Laying the Foundation: Security by Design for the Marijuana Marketplace

Since 2015, my employer—Kroll—has aided in designing and implementing security systems, as well as developing security programs, for clients in the cannabis space. We have assisted clients who are successfully operating medical and recreational cannabis dispensaries in the U.S. states of Arizona, California, Massachusetts, Missouri, Nevada, New Jersey, and Pennsylvania, and our team in Canada provides due diligence background investigations on behalf of Canadian authorities as part of government licensing programs.

As more states allow for the legal sale of cannabis, some of the initial struggle of gaining support from communities has eased slightly. And as more facilities have opened, communities have learned that they are not the neighborhood nuisance that many people first imagined. Images of customers exiting the facilities smoking their purchase as underage teenagers beg them for product in the parking lot never became reality. The expected rise in the level of crime and disorder did not only not occur as predicted, but in fact many of these facilities have had a positive impact on crime.

Cannabis companies have—and can—lose their license and entire investment for employee misconduct.

Kroll has conducted crime assessments in and around numerous licensed cannabis facilities and discovered that the use of the facility, the utilization of security technology, and security staffing have led to a significant reduction in crime in the area.

However, this does not mean that cannabis companies can ease up on security operations. They must employ compliance programs that ensure they continue to provide a good customer experience while keeping customers, staff, and their product safe. Most facilities have dozens of cameras that are capturing everything they view 24 hours a day, 365 days a year. Any security program needs to ensure that there is an auditing program of camera video before any incident or issue. While cannabis company owners promise that they will take every measure needed to ensure safety and compliance with local regulations, often times employees may take short cuts and not follow the policies and procedures as required. A compliance program that proactively reviews camera video to ensure folks are following the rules can keep a client out of harm’s way with regulators. Unlike a bar or a night club that may get shut down for a night or issued a small fine for serving minors, cannabis companies have—and can—lose their license and entire investment for employee misconduct.

When the industry first became legalized at the state level in the United States, there were burglaries and home invasions targeting the owners of cannabis facilities. This was initially due to the fact that banking systems could not support cannabis companies, so owners were keeping large amounts of cash in their homes. The dispensaries, however, were relatively free of robberies or other incidents. From a safety and security lens, our team at Kroll recommends facility designs that utilize controlled access into and within the building to deter strong armed robberies. A facility with a higher level of deterrence against crime is a less desirable target than those with a lower level of deterrence.

Local zoning rules seeking to limit public queue lines and clients’ desires to have a welcoming open floor plan require a balancing act as the industry has grown. Local state charted banks and credit unions, along with technology, have diminished the need for owners to keep cash in their mattresses. We have seen an uptick in armed robbery events at cannabis facilities that may swing the pendulum back towards secure man traps at entry points to further deter access by unwanted persons. For example, a recent event at a Shoreline, Washington, cannabis dispensary resulted in a clerk being shot six times.

While facilities are designed with the latest in access control programs, artificial intelligence enabled video surveillance systems, and biometric enabled devices, there is still a need to get back to the basics of conducting staff safety and security training, including training staff on de-escalation techniques and how to respond to a robbery.

Many facilities have installed panic buttons, but never properly trained staff how to utilize them. Most armed robberies result in a nervous and paranoid suspect interacting with a terrified staff member and last 60 to 90 seconds without escalating to a physical assault. A staff member fumbling for a panic alarm switch may escalate the interaction—resulting in violence. We train our clients’ teams to cooperate fully with the subject’s demands and to not utilize the duress button until the subject has exited the building. This strategy limits the chance of employees’ actions triggering an assault while also allowing for the notification of local law enforcement as soon as possible because traumatized staff may be incapable of quickly dialing 911 and providing a location.

A staff member fumbling for a panic alarm switch may escalate the interaction—resulting in violence.

An armed subject who finds themselves trapped inside a facility with customers and employees as police respond to the robbery alarm is a nightmare situation to be avoided at all costs. If a subject has already engaged in actual physical assault, however, then staff should immediately hit the panic button because we often see situations like this become more violent.

Key facility security characteristics that should be considered include:

• The floor plan layout can affect the level of vulnerability for the facility. Often, floor plans are designed to optimize space utilization and a welcoming environment, which may increase vulnerability for crime. Floor plans should be reviewed by a security expert at the early stages of development to reduce vulnerabilities.
  
  
• The facility floor plan also drives the extent of security technology required. Obstructive floor plan layouts typically require additional cameras and intrusion detectors compared to more open layouts.
  
