What Is Going On? Is There Currently A Contract … There Currently A Contract Extension On The...

3101 N Federal Hwy www.biotrack.com T: 800.797.4711 Fort Lauderdale, FL 33306 F: 954.206.0200

AnOpenLetterTotheStateofWashingtonCannabisIndustry

October26,2017

DearWashingtonCannabisIndustry,IwritetoyoutodaywiththesincerehopethatIcancutthroughmuchofthenoiseandrumorofthelastfewdayswithsome transparency so you canmake informed decisions as business owners and sowe can come together for theforwardprogressoftheindustry.BeforeIwriteanythingelse,IwanttoemphasizethefactthatWashington’scannabisindustryisincrediblyimportanttoBioTrack.Itwasourfirstgovernmentcontract.TJFerraro–BioTrack’sfounder–andIlivedinWashingtonforthethreemonths it tooktocustomizeandimplementtheoriginal traceabilitysystem. More licenseesuseourbusinessplatform inWashington than in any other state. We have an office in Olympia, and nine BioTrack employees callWashingtonhome.Manyofyouareourfriends.Ifyoutakeawaynothingelsefromthisletter,pleaseknowthatyouareimportanttousandweremaincommittedtodoingeverythinginourpowertomakeyousuccessful.Ratherthanaskyoutoblindlybelievemynarrativeoversomeoneelse’s,theactualemailssentfrommetotheWSLCBareattachedtotheendofthislettersoyoucanverifythefactsandjudgeforyourself.TheseemailsareavailableviapublicrecordsrequestsoIamnotsharinganythingthatwouldn’talreadybeavailableforpublicinspection.

WhatIsGoingOn?BioTrackTHC’s traceability systemcontractwith theWSLCBexpiresonOctober31st,2017unless it is extended. Amoredetailedchainofeventsisprovidedlater,buttheshortstoryisthattheWSLCBinitiallychosetonotextendourcontractbeyondOctober31,2017,andMJFreewaywasselectedtoprovideareplacementsystemthatwas to takeoverbythetimeoursystemistobedecommissioned,atmidnightonOctober31st.ItwasrecentlyannouncedbytheWSLCBthatthereplacementsystemwillnotbeoperational intime,and licenseeswillhavetoreporttheirseed-to-saletraceabilitydataviamanualspreadsheetsfortwomonthsuntilthereplacementsystem’supdatedgo-livedateofJanuary2, 2018 assuming everythingmoving forward remainson schedule. Thesemanual spreadsheets are tobeused for tracking all plant, harvest, inventory, conversion, sample, laboratory testing, transportation/chain-of-custody,andsalesdataforaslongastheWSLCB’scontingencyplanisinplace.

IsThereCurrentlyAContractExtensionOnTheTableBetweenTheWSLCBAndBioTrackTHC?The WSLCB sent to BioTrack terms for an extension last Tuesday, October 17th. This was the first offer for anextensionthattheWSLCBhasofferedBioTracksinceMJFreewaywasawardedtheircontractinJuly,andremainsasthecurrentofferonthetable.TheWSLCBofferedBioTrackafourmonthextensionfor$125,000,or$31,250permonth.Toputthisofferincontext,overthefour-yearlifeofthecontract,BioTrackdidnotearnmaintenanceandsupportfeesfor the first two years and earned $180,000 per year ($15,000 permonth) for the past two years. TheWSLCB’sextensionofferisa$16,000permonthpremiumoverthestandardrate.TheWSLCB’scontractwiththenewvendoris$600,000peryear,or$50,000permonth.


PermyemailtotheWSLCBonThursday,October19th(see“Exhibit2”),BioTrackdidNOTdeclinetheWSLCB’sofferfor extension. However, BioTrack requires resolution on security concerns that were previously brought to theWSLCB’sattentionbefore theothercomponentsofanyoffer,suchas financialandtimingcomponents,canevenbeconsidered.BioTrackisstillactivelyseekingtoresolvethesesecurityconcernspriortotheexpirationofthecontract.ThefinalparagraphinmylastemailtotheWSLCBonthismatter,datedOctober19th,readsasfollows:

“WhenwefirstspokelastMondayaboutthepossibilityofextension,youassuredmemultipletimesthatthecurrentprojectisrunningonscheduleandthattheextensionwasbeingofferedtousforthebenefitof the third-party software providers, and for thatwe are grateful for theWSLCB’s consideration. Iwanttobeclearthatwearenotsaying“no”totheextension.Wejustcannotconsideranyotherfactorsuntilwecanresolvetheseconcernsandtheyhavenotyetbeenresolved.However,wedon’twantoursecurity concerns to causeaburdenon theWSLCB if everything is indeed runningon time.WehavedoneourbesttobepartnerswiththeWSLCBsincethebeginningsowehopethatwecanresolveourconcernsbeforenextweek’stransition.”

