Advanced Communications and Information Technology - Joint
Video
Transcript
7 documents
Summary
Machine transcript
May contain errors. Verify important quotations against the official video.
About transcript accuracy
- Source
- Whisper
- Model
- ggml-large-v3-turbo.bin
- Processing date
- October 2, 2026
The meeting was called to order by Senator Ricky Hill, who then handed control to Representative Stephen Meeks to outline the agenda and an upcoming closed session for a cyber-security briefing [13,15].
Meeks explained that the closed session (item e) would let the chief cyber-security officer report on state cyber-breaches without exposing vulnerabilities [15-16].
He announced that this would be his final meeting as chair of the House Technology Committee after ten years, reflecting on missed opportunities in broadband expansion, a delayed NASA lunar-base partnership, and the need to embrace artificial intelligence [17-27].
Meeks also proposed creating a dedicated innovation officer to drive AI adoption and prevent the state from falling behind other jurisdictions [26-27].
Senator Hill moved to approve the minutes from the August 26 2026 meeting, which passed unanimously [30-31].
State Broadband Director Glenn Howie reported that over 400,000 homes and businesses-about one-third of Arkansans-are slated to receive modern broadband this decade [34-35].
Since its 2019 inception, the Broadband Office has awarded $826 million in grants for 298 projects covering more than 205,000 locations, with 167 projects already completed serving roughly 124,000 sites [36-38].
The latest BEAD program will fund 210 projects reaching 77,000 locations with $300 million, achieving 99 % of eligible sites receiving competitive bids and directing 67 % of funds to Arkansas-based companies [40-44].
Statewide connectivity rose from 73.1 % in June 2022 to over 90 % by December 2025-a 24 % increase-and the agency highlighted new transparency tools such as an interactive broadband map and real-time construction dashboards [51-52,56-68].
Palo Alto Networks’ Michael Gregg briefed the committee on emerging AI-driven cyber threats, emphasizing AI as a force multiplier, identity-based attacks, and supply-chain risks, and urged the state to develop safeguards and education around AI use [120-143].
He warned that fake-identity attacks are growing and that third-party supply-chain vulnerabilities-up 3.8 % and now accounting for 23 % of cases-are being exploited by nation-state actors targeting weak defaults in critical infrastructure such as water and pipeline systems [144-149].
Gregg explained that frontier AI models now let threat actors develop and launch fully automated attacks within 24 hours, collapsing the historic two-year lag between vulnerability discovery and exploitation [150-152].
Breach statistics showed roughly 50 % of organizations suffer a breach each year, with an average disruption of 241 days and a $4.4 million cost, while entities that employ AI for defense reduce losses by about $2 million [154-155].
He argued that accumulating dozens of security tools is inefficient and advocated consolidating into integrated platforms that combine AI with a human-in-the-loop approach to lower overhead and prevent analyst burnout [156-158].
Drawing on his state CISO experience, he demonstrated that such consolidation and AI cut mean-time-to-respond from over 10 hours to 55 minutes and reduced phishing response time by 97 percent, extending analyst tenure from roughly 14 months to more than 40 months [160-162].
Representatives Meeks and Richmond asked how states can become leaders, emphasizing AI-driven proactive defense, the difficulty of attribution, and the importance of basic hygiene such as changing default credentials [165-170, 182-186].
Gregg recommended AI-awareness training, analogous to phishing training, to prevent misuse of generative AI by employees [175-176].
Mary Ann Mines introduced herself as founder of Secure Energy and described Arkansas’s supportive ecosystem-including venture centers, SBA matchmaking events, and federal grant programs-that enables cyber-energy innovation and micro-grid resilience [206-224].
The committee then moved to a brief recess after a motion was seconded and approved [229-231].
Machine transcript
May contain errors. Verify important quotations against the official video.
About transcript accuracy
- Source
- Whisper
- Model
- ggml-large-v3-turbo.bin
- Processing date
- October 2, 2026
Senator Ricky Hill
Unverified
3:30
Now we'll call the meeting to order. Okay, the meeting is called to order. I'm going to turn the meeting right over to Representative Meeks, and he is going to explain to us the close process of the meeting we're going to have a little bit later on. That does not mean it's right now, and then we'll get started with the beginning of the meeting.
Representative Stephen Meeks
Unverified
4:00
okay thank you um mr chairman so um pursuant to act 489 of 2025
when we get to item e that is going to be a closed session we pass this in order to allow our chief cyber security officer to give us updates on any cyber breaches that have taken place in the state over the last year and allows us to become informed what was done how those were handled without letting the bad guys know where all of our vulnerabilities are at so
after we finish with D we're actually going to have a cyber expert visit with us for a few minutes and then we will recess and then upon that recess we'll ask all the members of the public and those that are not legislators or staff to please exit the room at that time yes yeah during the recess before we move on colleagues this is quite likely my last meeting as your chairman after 10 10
years being the chair of the House Technology Committee we might try to squeeze in one more but it will be off-site so this will be our last meeting here that I will get to be your chair and so I'd like to share just a few closing thoughts while anybody still cares what I have to say about these topics and then then we'll move on to the to the meeting and I want to speak about missed opportunities when I took over this committee back in 2015 one of
the goals that was given to me was to get broadband throughout the state and And it was something that I worked on for several years. And eventually, we came up with sort of a plan to try to begin investing in broadband at that time. But unfortunately, my Senate co-chair at the time, who's no longer in the Senate, basically threw me under the bus. We missed that opportunity. And so, as a state, we did nothing until COVID hit. And then when COVID hit, it became an emergency. And I was in a meeting with Governor Hutchinson, and he asked me, how much do we need to invest in this?
and I told them $100 million, and that was our first investment. But we missed the opportunity to begin working on that sooner. It wasn't until we had an emergency that it became important enough for enough people to care about it. Last month, many of you were here, but I spent three months working with Congressman Hill's office trying to have NASA representatives come to our state and share with us the ambitions to build the lunar base. And NASA is looking to invest billions and billions of dollars.
And obviously those dollars are going to be spent here on Earth and looking for businesses here, you know, people to build pumps and sensors and, you know, things that we can do here in Arkansas. And, you know, I went over to the Arkansas chamber and told them, you know, hey, there's an opportunity here for our state. And, you know, they had little to no interest in it. Thankfully, the Little Rock chamber picked up the ball. When we held the meeting, many of you were here last month, only one TV station cared enough to be here about that.
It was an opportunity for us to grow jobs in our state and to inspire the next generation. And we missed that opportunity, I believe. And now we're looking at AI going into the future. This last August, I had a chance to attend AI4, the largest AI conference in North America. There were 13,000 people there from 100 different countries. I actually encouraged some of our executive agencies to come and attend. There were over 300 AI vendors there.
