Nevada Website Snafu Exposes Information of Thousands of Dispensary Applicants

Four more states legalized recreational marijuana in November, but implementing those new programs may not go smoothly. Nevada is one of those states: Medical marijuana has been legal there since 2000, and last week the state website accidentally leaked personal information on nearly 12,000 people who have applied for medical dispensary licenses.

Applications are eight pages long and include detailed information about applicants, including Social Security numbers, driver's license numbers, full addresses and physical details such as weight, height and eye and hair color.

Security researcher Justin Shafer discovered a bug that makes the website's portal vulnerable to anyone with the right web address or specific Google search term.

A spokesperson at Nevada's Department of Health and Human Services, the department in charge of the marijuana application program, confirmed to ZDNet that the website has since been taken offline and that affected applicants will be notified.

Along with Nevada, California, Maine and Massachusetts also legalized recreational marijuana in November; those states also experienced subsequent problems.

Maine had to conduct a ballot recount before verifying that the measure had passed.

California's 62-page initiative that legalized retail marijuana in the state accidentally eliminated the medical marijuana sales tax that was already in effect. That could mean that medical marijuana sales in California will remain tax-free through the end of 2017, resulting in the loss of an estimated $49.5 million in tax revenue.

Massachusetts was also in the news last week, when lawmakers quietly voted to push back the licensing of any recreational stores until July 1, 2018 — six months after the expected launch date. That means that while possession of recreational marijuana will be legal, sales will not be.