The 12/2/15 Terrorist Attack Legacy Report A Planning, Response, and Recovery Resource for Organizations Confronting Terrorism and Other Catastrophic Incidents October 2018 CPARS Consulting, Inc. The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Dedication This report was developed to honor the dedicated San Bernardino County employees present during the December 2, 2015 terrorist attack, including fourteen (14) deceased victims 1 and fifty-eight (58) survivors that continue to be, and will forever remain, beloved members of the San Bernardino County Family; as well as the countless members of the San Bernardino County Family who worked tirelessly and selflessly to safeguard the community and support those affected with compassion, dedication, and professionalism. 1 One of the fourteen (14) deceased victims was not a San Bernardino County employee, but is nonetheless remembered through this report. Dedication i The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. ii The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Acknowledgements Critical Preparedness and Response Solutions (CPARS Consulting, Inc.) would like to thank the following individuals with San Bernardino County who recognized the importance of sharing the County’s experience with terrorism so other organizations may be better prepared to respond and recover, and offered the full commitment of their time and County resources to make this effort a priority and success:  Robert Lovingood, First District Supervisor, Board Chairman  Janice Rutherford, Second District Supervisor  James Ramos, Third District Supervisor  Curt Hagman, Fourth District Supervisor, Board Vice Chairman  Josie Gonzales, Fifth District Supervisor  Gary McBride, Chief Executive Officer (CEO)  Leonard Hernandez, Chief Operating Officer (COO)  Gregory Devereaux, CEO (Ret.)  Dena Smith, COO and Interim CEO (Ret.)  Mary O’Toole, Principal Management Analyst (Ret.) CPARS also wishes to thank the hundreds of County employees, past and present, who contributed their perspectives, experiences, best practices, and lessons. This resource would have lacked value without their candor, time, and generosity of spirit. Lastly, CPARS would like to thank its team, which demonstrated great commitment, heart, and professionalism working with San Bernardino County stakeholders in the creation of this report:  Nick Lowe, Project Manager/Co-Author (CPARS Consulting, Inc.)  Kathryn Humphrey, Deputy Project Manager/Co-Author (K-Rise Enterprises, Inc.)  Julie Quinn, Co-Author (QuinnWilliams, LLC)  Katherine Williams, Co-Author (QuinnWilliams, LLC)  Sheri Benninghoven and Scott Summerfield, Communications/Public Information Subject-Matter Experts (SAE Communications)  Jean Roque and Christine Thelen, Human Resources/Employment Subject-Matter Experts (TruppHR, Inc.) Acknowledgements iii The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. iv The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Table of Contents Dedication ........................................................................................................................................ i Acknowledgements.........................................................................................................................iii Introduction .................................................................................................................................... 1 Background and Context............................................................................................................. 1 Report Purpose ........................................................................................................................... 2 Report Structure ......................................................................................................................... 2 Additional Information ............................................................................................................... 3 Category 1: Emergency Protocols ................................................................................................... 5 San Bernardino County Snapshot ............................................................................................... 5 Emergency Protocol Considerations ........................................................................................... 7 Preparedness .......................................................................................................................... 7 Response ................................................................................................................................. 8 Recovery................................................................................................................................ 10 Category 2: Operational Response ............................................................................................... 11 San Bernardino County Snapshot ............................................................................................. 11 Operational Response Considerations...................................................................................... 15 Preparedness ........................................................................................................................ 15 Response ............................................................................................................................... 17 Recovery................................................................................................................................ 19 Category 3: Communications........................................................................................................ 21 San Bernardino County Snapshot ............................................................................................. 21 Communications Considerations .............................................................................................. 23 Preparedness ........................................................................................................................ 23 Response ............................................................................................................................... 24 Recovery................................................................................................................................ 26 Category 4: Employee Support ..................................................................................................... 27 San Bernardino County Snapshot ............................................................................................. 27 Employee Support Considerations ........................................................................................... 31 Preparedness ........................................................................................................................ 31 Response ............................................................................................................................... 32 Recovery................................................................................................................................ 35 Table of Contents v The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Category 5: Continuity of Operations ........................................................................................... 38 San Bernardino County Snapshot ............................................................................................. 39 Continuity of Operations Considerations ................................................................................. 43 Preparedness ........................................................................................................................ 43 Response ............................................................................................................................... 44 Recovery................................................................................................................................ 49 Category 6: Organizational & Financial Recovery ......................................................................... 51 San Bernardino County Snapshot ............................................................................................. 51 Organizational & Financial Recovery Considerations ............................................................... 55 Response ............................................................................................................................... 55 Recovery................................................................................................................................ 55 Table of Contents vi The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Introduction On December 2, 2015 San Bernardino County experienced a devastating act of terrorism that was unique in the United States at the time. The attack simultaneously exhibited characteristics of organized terrorism, workplace violence, and countless active shooter incidents. The County was the employer of one of the perpetrators and all but one of the victims. It was also the provider of essential and mandated government services that had been targeted. The attack was inspired by the Islamic State of Iraq and Syria/the Levant (ISIS/ISIL), so to the world outside of San Bernardino County government it was seen as a terrorist attack akin to the attacks in Paris the month before, or as simply the latest in a series of horrific mass shootings occurring across the country. But to some County employees, particularly those in the Environmental Health Services Division, it was much more. It was a deeply personal betrayal carried out against them by a fellow County employee. Just months earlier, the perpetrator’s colleagues had held a baby shower to celebrate the pending birth of his first child. Although there were numerous correlations between San Bernardino County’s experience and other incidents, the December 2 attack was unique in many complex ways. There was no definitive resource available to guide San Bernardino County through the unforeseeable and unprecedented challenges it would face. With this resource document, San Bernardino County hopes its experience will help other jurisdictions and organizations better prepare for, and if necessary, respond to, this new threat environment and improve the care and support for victims and survivors. Background and Context On December 2, 2015 the San Bernardino County Department of Public Health (DPH) Environmental Health Services (EHS) Division was hosting an annual training event at a conference center a short distance from their San Bernardino offices that is part of the Inland Regional Center2 (IRC). Seventy-two (72) individuals from the EHS Division and DPH were in attendance. At approximately 10:30 a.m., one EHS Specialist (the male perpetrator) left the meeting. He returned a little less than half an hour later with his wife (the female perpetrator). They were armed with multiple firearms, hundreds of rounds of ammunition, home-made explosives, and were dressed in tactical military-style gear. At 10:58 a.m. they approached the IRC Conference Center killing two people near the entrance to the building before proceeding into the meeting space. The perpetrators indiscriminately fired upon the attendees, killing a total of 14 people, injuring 22, and traumatizing all the survivors that witnessed the attack. The perpetrators fled in a rented vehicle before law enforcement arrived. Later that afternoon they were tracked down by law enforcement and both perpetrators were killed during a gun battle approximately one mile from the IRC around 3:15 p.m. Two days later, the Federal Bureau of Investigation (FBI) declared the attack a premeditated act of terror inspired by a radical Islamic terrorist organization. 2 The IRC is a government-funded not-for-profit corporation that provides services and programs to people with developmental disabilities and their families. Its headquarters includes a conference center located in the City of San Bernardino. Introduction 1 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County The attack had widespread impacts on San Bernardino County. The deceased (with the exception of an IRC contractor), the survivors, and one of the perpetrators were County employees. Without precedent, the County was faced with critical decisions associated with accounting for personnel, security, employment benefits, psychological care, public information, memorials, and reconstituting a division left void of personnel, among many other matters. The attack would ultimately have an effect on the entirety of San Bernardino County government; nearly 22,000 employees affectionately and genuinely referred to as the “San Bernardino County Family.” Some of those far reaching consequences would include removing the perpetrator’s work-related vestiges in the community, addressing the sufficiency of the County’s emergency action plans, donations management capabilities, litigation, legislation, effects on workplace culture, financial implications, and attempts at cost recovery under uncharted circumstances. The San Bernardino County Board of Supervisors and County Administrative Office (CAO) commissioned Critical Preparedness and Response Solutions (CPARS Consulting, Inc.) to document the short- and long-term impacts and actions of the County of San Bernardino associated with its response to and recovery efforts since the attack in a formal organizational review. The contents of this report were gleaned from the experiences, lessons, and best practices documented in that comprehensive review, which is available via the following link: http://www.sbcounty.gov/uploads/CAO/reports/December2OrganizationalReview.pdf. Report Purpose The County wanted to learn from its experience and, more importantly, share information to strengthen the preparedness and resilience of other communities and organizations that may be faced with, or want to prepare for, similar emergencies. On December 2, 2015 there was no reference document available regarding what to anticipate during such a situation. While San Bernardino County reached out to communities that were previous victims of mass shootings (e.g., Newtown, CT and Aurora, CO), those experiences did not quite mirror the scenario that faced San Bernardino. As a result, the focus of this report is to provide best practices, lessons learned, and considerations from San Bernardino County’s experience that may benefit the preparedness, response, and/or recovery efforts of your organization or jurisdiction. The Legacy Report is not intended to be prescriptive (i.e., telling another organization what decisions to make or actions to take), but instead, it is intended to help your organization anticipate the nature and urgency of the decisions and actions it may face. In addition, this report is not intended to be an exhaustive preparedness or response guide. It was developed only to capture those unique occurrences in San Bernardino County’s experience that may not be obvious to others. San Bernardino County hopes this document will reduce elements of surprise, simplify the complexities associated with these horrid experiences, and make your organization’s decisions more proactive and informed. Report Structure This report is organized into six topical categories described below. At the beginning of each section is a snapshot of San Bernardino County’s experience relevant to that topic to put the subsequent considerations into context. The topics and sub-topics listed are associated with a Introduction 2 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County larger organizational review the County undertook prior to the development of this report. Because this report is intended to support your needs and not reiterate San Bernardino County’s experience, the snapshots are intended to be concise in order to facilitate your access to directly relevant information that may be applicable to your situation. For additional contextual information, San Bernardino County’s complete organizational review is available online at: http://www.sbcounty.gov/uploads/CAO/reports/December2OrganizationalReview.pdf. Following each snapshot are lists of reference items for your consideration before and in the midst of crisis and as you work toward recovery. To reflect those phases, the reference items are organized by those things you may need to consider before an incident (“Preparedness”), those items for consideration in the immediate aftermath of an incident (“Response”), and longer-range considerations for returning to normal or defining a new normal (“Recovery”) all extrapolated from San Bernardino County’s experience. The six topical categories are as follows: 1) Emergency Protocols: This section presents considerations from San Bernardino County’s experience in addressing imminent threats to human life, the safety and security of personnel, and the immediate wellbeing of victims and survivors. 2) Operational Response: This section presents considerations for managing crises (e.g., selecting strategic objectives, assigning tasks, documenting activities, monitoring progress), enabling and supporting emergency operations, and positioning your organization toward recovery. 3) Communications: This section presents considerations for facilitating information sharing/ situational awareness and the mass distribution of information (internally and publicly). Communication and coordination is perhaps the most integral part of every organization’s ability to effectively respond, manage impacts and crises, and achieve a new normal. 4) Employee Support: This section presents considerations for addressing the needs of victims, survivors, and the whole of your organization, ranging from employee benefits to psychological counseling and donations. 5) Continuity of Operations: This section does not reiterate national, international, or industry standards for continuity, but rather presents unique considerations and lessons for the implementation of continuity programs gleaned from San Bernardino County’s experience. 6) Organizational and Financial Recovery: This section presents considerations for establishing a new normal, making your organization fiscally whole, and addressing the long-term cultural and operational ramifications of a catastrophic incident. Additional Information If San Bernardino County’s experience can help you better prepare for, respond to, or recover from a catastrophic incident beyond the contents of this report, please contact the San Bernardino County Administrative Office at (909) 387-4842. Introduction 3 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. 