Traceability FAQ Subtopics (links)
Post-Implementation, Feb. 1
Information about the Leaf Data Systems Malicious Intrusion
The Washington State Liquor and Cannabis Board (WSLCB) reported Feb. 8 that the online marijuana traceability system was disrupted after a computer vulnerability was exploited on Saturday Feb. 3, 2018. The exploitation allowed an intruder unauthorized access to the system, which is maintained on servers managed by a vendor, MJ Freeway.
What did the intruder get or do?
State officials say there are indications a copy of the traceability database was taken. The security incident also disrupted inventory transfer data for some users. This is one root cause of the transfer/manifest disruptions experienced between Feb.–Feb. 5. The vulnerability that led to the incident has been corrected.
When was the intrusion realized?
The state’s vendor, MJ Freeway, became aware of the transfer abnormality on Feb. 3. The company immediately began a review and identified it as a potential security incident on Feb. 5. MJ Freeway immediately notified the WSLCB. The WSLCB then contacted the Washington State Office of CyberSecurity (OCS) which examined the data taken to determine if it contained personally identifiable information, PII.
No Personally Identifiable Information Released
The OCS review, completed Feb. 7, found no PII, such as names or social security numbers in the data provided by the vendor. However, out of caution, the WSLCB notified licensees of the incident.
What was determined in the review by the Office of CyberSecurity?
Both MJ Freeway and the Office of CyberSecurity determined that no personally identifiable information was obtained in the intrusion. The information captured is absent of information that would require WSLCB to initiate protections for licensees.
What exactly was obtained through the intrusion?
The following information was accessed during the incident:
Route information of manifests filed between Feb. 1 and 4, 2018.
Transporter vehicle information including VIN, license plate number and vehicle type. The database does not include driver or driver license information.
With the exception of the manifest data all the information obtained via the intrusion is publicly available. The WSLCB already responds to requests for publicly available records per the state’s public records law
As a licensee, what do I need to do?
Since no personally identifiable information was released, you do not need to do anything at this time. It’s good practice, however, to review your transport plans and take any appropriate steps you feel necessary for your business.
I have experienced long waits with Leaf Support and my issue is not resolved. Will the customer service be improved?
When Leaf Data Systems was implemented on February 1, a large number of licensees called Leaf Support while trying to access Leaf for the first time or to get assistance with retrieving API keys to share with their third party software providers. MJ Freeway has doubled their customer service staff to handle the demands.
Please note that if you have already contacted Leaf Support, a ticket has been logged. If you call or email about the same issue again, this will result in an additional ticket being logged, which may slow the Customer Support process. MJ Freeway is working as quickly as possible to address logged tickets and assist licensees with issues.
Is everything that is happening with the new Traceability system unanticipated? Can further testing by the LCB resolve the problems licensees are having with Leaf Data Systems?
Several contributing factors have caused issues for licensees and third party software integrators accessing Leaf Data Systems. These include an overly compressed project timeline that was further complicated by unanticipated delays, the expected occurrence of bugs during a software implementation and the malicious intrusion on February 3.
WSLCB and MJ Freeway are working diligently to prioritize and resolve identified issues, and have scheduled releases for updating Leaf Data Systems to streamline the user experience. All new code is thoroughly tested, with the exception of emergency deployments to fix crucial functions.
How many system updates or releases are scheduled for Leaf Data Systems?
At this time, there are five planned releases, which are scheduled to be complete by July 1, 2018.
My third party software provider has rejected orders. This is creating a work stoppage.
WSLCB has not instructed any business or software provider to reject orders.
Many retailers are not accepting product. This also is creating a work stoppage.
Retailers may have been leery about accepting product due to the transfer/manifest issue that was creating confusion. Email communication went out about this on February 7. Retailers may accept product when the product manifest has new Leaf Global ID numbers. The Leaf Global ID numbers will link to Contingency ID numbers or Old Traceability ID numbers from the legacy system used prior to the Contingency Period.
