Good morning and welcome to the
Port of Vancouver Board of
Commission meeting. Today is
Tuesday, September 8th, and I'm
calling the public meeting to
order at 9:30 a.m. There was no
executive session held this
morning. Please note this
meeting is being recorded. My
name is Don orange. I'm the
commission president for the
Port of Vancouver. Joining me
are Eric LaBrant and
Commissioner Temple Linse. We
are conducting a hybrid meeting
along with our in-person
meeting. We are having here. We
are also set up so those who
are not physically able to
provide oral testimony can do
so virtually. Please join me in
the Pledge of Allegiance.
Pledge allegiance to the flag
of the United States of America
and to the Republic.
>> For which it stands. One
nation under God, indivisible,
with liberty and justice for
all.
>> To the agenda. First action
item is approval of the minutes
temple.
>> Yes. So I did review the
minutes and found them to be
largely in order. There was a
small clerical error on the the
originally published minutes,
which was simply a time error.
So that has been updated. The
error was listed that we signed
documents at 952 and adjourned
at 9:59 a.m. and or ten. It's
been corrected to reflect the
proper time, which is in the
9:00 hour, not the 10:00 hour.
So with that change, I move
approval of the minutes.
>> I'll second the motion. All
those in favor?
>> Aye.
>> Aye. Unanimously. Jonathan,
I think we what is it? Open
forum is next up.
>> We didn't have anyone sign
up for for virtual open forum.
And we don't have anyone
present who signed up to speak
today.
>> Okay. Hearing none. Next up
are action items on the agenda.
That's to you.
>> Okay, so first on the agenda
item today will be first action
item. Today will be presented
by Lori Taylor, our industrial
and maritime sales manager.
>> Thank you Jonathan. Good
morning commissioners. First
action item is to approve the
First Amendment lease between
the Port of Vancouver and Sigma
D G Corporation. This lease
agreement supports the port's
strategic plan, goals to
support growth and economic
opportunities for existing
tenants that utilize the port's
property and infrastructure
investments to create jobs and
support the economy. Sigma D G
Corporation, or Sigma, is North
America's distributor of
threaded fiberglass rods and
connectors. They. This
specialized product is used in
a wide range of concrete
product. Excuse me. Projects
including roads, bridges, and
mining. They also fabricate
their own bolts and connectors.
Sigma has been a port tenant
since 2013, leasing 950. Excuse
me, 9150ft² of warehouse space
in building 2801. On May 14th
of 24, Sigma entered into a
five year agreement, expanding
the lease premises to 15,750ft²
to support the fabrication
operations. The purpose of this
amendment is to extend or
expand their premises to
22,000ft². Effective August
26th, 2026. To accommodate
their growing operation, Sigma
has six full time employees on
site at 2801 B through C. If
approved, the new value of this
lease over the remaining 33
months of the term is
approximately 520 000, plus
additional charges for
leasehold excise tax, common
area maintenance insurance and
stormwater recovery fees. A
portion of the lease revenue
was included in the 2026
approved budget, and remaining
revenue will be included in the
2027 preliminary budget. The
recommendation is that the
Board of Commissioners approve
and authorize the CEO to sign
the lease amendment of 2801,
section B and C, Northwest
Lower River road between the
Port of Vancouver and Sigma D,
G.
>> Questions.
>> Not a question, but a
comment. Thank you for the
presentation and I think it's
great to see a tenant that's
been here so long growing and
expanding and that we're able
to accommodate them. So very
excited about that.
>> I was just going to ask if
I'm looking at this map
correctly. This is our neighbor
just yep.
>> Just across the way. They do
share a building with another
tenant, but they have big plans.
So we're here to support that.
>> Fantastic. How was it?
>> Thank you. Thank you.
>> Well then, if there's no
further comment, I move to
approve the recommendation as
presented by staff.
>> I'll second the motion. All
those in favor?
>> Aye.
>> Aye. Unanimously. Thank you.
Jonathan.
>> Okay. Our next agenda item
today will also be presented by
Lori Taylor.
>> So this is to approve the
First Amendment to restated
ground lease between the Port
of Vancouver and sell
Copartnership, who's doing
business as Verizon Wireless,
the port. The port's strategic
plan has established a goal to
generate and sustain
diversified revenues to promote
the port's long term financial,
sustainability and economic
base. The Restated Ground Lease,
effective January 1st, 2015,
amended the original 1984 lease
in its entirety. The restated
ground lease between the port
and Verizon Wireless. With
approval of American Tower
Delaware Corporation as
Sublessee. The initial term was
for a period of five years,
with three additional automatic
extension terms for five years
each. Provided that Verizon
timely exercised the option and
was not in default. The purpose
of this First Amendment is to
approve the merger from Verizon
Wireless, LLC to sell
Copartnership doing business as
Verizon Wireless. Verizon has
timely exercised the first two
extension options. The current
term expires on January 1st,
2029. This First Amendment
would also exercise the final
five year option, extending the
term through December 31st,
2034, and provide for two
additional five year extension
options under the same terms
and conditions. Use of the
premises is. The operation is
for the operation of a
communication tower outside of
building 2001, including all
necessary utilities on a site
area of approximately 3154ft².
Income to the port for
exercising. The next five year
extension option is $604,432,
plus leasehold excise tax. Upon
execution of the First
Amendment, the port will also
receive a $20,000 signing bonus.
A portion of the revenue was
included in the 2026 approved
budget. The Board of
Commissioners approve and
authorize. The recommendation
is that the Board of
Commissioners approve and
authorize the CEO to execute
the First Amendment. Restated
Ground Lease at 2001 Kotobuki
Way between the Port of
Vancouver and Selco partnership,
Verizon Wireless.
>> Any comments? Questions.
>> Thank you. I have a question.
So this is essentially
restating because there's been
a merger. So I know that the
port does extensive vetting
when we're taking on a new
tenant in the first place when
there's a merger. Can you talk
about the vetting process for
that new company coming in?
>> Yes. In this particular case,
we reach out to the state of
Washington and get a
confirmation of that merger.
And it's a certificate of
merger from the state of
Washington, because they're a
utility company. They're really
difficult to move and change.
They don't just pop up
somewhere. So there's a with
the stability of that, then we
can rely on a certification
with the state of Washington.
>> Great. Thank you. And so
then by then signing into this
lease, they also commit to all
of our business practices and,
and following the lease as was
given for the for the previous
tenant.
>> That is correct.
>> Great. Thank you.
>> Piggybacking on that. So
that would include the the
sublease. Yes. You're talking
in the opposite direction, Mike.
That would include the sublease
to American Tower, Delaware
Corporation. Yes. Okay. All
right. That was my only
question. I thought those were
pertinent questions. We just
watched Weyerhaeuser lease a
section of their place to
another paper company. Didn't
go very well for some of the
folks working there. Thanks for
your attention on this matter.
Does anybody want to move
forward? There.
>> Well, I'll move to approve
the recommendation as presented
by staff.
>> And I'll second the motion.
All those in favor?
>> I.
>> I, I.
>> Thank you very much.
>> Thank you. Lori.