4 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Category 1: Emergency Protocols San Bernardino County Snapshot perpetrators. The constant evolution of information made it difficult to assess the situation, set County policies and priorities, and release information internally and publicly. Decisions made based on information available at the time had to be frequently re-evaluated and adjusted. Accounting for Personnel: Initially, the County’s top priority was accounting for personnel that may have been present at the EHS event, which was expected to draw about 90 staff. It would take approximately eight hours of individual department and centralized County efforts using direct contact, outreach to emergency contacts, eyewitness accounts, data on transported victims, and media monitoring to determine the status of the 72 County employees ultimately confirmed to have been in attendance; resulting in the identification of 14 deceased County employees (including the perpetrator), 22 injured and transported to hospitals, and 36 survivors. Credit: KTLA Incident Support: County personnel were both targets and responders during the attack. Public safety agencies such as the Sheriff-Coroner and Probation Departments, County Fire Protection District, and Inland Counties Emergency Medical Agency played a direct role in responding to the incident. Many other departments also contributed: treatment of victims at the Arrowhead Regional Medical Center; provision of laptops and internet connectivity to the Command Post by the Information Services Department; crisis counseling services offered by the Department of Mental Health; fuel, generators, and vehicle services from Fleet Management; and services for victims of crime from the District Attorney’s Office, among others. Dynamic Situational Information: In any emergency, one of the most complicating factors Credit: R. Lindsay to response is the accuracy and reliability of information. In the first few hours following the attack misinformation was prevalent and posed challenges to the County’s decision-making. Specifically, questions persisted as to the location(s) of the incident, intended target(s), and the identities and motives of the Emergency Protocols: SBC Snapshot Immediate Security Measures/Lockdown: In the immediate aftermath of the attack, County staff was advised to “stay indoors and not leave their buildings.” The majority of executives and department heads interpreted that to mean “lockdown.” The definition of which was widely interpreted with implementation as equally varied across the County. Some departments secured all entryways, others posted guards/personnel, some gathered personnel in semi-secure interior conference rooms, some allowed 5 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County customers in, others had customers leave, some recalled field personnel, others instructed field staff to take vehicles home, etc. All departments expressed a desire for formal procedures defining “lockdown” and associated implementation actions. Notification of Next-ofKin: The San Bernardino County Sheriff’s Department Coroner Division made positive identification of all 14 victims and 2 perpetrators by 9:00 a.m. on December Credit: T. Pierson/The 3, 2015. In-person Press Enterprise notifications to next-of-kin were completed by 3:00 p.m. that same day by the Coroner Division accompanied by Victim Advocates from the District Attorney’s Office and FBI. At the time of this report, the Coroner Division was expanding its notification protocol to allow families to state their communication preferences (i.e., in-person, telephonic) at initial engagements to potentially expedite the process; particularly in cases such as this, with significant media coverage or where distance creates a significant delay with inperson notifications. Autopsies of the victims were completed by December 7th and the perpetrators’ autopsies were completed on December 8th. Official Autopsy Reports (public records in California) were meticulously reviewed, completed, and released after first being offered to the nextof-kin in May 2016. Tremendous care was taken at every step to respect the deceased, protect privacy, and expedite processes and information sharing. Credit: SB Sun Personnel Release and Office Closure: The decision to release all non-essential County employees in the City of San Bernardino for the remainder of the day on December 2, 2015 occurred approximately three hours after the incident. At the time, it was unknown whether the attack was random, targeted, or the first of potentially multiple attacks in the County or on County government. In addition, the County immediately recognized the psychological and emotional toll on County employees once it was revealed that their peers and friends were the victims. Citing these reasons, the Chief Executive Officer (CEO) authorized all non-essential functions throughout the City of San Bernardino (the County seat) shuttered for the remainder of the day. Later that evening, the decision to close all nonessential County functions/offices throughout the County for the remainder of the week (until Monday December 7, 2015) was approved by the Board of Supervisors. Credit: M. Ferner/Huffington Post Emergency Protocols: SBC Snapshot 6 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Emergency Protocol Considerations Topic/Keywords Being a Target and Responder Lockdown Procedures Authorities of Contracted Security Services Accounting for Personnel Incident Locations and Management (Witness Interviews, Personnel Release/ Reunification, and Family Assistance Centers) Options to Notify Next-of-Kin Preparedness Considerations Your organization’s personnel may become both the target and responders depending on the situation, similar to San Bernardino County. Your preparedness activities (e.g., planning, training, exercising) should consider that potential reality and build resilient mindsets and capabilities to address that occurrence. Develop organization-wide procedures for, and a shared understanding of, a “lockdown.” Create common lockdown guidance that provides clear definitions of “lockdown”; conditions warranting implementation and associated activation levels; specific protocols for securing premises and maintaining vigilance; instructions on handling staff, the public/visitors, and personnel in the field; the temporary release of vehicles for personal use; appropriate messaging (e.g., use of public address systems, signage, website messages); and actions for maintaining readiness (e.g., training, drills). Real-world notifications activating the policy should then use the associated defined terminology. Determine if contracted security staff has the authority to make a security policy decision (e.g., lockdown, close a facility) or whether they must receive approval or direction from another source. Consider the advantages and disadvantages of each approach. In either case, contracted security personnel should know what is within and beyond their authority. Consider an organization-wide protocol for providing an actual or anticipated attendance list for special events to an off-site third party, such as an administrative/clerical staff, either before an event begins or shortly after it begins (e.g., texted photograph of sign-in sheets). Look within your organization/jurisdiction for facilities that may potentially be used for mass witness interviews, reunification/release of personnel, and family assistance. In San Bernardino County, for example, nearly 600 people present at the Inland Regional Center needed to be interviewed by law enforcement after the attack, provided basic comfort services, released or reunified with their loved ones, and assistance provided to families seeking information on the status of their loved ones. The facilities selected should offer appropriate capacity/size, access (e.g., ingress, egress, parking), comfort needs (e.g., restrooms, kitchens/food handling, seating), security, privacy, and isolation from the media. Consider their potential co-location, need for separation, and/or relative distance from each other as individuals may need to travel or be transported between multiple sites. Also identify which entity will be responsible for managing each function and which will be providing support. If your organization has the responsibility for officially notifying next-of-kin of the death of a loved one, as the San Bernardino County Sheriff-Coroner Department did, consider multiple options for making notifications in unique situations that are widely covered by the media or where the speed of information sharing is faster than in-person notifications may allow. In-person notifications are typical, but there may be benefits to potentially asking loved ones about their preferences for receiving official notifications and other communications (e.g., in-person, telephonic, or other means). If information on victims is already being reported or speculated by traditional or social media or Emergency Protocols: Considerations 7 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Preparedness Considerations word-of-mouth then families may be waiting in suspense for longer than necessary if in-person notification is the only option. Topic/Keywords Decision-Making with Limited Information Maximize Capabilities and Resources Security/Law Enforcement Requests Lockdown and Public Access Accounting for Personnel Process Accounting for Personnel Responsibility Response Considerations In any emergency, one of the most complicating factors to response planning and operations is the accuracy and reliability of information. In the initial phase of the incident limited or misinformation will be prevalent, posing challenges to decision-making. Do not let this paralyze your response. Remember a decision made based on the best information available is probably better than no decision at all, followed by frequent re-evaluation and adjustment as necessary. Some personnel may be more comfortable operating in this ambiguous environment than others. Be careful not to limit the use of all the capabilities of your organization because of preconceived notions when managing or supporting incident response. Capabilities you feel may be of little value may in fact provide a great advantage and valuable contribution. Do not overlook the potential application of seemingly irrelevant capabilities and resources as out-of-the-box approaches or unknown strengths which may benefit your organization. A major criminal incident may require significant increases in security or law enforcement presence at many locations. Even though it may be assumed security/law enforcement resources are fully committed to higher priority missions, security support is a suitable request for activating law enforcement mutual aid (particularly in California). If necessary, resources can be requested from outside the affected region to temporarily support security needs at critical sites or for other purposes. It is better to proactively request such resources than assume they are not available. For facilities that serve the public, consider the safety of patrons in addition to personnel when a lockdown or shelter-in-place is implemented. Directing the public or non-employees to immediately leave may put them at risk. Your accountability for personnel and identification of victims will likely not be aided by medical transporters or hospitals as this information is protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Use direct contact with personnel that may be present at the incident, make contact with emergency contacts, access event attendance lists (anticipated or actual) and personnel attendance records/timesheets (showing sick leave, annual leave, jury duty, etc.), monitor traditional and social media, use targeted activations of mass notification systems, and gather eye witness accounts from those onsite with whom you have contact to account for all personnel. Realize, however, that many of these sources may initially be unreliable. Consider identifying someone from the organization familiar with the potential victims to participate in the accountability process. They may be able to better identify people upon sight, have personal contact information, or contact information for loved ones of potential victims otherwise not available to the employer. In addition, the accountability process may be laborious. Consider assigning a team of individuals proportionate to the magnitude of the emergency to lead the accountability process. Emergency Protocols: Considerations 8 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Accounting for Personnel Information Sharing Employee Identification Information to Authorities Service Provider Accompaniment During Notifications to Next-of-Kin Personnel Release Office Closures Exceptions to Personnel Release/Office Closures Transportation Support for Personnel Response Considerations While you should be protective and respectful of the information you gathered related to personnel and victim status, consider sharing it with all parties that may have a necessary and urgent need-to-know (e.g., medical examiners, law enforcement, insurers). In addition, while you may not want or be able to provide specific information to colleagues or loved ones of those affected, create an appropriate message that assures them all personnel are being accounted for and information will be released as it is verified. It may be emotionally challenging to not provide the information to those concerned, but it is better to first ensure the information is accurate and confirm you have authorization to share it. If available, provide authorities (e.g., law enforcement, medical examiners) with photographs and information on personally identifiable characteristics of potential victim employees. For example, if your organization takes photographs of employees for employment badges or security access cards, provide those photographs to authorities. This significantly expedited the Coroner’s ability to make positive identification of victims in San Bernardino County. Consider including representatives from departments/organizations that provide services for victims and their loved ones at in-person death notifications to next-of-kin. For example, both FBI and County District Attorney Victim Advocates accompanied San Bernardino County Sheriff-Coroner Department representatives during notifications. This allowed those representatives to immediately share with loved ones available services and resources and explain what may be next in the criminal justice process. Depending on the magnitude of the incident, consider whether it is safe and reasonable to expect offices/functions to remain open and personnel to remain at work. If a decision is made to close offices/functions and release personnel (whole operations or select operations/personnel) try to provide personnel with an estimate of when they may be required to returnthis decision may be updated in the future, but an initial expectation may be well received. Consult your organization’s continuity plans, legal counsel, and other relevant resources to determine which essential functions cannot be shuttered and to what degree. As necessary, you may need to allocate security or other resources to locations where essential functions are occurring if a threat still exists. In addition, certain essential functions may require inputs from other divisions/departments/organizations that otherwise consider their functions non-essential and may be planning to close, but instead need to maintain those ancillary functions in support of others. For example, in San Bernardino County, the mail service would not typically be considered an essential function; however, since the Courts had to remain open, some mail services had to be maintained while other functions/offices were closed. Closing operations or offices at an atypical time or restricting access to certain areas may result in personnel who normally rely on shared ride services or public transportation becoming stranded without another means home. Consider strategies for caring for stranded personnel until transportation assets are available or assisting them with their transportation under those conditions. Emergency Protocols: Considerations 9 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Response Considerations Unmarked Transportation Resources Consider using unmarked transportation resources to move sensitive items, persons, or the remains of the deceased. Marked vehicles are often followed and documented/photographed by the media and curious on-lookers, which may later appear disrespectful to those affected. Facility Access for Anticipate law enforcement and investigative personnel will need access to Authorities/ your facilities and the property of potential suspects and victims. The number Investigations of law enforcement/investigative personnel needing access to your facilities and the duration of their presence may be significant. Their efforts may continue after-hours. Consider providing keys, access cards, or equivalents to allow for unfettered ingress and egress to the areas where they need access, or if you intend to escort, grant access, or document each entry/exit, be sure your access control staffing is sufficient to manage the demand. Leaked Information/ Be cognizant of the potential for leaked information and images. For example, Images as a result of leaked images following the 2013 manhunt for killer Christopher Dorner in San Bernardino County, certain departments of the County chose different approaches following the December 2, 2015 terrorist attack to ensure confidentiality. Information security may affect the personnel and resources your organization chooses to assign to its response and recovery efforts. Public Disclosure The records of most public entities are subject to public disclosure because of the Freedom of Information Act (FOIA) or state- or local-level sunshine laws. Consideration for Many of these records may be troubling or traumatizing to victims and loved Victims and Loved ones. For example, detailed autopsy reports are subject to public disclosure in Ones California. First, public employees should be reminded that nearly everything they do, document, or say in the midst of crisis and thereafter may later become public record. In addition, documents known to likely cause concern or trauma should be crafted as sensitively as possible to consider the perspective of victims and loved ones. Victims and loved ones should be notified of pending releases of information and should be given an opportunity to review such information in advance of the release. While victims and loved ones may not be able to change the contents or alter the disclosure, they will at least be better prepared for public and media use of, and reaction to, the information. Topic/Keywords Recovery Considerations Continued Office Closures/Personnel Release Once the threat has been eliminated, try to quickly determine the organizationwide psychological effects on personnel and operational effects on systems and resources to determine whether it is appropriate and/or necessary to close operations, continue closures, or selectively provide leave to certain employees. Consider the sense of grief, violation, disbelief, and fear personnel may be feeling; the time it may take to prepare facilities and resources to resume operations; and the public perception and