Elizabeth and Luke Mason, scientists who met during graduate studies at Colorado State University, saw cannabis legalization in 2012 as an opportunity.

With backgrounds in biochemistry, microbiology, and analytical chemistry, they launched Aurum Labs in Durango in 2014, believing they could build a successful business while setting a standard for scientific rigor. As state regulators and lawmakers rolled out standards for potency and contaminant testing for marijuana producers, the married couple believed their lab would help protect consumers and guide the burgeoning industry.

“We were really passionate about starting the lab,” Elizabeth said.

“And doing things right,” Luke added.

“We can show that cannabis can be a legit industry,” Elizabeth recalled thinking.

But now, almost 11 years later, they have pulled down their shingle, and shuttered their business. And their outlook on the industry is far more grim than their initial hopes.

According to the Masons, as well as other industry insiders and researchers, the industry is riddled with loopholes that allow consumers to be deceived about everything from the marijuana’s potency, to the prevalence of dangerous pesticides, solvents and mold.

Aurum Labs’ closing in 2023 followed years of struggling with what the Masons described as an industry rife with fraud, where cannabis manufacturers work hand-in-hand with testing labs to exploit loopholes in the laws, and where the regulatory and market incentives nudge even the most lofty-minded toward unethical practices.

National researchers are sounding the alarm about the potentially serious health risks of using contaminated marijuana. Though rare, deaths nationally have been linked to fungal infections tied to the use of contaminated marijuana.

“If I was going to take in any kind of cannabis, particularly as a smoking product, which I don’t do by the way, but if I was going to, I would make sure that it had been irradiated and was certified as sterile,” said Kimberly Gwinn, a professor of pathology at the University of Tennessee who has studied cannabis contaminants.

Contaminated marijuana ends up in shops in Colorado, with state officials issuing health and safety recalls more than 40 times in the past three years. But when problems are found, and a cannabis recall is needed, the average time from the first sale to when a recall is issued is nine months.

Although Luke and Elizabeth Mason envisioned a system built on transparency and science, they saw the industry in Colorado undercut by competitors who seemingly “passed” every sample regardless of quality.

In pursuit of the cheapest cannabis that still passes tests for mold, pesticides and other dangerous chemicals, methods to avoid adulteration detection have infested the industry, they said. The Masons, other insiders and independent researchers have concluded that a significant share of marijuana products being sold legally to consumers is not as safe as advertised, potentially containing compounds that are shown to cause long-term health problems. And because high-potency cannabis is sold for more, tricks to juice the THC testing results favor those willing to use them, in an era when the cannabis industry is in contraction.

All the while, labs are free to develop their own testing protocols, rather than follow a state-mandated standard.

“The State of Colorado has strong systems in place to audit and monitor licensed testing facilities’ processes and reporting of results, including annual audits at testing facilities by the Colorado Department of Public Health and Environment (CDPHE),” a spokesperson for the state’s Marijuana Enforcement Division (MED) wrote in response to detailed questions about the state’s regulatory efforts.

Nonetheless, state-maintained cannabis testing data reveals irregularities that suggest possible manipulation. A Gazette analysis of 325,000 Total Yeast and Mold (TYM) test results found an unexpected uptick in the number of results just below the legal limit, and a steep drop in results immediately above it — deviations that raise questions about whether the numbers reflect reality.

And investigations by the state into a relatively small number of cannabis businesses reveal sampling and testing violations are often found, whether the state was specifically looking into that or another possible violation.

Taken together, accounts from inside the cannabis industry, combined with unnatural testing result data and the narrow glimpse into the industry provided by a small number of state investigations raise the lights on systemic issues riddling Colorado’s cannabis testing regime.

Despite a putative regulatory framework, Colorado’s cannabis industry, once expected to set the gold standard for product safety, appears to be plagued by inconsistencies, loopholes, and allegations of manipulation that cast doubt on its integrity.

And academic studies warn that these issues could expose unsuspecting consumers — particularly vulnerable groups like cancer patients who use marijuana to manage nausea and pain — to dangerous health risks, highlighting the dangers of insufficient oversight and a testing regime that some insiders claim is ripe for exploitation.