>> Okay. Our last agenda item
today will be presented by Josh
Pope, our engineering project
manager. Thank you Jonathan.
>> Good morning commissioners.
Good morning. This project
supports the port's strategic
plan goal to develop a 20 year
comprehensive maintenance plan
to maximize operational
capacity, efficiency and life
expectancy of port assets. This
project involves replacing both
the roof and the Hvac system in
the South. Administrative
building building 3103. The
roof and Hvac system have never
been replaced on this building
and are at the end of their
useful lives. On August 5th,
2026, the Port of Vancouver
Port of Vancouver issued an
invitation to bid 2647 South
Administrative Building, roof
and Hvac replacement project.
On August 27th, 2026, the
following bids were received in
your agenda item. There's the
bid list, with Fisher
Construction Group being the
lowest, the lowest responsible
bidder. Staff has reviewed
Fisher Construction Group Inc's
responsive bid and concluded
they are responsible contractor
capable of performing the work.
The engineer's estimate ranges
from $627,000 to $693,000. All
bids received were above the
estimate. The low bid was
determined based on the total
bid amount and after reviewing
the bids, it was determined
that the deductive alternate
would not be awarded. Funds for
this project were not included
in the approved 2026 annual
budget. The port has sufficient
funds to award and begin work
on this project. Are there any
questions or would you like me
to read the recommendation?
>> Sounds like go ahead with it.
>> Okay. That the Board of
Commissioners authorize the CEO
to execute a public works
contract with Fisher
Construction Group, Inc. the
lowest responsive and
responsible bidder for bid
26-47 South Administrative
building, roof and Hvac
replacement project for the
base bid of $883,763 plus plus
applicable Washington state
sales tax.
>> Comments. Questions.
>> I have a question. Knowing
that prices are all over the
place and generally not coming
down, I. Perhaps the answer to
this question is obvious, but
could you talk a little bit
about the variation between the
engineer's estimate and the bid
came in, and just anything we
should be aware of?
>> Yeah, absolutely. So we've
been seeing some some pretty
high variability, especially
with our roof projects. I think
if you recall, there currently
are largest roof is being
replaced currently. And that
was that was put in front of
commission here earlier this
summer. That you saw a very low
bid on. A big part of that
reason was just the time of
year that we're that bidding
there. The later in the year
that you get on a roof project,
the more risk there is
inherently to the contractor
with rain events. So that
certainly factored into this
bid. The other component to
this is because we're replacing
the Hvac system. There's an
existing hole in the roof that
we have to match. And so that
limits the types of units that
a contractor can bid on. And
that combined with market
availability, that also
increased the the estimate. And
those are really nuanced to for
a for an engineer's estimate to
capture. And so that's, that's
part of why you're seeing a
little bit higher bids this,
this go around.
>> I had a question about the
note that the roof and Hvac
system have never been replaced.
How how old is that building?
>> Yeah. So that building was
built in 2007. So it's
certainly at its it's time now
to replace the roof and Hvac.
It's, you know, 20 years.
That's about what we're seeing
getting out of this is called a
membrane type roofer. You've
heard references TPO or key KEE
has another type. And that's
you typically see 20 to 30
years. Some manufacturer. All
the warranties are about 20
years. But some manufacturers
you see a 20 year lifespan.
Some manufacturers see a 30
year lifespan. This particular
manufacturer is no longer in
business that originally
provided that roof. And it's
because their roof didn't quite
last as long as they wanted
their warranty. This project
was in our maintenance plan for
extended out a few years, but
that being said, we started
experiencing visible roof leaks
on the inside of the building.
And so we went up and did
another inspection of the roof,
found, identified some issues
with it, and that it needed to
be replaced. Port engineering
and port facilities work to
Tarp the roof currently. That's
also why this project wasn't in
the 2026 budget, because it's
done on an expedited basis to
address that issue.
>> And the Hvac. Is that all
electric?
>> Yes. We're going from a
natural gas unit to an all
electric unit, right? Yeah. To
meet with our climate action
goals.
>> Perfect. I'm satisfied.
Anybody want to move this thing
forward? I'll I'll move that.
We adopt the recommendation as
presented.
>> Second.
>> All those in favor.
>> Aye aye aye.
>> Unanimously. Next up.
>> Wonderful. Thank you
commissioners.
>> Thank you. Excuse me.
>> So commissioners, each month
we provide you a copy of the
port contract log. This is a
list of all the port contracts,
all of our public works
contracts, as well as our
service contracts and the
highlighted sections of those
contract logs are the most
recent activity. These are also
posted on the port's website.
Do you have any questions on
those?
>> None.
>> Okay.
>> New business.
>> No new business today.
>> Old business.
>> I don't think we have any
old business.
>> Okay. Accounts payable.
>> Yes. I'd like to introduce
Nick McIntyre, our accounting
manager, who will present the
payables today.
>> Thank you Jonathan. Good
morning commissioners.
>> Good morning.
>> We did not receive any
questions prior to the meeting,
so I'll start by reading the
recommendation then open the
floor for questions. The
recommendation is that the Port
of Vancouver, USA, Board of
Commissioners by motion
ratifies and approves the
payment of August 2026 vouchers
129189 through 129593 in the
amount of $6,430,656.17,
including electronic payments
generated between August 1st,
2026 and August 31st, 2026, and
the amount of $1,880,351.17 and
August 2026 payroll checks
52289699 and 52293223 through
52293224 and direct deposits
320001 through 320137 and
340001 through 340157, and the
amount of $873,077.09.
>> I'm having a problem in that
there's a typo in there on
direct deposits. Our deal says
320001 through 310137. Is that
correct?
>> In the agenda on section H?
That is how it's listed in the
recommendation. And on the
agenda item number H-1. It's
listed under direct deposits as
320137, which is the correct
amount. We have been we've
notified notified
administration and they're
going to correct that.
>> Okay cool. I was I was a
little bit curious looking at
the direct deposits as well.
The assuming, I mean, so those
are payroll vouchers and it
looks like it's jumping from
137 to 157.
>> So the electronic deposits,
they'll include both payroll
direct deposits, but also. Oh,
I'm sorry, are you referencing
the, the.
>> Just that range.
>> The range.
>> I'm guessing we didn't hire
20 people in the space of two
weeks.
>> No.
>> I'm getting a I'm getting a
note from you.
>> So I'll, I'll go back to the
team and we'll, we'll confirm
what the cause of that
difference is and we'll get
back to you guys by the end of
today.
>> Thank you. Well, that all
move that we adopt the
recommendation as presented.
>> Second.
>> All those in favor. Aye aye.
Unanimously. Thank you. Thank
you. Have a good day. See your
report.
>> See your report. We have
some project updates. I'd like
to introduce Mark Newell Marks,
our project delivery manager,
who will provide an update on
some of the activities going
around along the part.
>> Good morning commissioners,
a few updates. We continue to
be busy with projects around
around the port. So we'll jump
right into it. We'll start here
with terminal one dock
replacement project contractors,
Schetky marine construction and
projects around 68% complete.