media coverage. Although the known threat may be eliminated it may be necessary and appropriate to at least temporarily visibly increase law enforcement and/or security presence at and around affected locations to encourage employees to return to work by putting them at ease and presenting a safe work environment. Security Presence Return to Work Emergency Protocols: Considerations 10 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Category 2: Operational Response San Bernardino County Snapshot Department Emergency Operations Plans (DEOPs): One might assume DEOPs intended to address emergency procedures and continuity of operations would have been widely referenced following the attack. While departments were aware of the DEOPs, most did not find value within them relevant to the situation. Those results were not unexpected as a review of DEOPs confirmed most either did not include information relevant to the situation (e.g., lockdown procedures), were not compliant with the County’s template (which itself was not compliant with national and industry emergency management or continuity standards), or were not developed well enough to offer value (e.g., identification of essential functions and minimum staffing levels to inform the release of non-essential personnel). Most departments that referenced the DEOP on that day stated that they used it only for its emergency contact lists. supporting policy decisions, continuity strategies, and recovery (e.g., Family Assistance Centers). Credit: R. Lindsay Proclamations of Emergency: The County’s Director of Emergency Services (County CEO) signed a proclamation of emergency for the County on December 10, 2015, which was then reauthorized approximately every two weeks thereafter until August 8, 2017. During that time, the Proclamation was used to allow the CEO to organize, control, and direct the efforts and resources of County entities to collectively achieve emergency objectives; permit the CEO to make and issue emergency rules, regulations, and orders; allow the County to access resources through California’s Standardized Emergency Management System (SEMS); apply legal and liability protections; and position the County to potentially have eligible costs qualify for State and/or Federal reimbursement. County Emergency Operations Center (EOC): San Bernardino County’s EOC was operational within an hour of the attack and remained so until the evening of Friday, December 4, 2015. During that time it issued flash reports to stakeholders throughout the County, coordinated resources to support the field response/incident command, and served as an alternate Department Operations Center (DOC) for the Inland Counties Emergency Medical Agency (ICEMA). Per national, California, and industry standards and practices, the County EOC was underutilized and could have played a greater role managing information, maintaining situational awareness, and facilitating and Operational Response: SBC Snapshot Management Practices: The County EOC and departments that activated Department Operations Centers (DOCs) demonstrated a methodical approach for establishing 11 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County emergency objectives, making assignments, and tracking actions. Initially, most other department efforts and those of individuals were reactive and self-directedassuming responsibility when they identified a void. As a result, there was some duplication of efforts, lack of coordination across departments, or some assignments were given to staff that may not have been optimal. The situation improved days after the incident when the CEO established a multi-department Post-Incident Coordination Group that met regularly for nearly 15 months thereafter to facilitate planning, assignments, and information sharing across departments. Agent to issue required purchase orders for emergency repairs and renovations needed for alternate facilities to house relocating EHS Division functions and coordinate necessary security services. The authorities were later expanded and between December 7, 2015 and August 2016, the emergency procurement process was used 46 times for acquisitions totaling approximately $920,000. Procurements were wide-ranging, including cleaning and repair of vehicles, memorial events and items, counseling services, repayments to EHS mutual aid Credit: SB County providers, and temporary contractors to Credit: R. Lindsay provide EHS staffing. Documentation: Given the speed at which actions and incidents were initially occurring, few in the County took deliberate notes, kept a log, or tracked actions. For example, the authors of this report and the County’s organizational review struggled to clearly define the timeline of events on the day of the attack and those immediately following because most staff did not maintain records from those days. This was followed by multiple rounds of effort by the CAO to encourage personnel to recall, document, and submit records of their actions. Logs and records would later prove essential for historical, liability, and cost recovery purposes, but in the moment, they would have also kept personnel on track and insured against errors, omissions, or duplications of effort. Addressing the Perpetrator’s Footprint: Almost immediately following the attack, as the male perpetrator’s identity became widely known, dozens of retail food establishments began contacting the County asking that the Environmental Health “Grade Cards” with the perpetrator’s signature be replaced. In addition, some individuals were purportedly trying to collect the Grade Cards with the intent to sell them. A priority task was to replace all the EHS Division’s publicly posted food inspection Grade Cards bearing the perpetrator’s signature. Twenty-two Health Inspectors from neighboring Riverside County replaced 368 cards approximately a Credit: SB County week after the attack over three days. Additionally, the perpetrator had a workspace alongside his colleaguesmany now deceased or injured because of his actions. After EHS employees decided they wanted to return to their workspace after it had been Emergency Procurement: The County’s emergency procurement program was well positioned and prepared to support the emergency needs of the incident and was effectively optimized and implemented following the terrorist attack. Soon after the attack, the Board of Supervisors waived the competitive solicitation process and authorized the CEO and County Purchasing Operational Response: SBC Snapshot 12 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County completely remodeled, the location of the perpetrator’s former workstation was made into a storage area so no employee’s new workstation would be placed in the same area once renovations were completed. serve. The DPH coordinated security for the safety of both staff and the family of the deceased perpetrators when the family came to retrieve the official death certificates from the County. In addition, once both perpetrators were deceased, their child became the ward of the San Bernardino County Department of Children and Family Services (CFS). The child was provided with all the care and services due a ward of the County until she was eventually placed with relativeswhile employees within the same department were concurrently serving as Victim Liaisons to survivors of the attack and the families of deceased victims. As a provider of emergency and social services, addressing the perpetrator’s footprint also meant rising above the potential for personal biases and animosities as duty and professionalism demanded. For example, the Coroner’s Division investigated the perpetrator’s death, transported, autopsied, and released the remains with the same level of professionalism and respect they paid to the victims and all others they Operational Response: SBC Snapshot 13 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. 14 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Operational Response Considerations Topic/Keywords Emergency Plans/ Programs Compliance Culture of Dialogue Action Planning Emergency Procurement EOCs/DOCs Familiarity Training/Exercise Preparedness Considerations Emergency plans are important and are only of value when appropriate time and care have been taken to develop and maintain them, and actions taken to ensure they can be implemented. Whether developing one plan or a template for many plans, ensure it is comprehensive and compliant with national, international, or industry standards, provides specific prompts for the inclusion of needed information, identifies or suggests strategies and/or approaches for both emergency protocols and continuity responsibilities as applicable. Appropriate resources should be applied to guide staff through the development process. An audit/enforcement function should also be in place to review and provide feedback on emergency plans/programs and assure compliance, including evidence of implementation to impart confidence in organizational abilities to respond to emergencies and sustain operations. Foster a culture of open, unrestricted, and consequence-free brainstorming and productive discourse. Individuals that have valuable information to add to a discussion or who identify challenges with courses of action should be encouraged to present their thoughts during appropriate engagements. It is one thing to encourage discourse and another to demonstrate it. Culturally, some organizations are more reserved and others are more open. During an emergency situation where the consequences of decisions and courses of action are monumental, all appropriate stakeholders need to be comfortable contributing. In cultures where this is not as prevalent, greater effort should be placed on facilitating such discussion. In the midst of the crisis situation, personnel will likely self-direct actions and tasks amongst themselves or assume responsibility when a void is identified if the organization has not institutionalized a more formal approach to action planning. This may result in some duplication of efforts, lack of coordination across entities, assignments falling to inappropriate or unauthorized staff, etc. Advance training on, or regular use of, a system such as the action planning model within the Incident Command System (ICS) (https://www.fema.gov/incident-command-system-resources), may facilitate the setting of more deliberate strategic or tactical objectives, assignments, application of resources, cross-entity awareness, and information sharing to avoid the risks of more ad-hoc management practices. The ability to rapidly acquire resources necessary for response, recovery, and continuity capabilities is a critical component of an organization’s emergency protocols. Day-to-day procurement processes for most public entities are usually governed by state or local law and established procedures to ensure a competitive process and the best use of public funds. That, however, may present obstacles to immediate resource acquisition for emergency purposes. Ensure your organization’s policies and protocols allow and facilitate the emergency acquisition of resources during and following an incident. All stakeholders with a response/recovery responsibility in your organization should have a robust understanding of the purpose/value and functionality of your EOC, DOCs, or equivalents. Maintain a robust training and exercise program and take every opportunity to demonstrate/rehearse operations Operational Response: Considerations 15 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Elected Officials/ Senior Leadership Emergency Preparedness Federal Relationships Shared Expectations and Understanding Emergency Preparedness Funding EOC/DOC Access to Computer Aided Dispatch (CAD) Manual Processes Redundant Information Technology Systems Critical Incident Stress Management (CISM) Preparedness Considerations center capabilities, including during smaller-scale incidents and pre-planned events. Elected officials and senior leadership should make emergency preparedness a priority. For example, they should attend training and exercise events that have objectives associated with their emergency roles/responsibilities and should limit sending designees as much as possible. Inevitably, they will want to participate during the emergency, so they must be engaged during preparedness planning, training, and exercise activities. Designees and alternates should be welcomed along with the principals, but not in their place. Develop a relationship with your local FBI office and its personnel beyond law enforcement/investigative functions (and/or other federal entities not typically involved in your response/recovery activities) in advance. Develop a shared understanding of each other’s capability-levels so efforts can be better informed, resourced, and integrated during an emergency. In San Bernardino County’s case, for example, the FBI had planned to implement a “complete package” of services/resources expecting limited local capabilities when in fact San Bernardino County was prepared and capable of effectively addressing a large number of matters. Budget requests associated with emergency management/preparedness are sometimes less competitive than other organizational priorities. Terrorism and mass shooting incidents can happen anywhere and emergency management programs are invaluable to an effective response and recovery. Consider proportionate and stable funding for your emergency management programs. If feasible, provide the EOC or equivalent access to your jurisdiction’s computeraided dispatch (CAD) system or create a bridge between your jurisdiction’s emergency management information system (if applicable) and CAD system. Direct access to real-time incident information captured in public safety agency CAD systems may be invaluable to the EOC or equivalent during quickly evolving and/or complex incidents. Your EOC/DOCs or equivalents should be prepared to implement manual processes for information technology (IT) systems even during incidents that may appear to pose no threat to IT infrastructure. Although the terrorist attack in San Bernardino County had no direct effect on IT systems or infrastructure, the thousands of people attempting to stream coverage on the County’s IT infrastructure caused data exchange and information management systems to come to a near halt; thereby temporarily rendering internet-based activities obsolete at times. Having the ability to increase bandwidth, restrict system usage, or move to manual processes may all be valuable capabilities to have at your disposal. As part of a more holistic Critical Incident Stress Management (CISM) program, plan and coordinate to have Critical Incident Stress Debriefings (CISDs) for all response personnel (field and supporting) at either regular occurrences during operations or upon deactivation/demobilization of programs/resources. Operational Response: Considerations 16 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Proclamation of Emergency Personal or Unit Logs/Records EOC/DOCs Activation EOC Liaisons/Field Observers EOC/DOC Agency Representatives Confident Posture Response Considerations Proclaim a State of Local Emergency and request state and/or federal proclamations or declarations, respectively, if applicable. The proclamation typically facilitates the following (though your organization should determine in advance which liberties it specifically allows):  Empowers a central authority to organize, control, and direct the efforts and resources of the organization and make or issue emergency rules, regulations, and orders reasonably related to the protection of life and preservation of property (e.g., curfews, restricted/closed areas, price gouging ordinances, restrictions on sales, direct the allocation of private resources).  Access resources necessary for emergency purposes not otherwise available or in a more expedited manner (e.g., providing and/or receiving mutual aid, activating emergency procurement authorities, resource commandeering for the public good). (Specifically in California)  Legal and liability protections to include the amplification of privileges, benefits, and immunities provided by state law for registered disaster service workers. (Specifically in California)  Position the organization to potentially have eligible costs qualify for state and/or federal reimbursement, as applicable, in the event of an associated Presidential Declaration of Emergency or Major Disaster. Every person performing a function associated with the incident should keep a log/record or populate one when it is safe and appropriate to do so, to keep them on track, provide reminders of necessary actions or follow-up activities, ensure against omissions or duplications of effort, and for legal, historical, and cost recovery purposes. Consider activating your EOC, DOC(s), or equivalents immediately even if the incident does not appear to be the type for which your EOC/DOCs or equivalents would typically have a role. Consider dispatching trained and qualified liaisons or field observers to Incident Command Posts (ICPs) or other ancillary operations (e.g., Family Assistance Centers, Local Assistance Centers, shelters, logistics staging areas, etc.) for large and complex incidents/operations to facilitate and expedite information sharing, situational awareness, and resource management between the field and the EOC/DOC or equivalent. This may alleviate some burden on the field and EOC/DOC or equivalent and also present opportunities for the liaison/field observer to identify potential operational gaps or needs in the field that could be addressed by the EOC/DOC or equivalent. If not done already, consider having representation from the FBI, coroner/medical examiner, and others involved in mass casualty/fatality incidents as Agency Representatives in your EOC/DOC or equivalent to facilitate face-to-face (rather than virtual) coordination and information sharing. This may also help smooth what may otherwise seem like abrasive involvement from federal and/or other agencies with whom you may not typically work. As state, federal, or other agencies and resources arrive to take command or offer support, be confident in your organization’s capabilities and demand a seat at the table. The arriving parties may be intimidating, but your organization needs to stand up for itself and the best interests of its constituents. Operational Response: Considerations 17 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Effective PreExisting Processes and Systems Redacting/ Safeguarding Information Personnel Status Information Sharing Cost Codes Emergency vs. Standard Procurement Address Perpetrator(s) Footprint Response Considerations If you suspect your incident may officially be an act of terrorism (which may not be determined or have operational effects for days later or longer), do not let that classification affect your standard and typically effective processes and systems for information sharing, situational awareness, and inter-agency coordination. Continue to use those successful