Charisse Childers
An aging unemployment insurance system and the desire to get money to unemployed people quickly contributed to security problems with the Pandemic Unemployment Assistance rollout in Arkansas, state Department of Workforce Services leaders told legislators Wednesday morning.
DWS Director Charisse Childers, DWS CIO Carter Hawkins and Commerce Secretary Mike Preston answered questions from members of the Arkansas Legislative Council about the PUA website. Preston also continued to answer questions about the troubled launch last month of the Arkansas Ready for Business grant program.
The PUA had been taken down on May 15 after the Arkansas Times reported apparent vulnerabilities that could expose sensitive information of applicants. The website is designed to get unemployment compensation for self-employed workers and independent contractors in Arkansas who are out of work because of COVID-19. Applications are being accepted here.
The website was designed and built by Protech Solutions Inc. of Little Rock, a software and database company that, according to its website, has done business with states including Arkansas, New Hampshire, Maine, Michigan, New Jersey and Delaware.
Protech’s contract for the website, signed April 14 with the Department of Workforce Services, is worth $3 million, but it allows up to $2 million more for contingencies. The contract, which DWS hasn’t yet paid, lasts until June 30.
Childers said Wednesday that, since the site launched on May 1 through May 23, the PUA website has received 39,000 applications and sent payments to 21,100 people. It’s continuing to process claims on a daily basis, she said.
Preston said the FBI and an independent security contractor continue to investigate the security vulnerabilities that forced DWS to temporarily close the site, a process that includes combining through “thousands of lines of code.” But there was little more information he said he could share.
“While we’ve made great progress in the investigation, we are not at a point where we have information to share,” he said. “Also, a grand jury subpoena will not allow us to share information related to the data security incident at this time. Be assured, we are moving forward as quickly and as aggressively as possible to collect all the information and complete the investigation. At the appropriate time we will share those findings with this body.”
But under questions from lawmakers, Childers and Hawkins described an unemployment insurance system built on antiqued, outdated technology that complicated efforts to build the new PUA system.
Hawkins also defended the department’s use of Protech, and said he would use the contractor again. He described the company as “professional” and “good to work with.” He said the firm has an established team in Arkansas that’s already engaged in at least one state contract, and that, despite the security lapse, it ultimately delivered “a quality product today that is secure.”
“We were moving very fast and asking them to move very quickly,” Hawkins said. “… It boiled down to having to move too fast to get the money out the door, and mistakes were made, and decisions were made to move quickly to be able to accomplish that goal. And unfortunately we did have an issue, but we had to use Protech because of our aging system.”
Protech has a long-term contract with Arkansas to run the state’s Child Support Information System, which handles child support payments in Arkansas. The current contract, signed in 2016 and running until next year, is worth $42 million.
Because the company was already doing business with the state, DWS was able to use emergency procurement rules to quickly hire the firm to build the PUA site, according to Childers. Whether she would use Protech again would depend on whether other vendors were accessible under those emergency rules, she said.
Sen. Jason Rapert, R-Conway, asked whether Protech’s DWS contract carried penalities for poor performance.
Hawkins said the contract has “language in there concerning data security and data breaches and responsibility,” but that “those consequences have not been assessed yet,” as the agency has been focused on “getting the money out the door and continuing to build the system.”
Preston also fielded more questions from lawmakers about the Ready for Business program. On Wednesday, the Commerce Department released a list of businesses that received grants under the program. The rollout was marred by what Gov. Asa Hutchinson called a “premature launch” on April 29 and questions of whether some businesses got advance word of the program, giving them an advantage over others seeking funds.
Under the program, led by the Arkansas Economic Development Commission, businesses can receive $1,000 per employee and up to $100,000 total. They can use the money to buy supplies including personal protective equipment, no-contact thermometers, no-contact point-of-sale payment equipment, cleaning supplies and hand sanitizer stations. They can also use the money to market themselves as “open for business” as the state lifts COVID-19 restrictions.
Legislators continued to ask Preston whether some businesses got advanced notice. Sen. Larry Teague, D-Nashville, quizzed Preston about how some businesses were able to submit their applications on April 29 within minutes of the website opening.
AEDC documents showed that the first business submitted its application at 5:04 p.m., four minutes after AEDC said the website went live.
Preston said he didn’t know how some businesses were able to submit the information quickly, and said he hadn’t talked to any of them to learn how they did it.
“If I were to guess … they probably tuned in to the governor’s press conference, they went to our website and saw the information that they needed,” Preston said. “They probably applied for some type of SBA loan or grant before, so they had a lot of this information that we were asking for excessively available. And they went on and were able to do that in, you know, under 10 minutes.”
Sign up for Daily E-news