And I spent a lot of my time visiting with those vendors to find out where's the technology going, where are the opportunities for us. And a lot of them told me that they would be interested in coming to Arkansas, visiting with us, sharing what they were doing. I actually had one guy told me that, you know, you guys are from Arkansas. you need to be over here talking to these folks that are in California and some of these because they're tired of all the junk that's going on there and they're looking for places to move and relocate. But I was the only one from Arkansas that was there. And as much as I would love to
offer them economic incentives to come to our state, that's not my position. So again, it was another opportunity from our state that was missed. I set up that 2036 commission to celebrate our state's 200th birthday i'm sure they'll do good things but i want them to do something great will they take it you know hopefully they will they'll prove me wrong but will something great come from that we'll see you know lastly one of the guys at the conference said this if your state
is not implementing ai you're doing a disservice to your citizens it's not about replacing our employees there's a lot of fear there that is not what the purpose of ai is the purpose of the ai is to allow the computers to do the computer work so that the people can interact with the people so that our sit our employees can be a lot more productive and we have a once in a generational opportunity here to take advantage of this technology but i'm afraid what's going to happen
is if we continue down and do like we've always done as a state we're going to be lackadaisical about it we're not going to put forward the effort and instead of being a leader in this area which because we're smaller we can be a lot more flexible than our larger cousins that we're going to look back and because we didn't put the effort we didn't put the time into it that we're going to end up being last again and I don't want that to happen for our state when we have such a wonderful opportunity and it takes somebody who's willing to be that point person who's willing to get
excited who's willing to continue who's willing to push and i don't know maybe we need to put you know maybe we need to create a position an innovation officer who's going to be that person who's going to push this push this push this because unfortunately what happens we all know you get busy in the everyday things of life and it's easy to push these opportunities to the side because it's not an emergency it doesn't need to be done today and we keep missing these opportunities. And so again, I know I'm rambling here, but, and I don't know that this is directed
to any, but we as a state have an opportunity here. And my hope is, is that as we go forward to encourage you, don't miss this opportunity. Make sure you keep pushing, pushing, pushing, pushing to take advantage of this opportunity that's being presented with some of these AI technologies because if not we'll want to be we'll be in the bottom ten states again and asking ourselves why when we could have been in the top ten so with that again colleagues if this is our last meeting it's been an honor serving
with you I think we have gotten some great things done and hopefully my challenge to you will encourage you to continue to be that push so that we can be in one of the top ten states as this technology involves and not a bottom ten state so with that I will turn it back over to Senator
Senator Ricky Hill
Unverified
11:25
Hill thank you representative makes well since this is a technology meeting I just want you to know things happen with technology colleagues if you would notice if you
hit your documents on your little computer there they're not loaded so we're going to go old school today since it's representative meek's last meeting we're going to use our paper okay that's right and so uh moving right on so you use your paper documents today colleagues and uh we'll go right on uh we need a consideration to uh approve the minutes from the august the 26th 2026 meeting everyone has a copy of that do we have a motion or any
questions? We got a motion. Yeah, we got it right here. We have a motion by Representative Richardson and a second by Representative Meeks. All those in favor? Aye. All opposed, same sign. Motion passed. Minutes are approved. Okay, we're going to move right on to item C, the update on the Arkansas Broadband Office. Mr. Glenn Howie if you'd come forward and introduce yourself for the record all
Speaker 47
12:56
right good afternoon Glenn Howie state broadband director go right ahead sir okay appreciate it mr. chairman and representative Meeks thank you for your service to the state your chairmanship it's been a pleasure not to prevent present before this committee multiple times so today we'll look at an update on broadband development across the state quick agenda I'll try to get through this relatively quickly for everyone but first in case there are any new members that perhaps are seeing me or hearing me
for the first time or new to the General Assembly since our last update we'll have one slide on the state broadband office and talk about that briefly we'll look at a brief history of the grant programs here in the state take a quick snapshot of the current state of connectivity we'll talk briefly about transparency and communication then of course as you are all well free to fire away and ask questions whenever you want I have a dedicated Q&A portion here at the end a quick
did you know before we get started, this is a stat that I and our team worked hard on to mine the data on this, and I think it's a great statistic that you can take on the road with you that over the course of this decade, from 2020 to 2030, over 400,000 homes and businesses in the state of Arkansas, which represents more than one million Arkansans, okay, so more than one-third of our population will gain access to modern broadband speeds for the first time over the course of this decade so it's a great it's a great did you know statistic as you are out
on the road again quick recall for any of you that may be unfamiliar our team in our office as representative meeks a highlight at the opening established in 2019 and in 2020 the first funds started to flow through our office both with the state allocation and then federal dollars as a result of the covid pandemic we have when we're fully staffed we have eight full-time staff positions on our team which I'll note to date all federally funded okay so our office is fully federally funded does not impact state appropriations since the establishment of
the office we've awarded over 800 million dollars in grants 826 to be exact covering 298 projects across the state accounting for over 205,000 homes and businesses of those 167 projects have completed to date covering 124 000 so we're almost at the 125 000 location mark as a result of the efforts of the state this body and our office and for that everyone should be very very very proud okay so quick look the history of the grant programs to date you'll notice these are
screenshots from some of our dashboards that are all publicly available and you'll note we kind of They look better as the years go by. So you'll see improvement in these dashboards as we move forward. So round one funded both through state, again, appropriations and CARES Act funding. Back in 2020 and 2021, 76 projects out of round one. Again, $122 million total completed several years ago. Round two of funding for the state. This was through state and local fiscal recovery funds or SLR funds out of ARPA.
As you would know, at 86 projects there, out of round two, $278 million in allocation. This is back in 2021 and early 2022. Again, these dashboards are all publicly available. Round three, capital projects fund, or CPF, again, a second bucket out of the ARPA program. 19 projects there, $126 million allocation to date, 75% completed on those projects. Very excited. And we have a June 30th next year deadline by U.S. Treasury to have those projects completed.
Quick update here in our capabilities on the dashboard side of things. So this represents our fourth round of funding as a state, the Broadband Equity Access and Deployment Program, or BED program. this particular funding round you have 210 projects covering over 77,000 locations for 300 million dollars in grant funding there now on these projects we expect shovels in the ground on the first of these projects by the
end either right before the end of the year or early right after the new year on these particular projects across the state and the second and last did you know over the presentation today that the bead program at the 300 million dollars here for broadband deployment represents the single largest investment in broadband infrastructure in Arkansas's history so a couple of slides about the bead program which again is our fourth funding round here in the state I want to lead off with it was a highly highly competitive grant program we received
730 applications from 33 different providers to cover those 77,000 locations that were eligible. Of those, 99%, 99% of all the eligible locations in the state received bids from two or more internet service providers. So highly competitive in the design and the way that we did that. And I think a testament to Arkansas's program to date is that, again, this was the fourth funding round. So we've been able to learn and improve over the course of these different years and these different funding rounds, sort of give us an edge over our state,
our peer states and our competitors in the region because we've been so active in this process every location in the state in the bead program received an average of 3.1 applications so again highly competitive highly competitive program quick summary here of the data we just talked 730 applications from 33 isps to cover to those 77 000 locations i do want to note you know in the program we have homes we have businesses but we also have community anchor institutions so we think about any police stations perhaps out there that lacked connectivity police stations
libraries so forth as far as i am aware we are the only state in the country that can say that we had a grant award for 100 percent of our locations so every locations that were eligible for the program received a grant award and as far as i'm aware i think we're the only state in the country that can make that claim again just shy of 300 million dollars in grant funds for that round i want to note more than 200 million dollars of that is is granted to arkansas-based companies so if we think about economic development and job growth and businesses for our people
that's a fantastic statistic that over 67 percent of our funding is dedicated to arkansas-based companies 3 800 average grant award per location i do want to say that this particular grant round that we just ran has a technology neutral kind of approach we had 76 of our locations in arkansas get awarded to fiber technology, 16% of our locations awarded to LEO satellite, 7% licensed fixed wireless, and 1% a hybrid fiber coax.
Two more slides on BEAD, and then we'll talk about the current state of connectivity, which I know that you're all wanting to hear about. So timeline here, the federal government, U.S. Department of Commerce through NIST and NTIA has approved all of our plans. ALC has granted, well, both peer and ALC granted appropriation approval for the fourth round of funding. We've executed grant agreements with all 14 ISPs in the program, and then, again, both our environmental reviews that have to take place, and we think construction will start
either end of this year, early next year. Quick note, and last slide on the BEAD program, earlier this month, NTIA, who, again, is the federal agency responsible for the program at the federal level did release some additional guidance and so they put out a policy notice to include additional locations into the bead program and really the goal here is to connect additional locations that fall into three categories one locations that have been defaulted okay by other providers and other federal grant programs for
instance ones that we are not responsible for right so you have some providers really across the country that have been a part of other perhaps FCC programs that have defaulted on their projects, we want to try to bring those in to the program if we can. Two, locations that have been added since the map was finalized. So you have new builds, right, new homes that go up all the time in Arkansas, and if they're on the most recent map that's available to us, we want to add those in to the program. And then lastly, there was a challenge process that was a part of when we kicked the program off. One of the challenges that could have been made was a provider would say, hey, you know,
going to build to that house in six months so you shouldn't fund it with the grant we're going to do that if any of those providers did not fulfill their commitments we're going to bring those locations back into the program so we expect somewhere between 12 and 16,000 additional locations with a NTI will also give us a cost cap
Speaker 52
22:02
of what we can spend to cover those locations we expect it to be somewhere between 46 and 61 million yes
Speaker 47
22:10
sir oh okay so the light so I wasn't sure. So what does all that mean?