  
• Sensitive areas (e.g., product vaults, security equipment rooms, etc.) located along perimeter walls may provide an intruder with a means of penetrating their walls and taking product or damaging security equipment without detection, especially if product storage or equipment racks are located along those walls. Where possible, locate sensitive areas within protected space--requiring an intruder to first enter areas with intrusion detection before gaining access to sensitive areas.
  
  
• Implement robust physical hardening measures for doors, windows, skylights, and sensitive area/room walls and ceilings to significantly increase deterrence against intrusion, making the facility a less desirable target. A client facility that implemented minimal hardening experienced an intrusion which resulted in theft of all cannabis products on hand, significant vandalism, and losses due to being closed until repairs could be made. The cost to install additional hardening measures was much less than the losses they incurred.
  
  
• Some U.S. states permit alternatives to their physical and technological security requirements and typically require a request for a waiver to be submitted to the regulatory agency for review and approval, if accepted. When providing an alternative solution, submit the proper forms to the regulatory agency as soon as the alternative measure is decided. Many of our clients in one state have been able to successfully waive a requirement for two separate intrusion alarm systems from two separate (non-affiliated) security vendors by having one intrusion alarm system that utilizes two or more methods of communication to a central monitoring station. Implementing an alternative security solution without prior approval can result in a delayed opening and additional cost to bring the security measures into compliance.
  
  
• Security systems are often required to have hours of runtime for the security systems during a power failure. An uninterruptible power supply (UPS) with 30 to 60 minutes of runtime backed up by a generator is optimal. If a generator is not provided, ensure there is ample room, structural support, and dedicated power for the UPS. For example, one cannabis client had a moderate size facility without a backup generator in a state requiring a four-hour security system runtime on backup power. Their UPS required a dedicated equipment rack, a 50-Amp 208/240 VAC power circuit and a floor structure that would support its 2,000+ pound weight. Ensure your security system requirements are properly coordinated and accommodated as early as possible before implementation.
  
  
• Many dispensary operators unlock their entry door during business hours to promote a welcoming environment, which also enables threatening persons to enter without restriction. While these doors could be kept locked and only unlocked for vetted persons, an unwanted person could follow a vetted person through the door while it’s unlocked. To effectively deter unwanted or threatening persons from entering, especially in high-risk locations, install mantraps or vestibules with interlocking doors at public entrances and exits that are controlled by security personnel or staff monitoring the door. An unwanted person may still be able to follow a vetted person through the outer door, the inner door can remain locked, preventing the unwanted person entering.
  
  
• Doors into and within cannabis facilities should be controlled using access cards, rather than keys or keypad codes. Keys can be duplicated, and rekeying doors due to a lost or stolen key can be costly. Keypad codes can be easily shared or seen being entered by others to gain access. Access cards issued to each authorized person can be immediately disabled anytime a person ends employment or a card is lost or stolen—minimizing opportunities for unauthorized access.
  
  
• Cameras should be positioned to provide viewing and recording of required areas from multiple angles and enable identification of all persons as they enter and leave the facility. This reduces the likelihood of an employee or customer from being able to turn away from a lone camera to hide his or her identity and/or unwanted activity. While fewer cameras reduce cost, not being able to clearly view and record people and unwanted activity may prevent identifying a culprit and cause needless issues with regulators.
  
  
• State regulations typically require operators to report any security system failures when they occur and may require staff and/or security personnel to remain onsite until repaired. Security equipment from well-established manufacturers installed by a quality security vendor typically provides greater reliability—reducing the number of failures that must be reported and scrutinized by the regulatory agency.
  
  
• States may require routine testing of the security systems. Establish a compliant testing schedule with your security vendor and ensure they have the capability of making necessary repairs while onsite or within regulatory time frames. This will minimize downtime inconvenience and regulatory compliance issues.

Providing safety and security to clients in the cannabis space needs to blend the introduction of the latest smart security technology with the basics of security facility design utilizing the concepts of crime prevention through environmental design (CPTED). As with all security programing, as risks and threats change the security program needs to adapt to meet challenges as they evolve.

Daniel Linskey is the managing director, head of the Boston Office, for Kroll.

Roy Parks, CPP, PSP, is a senior manager in Kroll's Security Risk Management practice, based in Washington, D.C. Parks has more than 44 years of experience in strategic planning and development of physical, operational, and technical security solutions. In addition to the cannabis industry, his projext experience spans aviation/transportation, corporate and financial, health care, education, communications, utility/energy, oil/petroleum, government/military, mixed-use/multi-tenant campuses and high-rise properties, hospitality, museums, and executive/exclusive residential projects.

© Kroll and Associates