Regulatory mirage?

Colorado requires several tests to be performed on cannabis before it’s placed on a dispensary shelf. Microbial contaminants are one of the main targets, measured in the Total Yeast and Mold (TYM) counts. The state’s legal threshold is 10,000 “colony forming units” (CFUs) per gram, for cannabis flowers or buds — the plant in its most natural form, traditionally smoked in cigarettes or pipes.

But to be sure, the threshold is not uniform from one state to the next, and researchers say the science is thin, when it comes to what’s actually safe. Because marijuana is still federally illegal, grow operations and testing facilities are not regulated by federal safety agencies, like the U.S. Food and Drug Administration. That lack of federal oversight means there is no national contaminant and potency testing standard, and the states that have passed laws legalizing marijuana craft their own rules.

The Total Yeast and Mold thresholds in Michigan and Maryland are 10 times higher than in Colorado, while the states of Iowa and Delaware are more stringent and have lower thresholds than in Colorado. In Alabama, authorities require testing for coliform, high levels of which can indicate unsanitary conditions during production. Colorado does not require testing for coliform.

Mold can grow on fruits, vegetables, meat and bread. The U.S. Food and Drug Administration regulates its prevalence in food, sets thresholds and permits remediation and mitigation methods. But mold can also show up in other consumer goods, from pharmaceutical drugs and health supplements, to makeup and tobacco, where a mishmash of state and federal regulatory frameworks and industry standards provide guardrails of varying strength for consumers.

Colorado law requires cannabis products to pass tests for microbial contaminants, water activity, and potency before getting to a retail storefront. The microbial tests screen for Aspergillus, yeast, and mold, while water activity tests check for potentially concerning moisture levels that could encourage contamination.

And these microbial pathogens can have serious health effects on users.

In 2020, a Centers for Disease Control and Prevention survey of insurance records found marijuana users were 3.5 times more likely to develop fungal infections than non-users, with Aspergillus accounting for nearly half of those infections.

And a 2021 study of nearly 53,000 Medicare kidney transplant patients revealed that marijuana users faced a higher rate of transplant failure and death within three years.

“Although these infections were uncommon, they can result in substantial illness and even death, particularly in immunocompromised persons,” the 2020 study further found.

While any cannabis product that fails must be remediated or destroyed, loopholes in labeling often obscure whether remediation occurred, and gaps in regulations allow small remediated samples to be tested as though it represents a much larger batch of marijuana.

Cannabis remediation, which includes methods like irradiation or ozone treatment, is intended to decontaminate products that would otherwise fail safety tests.

“Licensed businesses that fail mold tests have the ability to decontaminate and/or remediate the failed batches and submit that product for additional testing,” an MED spokesperson explained. “Licensees are permitted to use approved decontamination or remediation methods and retest any batches that previously failed mold testing.”

Dr. Tess Eidem, a microbiologist who has worked in the cannabis industry and continues to advocate for consumer protections, explained just how far remediation can go.

“People can remediate really high levels,” Eidem said of yeast and mold found on cannabis. “You can have one million CFUs (colony forming units) and if you irradiate it with x-ray here in the U.S. or gamma up in Canada, then you can bring it down to passing levels.”

However, there are ways some businesses exploit remediation to game the system, including some producers who preemptively remediate cannabis flower before testing, whether or not contamination is present. This ensures the sample passes, but flagging the product as being remediated is a murky area, industry insiders said. If a small amount sent for yeast and mold testing has been preventatively remediated, the larger batch could be sold without that designation, allowing potentially contaminated product to reach consumers without transparency.

The state’s system, some argue, leaves open loopholes and creates a perverse incentive to cut corners at other stages of production.

“People get around growing their plants in unsanitary environments, or harvesting diseased plants, or not controlling their post-harvest drying and curing,” Eidem said. “They’ll get around failing by proactively treating their cannabis flower before they send it out for testing, and then it’s never flagged in the system as being remediated.”