A lot of data, a lot of maps. What does that mean for the current state of connectivity across Arkansas? Well, there's about, and Shelby probably can fact check me on this, about 1.36 million locations in Arkansas, homes, businesses, and again, community anchor institutions. If you can see it, it's a little small. We did some data tracking from June of 2022 through December of last year. In June 2022, we had a 73.1% sort of connectivity rate,
if you look at what the federal government defines as broadband speed. So again, in June of 2022, Arkansas was at a 73.1% connectivity rate. As of December last year, we're at over 90% now. That's a 24% increase in broadband connectivity across Arkansas over the last three years. So again, Arkansas has much, much to
Speaker 60
23:08
be proud of. Quickly, on transparency and communication, you know, we think we pride ourselves
Speaker 47
23:14
on our team as being very open and transparent, both with the General Assembly, our providers, and our stakeholders across the country.
We do many, many forms of outreach. You guys have seen, some of you have been at some of the town halls that we'll do. Every fourth Friday of the month, we have that legislative update window where we get on a virtual call and are available with office hours. and many of you have have come to those we do them for you we do them for the county judges we do them for the mayors we do that every month we've done town halls across the state which I said we have weekly ISP calls with our providers that we've done for years now where they're able to ask questions and get the latest updates again a host of things that we do we think that we truly
are the most communicative and most transparent office in the country and if you feel like if you ever feel like we're not let me know okay reach out to personally and we'll get that corrected quickly this is a screenshot of the Arkansas State broadband map it's publicly available on our website again the most detailed map about broadband at the location level in our state's history we also know as a form of communication we need to do better and get out videos and always continue to iterate on how we communicate so
briefly I'll show a quick video that our team has produced that we hope to go
Speaker 65
24:41
public with in the next couple of weeks. Have you ever wondered who your internet providers are or whether your home is part of a federal broadband grant program? The ARConnect broadband map can help you answer both questions in just a few clicks. You can explore broadband availability throughout your community, compare providers, and better understand how broadband investments are expanding across Arkansas.
Start by visiting the Arkansas broadband map and entering your address in the search bar. The map will zoom directly to your location. Next, click on your location to view additional details. The map will tell you whether your address is included in a federal broadband program such as the BEAD program or whether it's covered by another broadband grant. From there, you'll see the internet service providers that report service at your address along with information about the technologies they offer and the speeds they advertise. This makes it easy to identify who currently provides broadband service to your home or business.
Whether you're looking for an internet provider today or simply want to know if your location is part of a federally funded broadband project, the ARConnect Broadband Map is your one-stop resource. Visit
Speaker 68
25:48
the map today and discover what's available at your address.
Speaker 60
25:53
So this is an example of a tremendous resource that's available to the
Speaker 47
25:58
General Assembly, providers, the general public, They can answer the vast majority of questions. So sometimes we'll get inquiries from you guys, right? And it's, you know, a particular constituent in having a problem
or they don't know who's serving them or are they part of a grant program or what's going on. You know, that state broadband map, which, again, is the most detailed one we've ever had, can answer 99% of every question that a constituent will have for you. So, again, a tremendous resource, publicly available. Any way that we can help you get that out and disseminate that, we'll be more than happy to do that. and wrapping up here i just wanted to return uh to the the bead dashboard that we put together and regarding transparency one of the things that we did with this newest dashboard was add filters
okay so um you can search the bead program and the locations that were assigned in the bead program and the the provider that won the awards for those locations you can do filters and you can filter by congressional district or technology or project or provider or county or municipality and especially for the members of the committee by Senate or House district okay and just as a quick example it's at the top here and again this is publicly available anyone can use this
represent weeks for you and your last meeting a highlighted district 42 on the map and so as a house member or a Senate member you can filter the map will zoom in on your district and it'll list the data for your district so the providers who won awards in the bead program for your district uh the number of projects the number of locations the total grant award and the technology breakdown is all there for you and again publicly available um we we leverage this a lot and people generally like um what's available and last slide before open you know q a portion here one of the things that we added as well from
a public stakeholder standpoint is people want to know and you hear it too you know when is it getting to my house right when are we getting connected so what we did with first country first state in the country that I know of to release and in a real-time progress dashboard system and so this what you're seeing here again is publicly available this maps all of the bead projects across the state and it directly links with the portal system that the providers have to report into to our office and so on a monthly basis as the providers are out there building
and constructing on a location by location basis this dashboard will update in real time and so people are able to search by their address and get updates and so again it's a real-time insight into what's taking place the construction that's going on and i don't know of a way that we could be more transparent with folks through all the methods that we try to do okay so with that little q a here at the end and we'll see we'll see
Senator Ricky Hill
Unverified
28:45
what the committee has thank you for tally do we have
Representative Stephen Meeks
Unverified
28:51
any questions representative meets all right so uh first off thank you sir for the work you've done
you've done a tremendous tremendous job in that uh that office uh so basically um according to this we're down to less than 10 percent of our citizens that don't have access to high speed internet that's correct okay awesome love seeing that uh any idea with how that compares with other states nationwide or we
Speaker 47
29:14
uh you know yeah that's a great question i think one of the things that's not on this particular slide deck here from, from 2022 to 2024, Arkansas actually led the nation and increased broadband connectivity over that timeframe, uh, 9%, uh, from 2022 to 2024. Uh,
so, so one, Arkansas is leading the country in expanding broadband connectivity. Um, you know, there's always, there's always more work to do. I think folks that, um, are still waiting, right. For connectivity, you know, they don't care about my stats, right. Right. They don't care that we've whatever they know that they're not still there they're still waiting on connectivity in their family which which gives us the motivation to move with a sense of urgency this is you know everything you talked about earlier right the space stuff and and economic development you know try doing
economic development without internet connectivity right it's not happening and so this is one of the most critical things that
Representative Stephen Meeks
Unverified
30:10
last question for me do we have a maybe an estimated completion date when we think we'll have most everybody in the state take care for us by the
Speaker 47
30:20
end of the decade is our goal so by 2030 and the bead program is a four year federal guidelines give the providers four years to complete their projects that count that the clock has already started on them which would put us at 2030
now I always impress upon them that I want it done in two years or less that's the expectation from my seat technically they have four but we push very hard I don't care how small it is or how large it is. The goal is two years or less. And that's what we're going to try to do.
Representative Stephen Meeks
Unverified
30:46
Okay. And then one last question came to my mind. Uh,
at one point there was a, um, supply chain issue. We're trying to get fiber because everybody else in the country is trying to do this. Uh, is that supply chain issue still there trying to get the fiber to be able to put it in the ground or
Speaker 47
31:02
that, is that getting better? Yeah, sure. Great question. Uh, you know, what
you've had now is a convergence, right? Not only are, again, this is a 42 and a half billion dollar program across the country, right? And so not only are you having all of the states run these broadband infrastructure deployments, you now have the added data center builds that are taking place across the country, which require fiber connectivity and infrastructure, and all that goes along with that. So now you have a convergence of the infrastructure projects and data centers and everything getting built. You know, the manufacturers continue to tell NTIA that they have it covered, and they've
made those commitments. I think AT&T recently announced a $3 billion fiber deal with Corning. That was announced recently. But, yes, it is a barrier, I guess, in short, to wrap it. It's a barrier that we're aware of and we're tracking. We do everything that we can from our seat here in Arkansas. Thank you. Representative Mayberry. And this
Speaker 79
31:56
is one of your last meetings as well, is it not? It is, yes. Thank you.
Representative Julie Mayberry
Unverified
32:11
I appreciate that. Representative, maybe you. There we go. I thought I had it on. What I was saying was that you are so very easy to get a hold of, and thank you for taking all the questions. Just remind me, but I think I just found it. I was looking at that one, that map, and I was trying to recall, because it's been a little while since I looked at it, what the gray dots, what the green dots, what the, I don't know if you call it, pink or red just kind of I just found it online but just remind us what what does that mean what are all
Speaker 47
32:40
those different dots yeah sure okay great question representative Mayberry is going to say
Julie representative Mayberry and I will say you were one of the most invested members of the of the legislature on this on this topic I
Speaker 47
32:54
need it they need it if I recall correctly they're they're recipients in the bead program yes they are we got It's just not happening quick enough for them, but it's okay. Yeah, so what you're looking at here, again, this maps all 1.36 million locations until Shelby fact-checks me in a little bit on the count.