WhatIsTheSecurityConcernThatNeedsToBeResolvedBeforeBioTrackCanFeelComfortableInAccepting

TheExtension?On Monday October 9th, theWSLCB and I connected for the first time in nearly six months to discuss a possibleextension.IwasinformedthattheWSLCBremainedconfidentthatthenewsystemwasontime,butthatanextensionwouldallowthebusinessseed-to-salesoftwareprovidersmoretimetointegratewiththenewgovernmentsystem.ItheninformedtheWSLCBthatBioTrackhasseriousconcernsrelatedtosecurity.AfterMJFreewaywasawardedthecontract,beginningtheweekofAugust21,2017,BioTrackbeganprovidinga“datadump”oftheentiretraceabilitysystemdatabasetotheWSLCBonaweeklybasissothattheentiredatasetcouldbemapped andmigrated to the replacement system.However,manyWashington licensees received an email inmid-September alleging to sell databases described as “WA DATABASE,” “NV PROD DATABASE,” and “PA PRODDATABASE,”amongothers(see“Exhibit6”). ThesepresumablyaretomeantheWashingtondatabase, theNevadadatabase,andthePennsylvaniadatabase.Theemailsalsoprovidedunencryptedsampledatafilesasakindof“proofoflife.”Somebusinessseed-to-salesoftwareproviderstookituponthemselvestoinvestigatethesampledataanditwasreportedthatthesampledatanotonlyappearedlegitimate,butthatitincludedsensitivedatathatisnotpubliclyavailable: data that is containedwithin the full un-redacted traceability dataset. I am sure thatmanyofmypeerscontributedtotheindustry’sinvestigation,butIspecificallywanttorecognizeDavidBusby,CEOofWeedTraQR,forhistirelesseffortsinthisregard.To BioTrack, other third-party software providers, and many Washington licensees, this is a serious concern.BioTrackcurrentlyoperatessixstate-levelgovernmentcannabistraceabilitysystemsandhasmanagedWashington’straceabilitysystemforfouryearswithoutanysecuritybreaches.Wethenfindourselvesinasituationwherebothourreputationandour securityare co-mingledwithanother company’s; and thena fewmonths later, credible reportssurfacethatWashington-specificdatanototherwiseavailabletothepublicisfoundoutsideofthechainofcustody.I conveyed to theWSLCBourconcern that this situationwherewe“sharespace”with theirnewvendorputsus injeopardy.Imemorializedthoseconcernsinwritingwithinmyfollow-upemaildatedOctober16th(see“Exhibit1”).

“Thecurrentstatusquohasalreadyharmedbothourreputationandourpeaceofmindwithrespecttosecurityrisk.Pleaseunderstandthatwehavecontinuedtoprovideourtraceabilitytechnology,support,andweeklydatadumpsoftheentiretyofthedatabasebecauseweremaincontractuallyobligatedtodoso,notbecausethenewstatusquoisinanywaycomfortableforus.Everypassingdayinwhichwefindour reputation and security co-mingled with another vendor without any assurances that ourtechnology—and therefore our livelihoods—are safe within this new co-mingled environmentcompoundsouranxietyandintensifiesourdesiretoexittheunsafesituation.”