“You can’t take spoiled hamburger and cook it and be like, ‘it’s fine.’ You can’t do that,” Eidem said. “But in cannabis, you can.”

And according to an industry consultant who has worked with lots of cannabis companies over the past several years, and who asked to not have his name used in order to speak more openly, proactively remediating cannabis has turned into a regular method used to ensure a passing test.

“That’s the standard practice. You treat it before, so it passes. That’s your process to ensure no mold,” he said. “A lot of times what happens, is they will treat what’s required to be sent to the lab, and not the 1,000 pounds behind it.”

Such an oversight in the regulations means that while tested samples have been “pre-remediated,” there could be lots of compromised marijuana ending up on shelves purporting to reflect a passing test.

Cannabis testing regulations have evolved since legalization. Microbial and potency testing were required early, while water activity testing was added in 2021 and pesticide panels expanded in 2023.

While a regulatory system that makes adjustments is not unique, these staggered updates left gaps in oversight allowing exploitative practices like pre-remediation to become common, according to the Masons.

Colorado also has not developed standardized procedures for testing labs, allowing lab directors and owners to rely instead on a reference library maintained by CDPHE that is a compilation of scientific literature on marijuana testing. Labs develop their own testing protocols, which are then reviewed by CDPHE as part of the state’s lab certification process.

The state uses a “complaint-driven” enforcement system, relying on formal grievances or whistleblowers to prompt investigations. The MED has documented cases of test batch adulteration and lab shopping, but these violations often come to light only after whistleblowers tip off the agency.

This reactive model enables systematic manipulation to persist, including artificially inflated potency results and the pre-remediation of contaminated products before they are sent for testing.

RM3 Labs

Rm3 Labs Colorado, owned by Ian Barringer, who previously ran an investment advising firm and was president of a Boulder-based summer camp and after-school youth program, became the go-to lab in Colorado for high-potency marijuana results. But according to the findings of a Colorado Department of Revenue hearing officer, the lab did so through deception that posed peril to consumers — a finding Barringer is now challenging in court.

The hearing officer found that by 2021, Barringer’s lab — one of 10 operating in the state — had cornered a third of all marijuana potency testing in Colorado and had become a favored lab for marijuana cultivators and producers because it regularly produced among the highest potency findings for labs in the state.

The higher the potency of marijuana, the more a product can fetch on the market. Deceptive potency findings, though, can pose risks, especially to immunocompromised patients who might not be getting the proper prescribed product, the hearing officer found.

In 2015, the average potency of marijuana flower in Colorado averaged about 18% to 19% THC, but the potency has trended upward in recent years. By 2021, Rm3 was regularly reporting potency results over 30%, at times even exceeding 40% potency — and during a year-long stretch that began in May 2021 Rm3 averaged the highest potency levels compared to all other labs in the state.

“They were extremely well-known for it,” the industry consultant said of Rm3’s high potency results.

The hearing officer found those higher THC levels occurred through a sieving method that removed mostly stems and plant matter that had far lower potency but was never tested when it should have been, according to the hearing officer’s findings.

For a lot of cultivators, the industry consultant said, “you would send potency (samples) there over anybody else during that time. That was very well known.”

A former employee for Rm3 also warned the state’s Marijuana Enforcement Division that Rm3 was using a potency testing system that the state had never validated, and in 2020 state officials deemed “unacceptable” a previous potency method Rm3 used that dried out samples before testing.

“Drying it out is definitely common,” the industry consultant said of the widespread effort put into boosting THC potency results.

But Rm3’s problems extended to contaminant testing, as well, with the lab reporting Teflon-coated spatulas used by its analysts caused lead contamination. Further investigation revealed calibration errors in November and December 2021 caused Rm3 to certify marijuana contaminated by lead at levels regulators deem unsafe. Colorado’s marijuana enforcement division did not issue a health and safety recall until February 2022.

The owner of a competitor — Gobi Labs — testified that during the five years that began in 2021, he lost more than $1 million in business to Rm3. Luke Mason testified that the lab he and his wife established, Aurum Labs, lost so much business to Rm3, that it led to their shuttered operations.