mechanisms as you would in any other emergency situation. Carefully consider what, if any, information you are redacting/safeguarding, from whom, and why. Be particularly cognizant of redacting/safeguarding efforts being done only out of sensitivity for emotional/psychological impacts that may actually negatively impact the effectiveness of emergency operations. Consider proactive and non-redacted information sharing between the personnel accounting process and parties whose services to victims, loved ones, and next-of-kin may benefit from the immediate notification of a person’s status (e.g., medical examiner/coroner, reunification programs, employee benefits programs). Assign unique incident-specific “codes” for time keeping, cost tracking, and to facilitate emergency procurement. Widely distribute and advertise the codes and provide instructions on their use throughout the organization. Determine which procurements/acquisitions associated with your response, continuity, or recovery efforts are justifiable under emergency policies and will be pursued through expedited procurement versus those pursued under normal procurement procedures. The duration and magnitude of the recovery effort may influence the decision that reflects the best use of public funds. For example, San Bernardino County chose emergency procurement authorities to facilitate the quick-turnaround preparations of alternate facilities for relocating personnel while using standard budget appropriation and capital improvement procedures for the renovation of primary facilities to which relocated personnel would permanently return. If the perpetrator(s) had an association with your organization, it may be necessary for the organization to remove, suppress, or address the physical and psychological mark left by the perpetrator(s) on the organization. To support recovery, emotional welfare, and avoid contemptable acts by third parties, these actions may need to be taken quickly and immediately depending on the situation. Discern the physical and psychological “footprint” left by the perpetrator(s) on facilities, personnel, customers, processes, and apply resources to eliminate the footprint as appropriate. Operational Response: Considerations 18 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Recovery Considerations Management/ Coordination Group As the magnitude, consequences, and duration of the incident’s impacts become apparent, consider establishing a separate management/coordination group with wide-ranging and diverse representation to specifically advise on policy, priorities, and coordinate efforts solely related to the response to and recovery from the incident. The group may meet frequently initially and alter its scheduling as the recovery evolves. Depending on the duration of the recovery, the group may exist for months or years. For example, San Bernardino County established a “Post-Incident Coordination Group” with permanent representation from 13 departments, augmented regularly with others as needed, that met weekly, bi-weekly, or monthly for more than 14 months following the attack. Within a few weeks or months after the incidentas is appropriate and reasonableinitiate an effort to formally collect incident-related documentation and records from affected individuals and organizational elements. Consider providing “prompts” much like a survey to which individuals or organizational elements may respond (e.g., “what were you doing when…,” “how did you use the plan…,” “how were you notified of…”). People’s recollections of the incident, what they did and when, will quickly begin to fade so you will want to gather accurate information as soon as possible. This will be aided if personnel/units kept logs/records. For any of the aforementioned reasons associated with a Proclamation of a Local Emergency, the organization may want to continue its proclamation for the duration or a portion of the recovery phase. If necessary, be prepared to renew and justify proclamations at statutory timeframes with termination of the proclamation at the earliest possible date that conditions warrant. For example, San Bernardino County’s proclamation was in effect from December 10, 2015 to August 8, 2017; reapproved by the Board of Supervisors approximately every two weeks during that time in accordance with California law. If your organization is a provider of emergency services, social services, or employment benefits, it may be necessary to rise above the potential for personal biases and animosities to provide services to the perpetrator(s) and/or their loved ones. There may be little that can be done to prepare organizations for this other responsibility than to say duty and professionalism may demand it. Also be cognizant of the psychological effects this may have on staff required to assist the perpetrator(s) that harmed their colleagues/friends/organization or the perpetrator’s loved ones. Gather Formal Documentation/ Records Proclamation of Emergency Continuation Potential Services to Perpetrator(s) Operational Response: Considerations 19 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. 20 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Category 3: Communications San Bernardino County Snapshot Initial Notification: The initial notification of the terrorist attack was received by the CAO on December 2, 2015, at 11:20 a.m. This first message inaccurately minimized the severity of the incident, but within 10 minutes there was understanding that County employees were victims. By 11:40 a.m. the news media was widely reporting the incident. Over the next few hours, information continued to be uncertain and sometimes inaccurate. The County EOC issued its first Flash Report at 11:45 a.m., which provided information on road closures and areas to avoid, but did not include any incident details. The first official “county-wide” notification was sent to the Board of Supervisors, County executives, and department heads at 12:04 p.m. from the CEO directing all staff to “stay indoors and not leave their buildings.” The next official county-wide notification was an email at 1:48 p.m. instructing staff “within the City of SB who are not responding to the incident [to be] released from work for the remainder of the day,” with a follow up email at 3:24 p.m. informing all non-essential County employees of the same information. Compensation System (EMACS) proved to be largely inaccurate or out-of-date so contacts could not be reached. While select departments had up-to-date and useful contact information that they maintained independently, most departments did not. Soon after the attack, the County instituted a policy requiring all personnel to update emergency points of contact and associated contact information to coincide with the annual renewal of employee benefits to avoid this problem in the future. Mass Notification/Communications to Employees: At the time of the attack, the County did not have a mass notification system capable of automatically and simultaneously contacting its nearly 22,000 County personnel. In most cases, for instance, the County’s standard approach had been initial emails to department heads who in turn disseminated messages to their personnel as appropriate through means available to their department. In the aftermath of the attack, some employees received notification directly from department heads, through supervisors, or mass emails, while others learned through social media and website or blog posts. Some employees, having no means to be reached when not at their work computers or when not physically present, did not receive essential notifications. As of September 12, 2017, the County instituted a new Employee Emergency Notification System (also known as the “SB Safe Employee Alert System”) and associated operational guidance for use county-wide with the first major test on Credit: SB Sun Emergency Contacts: As part of its effort to account for personnel, the County tried to reach designated emergency contacts for employees believed to be in attendance at the EHS event. The information in the County’s Employee Management and Communications: SBC Snapshot 21 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County October 19, 2017 as part of the Great California Shakeout drill. The system can send text messages and/or emails to County employees in the event of an emergency that potentially threatens the health and/or safety of employees. (ARMC)a county-operated hospital that was without a PIO at the time; navigated HIPAA and information privacy protocols; and monitored media sources for rumors and misinformation. The PIOs would go on to provide direct support to survivors and loved ones as the media descended upon the area; created opportunities to draw attention from employees, survivors and loved ones; and used their influence to promote widespread advertising of the SB United Relief Fund. Public Information: Multiple department Public Information Officers (PIOs) supported the management and release of emergency information to the public during and immediately following the terrorist attack; most notably the Sheriff’s Department public affairs team and Department of Public Health PIO. However, since a Joint Information Center (JIC) was not established because of the short duration of the incident, the CAO PIOs handled much of the public information function thereafter. When the CAO PIOs first learned of the attack, it was not apparent for nearly an hour that it had targeted County personnel. The nature of the event changed dramatically again when one of the assailants was identified as a County employee who was later killed in a shootout with law enforcement that afternoon. In the immediate aftermath, the CAO PIOs provided direct support to the County Board of Supervisors for emergency messaging; fielded hundreds of calls and emails from the press, public, and loved ones looking for information about the incident and County employees; utilized the County’s Twitter and Facebook presence to ensure messaging was accurate and timely; served as the PIOs for the Arrowhead Regional Medical Center Communications: SBC Snapshot Credit: SB County 22 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Communications Considerations Topic/Keywords Mass Notification System Emergency Contact Information Updates Accessibility Public Inquiry PIO Capabilities PIO Succession Social Media Preparedness Considerations Consider acquiring, programming, and using a mass notification system for all personnel capable of utilizing multiple communication mediums, including email, text, and telephone, both personal and professional. Redundant notification systems that include push notifications (i.e., to telephones and emails) and passive notifications such as website or social media postings are particularly effective. Implement a policy for updating employee emergency contact information at least annuallyperhaps along with an annual employee benefits renewal process or another milestone. Ensure employees understand the importance of providing personal contact information for themselves and for their emergency contacts. Emergency Contacts should be stored electronically so they are accessible off-site or without access to organizational networks and back-up hard copies should also be kept with trusted and authorized personnel. The San Bernardino CAO received more than 100 calls in the first 30 minutes following the attack from the media, the general public, County departments/employees, and families/loved ones of potential victims. Media calls, public inquires, and calls from families/loved ones will likely need to be handled differently. Posting information on many channels and then directing the media/public to those channels is typically the most efficient. For personalized assistance and public assurance, a call center may be necessary (Note: equipment needs and staff training/structure can be created before the incident). Ideally, inquiries from the media, public, and families/loved ones would be routed to three different and dedicated resources. Determine how your organization will answer, log, triage, respond, and follow-up on those inquiries. Significant resources may need to be applied. Ensure your organization has competent and skilled PIOs ready to respond to an emergency of significant magnitude and complexity. It is critical to have highly trained and experienced staff that can handle stress and are comfortable in front of the national media. Teams of internal staff from across departments as well as those from nearby agencies/ organizations who know one another and who regularly train together can help an organization get ahead of issues and generate public trust. The PIO function, similar to the organization’s senior leadership, is important and unique and warrants an order of succession that may be implemented when principal PIOs are unavailable. The organization’s portrayal by the media and public perception is enough to make or break an organization. As such, it is critical to have multiple skilled PIO personnel available to back-up each other within all appropriate organizational elements. Encourage PIOs to become well-versed in the social media landscape. Visual story-telling skills are imperative and go well beyond simple social media postings. The CAO PIOs in San Bernardino were highly experienced with social media and elevated the County’s social media presence prior to the attack so County employees, residents, and the media were able to turn to the County's online presence as a trusted source for information, which assisted the County with managing the onslaught of inquiries. Communications: Considerations 23 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Alternate Communications Information Distribution and Retention Multiple Mediums Communication Frequency Elected Officials Messaging to those Affected Accessible Information Translation Services Response Considerations When planning for information dissemination, consider that those affected by the incident may not be in possession of their normal communications devices (e.g., they may have been left behind during an evacuation, damaged, ran out of power, confiscated as evidence) and alternate means of immediate engagement may be necessary. When communicating information related to benefits, leave, administrative processes, etc., the needs and expectations of affected victims, loved ones, and employees will be diverse. It must be recognized that individuals will be receptive to information at different times and via different modes. When information is provided it will not necessarily be received or comprehended. Information needs to be available consistently or continually through multiple mediums to maximize distribution and retention. Whether or not ongoing communication with victims/affected individuals is necessary, you may still want to consider maintaining contact with those affected on a regular basis to ensure them they are not forgotten and services continue to be available. Likewise, additional dedicated staff may be needed to help communicate with those affected. Some of the methods used by San Bernardino County included:  Personal Networking – EHS employees used their personal relationships and personal contact information to relay information to each other.  Formal Information Sessions – Representatives from departments including the CAO, Human Resources, Risk Management, District Attorney Bureau of Victim Services, Department of Behavioral Health, and the San Bernardino County Employees’ Retirement Association held multiple in-person information sessions.  Social Media – An EHS employee created a private Facebook page for EHS staff only accessible via invitation. For nearly 6 months, EHS leadership would email the Facebook page creator to request information postings or notifications for upcoming events.  Website – The County created a password-protected website only accessible to EHS employees.  Mailings – The County developed a mailer template and provided EHS with relevant information to be disseminated. EHS would in turn populate the template and mail it.  Email – All EHS employees retained their ability to access their work email accounts from home. Elected officials may wish to communicate with victims and affected personnel if applicable to your organization. During non-crisis periods, they may do so per their own preferences to their own constituents without coordination with fellow elected officials. In the event of crisis, they are strongly encouraged to coordinate their communication strategies for victims before reaching out. They should apply similar timing, messaging, and means (e.g., letter, telephonic, in-person) to ensure groups of victims/affected personnel are not engaged in different ways or not at all, which could create resentment. Ensure all press conferences, events, incident facilities, and other associated locations make information accessible to individuals with disabilities, access, and/or functional needs (e.g., sign language interpreters, signage in multiple languages, braille). All information intended for the public should be translated Communications: Considerations 24 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Public/Internal Messaging Branding/ Terminology Intense/Aggressive Media Leverage Intense Media Focus Support Those Affected with the Media Rumors and Misinformation Public Information Surge Capacity Response Considerations into all appropriate languages and, as much as possible, distributed at the same time and via the same modes as English versions. Establishing contracts for translation services for media/public materials should be considered in advance of an emergency. Listen to those affected for cues regarding branding and terminology while crafting public and internal messages. In San Bernardino County, for example, those who were present during the attack preferred to be called “survivors,” not “victims.” The loved ones and the colleagues of those who were killed wanted it to be known their loved ones were not “lost” but “taken” by the terrorists. Every effort was made to direct attention to the survivors/victims and not the perpetrators. The media (traditional and non-traditional) will be relentless and ruthless in getting information. They will find personal phone numbers, email addresses, and home addresses of victims, witnesses, and officials of the organization. They will camp out at individual’s residences, follow their vehicles, stalk them in public, and misrepresent themselves as third parties providing services or representing other interests. As a result, those affected may isolate themselves, disconnect their phones, stop checking email or regular mail, etc. It is important for affected individuals and the organization to be prepared for the media onslaught and have resources available to support ongoing engagement/communications with stakeholders. Leverage the intense media focus to your benefit or to help achieve your objectives. For example, San Bernardino County held a press conference on the Monday morning following