Our technology is howwemakeour living. If the security of our technologybecomes compromised, at least sixtypeople lose their jobs and all of our customers who depend on us also become compromised. It would beirresponsibleofustoignorecrediblethreatstotechnologysecurity.NowIamnotsayingthatweknowforcertainthattheWSLCB’sorMJFreeway’ssecuritywasbreached.Maybetherewasnosecuritybreachofanykind.Maybetherewasasecuritybreachandithassincebeenremedied.Maybetherewasasecuritybreachandit’sstillthere.Whatwedoknowisthatthereisenoughsmokethatwearenotcomfortablemovingforwardwithoutareasonablelevelofassurancethatthefirehasbeenaddressed.TheWSLCB’spositionatthetimewasthattheemailwasa“spoof”andthatitwas“fakenews”,andBioTrackrespectstheirprerogativetobelievethatnosecurityissuesexist. However,werespectfullydisagreedwiththatpositionandsaidweneededsometypeofmeaningfulassurancesthattheallegedbreacheitherdidnothappenordidhappenandhassincebeenremedied,sincewithoutthatwehavenosolidfootinginunderstandingourcurrentriskexposure.

WhatHasBioTrackObtainedSoFarToAddressTheSecurityConcerns?

ToemphasizeBioTrack’ssincereinterestinapossibleextensionandtoensurethatBioTrack’sconcernregardingthepossiblesecurityissuewasnotmisunderstood,IhadamemberofBioTrack’sboardofdirectorsjoinmeonacallwiththeWSLCBonFriday,October13th. IalsohadtheCEOofoneofourcompetitors jointhecall toshowwhathehaduncoveredfromthe“spoof”emailthatlicenseeshadreceived.Atonepoint,wesuggestedthatathird-partysecurityauditprovidinga“cleanbillofhealth”maygoa longwayinallayingourconcerns. TheWSLCBreassuredusthatasecurityaudithadbeenperformedby theWashingtonStateOfficeof theChief InformationOfficer (OCIO),but thatnoneofthecontentsoftheauditreportcouldbeprovidedtous.TheWSLCBofferedtoobtainastatementfromtheOCIOthatcouldaddressourconcerns.Weagreedtoincorporateitintoouroverallevaluation,butcouldnotpromisethatitwouldallayourconcernssincewehadnotyetseenit.Toexpeditetheprocessingoodfaith,immediatelyafterthatcallconcluded,BioTracksubmittedarecordsrequesttotheOCIOforanysecurityauditdocumentationthatisavailabletothepublic.AsofthewritingofthisletterwehavereceivedoneresponsefromtheOCIO’sofficedatedOctober19thstatingthattheyestimate,“itwillrequirenomorethanthirtydaystoprovideyouaresponse,”(see“Exhibit3”).OnOctober17th,IreceivedanemailfromtheWSLCBstatingthatBioTrack’s“concernswereaddressedalready.”Uptothatpoint,wehadreceivedonlyverbalassertionsandnothinginwriting.OnepartofmyOctober19themail(see“Exhibit2”)containedthefollowingresponse:

“Weappreciate the fact that theWSLCB is leaningona reviewperformedby theOCIO that foundnoadverse security concerns, but we have not seen any documentation with our own eyes or even adocumentstatingthatweareprohibited fromseeingsuchdocumentation.Nooffense,butwecannotjusttakeyourverbalwordonsomethingthatcouldhavefarreachingconsequencesforourlivelihoodsandourcustomers.

I amanaccountantby training. If someonewithdraws$1,000 from the companybankaccount, thatpersonwouldhavetoshowmeareceiptprovingwhereitwent.Aresponseof,“Ihavethereceipt,butIcannotproduceitforyou,”isnotonethananyonecouldreasonablyaccept.I'mnottryingtomakelightofthesituation,butpleaseappreciatethepositionwe’reininthatnothingthatwecanrelyonhasbeenprovidedtous.”

Laterthatday,theWSLCBsenttomealetterfromtheStateofWashingtonOfficeofCyberSecurity(see“Exhibit4”).Theletterstates,“WehavecompletedoursecuritydesignreviewonthenewcannabistraceabilitysystemprovidedbyLeafDataSystemsvendorMJFreeway…theproject,asproposed,usesappropriatesecuritycontrolsandmethodstomeetOCIOITsecuritystandardsatthetimeofreview.”ThoughwegreatlyappreciatetheeffortsoftheWSLCBstafftoobtainthisletter,itdoesnotprovidemuchinformationorthepeaceofmindthatweareseeking.


1. The letter does not provide a date for when the review was performed. No review can provide anyassurancesaboutcurrentsystemsecurityifitwasperformedbeforethe“spoof”emailwassenttolicensees.