“We were really exhausted of this industry,” Elizabeth Mason said in a recent interview.

“And discouraged by the direction it was taking,” Luke Mason said.

Elizabeth Mason said it seemed a domino effect took place. Once cultivators and manufacturers realized one business benefited from manipulated lab results, one after another started pushing the boundaries.

“One person was getting away with it,” she recalled. “So, then another person tried it, and then another person tried it, until the whole industry was doing it. The testing labs that were doing it were making a lot of money.”

She stated that some of their previous customers still would come back, asking them for actual results, just so they would know how to fix problems, while at the same time using what she described as unethical labs to get favorable and fraudulent test results that would go to state regulators.

“A lot of time, our old clients who had switched to getting their compliance testing done would still send us a sample because they wanted to know what their real potency was, or they knew they had a mold and yeast outbreak, and they wanted to know if what they had done to remediate it actually worked,” she added.

Colorado’s Marijuana Enforcement Division in 2022 revoked Rm3’s marijuana potency testing certification in June 2022 but renewed that certification a little over a month later. Officials imposed a fine of $400,000 on Rm3, later reduced to $155,000.

Rm3 has sued the state agency and Heidi Humphrey, the agency’s executive director, in Denver District Court, claiming the initial revocation of its certification was improper and ended up causing financial havoc that prompted the closure of the lab, which cost 46 employees their jobs.

The lawsuit highlights that Colorado has not developed a standardized process and claims state officials signed off on Rm3’s testing protocols repeatedly and then penalized Rm3 after competitors complained.

“We are strongly contesting the findings of the Department of Revenue, and we are appealing in state court in an independent forum,” said Barringer, the owner of Rm3.

The state has filed a response to Rm3’s lawsuit denying any wrongdoing.

A System Struggling to Keep Up

Colorado’s Marijuana Enforcement Division operates under a complaint-driven model, relying on complaints or whistleblowers to prompt an investigation. While this approach can and has uncovered specific violations, industry insiders say it leaves the broader system vulnerable to systemic manipulation.

“Are labs cheating? What I’ve seen,” Eidem said, “is that cannabis manufacturers will shop around until they get the result they want.”

Without effective auditing to detect patterns that might indicate fraud, producers can exploit the system by selecting labs where potency is inflated and contamination goes undetected, Eidem and other industry insiders say.

One barrier to accountability is the precise way that marijuana laws have been crafted. The MED has cited a state law protecting testing privacy as preventing the release of lab-specific test results. While the hundreds of thousands of test results analyzed by The Gazette show unnatural fluctuations in yeast and mold testing results, the law prevents being able to see whether the aberrations are isolated to certain labs. This makes it nearly impossible for consumers — or even other industry operators — to know which labs deliver questionable results.

A review of the agency’s “Final Action Reports,” which document when MED has found violations of the state’s marijuana rules, show that around half of the state’s 2024 reports included some kind of testing-related malfeasance.

From test batch adulteration to the use of unauthorized chemical treatments, testing and sampling violations were more common than any other category of marijuana rule violations.

Take the case of Big Medicine Cannabissary, a licensed cannabis cultivator in Colorado Springs, where the company’s owner admitted to adulterating test batches by “submerging marijuana buds selected for testing into a ZeroTol Mixture,” a solution containing Hydrogen Peroxide and Peroxyacetic Acid that the product’s makers say will “prevent, suppress and control” algae, fungus, mold and mildew from plant material. The violations cost the company $8,500.

At a cultivation site called Rivus Fine Cannabis, in Denver, the cannabis producer submitted samples for testing “that underwent a separate sanitization process from the associated Harvest Batch or Production Batch for the purpose of circumventing contaminant testing detection limits.” They were fined $15,000.

At Eco Green Grow, in Denver, MED investigators found employees had been instructed to leave a small sample of the harvest out to dry, in order to juice their THC potency test results. The company was fined $15,000.

In all, MED has posted more than 500 administrative action reports online, going back to 2014, though the agency does not make public any reports that haven’t had a full appeal process play out.