the attack to coincide with the timing of County employees returning to work for the first time. The press conference was substantive, featuring survivors, treating physicians, and the Board of Supervisors. The County used that press conference to divert media attention away from employees so they could return to work in peace. The County would also only agree to participate in televised interviews if media outlets advertised the “SB United Relief Fund” or the “SB United Relief Fund” posters were prominently placed at media events. Assist and support individuals who want to talk to the media, particularly survivors and the loved ones of victims. San Bernardino County created a list of 50 questions and suggested answers to prepare individuals for some of the potentially intrusive or offensive questions that might be posed by the media. The County also offered to provide one-on-one coaching to prepare those individuals for interviews. From a public information perspective, be prepared for rumors and misinformation around the incident and your organization’s actions, particularly during and immediately after the incident. A proper Joint Information System (JIS) will have a thorough rumor control function as a vital responsibility. Be prepared to surge your public information capabilities and do so as quickly as possible during the incident. Consider accepting offers of assistance from those you know, trust, and who have experience with the national media. PIOs may have the instinct to take on growing responsibility to help the response effort or may not accept assistance thinking it will take too long to onboard the Communications: Considerations 25 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Response Considerations support, but then quickly exceed their span of control. Maintain a realistic perspective on the public information workload, your capabilities, and request or accept support as appropriate. PIO mutual aid may be available to the public sector or PIO trade organizations for the private sector. Topic/Keywords Recovery Considerations Organization-wide Information Sharing Ensure situational information and information regarding organizational response/recovery actions are crafted for multiple audiences and made available to each group accordingly. Those directly impacted or involved will need the most detailed information, while those on the periphery may benefit from just a basic status summary. Not everyone needs all available information, nor do they need it at the same time, but providing some information to all stakeholders at appropriate intervals may help build support for your mission, address concerns of transparency, and satisfy curiosity that may otherwise lead to discontent or criticism. For example, in San Bernardino County, county-wide information updates were not disseminated during the response or at regular intervals during the long road toward recovery. As a result, many personnel believed the County was taking no action and might be failing the victims. In reality, many efforts were underway (e.g., security enhancements, renovations, memorials, benefits administration) that could have been shared to manage perception. Err on the side of over-communication. Anticipate your organization and perhaps specific employees and stakeholders, will vacillate from “hero" to "villain” in the public eye. The communication response will have to adjust accordingly. An article may praise your efforts to help the victims while another calls into question your motives and the quality of your actions. Be prepared to receive criticism for your communications approach. Some will feel you shared too much too quickly; others will feel you did not share enough or took too long; others may have wanted the information to come from a different source within the organization. Do your best under what will be very trying circumstances and know you will not please everyone. The intense media attention may wane after a few weeks or if another tragic incident occurs. However, anticipate that at major milestones (e.g., anniversaries), as significant developments occur (e.g., investigation results, decisions in legal actions), after incidents with similarities to yours happen elsewhere, or sometimes just unexpectedly, the media will reemerge for new information and may rehash old issues with the same voracity. Depending on the nature and severity of your incident, be prepared for this cycle to continue indefinitely. This is also a reason why your organization’s spokespeople should be actively kept informed about any potential developments even years after the incident. The organization should assume the media will find out about everything and your spokespeople need to be prepared at all times. Shifting Persona Anticipate Criticism Cyclical Media Attention Communications: Considerations 26 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Category 4: Employee Support San Bernardino County Snapshot Victim Liaisons: The County created a Victim Liaison program inspired by a concept used by public safety agencies that provides single points of contact and support to the families of deceased employees. The goal of the County’s program was to assist the victims and their families Credit: J. Hong/AP with the scale of bureaucracy and paperwork related to benefits, payroll, workers' compensation claims, and the like. Each victim was assigned a liaison to assist with practical matters and to be a conduit for information regarding the County's processes and resources. Individuals selected to serve as liaisons were chosen from the Department of Behavioral Health (DBH), Children and Family Services (CFS), and the Transitional Assistance Department (TAD). The relationship between liaisons and victims varied. As the program was established very quickly, written guidelines were not developed outlining the specific duties and expectations of the liaisons or the recipients. Some liaisons supported families with their daily activities, including driving victims to appointments, providing childcare, grocery shopping, and assisting with holiday decorating. A number of the liaison responsibilities were not traditionally part of the first responder model, but reflected the County’s desire to do ‘whatever it takes’ to assist the victims and families. Elements of the program and liaisons continued to function until June 5, 2017. Employee Support: SBC Snapshot Victims of Crime Services: The San Bernardino County Bureau of Victim Services (BVS) is part of the County District Attorney’s Office and offers a wide range of services to those who have been the victims of a crime. BVS services include: crime-related crisis counseling; emergency services such as food, shelter, clothing, medical care and transportation; orientation to the criminal justice system; court support; and referrals for mental health services, among others. All victims of the terrorist attack were eligible for services from BVS, including victim compensation benefits from the California Victim Compensation Board (CalVCB). “Victims” included the families of the deceased, the injured, those present during the attack (including approximately 600 nonCounty personnel that were on-site at the IRC Credit: G. Roth complex that day), and residents living along San Bernardino Avenue where the shoot-out with the perpetrators occurred. BVS immediately assigned ten “Victim Advocates” to exclusively assist with the short- and longterm needs of the associated victims. The BVS Victim Advocates were experienced and had worked significantly with trauma victims in the aftermath of violent crime. However, addressing the magnitude of the December 2, 2015 attack proved a challenge for even them. The response required an unprecedented level of coordination with other County departments to navigate unmet 27 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County victim needs, manage the volume of claims, and adapt to changing policies and exceptions beyond normal statutory limits. By all accounts, the BVS team met the needs of victims in a timely and compassionate manner. work while on disability or other approved form of leave. Initially, all of the EHS Division and affected Land Use Services Department staff who shared office space with the EHS Division were given paid leave until January 11, 2016, but could then continue leave as needed through workers’ compensation, short-term disability, and/or the victim compensation benefits from CalVCB. The HR Department partnered with the RM Department and District Attorney’s BVS to Credit: C. Porter ensure victims continued to receive full compensation and benefits. The County also later assigned a full-time Human Resources Officer and hired a Wellness Coordinator to specifically address the needs of all those in the EHS Division. Emotional Support: Following the attack, the County recognized the substantial emotional consequences it would have on personnel. The County provided a wide range of emotional and psychological support services both to County employees and the greater community. Three entitiesone internal to the County and two externalwere crucial in the delivery of emotional support services: the DBH and two private contractors, the Counseling Team International (CTI), which had pre-existing contracts with multiple County Departments, and the International Trauma Center (ITC). The utilization of thirdparty counselors was particularly effective to support the EHS Division. While DBH clinicians were trained to respond to crises, the nature of this event meant that the DBH clinicians were themselves emotionally impacted by the incident. The CTI and ITC counselors were independent. DBH and CTI counselors were regularly on-site at a variety of facilities for long-durations (months to years). ITC provided management-level counseling services to supervisors on how to navigate a traumatized workforce while maintaining productivity. The services provided an additional message to employees that the County was supportive of, and had prioritized, employees’ emotional health. The County created a novel, yet labor intensive, solution to simplify the process for victims by issuing single paychecks that covered each employee’s total compensation regardless of the source of incomebe it regular time, paid leave, workers' compensation, or CalVCB benefits. Traditionally, victims would have received individual payments from each source, each according to a different payment schedule, and covering different pay periods. In addition to easing reconciliation burdens on the victims and ensuring a steady and predictable level of income, administering a single paycheck through the County payroll system ensured employee benefits such as vacation and retirement credits continued to accrue. As part of the ‘whatever it takes’ mentality, leave for employees was individually tailored. Employee Benefits and Leave: The Human Resources (HR) Department worked to ensure the continuity of pay, benefits, and leave for all County employees affected. The concept was often referred to as making victims “whole”meaning they would accrue their salary and benefits as normal, regardless of whether (or how often) they returned to Employee Support: SBC Snapshot 28 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Department continued to work long hours to expedite the program whenever possible. A California Department of Industrial Relations investigation determined claims were typically delayed or denied because employee physicians “…had failed to document or fully explain their requests.” The report also found that of the total 2,146 treatment decisions, 90% were approved and 3% received modified approval. Nonetheless, to address growing concerns, the County hired nurse case managers to proactively serve as ombudsmen to facilitate the presentation of treatment requests in a way that would satisfy the workers’ compensation system’s treatment guidelines, which was a best practice later integrated into California law. Credit: SB Sun Workers’ Compensation: Workers’ compensation was the primary means through which medical care, psychological care, and short-term disability was provided to County employees present at the workrelated function that was the target of the terrorist attack. The workers’ compensation program in California is highly regulated by the State. San Bernardino County’s workers’ compensation program is self-insured to a ceiling and self-administered. Donations: Within hours of the attack, both monetary and in-kind donations were being sent to the County. The County had no mechanism in place for the acceptance or management of such donations. Building on a prior relationship with the Arrowhead United Way, the SB United Relief Fund was established using the United Way’s expertise and fundraising infrastructure. Early decisionmaking allowed the County to take advantage of the intense media spotlight to bring awareness to the relief fund. Ultimately, the fund raised and distributed more than $2.5 million to victims. In-kind donations and tribute events were more difficult to manage. Individuals and organizations offered to donate physical items for victims, survivors, and their families and a plethora of organizations wanted to honor the victims During the first five months after the incident, the Risk Management Department was able to approve nearly every claim without delay or question. This may have established expectations for employees that were not sustainable in the long-term. In order to maintain the integrity of the program, and to be responsible to its excess insurers and maintain eligibility for future coverage, RM ultimately had to employ a more structured and discerning process that involved the requirements for Utilization Review (UR), which added a third-party medical expert into the previously internal process for each claim. This added layer of review created frustration among many program recipients who wondered why processing was now taking longer and why previously approved treatments were now being questioned, and in some cases, denied. The confidential nature of many of the review decisions may have also led to misunderstandings and contributed to an environment of distrust. Faced with these challenges, the RM Employee Support: SBC Snapshot 29 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County and help heal the community with tribute events (e.g., at sporting events). Originally these requests were funneled to the EHS Division, which was already overwhelmed and dealing with its recovery. Eventually, the County designated a liaison to catalogue the in-kind donations and tribute events and Employee Support: SBC Snapshot communicate information to those affected, while not advising or recommending any particular action. This also added a layer of privacy protection for the victims and families who did not have to engage with the donors unless desired. 30 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Employee Support Considerations Topic/Keywords Preparedness Considerations Donations Role Depending on the nature of your incident there may be an overwhelming outpouring of donations. Donations, and questions about where or how to donate, will begin almost immediately. Determine your organization’s role in managing in-kind and monetary donations and tribute events in advance. Some of the difficult decisions may include whether you will receive donations or defer them to another entity, how you define eligibility (e.g., who qualifies as a “victim” of your incident and whether secondary/indirect victims and families of victims or perpetrators will be included), who will make allocation decisions, which items or tribute events are appropriate, the logistics needed to manage donations, etc. Regardless of what entity is responsible for donations, the most important aspect is ensuring that the funds are protected during collection and then are disseminated to the proper recipients. Donations Managing the inventory, distribution, and invitations associated with in-kind Management donations and tribute events may require one or more dedicated positions, at least in the initial aftermath of the incident. Identify a position/division/ Responsibility department to oversee donations management. Depending on the emergency, your organization may wish to redirect offers of volunteers, in-kind donations, or tribute events to a dedicated entity. That decision can either be written into emergency plans or left to the discretion of the entity chosen to manage donations. Consult the Federal Emergency Management Agency (FEMA) website for information and guidance on what may be involved with, and how to prepare for, donations management. Donations Identify community partners that may be qualified and willing to handle Management monetary or in-kind donations. A centralized “fund” or “donations center” managed by a third-party with strong oversight and a transparent approach Community Partners may ease coordination demands and concerns regarding conflicts of interest. Establishing a Memorandum of Agreement/Understanding (MOA/U) may help expedite the engagement immediately following an incident. Victims of Crime Be familiar with the services offered by your local, state, or federal Services governments, and the community to victims of crime. For example, in California, the California Victims Compensation Board (CalVCB) administers benefits through local District Attorney offices that include: crime-related crisis counseling; emergency services such as food, shelter, clothing, personal items, medical care; transportation; orientation to the criminal justice system; court support; special services to victims of sexual assault; and referrals to mental health services. San Bernardino County’s District Attorney also provides canines to comfort victims and sponsorships for children to attend local grief camps. If your incident is the result of criminal activity, be prepared to refer victims or those affected to available services or facilitate that connection. Workers’ If an incident occurs while personnel are performing a work-related function, Compensation the care for their associated injuries will likely be facilitated by your workers’ Expectations compensation program. The workers’ compensation program likely works differently and may be more rigid than your organization’s medical benefits program. Most employees likely have little to no familiarity with the organization’s workers’ compensation program unless they have past Employee Support: Considerations 31 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Preparedness Considerations experience. Consider providing employees with a summary or Frequently Asked Questions (FAQ) document that provides background on the program and what they may expect. Having an understanding of the program before they use it may save frustration later on. Once an incident occurs, immediately share that information with the potential victims again. Regularly setting expectations associated with the workers’ compensation program will be important. Topic/Keywords