Freedom Leaf Interview: BiotrackTHC’s Patrick Vo

Seed-to-sale tracking is in the news. MJ Freeway has had numerous calamitous hacks to its systems. But MJ Freeway’s chief competitor, BioTrackTHC, which operates in seven states and Puerto Rico, has not. Credit goes to the Fort Lauderdale-based company’s CEO Patrick Vo and his team of software engineers. He received degrees from the University of Arizona and Indiana University before beginning his corporate career at Price Waterhouse Coopers. After moving to Colorado in 2011, Vo dove into the marijuana industry, and soon was hired by BioTrackTHC. This interview was conducted in March.

On Mar. 8, BioTrack announced it was merging with Helix TCS. Why the merger and why with Helix?

Both companies provide ancillary support products and services to the cannabis licensees, and the shareholders and management of both companies believe that the merger will position both teams to excel. Both organizations will remain distinct business units, and leadership will not change for either team. However, we plan to rationalize common business functions and have each team leverage the knowledge, operational and economic resources of the other to create even more value to the customers that rely on us. All in all, we’re very excited for the potential this merger holds for both companies and look forward to what the future holds.

Where you born and raised?

I was born in Muncie, Indiana. I’m a child of Vietnamese immigrants. That starting point shaped who I am. Woven through all of my choices is the idea that I’m “one of the lucky ones.” There are millions of others who were left behind [during and after the Vietnam War] and didn’t make it out. The greatest tragedy of my life would be to waste it by achieving mediocrity.

What led you to enter the marijuana industry?

I was a nerd when I was younger. Cannabis was something the cool kids did in school, so it was not a part of my growing up. That changed when I moved to Colorado and started working with a physician who provided medical recommendations for cannabis patients. I saw firsthand the positive impact cannabis has on patients with all sorts of conditions. I knew then that cannabis was where I wanted to be.

A few months later, I met BioTrack founders Steven Siegel and T.J. Ferraro and was shown their software. It was just the two of them at the time. I told them: “You created the best cannabis software that no one’s heard of. Let me help you build a company around it.”

The company initially developed prescription-drug monitoring software for the state of Florida in 2009. How did that turn into BioTrackTHC?

The company was founded to develop technology that would prevent medicine from being diverted for non-medical use. The first target was the prescription-opioid epidemic. Around 2009-2010, Colorado cannabis licensees approached us and asked if we could pivot our software for cannabis workflows. With the prescription-drug monitoring software as a foundation, we began designing cannabis-plant and inventory tracking systems based on direct input from cultivators and dispensaries.

VO: “A large-scale crackdown on the cannabis industry would be political suicide.”

How does BioTrackTHC’s seed-to-sale tracking work?

We have two seed-to-sale tracking systems: One is for businesses and the other is for governments to use. Every seed, clone and plant is issued and assigned a unique identifier. That identifier, the associated inventory record, carries information, such as the licensee that has custody of the plant, the plant/strain name, the date it was planted, its growth stage, which employee has interacted with it and so on. Once a plant is harvested, each category of plant material [flower, stems] is assigned its own unique identifier that’s a “child” of the preceding “parent” identifier. The assigning of unique identifiers and connecting new “child” inventory with its “parent” inventory creates a lineage chain from plant to plant material to consumable products. The system can tell any unique identifier’s characteristics and quantity, trace it all the way back to the plant from which it came and follow it to where it and any of its derivative products end up, whether it’s still in inventory, destroyed or sold.

The government version captures all inventory activity throughout an entire state. Not only do the government regulators have visibility over what an individual business reports, they can see products move from one licensee to another, lab-test results and [have] controls in place to prevent malicious and unintentional breaking of the law.

Patrick Vo at a dispensary

What are the advantages and disadvantages of using RFID chips?

In industries where products move through an assembly line and conveyor belts, RFID [Radio Frequency Identification] chips provide an advantage over barcodes by reading through certain lightweight materials and boxes. The theory in our industry is that an RFID reader should be able to scan a tag or a group of tags from a farther distance than reading the tag number with your eyes or using a traditional barcode scanner, thereby decreasing the time it takes to undergo an auditor inspection. However, the RFID was not designed for that application. RFID waves can’t pass through items with high water content. Indoor lights and metal can cause interference with signal reading. Densely lining up tags together may cause “shadowing” where the first tag prevents the tags behind it from being readable. An indoor room with water-filled plants that are densely arranged and surrounded by lights and metal is pretty much the worst environment for this technology.