This view here is kind of
oblique view. Looking back at
the at the dock structure
itself. And you can see the
kind of the progression from
from the upstream to the
downstream side of it, with the
contractor having prepped for
for topping slab pours down on
this area. And then and then
you can see kind of the step
down section where the future
public market will be. So a
little bit of a good
orientation showing the whole
stretch down to the waterfront.
Vancouver Waterfront Park there.
Next slide. A little bit more
of a close up view here. This
is crews actively working on
these pile cap extensions. You
can see the perimeter of the
public market kind of on that
lowered section where the crawl
space is. And and then on the
right hand side, over the over
the piles, them forming,
reinforcing, being installed.
And this will be kind of the
future front, front face side
of the public market, kind of
that width that will run the
whole, whole length down. So
they'll continue to, to form
and, and jump these
construction elements forward
and then place precast panels
on top of this as necessary. So
quite a bit of activity going
on here. Next slide is a little
different angle showing a
little bit similar. You can see
those pile cap extensions on
the lower lower right there
kind of being extended off and
crews kind of continuing to
work through those areas. A lot
of formwork and Falsework
supports there. You can see a
whole pile of those on top of
that. That's the those are the
supporting systems that they
continue to reutilize to, to
support the caps in this space.
So a lot of lot of organization
going on here, and they're
forming edge walls around the
perimeter and, and kind of
hopscotching around usually
about a pour every week or so.
Next slide. West progression,
as mentioned, this kind of a
little different angle looking
back where the Vancouver
landing ties in to, to the
structure. And you can kind of
see a few of those pile caps
kind of extending out over that
area. Crews are continuing to
make progress here and working
on tying, tying those elements
in and finishing up with some
of these pile caps. They'll
continue making concrete pours
and progress all the way
through the rest of the fall
here. And, and then we'll kind
of go from there into the
Fender system elements, which
that won't occur until probably
November or December, when we
will have some more vibratory
pile installation. Next project
is building 2001. Josh
mentioned a little bit about
this project here. Well, maybe
not as glamorous of a project.
Nonetheless important to seal
the weather and water for
another 20 plus years. So roof
works about 75% complete. This
is just kind of a shot of what
the top looks like right now of
the of the main building. And
the main building is almost
100% complete with its, with
coverage as I speak right now.
And here's just kind of
internal gutter system and, and
kind of this is that induction
welded system that's been
installed. Next slide just kind
of shows more of a, another,
another view looking back the
other direction. More on the
ridgeline elements. So there is
also a couple of other roof
structures down below that are
lower that also are in progress.
And they will continue working
on those here as well. Interior
wise, they've been they've this
this is kind of sealed off a
number of areas that have had
kind of historic leaking and
elements going on. So those
phase one office and kind of
lunchroom break room elements
where there's been moisture
issues, remediation has has
been completed and now they're
into the second phase. And
there's a couple more phases
after this to, to work on that
area. Next slide shows a little
bit of the interior. This is
one of those spaces where
moisture is kind of come down
from the ceiling or has has
permeated some areas. So
there's some wall remediation
work going on on the interior
bays as well. So all being
coordinated with our, our
tenant and Pacific Tech is the
contractor working on this
project. Next slide. Right next
door. Really, like I said,
small project, but interesting
to the to the adjacent port
staff just because we walk
through here all the time. So
here you can see the structural
steel being placed on top of
the pile caps. And just the
interesting thing to note here
is everything. Everything is
being supported off those
center three columns and down
to the foundation. So nothing
is relying on any of the
adjacent buildings. And so
right now they they've
installed the steel, the
welding is complete. And next
slide shows a little bit more
metal decking installed. They
still have some flashing and
connector connections up on top
to seal that area off and
painting in progress. So fun,
fun little project there. Next
project here is trail segment
four and five and contractors,
advanced excavation specialists.
The projects around 55%
complete. And here in this
slide you can see update that
you know they're starting to
install some of the gravel base.
So as you remember, some of
these areas were were
definitely sloped off pretty
good. Now they have some
retaining wall structures in
there. And so they're getting
kind of to that base section.
Obviously they still have yet
to, to grade that out or get
into any of the asphalt paving
elements or some of those areas
as they're continuing to work
on some structural work and
subgrade work. Next slide. This
is kind of a little bit further
down the retaining wall that
you can kind of see in the in
the right hand side there in
the, in the background that
that's complete now. So they're
continuing to progress in that
space. And I think I have one
more slide here, which is
showing reinforced soil slope
walls. So kind of a variety of,
of wall elements depending on
the location and slope
conditions that's out there. So
they've completed this work as
well. So it's been good to see
some, some progress here in the
last month on this project.
Next slide. I think that's it.
So any questions on any of
those projects.
>> Apparently not.
>> All right.
>> Thank you.
>> Sounds good.
>> Thanks Mark.
>> Well that's all I have today.
Commissioners.
>> Cool. There's an order to
this, but I think you're it.
>> Okay. Let's see. So I went
on another port tour. Not this
past weekend, but the Saturday
prior and again, packed bus
folks were super interested in
it. Love hearing the community
talk about how excited they are
to learn more about the port.
And Aaron just did a bang up
job again. So awesome work. And
then also had a meeting of RTC,
the Regional Transportation
Council, and just a comment on
the work of that. So RTC
coordinates different agencies
in our in our region, southwest
Washington region for
transportation projects and
distributes some federal funds.
And because of Rtc's and our
local agencies ability to be
nimble with some of this
funding and able to move stuff
around if something isn't ready,
being able to move it to a
different project. What that's
allowed the region to do is
capture funding from other
regions that aren't able to be
that nimble. So was pointed out
that lots of other regions are
jealous of RTC, so we encourage
them to keep up that good work.
And what it does is it allows
us to continue to get
transportation projects moving,
impacting the region in a
positive way and using money
that other regions maybe
weren't able to use so
effectively. So good for us.
>> Thank you. Eric. I mean, the
main thing on my on my radar
over the last couple of weeks
was Labor Roundtable back on
the 28th. One of the concerns
that came forward that we might
want to take an additional look
at and it came from from a
report from the city was with
our responsible bidder language.
There's a kind of a kind of a
gap there where. As we look at
L and I records for contractors,
it will list violations once
they finally wound their way
through the years worth of
appeals and citations and
complaints are available, but
require a public records
request, which then kind of
puts ports and cities in the in
the unfortunate standpoint of
if we want to take those into
account, then our contracting
folks have to manually request
records and essentially set up
an investigation for every
successful bidder. So it's not
not really scalable or
sustainable. So wanted to bring
that forward. And I'll be
probably discussing that a
little bit more with, with
Julianna when she's back to see
if there's opportunities for us
to, I think it would probably
be a statewide fix, but
opportunities for us to support
L and I and making that
information more readily
available so that we can take
that into account as we're
bidding out all these different
projects. And that concludes my
report. Interesting. I used to
be an employer in L and I. The
difference between when an
issue happens and when it goes
on your record and affects your
rates and so on, can be 18
months or you're in the HR
business, you know it. And
that's fascinating. I don't
know how you repair that, but.
It might be an interesting
issue for us. I met with the
CEO, I went to a climate
community climate discussion.