But what you'll see here is that the gray
Speaker 47
33:21
or meet the federal definition of broadband. The green dot locations are grant program locations, but not the bead, most recent locations. And then the purple locations on this map are the bead program locations. So served, granted, bead. Okay. And
Representative Julie Mayberry
Unverified
33:44
then anywhere that there's just nothing that's...
Speaker 47
33:47
If there's nothing, that would indicate... And again, there's more dots once you zoom in, right? But broadly, if you see a location without dots, that means there's no location. there there's no home there's no business there's no community anchor institution it's just forest or what have
Representative Denise Garner
Unverified
34:07
you okay okay thank you thank you and I too would just like to say thank you for all of the communication it really really did help so of the folks that we have left what are the barriers
to getting them service is it location is it isolation is it sure what is it I mean, I can guess that there are some places that may never be able to get fiber, certainly. But are there other alternatives? What are we doing for that group? Yeah, that's a great
Speaker 47
34:37
question. You know, there should be, there's always going to be some location, right? Either someone built a new house or the federal mapping missed someone. There's always going to be a location. There should be very few, okay?
It could be 77,000 locations or the last of the last, right? There's a reason they're in this bucket, right? There's a reason a provider has not built to them yet, right? Either density, so there are so few homes in that area that it makes it financially very difficult for a provider to bring in, it's not regulated, it's not a utility, so it's still a for-profit business, right? So either the locations are not dense enough to date to have made the financial investment, work it for them.
Topography plays a role, rights are early in the mountains and there's granite and you've got to drill through the granite to get there, which makes it more expensive. So typically geography and topography and density of locations is what makes or breaks financial sense from a provider to go build to them. But in any case, that's the 77,000 locations across the state. most expensive that's why over time for your grant cost per location kind of goes up because you're you continue to get the better ones right better ones as you go so again these are the last of the last there's always going to be a little
few that's why you know they're they're through some of the other federal programs like USDA and then the form bill there's additional broadband grant money in the rule kind of in the reconnect program through USDA Universal Service still runs their program so there's always going to be a little bit a funding flow to help pick up these locations um but but the first part of your question these are the last the last we hope to get them all and then secondly you know there is a place for every technology um you know so even with a grant program some locations are just naturally so
expensive to get to with a traditional fiber route that it would make sense for for a leo satellite system like a starlink or the amazon leo competitor that's going to come online in the next year or so so you have to ensure when you're running these programs that you select you know the best technology for the right location um and there's there's really uh there's room for all the technologies depending upon the
Representative Denise Garner
Unverified
36:59
there is hope for everybody that we're going to have something to be able to get internet service
Representative Stephen Meeks
Unverified
37:04
great thank you very much representative meeks yeah you'd mentioned
the leo satellites how do how do we administer that because that's more of an individual type thing versus a
Speaker 47
37:17
isp provider yeah sure so in in our four in the bead program we have uh grant awards i don't know if it's on maybe one one of these screens let's see it's gonna be small but yeah we have grant awards for both spacex which is starlink we have grant awards for amazon and the leo competitor um those the two satellite companies will certify that they can provide service to all the locations
they've been awarded at that point it's our expectation a little bit down the road but they would open up for instance a both an online portal system where folks can go to register for their their service they would get equipment for at no cost to them delivered to them with a reduced monthly cost associated with that service and so there's going to be a portal system that they've told me about there will also be a sort of a traditional telephone line that folks can call into because if you're signing up to get internet you may not have internet to get internet right so there'll also be a hotline number for folks to call in end of the day equipment at no cost to
the home and a reduced cost monthly cost per service so if
Representative Stephen Meeks
Unverified
38:17
we have constituents that don't have internet service now maybe the bead program won't get to them for a couple of years they could theoretically go to and apply to get you know leo service at least until sure yeah it'd be a great a great bridge opportunity
Senator Ricky Hill
Unverified
38:37
we seeing no further questions you're finished all right thank you sir thank you sir appreciate what you do and what you've
done for the state as far as when you started i think i was at the first meeting
you ever did in i think it was keogh arkansas the day you started the day after you
Speaker 47
38:56
started it was i think it was the first week i was on the job um folks look at mayor white she is she is a a very um she works hard for her community i'll tell you that and um yeah first week at the little it's like it's also the fire station and city hall all in one yeah and and we were you know all that was it was really
neat because we were there and we're talking about the problem in connectivity and what they what they needed um and you had all the fire equipment in the same room it was very neat it was it was great. And I will say, you know, it's been four plus years now. Four plus years. It's
Speaker 52
39:36
been an honor to be here and to do this work. And I very much appreciate it. Well, you've done a great
Senator Ricky Hill
Unverified
39:42
job. We appreciate it. And you're always available for anyone if they have any questions. So we thank
you for that. Thank you. Moving right along, Section D, Discussion of the Future of Utilization of Artificial Intelligence and Cybersecurity Implications for Arkansas. Mr. Michael Gregg. If you will, Mr. Gregg, just
Speaker 115
40:27
Strategist for Palo Alto Networks. Thank you all for having me here this
Speaker 117
40:34
afternoon. I just wanted to talk a little bit about kind of what
Speaker 119
40:42
I see because I deal primarily in SLED, so state, local, education is where I deal.
What I see from the states, what I see from other states as far as AI and cybersecurity. So as far as my background, I've published over two dozen books. I led cyber operations for the state of North Dakota for five years. As that, I grew us from about 20,000 endpoints to 250,000 endpoints. During that time, I was lucky enough to get invited to the White House to meet with the president and talk about our cyber program that we developed.
And prior to that, I worked international, and I worked international for a terminal organization, and I worked in the Philippines and in Singapore. And I really got to see firsthand, this was during the time of NMDA, the kind of things that threat actors were starting to do as far as automated attacks and attacking organizations and large entities. And so I just want to share a little bit of that today as far as what we see today and what we see in the environment going on. So I'll kind of cover this in three areas.
I'll talk a little bit about emerging trends as far as what we see with AI and where AI is today. I'll talk a little bit about kind of the current threat landscape as far as the types of cyber attacks and what we're seeing as far as in cyber. And then finally, what I would see is some opportunities there for the great state of Arkansas and then open it up for discussion. So kind of starting off, I would say this. If you think about it, it's interesting because AI has come about so fast.
If you look even two years back, two years back, no one really even talked about this stuff. It's really a complete paradigm change. And it's interesting because if you look at Sam Altman, he said at one point, he said what he said 26 months ago, he said we added something like a million users over five days. And then more recently, he said we added a million users in the last hour. So just even in the last hour, they added a million users. So this transformation has come about very, very quick.
And it offers a lot for states as far as what government can do as a really multiplier and multiplier to help. And what I mean out of that is coming out of state government, one of the things I figured out pretty quick is you can't hire yourself out of your needs of what you need. There's no way to meet that workforce that you need. And with AI, we've got real opportunity as far as faster document processing. we've got real opportunities there, is finding errors in things like fraud prevention for state
benefits and others, and really increasing that experience that we see as far as individuals have when they interact with state government. But at the same time, unfortunately, what I've got to say is that it not only creates opportunities, it brings high amounts of risk. And I think it's interesting, this quote up toward the top, if you notice it says, 78% of users who use AI at work bring other tools rather than the ones that were given to them by the entity. And so my point is,
is that like outside of my day work, I do a lot of work with nonprofits. And one of the nonprofits I work with, they said, you know, we've got all this information about our donors and everything else. We're just going to drop that over into an AI program and see what we can find out. And I They said, there could be some PII or other types of information in here that maybe we don't want to share publicly. But they hadn't really thought about that, and they hadn't thought about how exposing this could cause a big problem. So really that education and awareness that we have to bring forward to the state for them to understand what to use and how to use it is going to be a big paradigm change.