Retailers should know that WSLCB Enforcement has shared with all officers that retailers do not need to refuse product because of the new Leaf Global ID numbers on manifests.
How many known bugs are there in the Leaf Data Systems software? How many of these are critical? What is the repair timeline?
There are approximately 150 known and documented bugs in the software system at this time. Any bugs that were critical and blocked workflow (stopping product from moving through the supply chain) were resolved before Leaf Data Systems was implemented on February 1. If a reasonable workaround was identified for a bug, the bug may still be under repair. Bugs are identified and prioritized using a severity scale, with Severity 1 being the most critical, and Severity 4 being low. Bugs with the highest severity levels are always addressed first.
Severity 1 – Critical: deems system inoperable
Severity 2 – High: affects accuracy of production data and/or inhibits the ability for compliance with reporting requirements. Does not deem system inoperable, but disrupts normal business operations.
Severity 3 – Medium: Data is accurate, system is usable but not functioning as designed.
Severity 4 – Low: A cosmetic deficiency, such as a spelling error or color irregularity that doesn’t affect system functionality
It’s rumored the API (application programming interface) is not working for third party integrators. How and when will this problem be resolved, since many licensees use a third party software system?
At this time, third party integrators should not be experiencing issues with the API. WSLCB and MJ Freeway will continue to resolve any issues as they are identified, in a prioritized order.
There is currently no training available for labs. Why not?
A webinar was recorded for labs on Administrative Setup, Inventory Management, and Lab Results. This link is available on the Leaf Training for Licensees page. WSLCB has contacted MJ Freeway about creating more training materials for labs.
Some of the training modules posted on the Leaf Training for Licensees page are not current and have errors. Will these be refreshed?
MJ Freeway is in the process of reworking the “Introductory Webinars on Leaf Data Systems: An Overview” series. Until the updates are made, the older videos will remain posted.
Additionally, there are a variety of newer webinar recordings on this page that have been produced for specific license types.
Is it true I have to relabel all of my plants or products?
No. You don’t need to relabel your entire physical inventory.
When product is electronically entered into the Leaf system, it will have the old contingency number, or possibly even the legacy system identification number physically on it. We do not expect licensees to relabel all of their product/plants with new numbers. Instead, it is expected that new numbers are physically attached as soon as actions such as conversions, harvest, or lotting are made.
Licensees may transfer and receive product with the contingency or historic numbers still physically attached to the product. For example, retailers do not need to physically relabel their inventory, and processors sending packaged end product to retailers do not need to physically relabel all their product prior to sending it.
It is expected that the historic IDs are linked to the new Leaf IDs by the third party software system or licensee entering the Contingency ID or Old Traceability ID into the “Contingency / Old Traceability” field into Leaf Data Systems when inventory is uploaded.
Because this only applies to product that is being uploaded as initial Leaf inventory, this exception will only apply to those items that existed prior to implementation of Leaf Data Systems.
What is being done to improve communications with licensees? The LCB keeps telling licensees to go to the website. Why aren’t more real time updates provided?
WSLCB acknowledges there are always struggles with using listserv communications method. The email list that makes up the licensee bulk distribution was extracted from the legacy system shortly before it was decommissioned. Once all licensees have become active in Leaf Data Systems, WSLCB will be able to extract current email addresses of all Leaf Users and use this for distribution of messages. The website is updated as frequently as possible, and is the best place to seek the most current information available. WSLCB makes every effort to add new information to the website in a timely fashion.
What are the deadlines for transitioning plants and inventory into Leaf Data Systems?
To help ease licensee transition to Leaf, we’re extending the deadline for transferring plants and inventory into Leaf until February 28. The previous deadline was February 15, 2018. The QA results deadline has been extended to March 15, 2018. The previous deadline was February 28.
Why is the LCB transitioning the traceability system so fast?
The contract with the current vendor ended on October 31, 2017. Currently we are operating using a Contingency Plan. The new traceability system will go live February 1, 2018.
How long will the Contingency Plan be in effect?
