Smoke Cloud: Encrypting the Internet of Weed

For the past two months, a modest stand of medicinal cannabis plants has inched skyward at an undisclosed grow in Berkeley, California. The plants, all of the OG Kush strain variety, are part of a beta test helmed by smart gardening startup Edyn, whose solar powered, wi-fi connected garden sensors stream ambient temperature, light, humidity, and soil acidity data to the cloud, to then be analyzed against known patterns for various soil conditions.

It's all in the name of growing the very best buds efficiently and semi-remotely, and it's happening online. Welcome to the Internet of Weed. The question is: How secure is it?

As the fine art of growing pot becomes more data-driven by the day, with smart technologies like the Edyn sensor and Heliospectra's real-time spectrum and intensity regulating LED rigs equipping amateur and master weed growers alike with the tools to optimize, regulate, and automate the entire harvest cycle like never before, you begin to wonder how easy it would be for any sort of outside hack to screw with or sniff on "connected" pot grows.

For those already using, or at least interested in using Edyn's sensors for growing medical weed within or without their legal rights—if Edyn's wildly successful Kickstarter campaign is any indicator, quite a few people are into the concept—is it far fetched to think a backyard patch of, say, Punta Roja is now suddenly an electronic target to be tampered with or spied on?

It's something Edyn CEO Jason Aramburu says his company is particularly sensitive to. Aramburu told me that Edyn has already received a lot of feedback from users, beta testers, and people who just plain want to grow their own medicinal cannabis with a little help from something like the Edyn sensor, who are all really concerned about security. After all, the Internet of Things (including, but not limited to, the Internet of Your House), where systems like Google's Nest manage thermostats and smoke alarms, is not impervious to exploits.

"Hackers have figured out how to get into your thermostat and futz around with it," Aramburu said. "In the case of Edyn, a lot of growers who want to grow cannabis are concerned either that some malicious hacker could come in and mess with their settings or, even worse, law enforcement agencies could identify who is actually growing cannabis, and use that enforce some kind of agenda."

And so Aramburu and his team at Edyn have taken to encrypting all their hardware. It's part and parcel of a broader push to preserve privacy in this post-Snowden age of anxiety.

First, a bit about the hardware itself. What the Edyn sensor does is it sends a tiny electrical signal into the soil, and then measures how the soil's attitude affects the frequency and intensity of the signal, along with "some other proprietary stuff," Aramburu said.

All that data allows you to gauge the moisture, fertilizer, and pH levels of your soil. Essentially this lets you determine precisely what's going on in your soil base, the data of which is then used to program the unit's watering valve. The valve controls your existing sprinkler or drip system, but also collates forecast information; if the forecast is calling for rain, the sensor won't give your plant(s) as much water.

The system is elegant, if not entirely novel to auto-agriculture writ large. The difference here is that Aramburu and Edyn are making it clear that they respect the rights of law-abiding citizens to grow pot with Edyn if they so please. (According to Aramburu, everyone getting their hands dirty at Edyn's Berkeley beta test have the proper state credentials to be doing so.)

To that end, every Edyn sensor has 128-bit encryption on the device. When the water valve sensor communicates with the cloud over the wi-fi network, Aramburu said, "it's virtually impossible for someone to snoop on that information with a packet sniffer or something like that. It's impossible to get that information."

I didn't get the same assurances from Heliospectra, the aforementioned Sweden-based intelligent LED lighting company. (You might remember Heliospectra from High Country, Motherboard's doc on the future of green tech, which checked out a pair of Heliosopectra smart lighting rigs then in beta phase at a boutique medicinal pot shop in Denver.)

Chris Walker, a representative for Heliospectra, tells me their lamps are designed to be used via secure private network, rather than an open Internet connection. "We recommend standard security firewalls for our set ups," Walker adds.

Of course, it's not just weed. It might be ideally suited for growing cannabis, sure, but Edyn wasn't conceived for the express purpose of growing just cannabis. According to The New York Times, Aramburu's plan for the Edyn sensor "goes beyond people in upscale ZIP codes to cultivate things like exotic kale and heirloom beets." He also intends to begin selling his sensors on the cheap to farmers in third-world countries who want to yield crops, and make a living, sustainably and efficiently. And all that data, presumably, will be stored in the cloud.

Ultimately, something like the Edyn sensor is a way to add to a growing corpus of gardening knowledge as agriculture generally goes the way of automation, smart sensors, and the like. When it comes to weed in particular, the idea is it build up a database of strain dos and don'ts, as different strains require different growing conditions.

"There's no database of what the optimal conditions are for Strawberry Cough or OG Kush," Aramburu said. "That information just doesn't exist." So, too, for the optimal conditions—grow specs, time, date, and location data—for hackers, cops, or the DEA to pounce on. At least, not for long.

That's why Edyn has also made the commitment to not share a user's location or other information with any third parties. "It's all anonymized, all private," Aramburu told me.

Back at the undisclosed grow in Berkeley, the ten OG Kush plants now stand well over five feet tall. With any luck, they will start budding in the next month.