2. Theletterstatesthatitwasthesecuritydesignthatwasreviewed;thesystemitselfdidnotundergogenerallyacceptedsecurityaudittesting.Thatislikethedifferencebetween,“Patrick,wereviewedtheairplanedesignyoudrewonpaper and thedesign should fly,” versus, “Patrickwe tested the actual plane youbuilt and itsuccessfullyflew.”

3. Finally,theOCIO’sonlineprojectdashboard’sOCIOAssessmentreads,“userauthenticationrequirementsand

SecurityDesignReviewincreaserisk due to imminentproject implementationdeadline” (emphasismine) for07/13/2017,07/27/2017,08/22/017,and09/15/2017.Now,Idon’tknowwhatthismeans,andtobefairIonly just found this todayandhavenotgiven theWSLCBanopportunity tohelpmeunderstandwhat thiscommentmeans, butmy current interpretation is that on each of those dates, the SecurityDesignReviewcontinuedtoincreasetheriskthattheprojectwouldnotbecompletedontimebecausethereviewremainedongoingasthesystemwasbeingdeveloped(see“Exhibit5”).(https://http://waocio.force.com/ProjectDetail?id=a060P00000ezEk1QAE)

TheWSLCB has been quoted recently in themedia saying, “We’ve given them everything thatwe have and everyassurance.”NowIunderstandthatthisislikelytrue;thattheWSLCBhasgiventouswhattheyareallowedtogiveus.However,everythingtheyhavegivenusthusfarhasbeenverbalandonebriefletteronwhichwecannotplaceagreatdealofreliance.Again,wehavearesponsibilitytoourothergovernmentclients,tothelicenseeswhodependonourbusiness software, andour staff to takeevery reasonableprecaution toprotectour technology fromsecurity risks.Acceptinganyextensionofthecurrentsituationwithoutreasonableassurances,regardlessoftheamountofmoneyoffered,wouldbeirresponsible.Again,wedidnotdeclinetheWSLCB’sextensionrequest.Wejustcannotmoveforwarduntiltheseconcernsaredealtwith.Wearestillactivelysearchingforalternativemeanstohelpusdeterminehowsensitivenon-publicdatacametobefoundwithinthe“spoof”emailsenttotheindustryandwelcomeanyassistancefromanyotherparty,WSLCBorotherwise.

CanBioTrackAcceptTheExtensionAfterOctober31stIfTheSecurityIssueIsAddressedShortlyAfter?IamnotsureasIamnotanattorneythatspecializesinWashington’sgovernmentcontract law. However,IdonotbelieveeithertheWSLCBorBioTrackcan“extend”acontractthatisnolongerineffect.Theremaybeawaytojustifya sole-source procurementwhere theWSLCB can offer a new contract should the current contract expire, butwewouldhavetoconsultanattorney.

WhatIsBioTrack’sPlanIfTheContractExpiresonOctober31st?We learned about theWSLCB’s “contingencyplan” from the sameannouncement thatmanyothers in the industryreceived onThursday, October 19th, andwe learned onTuesdayOctober 24th,with everyone else that themanualspreadsheetera isexpectedto lastat leastthroughJanuary1st…somanyofourplansarerapidlyevolvingandstillsolidifying.Thatbeingsaid,hereisourgameplanfornow.First,BioTrack is committed to itsdirect commercial customers: thosewho relyonBioTrack’sbusiness system forinventorymanagementandpoint-of-sale. Itisourintentthatineverywaypossible,yourBioTrackbusinesssystemwillautomaticallygeneratethespreadsheetsnecessaryforsubmissiontotheWSLCBsothatthereisareducedimpacttoyourbusiness.Pleasehavepatiencewithusasweareworkingwithamovingtarget.Secondly,thesuccessofWashington’sindustryasawhole–andthereforethesuccessofeverylicenseeinWashingtonwhether you use our business platform or not— is important to us. We have no intention of giving the federalgovernmentanyreasontogivethisindustryahardtime.BioTrackunderstandsthatevenwithmanualspreadsheets,