Communications Leadership Needs of the Affected Affected Individuals Engaged in Decisionmaking Services/Resources Packet Integration of Victims of Crime Services Intermediary with Non-Organization Benefits Programs Response Considerations Communication is essential to establishing expectations, building trust, avoiding misinformation/rumors, and the overall satisfaction of victims and affected personnel. After an emergency, your organization’s leadership should reach out immediately and directly to let victims and affected individuals know they are a top priority. Leadership should then continue to be involved in the messaging. Do not expect those affected by the incident to be able to articulate their needs. Simply asking “what do you need” typically results in minimal input and may cause frustration. Provide ideas/suggestions to those affected as a way to solicit their input/reactions to a potential course of action. Determine whether you want to allow affected individuals or their representatives to be involved in decision-making processes and the selection of courses of action. The courses of action selected will likely need to meet the needs of those affected for the organization to truly recover. Sometimes just having a voice may ameliorate any feelings of being left out, animosity, or minimize criticism. At the same time, families in the midst of grief may not be suited to group decision-making and collaboration. The organization must judge the advantages and disadvantages of both options and choose an approach that fits its unique situation. As soon as feasible, distribute information to victims, affected personnel, and the next-of-kin of the deceased associated with compensation, leave, and benefits (e.g., accrued leave, retirement credits, life insurance pay outs, continuation of health insurance benefits, deferred compensation, retirement medical trusts, cash out of leave balances, accidental death and dismemberment benefits). Consider personally meeting with victims and their families at their homes, hospitals, or other locations. If your local, state, or federal governments, or the community offer services to victims of crime, consider establishing a communication channel between your organization and those programs to improve the delivery of benefits to those affected. If permitted by the program recipient, your organization may be able to provide information to the service provider to expedite services and assist the service provider with the coordination or delivery of said services. Consider if your organization is able or willing to serve as an intermediary between victims/affected individuals and entities outside your organization that may also provide services or benefits (e.g., retirement programs may offer survivor or disability retirement benefits; or benefits from the Veterans’ Administration, Social Security Administration, labor unions, state or federal tax agencies, departments of motor vehicles). Employee Support: Considerations 32 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Response Considerations Family Assistance Center If the incident is large enough, consider establishing a Family Assistance Center (FAC) as a one-stop-shop for information on all benefits and services. The FAC may allow victims and loved ones to immediately register for and begin receiving services or at minimum get information on all available services. If feasible, it is ideal to include all non-organization service/benefit providers in the FAC. The FAC may need to be open for a number of days or weeks to accommodate the number of individuals requiring service or to address the complexity of the situation. Emotional Support Do not underestimate the breadth of the demand for emotional support services (e.g., counseling). An incident affecting only a small portion of your Demand/Duration organization may have organization-wide psychological impacts. In addition, emotional support may be necessary from the most junior staff to the most senior executives for years after the incident. For example, two and half years after the attack on San Bernardino County’s EHS Division, counselors were still on-site at EHS two days a week. Do not assume any group is more vulnerable to, or immune from, these effects. Consider providing some degree of services throughout your organization at all levels, not just to those directly affected. Encourage all personnel to take advantage of the services as needed and genuinely create an environment of understanding and flexibility. Emotional Personnel, including you, will handle stress in many different ways. Recognize Responses this is normal. Do not take interactions personally or punish yourself for how you react. Trauma will also change the dynamics of personal relationships within your organization. Affected personnel may gravitate to those who had similar experiences which may create tension in the workplace (e.g., present for the incident vs. not present, injured vs. not injured, lost a friend/loved one vs. not, returned to work vs. did not). The victims or those directly affected may need or want time together to discuss work related situations without your organization being formally present. Be comfortable with this and recognize they will communicate with you when ready. Secondary/Vicarious Recognize staff assisting victims may experience secondary trauma or increased Trauma stress that may be equally concerning. Personnel working long hours under incredible stress and potentially under media/public scrutiny, may experience trauma even if they were not directly involved in the incident. Emotional Support Third party counselors are a tremendous resource to have available for victims and affected personnel. Look within your organization to those divisions/ Third Party departments that may already provide such services or have trusted positive Counselors relationships with outside counseling services. You may consider having counselors available to affected groups/individuals in-person during business hours and telephonically after hours. Mental Health Involve counselors or mental health professionals in your decision-making Professionals associated with employee services and recovery efforts. They may provide Decision-Making unique insights into how programs or actions may be received by victims and Support anticipate the potential needs of victims. Workers’ As soon as possible, open workers’ compensation cases for all victims and all Compensation Cases those potentially affected. For example, in California there is a one year window to do so, and opening cases will ensure employees have a file even if something related to the incident does not become an issue until after the window closes. Employee Support: Considerations 33 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Termination of Benefits to Dependents of the Deceased Death Benefits Potential Deficits in Compensation, Benefits, and Leave Time Coding Leverage Media Coverage to Solicit Donations Donation Caution Response Considerations The death of an employee may legally be considered a termination of their employment, which may lead to the termination of the employee’s benefits, including those for their dependents, at the end of the next month, pay cycle, or other pending milestone. Your organization may want to consider the implications this may have on the loved ones of those who just lost a family member and determine what, if anything, the organization is able or willing to do to ease the burden. In the case of San Bernardino County, the health and medical benefits for the dependents of those killed during the attack would have expired on December 24, 2015. The County chose to continue their health and medical benefits by paying Consolidated Omnibus Budget Reconciliation Act (COBRA) premiums for two and in some cases three years after the attack. If there is widespread publication of the deceased victims’ names, your organization’s life insurance carrier may agree to waive the investigation process and the requirement that victim families' produce death certificates to qualify for death benefits. If applicable, consider requesting this waiver to expedite the distribution of death benefits to next-of-kin. The incident may have long-term effects on the compensation and benefits of victims and affected personnel. For example, victims and affected personnel may need extended medical leave beyond their accrual, they may stop receiving retirement credits/benefits if they have not been able to return to work, your organization’s or state’s disability benefits may only cover a portion of the employee’s previous salary, etc. Your organization may want to consider what it is able or willing to do to address these situations. San Bernardino County, for example, worked to make affected personnel “whole” by finding other funding sources to compensate for salary deficits not covered by disability programs, coding leave in such a way that retirement credits continued to accrue, etc. Determine a strategy for how victims, other affected employees, and employees as a whole will account for, document, or code their time if they are out due to injury, the temporary closure of offices/functions, were instructed to take leave, or other situations. Consider having someone within the organization enter the time for victims and affected personnel, at least initially, to alleviate some of their burden. Fundraising may be most effective when media attention is most intense and that window can be brief. When contemplating the solicitation of monetary donations, coordinate with PIOs as soon as possible to utilize the media attention to spread the donation message. With the prevalence of online crowdsourcing, be cognizant of potential scams or misrepresentations of organizations or individuals. Immediately report concerns of fraud to the crowdsourcing entity and law enforcement. Employee Support: Considerations 34 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Emotional Support Management Challenges Workers’ Compensation Nurse Case Managers Administrative Processes Communications Communications Interdepartmental Coordination Employee Benefits and Leave Frequently Asked Questions Ease Administrative Processes Interagency/ Interdepartmental Coordination Recovery Considerations Seek additional guidance, support, or counseling resources for supervisory and leadership personnel responsible for managing staff that have experienced trauma. This is a unique type of support that will help management understand how and why personnel are acting/reacting as they are, accommodate unique needs as appropriate, and balance and set expectations associated with work performance that are fair and reasonable. Consider a model utilizing nurse case managers to help manage workers’ compensation claims in your organization. Nurse case managers assist injured workers by interacting with physicians, pharmacies and other service providers to prevent interruptions in care. They inform recovering injured workers of what is occurring in their respective cases, explain why actions are occurring, and talk through available options. Additionally, nurse case managers provide injured workers with individualized services to ensure any necessary paperwork for the workers’ compensation system is processed in a timely manner to minimize delays in receiving care. Anticipate victims and others affected may be overwhelmed by the administrative processes surrounding compensation, leave, and benefits. You will need to repeatedly explain these processes. Some resources for meeting information needs may include:  An online password protected website  Private, invitation-only social media page  Formal information sessions with regular occurrences  Mailings or in-person deliveries of information When delivering information regarding benefits or administrative processes to a large number of affected individuals, consider hosting multiple formal information sessions with subject matter experts or representatives from responsible departments/business units. This will allow responsible departments to better coordinate with victims, know what their partners are doing, and develop a shared understanding of the concerns of those affected. Develop a Frequently Asked Questions (FAQ) document that captures the questions victims and affected individuals most frequently ask regarding benefits, leave, compensation, etc. This document should be frequently updated and maintained for the long-term as new or alternate questions will arise as conditions evolve. Questions and answers should at least be related to services your organization provides, but you may also want to provide contact information for other relevant external services or even answers to questions regarding external services if known. The FAQ document should be widely distributed and made available through multiple mediums. Consider what, if anything, your organization is able or willing to do to ease the administrative burdens on victims and affected personnel. For example, victims may receive compensation/benefits from many different sources. This may mean receiving separate payments, each on a different payment schedule, covering different payment periods, leaving the victim to ensure they equate to the full or negotiated compensation. San Bernardino County, for example, worked to issue a single “whole” paycheck for as long as victims were eligible for workers’ compensation or short-term disability, but doing so did require an unprecedented level of interdepartmental coordination, time, and resources. Employee Support: Considerations 35 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Administrative Processes Surge Capacity Single Points of Contact for Victims/Affected Personnel Employee Support Program Development Recovery Considerations Anticipate a tremendous amount of additional administrative and managerial needs as a result of the services your organization is providing to victims and affected personnel. Multiple programs may need to surge their capacity for long durations of time. Early in the process, consider contracting for additional support, hiring additional staff, and/or reassigning current staff to be dedicated to victim programs/services (e.g., benefits administration, modified work schedules, donations, victim communications). Do not allow programs or great ideas intended for the victims to become a burden for the victims or the affected organizational element(s). For example, if your organization intends to pursue a grant do not assign responsibility for pursuing the grant to the affected organizational element. Have mechanisms in place in unaffected parts of the organization to manage all victim programs. Consider developing a single point of contact between your organization and the victims or affected personnel to avoid the frustration of the victim having to coordinate with many different positions/divisions of your organization. The point of contact can provide information to the victim, relay messages back to the organization, and connect the victim with other appropriate services/divisions. San Bernardino County, for example, established a program of “Victim Liaisons” loosely based on models used by public safety agencies. If this model is selected: 1) consider selecting points of contact that may be familiar with the victims or families of the deceased and/or those with backgrounds in dealing with individuals that have experienced trauma (e.g., counseling backgrounds, social workers); 2) determine the level of support/ services to be provided (i.e., in addition to facilitating communications, does your organization also want them to assist with funeral arrangements, provide transportation assistance, deliver well wishes, supplies, or other resources, or support other potential personal needs); 3) determine if the points of contact will be dedicated to this responsibility and if so, how their primary functions will be covered in their absence; 4) whether the services will be available afterhours or beyond normal work hours and how the point of contact will be compensated; 5) if the points of contact require organization-provided resources (e.g., vehicles, phones, purchase cards); and 6) how the organization may address performance, personality, conflict of interest, or other matters between the point of contact and program recipient if they arise. However, be mindful that creating a liaison program may create an accidental barrier to direct communication with benefits and service providers. The points of contact may become the trusted source for information for victims rather than the actual service provider, but the liaison may have limited expertise. Likewise, the liaison may develop such a relationship with the victim that they begin representing or speaking for the victim. Ensure liaisons are mindful of their limitations and procedures exist to connect victims with those directly responsible for benefits and services. Any new program developed to meet the needs of victims, survivors, or personnel should:  Have clearly defined program goals, parameters, and procedures.  Staff supporting the program should have clearly defined responsibilities.  Balance rigid procedures with the need to remain flexible and adapt to Employee Support: Considerations 36 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Recovery Considerations     unforeseen needs that may arise. Determine if a training curriculum should be developed. Create a summary reference document that captures program goals, available services, staff responsibilities, and program limitations for program recipients. Create a feedback mechanism by which program recipients may offer feedback, both positive and negative, to ensure the programs are meeting their intended purposes. Identify an exit or demobilization plan and anticipated end date for the program to set expectations, but leave flexibility for extensions as needed. Employee Support: Considerations 37 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. 