SALEM — Oregon's licensing and tracking systems for recreational marijuana have weaknesses that could let illegal activity to fly under the radar, state auditors say.
The recreational marijuana program also lacks important security measures that could protect sensitive information and IT infrastructure from being compromised, according to an audit released Wednesday, Feb. 7, by the secretary of state's office.
Oregon's Liquor Control Commission regulates the recreational marijuana program, issuing licenses to producers, retailers and others selling marijuana for personal use. The agency also runs the "seed-to-sale" tracking program to track marijuana on its journey to market.
Among other issues auditors found, data in the cannabis tracking system was self-reported by cannabis businesses, raising auditors' concerns about its reliability.
There aren't enough trained compliance inspectors to adequately keep an eye on recreational marijuana activity. And auditors also found that the OLCC lacks an overall IT security management plan for the agency and a disaster recovery plan for its information.
Battling the black market
Wednesday's audit report comes as there's renewed attention on marijuana, especially in states that have legalized the substance. In early January, Attorney General Jeff Sessions issued guidance to U.S. attorneys in states that have legalized marijuana saying they may use their discretion when it comes to prosecuting marijuana cases. Marijuana remains illegal under the federal Controlled Substances Act.
U.S. Attorney for Oregon Billy Williams said last week that Oregon produces far more marijuana than Oregonians can consume, and that product is leaking into the black market.
Oregon voters approved recreational marijuana in a November 2014 ballot measure. Recreational marijuana became legal on July 1, 2015. The popularity of the program is greater than state officials had expected. Through November 2017, the state had collected about $115.5 million in state marijuana taxes since retail sales began in January 2016, according to Wednesday's audit.
OLCC Executive Director Steve Marks wrote in response to the audit that his agency "is actively following up on all aspects of the audit" and wants to get more money to "move forward" on the technology issues raised by the audit.