venue, the reps have said. The lounges will also benefit people in apartment complexes or housing where owners don’t allow cannabis.

“At its core this is a bill to decriminalize marijuana use in the state,” said Chris Anderson, a government relations rep for the Apothecary Shoppe dispensary in central Vegas. “The current bans can be seen as a form of discrimination against folks that have less means.”

The Apothecary Shoppe’s lobby resembles that of a quaint hotel, complete with tall wood-grain desks and formally dressed attendants to serve its guests. Fancy menu booklets, like those found at gourmet Italian restaurants, rest on the desks underneath bright reading lamps.

Instead of checking people into a resort, though, the uniformed budtenders offer their recommendations for marijuana products. The dispensary plans to offer a similar visitor experience for its planned on-site consumption lounge if A.B. 341 gets the nod from state officials.

In the increasingly unlikely event that the bill doesn’t pass, the Silver State already has one small lounge open. The Las Vegas Paiute Tribe, playing by its own set of rules that allow it to bypass state law, has operated a small “tasting room” inside its mega-dispensary on tribal land for a couple years. There, customers can try 0.3-gram blunts of flower, take a bong rip or inhale a single dab.

It’s just a sample of what’s to come, though, if state officials can be taken at their word.

What is the role of the Quality Control (QC) Laboratory?

The Quality Control (QC) laboratory serves as one of the most critical functions in consumer product manufacturing. The QC laboratory has the final say on product release based on adherence to established product specifications. Specifications establish a set of criteria to which a product should conform to be considered acceptable for its intended use. Specifications are proposed, justified and approved as part of an overall strategy to ensure the quality, safety, and consistency of consumer products. Subsequently, the quality of consumer products is determined by design, development, Good Manufacturing Practice (GMP) controls, product and process validations, and the specifications applied throughout product development and manufacturing. These specifications are specifically the validated test methods and procedures and the established acceptance criteria for product release and throughout shelf life/stability studies.

The Code of Federal Regulations, 21 CFR Part 211, Good Manufacturing Practice for Finished Pharmaceuticals, provides the minimum requirements for the manufacture of safe products that are consumed by humans or animals. More specifically, 21 CFR Part 211: Subpart I-Laboratory Controls, outlines the requirements and expectations for the quality control laboratory and drug product testing. Additionally, 21 CFR Part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food: Subpart B-Processes and Controls states that appropriate QC operations must be implemented to ensure food products are safe for consumption and food packing materials and components are safe and fit for purpose. Both food and drug products must be tested against established specifications to verify quality and safety, and laboratory operations must have the appropriate processes and procedures to support and defend testing results.

ISO/IEC 17025, General Requirements for the Competence of Testing and Calibration Laboratories is used to develop and implement laboratory management systems. Originally known as ISO/IEC Guide 25, first released in 1978, ISO/IEC 17025 was created with the belief that “third party certification systems [for laboratories] should, to the extent possible, be based on internationally agreed standards and procedures”⁷. National accreditation bodies are responsible for accrediting laboratories to ISO/IEC 17025. Accreditation bodies are responsible for assessing the quality system and technical aspects of a laboratory’s Quality Management System (QMS) to determine compliance to the requirements of ISO/IEC 17025. ISO/IEC 17025 accreditation is pursued by many laboratories as a way to set them apart from competitors. In some cannabis markets accreditation to the standard is mandatory.

The approach to ISO/IEC 17025 accreditation is typically summarizing the standard requirements through the use of a checklist. Documentation is requested and reviewed to determine if what is provided satisfies the item listed on the checklist, which correlate directly to the requirements of the standard. ISO/IEC 17025 covers the requirements for both testing and calibration laboratories. Due to the wide range of testing laboratories, the standard cannot and should not be overly specific on how a laboratory would meet defined requirements. The objective of any laboratory seeking accreditation is to demonstrate they have an established QMS. Equally as critical, for product testing laboratories in particular, is the objective to establish GxP, “good practices”, to ensure test methods and laboratory operations verify product safety and quality. ISO/IEC 17025 provides the baseline, but compliance to Good Laboratory Practice (GLP), Good Manufacturing Practice (GMP) and even Good Safety Practices (GSP) are essential for cannabis testing laboratories to be successful and demonstrate testing data is reliable and accurate.