38 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Category 5: Continuity of Operations San Bernardino County Snapshot Evolution of Leadership/Delegations of Authority: On December 2, 2015 the County CEO was in route to Washington, DC, and the Chief Operating Officer (COO), three County Supervisors, the CAO PIO and others were at a conference in Monterey, CA. Leadership of the County had been temporarily passed to the Assistant Executive Officer (AEO) for Finance and Administration. The attack would later affect the continuity of leadership for the Department of Public Health and its EHS Division for nearly a month. The County had to navigate succession planning and delegations of authority for key leadership positions to facilitate emergency policy-making, the continued functioning of government, and the ultimate recovery of critical government functions; namely environmental health services. In some cases the County used pre-defined authorities and in others an ad-hoc approach. Although relatively well managed, in both cases, opportunities to better define and delineate authorities and improve transitions among leaders existed. phone number and online complaint/inquiry system and the non-traditional function of replacing restaurant grade cards bearing the perpetrator’s name. As functions resumed, priority was given to complaints and reported problems, then to contractual requirements, and lastly to routine inspections. Although understaffed and with staff continuously transitioning, the EHS Division was able to achieve nearly full capability levels for complaint investigations and/or service requests even as the number of complaint inquiries remained comparable to the previous year. Most notably during the first six months after the attack, all EHS inspections were reduced significantly. For example, from January 2016 to June 2016 as compared to the same period the previous year, the EHS Division conducted 44% fewer plan checks and construction inspections, 41% fewer pool inspections, 69% fewer vector control and mosquito inspections, and 24% fewer food facility inspections. Two years after the attack, as a result of returning Credit: SB Sun staff, new hires, and continued contractor support, the performance levels for this sampling of essential functions had continued to improve, but the EHS Division was still running a deficit of 12% fewer plan checks and construction inspections, 34% fewer pool inspections, 20% fewer vector control and mosquito inspections, and 24% fewer food facility inspections for calendar year 2017 versus 2015 (the year prior to the attack). As of this report, deficits remained and functional prioritization decisions were still Continuity of Essential Functions: The essential functions of the EHS Division protect public health and maintain regulatory compliance within San Bernardino County. As a result of the terrorist attack, the EHS workforce was seriously impacted; however, the demand for service from the public, business, and industry remained high and unchanged. From December 2 to 13, 2015 all EHS functions were shuttered except the logging of calls to the EHS Division’s “800” Continuity of Operations: SBC Snapshot 39 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County being made on a daily basis. Regardless of the objective assessment of continuity efforts, compliments were owed to all those involved in the EHS Division’s continuity and resumption because the Division took on many more responsibilities than it previously had, well beyond resuming and sustaining essential functions. preference and decided to ultimately return to renovated facilities, which all parties agreed had to “look, feel, and smell” completely different. The majority of EHS personnel present for the terrorist attack, all the deceased and injured victims, and the male perpetrator, worked at two EHS office locations that would be remodeled. Also affected was staff from the Land Use Services Department/Code Enforcement Division and Information Services Department/Multimedia Services Division that would also need to relocate during construction. The County’s pre-existing DEOPs did not include continuity strategies associated with alternate facilities or the relocation of functions. As such, a “Project Team” was established with multidepartment representation tasked with opening alternate facilities by December 14, 2015. By th December 6 the team had identified two alternate sites. By the next day emergency procurement authorities had been granted. Between December 8th and 10th, the Project Team developed floor plans and logistical strategies to support relocation needs and alternate operations. From Friday, December 11th to Sunday December 13th, the Project Team and contractors worked tirelessly to prepare both alternate facilities for operations; including painting, carpeting, lighting, equipment, telephones, furniture, information technology systems and access controls, moving files, documentation, and resources. Of particular note, a small team of DPH, Real Estate, and Human Resources staff personally boxed, labeled, transported, and set out the personal effects of each survivor at the associated workstation at the alternate Alternate Facilities: San Bernardino County’s reasons for temporarily relocating personnel to alternate facilities included: 1) since the male perpetrator was a County employee, his office area became a crime scene being investigated by local and federal law enforcement agencies; 2) the office areas of the deceased and injured victims appeared “frozen in time” and, along with the perpetrator’s office area in the same vicinity, presented psychological barriers to healing and recovery; and 3) security concerns voiced by survivors would lead the County to make security alterations to make personnel comfortable returning to work. By December 4, 2015, the County had determined either a permanent relocation or complete renovation of existing EHS workspace was necessary. The EHS Division staff was consulted for their Continuity of Operations: SBC Snapshot 40 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County facility. Generally, all relocated personnel were satisfied with the alternate facilities and felt they sufficiently supported functions to the degree they were being performed. The two sites were used until October and November 2016, respectively, until renovations of permanent facilities were nearly complete. The cost of renovating and equipping the two temporary spaces totaled approximately $200,000. began, and contractors were brought on board. REHS-qualified personnel from other San Bernardino County departments or close partners (e.g., San Bernardino County Fire Protection District’s Hazardous Materials Teams) provided assistance to EHS on weekends and on their days off; and where non-technical staff was needed (e.g., administrative, clerical), the County reassigned personnel from other departments. Recognizing the EHS Division would not reach optimal staffing levels anytime soon, the County hired the California Association of Environmental Health Administrators (CAEHA) to provide contract staffing. By the time of this report, the contract with CAEHA had been extended and increased in value twice to a total of $3,500,000 and a term through December 31, 2018. As of March 2018, more than two years after the attack, the EHS Division was still short staffed a total of 9.5 equivalent fulltime positions from its pre-incident levels5 CAEHA contractors were still working fulltimeand was dealing with the long-term effects of diminished institutional knowledge and leadership. Alternate Personnel: Seventy-two (72) of the EHS Division’s 92 staff members were present for the terrorist attack. By that afternoon, 39% had been killed or injured. The remaining 56 staff, whether present for the attack or not, experienced varying degrees of psychological trauma. The staff available and capable of supporting the EHS Division’s essential functions fundamentally went from 92 to a handful in a matter of minutes. The training and certification requirements for Registered Environmental Health Specialists (REHS) are set by California regulation and alternate personnel needed to be fully qualified to complete the work. Nearly immediately, DPH activated California’s Medical and Health Mutual Aid System. Between December 10 and 24, 2015, sixtythree (63) mutual aid personnel were provided to San Bernardino by Riverside and Los Angeles Counties. Between January and June 2016, the EHS Division would continue to receive mutual aid support, which would grow to include Orange, Ventura, San Luis Obispo, Contra Costa, and Marin Counties, the California Department of Public Health (CDPH), California Department of Resources Recycling and Recovery (CalRecycle), and the California Department of Water Resources (DWR) Drinking Water Division. Mutual aid support would remain consistent at 44 staff in January and February 2016 (equating to nearly 1,600 labor hours each month), but declined each month until June 2016 as permanent EHS staff returned, new hires Continuity of Operations: SBC Snapshot 41 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. 42 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Continuity of Operations Considerations Topic/Keywords Preparedness Considerations Continuity Plans Develop comprehensive continuity plans compliant with one or more continuity standards, such as those listed below, and take actions in advance to ensure the Ability to Implement plans can be implemented. Continuity Plans  Federal Emergency Management Agency (FEMA) Continuity Guidance Circular (CGC)  Disaster Recovery Institute International (DRII) 10 Professional Practices (also referenced in National Fire Protection Association [NFPA] 1600).  International Standards Organization (ISO) 22301 “Societal Security Business Continuity Management Systems - Requirements” Worst Case Scenario Continuity planning typically addresses a degree of degradation of an Planning organization’s capabilities or resources, but rarely addresses a complete eradication of those capabilities or resources. For example, pandemic planning may have led an organization to plan for absenteeism rates of 30% to 40%, but few plans address an immediate loss of 100% of a workforce as was essentially the case with San Bernardino County’s EHS Division. In addition, continuity plans often assume full recovery is possible within a short timeframe (e.g., one to a few months). San Bernardino County’s EHS Division was operating from alternate facilities for nearly a year after the attack and with alternate personnel at diminished capacity more than 2½ years later. Although a similar occurrence is unlikely to affect most organizations, some degree of planning and consideration of worst-case scenarios (e.g., complete loss of personnel, facilities, information technology, communications) for an extended period of time (years) may assist an organization during any future continuity event no matter the magnitude. Anticipate NonIn addition to the traditional essential functions of the organization, plan to Traditional assume more responsibilities following a crisis than the organization had Functions before. Below is a list of examples from San Bernardino County’s experience. In some cases, the below responsibilities required full-time commitments of Surge Capacity individuals and/or whole teams. An organization should plan to staff itself accordingly to address similar responsibilities in addition to its typical essential functions.  Managing the acquisition and scheduling of continuously changing personnel (e.g., volunteers, inter-departmental loans, mutual aid, contractors).  Managing the leave, evolving schedules, and paperwork of returning staff.  Coordinating counselors for staff, addressing psychological needs, and changing group dynamics.  Hiring, onboarding, and training new staff, along with processing all necessary documents.  Handling communication with returning employees and those on leave via mailers, email, and website posts.  Regularly reviewing workload, demand for service, and staffing to provide ongoing reports to executives and the media/public.  Managing relocations, alternate facilities, and facility renovations.  Handling donations, tribute events, and special occasions. Continuity of Operations: Considerations 43 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Preparedness Considerations  Delegations of Authority Succession/ Delegations Familiarity Identification of Alternate Personnel Sources Facility Information Redundant Communications Systems Systems Accessibility Managing large quantities of incoming mail of support and condolences (e.g., banners, gifts, cards). Formal delegation of authority letters/protocols should identify what authorities (e.g., administrative, fiscal/budgetary, policy, legal) may be delegated from a principal to a designee/successor, to what degree, and for how long, and which authorities are not. Use everyday occurrences such as principals being on travel, sick leave, or vacation as opportunities to formally implement, evaluate, and become familiar with orders of succession and delegations of authority (including delegation procedures). Identify all the sources of appropriately qualified alternate personnel to potentially achieve your recovery point objectives, including personnel from other departments/divisions within the organization, partner organizations that may loan personnel, mutual aid/assistance systems, associations, volunteers/ retirees, and contractors. This is particularly important for positions that are highly technical or where there is short supply. If you operate multiple facilities (e.g., San Bernardino County government had presence in nearly 500 buildings), ensure information on your facilities (e.g., floor plans, contracts, points of contact) is readily available, up-to-date, and backed-up. Identify those individuals the organization may need to be in communication with during an emergency/crisis situation. Determine whether standard communications systems (e.g., cellular telephone, tablet, laptop) provide sufficient capability to facilitate those communications in a crisis/emergency. If not, consider providing redundant communications systems (e.g., satellite telephone, radio). Then ensure users are trained on the systems, the systems are tested regularly, and the user keeps the systems with them at all or appropriate times. Ensure information on how to access systems (e.g., facilities, websites, telephone systems, electronic records/databases) is either documented or shared with others outside your division/department/organization so others may act on your behalf or that of those affected. Topic/Keywords Public/Customer Expectations Logging Public/ Customer Inquiries/ Requests Ongoing Prioritization of Functions Response Considerations Do not expect the public or your customers to be sympathetic to, or cognizant of, your situation. In some cases the public/customers may be sympathetic, but may not be able to alter their requirements for legal, regulatory, or contractual reasons. The demand for service, quality, and responsiveness will likely remain unchanged. If essential functions must be stopped or recovery time and point objectives cannot be met, assign some part of the organization or partner entity responsibility for logging/tracking public/customer inquiries, requests, etc. to later be followed up on once functions are resumed. Regardless of the quality of continuity plans; prioritization decisions related to workload, functions, and assignments will likely need to be made on a regular basis (e.g., daily) to balance constantly changing demand for service and mandated requirements with limited staffing. Continuity of Operations: Considerations 44 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Indirect Effects on Tangential Personnel or Operations Devolution of Functions Waivers/Extensions Definitive Delegation of Authority Awareness of Delegated Authorities Incident Effects on Principals Role of Remote or Returning Principals Recalling Principals Response Considerations An incident may directly affect certain personnel or operations and thereby mistakenly leave tangential personnel or operations seeming unaffected. Any number of factors may seriously affect tangential personnel or operations to the point continuity plans may need to be implemented for seemingly unaffected elements of the organization. For example, functional interdependencies, shared workspace, personal or professional relationships with victims, and other factors could have continuity implications. Be mindful of the interconnectedness of your organizational elements or personnel and be prepared to activate continuity plans for tangential functions if necessary. Initially devolve as many functions as possible to partner entities. Although devolution is often considered a last resort, it may in fact be the best first option. Following a crisis situation, the fewer functions an organization is immediately responsible for maintaining/resuming may be for the better. Functions can quickly be reabsorbed by the organization if capacity and capabilities exist, but the initial burden of keeping functions in-house when devolution was an option could have serious and long-term implications on continuity and recovery. Immediately seek waivers or extensions for pending legal, contractual, or regulatory requirements. The waiver/extension may not be granted, but entities may surprise you with their level of flexibility or compassion. You will not know unless you ask. The fewer functions an organization is immediately responsible for maintaining/resuming the better. As appropriate, ensure a definitive decision is made within the organization as to who has been delegated authority (i.e., who is in charge) when principals are unavailable or preoccupied with other obligations, what authority they have been given, and for how long. Ensure all appropriate stakeholders are made aware of those that have been delegated authority and the current chain of command. Broader distribution is preferable to limited awareness. For example, following the attack in San Bernardino County, two County Supervisors were just down the hall from the Acting CEO, but the Acting CEO was unaware of their presence and no consultation with them occurred. Likewise, the two Supervisors were unaware of the delegation of authority to the Acting CEO. Principals may return to work, but their time and attention may be occupied with non-traditional roles (e.g., visiting the injured, attending funerals, liaising with affected personnel, engaging with the media, self-care) or they may not be in the state of mind to handle their leadership responsibilities. For all intents and purposes, they may be available, but absent from their normal administrative and operational responsibilities. The organization must balance its operational needs with the intentions of the affected leader, and then select an appropriate course of action (e.g., delegation/succession). If authority has been delegated, determine how or if the principal will be integrated into operations if they are in communication with the organization, if they are present, or if they are returning to duty. If principals are being recalled, be prepared to immediately coordinate the logistics and finances associated with their emergency travel. Continuity of Operations: Considerations 45 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Response Considerations Appropriateness of Determine if the order of succession is appropriate for the situation. For Orders of Succession example, a tertiary successor may be appropriate to lead the organization to the Situation through a typical day, but may not possess the appropriate expertise, experience, or skill to lead the organization through alternate operations or rebuilding of the organization. Temporary ThirdIf your leadership is impacted by the incident, consider acquiring an Party Leadership independent and objective third-party with particular experience in the subjectmatter and organizational leadership to help lead the organization’s continuity and