The city was backing over
Marchel house that was led by
the conservation group ideas
about how we can move forward
in this time on our on the
targets to get to the climate
targets in very interesting
times. And it was pretty good.
Had about 20 people
participating from all over
town. And actually I live a
block outside of town, so I
went anyway. Yesterday I had
the opportunity. There were two
things I went to one, they had
a recovery day down at. Esther
Short Park and I hadn't
somebody I know was a food
vendor down. It was rather
exciting. They had groups from
veterans groups and and
community groups and all sorts
of nonprofits that try to help
people get out of God awful
problems they're having around
substance abuse. And it was
encouraging. And that there
were, I would say. Hundreds, if
not thousands of people there
that were working successfully.
I don't know about anybody else,
but in my case, I know people
or I'm related to people that
struggle with these issues. And
it gives you hope that maybe,
maybe there's a way out of this
stuff. And I went to a Labor
Day picnic and bumped into Eric
there again yesterday. I think
that'll do it. Up next. We've
got a workshop coming. Is it
ready to go now?
>> Well, I think we're due
upcoming events and then we can
roll into the. Yep, we can roll
into the workshop. Right after
that.
>> I do the same thing to
Juliana, I apologize.
>> Okay. All right. Upcoming
events. So next commission
meeting. Our regular commission
meeting is Tuesday, September
22nd, 9:30 a.m. Community
events. We have the Lincoln
Neighborhood Association
meeting, which is Tuesday,
September 8th, 6:15 p.m. to
7:45 p.m. at Lincoln Elementary
School. We have our ninth port
tour on Wednesday, tomorrow,
September 9th from 10 a.m. to
11:30 a.m. reservations are
currently full, but you can
join the waitlist at the Port
Van, usa.com/community. We have
a September Hatchery tour at
Columbia Springs, which is
Wednesday, September 16th from
3 p.m. to 4 p.m. you can join
the Columbia Springs team for a
hatchery tour and trace the
path of spring water through
their site. And this is a free
event. We also have the
Vancouver Audubon Migratory
Bird Celebration, which is
Saturday, September 19th from
10 a.m. to 1 p.m. at the Water
Resources Education Center.
Join in on the third annual
celebration of the tens of
millions of birds that migrate
through the southwest
Washington, traveling thousands
of miles and back again. This
is also a free event. And
lastly, we have the Clark
County Historical Museum,
Haunted History walking tours,
reoccurring weekly on Fridays
and Saturdays through Halloween.
October 31st at 7 p.m. Learn
about the tales, the history
and unexplained mysteries of
Vancouver on this mile long
tour through downtown. Tickets
are $20 per person.
Communicating with commission
so you can share your thoughts
during open forum at our at our
public meeting, the public
comment period for all
regularly scheduled Commission
meetings, you can email the
commissioners at Port
Commissioners at Port Vannis,
kutsar.com. You can speak to
commissioners by calling the
port office at (360) 693-3611.
For specific contact
information, you can mail your
comments to port POV Port of
Commissioners at 3203 Northwest
Lower River road, Vancouver,
Washington, 98660. And for more
information, you can visit the
port's website, www.kutsar.com.
Now we can get it. Now we can
get into the. So if you'd like,
we can. We can do that. We have
the workshop. We can roll right
into that if you'd like to.
>> Please do.
>> Okay. With that, I'd like to
introduce Chris Carter, our
information security architect,
and Logan Rogers, our
information security analyst.
They're here this morning to
provide an update on
cybersecurity.
>> Good morning commissioners.
Good morning. Good morning. All
right. So we're going to split
this presentation up here. I'll
cover the first part. And then
Logan will go ahead and cover
the second part. So again my
name is Chris Carter. I'm
information security architect
here at the port. We're going
to touch on the year in review
first kind of what we've been
up to and kind of what we've
been working on. So the first
highlight of the year I want to
cover is we had the US Coast
Guard come out and do a hunt
mission. Two years ago. We had
the Coast Guard come out and do
an assess mission. So at that
time, they brought out 13
people and played their roles
as of hackers and tested our
systems. The mission is a
little different. So this is a
cyber protection team. That is
they will deploy if there's an
issue in a port or a maritime
facility and hunt for the
adversaries. So in order for
them to keep their training up
and stuff, they they come out
and do these free missions. So
this year they came out, they
came out, they did two site
visits prior to coming out. The
first one was just to walk
around the port to see our, our
systems, how our networks are
set up. The second time they
came out and deployed sensors
that were intercepting our
network traffic, and those ran
for about 2 to 3 weeks. And
then after that, they came out
for two weeks total on site,
five of them. And they went
through those logs and then
helped us. You know, there was
a lot of questions, you know,
how do how do these systems
work? And then they're also
searching for adversaries. I
will say they did not find any
adversaries on our network. So
that's definitely positive. But
it was a great learning
experience for both them and us.
You know, over the two weeks
they did, they asked you a lot
of questions. We had a 180 plus
questions asked of us trying to
dig deeper into the systems.
And, you know, they're really
asking questions like, why does
this computer talk to this
computer? And so it was a, it
was a great learning experience
for our side to just to help
better understand why these
computers are communicating the
way they are and making sure it
was the right thing to do there.
So. So as I said, that was our
second US Coast Guard mission
in the last couple of years.
Most ports don't want to sign
up for these because they're
afraid that the US Coast Guard
is a regulator. They're going
to get in trouble for doing
that. But this is just just a
great way to establish that
relationship. So if there is an
issue down the road, you know,
we have that working
relationship with the Coast
Guard. And there was zero cost
to us. So I would say their
first assess mission, if we
were to do that, to go out to
bid for that, it's definitely
over $100,000. And probably the
same with this last one. So
it's a good cost saving measure
as well. Immediately following
that, which I will not
recommend doing back to back
assessments, we had the state
auditor's office go through a
cyber checkup with us that was
not as intense as the Coast
Guard's assessment. This time
around. It was just a 20
category checklist where we met
with them, provide them with
documentation. We went through,
you know, their recommendations,
making sure we're hitting on
all those marks. What's coming
out of that is we signed up for
their full cybersecurity audit.
The unfortunate part of that is
there's a 2 to 3 year waiting
period on those. So so when
they come out in 2 to 3 years,
it will be intense, like the
Coast Guard type of missions
that they've done. And again,
this is provided to us at no
cost. So it's a great cost
savings there. So. One thing
we're working hard on this year
is, as you know, with the new
ERP system, our environment is
changing. Technology is
changing. When every time that
technology changes, so does,
you know, the the attack
surface. So we're constantly
upgrading our policies, kind of
reviewing the technology and
making sure we're staying on
par with the changes there. As
you know, the AI is exploding
everywhere so that the AI
aspect of that is while it's
helpful in everyday work, it's
also extremely helpful for the
attackers. So they're attacking
faster. We're seeing an
explosion of patches come out.
I joked that it used to be
Patch Tuesday. It's now patch
every day because it's how
everyone's releasing patches as
AI's assisting in finding these
vulnerabilities. We've also had
another successful grant fund
to the port security grant.