Where ISO/IEC 17025 accreditation falls short

Adherence to ISO/IEC 17025, and subsequently receiving accreditation, is an excellent way to ensure laboratories have put forth the effort to establish a QMS. However, for product testing laboratories specifically there are a number of “gaps” within the standard and the accreditation process. Below are my “Top Five” that I believe have the greatest impact on a cannabis testing laboratory’s ability to maintain compliance and consistency, verify data integrity and robust testing methods, and ensure the safety of laboratory personnel.

Standard Operating Procedures (SOPs)

The understanding of what qualifies as a Standard Operating Procedure (SOP) is often misunderstood by cannabis operators. An SOP is a stand-alone set of step-by-step instructions which allow workers to consistently carry out routine operations, and documented training on SOPs confirms an employee’s comprehension of their job tasks. Although not required per the current version of the standard, many laboratories develop a Quality Manual (QM). A QM defines an organization’s Quality Policy, Quality Objectives, QMS, and the procedures which support the QMS. It is not an uncommon practice for cannabis laboratories to use the QM as the repository for their “procedures”. The intent of a QM is to be a high-level operations policy document. The QM is NOT a step-by-step procedure, or at least it shouldn’t be.

Test Method Transfer (TMT)

Some cannabis laboratories develop their own test methods, but a common practice in many cannabis laboratories is to purchase equipment from vendors that provide “validated” test methods. Laboratories purchase equipment, install equipment with pre-loaded methods and jump in to testing products. There is no formal verification (what is known as a Test Method Transfer (TMT)) by the laboratory to demonstrate the method validated by the vendor on the vendor’s equipment, with the vendor’s technicians, using the vendor’s standards and reagents, performs the same and generates “valid” results when the method is run on their own equipment, with their own technician(s), and using their own standards and reagents. When discrepancies or variances in results are identified (most likely the result of an inadequate TMT), changes to test methods may be made with no justification or data to support the change, and the subsequent method becomes the “validated” method used for final release testing. The standard requires the laboratory to utilize “validated” methods. Most laboratories can easily provide documentation to meet that requirement. However, there is no verification that the process of either validating in house methods or transferring methods from a vendor were developed using any standard guidance on test method validation to confirm the methods are accurate, precise, robust and repeatable. Subsequently, there is no requirement to define, document, and justify changes to test methods. These requirements are mentioned in ISO/IEC 17025, Step 7.2.2, Validation of Methods, but they are written as “Notes” and not as actual necessities for accreditation acceptance.

Change Control

The standard speaks to identifying “changes” in documents and authorizing changes made to software but the standard, and subsequently the accreditation criteria, is loose on the requirement of a Change Control process and procedure as part of the QMS. The laboratory is not offered any clear instruction of how to manage change control, including specific requirements for making changes to procedures and/or test methods, documented justification of those changes, and the identification of individuals authorized to approve those changes.

Out of Specification (OOS) results

The documentation and management of Out of Specification (OOS) testing results is perhaps one of the most critical liabilities witnessed for cannabis testing laboratories. The standard requires a procedure for “Nonconforming Work”. There is no mention of requiring a root cause investigation, no requirement to document actions, and most importantly there is no requirement to document a retesting plan, including justification for retesting. “Testing into compliance”, as this practice is commonly referred to, was ruled unacceptable by the FDA in the highly publicized 1993 court case United States vs. Barr Laboratories.

Laboratory Safety

Safe laboratory practices are not addressed at all in ISO/IEC 17025. A “Culture of Safety” (as defined by the Occupational Safety and Health Administration (OSHA)) is lacking in most cannabis laboratories. Policies and procedures should be established to define required Personal Protective Equipment (PPE), the safe handling of hazardous materials and spills, and a posted evacuation plan in the event of an emergency. Gas chromatography (GC) is a common test method utilized in an analytical testing laboratory. GC instrumentation requires the use of compressed gas which is commonly supplied in gas cylinders. Proper handling, operation and storage of gas cylinders must be defined. A Preventative Maintenance (PM) schedule should be established for eye wash stations, safety showers and fire extinguishers. Finally, Safety Data Sheets (SDSs) should be printed and maintained as reference for laboratory personnel.