WSLCB completed a thorough analysis of the tasks and reviews ahead. The Contingency Plan will be in effect November 1, 2017 through January 31, 2018. The new Leaf system will go live February 1, 2018.
Did the LCB try to pursue a contract extension to ensure that the new platform is ready?
Yes. Due to the compressed time frame, the LCB sought a contract extension for approximately the past year. This project has been under an aggressive, compressed timeline since it began. Despite our efforts to reach a contract extension, the previous vendor ultimately did not respond to our generous financial offer for a four-month extension.
When will LCB transition from the current Marijuana Traceability System to Leaf Data Systems and how long will it take?
The previous traceability system stopped functioning at 11:59 p.m. on October 31, 2017. The new Leaf system will be implemented February 1, 2018. During the timespan between the previous system ceasing operation and the new Leaf system being implemented, licensees are required to provide traceability data by using the contingency operations plan.
What business activities can occur during contingency operations as the transition to the Leaf system occurs?
Licensees should conduct business as normal during this time frame. Licensees must keep records of all traceability activities that occur during contingency operations. Licensees must input current plant and inventory data into the new Leaf Data System when it goes live.
How long will the Contingency Plan be in effect? When will the new Leaf system be implemented?
The Contingency Plan was implemented November 1, 2017 and will be in effect until January 31, 2018. The new Leaf system will be implemented February 1, 2018. If there are any changes, the website will be updated. WSLCB is doing everything possible to keep the central system downtime to a minimum while ensuring there is sufficient time to complete development and testing to deploy a stable, reliable traceability application.
If a licensee has a current license but is not currently operational, what are the reporting requirements?
If you have an active license, you are required to report during the Contingency Period. If you have no activity, report that.
What if some random stranger on the internet uploads data via the contingency website?
Any suspicious data that is uploaded will automatically be quarantined, analyzed and reviewed.
Is there any way to get a complete data dump of all the KPI’s in the reporting module of the legacy system?
The reporting functionality doesn’t allow for a single complete .csv export. BioTrack THC offered a 72-hour window for read-only access of your information. The window began at 12:00 a.m. November 1, 2017.
How will I be able to find my original parent lots to put into the spreadsheet when I need to harvest or create samples for testing?
As a licensee, you are responsible for your own inventory management. BioTrack THC offered a 72-hour window which began at 12:00 a.m. November 1, 2017 for read-only access to review your data. The regulatory system is not an inventory management system.
How will transfers work? Will third party software systems support this process?
You will need to report transfer information on a daily basis via the Manifest webform (found on the Traceability Reporting page). During the Contingency Period, WSLCB will automatically generate manifest numbers and populate them onto completed manifests. For public safety reasons, the route will not be entered on the web form. You will need to hand-print the route on the manifest prior to transfer. The 24-hour quarantine period begins when the Manifest webform is submitted. You may print the manifest form, or use third
party software manifest output to accompany shipments.
What data will I have to reenter after the Contingency Period is over and the new Leaf system is live?
You will only need to enter current plant and inventory data into the new Leaf system after it is live. If you have a third party commercial software system, it is possible your software provider can facilitate this process. Please contact your third party provider directly to learn more.
What data do I have to report and when do I need to report it?
You need to report all of the same information that is already required to be collected and reported under current rules and regulations. All information that needs to be reported, along with instructions, can be found on the WSLCB website.
Transfer and Destruction events must be reported as they occur. When WSLCB receives Transfer and Destruction forms is when quarantine periods begin for each activity. All other traceability information must be reported weekly, and tax/sales information is required to be reported monthly.
Forms for all reporting activities can be found at the Traceability Reporting page.
What are my record keeping requirements while the Contingency Plan is in effect?
You need to continue to collect and retain records as usual. If you are unsure of what to collect and retain, refer to current WAC requirements. Traceability records must be kept and maintained on the licensed premises for a three-year period and must be made available for inspection if requested by an employee of the WSLCB (WAC 314-55-087).
What is the required file format for uploading data during the Contingency Period?
The accepted file formats for uploading reporting data are .xls and .xlsx (Excel).