That's to replace some camera
equipment. We also have another
open grant with the port
security grant on a network
access control system that is
95% complete, and we have two
grants out right now. We're
waiting for word on that will
assist us in some cybersecurity
projects. So we're always
grateful for those programs.
Another one more grant I wanted
to touch on really quick is the
state and local cybersecurity
grant program. Myself and Logan.
This is provided through the
state. They had offered some
training opportunities on AI
and privacy. So both me and
Logan applied for that training
and we both received it. So
we're two of 50 people in the
state. So we're working through
that right now. And then
another thing to highlight on
that. We're the only two people
from the port industry to
receive that. So that was we're
grateful for that opportunity.
Next slide. We'll talk on the
big one on the regulations. And
I know I covered this one last
year and probably the year
prior also. Next slide. So the
TSA so stands for Maritime
Transportation Security Act.
That was established after the
events of nine over 11. So that
was came into the act in 2002.
So that was mostly focused on
physical cyber security gates,
guards, stuff like that stuff
you see at the airports and
stuff like that. And then, as
you know, technology changes.
The threat landscape changed.
We started seeing, you know,
Coast Guard wanting to put some
emphasis on cyber security. So,
you know, when I started at the
port, one of my first
conferences I went to was the
Coast Guard was talking about
cyber, this, cyber that we're
going to have controls. We had
to wait about five years for
that to actually start taking
place. So their first attempt
at that or first requirement
was the cyber annex, which we
saw in 2021. So that required
every port to have like a cyber
plan. Kind of one of the issues
was that some port cyber
annexes were 50 pages, 100
pages long. Some some were 2 to
3 pages long. So there was no
really structure to them. And
so it really wasn't doing a lot
to keep us safe because there
was no guidance on that. So
they came up with the new final
rule, cyber rule that came out
in 2025, that when first rolled
into effect in July of 2025,
and that first aspect of it was
reporting how we report cyber
incidents. Who do we report to?
If there was a cyber incident?
We have several reporting
channels, which I believe
currently for us, we would have
eight different reporting
agencies we'd have to report to.
So there's still work on the
federal side on how they can
coordinate that better. But
that was the first one that
came into effect. The second
kind of land mark on that was
in January this year. It
required that everyone that
touches your network has to be
cyber trained. So we provide
annual cybersecurity training.
And that's not only going to
employees and contractors, but
even vendors that may need
remote access. So if a vendor
is requesting remote access,
it's not freely given. They go
through a cyber security
training and they are heavily
vetted on that. We are very,
very limited on how we get
access to that, to those
vendors. Next slide. So I'll go
a little bit more about the
regulations. So the first part
of this regulation is a formal
cyber security plan. There are,
I believe, like 15 or 16
different controls that are
looking for all the way from
logging to training to
reporting, like I've already
covered. It's. Fairly more more
structured and more specific
what they're looking for. So I
think that will help better
than the cyber annexes. The
next thing they're looking for
is a dedicated cyber security
officer. So they want to make
sure that there's someone at
the port that they can get hold
of 24 over seven, and that is
responsible for that, that
cyber security plan, both in
myself and Logan share that
responsibility. There kind of a
new thing here is what they're
requiring is annual risk
assessments. And that's where
we go with our partnerships
with the Coast Guard and the
state auditor's office. These
risk assessments are expensive.
So when we're using those free
resources through the Coast
Guard, through the auditor's
office, through the Department
of Homeland Security, that's
going to help us use that money
that would go into just a
couple week process, but we can
redirect some of that money to
more security platforms and
stuff like that. Training and
awareness. We've touched on
that a little bit, but as of
January of this year,
cybersecurity training and
awareness is required for all
all staff, contractors, vendors.
And there is a time frame on
that. So they everyone has to
be trained within five days of
receiving network access. So
that's usually covered in the
first week. And on the
onboarding process. So then
other regulations are
continuous monitoring. We're
logging, you know, network
traffic, phishing emails, stuff
like that. You know, there is
some language in the regulation
where they're not giving us
defined periods. Like you have
to keep your logs for 90 days,
180 days. So there's a lot of
back and forth right now. And
like, you know, how many days
do we need to keep these logs
or years or whatever? So I
think their language is to,
when it's no longer useful,
right? When is that? So we're
working through that right now.
And then the reporting
requirements. So, you know,
there's strict guidelines
through the Coast Guard on how
we report who we report to in
the time frame. But on top of
that, we have other regulations
through the state, especially
when it's impacting financial
systems. And when we report.
Next slide. So our past so far.
So we've built this layered
security program, you know,
across all of our systems. We
tried to get involved really
early in the software selection
process. We're vetting the
vendors, the country of origin,
you know, hardware is a big,
big issue. We want to make sure
it's manufactured not in a
nation state sponsored, you
know, known for cyber activity.
So we we are really working
hard on that to be part of that
process. We've rolled out
multi-factor authentication
through all users and vendors.
You know, that's one of the key
factors of stopping a breach is
to have that multi-factor
authentication. We've improved
logging and monitoring. You
know, everything gets logged.
We've run dashboards, we run
reports, we run our processes
off this logging. It really
helps us identify issues early.
For example, if you were to go
to a outside of your normal
login activity and log in,
let's say from Canada or
something, we're going to get
alerted about it. We're going
to investigate that right away
and make sure that that's a
valid login. So we have
established an incident
response plans. We're working
on those playbooks and response
plans constantly as technology
and system changes those have
to be updated. So like I said,
we worked hard with the Coast
Guard and Soyza and Homeland
Security and the state
Auditor's office to get these
assessments that they offer for
free completed. And we're we're
leaning heavy on federal and
regional agency partnerships,
which I'll touch on in a little
bit here, too. We have active
participation in the MTA Isac.
So the Isac stands for Maritime
Transportation System,
Information Sharing and
Analysis Center. This is a.
Nonprofit that the port was a
founding member of. I served on
the board for 5 to 6 years. Now
Logan is on the board taking my
spot. So it's a great, great
agency or great organization
that has many ports across the
country and now even across the
world that are sharing
information Dayley to fend off
attacks. So kind of one of the
things we're doing now is we're
doing regular cyber exercises.
So those consist of, you know,
full blown tabletop exercises.
And they and then we have
monthly phishing tests. So you
may see those come through. We
are constantly testing users,
not only testing the users, but
it tests us on how we respond.
If there was, you know,
phishing test that someone may
have clicked on of how we go
through our processes there. We
continue working with the Coast
Guard on cyber testing. You
know, like I said, we've done
two missions so far and we love
to have them out again. And
probably after the state
auditors come. Try to do one of
those big. Missions, you know,
every two years. So we're
engaging with a third party
cyber security operations
center. So this allows us to
sleep at night. So so they're
have 24 over seven eyes on our
network. Our network logs. They
see an issue at three in the
morning. They'll call us. So
it's not an alert that's
waiting in my inbox in the
morning. You know, if we're
we're working against
adversaries in other parts of
the country. They're not on the
same time frame as us. You can
almost see when they determine
your hours, you work and
they'll start their attacks
like an hour after you're done
for the day. So this third
party SoC is really beneficial
for us. You know, hopefully we
don't have to use them too much,
but definitely allows some, you
know, downtime for us away from
the office. So we're
formalizing the MTC, our TSA
compliance plans, like I talked
on the regulation. So those are
due here in July. We're going
I'll hopefully submit our plans
and documentation here by the
end of the year. And then we're
expanding governance and
documentation. You know, it's.