ISO/IEC 17025 accreditation provides an added level of trust, respect and confidence in the eyes of regulators and consumers. However, the current process of accreditation misses the mark on the establishment of GxP, “good practices” into laboratory operations. Based on my experience, there has been some leniency given to cannabis testing laboratories seeking accreditation as they are “new” to standards implementation. In my opinion, this is doing cannabis testing laboratories a disservice and setting them up for failure on future accreditations and potential regulatory inspections. It is essential to provide cannabis testing laboratory owners and operators the proper guidance from the beginning and hold them up to the same rigor and scrutiny as other consumer product testing laboratories. Setting the precedence up front drives uniformity, compliance and standardization into an industry that desperately needs it.

---

References:

1. 21 Code of Federal Regulations (CFR) Part 211- Good Manufacturing Practice for Finished Pharmaceuticals.
2. 21 Code of Federal Regulations (CFR) Part 117;Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food: Subpart B-Processes and Controls.
3. ICH Q7 Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients; Laboratory Controls.
4. World Health Organization (WHO).
5. International Building Code (IBC).
6. International Fire Code (IFC).
7. National Fire Protection Association (NFPA).
8. Occupational Safety and Health Administration; Laboratories.
9. ASTM D8244-21; Standard Guide for Analytical Operations Supporting the Cannabis/Hemp Industry.
10. org; ISO/IEC 17025.

Destigmatizing and legalizing cannabis are certainly positives for the industry, but it’s not just an increase in retail sales fueling the sector’s boom. Venture capital investors and businesses formerly agnostic (or even opposed to cannabis) now are pouring money into the industry, fueling much of the growth. With that, many long-term cannabis (and hemp) entrepreneurs are looking to parlay their experience and expertise in the field into profitable businesses.

The entrance of big money into the industry certainly provides a solid jumping-off point for businesses that partner with investors to increase profitability and valuation. However, it could also come back to haunt the seasoned cannabis entrepreneur who enters into a partnership without fully understanding the terms of the agreement.

This is why it is imperative for industry veterans to know how they can protect their stake in a business at the beginning of a new venture and avoid potentially expensive and time-consuming legal battles down the road, should things turn sour.

The strategies presented here can be effective in protecting your stake in a developing business, but remember that big money investors often have a “take-it-or-leave-it” mentality. However, that doesn’t mean a venture capital investor holds all of the power and leverage in the negotiation just because he or she is putting up money. Without your unique skill, product, process or experience—whatever forms the base of the business and sets it apart from competitors—the investment opportunity wouldn’t exist in the first place. If you are critical to the success of the business, you have leverage to steer the deal or walk away if the terms aren’t beneficial to you.

Document Early

When you’re in the early stages of building a business, it’s easy to get caught up in the euphoria of the new possibilities and future success of your new venture. While developing a vision in collaboration with new teammates and investors, there is not as much desire to pause the momentum and ask difficult but important questions like:

• How will we make management decisions?
• How much of this venture do I own, and how much do my partners own?
• How would we deal with potential disputes between partners?
• How would my interests be protected if:
• The venture just muddles along or is a bust?
• Everything goes as planned and the business is a moderate success?
• You hit a home run and your founder’s shares are worth millions?

 That’s why it’s essential to put the terms of the business relationship on paper early, so expectations are clear and there are no misunderstandings or surprises in the future. You should start documenting once you’ve found your core business partners, even if you don’t have all of your investors on board yet.

Have a lawyer on your side—especially when dealing with investors

Finding a business-savvy lawyer to represent your interests can be critical early in the process, especially when dealing with outside investors or venture capitalists. A competent attorney can ensure the correct information is documented from the outset, draft operating agreements (more on that below) and can make sure your voice is heard in negotiations and business proceedings.

An operating agreement defines member’s rights

An operating agreement, sometimes called a shareholder or partnership agreement, is an essential document that defines members’ rights and lays out a framework of operations for events that could render parties in the business unable to continue working together. Think of it as a prenup for a business, intended to protect all parties if things go wrong or a member wants to leave the business. It can prepare the business for events such as:

Someone wants to amicably leave the business—what happens to their shares?

• The business is booming and new investors want to buy in;
• Majority partners want to sell the business;
• Partners disagree on key management decisions or how to run the business.

 If you’re a cannabis industry veteran, you more than likely have expertise on the product itself—whether growing it, selling it, studying it, or manufacturing secondary products like concentrates and edibles. But if you’re seated at the table with investors looking to pump their money into the venture, you want to make sure you are maximizing your return on your years of work—not to mention legal risk—associated with working in the cannabis industry during the bumpy road toward more widespread legalization.