The state’s investigations led to dozens of cultivators being found in violation of state rules, with a high concentration of testing violations. Industry insiders say the reports are likely finding only a small fraction of bad practices.

And while MED adjusted the rules over the years, with the stated intent of regulatory clarity and consumer safety, state lawmakers have sometimes softened the regulations, aligning with objections from the industry.

In 2023, MED adopted a rule requiring that cannabis decontaminated after failing a test be labeled as such, with an effective date of July 1, 2025. But before it could take effect, the state legislature passed, and Gov. Jared Polis signed a law during the 2024 session, which overrode it.

According to the new law, “if a licensee is able to decontaminate (the) product and that product passes additional required testing, then the licensee does not need to provide an additional label that would otherwise not be required for a product that passed initial testing,” the MED spokesperson continued. “This statutory change eliminated the Division’s / State Licensing Authority’s rulemaking authority on the matter, requiring the Division to initiate a repeal of the labeling requirement.”

Despite the lack of labeling required for failed and remediated cannabis, state regulators maintain that the testing program has multiple layers of oversight, intended to ensure consumer safety.

Colorado’s system for overseeing cannabis testing includes annual audits by CDPHE, where regulators review labs’ standard operating procedures, method validation data, analyst training, and quality management systems.

In addition, the MED conducts routine inspections and monitors aggregated test results from licensed labs, a spokesperson said. Testing facilities must maintain ISO 17025 accreditation and participate in a proficiency testing program to verify accuracy.

“These overlapping regulatory mechanisms ensure testing facilities are producing and reporting consistently accurate results,” a MED spokesperson said.

Even with these safeguards in place, inconsistencies that suggest some kind of manipulation persist, raising questions about how effective the oversight is.

The 325,000 cannabis test results analyzed by The Gazette showed a small clustering just below the legal threshold of 10,000 CFUs (colony forming units) per gram, and a steep drop-off just above the legal threshold, when compared to the statistically expected results, given the many tens of thousands of results in lower test result ranges.

The anomalies defy the natural occurrence of mold, and suggest that the results are either incomplete or in some way manipulated.

The Masons said practices designed to increase potency will be used on one sample, practices designed to remediate yeast and mold will be used on another sample, and practices to hide pesticides can be used on another sample, and the three different samples can then each be used for a different test, but all tied to the same larger batch of cannabis.

“They’ll microwave their micro(biotics) sample to kill anything, but they don’t want to send that for potency, because it degrades the potency,” Elizabeth Mason said.

Any combination of these maneuvers designed to get around failing test results, happening broadly throughout the industry, would potentially lead to a steep drop-off in the test results above the legal thresholds.

Consumer alerts leave gaps in public awareness

On its surface, Colorado’s cannabis testing framework presents an image to the public that the products are safe, and rigorously tested.

And according to MED, the agency conducted 160 unique investigations into licensees regarding product safety. And the agency said in a statement that it issued 55 enforcement actions, though only 46 are publicly available.

But even though enforcement is happening, when failures come to light, public alerts often come months or even years after the cannabis was sold to consumers, essentially making moot the alerts.

The delays mean that in order to avoid consuming the tainted cannabis, consumers would have to sit on their purchases for months, waiting to see if there’s a consumer alert. Or even if a consumer wanted to know after-the-fact, they would need to keep the packaging labels from their purchases for months or years after buying it.

A review of three years of MED health and safety advisories shows that nine months passed, on average, from the first sale date of tainted cannabis, before an advisory was issued, with one coming more than three years later.

The advisories support what industry insiders have said about the prevalence of moldy marijuana and testing impropriety. Of the 41 advisories issued by MED in 2022, 2023 and 2024, more than three-quarters of the advisories found Total Yeast and Mold counts in excess of state limits. And one in every three advisories included violations of the state’s testing procedures.

One manufacturer, Durango Cannabis Company, had advisories issued for their products more than once, both in 2023, for improper testing procedures and Total Yeast and Mold levels.

And while the advisories are posted publicly, consumers who purchased cannabis included in an advisory cannot be contacted by the state, because of privacy laws that prevent keeping track of individual purchases.