Especially with AI,
everything's changing so fast.
Especially how we treat data.
And, you know, these new
systems and how many kind of.
Capabilities they have and how
fast they can do stuff. So
we're expanding that governance
and documentation to support
those systems, standardize
standardizing controls. So part
of that's through the
regulation. So there are those
Coast Guard regulations follow
some controls called NIST 853.
We are, you know, trying to
have a standardized you know,
how we how we operate, how we
do our user accounts, stuff
like that. And then most
importantly, we're sharing with
others. We're really active in
a lot of different groups and
how we're sharing threat Dayley
Intel Dayley not only threat
Intel, but best practices and,
you know, even software
recommendations. Next slide. So
we're invested. We're counts
and that's our people. We're
one of the few ports in the
state that has two dedicated
cyber people. We definitely
wear more hats than just cyber.
But I mean, most ports in the
state, I would say about 20% of
them just in the state only
have IT team. And most of those
are just single person IT teams.
So we are seeing ports starting
to hire cyber as these
regulations come into play. The
part kind of the struggle
they're going to have on that
is these regulations are pretty
intense. And you got to really
know your networks to so that
hire someone in and have them
be there just six months before
a major regulation is due is
going to be a definitely
struggle for them. And then
just want to touch on this
throughout all the Pacific
Northwest deep water ports,
only, you know, 30 to 40% of
them have cyber staff at all.
So. I don't know how they do it
and defend off all the
adversaries. But. I think
that's an interesting fact.
Next slide. I just touch on our
partnerships. These
partnerships are really
important for us. Excuse me. So
we touch on the Coast Guard's
partnership outside of our
missions that we do with that,
we have an area maritime cyber
security committee with the
local sector. We meet usually
quarterly on that, but we're
always in touch with our cyber
representative at the sector,
usually weekly, at least
monthly. So we're working with
the Coast Guard a lot on that.
We are members of the FBI.
Infragard. Community. So the
FBI Infragard is a private
partner, a public private
partnership, so that those
groups have, you know, they
have public sector, they have
private sector. They have the
federal government agency. I'm
a member of the Oregon Chapter,
and Logan is a member of the
Washington chapter. So we cover
both those chapters on that
process. With the next one, I
want to touch on the maritime
transportation system. Isac. So
like I said, we were founding
members of that. We continue
working with them. You know,
we're sharing hundreds of
threat Intel things back and
forth weekly. It's a completely
automated system now. So it
loads right into our system. So
if a port in Louisiana says,
you know, we're seeing these
phishing emails, these network
threats, it gets put into the
central system and pulled into
ours. And then we can flag on
that. So it's really beneficial
for us because there'd be no
way to manually go through
those spreadsheets and look at
them and load them up every day.
And. It's very interesting to
see when you see an attack take
place or an attempted attack
take place in Louisiana or
Florida, and then that same one
is taking place here or in the
state here. So one other Isac
we're a member of is the water
Isac. We do have a small water
system here. So this the water
Isac water utilities have been
in the news a lot in the last
couple weeks. Utilities they're
getting they're being heavily
targeted by nation state actors.
And so this water Isac you know,
we're exchanging, you know,
same same idea with the
maritime one exchanging ideas.
Threat Intel policies, you know,
making sure that, you know what
what happens at one utility or
one agency across the country
doesn't happen here. So it's
been a really great partnership
there. One thing we found on
the next one is the Pacific
Northwest Maritime Information
Exchange. This is kind of a
branch off the. Isac. So. Isac
is great. What I wanted to do
was to have something more
regionalized. We see different
threats sometimes than maybe a
port in New York or Louisiana
may face. So this is a more
localized information sharing.
We have several tenants in that
group. We have several ports
throughout the state in that
group, and we have some
different agencies in that
group. So we're, you know,
exchanging information back and
forth. It's been a really great,
especially on, you know,
deploying controls or policy
against like maybe something
comes out of the state and how,
you know, we can. You know,
query another port in the state
and say, you know, how are you
tackling this issue? And so
we're not all trying to
reinvent the wheel. So the
Association of cities, counties,
information systems. So we are
certainly not a city or county,
but they do offer membership to
all government agencies. This
is an extremely active group
through with all the cities and
counties throughout the state.
Again, it's just mostly
exchanging best practices,
policies. You know, controls
why we may not all use the same
systems. Most of our base
systems are the same. So that's
been really beneficial in the
last year as we grow our ERP
system. The American
Association of Port Authorities,
we are active in the IT
committee. We're active in the
cybersecurity subcommittee, and
I've been attending some of the
physical Security Committee
meetings as well. Just as
there's been some overlap with
cyber and physical security. So
that's something we, you know,
always been involved in,
continue that relationship
there. And then finally, the
state of Washington. I think
this is something we've really
worked the last year or two
with. Maybe we weren't as
involved before, but, you know,
both myself and Logan
volunteered to do an RFP with
them to review how they're
doing their cyber stuff. So.
That was a great experience. It
was a very time consuming
experience as our RFPs maybe
see 10 to 20 applicants, the
states had over 180. So. Going
through all those RFPs to help
the state select their cyber
controls. And that helps us
when we then they do a grant
process for that training. You
know, we help them out and
hopefully they'll return that
favor. So that's all I have.
I'm going to turn it over to
Logan now.
>> Perfect.
>> Thank you Chris. Morning,
folks. So first topic, we're
going to kind of discuss. I
mean, as you know, AI is
everywhere. You can't really
even go to a coffee shop
without hearing about AI
anymore. So we're going to
start with that. What we're
actually going to start with is
a little brain teaser. So what
I'm going to show you is I'm
going to show you a picture.
It's going to be two photos and
just kind of guess if it is
real or if it's AI generated,
can you kind of piece out what
might be real, what might be
fake? Commissioners? Do you
want one of you want to take a
stab at it? Which one you might
think is real might be fake.
>> Not me.
>> I'll say on the right.
>> Okay.
>> I was going to guess fake on
the left. So one of us.
>> Will get. Okay. Perfect. So
it is a teaser. They're
actually both fake. So that's
one of the things with AI. It's
not a single thing that you're
going to be seeing in your
emails anymore. Trying to
create paragraphs help you
draft a speech or anything like
that. It's we're getting into
more real life things of image
generation, and it can fool,
fool the eye, fool the next
person down the road. So we'll
go into really the next topic
of it is the capability is
advancing. One of the first
items here is frontier AI
models. What frontier means is
kind of the bleeding edge, the
next up and coming thing that
you're going to see, and a test
out in the wild. We call it the
humanities last exam. What it
is, it's it's a test compiled
of 2500 questions from
different agencies really
around the world. So these
topics include math, science,
engineering, medicine, some of
these some of these tests kind
of help create new medicines
and create new vaccines. So
some of these frontier AI
models from this source at
Stanford, these gained 30%, 30
percentage points in a single
year. That's unheard of. You
don't really hear about that
from technology, let alone
people most of the time. So
some of the stats, some other
stats from this report, I would
recommend going to read this
report. As for the last three,
almost four years now, Stanford
has released this AI index
because as I said before, AI is
taking off and it's not really
going to stop. So one of their
tests, their AI models did
achieve gold gold medal level
performance on the
International Mathematical
Olympiad in 2025. That's just
an interesting stat, because
though math may seem A to B
equals C, it's not always how
it is. And then this new
benchmark, this is called OS
world. What it is, it's almost
370 tasks that we give the AI
model, and we give it pretty
much a computer to run by
itself. It can use its keyboard,
it can use its mouth by itself.