Now, for the current threat landscape and what we see going on as far as the landscape is that this is truly a paradigm shift, and here's what I mean by that. If we think to the past and we think of code and applications and programs, we look at application lines of code, we look to see if they have vulnerabilities in there, and it's very deterministic to have people find these problems. We can look for those, but with AI, it's much different because these attacks can mimic what
you'd think of as normal usage, and you could think of something like, well, I'm going to automate payroll, or I'm going to automate payment out to recipients, and you might be able to do that, but unless you do things like keep human in the loop, and you have good controls for this, what may look as normal traffic could very quickly turn into something where it's been turned for bad or it's been turned in some way that exposed some type of security weakness. Now, as far as the actual threats that we see and that we see from our investigative
branch, Unit 42, we really see four trends in 2026. So we go out after there's a big breach, after there's an incident, we work with cities, counties, schools, higher education, K-12, And these four themes have been consistent in what we see. One is that AI is a force multiplier, that threat actors are now using AI to move very quickly and to operate at speeds that previously were unheard of.
The second is in the majority of these attacks we see, when we look at these attacks, identity is the number one item that these threat actors use to gain access and get in, identities in almost all of these. Software and the software supply chain is going to become even more critical than it's been in the past. It's who we buy from. Do we trust them? Do we know what they're giving us? Have we vetted it? Is it secure? And finally, and the security one to me is nation-state actors, what nation-state actors can do
and what we've already seen them doing just over the last six months to a year to two years back. And I'll talk about each one of these in a little bit more detail. So the big one is really AI as a force multiplier. So Palo Alto was very lucky because we got early access to what are known as these frontier models. And when we got early access to these frontier models, what we were able to do is look at our own code and do a self-inspection. And when we did this self-inspection in less than three weeks, we found the equivalent of literally five years' worth of vulnerabilities.
So we found what would have taken our testers five years to find in three weeks. And that's great. If you're a customer of our product, that's a great thing to have because now I can say our product is much more secure. But here's the thing. If you buy product from somebody else that didn't vet it, if you have homegrown code that the state's built in-house, if you have applications that are open source and these open source applications haven't been vetted, that means the threat actor can now decompile or disassemble this code very quickly
and find these vulnerabilities at machine speed. So identity, this is trend number two. And in trend number two, about an 89% of the cases we look at, when we go out and we work a breach, 90% have to do with identity. That could be human identity. That might potentially be shared accounts. It could be potentially system accounts. It could be AI-based accounts. But in most of these, the threat actor's gotten in by some form of identity.
And here's what's scary about that. Once they get in and they get this access, it looks like a normal user. It looks like Senator Hill. It looks like Representative Meeks. It looks like Michael Gregg. It looks like any normal user. So as they move laterally between the network and move between Department of Transportation, Health and Human Services, whoever else it may happen to be, It looks like normal traffic, and because of that, that allows them to move laterally very quickly and not be detected until massive damage is done, ransomware, other types of attacks.
The next one is identity. Anyone see in the last six months to a year where they showed North Korean hackers hacking in, they appeared to be U.S. citizens, they would apply for jobs, but they look just like someone that was here. They sound like someone that was here. They speak English. But the whole idea was the threat actor used these synthetic identities, and with these what they're trying to do is get a job, get hired, get a username and password, get access in, and then once they get access in, they now have credentials,
and again they're using that access to get in and cause damage or wreak havoc. The other part of this is think about things like in the old days. Everybody at one point probably got that email from the Nigerian prince, and he was going to make sure you got, what, a million dollars and make sure you got part of that. Yeah, that's not real. Sorry. Sorry, sir. But today, what they can do is through AI, they can generate a unique threat email or scam for each individual on here.
I looked at some previous ones where you folks had looked at things like delete me and others to see what information was on the web. They can gather that information and target each one of you individually. This has really impacted me enough. As an example, I told my bank, I said, I don't want you to do any of their transactions with me over the phone. I want to go in person for them. Because someone could simply take my voice from this committee meeting here today, make a clone of my voice, and then call into the bank and say, transfer this money or move this money.
So this whole fake identity thing is going to continue to be a big problem or big issue as we move forward. Third one we have here is supply chain. And with supply chain, it's all about who we buy these items from and what we buy. So when we look at this from Unit 42 in Palo Alto, here's what we see. we see a large percentage there of the actual attacks and the attacks that are coming in, something about 3.8% of an increase using third-party applications, coming from those third parties.
That's risen to 23% of the total cases we look at in 2026. And in 22% of those, they used vulnerabilities to maintain that access and get access. Think of it like this. If the great state of Arkansas was going to build a new building onto the Capitol, if Department of Transportation was going to build a new bridge, you'd probably want to make sure the rebar was the right rebar to the right strength. That the concrete used was a specific type of concrete.
You'd want to have inspectors or auditors come in and see that they've built it to code. When we buy software now, we have to inspect it very closely when it comes from third parties because otherwise we do not know whether or not we are going to inherit their vulnerabilities. So looking at this code becomes much, much, much more critical than it's been in the past. Number four is nation-state actors. Nation-state actors can include China, North Korea, Iran.
Now, sometimes they do this to get instant access. Sometimes this can be done for long-term persistent access to stay inside these networks or maintain that access. I'll give you an example. Just over the last few months, we've seen multiple states impacted as far as their water systems, and their water systems have been impacted by what we believe are Iranian-based threat actors and others. And for this, I'd like to be able to say that these individuals did something unique,
that they did something that was hard to do. But what they did in the majority of these attacks was they scanned the Internet. They looked in for open ports and services that were tied to these water-based systems. Then they simply used default usernames and passwords, credentials that had never been changed, and used those to log in and get access. So some of this goes back to just basic hygiene practices, moving this stuff off the web, changing usernames and passwords,
and putting that basic hygiene in place. In other cases, though, it's more critical. Think of, for example, the targets we've seen against U.S. infrastructure, including power, including pipelines. Anybody remember, for example, the Colonial Pipeline, Eastern U.S.? Colonial Pipeline was hit, knocked out all oil and gas distribution on the East Coast, caused gasoline shortages, caused their shortages in this. Imagine if threat actors now got in persistently and turned this off on large areas.
With water, maybe we can do without that for a short period of time. But imagine electricity goes down for hours or days. That's an impact that stops everything. So these types of attacks are something also that we see that you're going to have to be concerned with. So the final piece of this is really in the hands of the threat actors. they can now use these frontier AI models to dramatically accelerate attacks. So what used to take long amounts of time can be done very quickly.
I'll give you an example. In my previous life in state government and in private industry, taking 30 to 45 days to patch infrastructure was not unheard of. It takes time to do this. It's a cycle to get this done. But with threat actors, they can now do this very quickly. If you look at this graph, what you'll see is if you look back just to about 2018 or 2019, the time frame there shows over two years. Here's what I mean. When a vulnerability or problem was found, it took over two years before anyone actually
created some type of their threat to use with it. That time frame now today has fallen under 24 hours, meaning when a vulnerability is found, the threat actors have used AI and they've created now an attack that's fully automated from end to end and they can launch in under 24 hours. It means the historic way that we've done patching in the past will no longer work. We've got to change that approach to keep up with them, which means we've got to use AI from the defensive standpoint to fight it from the other standpoint
of what the threat actors are going to do. They can even set this up and set it up on their computer systems and say, do the entire attack in from end. And if it doesn't work the first time, it can be polymorphic, meaning it changes and it keeps trying. So if it can't get in the first time, think of the analogies of your house. It goes and tries the door it can't get in. It'll go around and try a window and see if it can open the window or get in that way. So what are our opportunities? Here's what I'll say. The one item we have to think about out of this and we clearly have to consider is this,
is that if we don't do anything, there is an impact from this. And that's the great thing that I appreciate you allowing me to speak here today because the goal really here is to make individuals aware where you can assess the risk and you can determine is it something we can accept? Do we transfer it? Do we mitigate it? How do we handle this risk? And what we see over the organizations in public and private, 50% in general have some type of breach each year. Out of that, the disruption duration on average is 241 days. So over six
months. The financial impact is about $4.4 million per impact. So it's the cost of do we spend now and do we put defensive controls in or do we spend later and we clean up after the ransomware breach. Here's what we do see, though. When we take and we look at things and we look, for example, like at the industry and entities that have put in AI and have used AI for defense, we see a reduction of around $2 million. So the impact they have is much lower than what we see for those that
have not put AI in place to defend. Here's the other one, and I think this is interesting. As a former state CISO, I can tell you that adding more security tools, one on top of another, on top of another, doesn't help the process. If you look at the slide, what you'll see is accumulating 31 different tools over 13 different companies means you're paying 13 different bills. You've got 13 different vendor contracts, and you're forcing state employees to log into multiple consoles and tools to see what's going.