Does the reporting have to be done on Sunday by 11:59 p.m., or can we pick a day every week and do it when it is more convenient?
The weekly reporting period runs from 12:00 a.m. Monday through 11:59 p.m. Sunday evening. You should report accordingly.
For weekly reporting - “Retailer licensees will update the “Retailer Weekly Traceability Data Sheet” by close of business each day, and upload a new sheet containing their reportable transactions once every Sunday by 11:59 p.m.” Is this report to include that Sunday as well, or just the Saturday before? What is the day span?
The span of the week runs from Monday at 12:00 a.m. to Sunday at 11:59 p.m.
We work a Monday through Friday schedule. Will it be okay to submit our reports on Friday if we have no reportable work for Saturday or Sunday? And if so, I assume that I would date my submission for the Friday date not Sunday?
Yes, you may submit your reports on Friday if your business is closed on Saturday and Sunday.
When should I submit my retail sales spreadsheets?
For daily sales, submit your spreadsheets each week by 11:59 p.m. Sunday. For monthly sales/tax reporting, submit your information by the 20th of the following month.
Do the sales sheets need to be sent every night before 11:59 p.m.? Does this need to include all new inventory we have received, including samples, etc.?
You need to submit sales on a weekly basis.
During the Contingency Plan Reporting Webinar there was a review of making adjustments as a producer/processor. It was also mentioned that only transactions would be recorded, and not inventory. Given the spreadsheet recording process, at what point would an adjustment be made if we are not tracking inventory?
While you are not submitting your inventory during the Contingency Period, you are responsible for tracking your inventory. If you need to make an adjustment to your inventory, use the Adjustment tab in the Producer/Processor Reporting spreadsheet.
In the Retailer Weekly Traceability Data Sheet under “total price”, is “total price” the price to consumer before adding all taxes?
Yes, “total price” is the price to the consumer before adding any taxes.
Will you accept weekly reporting forms with formulas or other edits in them as long as all required information is included?
Yes. You may add formulas, but you may not add new columns or macros.
As a producer, how do I sell plants to medical patients using the state provided spreadsheets?
All plant sales to medical patients from a producer will be entered into the state spreadsheets during contingency as an adjustment.
Open the Producer/Processor spreadsheet
Click on the "Adjustments" tab
Enter in License #, use the plant ID for "Unique 16 digit ID," enter the Adjustment Date, and type "Plant" for the Inventory Type. Under "Quantity Lost/gained" enter "-1" to indicate the plant is being deducted. Under "Adjustment reason" a new designation is present called "Medical Sale." Please enter "Medical Sale" as the Adjustment Reason. Add any further information you would like under "Additional Explanation."
As a Producer/Processor what do I do if other licensees refuse to do business with me because I don't use third party software?
This is entirely up to licensees. The LCB cannot mandate which businesses a licensee works with. While licensees can choose to work only with businesses who use a third party integrator, they do have the option of contacting their integrator to see if there is a way for them to input the information from the manifest into their system. They also have the option to work with the Contingency Plan Excel spreadsheets, reporting the transfer on the “Received Transfers” tab and tracking the product and sales manually.
If I currently have each variety of plant in a room, how do I harvest the entire room? Should I use a group or batch of plants?
Each separate variety of plants in a room must be logged individually.
Do clones go under the new plant tab or conversions tab?
Per state regulation, a clone is not a plant until it is 8” tall. However, during the Contingency Period, if you purchase clones you should record them on the tab labeled "Recieved Transfers" in the reporting spreadsheet for producer/processors. If you create a new clone, record this on the "Coversions" tab.
Where should I report the creation of new inventory such as clones or seeds?
You shoud report creation of new inventory such as clones or seeds on the tab labeled “Conversions” in the reporting spreadsheet for producer/processors. When the clones or seeds have reached 8" in height or width, they are considered to be plants and then you will then need to record them on the "New Plants" tab of this spreadsheet.