And we say, go do this
benchmark. As that graph
indicates there on your screen
from 2024 to 2025, it increased
significantly. I believe it was
about 12%. And it's reaching
almost a human level capability.
So it's not going to slow down.
This is a year over year trend,
and we're seeing week to week,
month to month that it's even
progressing even rapider. So a
couple things with AI, it's not
only being used for proper,
proper items like this, doing
benchmarking, doing testing,
but it's, we're, we're seeing
it used, obviously, as Chris
stated, and the more attacking
vector, not only targeting Port
Maritime, but really the entire
world. So a couple couple items
to really always look at is
verifying before you trust it.
So the sauce, were you
expecting it. What's it coming
from? AI can now manipulate
voices. If you if it hears and
trained long enough on a model
or excuse me on a voice, then
it will start picking up speech,
speech recognition and can
actually mimic voices.
Unfortunately, it's it's a
tough thing to hear, but it can
also do face, as I showed you
previously, we can just create
random faces and it's going to
fool you. And with writing,
it's just becoming better and
better in writing. So if you
were not expecting it, and
especially if you sense a sense
of urgency to it, then stop.
Don't communicate with it and
just take a couple minutes to
ask and ask for help. The
context, just because it seems
perfect and it seems so well
written, doesn't mean it's
actually legit anymore. Number
one thing to ask is, does this
actually make sense to you
first off? And then the last
part is to confirm this is what
I do in my personal life.
Anytime you're not expecting it,
just verify if it is a doctor's
office calling you, saying that
you have something and you
weren't expecting it, hang up
the phone. If they called you
and call your actual doctor's
office, or if you got an email,
they say you have something,
just call them. It's not, it's
not just going to take a couple
of minutes. So how we're
keeping up with this
environment, as Chris stated,
we were two of 50 folks in
state of Washington to get
awarded our certification
trainings, ones on AI, ones on
information privacy. So we are
going through that. And then
another certificate that is
taking place is a more
offensive, secure security cert.
So one of my one of my main
duties is I perform hacking
actions. So I do it on our
network. Because if I can find
it first, then we can patch it
quicker. So I am going through
the certifications and it will
just better our environment for
that. We are attending a ton of
webinars and summits, so
getting involved in the
community, not only locally but
around the US to make sure that
we're staying, staying informed
on what is actually happening
out there. Obviously working
with our partners, as Chris
said, we have a lot of
partnerships locally, so we are
keeping a constant
communication with them to
understand what they are seeing
and what we are seeing. And
because at the end of the day,
we're all doing the same fight.
So it's it's best to share all
the information together. As I
become certified. We're trying
to do that the best we can and
then testing. We not only test
internally, but like I said, we
test externally too. We have to
make sure our environment is
secure the best that we can. So
we're going to shift a little
bit to cyber security and
business continuity. Business
continuity is one of the most
important things because we
have to keep the port running
and keep the lights going. So
the environment that we're in,
couple industry wide trends
that we're seeing in 2025,
maritime cyber incidents
roughly doubled. Last year, we
saw close to 1200 cyber related
incidents throughout the
maritime industry. So it's not
it's not going to be slowing
down for 2026 either. I expect
it to be close to double again,
unfortunately. And when these
events do happen and these
these partners are breached,
we're typically seeing a
recovery window now moving into
the weeks instead of days. It
used to be days for a very long
time. But now that attacks have
gotten so sophisticated and
somewhat easier depending on if
you're using a or not to
complete it, there a lot longer
lasting. And then in modern
ransomware attacks, they're
also targeting backup systems.
So best business practice is
always to keep backup of all
your data, keep it here and
then keep it there. These these
attacks are starting to try to
find those backups, data
sources and make sure that
these businesses can't come
back online. So why this
matters for us? It's we all
have to understand it together
and try to figure this out. So
prevention is still the
precedent and that's what we're
taking the most serious. That's
why we have two cyber staff
here. But understanding that
recovery is really the next
best option as well, just in
case something does happen. And
then our posture, what we are
doing today, a little bit of
information on that. As Chris
stated in extreme detail, we
are doing a lot of port wide
monitoring, understanding
what's in our environment, what
we can see and what we can't
see. We are doing external
attack surface scanning. Like I
said, we we have to make sure
that if we can, nobody can get
in. And if somebody can, then
let's find it first and make
sure to close up that hole. And
then sector information sharing.
As stated a lot, we are we are
wanting to make sure everybody
else knows what we're doing and
vice versa, because somebody
down the road may be seeing one
thing and we won't know about
it for a couple hours. Testing.
We are doing regular security
awareness exercises. As Chris
stated, we are doing it both
internally and then we have
ongoing testing of our
safeguards and defenses just to
make sure the things that we
are putting in place actually
meet what they say, and then
talking about backups,
understanding that we we do
have our backups in place. And
if something were to happen, if
we did move to that backup
system, will it actually work?
So we, we, we actually go
through our, our backup system
and actually run it. And it
will not hurt the operations.
People won't even know about it.
So we, we prove that everything
actually works. And then
responding, if something does
actually happen, how do we
respond? So we have documented
incident response plans. So if
incident A happens then we're
going to follow subset A, B, C
and D. And then making sure
that all of our defined roles
are actually there. So we're
not guessing. We're not trying
to figure out who to actually
go to. And as Chris stated,
when we have to report anything,
we have upwards of eight
different agencies. Not all of
us are going to memorize all
those agencies, the phone
numbers, the emails that we
have to go to. So we just write
it down and then understanding
the incident we in we in this
community security community,
excuse me, call them postmortem
reports. So we do them already
here and understanding that at
the end of an event, we can go
back and look at it five years
from now and understand what
actually took place, what we
did to fix it, and what we
learned from it. Continuity
when it counts. So these are
kind of the steps that we take
in place. So if something did
happen, this is what we're
going to actually happen. We're
going to first contain
whatever's actually going on.
If it was a single device or a
plethora of devices, we're
going to find, we're going to
find that group, and then we're
going to isolate it just to its
own home. That way it can't
start spreading around the
network operating, as I said
before, our contingency
procedures and our incident
response plans, we're going to
follow those plans and
playbooks and understand what
needs to be stood up to be able
to run and keep keep the
business going in an
unfortunate time. And then once
everything is actually taken
care of and secured, and we can
confirm that we're going to
start restoring from our our
backup data and make sure that
all of our tested procedures
actually work and go through.
