The alternative, of course, is to apply for a visa. This is a long-winded process. First, he'd have to apply to the police for a copy of his criminal record. (Cost �10. Maximum wait 40 days). He'd then need to arrange an appointment at the US embassy in London. (Cost $100. Wait around 2 weeks). After downloading and completing the relevant paperwork, he'd have to attend the interview. (Cost �13.50 to pay for the return, by courier, of his passport). He'd then have to wait to hear the result of his application. (Minimum time currently quoted = 8 weeks. During this time his passport would be held at the embassy, so he wouldn't be able to leave he country for any other travel).
The risk with this approach is, of course, that he could be refused a visa. The exact criteria used by the US authorities are not made public but it seems likely that someone convicted of possession of a class C substance 20 years ago would stand a much greater chance than someone who has just been released from prison for supplying a class A drug.
If your friend has already booked his holiday, then he has been extremely unwise. (That's the politest way I can put it). If time allows, I'd recommend that he seeks a visa.
If he's not already booked, I suggest that he seeks a visa before he even considers booking. (If necessary, that might mean delaying the holiday until next year).
Chris