If You Have Only Protected Your Cannabis Business Using the Minimum Security Required by Law, YOU ARE NOT SECURE

This year has been filled with what has been termed peaceful protests. Unfortunately, the reality is these peaceful protests have left an undetermined amount of damage in their wakes sure to total tens of billions of dollars across the U.S. Many businesses have been damaged and looted with no rhyme nor reason as to the type of business. Certainly, the criminal elements have taken advantage of this and have targeted businesses with eyes on a specific booty including cannabis.

The Oregon Liquor Control Commission, the agency that oversees recreational cannabis in Oregon, says that more than 60 weed shops reported losses between May and July, 2020. Many dispensaries were broken into multiple times. Civil unrest that led to windows being broken and product stolen from inside, known as smash and grabs, and looting has become commonplace. Who could have predicted the civil unrest that has spread across the country and who would have thought to mitigate against it?

Admittedly, civil unrest is generally something that is considered a hazard to mitigate against in major cities and metropolises but not in suburbs and industrial areas. To this point though, how many dispensary owners had a qualified security consultant conduct a risk assessment including hazard vulnerabilities on their proposed site location? And, if an assessment were conducted, how many dispensary owners didn’t take the advice of the security consultant’s assessment and instead decided that proposed mitigations were just too expensive?

Speaking from my personal experience as a security consultant to the cannabis industry, very few cannabis organizations take the time and spend the money to implement appropriate security measures beyond any that are specifically required by governing rules and regulations. Every proposal I send out to an organization looking to me to provide security consulting services and author their security plan and content for permitting or licensing applications contains a risk assessment of the site as a starting point. Any security consultant worth their fee will base the security plan according to individual site risks and established security standards and guidelines in addition to applicable rules and regulations. Protecting your cannabis business according to the minimum security required by law will not protect your business very well in most instances. Every state has its own set of rules and many of those have been cut and pasted from other states. There is not one single state I am aware of whose rules for physical security requirements are enough to ensure the security of the dispensary. As there is still currently much unrest in Portland today, let’s look at the security requirements for Oregon cannabis dispensaries.

Although Oregon was the first state to decriminalize possession of small amounts of marijuana in 1973, retail sale of medical marijuana was not approved until 2012. Two years later, in 2014, voters said yes to legal marijuana and recreational dispensaries opened in the first half of 2016. Medical marijuana is regulated by the Oregon Heath Authority and recreational marijuana is regulated by the Oregon Liquor Control Commission. The rules with regard to security are basically identical between medical and recreational dispensaries and are lacking with regard to “usual and customary” security elements and practices as can be found in security standards and guidelines.

The definitions section of the rules (OAR 333-008-0010) define “safe” as:

• A metal receptacle with a locking mechanism capable of storing all marijuana items on a licensed premises that:
  • Is rendered immobile by being securely anchored to a permanent structure of an enclosed area; or
  • Weighs more than 750 pounds.
• A “vault”; or
• A refrigerator or freezer capable of being locked for storing marijuana items that require cold storage that:
  • Is rendered immobile by being securely anchored to a permanent structure of an enclosed area; or
  • Weighs more than 750 pounds.

The General Requirements for Medical Processing Sites and Dispensaries: Security Requirements section of the rules has one line referring to safes in order for an organization to be registered and remain registered:

Have a safe or vault as those terms are defined in OAR 333-008-0010  for the purpose of securing all marijuana items as required by these rules, except that a registered processing site may keep all usable marijuana, cut and drying mature marijuana plants, cannabinoid concentrates, extracts or products on the premise in a secure area.

OAR 333-008-0010 defines “secure area” to mean a room:

• With doors that are kept locked and closed at all times except when the doors are in use;
• Where access is only permitted as authorized in these rules; and
• Not visible from outside the room or within public view.

The definition section states:

“Vault” means an enclosed area that is constructed of steel-reinforced or block concrete and has a door that contains a multiple-position combination lock or the equivalent, a relocking device or equivalent, and a steel plate with a thickness of at least one-half inch.

Both the definitions of “vault” and “safe” leave a lot to be desired and are incomplete. Cannabis is listed as a schedule I drug by the DEA. The DEA requires the storage of small quantities of schedule I drugs in one of the following secured areas:

• Where small quantities permit, a safe or steel cabinet;
• Which safe or steel cabinet shall have the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques;
• Which safe or steel cabinet, if it weighs less than 750 pounds, is bolted or cemented to the floor or wall in such a way that it cannot be readily removed; and
• Which safe or steel cabinet, if necessary, depending upon the quantities and type of controlled substances stored, is equipped with an alarm system which, upon attempted unauthorized entry, shall transmit a signal directly to a central protection company or a local or State police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve.
• a vault constructed before, or under construction on, September 1, 1971, which is of substantial construction with a steel door, combination or key lock, and an alarm system; or
• A vault constructed after September 1, 1971:
• The walls, floors and ceilings of which vault are constructed of at least 8 inches of reinforced concrete or other substantial masonry, reinforced vertically and horizontally with ½-inch steel rods tied 6 inches on center, or the structural equivalent to such reinforced walls, floors, and ceiling;
• The door and frame unit of which vault shall conform to the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 20 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques;
• Which vault, if operations require it to remain open for frequent access, is equipped with a “day-gate” which is self-closing and self-locking, or the equivalent, for use during the hours of operation in which the vault door is open;
• The walls or perimeter of which vault are equipped with an alarm, which upon unauthorized entry shall transmit a signal directly to a central station protection company, or a local or State police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve, and, if necessary, holdup buttons at strategic points of entry to the perimeter area of the vault;
• The door of which vault is equipped with contact switches; and
• Which vault has one of the following: Complete electrical lacing of the walls, floor and ceilings; sensitive ultrasonic equipment with the vault; a sensitive sound accumulator system; or such other device designed to detect illegal entry as may be approved by the Administration.

The rules do not define or require anything in particular for doors other than “commercial grade” locks on all perimeter doors or entry doors to the dispensary if located inside another commercial building. No mention is made of commercial grade locks to be used on the doors to “secure areas.” All perimeter doors and windows require intrusion detection alarm devices but no other requirements for perimeter windows are made.

The dispensary owner who implemented security measures required by law for dispensary registration and operations could have implemented many mitigation tactics that may very well have prevented the assailants from entering their dispensary during civil unrest:

WINDOWS:

1. The application of window film designed to protect against attack, can increase the strength of the glass by 300 times the original strength. The film can usually be defeated with multiple repeated attacks, but the time involved to actually breach a window protected with properly installed and anchored window film may be enough that the assailant moves along to an easier target.
2. Installing bars or steel mesh screens over the windows may not be aesthetically pleasing but it certainly would have prevented the average “protestor” from gaining entry.
3. Installing security shutters of either the roll-up type, with horizontal interlocking slats (that are usually made of aluminum or polyvinyl chloride) which roll up into a box at the top of the window; or accordion type, having vertical interlocking slats that slide to the sides of the window. These shutters can be operated electronically or manually. With a little thought, they could be activated to close when an intrusion alarm device is in an alarm state. An attempt to break the window would activate a glass break sensor that, in turn, activates the shutters to close preventing further damage to the window and entry through the window.

DOORS:

1. The storefront entrance door is often a glass door and should be protected the same way as windows.
2. The interior doors to “secure areas” present several vulnerabilities but can be strengthened considerably more than the absence of requirements provided by the law. Solid wood or sturdy hollow metal doors can be covered with metal to strengthen against attack.
3. A door is only as strong as its frame and hinges attaching to the frame. The use of full length hinges, often called piano hinges, make it much more difficult to breach.
4. Filling the door frame with concrete or grout can prevent or delay prying the door open at the latch.
5. Adding steel plates to the door or frame (astragal plates) to protect vulnerable areas or the entire top and latch edge of the door. These plates should be 2 inches wide with a 1 inch overlap between the door and the frame.
6. Although “commercial grade” locks are not required on interior doors (the secure area is an interior door) they should be installed. Use a double-cylinder high security bolt lock.
7. The door to an interior “secure space” can also be protected with a roll down security shutter that is deployed at closing time.

VAULT and SAFES

1. Locate the vault off the perimeter of the building. A vault wall should never be a shared perimeter wall, nor should it be adjacent to or against a perimeter wall.
2. Construct a vault to DEA standards and it is doubtful anyone on a looting venture will breach it. A skateboard or baseball bat will not allow a looter to gain entry to a vault constructed to these standards.
3. Add safes inside the vault as yet another layer of security between the assailant and your cannabis assets.
4. Add refrigerators to the vault to store those concentrates and extracts that require refrigeration. Leaving these items on the sales floor leaves them vulnerable.

As can be seen, the state law and associated rules for physical security requirements for dispensaries should not be the end goal but, rather, should be seen as a starting point for the security plan. There are three things that must simultaneously be present for a crime to occur, often referred to as the Crime Triangle:

All three elements must be together at the same time in order for a crime to occur. Security professionals design security programs to reduce or remove the one element of the triangle that they can most affect: OPPORTUNITY. As has been demonstrated, the state law and associated rules for physical security requirements for dispensaries should not be the end goal but, rather, should be seen as a starting point for the security plan.   The proposed mitigations above and beyond the law and rules are designed to reduce or eliminate the opportunity for crime. They may also reduce an adversary’s ability and desire by increasing the complexity of skills they must possess or plans they must orchestrate in order to succeed at the crime.

A dispensary owner must determine the amount of risk they are acceptable with in the design of their security systems and design their physical security plan to attain that level of risk. Simply following the rules, as demonstrated against Oregon’s rules, will not protect your business nearly as effectively as a plan designed after a proper risk assessment and consideration/application of established security standards and guidelines.