This is the same thing I had. When I started, I literally felt like I had to have my head on a swivel because I had to turn and look here, and I had to turn and look here, and I had to turn and look here to see what was actually going on. So that consolidation means that you're much better off when you can consolidate this down. So what I did was I consolidated down all these point tools. So the result was first I cut the overall overhead of having these redundant line items. Also, because now I had these integrated automated tools where I used AI, but I still had human in the loop, I was able to reduce down my time.
And I didn't need to hire 50 other analysts to do it. What I was able to do is take my existing analysts, move them to more fulfilling types of work, and at the same time handle this noise in the background. And what it did for me was when I started, my analyst on point usually stayed about 12 to 14 months. and I'd lose them. They'd burn out. By using these types of techniques, I pushed my analyst over 40 months. They'd stay three, four years because they were doing more fulfilling types of
work, better meeting the citizens of the state's needs, and at the same time, they were able to grow and grow in what they were doing. So let me show you these numbers. These are not numbers from some vendor marketing material. These are actual numbers from my work that I did as a state CISO to give you some idea of implementing any AI, using it with human in the loop, and being able to do this and build this in for defense, what'd you get out of it? So when I looked at things, and this
is in one three-month period, in one three-month period, I was able to reduce my mean time to respond for attacks coming in from over 10 hours down to 55 minutes. I was able to take the phishing meantime to ownership, take that down by 98% of the previous time I had, and I only had a few number of vendors I had to deal with, I only had a few products, and my team could focus on what was most important. My time in phishing and looking at phishing, which is usually always a big problem that's on average over half of any what state cyber program looks at is phishing and that
trying to trick people in, reduce that down by about 97%. So I would say this. There's many different ways that the state can benefit from proper AI implementation. One is just on the client services and being able to move to where people can get those services they need more quickly and get that information. That's what I loved about the last presentation was how you could go down there and drill down in the map and get to exactly what you want, when you want it, and citizens got access to that.
Two is raise that overall level of government efficiency, and the third piece of it is really that consolidation of platform approach to security. So consolidate down that number of tools, use those single platforms, use AI to fight bad AI, and at that point really change the paradigm of what we see today. So in closing, I'd just like to say this. AI is an accelerator. It's either going to accelerate state efficiency and defense, or it's going to accelerate adversarial intrusion.
Governance, visibility, machine speed defense is going to determine which side of that line that state government lands on. Thank you all for your leadership, your time here today. Open for any questions. Great presentation. We do
Senator Ricky Hill
Unverified
1:01:40
appreciate you very much for doing that. And we'll turn it right over to Representative Meeks.
Representative Stephen Meeks
Unverified
1:01:47
So thank you for your presentation. That was kind of making the point I was trying to make when I – my opening statement. Essentially, this game is going to be won by who has the better AI.
It's going to be AI versus AI, state government versus the bad actors. And if we don't put these tools in place, it's going to be detrimental to our citizens. You know, we have a lot of data out there for our citizens. And so where do you, I guess it's more comments than questions. Where do you see not only Arkansas but other states as far as implementing these kind of strategies?
You know, what can we do as a state to make sure we're a leader in this area, that we're protecting our citizens' data, and that we are not falling behind, that we're not vulnerable? Because, and the reason why I ask that is, if it's easier for them to pick on Idaho, we're going to pick on Idaho instead of Arkansas, right? We want them to pick on Idaho and North Dakota and everybody else. So how do we make sure we're not the
Speaker 117
1:02:59
easiest target? Representative Meeks, members of the committee, first thing I'd say is I love that analogy. because the analogy, I would agree with you.
Speaker 119
1:03:06
I would say it's much like that, that they say if you're at a camp out and a bear comes in and starts chasing everybody out, you don't have to be the fastest runner, but you don't want to be the slowest one either. So first, I think all of you are taking a huge step here today because it's understanding that problem and that the paradigm has changed and that the times we live in changed. I think that's the first piece. The second piece out of that is starting to look at those programs and those ways to be able to do that and not to add headcount and add people, but be able to add that efficiency.
And the third part is just look at that overall attack surface, because what I described as an example with water was simply they left these water systems exposed. They had default usernames and passwords, and threat actors leveraged this. So doing basic hygiene along the way will go a long way toward helping address this problem.
Representative Stephen Meeks
Unverified
1:04:06
And my last question is that one of the pieces of legislation that I passed last year was to require that state agencies have training for state employees.
Can you talk about the importance of that and any recommendations to make sure that, so that we don't have employees that are taking data that needs to stay secure and putting it out in the public chat at GTP? Representative Meeks, members of the
Speaker 119
1:04:36
I mentioned I work with several nonprofits. One of them is Habitat for Humanity. If you go out to Habitat for Humanity, and I love working for them because I figured out how to do so much stuff that I couldn't do before.
But my point is this. In the morning when you go out there, if they're going to give you a circular saw or they're going to give you some other type of power tool, you have to go through training first before they give you that tool. Otherwise, their insurance cost would be huge. AI is no different, much like we have phishing training. And we need phishing training to tell people you shouldn't click on that link, you shouldn't pick up that thumb drive you found in the parking lot and bring it in and plug it into your computer. We have to do the same thing with AI. It's not that people don't want to do the right thing.
They have to be educated on it. So my personal approach would be much like you're probably doing phishing awareness training, you add in AI awareness training in much the same way. so that people understand those risks and they understand that if they put that data or information in those programs, the potential risk or impact of that, because they want to do the right thing. We just have to help educate them as far as
Senator Ricky Hill
Unverified
1:05:52
what that is. Thank you. Next we have Representative Richmond.
Representative Marcus E. Richmond
Unverified
1:06:01
Chair. One of the concerns I have seemed like in this particular problem area that we have is that it always seemed like we're reactive in our response and constantly trying to undo the damage that has been done. I would think that AI would be able to make us, put us in a position where we could be more proactive, possibly get ahead of this. Have you seen any states or is there anybody that you know out there that's actually, as part of the defense for the state, created teams that literally just go in and search for these vulnerabilities and look for the potential problem?
And the other thing then is, can we eventually get to the point of who actually did this instead of guessing that, well, we think it was the Iranians, we think it was Chinese, whatever? Thank
Speaker 117
1:06:54
you. Yeah, let me I'm gonna answer Thank you representative Richmond members of the committee. I'm gonna
Speaker 119
1:06:59
answer the in part first and then come back to the other piece You can do attribution many times, but attributions very tough Because they come through one entity to another entity to another entity so you can find out
But sometimes I just want to say it doesn't always matter because if they've caused damage in an outage We've still had the damage and the outage, and if we find out that it's North Korea, it's another entity, there's not always a lot that we can do. So we can trace it back, but that won't always maybe help you in the moment of that. And the interesting thing about me getting to see 50 states is if you've seen what one state does, there's 49 other ways to do it, and usually the other states are doing it 49 different ways.
