This year has been filled with what has been termed peaceful protests. Unfortunately, the reality is these peaceful protests have left an undetermined amount of damage in their wakes sure to total tens of billions of dollars across the U.S. Many businesses have been damaged and looted with no rhyme nor reason as to the type of business. Certainly, the criminal elements have taken advantage of this and have targeted businesses with eyes on a specific booty including cannabis.
The Oregon Liquor Control Commission, the agency that oversees recreational cannabis in Oregon, says that more than 60 weed shops reported losses between May and July, 2020. Many dispensaries were broken into multiple times. Civil unrest that led to windows being broken and product stolen from inside, known as smash and grabs, and looting has become commonplace. Who could have predicted the civil unrest that has spread across the country and who would have thought to mitigate against it?
Admittedly, civil unrest is generally something that is considered a hazard to mitigate against in major cities and metropolises but not in suburbs and industrial areas. To this point though, how many dispensary owners had a qualified security consultant conduct a risk assessment including hazard vulnerabilities on their proposed site location? And, if an assessment were conducted, how many dispensary owners didn’t take the advice of the security consultant’s assessment and instead decided that proposed mitigations were just too expensive?
Speaking from my personal experience as a security consultant to the cannabis industry, very few cannabis organizations take the time and spend the money to implement appropriate security measures beyond any that are specifically required by governing rules and regulations. Every proposal I send out to an organization looking to me to provide security consulting services and author their security plan and content for permitting or licensing applications contains a risk assessment of the site as a starting point. Any security consultant worth their fee will base the security plan according to individual site risks and established security standards and guidelines in addition to applicable rules and regulations. Protecting your cannabis business according to the minimum security required by law will not protect your business very well in most instances. Every state has its own set of rules and many of those have been cut and pasted from other states. There is not one single state I am aware of whose rules for physical security requirements are enough to ensure the security of the dispensary. As there is still currently much unrest in Portland today, let’s look at the security requirements for Oregon cannabis dispensaries.
Although Oregon was the first state to decriminalize possession of small amounts of marijuana in 1973, retail sale of medical marijuana was not approved until 2012. Two years later, in 2014, voters said yes to legal marijuana and recreational dispensaries opened in the first half of 2016. Medical marijuana is regulated by the Oregon Heath Authority and recreational marijuana is regulated by the Oregon Liquor Control Commission. The rules with regard to security are basically identical between medical and recreational dispensaries and are lacking with regard to “usual and customary” security elements and practices as can be found in security standards and guidelines.
The definitions section of the rules (OAR 333-008-0010) define “safe” as:
The General Requirements for Medical Processing Sites and Dispensaries: Security Requirements section of the rules has one line referring to safes in order for an organization to be registered and remain registered:
Have a safe or vault as those terms are defined in OAR 333-008-0010 for the purpose of securing all marijuana items as required by these rules, except that a registered processing site may keep all usable marijuana, cut and drying mature marijuana plants, cannabinoid concentrates, extracts or products on the premise in a secure area.
OAR 333-008-0010 defines “secure area” to mean a room:
The definition section states:
“Vault” means an enclosed area that is constructed of steel-reinforced or block concrete and has a door that contains a multiple-position combination lock or the equivalent, a relocking device or equivalent, and a steel plate with a thickness of at least one-half inch.
Both the definitions of “vault” and “safe” leave a lot to be desired and are incomplete. Cannabis is listed as a schedule I drug by the DEA. The DEA requires the storage of small quantities of schedule I drugs in one of the following secured areas:
The rules do not define or require anything in particular for doors other than “commercial grade” locks on all perimeter doors or entry doors to the dispensary if located inside another commercial building. No mention is made of commercial grade locks to be used on the doors to “secure areas.” All perimeter doors and windows require intrusion detection alarm devices but no other requirements for perimeter windows are made.
The dispensary owner who implemented security measures required by law for dispensary registration and operations could have implemented many mitigation tactics that may very well have prevented the assailants from entering their dispensary during civil unrest:
WINDOWS:
DOORS:
VAULT and SAFES
As can be seen, the state law and associated rules for physical security requirements for dispensaries should not be the end goal but, rather, should be seen as a starting point for the security plan. There are three things that must simultaneously be present for a crime to occur, often referred to as the Crime Triangle:
All three elements must be together at the same time in order for a crime to occur. Security professionals design security programs to reduce or remove the one element of the triangle that they can most affect: OPPORTUNITY. As has been demonstrated, the state law and associated rules for physical security requirements for dispensaries should not be the end goal but, rather, should be seen as a starting point for the security plan. The proposed mitigations above and beyond the law and rules are designed to reduce or eliminate the opportunity for crime. They may also reduce an adversary’s ability and desire by increasing the complexity of skills they must possess or plans they must orchestrate in order to succeed at the crime.
A dispensary owner must determine the amount of risk they are acceptable with in the design of their security systems and design their physical security plan to attain that level of risk. Simply following the rules, as demonstrated against Oregon’s rules, will not protect your business nearly as effectively as a plan designed after a proper risk assessment and consideration/application of established security standards and guidelines.
Tim Sutton is considered the most qualified cannabis security expert in consulting. With nearly 35 years of security management experience across several industries including boots-on-the-ground experience within the cannabis industry as security director for two Illinois-based MSOs and triple security board certification, he has been the cannabis industry’s go to security consultant since 2013. His expertise includes operational security management, program development, loss prevention, physical security, risk assessments, and technical security systems design and implementation. Tim is a Director on the ASIS International Professional Standards Board, and a member of the ASTM International D37 Committee on Cannabis Standards.
Sutton has spoken at a number of cannabis industry events covering security subject matter. He first entered the cannabis industry as a security consultant when he authored security content for the extremely competitive Illinois permit application process winning two cultivation permits and three dispensary permits. After winning five IL permits, Mr. Sutton has provided security consulting services and authored consistently winning security plans and content for applications and operations in multiple states.
In addition to operational security director roles within the cannabis industry, Mr. Sutton has worked as a hospital security director, manufacturing facility security coordinator, and retail director of loss prevention and security. He also has held several positions within a security integrator operation including account executive, senior systems engineer, and licensee in charge and today provides security technology plans for multiple industries.
Your email address will not be published. Required fields are marked *
Name *
Email *
Website
Save my name, email, and website in this browser for the next time I comment.
Comment *
Notify me of follow-up comments by email.
Notify me of new posts by email.
Δ
Saturday marks marijuana culture’s high holiday, 4/20, when college students gather — at 4:20 p.m. — in clouds of smoke on campus quads and pot shops in legal-weed states thank…
The state budget that’s expected to be adopted in the coming days calls for repealing the potency tax on marijuana products as well as new regulations intended to give local municipalities, including…
SEATTLE (AP) — Saturday marks marijuana culture’s high holiday, 4/20, when college students gather — at 4:20 p.m. — in clouds of smoke on campus quads and pot shops in…
Significant adjustments have been made to Connecticut House Bill No. 5150, the omnibus cannabis/hemp legislation that is waiting to be taken up by the full House. An amended version of…