WSLCB CCRS Manifest Webform

With the launch of the CCRS platform on December 6th also comes a web-form for licensees to fill out at https://lcb.wa.gov/manifest. Due to the tedious nature of this web-form many vendors had automated this process. And then the LCB told us that is not allowed.

There was only a simply image captcha to solve, and a vanilla Drupal web-form. So, it was trivial to automate, simple, direct and now fully integrated with the licensee software.

Really Blocked?

No, not really. The LCB just added a Captcha to the form and made some FAQs -- which were ambiguous at best.

Q: Can we get rid of the captcha so we can have bulk uploads to the form?

A: Captcha is a standard security feature that will not be removed prior to CCRS launch. The Webform Manifest is not designed for bulk uploads.

And

Q: This captcha will not prevent integrators from automating the webform on behalf of their customers, it will just make it more annoying/expensive to do so. Can you help us understand why the LCB believes the captcha is necessary?

A: Captcha is an standard security feature that will not be removed prior to CCRS launch. The Webform Manifest is not designed for bulk uploads.

As you can read, they wouldn't get rid of the Captcha -- but that's a trivial matter. They only stated the form was not designed for bulk uploads. And that's the point we needed clarity on -- what's designed for vs what is allowed.

Shortly after launch discussions around this form from various vendors then added to this issue. Some (including us) were claiming very-good automation on this process. Other vendors were claiming that the LCB had explicitly forbidden it -- and even implied the software providers who had implemented it might have their access in jeopardy.

This situation created the requirement for clarity.

Testing & Post Launch Clarity

The form was off-line for most of the roll-out period -- so on the way to launch everyone was blocked from working too much on this problem. There was a small window when the form was online, in November -- but it was closed off very quickly.

On Dec 6th it came back online and with that many software vendors got their solutions deployed and worked out the finishing touches. -- I'll add a video here.

On Dec 7th, based on those discussions we asked the LCB for some clarity Ticket #IR50558.

OpenTHC is using web-service automation to upload the data from our application through the Drupal webform provided by the LCB -- to ensure accuracy and timely reporting of this required information. Our clients (the licensee) are still required to fill out the captcha form.

We've been told before, verbally, in meetings this was acceptable and reasonable.

However there is some confusion regarding this process and others are claiming that zero automation and/or assistance is allowed -- which I think is a mis-representation of what the LCB has previously stated and touched on in the CCRS FAQs.

As far as we're concerned, everything is working perfectly as intended -- so, can we just keep doing it this way that's working for the LCB, the Licensee and OpenTHC?

And they told us it was a question for a different team, so we'll have to wait.

Public Comments to the LCB

While waiting, I (djb) also spoke to the Board of the LCB about this subject, it's on their YouTube The notes I tried to read verbatim (but likely didn't get 100%) are

And finally, the agency needs to make some clear statements about what a licensee’s contracted agent is allowed to perform on their behalf. Some software providers have implemented robust automation solutions the Drupal based Manifest Web-Form; others are claiming that the LCB has stated that is not permitted – however the agency has not made any definitive statements about it – only claims that “Webform Manifest is not designed for bulk uploads.” – because Not Designed and Not Allowed are significantly different things.

If this automation is Not Allowed then the LCB is making it much more difficult for the licensee to enter data accurately and consistent with CCRS file upload. Also, the automation issue is completely unrelated to the “Image Captcha” feature that Web-Form others have complained about – so don’t conflate the two. Captcha is not the core problem; the blessing to automate on behalf of the licensee is critical, the timing need is urgent.

This was on December 8th, around 10:45 AM

Automation Clarity - Part 1

On December 8th at 15:27 (Olympia time) we got a message back from the LCB to clarify.

The agency has not made any changes to the expectation or allowances regarding the manifests. The agency will broadcast it widely and update all of the documentation posted on the CCRS Resources page if it changes. Please review the FAQ Manifest section for more details.

That was helpful.

Our previous statements remain unchanged; for more information please re-read this sentence.

Automation Clarity - Part 2

Well, I was not happy with that, and the issue at hand is pretty dramatic for our business. If we do automation, but it's not allowed we could have our access revoked -- which puts 90% of our business model in Washington at risk. If we don't do automation we'd be throwing away the work-time we spent on it (a little sad) and we could also lose competitive advantage.

We should also add, at this time all the software integrators are working together in the form of the WCIA. That is, we're all in this together. This automation question affects every software vendor and every licensee. This clarity, and uniform application of the rules to all parties, is fully a requirement of the LCB -- and we're obligated to follow them too. It's a tangled mess.

So, I asked once again, with my usual cheerful gusto.

I'm asking for clarity on existing rules and FAQs which you have failed to provide. You've simply deflected to discussion about changes and pointed me back to the same ambiguous FAQs that don't provide a clear answer and started this question thead. -- as if a re-read of the same ambiguous information would be helpful. This is the exact same thing I complained to the LCB Board at the meeting today -- about this specific subject -- asking for an unambiguous answer!! -- see https://youtu.be/P4Y6hT5eVUI?t=2862 The DOR can give a straight answer, why can't you?

Please answer these two questions with a YES or NO -- so we can finally and explicit and clear information -- instead of your vague ambiguous FAQs and more non-answers via email. 1) Is it true that the LCB has forbidden any automation at all of the forms at: https://lcb.wa.gov/manifest ? 2) Can we, OpenTHC or any other vendor, automate, to the extent possible, completion of the forms at https://lcb.wa.gov/manifest ?

The correct answers, should be 1=No; 2=Yes

So, naturally the LCB wrote back.

1) Is it true that the LCB has forbidden any automation at all of the forms at: https://lcb.wa.gov/manifest ? Yes

2) Can we, OpenTHC or any other vendor, automate, to the extent possible, completion of the forms at https://lcb.wa.gov/manifest ? No, not at this time

Notice they replied with the exact opposite of what we (we as in the entire cannabis industry in Washington) were hoping for.