But that's not wrong because you get to see a lot of different ways this is handled. Now, here's what I've seen is some states are going in and they're doing such things as virtual patching. So what they do is they, at the firewall level, put these controls in place very early. The other thing I've seen that some entities are starting to do is just bring in a team. And they bring in a team and the team burns down that backlog of vulnerabilities and burns down those vulnerabilities that are there. and the second piece is look at that process so here's what i mean by that you have things that
are inside your house and they're inside your house and that's hard for the bad guy to get to but you have things outside your house maybe you have some stuff on the front porch you have some stuff on a carport you have some stuff outside in the yard that they can get to that perimeter surface if you can reduce down what's there think of that as your tack surface and you can remove the water and the sewer and the other systems where it's back behind those layers of protection, then you've given yourself more time to patch that and secure that. So securing what's seen as external,
working on that first and moving that down, and then using teams to address those items that are highest risk, highest impact first, maybe doing that as a one-time spend is what
Speaker 122
1:09:02
I've seen, or the two items that I would bring up. Thank you, sir. Thank you, Mr. Chair. It sounded like a military plan, didn't it? The only other question I have is
Speaker 134
1:09:19
whether to scan you and Meeks and see if your synthetic personality is generated by Skynet or something. That's the reason we cut your speaker off.
Senator Ricky Hill
Unverified
1:09:30
Representative Collins, please take your time, sir. Thank you, Mr. Chair. Well, I appreciate you being
Representative Andrew Collins
Unverified
1:09:39
here, and I appreciate the presentation. I guess, you know, I kind of have a question about the format. I understand you're here because you're invited to present to us. It does seem to me that if there are things that we as a state should be doing, the real conversation should be with our state sister who is in the room right here
and does a great job and probably is well-informed about everything that you said. So while I'm glad to hear it, you know, it's good for me to hear, I feel like the actionable items, there are already gaps in what we're doing. It's going to be with that conversation. So I guess my question is, do you have plans to talk to him? Or is that something that he needs to have the conversation with you? Or do you feel like he is probably in his work as our great state?
So gotten all this information and is probably putting that into practice in
Speaker 119
1:10:35
some way. I would agree that your team is doing great work. And I think the thing that I bring to the table is a different point of view. Because in my role, what I get to see is what all 50 states see and the types of incidents that we see across the United States. Now, as far as any help with your team, I know, Gary, I've talked to these folks before, and I would think of that quote as iron sharpens iron so one man sharpens another.
And what I mean by that is I'm certainly available to consult and advise however is needed if I can help in any way. But my role here today is just kind of say what we see as far as attacks over the entire U.S., the soft spots we see that threat actors are going after, and what we're seeing where states win and states lose, meaning we had the city of St. Paul taken offline last year. We had the state of Nevada that had a huge breach and had to shut down portions of their own network
because they were not sure how far the threat actor had gotten in. I just want to really help advise and give that insight into it to give better understanding of it to help these folks with the presentation and the work they do here for the
Representative Andrew Collins
Unverified
1:11:51
great state of Arkansas. Okay. And I have, again, I guess I just will make a final comment. I feel very confident that he is looking to have those conversations with people who are sharpening him and his team, but I appreciate you informing us as well.
Speaker 138
1:12:06
Thank you. Thank you, Representative Collins. Representative Hall. Thank you,
Representative Brad Hall
Unverified
1:12:11
Mr. Chairman. Thank you for being here today. I'm kind of AI illiterate, I guess. I just know I push a button and it comes up and I ask it a question and it answers it. Whether it's right or not, I have no idea. my concern is is that you know in the future as we get into this with you know we're in a war with iran or a military conflict what happens if we go into a military conflict and and they start really attacking our like data centers what happens to to the ai at that point do does our
water systems completely shut down because to me i feel like ai makes us kind of soft you know it's easy and people are are creatures of habit and we like easy and and once we lose those uh i guess the the people that that work those jobs or do those things uh we can't really call them back to do that and and uh that's what concerns you know like i used to work on my truck and and now i pop my hood and it might get better gas mileage but i can't work on it you know so So I'd just like to know, listen to your response on that.
Speaker 119
1:13:15
Thank you. Representative Hall, members of the committee. What I would say is as far as, like, the data center piece of it, that's not really my bailiwicker area. I'm more about my areas of knowledge are cybersecurity risk and compliance. But I would say that for threat actors trying to get in, nation states and others, they're going to
Speaker 122
1:13:35
look for easy points of attack. They're going to look for that soft spot. and try to get in so again if it's something they can see or access like the water systems we
discussed and that doesn't have even the basic controls put in place like usernames and passwords changed uh then we've got real issue and i'm right there with you with the vehicle i love to work on vehicles but i can't do it on anything new anymore because i don't know anything when it's underneath the hood it's all electronic thank you representative
Senator Ricky Hill
Unverified
1:14:08
Hall seeing no other questions mr. Gregg we do thank you very much for your time sir and appreciate you being here and we encourage you to share any of the knowledge or any
information that you have about other states what they're doing what they're not doing with our people thank you thank you sir okay we're going to jump real fast we had someone to come in that actually won't sign sign up to speak uh today on the closed session but she won't be able to do that a little bit later on so we'll get uh miss marianne means to come uh come forward please introduce yourself uh for the record and tell where you're from and and what you're an expert on.
Speaker 143
1:14:53
Dr. Mary Ann Mines: Good afternoon. I'm Dr. Mary Ann Mines, and I appreciate this opportunity. So thank you, Chairman Meeks, Chairman Hill, and members of the committee for allowing me to say hello. I am Dr. Mary Ann Mines, founder and CEO of Secure Energy Incorporated. It's an Arkansas-based cybersecurity and energy technology company. I also serve as CTO and Executive Vice President of Emerging Technologies at Curtis Stout, which is an 80-year-old electrical contractor here in Little Rock, Arkansas, as well.
I moved to Arkansas three years ago, and prior to that, I spent 30 years in Washington, D.C., working at the intersection of cybersecurity, national security, and critical infrastructure protection, as well as emerging technologies in those fields. My background has included work with standing up at Department of Homeland Security, now 25 years ago. I was on the Infrastructure Protection Transition Task Force, where they brought 22 agencies together to really focus on critical infrastructure.
Also with standing up U.S. Cyber Command, which was a few years later, when Joint Task Force JTF-GNO, the Global Network Operations, transitioned to U.S. Cyber Command as a part of its move up to near Fort Meade and also working with NIST and the National Science Foundation and some specialized cyber security development and Department of Defense and other intelligence and federal agencies. So today I wanted to share and I'm going to move this over here so I'm not looking sideways.
One of my primary focuses is taking that experience and building capability right here in Arkansas. this is a very special state and I really believe in its future and want to make sure that we're energy resilient and cyber security is at the heart of that and I do appreciate the speakers already today kind of doubling down on that so with that through secure energy who are developed we've developed a capability that comes out of the intelligence community I'm not here to sell that I just want to make you aware of it called trusted grid talk it is an
Arkansas-based and developed cybersecurity technology focused on protecting operational technology and it controls our energy and cyber our critical infrastructure. We also just recently received an award from the Army to do that very thing in a program that's focused on cyber resilient tactical micro grids and power plants for our nation so it's very exciting. I share this because it's important to me that Arkansas has the opportunity to become a recognized
center for energy resilience, cybersecurity, microgrids, defense technology, and critical infrastructure innovation. We have tremendous assets here, as you all know, our universities, our utilities, our electrical and manufacturing industries, military installations right here nearby, and technology companies, and most importantly, our people, and the resilience that comes from our wonderful people in Arkansas.
