Department of Commerce Secretary Mike Preston told lawmakers Wednesday that an ongoing grand jury subpoena "will not allow us to share information" about a data security incident nearly two weeks ago in the state's online portal for people seeking federal Pandemic Unemployment Assistance.
Asked about who received the subpoena and where the grand jury is meeting, department spokeswoman Alisha Curtis said afterward, "We are asked not to disclose information regarding any subpoena" based on advice from the FBI, which is investigating the matter.
Pandemic Unemployment Assistance payments are available to gig economy workers, independent contractors and self-employed people who are out of work because of the coronavirus outbreak and are ineligible for any other unemployment compensation.
Preston told the Legislative Council that the state learned of the data security incident May 15 and took the system offline to disconnect outside access to the database. The department then hired a computer forensic company to determine who caused the incident.
[CORONAVIRUS: Click here for our complete coverage » arkansasonline.com/coronavirus]
Independent security experts confirmed that the problem was remediated May 20, that the system was secure and that people could confidently proceed with applying for benefits, he said.
"Right now, the forensic and FBI investigation is still ongoing," Preston said. "Forensic investigations are extremely thorough and require the scanning and reviewing of thousands of lines of code.
"While we have made great progress in the investigation, we are not at a point where we have information to share," he said. "Be assured we are moving forward as quickly and as aggressively as possible to collect all the information and complete the investigation. At the appropriate time, we will share those findings with this body."
According to an Arkansas Times report, an unnamed computer programmer, while applying for benefits, realized the site left applicants' bank account and Social Security numbers exposed. The Times said the programmer tried to alert the Arkansas Division of Workforce Services and the Arkansas State Police.
At the request of Gov. Asa Hutchinson, Preston declined to appear before the House and Senate State Agencies and Governmental Affairs committees May 21 to discuss the website's security. He then agreed to testify Wednesday before the Legislative Council.
"I apologize if there was any miscommunication and misunderstanding about myself or anybody from my team being there," Preston told the council. "We are appreciative that you all get together as the ALC and this body to hear from us. ... Folks went and traveled ... a long way to come down [to Little Rock,] and we weren't there."
Preston said last week in an email to a legislative staff member that he was unable to provide any information to the State Agencies committees about Pandemic Unemployment Assistance issues because of a federal investigation.
Last week, Hutchinson said he advised House Speaker Matthew Shepherd, R-El Dorado, and Senate President Pro Tempore Jim Hendren, R-Sulphur Springs, that his administration would testify at Wednesday's council meeting.
"My team had to be fully focused on supporting the effort of getting the website secure and the payments to the applicants," the governor said last week.
But Sen. Bob Ballinger, R-Berryville, questioned Preston on Wednesday about his absence last week.
"There was a miscommunication, misunderstanding," Preston said. "Our apologies.
"We were discussing with the FBI about what we were not allowed to say, and they were instructing us not to divulge information, so there was a concern [about] what could we say at that time," he said. "What we can [say] is what we shared a little bit earlier."
"Also, we were working feverishly with the team to get those PUA payments out, so I would say it was a combination of both things that we were trying to address that situation, but also making sure that we were in step with what law enforcement and the grand jury subpoena instructed us to," Preston said.
In response to a question from Ballinger, Preston said he communicated with the legislative staff and that "I did not receive a communication that there was still an expectation for me to be there" May 21.
"The apology is on me because my understanding was that it was OK and that I was not to come to State Agencies and that I would be here today," he said.
Charisse Childers, director of the Division of Workforce Services, said that the division has received 39,000 applications for Pandemic Unemployment Assistance since May 1, that it started making payments on May 21 and that it has disbursed $19.3 million.
She said the division approved 21,100 people to file weekly claims in the week ending Saturday; 12,200 of them filed claims and were paid.
She said that in the week of May 16, the division approved 19,700 people to file weekly claims; 16,150 of them did.
Childers urged lawmakers to tell constituents who filed for the assistance to check their emails to keep track of their accounts, as well as to submit their weekly claims.
Childers also encouraged people to file retroactive claims.
Curtis said Childers was referring to the period of unemployment between the date an individual's work was first affected by the pandemic and the date the person's assistance application was approved.
Childers told lawmakers that state officials originally estimated 100,000-plus people would be eligible for the assistance.
"We are at about 39,000," she said. "We thought that population would be larger. We are continuing to reach out to that population and make sure that everybody is aware of this program and the assistance that is eligible under the PUA provision."
Metro on 05/28/2020