thereneeds tobesomemethodof communicationanddataexchangebetween licensees regardlessofwhich third-partycommercialsystemyouuse. Onecommondenominator foreverythird-partycommercialsoftwaresysteminWashington is that it successfully integrateswith ourAPI. BecauseBioTrack owns its traceability technology andlicensesittostategovernmentsforuse,wecancreateaprivate-sectorversionofourtraceabilitysystemthatwouldmirrorthecurrenttraceabilitysystem.Itwouldevenincludeaweb-interfaceforthelicenseeswhohavereliedonthefreely-providedMJTraceabilitywebsite,anditwouldhavethecurrentversionoftheWashingtonAPIsoeverycurrentbusiness seed-to-sale provider will already be integrated with it. Though we are still working on the specificmechanics,allitwouldtakeisforeveryonetopointtheirsystemstothenewURL(website);allfunctionsandalldatathatiscurrentlycoordinatedandexchangedbetweenlicenseeswouldbenearlyidentical,ifnotperfectlyidentical,tothewaythingspresentlywork.Thisprivate-sector“clone”ofBioTrack’straceabilitysystemcouldcontinuetooperateforaslongasweneeditto,evenifaworst-casescenarioweretohappenandtheWSLCB’ssystemisunabletogo-livebyJanuary1,2018asplanned.Wehaveyettofigureouttheeconomics,butourgoalistojustgetthejobdonefirstandworryabouttherestlater.Please remember thatweareattempting to surfawave in thewildhere, so I canguaranteeyou that therewillbeturbulenceaswego;however,myteamandIbelievethatthisisourbestoptiontoavoidindustryArmageddonandwe will all band together to navigate these unpredictable waters as best we can. We have already received anoutpouringofsupportfromtheotherthird-partysoftwaresystemsandinspiteofthefactthatwe’recompetitorsandhave our differences, I know that we can continue to use this challenge as an opportunity to bring the industrytogetherforeveryone’ssuccess.HighestRegards,PatrickVoPresidentandCEOBioTrackTHC


Exhibit 1 Email—October16,2017

Nochangeshavebeenmadetothisemailreproductionotherthantheremovalofrecipientswhowerecc’d.

----From:PatrickVo<[email protected]>Date:Mon,Oct16,2017at12:28PMSubject:BioTrack–Follow-upOnFriday’sCallTo:“Antolin,PeterP(LCB)”<[email protected]>Peter,First of all, because thequestion cameuponFriday’s call, Iwant to reiterate thatwe are indeed interested in thepossibilityofanextension.NeitherI,norDirectorMolloywouldhaveinvestedourtimeforthecallwerethatnotthecase.However,thoughitistheLCB’sprerogativetobelievethattherearenosecurityissuesrelatedtotheLCBoranyof the LCB’s other vendors, we’ve heard otherwise from other third-party vendors within the state who haveuncoveredconcerningevidencetothecontrary.Itwasalsoaskedofuswhysecurity isan issuewhenall theLCBisaskingfor isanextensionofthestatusquo.Toreiterate and clarify what Mr. Molloy stated on the call, that question assumes that we are okay with the statusquo.However,thestatusquochangedwhenanothercompanywaschosentoessentiallybeaco-vendorwiththeLCBandBioTrack,followedbyreportssurfacingthatWashington-specificdatanototherwiseavailabletothepublicbeganbeingdistributed.The current status quo has already harmed both our reputation and our peace of mind with respect to securityrisk. Please understand that we have continued to provide our traceability technology, support, andweekly datadumpsoftheentiretyofthedatabasebecauseweremaincontractuallyobligatedtodoso,notbecausethenewstatusquoisinanywaycomfortableforus.Everypassingdayinwhichwefindourreputationandsecurityco-mingledwithanothervendorwithoutanyassurancesthatourtechnology—andthereforeourlivelihoods—aresafewithinthisnewco-mingledenvironmentcompoundsouranxietyandintensifiesourdesiretoexittheunsafesituation.Withrespecttoreputationalharm,atleasttwostateagencieshavereachedouttooneofourothergovernmentclientswithconcernsthattheyheardthatthe“WashingtonTraceabilitySystem”wasallegedlycompromised.Atthispoint,BioTrack has become synonymous with Washington’s Traceablity System and so we had to assertively defendourselves;andthesearejustthetwoinquiriesthatweknowabout.Thiscannotcontinue.With respect to security risk, because LCB owns the data captured by the traceablity system (including passwordhashesincludedwithinthedatabase),wecurrentlyhavenoviablemethodavailabletousofensuringperfectsecurityofoursystemswithinthecurrentco-mingledsituation.Even ifeverysinglepasswordwaschangedtomorrow, thiswouldonlyprovidetemporaryreliefuntilthenextweeklyfile.Thankfully, the third-party vendors who have been independently investigating this matter have yet to uncoverevidencethatpasswordsthemselveshavebeencompromised.Nevertheless,theirfindingsthusfarsuggestthatthereisindeedabreachsomewhere.Onthecall,weaskedforassurancesthattheallegedbreacheitherdidnothappenorhassincebeenremediedifitdidhappen.Please remember thatweatBioTrackdonotknowwhat theLCBknows, andsowehavenosolid footingwhenitcomestounderstandingourriskexposuretobeingco-vendorswiththeLCB’sothersystemprovider.Wearenotaskingforanythinginappropriate.WeexpecttheLCBtoprotecttheirownproprietaryinformation,andthatof