How to protect your stake as a minority shareholder

If you’re dealing with angel investors, chances are that you will be a minority shareholder, meaning you will own less than 50% of the shares or interest in the company. While you may not own the bulk of the company as a minority shareholder, don’t be quick to sign an agreement that diminishes your rights. Remember to take advantage of the leverage you hold as a cornerstone of the business by including provisions in the operating agreement that protect your rights and stake in the company.

For that reason, you should identify in the operating agreement the types of business decisions that will require consent by a supermajority of shareholders. Supermajority votes are recommended for decisions that affect the trajectory of the business, such as selling the company, liquidating assets, appointing management, spending a certain amount of money or taking on a certain amount of debt. If, for example, you are one of several minority shareholders who share ownership with an angel investor who owns 65% of the company, delineating decisions that require a supermajority vote ensures the angel investor can’t commandeer the business or make decisions that inequitably benefit him or her over the minority shareholders. 

Tag-along rights, also known as co-sale rights, are another provision to consider including in the agreement. If a majority shareholder decides to sell his or her shares, tag-along rights give minority shareholders the right to join the transaction and sell their shares along with the majority shareholder at the same price. Tag-along rights ensure the shares of minority partners are as liquid as those of their majority partners. Angel investors and venture capitalists, who tend to be well-connected businesspeople, may have an easier time selling hundreds of thousands or millions of dollars’ worth of shares than a boots-on-the-ground minority shareholder.

Conversely, drag-along rights give power to majority shareholders to force minority shareholders to sell their stock if the majority shareholders enter into a sale. Drag-along rights prevent minority shareholders from blocking the sale of a company, but also entitle them to the same terms of sale and conditions as the majority shareholder. Drag-along rights tend to favor majority shareholders and can eliminate 100% of minority shareholders in the event of a sale.

Buyout provisions can also protect minority investors by setting a valuation equation or identifying a neutral valuation expert to establish a fair way for buyout terms to be decided. For example, if a majority shareholder wants to buy out your 15% ownership in a company, but you believe those shares will be worth more in the future, a pre-negotiated valuation equation can determine how much your shares might be worth down the line. If you’re being forced to sell while the company is growing, a valuation equation could allow you to capitalize on the growth of the company and improve the price per share you’ll receive.

Vesting

In some cases, the operating agreement will dictate that minority shareholders receive their shares in the company on a vesting schedule, meaning the shareholder does not fully realize the full rights and benefits of the shares until certain conditions are met, such as remaining with the business for a certain period of time. We often see vesting provisions where certain business partners are providing “sweat equity” (i.e., their time, services or expertise) as opposed to monetary investments. Vesting schedules can be set up to allot a set percentage of shares over months, quarters or years, depending on the agreement. Minority shareholders will benefit from vesting schedules that vest more shares up front or on a more frequent basis.

“Cliff vesting,” where a larger percentage of shares vest all at once after a longer period of time (typically a year), requires the shareholder to stay at the company for a set time period before he or she will fully realize his or her shareholder rights. A typical “cliff vesting” clause provides that 25% of the allotted shares vest after the first year, with the remaining shares vesting over the next three years in equal monthly tranches. This arrangement tends to benefit majority shareholders because it gives them the potential opportunity to push out minority members before a significant portion of their shares have vested.

To protect against this scenario, minority shareholders should consider including a provision setting forth that if the minority member is pushed out of the operation of the business, his or her shares will continue to vest on schedule so long as he or she was terminated without cause or separated for good reason. Conversely, if the member is terminated for cause or leaves without good reason, he or she loses his or her unvested shares.

“Cause” is typically a defined term in the agreement and will often include “bad” behavior such as: the conviction of a felony, a breach of fiduciary duty, misconduct causing harm to the company or willful failure to perform substantial duties. The company should tailor this list to conduct that best suits its needs. 

Similarly, a “good reason” clause provides pre-negotiated situations that are considered acceptable withdrawals from the company that would also trigger vesting or accelerate the vesting schedule. “Good reasons” should be negotiated in the operating agreement and could include:

• Being asked to relocate more than 50 miles from your home;
• Substantial reduction in compensation;
• Substantial reduction in responsibilities or authority.

Remember that the efficacy of the protective measures laid out here depend on the negotiated terms in the operating agreement. You may not be able to convince all parties to agree to all of these provisions, but retaining a lawyer will ensure that you understand your rights before a dispute arises and will increase the likelihood that provisions that are protective of minority members make it into the final agreement.