What I want you to know about me is I want to be a resourced Arkansas, when the legislators dealing with questions involving cybersecurity, artificial intelligence, energy infrastructure, grid resilience, defense technology, or emerging technologies, I'd be honored to provide whatever technical perspective or assistance that I can and I also want to help bring federal investment there's a lot of federal investment that's possible here and I'm already with just one year of being a women-owned Native American
owned small business that I stood up as an Arkansas company we won an award within nine months with the Army that's a 10 million dollar contract so we are we are looking to bring in the investment I'm working with the Venture Center I'm working with the Small Business Administration and really just doubling down on putting Arkansas on the map from a federal perspective. It already is on the map, but really putting it on the critical infrastructure protection cybersecurity map. So with that, and also technology development, we've got a lot of innovation,
and I'm tied into some of the innovation. My husband and I stood up a nonprofit called Smart Innovation Corporation. It's an Arkansas-based nonprofit. it. We want to give back and help the workforce development and especially in the STEM education and bringing our young people up in this area. There's so much opportunity and I think if we come together as a state we can provide jobs for them so that when they're here they can grow here and live here and stay in Arkansas instead of have to chase jobs maybe in Washington
D.C. or California or something like that. But we want to make them at home with technology opportunities and advancement right here and let's see sorry my last few things I have spent much of my career working on these challenges nationally and at this point my career I want to bring that experience home it's actually my husband's home I we met in Virginia and he grew up in Arkansas and we've been back and forth for 30 years with kids and grandmas and all that but now we
made, you know, Arkansas our home, moved here just three years ago. So with that, thank you for allowing me to introduce myself. And it's sort of a casual, just get to know your way. I just really do want to be a resource. I'm very much about educating that workforce and helping us advance as a state. So thank you
Representative Stephen Meeks
Unverified
1:20:36
very much. So let me ask a question. I think you answered it, but um you you were in washington dc you you came to arkansas to develop a cyber security business
was it was it um i guess what was the motivate you know is the environment in arkansas favorable for small businesses such as yours to grow in this space is that one of the reasons why you chose to come here because obviously you could have gone anywhere in the country i mean you said of Virginia. I think family may have been a motivator there, but talk to us about why Arkansas for growing this business, and are there things we can do as lawmakers in state policy to encourage
Speaker 143
1:21:21
that in other businesses? Thank you for that question. Yes, actually it started as a family moved and it became a reality to me that this is the absolute best place to start a technology company. I've been able to be introduced to the ecosystem with the Venture Center. Many of the -- there's incubators, there's incredible resources for small businesses. The ASB -- I'm probably going to mess it up -- the Arkansas Small Business Technical
Development Center, the major resource. They host opportunities for the small businesses that, I mean, no comparison. Let me just give you an example. Last Friday, I actually rode back on the airplane with government Sanders, believe it or not. We were seated next to each other, which was exciting. But I was up there for what was called a government matchmaking event put on by the Small Business Administration. There were, like, 30,000 people there and, like, maybe 40 government officials that we were trying to get matchmakers with.
Impossible. I had two appointments, and I flew up there for that. And as an example of what happened in Arkansas when the ASB, what did I say, TDC, sorry, put that same kind of event on with the American Seed Fund. And it was the same kind of thing. were 20 government officials there and the ratio was I had a meeting with every single one of them that there was almost fewer companies there than there were government opportunities to speak with so the the opportunity of for
access and relationship with the the government and the for instance today this would not happen in Washington DC where I'm just you know in the audience to meet you right before the meeting and you invite me to say hello. That is extraordinary, and it means so much to me as an individual and to me as an innovator and a technology leader and somebody who wants to inspire a younger upcomer in the entrepreneur world. This is the place to do it.
And also, not just the personal side and the support, there is investment. There are big grants. The EITC program is extraordinary. For a company like mine, I'm going to go through that program and have a facilitated, you know, Series A raise that is supported and encouraged, and the investors are coming forward because there's actually, it de-risks their investment. So there's, I just so appreciate Arkansas,
and I think it's a leader in supporting small business, especially in the technology front. As
Representative Stephen Meeks
Unverified
1:24:12
lawmakers, we love hearing that. Thank you, and thank you for your willingness to
Senator Ricky Hill
Unverified
1:24:21
visit with us today. Yes, thank you. I appreciate you. Thank you for addressing us. Appreciate it very much. Thank you. Before we move on to the next phase of the meeting, I want to personally say, Representative Meeks, thank you
for your service to this committee and to the state of Arkansas and to the state legislature overall.
two of us have shared part of uh part of our districts together in the past and with the redistricting we kind of got split up and stuff but always enjoyed working with you and everything and i know you're passionate about the technology and everything here that's really wanted to say thank you for your time thank you for your service and i personally appreciate everything you've done for the state of arkansas and wish you the best in the next next adventure in
life so thank you for that very much sir appreciate it and with that being said if we can get a motion
we need to take about a two minute break maybe or five minutes two to five minutes the five minute break on this so we have a motion can we get a second got a second all those in favor say aye opposed same sign we're going to take about five minute break and we'll get back with you if any one of you want to you can uh say congratulations to representative meeks for some great years of service.
Agenda
A. Call to Order
B. Consideration to Approve the August 26, 2026, Meeting Minutes [Exhibit B]
C. Update from the Arkansas Broadband Office [Exhibits C1-C2]
- Glen Howie, Director, Arkansas Broadband Office
D. Discussion of the Future and Utilization of Artificial Intelligence and Cybersecurity Implications for Arkansas
[Exhibit D]
- Michael Gregg, Field Chief Information Security Officer and Director of Strategy, Palo Alto Networks
Closed Meeting Pursuant to Act 489 of 2025
E. Update on Audit and Enforcement Findings [Exhibit E]
- Gary Vance, Chief Information Security Officer, Arkansas State Cybersecurity Office
F. Other Business
G. Adjournment
Documents
| Title | Type | Pages | Source |
|---|---|---|---|
| Agenda — ADVANCED COMMUNICATIONS AND INFORMATION TECHNOLOGY - JOINT, Oct 2, 2026 | Agenda | 1 | Official source ↗ |
| Agenda — ADVANCED COMMUNICATIONS AND INFORMATION TECHNOLOGY - JOINT, Oct 2, 2026 | Agenda | 1 | Archived copy · official source no longer available |
| Exhibit B - 8-26-2026 - Minutes - Advanced Com. and Infor Tech | Exhibit | 1 | Official source ↗ |
| Exhibit B - Minutes 08-26-26 | Exhibit | 1 | Archived copy · official source no longer available |
| Exhibit C1 - Arkansas Boradband Office Presentation | Exhibit | 25 | Official source ↗ |
| Exhibit C2 - Arkansas Broadband Office Video | Exhibit | 1 | Official source ↗ |
| Exhibit D - Palo Alto Networks Presentation | Exhibit | 25 | Official source ↗ |
Speakers
Speaker 1
Speaker 7
Speaker 10
Speaker 7
Speaker 19
Speaker 18
Speaker 24
Speaker 18
Speaker 6
Speaker 4
Speaker 31
Speaker 17
Senator Ricky Hill
Unverified
Representative Stephen Meeks
Unverified
Senator Ricky Hill
Unverified
Speaker 47
Speaker 52
Speaker 47
Speaker 60
Speaker 47
Speaker 65
Speaker 68
Speaker 60
Speaker 47
Senator Ricky Hill
Unverified
Representative Stephen Meeks
Unverified
Speaker 47
Speaker 52
Representative Stephen Meeks
Unverified
Speaker 47
Representative Stephen Meeks
Unverified
Speaker 47
Speaker 79
Speaker 80
Speaker 81
Representative Julie Mayberry
Unverified
Speaker 47
Speaker 91
Speaker 47
Speaker 60
Speaker 47
Representative Julie Mayberry
Unverified
Speaker 47
Representative Denise Garner
Unverified
Speaker 47
Speaker 52
Representative Denise Garner
Unverified
Representative Stephen Meeks
Unverified
Speaker 47
Representative Stephen Meeks
Unverified
Speaker 88
Senator Ricky Hill
Unverified
Speaker 47
Speaker 52
Senator Ricky Hill
Unverified
Speaker 46
Speaker 114
Speaker 115
Speaker 117
Speaker 119
Senator Ricky Hill
Unverified
Representative Stephen Meeks
Unverified
Speaker 117
Speaker 119
Representative Stephen Meeks
Unverified
Speaker 117
Speaker 119
Senator Ricky Hill
Unverified
Speaker 130
Representative Marcus E. Richmond
Unverified
Speaker 117
Speaker 119
Speaker 122
Speaker 134
Speaker 116
Senator Ricky Hill
Unverified
Representative Andrew Collins
Unverified
Speaker 119
Representative Andrew Collins
Unverified
Speaker 138
Representative Brad Hall
Unverified
Speaker 119
Speaker 122
Senator Ricky Hill
Unverified
Speaker 143
Representative Stephen Meeks
Unverified
Speaker 143
Representative Stephen Meeks
Unverified
Senator Ricky Hill
Unverified
Speaker 1