FORREST CITY -- Gov. Asa Hutchinson on Monday said a computer programmer "exploited" a vulnerability in the state's online portal for people seeking federal Pandemic Unemployment Assistance and that the FBI is investigating the breach.
According to an Arkansas Times report, rather than obtaining private information on individuals, the unnamed programmer actually tried to alert the Arkansas Division of Workforce Services and Arkansas State Police to the vulnerability. The programmer, who was applying for benefits, realized that the site left applicants' bank account and Social Security numbers exposed, according to the report.
The governor was in Forrest City to deliver one of his near-daily coronavirus updates. Deaths linked to the virus reached 100 on Monday, officials said.
[Video not showing up above? Click here to watch » https://www.youtube.com/watch?v=RGwpBZUKxZw]
Federal Pandemic Unemployment Assistance payments are available to gig economy workers, independent contractors and self-employed people who are out of work because of the coronavirus outbreak and are ineligible for other types of unemployment compensation, including regular state unemployment benefits. The Division of Workforce Services opened the Pandemic Unemployment Assistance portal on May 5.
Over the weekend, Hutchinson said the system had been shut down after officials learned Friday that an applicant had seemingly "illegally accessed the system."
On Monday, during the news conference in Forrest City, the governor said the report from the Arkansas Times and his explanation on Saturday did not necessarily conflict.
"My information is that the data was exploited. And so that raises serious concerns. That is the reason the site had to be shut down," he said.
The governor explained what he meant by "exploited."
"When you say exploited, I believe that is a technical term of art that includes visual seeing of somebody else's data. And so that is a concern to us, and that is what constitutes a breach."
When asked how the state first learned of the site breach, a spokeswoman for the governor said in an email to the Arkansas Democrat-Gazette after the briefing that someone attempted to reach the Division of Workforce Services on Friday.
Katie Beck wrote: "We have verified that a call was received by the DWS call center late Friday afternoon. Agency leadership learned of the security breach shortly after via an email from the Arkansas Times and that is when the site was shut down."
Hutchinson over the weekend said ProTech Solutions, a third-party contractor, was working to ensure the site is secure. If the investigation finds that personal data has been compromised, then applicants will be notified, he said Saturday.
When asked Monday about the extent of the site's vulnerability, Hutchinson said 30,000 applicants had submitted their information, "and yet it was a computer programmer that breached the system."
"As to what does that mean in terms of the sophistication of the breach or the sophistication of the weakness, I think I'll wait and get a report from the experts as to exactly how that should be interpreted," Hutchinson said.
The governor did not give an estimate on Monday for when the site might come back online, but he said officials were working during the weekend to resolve the issue.
DEATHS REACH 100
Deaths in Arkansas related to covid-19 on Monday increased by two from the previous day, bringing Arkansas' total fatalities to 100, officials said. The number of active covid-19 cases rose slightly from 1,008 on Saturday to 1,068 as of Monday. Covid-19 is the disease caused by the coronavirus.
Hutchinson held Monday's briefing at the civic center in Forrest City, where officials from the Arkansas Department of Health tested residents for covid-19 on Saturday. Inside a federal prison located in Forrest City, at least 412 inmates and 17 staff members have tested positive for covid-19, according to the Department of Health.
A week ago, the Health Department recorded an uptick in covid-19 cases in surrounding St. Francis County. At the time, the governor called the bump "worrisome."
Health Secretary Nate Smith on Monday said officials tested 550 people in Forrest City over the weekend, exceeding their goal of 500. As of Monday afternoon, 24 of 290 test results were positive. The rest of the results were expected to be completed by Monday evening, Smith said.
The per capita rate of testing in St. Francis County is more than double the average per capita testing rate statewide, according to Smith, although he added that "many of those tests have been in correctional facilities."
At the briefing, Forrest City Mayor Cedric Williams thanked local health officials and the local media for their part in sending the message "that people come out and get tested for this virus."
[Gallery not loading above? Click here for more photos » arkansasonline.com/519govbrief/]
The state recorded 54 new cases statewide, bringing the total number of cases in Arkansas to 4,813. One new case was in a correctional facility.
Smith said there are 591 active cases in the community, 378 in correctional facilities and 99 in nursing homes.
Seventy-seven patients are hospitalized, an increase of 12, Smith said. He described the increase as "a pretty substantial jump," but he explained that hospitalizations tend to lag about a week behind cases, and as a result the increase is not surprising in light of an increase in reported cases last week.
[Interactive Arkansas map not showing up above? Click here to see it: arkansasonline.com/arvirus]
"Fortunately, our number of cases have come down since then, and hopefully we'll see those hospitalizations come down as well, but we'll be watching that very carefully," Smith said.
According to Smith, the number of patients who have recovered increased by 55 to 3,645 since Sunday.
CALL FOR INVESTIGATION
Earlier Monday, state Democratic Party Chairman Michael John Gray called for the formation of a bipartisan legislative committee to investigate problems with the unemployment assistance website, as well as with the earlier rollout of a grant program for businesses.
"I would hope that we move past whose fault it is, and we move into, 'How do we keep this from happening again, why was the trust of Arkansans breached, and what do the solutions look like moving forward?'" Gray said.
When asked about Gray's proposal, Hutchinson dismissed it as "partisan attacks" and said the Legislative Council had already looked into the matter.
The Republican leader of the Senate, President Pro Tempore Jim Hendren of Sulphur Springs, responded to a similar question Monday by saying, "Certainly, questions need to be answered."
Hendren, who is also the governor's nephew, said the formation of an entirely new committee to look into those matters would likely be unnecessary due to the existence of the Legislative Council, a bipartisan panel of lawmakers that reviews state contracts and oversees other matters when the General Assembly is not in session.
"If there needs to be additional hearings, I think we have structures to do that, that both Democrats and Republicans can participate in," Hendren said.
House Speaker Matthew Shepherd, R- El Dorado, also said the Legislative Council would be the appropriate venue to handle inquiries into issues with pandemic programs.
BARS TO REOPEN
The governor on Monday announced that bars inside restaurants can resume operations today. Free-standing bars may reopen May 26, Hutchinson said, giving them more time to prepare and put safety precautions in place.
Dine-in establishments, including restaurants that contain bars, were cleared to reopen with limitations on occupancy effective May 11.
Social distancing rules for bars will be similar to the restrictions placed on restaurants, Smith said.
People will have to rely more on individual precautions -- in addition to public-health measures like testing and contact tracing -- as opposed to "regulatory mandates," Smith said.
"We're going to need to adjust our behavior individually and not count on someone looking over our shoulder to tell us what we know we need to do to protect ourselves and others," Smith said.
DENTAL MEETING
Leaders of Arkansas' dental and dental hygiene associations continued to air complaints over the Health Department's restrictions for their practices, in a conference call Monday with the agency's Covid-19 Dental Health Advisory Group.
In a letter to the governor last week, attorneys for the Arkansas State Dental Association criticized the state's guidance for resuming elective dental procedures as an "unmitigated disaster." The attorneys cited an email sent earlier this month by the Arkansas State Board of Dental Examiners that warned of reports of "over-scheduling by some" dentists, which the attorneys called an "undefined, vague" standard that put dentists' licenses in jeopardy.
Fred Church, the chairman of the Board of Dental Examiners, acknowledged in Monday's conference call.
A Section on 05/19/2020