During the Contingency Plan Reporting Webinar, I thought I heard Peter say that products going out to two different stores can have the same 16 digit ID. For instance, if Fudgey Brownies (2 Pack) are going to two different stores, they can have the same 16 digit ID. Is this correct as opposed to before, where everything had to have a separate ID? Also, I think I also heard him say that because of this, products don't have to be sublotted. Is there still a way to record sublotting if I want to do so?
Yes, this is correct. Products do not need to be sublotted during the Contingency Period. You may sublot and record for yourself during this time if you wish, though.
Will the parent lot numbers be available for our current cultivation and inventory or will we need to create new ones?
You may use the numbers generated by the legacy system.
How do I account for sublotting activities/events on the Contingency Reporting spreadsheets?
You are not required to report sublot tracking during the Contingency Period.
I need more details on how you want sublotting to be done in Traceability with the Contingency Plan. There is no sublotting during the Contingency Plan. For example, if you made a batch of 60 solid edibles and wanted to sell 30 of them to one retailer, you would use the same Inventory ID number as the original 60. The 30 you are sending to the retailer can be tracked back to the original batch of 60 because it is the same number. If I do not have any new plants, harvests, conversions, etc. do I have to put N/A under all of the tabs or am I able to jut submit it blank?
There is no need to put N/A, just leave them blank.
How do you want us to report vendor and educational samples to retail stores?
This is addressed on the spreadsheets. Just log them in.
We do not use a third-party software. How should we report the moving of plants from room to room?
During contingency, moving plants from room to room are not reported.
How do I produce bar codes during the Contingency Period?
There is no barcode generating option in the contingency plan. A variety of free bar code generators can be found on the internet. You can choose one that meets your needs. When the new Leaf system is implemented, bar code generation will be included in the software.
How do I generate unique plant/product IDs?
WSLCB has decided to keep the 16-digit format that uses the license number for the first 6-digits, with digits 7-16 reflecting batches. This will be for both plants and inventory.
To enter your first plant into the Contingency Spreadsheet (found on the Traceability Reporting page), start with number 1, and count up from there.
The 16-digit format can be broken down like this: LLLLLL000000000 (LLLLLL=license number and 000000000 = batch number)
I notice that you have asked us to use the first 6 digits of our license number in the creation of new product IDs, but then I notice that there are actually many products from the old system that start with the first six digits of our UBI, not our license number. Can you please clarify?
During the Contingency Period, please use your license number for the creation of new product IDs. Refer to the Traceability Reporting page for directions.
During the Contingency Plan Reporting Webinar, the host used the same global ID’s in various places. Wouldn’t this cause a conflict? Are we supposed to keep track of all global ID’s to make sure they are never duplicated? How do we make sure every ID created is unique?
No, for the Contingency Period using a global ID in more than one place will not cause a conflict. If you follow the system outlined for creating unique ID’s, your reporting will be fine.
When sending to the LCB, do we name the sheet with UBI-yearmonthdate? For example: 60337270220171031 if it was for October 31, 2017?
This is correct.
Is there going to be some sort of Unique ID number check/stop on the spreadsheets to prevent us from adding the same NEW number to a plant or inventory items on different sheets?
No, you are responsible for adding unique ID numbers correctly.
My question is regarding generating 16 digit numbers. During the example shown during the webinar, we watched the same number being generated more than once in different tabs. We watched the user start with the license number, 9 zeros and then 1, continuing on to 2, etc… This was done on tabs referencing completely different products but as far as was shown, there is no part of that 16 digit number that references the type of product. The user during the webinar did this very obviously with no explanation or warning not to which leads me to believe that it will be acceptable to the WSLCB if I have the same 16 digit reference number for a plant, a concentrate lot, AND a sample.
No, the same number cannot be used for a plant, a concentrate lot and a sample.
The Harvest spreadsheet allows you to enter the plant ID and weight gathered, but where are the new product IDs? What barcode do we put on the waste, flower lot and trim?
This was corrected in the updated spreadsheet that was posted on November 2, 2017.
Manifest and Destruction Reporting
How do I report destruction events?