Many of our customers operate in states that require RFID to tag plants and inventory. The feedback from essentially all of them is that RFID tags are not practical. They’re also for one-time use and cost nearly 50 cents each. In large quantities, this can have a major impact on revenues as well as the environment. To me, their only advantage is the appearance of being high-tech.

Self-reporting is basically an honor system. How do you respond to that concern?

Our platform requires that other parties input data where appropriate, removing many of the potential conflicts that arise from self-reporting. For example, state-recognized laboratories, not the licensees themselves, are responsible for inputting a product’s quality-assurance results, such as potency, microbial screening and pesticide residue, into the government’s system of record. When a licensee ships wholesale product to another licensee, our platform doesn’t automatically assign product custody to the receiving licensee. The product is categorized as “in transit” until the receiving licensee acknowledges in the system whether they’ve taken custody and the product quantity they’re accepting. Any unaccepted product goes back to the sending licensee, and any discrepancies between what was shipped and what was accounted for upon receipt, or that the shipment never made it to the destination, are reflected in one of the system’s many red-flag reports, so the state agency can be alerted and take appropriate action.

VO: “We’re all frustrated with MJ Freeway’s situation. When one team suffers, we all suffer.”

One of your competitors, MJ Freeway, has suffered a number of serious issues. Washington State recently delayed its transition from BioTrackTHC to MJ Freeway’s Leaf Data, leaving the state without a working tracking system. How did that happen?

The original launch date was Nov. 1, and it was delayed until Jan. 1. Then, the system launch was delayed again until Feb. 1. On Feb. 8, the Washington State Liquor and Cannabis Board (LCB) reported that an intruder had gained unauthorized access to the Leaf Data system on Feb. 3, less than 100 hours after the system launched. Transportation route information for wholesale deliveries from Feb. 1-4, as well as transportation vehicle VINs [vehicle identification numbers], license-plate numbers, and vehicle types were downloaded. Though Washington State makes most government data available for public records requests, detailed cannabis transportation information is typically redacted, since knowing which vehicles are transporting tens of thousands of dollars’ worth of product and exactly what routes they’re taking leaves them vulnerable to carjacking and theft.

Prior to the expiration of our contract, Washington State offered us an extension. We didn’t say “no,” but we just couldn’t say “yes” until the security concerns that came to our attention were satisfactorily resolved. We couldn’t risk the security of our own systems and our livelihoods being commingled with MJ Freeway’s system, and so the contract expired.

What led to the delay and subsequent security breach?

With only days until the expected decommissioning of the BioTrack government system, Washington State announced that MJ Freeway’s system would not make the Nov. 1 launch date, and that all licensees would have to report their plant and inventory quantities and activities via manual spreadsheets, something that everyone involved with the industry knew would be devastatingly costly. To make sure that the Washington cannabis industry could survive the “manual spreadsheet era,” we practically cloned our Washington traceability software system overnight and deployed it as a private-sector system, independent of MJ Freeway and the state. Licensees and the majority of our point-of-sale competitors agreed that our Unified Cannabis System (UCS) was the best path forward for the industry. For a small monthly fee to cover the hosting costs of the UCS, nearly all licensees in the state were able to continue reporting to our private UCS system, which then coordinated the chain of custody transfer data between licensees and generated over a million individual spreadsheet files that were automatically submitted to the LCB. It’s not an exaggeration to say that the UCS upheld the Washington industry and automated the reporting for more than 1,600 licensees from Nov. 1 until MJ Freeway’s system finally launched on Feb. 1.

Is MJ Freeway the only company operating in this space that’s been hacked? Why do you suppose that is?

We’re all frustrated with MJ Freeway’s situation. Though we all compete with each other for business, we’re ultimately fighting together to build trust, confidence, credibility and professionalism for the entire industry. When one team suffers, we all suffer.

Patrick Vo speaks at an event.

What is BioTrackTHC doing to make sure that the data you’re processing and storing remains secure?

Because the core of what we do is data—business management data, compliance data, patient/consumer data—system security has always been a top priority. BioTrack utilizes physical cryptographic security keys as well as passwords for multi-factor authentication into critical systems. This means guessing or stealing an employee’s username and password is not enough to gain access. The unique security key must be inserted in the computer’s USB port to successfully log in. Google deployed the same security keys to more than 50,000 Google employees and found they’re incredibly effective.

BioTrack also utilizes a technology that implements the Zero Trust architecture spearheaded by Google. It piggybacks on the security keys using a chained authentication system. Every developer log-in attempt is individually managed and independently tracked. Each log-in is limited in scope and valid for one-time use, and because there are no shared keys or shared developer environments, the ability for a would-be attacker to gain access to the system is dramatically reduced. And even in the highly unlikely event attackers gained access to one system, they couldn’t access other systems.