anyothervendor, justaswewouldexpecttheLCBtoprotectourownproprietaryinformation.However,wedon’tknowwhattoaskforbecausewedon’tknowwhatwedon’tknow.Theconsensusfromthemajorityofourboardofdirectorsisthat,thoughtheLCB’srequestforanextensionremainson the table, the current situation represents an imminent and unknown risk. We have a responsibility to ourcustomers,employees,andshareholderstonotendangerourownsecurity.You mentioned on the call that the vendor with whom the reported evidence appears to implicate has alreadycompletedasecurityauditorsomethingsimilarby theOCIO. Inorder tokeep themomentumofourconversationmovingasquicklyaspossible,andtoavoidputtingtheagencyinanawkwardposition,wesubmittedapublicrecordsrequestonFridayfora(presumablyredacted)copyofthecompletedinformationtechnologysecurityauditforthatvendor.Weknowthat itmay takea fewdays toreceivewhateverredacted informationwillbemadeavailable forpublicinspection,butwhateveriscontainedthereinmightgoalongwaytowardsallayingourconcerns.Finally,yourequestedadollar figure fromusearlier intheweek,andonceagainFriday.Wehavemadegoodfaithattemptsatdeterminingaprice,butwithoutknowingtheriskfactorwecannotputapriceontheunknownpotentialexposurecomponent.ThevalueofthecontracttoBioTrackisitsrevenuelessitscosts;andtheprobabilityofcostsrelatedtopotentialeventssuchasasecuritybreach,oursourcecodemadepublic,reputationloss,commercialclientloss, other government client loss, litigation, etc… are undefinably higher now than they were prior to the othervendor’sco-existencewithBioTrackandtheLCB.Betterunderstandingthoserisksareaprerequisitetodeterminingthelikelycostsandthereforethecontractextensionasawhole.Iknowthatthisisnottheansweryouwerehopingfor;butitisthemostresponsibleanswerIcangiveyougiventhecircumstancesandtheconcernsofourdirectors.WewillwaitforthepublicrecordsfromOCIOandwillcontinuetoworkwithotherthird-partyvendorstoindependentlyinvestigatethereportedmattersinordertoreachaconclusionwithrespecttoourriskexposuremovingforwardandthatriskexposure’sappropriateprice.WeunderstandthattheLCBispressedfortimeandmayneedtowithdrawitsrequestforanextensionifyouarenotabletowaitforustoreceiveandinspecttherequestedpublicdocumentsfromOCIO.AnyfurtherassistancetheLCBcanprovideinallayingourconcernsandtheconcernsofotherthird-partyvendorswouldbegreatlyappreciated.Wehope to come to a resolution in thebest interest of all parties thatdoesnot sacrifice security, and I trust that youwouldexpectnothingless.Sincerely,