You will need to report destruction information as it occurs. Please see the Destruction reporting form (found on the Traceability Reporting page) for details. The 72-hour quarantine period begins with submission of the destruction form.
As a retail store, I am concerned about the manifests. Will producer/processors be emailing retailers a file of the order on the manifest so that we don’t need to manually enter every single item?
Manifests automatically generate an email. On the email will be a freeform list of the items included in the order/shipment. You can work directly with the producer/processors you purchase goods from and third party software integrators (if you use a third party system) for detailed lists.
For plant/waste destruction, after the 72 hour period do we need to submit another form once product is destroyed?
No. The assumption will be that you have destroyed what you documented. However, if you void a destruction, you will need to resubmit.
On the receiving end of a manifest, regardless of whether or not a 3rd party processor has their own manifest template for customers to use, do we ALL need to use the manifest feature via the LCB website? In other words, as a retailer, should we only receive manifests that have come via the manifest email system through the LCB?
No, you are able to receive manifests that are generated through third party software systems.
In the "destruction spreadsheet" you entered one ID number and there was not an attachment to a spreadsheet that you went over with us, as you did with the "manifest" form. So, when we are destroying waste from multiple plants (for example) will we be completing a submission for each plant or be chaining together plants with commas?
You may chain together plants, separated by commas.
With regard to manifest and destruction portions of the procedures, on the webinar it showed the web form method. If we have a third party software system we use for will they be able to file the manifests and destruction notifications on our behalf?
Yes, third party software providers can file your manifest and destruction reporting during the Contingency Period.
What happens to manifests I create today?
Wait 24 hours and then release.
I know we have to submit manifests through an online form but do we have to release them? What happens to manifests I create today? What happens to destruction? Do I have to click destroy again once the 72 hours are up?
No, you don't have to release manifests. After the 24 hour manifest period you may begin moving your products. All manifests created beginning November 1, 2017 are subject to Contingency Reporting guidelines. After the 72 hour destruction period, it is assumed you will have destroyed what you reported.
What happens to destruction? Do I have to click destroy again once the 72 hours are up?
How do I fix a manifest? How do I delete a line item or adjust a quantity? How can I change the driver if I need to? What do I do with a manifest if the customer rejects the shipment?
If you make an error on a manifest, you need to start it over. If you change the vehicle, you will need to start over. You may change the driver on a manifest, but please note it in the free form text and reference the original manifest number. If a customer rejects a shipment, notate REJECTED on the manifest and send it back with the product. If the product has already been dropped off and the driver has left, you will need to report a product return and generate a new manifest for the return.
How can you correct a manifest?
To correct a manifest during contingency, simply create a new one.
On October 31st I built a manifest for items to be sent to a processor on the next day. November 1st we delivered the items successfully with the manifests and invoices. The issue I am having is that he is not able to view the items in his 3rd party system to receive them. They need to be able to do this to remain in compliance and to be able to start processing our products, so I was wondering if there was an extra step I needed to take during the contingency period to release items from a manifest to another licensee?
The short answer is “no,” there are no extra steps. You may release after 24 hour hold.
What are my tax reporting obligations while the Contingency Plan is in effect?
Retail licensees are required to submit tax information as usual on a monthly basis. For specifics on tax reporting, visit the FAQs on Taxes page. Producer/Processors do not have tax reporting obligations.
Is it required to report October’s monthly Tax Reporting on the new Tax Reporting form?
Yes, unless you use a third party software system.
During the Contingency Plan Reporting Webinar you entered 10-31-17 as the "reporting period" for producer/processor sales, then changed it to 11-18-17 (which would appear to be a "date submitted" not a "reporting period.") Since we will all be entering our October 2017 reporting period before 11:59 pm November 20, 2017: what date should we be entering in "reporting period?"
For sales completed in one month (such as October 1-October 31) report sales by the 20th of the following month.
How do I confirm my report?
If you are referencing tax reporting, please review the Tax Reporting page.
Please refer to the Tax Reporting links on the contingency plan page.