VO: “Assigning unique identifiers and connecting new ‘child’ inventory with its ‘parent’ inventory creates a lineage chain from plant to plant material to consumable products.”

When seeking state contracts, how does BioTrackTHC stand out from the competition?

Providing business software is one of the greatest values we bring to the table. Building solutions that are informed by how licensed businesses actually operate and incorporating those real-world processes and workflows into an informed government platform sets up both the government and the industry to succeed. With so many new states coming online and the continued growth of the industry, we’ve seen both the good and the bad and can therefore help different governments navigate this new terrain more effectively.

Patrick Vo at his desk

BioTrackTHC is currently operating in Arkansas, Delaware, Hawaii, Illinois, New Mexico, New York, North Dakota and Puerto Rico. What are the different regulations challenges from state to state?

Every state’s cannabis program, and the rules and regulations surrounding it, is unique. Though there are similarities and overlap, they’re all individualized to some extent. Since we’ve developed both a government-grade system and a business-grade system, we possess a robust and diverse array of turnkey software features and workflow options to build a system that can meet the vast majority of a new state’s needs right out of the box. Our team of experienced government-product managers is responsible for understanding all of the relevant cannabis regulations in their assigned states, for monitoring changes to those regulations and for managing the design modifications to the software to meet the needs of those regulatory changes.

An interesting example is Hawaii. The islands of Hawaii are separated by federal waters and federal air space, so though medical cannabis is allowed to move from production facilities to dispensary facilities on the same island, transport to other islands is not allowed. As an added control to make sure that licensees don’t intentionally or unintentionally violate the law, we wrote some code to constrain transportation so that the destination facility must reside on the same island as the originating facility.

A much more complex example is Washington state as it relates to Native American tribes. The tribes within Washington State may operate their own producer, processor and retail facilities that can also participate with the non-tribal Washington cannabis industry. Cannabis inventory can freely move between tribal licensees and non-tribal licensees, but the treatment of cannabis excise taxes creates some interesting dynamics. Tribal retail dispensaries may sell both tribal-grown products and non-tribal products. These tribal retailers are still required to retrieve cannabis excise taxes from the end-consumers in order to not have an unfair advantage over non-tribal retailers. However, those excise taxes are remitted to the tribal government and not to the Washington government because the Washington government has no authority over tribal businesses.

Non-tribal retail dispensaries may sell tribal-grown products in addition to non-tribal products and they too must retrieve cannabis excise taxes for both. However, the Washington government must separately track the excise taxes collected from the sale of tribal products so that the state can remit that portion of the taxes to the tribes.

How’s the medical-marijuana program in Puerto Rico doing?

It was originally supposed to get off the ground right around when Hurricane Maria hit the island in September. However, the cannabis businesses showed some real grit and was integral to restoring the island back to normalcy. Although much of the island is still in need of support and many people are still in horrible situations, there has been a collective push from the industry and the island as a whole to get cannabis businesses up and running because that means jobs, wages and tax revenue that could go towards post-storm recovery. In addition to the overall economic value that the businesses generate, many of the cannabis business owners and staff personally stepped in to help.  It’s been truly inspiring to see how strong the Puerto Rican community is in the face of adversity.

Do you have any concerns about the legal cannabis industry grinding to a halt because of federal intervention?

I’m not very concerned at this point. Popular support for the legal cannabis industry is too large for federal law enforcement to shut it down. [Attorney General] Jeff Sessions and the U.S. Attorneys have to know that a large-scale crackdown on the cannabis industry would be political suicide.

How would you react if a U.S. Attorney showed up at your door one morning with a warrant?

I would say, “Sir, we’re a software company. We don’t sell seeds.” I would attempt to have a respectful and constructive conversation with the U.S. Attorney. Whether he or she is for or against cannabis, society’s acceptance of it is a foregone conclusion. Not everyone is pro-cannabis, but not everyone is pro-alcohol or pro-tobacco either. Even if you don’t agree with the movement, everyone can support technologies that strengthen public safety through facilitating transparency and accountability. If the U.S. Attorney continued to pursue the warrant, then so be it. We’re a part of this industry and will continue to stand up for it.

This article appears in Freedom Leaf 32. If you enjoyed this article, subscribe to the magazine today!

Related Articles

MJ Freeway’s Seed-to-Sale Dilemma

Seed-to-Sale Tracking: How It Works

Ousted MassRoots Founder Gets His Company Back

Pounds Selling for $900 Wholesale in Oregon