Exhibit 2 Email—October19,2017


----From:PatrickVo<[email protected]>Date:Thu,Oct19,2017at12:21PMSubject:Re:BioTrack-Follow-upOnFriday'sCallTo:"Antolin,PeterP(LCB)"<[email protected]>Peter,IknowIsoundlikeabrokenrecord,butIregisteredourconcernsagainbecausewedonotfeelthatthoseconcernshavebeensufficientlyaddressed.Iamnotsurewhatyoumeantby“themostwecouldofferwastheinformationthatweprovidedlastweek,”aswewerenotprovidedanythingofsubstance.WeappreciatethefactthattheLCBisleaningonareviewperformedbytheOCIOthatfoundnoadversesecurityconcerns,butwehavenotseenanydocumentationwithourowneyesorevenadocumentstatingthatweareprohibitedfromseeingsuchdocumentation.Nooffense,butwecannotjusttakeyourverbalwordonsomethingthatcouldhavefarreachingconsequencesforourlivelihoodsandourcustomers.Iamanaccountantbytraining.Ifsomeonewithdraws$1,000fromthecompanybankaccount,thatpersonwouldhavetoshowmeareceiptprovingwhereitwent.Aresponseof,“Ihavethereceipt,butIcannotproduceitforyou,”isnotonethananyonecouldreasonablyaccept.Hereishowahypotheticalconversationwithmyboardofdirectorsoroneofourcustomersmaygowithwhatwehavebeenprovidedthusfar:Patrick:“TheLCBtellsmethateverythingisfineandthatweshouldnotbeconcerned.”Board:“Howdoyouknow?”Patrick:“Becausetheytoldmeso.”Board:“Haveyoureviewedtheevidencethatsupportsthisconclusion?”Patrick:“No.TheLCBtellsmethatIamprohibitedfromreviewingtheevidence.”Board:“Howdoyouknowyoucannotreviewtheevidence?”Patrick:“Becausetheytoldmeso.”I'mnottryingtomakelightofthesituation,butpleaseappreciatethepositionwe’reininthatnothingthatwecanrelyonhasbeenprovidedtous.Thankyoufortakingasecondlookatthespoofemail.Otherthird-partysoftwareprovidershaveanalyzedthesampledatabaseprovidedfromthatspoofemailandhavereportedthatitcontainedthefollowinginformationthatisnotavailableintheFOIAdatathattheLCBreleases:

·UseremailaddressesofvendorstaffandLCBstaff,·Licenseeemployees,drivers,andvehicles(tagandVIN).

Obviously,there’snotmuchyoucandoregardingtheNevadadataandthePennsylvaniadata,butanyinsightyoucouldprovideonhowthisinformationleftLCBcustodywouldbehelpful.IunderstandthatallWashingtonagenciesareheldtothesamepublicdisclosurestandards,whetherLCB,OCIO,orotherwise.However,asstatedearlier,evenareplyfromOCIOstatingthatthedocumentexistsbutcannotbemadeavailableforpublicinspectionisstillmorethanwhatIhaveatthemoment.Wearedoingeverythingwecantoquicklygetcomfortoverthediscomfortingredflagsandareleavingnostoneunturned.


Thepotentialsecurityrisksareamajorconcern,butIwouldberemisstonotalsoreiteratethereputationaldamageasaconcern.WhetherornottheLCBbelievesthattheallegedsecuritybreachesarereal,stateagenciesfromacrossthecountryhaveheardaboutandexpressedconcernregardingthem.WeremainattheforefrontofhavingtodefendbothourcredibilityandtheLCB’scredibilitytocurrentandprospectivegovernmentclientswithoutanyassurancethatwewillnothavetocontinuetodososhouldweagreeanextension.WhenwefirstspokelastMondayaboutthepossibilityofextension,youassuredmemultipletimesthatthecurrentprojectisrunningonscheduleandthattheextensionwasbeingofferedtousforthebenefitofthethird-partysoftwareproviders,andforthatwearegratefulfortheLCB’sconsideration.Iwanttobeclearthatwearenotsaying“no”totheextension.Wejustcannotconsideranyotherfactorsuntilwecanresolvetheseconcernsandtheyhavenotyetbeenresolved.However,wedon’twantoursecurityconcernstocauseaburdenontheLCBifeverythingisindeedrunningontime.WehavedoneourbesttobepartnerswiththeLCBsincethebeginningsowehopethatwecanresolveourconcernsbeforenextweek’stransition.


Exhibit 3 Emails—October13,2017andOctober19,2017

Nochangeshavebeenmadetothisemailreproduction.

----


Exhibit 4 EmailwithLetterAttachment—SecurityReview


----

From:Mueller,MaryD(LCB)<[email protected]>Date:Thu,Oct19,2017at2:54PMSubject:RE:BioTrack-Follow-upOnFriday'sCallTo:PatrickVo<[email protected]>Goodmorning,Patrick,Attached,pleasefindtheconfirmationletterthatwediscussedlastweekfromtheOfficeoftheChiefInformationSecurityOfficer.Pleaseletmeknowifyouhaveanyquestions.Mary


Exhibit 5 OCIOOnlineProjectDashboard

Thisisascreenshotofthebottomportionofthedashboardasof10/26/2017.