And then communicate, just
notifying those who need to be
told about what's going on and
make sure everybody knows what
is happening. So the main
takeaway of continuity is we're
always going to be prepared.
But if something does happen,
we're not too alarmed.
Obviously, it's a scary time if
something does happen and a
cyber event here, but we plan
for hours and hours at a time
understanding what we need to
do and know that though the
restore time and event time may
be weeks now, we're not going
to be we're not going to be
sitting there for months on end
and trying to figure out what
to do. So we always have to
plan. That's it for me. Any
questions?
>> Not a question, but a
comment. Thank you. And as
somebody who misses rotary
phones, I really appreciate
those of you who are really
digging in and taking this
seriously to protect everything
and everyone. I really
appreciate the the tests of all
of us as well. I think that's a
great I got caught once, so I
really appreciated it when that
happened. And an email tricked
me. So yeah, just thank you for
all of this work and staying
nimble and prepared as it
continues to change every
minute. So thank you.
>> I was going to ask because I
know, Chris, you've presented
at WP a couple of times what,
what we're seeing with some of
the smaller ports, because I
know they're, I'm assuming
they're lacking a lot of the
kind of bandwidth to address
some of these things, but
they're no less, no less
exposed.
>> Yeah. So they are starting
to hire some more, bringing
both IT staff and cyber staff
on board. So. Some of the
smaller ports that I'm in
communication with in the last
six months, they've hired cyber
people. So that's a good sign.
I think we'll see more of that
coming up. I mean, it's just
with the regulation, if they
are mtsa regulated, it's going
to be a struggle to do that
without staff. So. Like I said,
through our partnerships, if
they need a policy, they need
to be pointed in a direction.
I'm always there to help. And
same with Logan, I mean. You
know, we're happy to share not
only our threats, but our best
practices and our policies and
stuff like that. So I think
that's something we're seeing
across the state through, you
know, everything's changing so
fast. People have kind of given
up on trying to do it on their
own, and they're using their
partnerships and, you know, I
think we've got past to like,
you know, if you're at another
port, you're a competitor on
this IT and cyber side, that's
not the case. I mean, there's
great interactions with through
the ports and, you know,
sharing our best practices and.
You know, like what solution to
use. I think that's one of the,
the biggest ones is we get hit
constantly with sales pitches
and. So, you know, get that
word of mouth and say, you know,
we're using this solution, look
at it to solve this problem. I
think that's really beneficial.
So.
>> Well, I appreciate your,
your support of some of the
smaller ports and the fact that
we are working together.
>> Can I ask a follow on to
that really quickly, which I
also appreciate? I mean, in, in
all of our departments, we have
such incredible staff and we're
at a size where we're able to
offer a lot in, in support to
some of the smaller ports. And
I really appreciate all the
different information sharing
groups that there are. A
question that I had listening
to that, though, was, what are
the follow on effects for, say,
us for a larger ports that may
have more of that
infrastructure? The following
effects of the smaller ports
not having as much
infrastructure like despite
their best intentions, there
may be more that could happen
to them because they just don't
have the support that we have.
Are there follow on effects for
us of, say, a smaller port,
getting an attack, getting
attacked in some way?
>> I mean, there could be I
mean, we see it where like a
vendor gets attacked and that
same vendor works with like,
you know, 25 different ports in
the state. So that's where we
get really like when a vendor
comes to me and goes, I need
access to this system. And my
first answer is always, no,
like, like you're not getting
it. Like you're going to go
through all these steps. But
some ports say, you know, we
don't have the staff to, to
manage that. So here's access
to our system. I think a great
example of that recently is not
in the port industry, but in
the water industry, where all
these in Minnesota especially,
they got hit really hard with
the rural water systems, got
all, you know, they were
getting attacked. And a lot of
that's because they're using
the same systems, the same path
in. It might be a vendor that
can, you know, say, I can
access all these. I once had a
vendor show me that, look, I
have control of all these
systems. And he showed me on
his phone. I was like, well,
that's, that's not good. Like,
like, because then as an
attacker, I'm not going to
attack a single port. There's,
there's, the payout is not as
good as if I go after that
vendor who shares, you know,
that that, that 25 port, you
know, circle. So I think we're
seeing that more supply chain
attacks take place that that
way the attackers, you know,
they'll still focus on, you
know, the port or the port of
Vancouver with the Port of
Vancouver. We're lucky because
we get confused with Canada all
the time. So I mean, I mean,
even on my calls with vendors
and sales pitches, they talk
about Canadian regulations. And
I'm like, wrong, Vancouver. But
but, you know, we see a lot of
that. You know, the supply
chain attacks and stuff like
that. And we'll see that same.
We'll see a distribution list.
So let's say a vendor sends out,
you know, their company
newsletter and they put
everyone in the two line. Well,
once someone on that two line
gets compromised and then you
just see that thing roll, like
for 4 to 6 weeks. And I think
we had a good example. I in the
last year where an
environmental agent or a
contractor or vendor got
compromised and all that
information was on the sheet.
So they were just kind of going
through that list and you'd see
someone on that list get
compromised this week, and then
next week it's the same. So
that's where information
sharing goes. If we can get
that information out and share,
you know, we just saw this
vendor get compromised if
you're using them, heads up. So
because when a vendor does get
compromised, they're not the
first ones to run out and tell
you that they're compromised.
They don't want that
information getting out. So
sometimes they'll send out a
little follow up email. You
know, we got hacked, we got
compromised. Don't worry. We
got taken care of. Well, is
that really the case or are
other ports and other people in
the industry still seeing that?
So we really stress hard on the
information sharing. And again,
that's not only threat Intel
but the best practices too. So.
>> I think as a follow up, I'll
just say that the. The word
that's coming to mind a lot is
proactivity. Thinking about
like, like joining the cities
and counties group. And yeah,
we're not a city or a county,
but probably using a lot of the
same systems and vendors and
whatnot. It's, it's that kind
of proactivity that I think
helps helps keep us safe. So
definitely very much
appreciated.
>> I also want to point out
we're learning as much from the
other people that, that they
are learning from us too. So I
won't name the port
specifically, but there's a
port in the state that has a
one IT guy. He is really good
at one thing and I learned so
much from him. And then we
share that information back and
forth. But, you know, I think
in the industry, sometimes you
get like, well, if you're not
from this big major port,
you're not an expert on it. But
these smaller ports have the
experts because they're the
ones wearing all the hats. They
know the systems completely. So
we learned a lot from the
smaller ports too, that have
the single IT guys. So.
>> An observation is that a
fear that people have is that
AI is going to cost jobs. And
it sounds like they also create
a whole lot of of that. And I
have to I have to thank you for
coming in and terrifying the
jabbers out of us on a fairly
regular basis. I don't
appreciate it, but thank you. I
think that concludes it. Unless
anybody had more words. Thank
you so very much. Thank you,
thank you, thank you Chris.
With that, I believe we go to.
The this is the end of the
public meeting, am I correct?
We're going to sign documents
and we'll we'll adjourn a few
minutes after that. Thank you
all.