Why Security Needs To Be A Priority For Cannabis Business Owners
The legal cannabis industry is poised to take off in the United States. Sales are projected to reach $8 Billion in 2018, and opportunities abound for investors and entrepreneurs. Unfortunately, the same dramatic growth that makes this industry so attractive to legitimate businessmen also makes it attractive to criminals. Along with the growth of the industry has come an explosion in robberies and insider theft.
Robberies to date have targeted mostly dispensaries. One Seattle legal cannabis company, Have a Heart, has experienced ten robberies. In one recent incident thieves used a car to ram down the door to a dispensary and then made off with duffle bags filled with product. Since the company has no liability insurance its losses were taken fully out of pocket.
Earlier this year two robbers knocked over a cannabis dispensary in San Francisco and made off with half a million dollars’ worth of cannabis, edibles and accessories. The robbers spent two hours inside the store filling trash bags that they then hauled off in a large recycling bin.
In Rhode Island recently a twenty-five-year-old heating and air conditioning contractor who had done work in a cannabis cultivation center used the information he had acquired from working at the facility to bypass security systems, break in and steal a large quantity of medical marijuana. Only a portion of what was stolen was ever recovered
Last year Toronto police made arrests of several individuals in a string of high profile, violent robberies. The group had targeted dispensaries across Toronto for months in a series of successful raids.
The threat of criminal activity to cannabis businesses is real, and shows no signs of diminishing.
As significant as the threats faced to date are they are nothing compared to what is coming. Changes in the industry and the dramatically expanding scope of the legal cannabis industry mean that threats are going to multiply and grow in complexity and intensity. Security companies currently involved in the business and staffed primarily by formal local law enforcement officials and military personnel are unlikely to be prepared for what is coming. Alarms and guards alone are going to prove woefully insufficient.
If companies involved in the growing, processing and sale of legal cannabis do not move quickly to enhance the sophistication and scale of their security measures they are going to be caught short. As has happened in so many other industries, security measures are going to continue to be designed and implemented in a vacuum. They will be perceived to be effective and assumed to be sufficient until they are shown to be neither. By then it will be too late.
Cannabis Cyber Crime
An all cash business may seem to be largely immune from many of the cyber threats faced by many businesses today. As many challenges as the use of cash poses to legal cannabis business people, at least it means that earnings and capital are not accessible via the web in the same way that they are in more traditional businesses.
What this focus ignores, however, is the amount of valuable and compromising data that can be accessed remotely via cyber intrusions. For example, most states require strict reporting on production, transportation and sales. The location and status of plants and products is tightly controlled, and all such information is uploaded electronically to ensure the government knows where everything is and where it is going.
That data is a potential goldmine for individuals looking to hit dispensaries, rob delivery vehicles or perpetrate other crimes. Accessing such information may allow the organization and orchestration of robberies that will net takes in the millions of dollars. Given the potential scale of such crimes and the likely sophistication of the cyber-attacks that would be associated with them, off the shelf security and malware detection software is likely to prove woefully insufficient. It is going to take significantly more advanced and more sophisticated security to survive such attacks.
Insider Threat: Loss Prevention For Dispensaries and Growers
The Achilles Heel of any security plan lies in the threat posed by insiders, acting alone or cooperating with broader criminal conspiracies. Even the most robust security protocols are going to be largely rendered meaningless if someone inside is working against you. Unfortunately, most insider threat detection programs are formulaic and inadequate.
Law enforcement personnel and security professionals trained in wiring alarms and hiring guards, have no real background in understanding what makes people betray the companies or organizations for which they work and how to detect them. To the extent they attempt to address insider threat at all they rely upon simplistic, unproven methodologies, which commonly fail to detect real threats and often brand individuals who pose no threat as suspect.
The reality is that the creation of an effective insider threat program requires not only the utilization of top of the line software and hardware but also a mastery of the psychology involved in finding and neutralizing people working against you inside your organization. Security companies working the legal cannabis industry now commonly lack such capabilities. They are focused on simple, well known security measures sufficient under the best of circumstances to stop “smash and grab” thieves but useless in the face of more sophisticated and long-term targeting.
Organized Crime
An expanding industry is good news for people involved in it. More money means more attention from criminals however. It also means the nature of the people targeting the industry is going to change. Street punks looking to rob the till at a dispensary will remain a threat, but much larger, much more capable criminal organizations are going to get into the act as well.
That means that threats are going to become more complex and more dangerous. Organized crime syndicates capable of bringing to bear cutting edge technology, coopting employees with threats and bribes and transporting large quantities of stolen product are going to emerge, likely in the very near future, as a real threat to companies producing and processing significant quantities of cannabis.
The scope of the threat such criminal enterprises pose can hardly be over emphasized. The Sinaloa Cartel in Mexico is so vast that it operates more aircraft than Aero Mexico. It and other organizations regularly dig tunnels hundreds of yards in length under the US-Mexico border and install in them lighting, ventilation and rail systems. When criminal enterprises on this scale begin to turn their attention to the legal cannabis industry, simple alarm systems and retired law enforcement officers working as security guards are not going to be anywhere near sufficient to safeguard operations.
What will be required will be a quantum leap in the sophistication of the security measures employed. Perhaps most importantly, what will be critical will be robust red team exercises to ensure that holes in security and lapses in vigilance are identified prior to catastrophic losses and not afterward.
Overseas Environment
The legal cannabis industry is exploding in the United States and Canada. As it does so, however, it is taking on a truly international dimension. Exports to Europe have already begun and are likely to expand dramatically in the near future.
As American and Canadian businessmen involved with legal cannabis begin to operate abroad the nature and complexity of the security threats they face will morph. Assumptions that may be valid here about the scope and type of the threats faced will not be valid abroad. New and previously unknown dangers, such as those associated with foreign police and intelligence organizations thoroughly compromised by the Mafia and other criminal enterprises, will emerge. Security built around assumptions valid here in North America will prove useless abroad.
American corporations working abroad have long since recognized the necessity to employ security consultants with experience overseas and backgrounds in working with foreign security services. Legal cannabis companies are going to discover the same thing. The guys who can put up a fence and install alarms on your grow site in Pennsylvania are not going to be any help to you in preventing your container filled with legal cannabis products from going missing on the docks in Genoa.
Time for Dispensaries To Improve Their Security
In short, the game is changing.
What has been a low-key “Mom and Pop” industry is becoming one in which businesses making a billion dollars a year will be operating on a scale previously unknown.
What has sufficed, barely, for security to date will provide grossly inadequate in the very near future.
The challenge for legal cannabis businesses will be to upgrade their security in scale and complexity rapidly enough to head off catastrophic losses at the hands of thieves determined to steal hard earned profits.