----


Exhibit 6 “Spoof”Email

Thisisacopy/pasteofapostontheI-502googleforumwiththelicensee’snameremoved.

----

Anyoneelsegetthisemailthismorning?Haven'[email protected]

YOUAREBUYDATABASE!BITCOIN100,00%ANONYMOUSE

"MJPLATFORMDATABASE".33MCOMPRESS.1,6GNONCOMPRESSDOWNLOADLINKI.https://secufiles.com/54ky/mjplatform.7zDOWNLOADLINKII.https://ufile.io/gb78uDOWNLOADLINKIII.https://nofile.io/f/WUwkYa2ymW0/mjplatform.7z"NVPRODDATABASE".54MCOMPRESS.870MNONCOMPRESSDOWNLOADLINKI.https://secufiles.com/54kz/nv_prod.2017-08-02--02-49.7zDOWNLOADLINKII.https://ufile.io/vgtu9DOWNLOADLINKIII.https://nofile.io/f/MrC2a2j87Dq/nv_prod.2017-08-02--02-49.7z"TRACKERDATABASE".122MCOMPRESS.2,0GNONCOMPRESSDOWNLOADLINKI.https://secufiles.com/9gtD/tracker.7zDOWNLOADLINKII.https://ufile.io/90tqnDOWNLOADLINKIII.https://nofile.io/f/m7W9mVxAK6b/tracker.7z"WADATABASE".1,1GBCOMPRESS.23,0GNONCOMPRESSDOWNLOADLINKI.https://nofile.io/f/EV6UFF4ZzO4/wa_2017_09_05.7zDOWNLOADLINKII.https://ufile.io/dw86p

FILEAREENCRIPT.AFTERDOWNLOADYOUBUYENCRIPTIONKEY.

BUYENCRIPTION"MJPLATFORMDATABASE"0,002BTC[8,0$USD].https://www.pastecoin.com/mLk19YG91Z4Jhttps://satoshibox.com/ov4kgnu5t3n4p7j6p4zh8bcaBUYENCRIPTION"NVPRODDATABASE"0,002BTC[8,0$USD].https://www.pastecoin.com/npKoBjLeo3ELhttps://satoshibox.com/yuuekkj5d5nmeeprmhnpe3avBUYENCRIPTION"TRACKERDATABASE"0,002BTC[8,0$USD].https://www.pastecoin.com/blr13me2oAPnhttps://satoshibox.com/24eaif22cy4t886jhniqacbnBUYENCRIPTION"WADATABASE"0,002BTC[8,0$USD].https://www.pastecoin.com/nVMQeE2MQrwghttps://satoshibox.com/iwysyii2m6wt4sjd2bgcwnhvBUYALLENCRIPTION0,004BTC[16,0$USD].https://www.pastecoin.com/rpz1AzYmRV2Ghttps://satoshibox.com/piu234s3ft3v523bmskebqkk

GETSAMPLEFREE?!YES!!!!!!!!

"MJPLATFORMNVPRODTRACKERWASAMPLES+++PAPRODDATABASE+++CCPRODDATABASE".976KCOMPRESS.5.4MNONCOMPRESSDOWNLOADLINKI.https://secufiles.com/dt0l/samples.zipDOWNLOADLINKII.https://ufile.io/rzsq7DOWNLOADLINKIII.https://nofile.io/f/G4Mw99njVcx/samples.zipYOUWILLUSETHISWITHOPENOFENCRIPTFILE.http://www.7-zip.org/download.htmlYOUWILLBUYBITCOINAT.https://www.coinbase.com/buy-bitcoinORYOUWILLBUYBITCOINAT.https://localbitcoins.com/guides/how-to-buy-bitcoinsORMANYOTHERONLINE.

RUSHYOUBUYNOW!

What Is Going On? Is There Currently A Contract … There Currently A Contract Extension On The...

Documents

Transcript of What Is Going On? Is There Currently A Contract … There Currently A Contract Extension On The...