recovery until primary staff return or new permanent leadership is selected. Assure returning staff this temporary leadership is not intended to replace them, but rather temporarily relieve their burden. Executive Support Regardless of whether principals, successors, or third parties have been given Team authority, they will likely need more personal and professional support than normal during or following a major crisis. Consider establishing an executive support team of peers or deputies to provide advice and share in the burden of tasks and decisions. Be sure, however, to define each person’s role and ensure each person’s involvement is directly relevant and appropriate as it is possible to create an unintended perception of “lack of confidence.” Requests for When requesting personnel (from any source) include the job description for Personnel the position looking to be filled. The job description should include the responsibilities of the position as well as the qualifications and experience required. This may save time for the resource provider or entity facilitating the request and will help ensure your organization receives personnel that meet its needs. Certifications or Immediately seek approvals to reinstate lapsed or retired certifications or Credentials credentials or waive certification/credential requirements for alternate personnel from regulators, associations, collective bargaining units, etc. The reinstatement/waiver may not be granted, but entities may surprise you with their flexibility. You will not know unless you ask. Alternate Personnel Quickly determine how providers of alternate personnel will be reimbursed, if Costs at all, and whose responsibility it is to provide and pay for the ancillary needs of personnel, such as lodging, meals, and travel. Ancillary Requirements Duration and Attempt to negotiate with personnel providers to make their personnel Consistency of available for multi-week assignments/deployments and to provide the same Alternate Personnel personnel on a recurring basis. The costs and time associated with onboarding Deployments alternate personnel climb quickly. The longer the assignment and the more consistent the staffing the lower the costs and time required. At the same time, a deployment that is too long may become a challenge if permanent staff begins to return. For example, San Bernardino County found 90 day assignments, with the option to renew at the end of each cycle, worked well with its contractor. The approach allowed the contracted staff to develop institutional knowledge of programs and processes and build relationships with staff and customers, but the tenure was short enough to allow the contracted position to be retired upon the full-time return of staff or onboarding of new hires. Continuity of Operations: Considerations 46 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Response Considerations Administrative Standard Operating Procedures Either in advance of the emergency situation or soon into one requiring alternate personnel, consider developing short written guides or “cheat sheets” for basic administrative matters (e.g., getting assigned a vehicle; how to find/order supplies; locations of restrooms, break areas, etc.; directions to common business destinations). Familiarizing alternate personnel with these administrative matters may become an exceptionally time-intensive part of the onboarding process without an equivalent quick reference tool. Situational limitations may prevent alternate personnel from becoming completely familiar with your organization’s processes and systems. Be flexible and be prepared to implement manual or alternate processes to accommodate the capability levels of alternate personnel. For example, in San Bernardino County, returning EHS retirees were not familiar with the Division’s new computer system so they were allowed to use hard copy alternatives and administrative staff later uploaded the necessary data to EHS’ computer system on their behalf. Anticipate unsolicited and/or non-essential personnel (e.g., current employees, retirees, mutual aid, vendors/contractors) showing up to provide assistance after a crisis even if they have been instructed not to. Determine early on how you might utilize these individuals even if for minor tasks that may traditionally seem below their qualifications (e.g., answering calls, scribing notes, making photocopies). They may find satisfaction in contributing in any way. If they cannot be of assistance, be cognizant of their desire to help and try not to be dismissive. Personnel and performance issues will likely increase when using alternate personnel because of the revolving nature of their assignments. Managers should be prepared to handle this additional demand on their time. An incident may not directly or obviously affect facilities. The terrorist attack in San Bernardino County occurred at a non-County facility; technically leaving the County’s physical office spaces unscathed and fully operational. However, multiple factors may influence your decisions to relocate, renovate, or demolish facilities even if they appear unaffected. For example, areas associated with someone who committed a crime could become a crime scene or may now have an associated stigma; office areas of deceased or injured victims could present psychologic barriers to healing and recovery; personnel or customers may have new facility expectations as a result of the incident (e.g., safety, security measures); among others. Assess the ramifications of the incident on your facilities soon after the incident and plan to take actions in accordance. If your organization does not have pre-identified or prepared alternate facilities, consider immediately creating a team consisting of personnel representing real estate/facilities, information technology, and security interests, construction and supply vendors, and the affected divisions/departments/organizations to identify, plan, and prepare alternate facilities. To ease the transition and provide a degree of comfort and familiarity to relocating personnel, San Bernardino County’s planning team tried to mirror the layout of primary facilities at alternate facilities (e.g., where individuals sat with respect to each other, locations of supplies and equipment relative to each workstation, number, type, and size of meeting/conference spaces, break Manual or Alternate Processes Unsolicited Personnel Accountability and Discipline Indirect Incident Effects on Primary Facilities Alternate Facility Planning Team Alternate Facility Layout Continuity of Operations: Considerations 47 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Movement of Personal Effects Hospitable Gestures at Alternate Facilities Alternate Facilities Surge Capacity Notify/Advertise Relocation Responsiveness to Facility Needs Response Considerations rooms, reception areas, and public counters). Depending on the situation, consider whether your organization wants the alternate facility to be similar to, or different than, the primary facility. Handle the movement of personal items from primary sites to alternate facilities with great care and respect. Document how each workstation was laid out and organized and try to reconstruct it at the alternate facility. Vendors may do this or individuals from within your organization may wish to assist as they did in San Bernardino County. Relocating personnel that have been through a crisis may also be appreciative of the smallest hospitable gestures at alternate facilities (e.g., name placards/ signage on each workstation identifying the staff member, care given to the movement of personal effects, availability of refreshments, respectful music selection, special/convenient parking). If you anticipate permanent staff returning while you are using other sources of labor/alternate personnel (e.g., mutual aid, contractors, volunteers), then select and plan your alternate facilities to include more workstations than the preincident operation to accommodate both types of workers simultaneously (i.e., surge capacity of the alternate facility). Having alternate personnel using the workstations of permanent staff may create a perception of job insecurity or insensitivity in the minds of returning staff. In addition, returning staff may have unpredictable schedules, which may make it difficult for permanent staff and alternate personnel to share a workstation. The permanent staff may also return only briefly or may have reduced workloads, thereby maintaining your dependence on alternate personnel even when the permanent staff has returned and is on-site. Having additional workstations will show sensitivity for returning staff and allow flexibility around unpredictable schedules. Signage associated with relocated functions at primary facilities should be obvious (e.g., large, attention grabbing, duplicated in many locations). Signage should identify what functions have moved, to where and associated directions (if it should be publicly known), and provide contact information for relocated functions. Likewise, websites and other public facing resources should advertise the relocation and have similar attributes. In addition, neighboring divisions/ departments or entities that remain near the primary site should be notified of the relocation and provided associated information in the event they are visited by someone seeking the relocated function. Also notify neighboring divisions/ departments or entities that have operations near or within the alternate facility so they are aware of the new activity. Personnel that have been through trauma may be particularly sensitive to the type and quality of service they are afforded. Delays or inaccuracies in addressing facility needs may be one of those service areas. Anticipate facility challenges will occur following relocation (e.g., glitches, access issues, supply shortages). Consider having dedicated personnel and expedited processes to quickly address these issues. Continuity of Operations: Considerations 48 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Staff Transition Facility Transition Recovery Considerations Plan for sufficient transition time between returning principal leadership/staff and in-house successors or potentially physically departing alternate staff (third parties). Speak with returning principals/staff about their comfort level with successors/alternate personnel remaining side-by-side with them in a full-time role for some period of time to ensure a proper and phased transitionparticularly if there are concerns returning principals/staff may perceive such a move as a threat to their position or lack of confidence in their abilities. Returning principals/staff will likely find value in an extended transition time following an absence or major change in operations. Plan for sufficient transition time between alternate facilities to primary facilities. Follow a phased approach that allows the timely and comprehensive movement of equipment, resources, and personnel. Do not rush the transition to primary facilities if the facilities are not fully prepared. Continuity of Operations: Considerations 49 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County This page is intentionally blank. 50 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Category 6: Organizational & Financial Recovery San Bernardino County Snapshot Memorials and Remembrances: Since the December 2, 2015 terrorist attack, the County has hosted several memorial events. County leadership had consistently sought to remember and honor the victims in a manner that was compassionate, respectful, and inclusive of the entire “County Family.” The first memorial was a closed event held on January 4, 2016 for all County employees and the families of victims known as the “County Family Gathering” intended to "Remember, Honor and Support." County officials waited a month to avoid conflicts with the many funerals that were being held in the weeks following the attack as well as the holidays. The goal for the gathering was to foster a family atmosphere. There have since been anniversary events sponsored by the County and there are plans for a permanent memorial on the grounds of the County Government Center, which were in progress at the time of the writing of this report. Credit: R. Lindsay protected positions with temporary hires promising to find them a new home should EHS staff return. Hundreds of interviews were conducted, which included the help of mutual aid supervisors from neighboring counties. Trainees were initially sent to Riverside County when San Bernardino understandably did not have the capacity to onboard personnel. More than two years after the attack, 41% of EHS staff had either never returned to work or were no longer employed with the Division, 10% were still on modified schedules, 13 positions remained vacant, and there was a serious deficit of supervisors to subordinates. While the attack forever changed the EHS Division, attempting to create a new “normal” work environment remained an ongoing effort. Team building had become a primary focus. DPH and EHS leadership, with the support and recommendations of psychologists, felt a time was approaching to balance the longterm needs of the organization with those of affected individuals. Credit: R. Lindsay Reconstituting Employment Levels and Practices: Within a month of the attack, the County embarked on an effort to hire permanent staff to fill vacant and essential EHS positions. Tactics for filling hard-torecruit EHS positions included offering hiring and referral bonuses, targeting entry-level trainees with opportunities for training, certification support, and chances for later advancement, and “dual filling” vacant yet Org & Financial Recovery: SBC Snapshot Facility Renovations: As early as December 4, 2015 there was a consensus among County leadership that a permanent change would be needed to the two existing EHS Division office locations where victims and the male perpetrator had worked. A project team was 51 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County formed and included representation from EHS and other affected departments. Using traditional procurement vehicles, renovation costs would total $2,025,000 for the County Government Center and $975,000 for a location in the City of Rancho Cucamonga. The EHS Division and other affected departments returned to the County Government Center on October 3, 2016 and the Rancho Cucamonga site on November 17, 2016. As can be expected with any new space, Credit: SB County office needs and areas for improvement continued to be identified in both spaces for months after the return of staff (e.g., additional furniture, storage requirements, office supplies, security enhancements). At the time of this report, representatives of affected departments generally commented that most issues associated with the renovated facilities had been addressed or the issue had been retired, and most importantly, the new spaces were beautiful, functional, secure, and had significantly contributed to the EHS Division’s returning sense Credit: SB County of normalcy. (e.g., bag checks, identification requirements, screening procedures). To bring some initial order and efficiency to the independent efforts, in January 2016 the CEO instructed all departments to first send security-related requests and recommendations associated with County-owned facilities to the Real Estate and Information Services Departments for consideration. To formalize the process, the County then reconstituted its Security Task Force first established following a shooting at Riverside City Hall in 1998 and last used during a security review following the September 11, 2001 terrorist attacks. The Task Force consisted of representatives from Real Estate, Information Services, the Sheriff’s Department, the Office of Emergency Services, and Risk Management. In May 2016, the Task Force/County hired two consulting companies with contract ceilings of $500,000 each to conduct security assessments of County facilities. County facilities were categorized and prioritized and the first eight sites were assessed in 2017. As of this report, the County and security consultants were moving on to the second group of assessments while the first set of proposed improvements were being funded. All selected security enhancements would be pursued under normal capital improvement processes and procurement authorities. Since visible facility-specific or county-wide security modifications had not been implemented as of this report, many County employees engaged as part of this review had voiced frustration with the perceived lack of progress. Long-Term Security: One of the greatest concerns voiced by employees across County departments after the attack was the need to improve permanent security measures at County government facilities (physical resources and processes). At the time, the County owned or leased space in more than 500 buildings. Many departments immediately took independent steps to enhance their security, and where security was present, multiple departments worked with those services to enhance procedures Org & Financial Recovery: SBC Snapshot Total Cost Accounting: The costs incurred by San Bernardino County associated with the attack reached approximately $22.6 million as of January 12, 2017 when the County stopped attributing costs to the incident. This amount includes costs tracked and categorized at a County-level, but not countless ancillary costs incurred by individual departments. The 52 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County largest costs incurred were related to the closing of County offices between December 2 and 6, 2015 ($5 million), mutual aid and contract staffing for the EHS Division ($4.2 million), and real estate costs related to the temporary relocation and ultimate permanent renovation of facilities for affected departments. This total does not include legal fees, nor costs associated with the physical memorial planned to commemorate the victims. including the EHS Division, through the CDAA program. Litigation: In California, an injured party has six months to file a claim against any public entity related to Credit: SB Sun wrongful death, personal injury, or damage to property, with the exception of minor children who may file claims for up to two years after they reach 18 years old. In these claims, the County of San Bernardino (the public entity), must respond to the claim within 45 days. If the public entity denies the claim, the claimant has six months to file suit. A total of 29 claims were initially filed against the County associated with the December 2, 2015 terrorist attack; many related to wrongful death, negligence, and claims the County fostered a hostile work environment. All 29 claims were denied by the County. After the 29 claims were rejected, four lawsuits were ultimately filed. Of the four: two cases were dismissed in State Court; another involving a car accident between a Sheriff’s vehicle during the tactical response was being negotiated; and as of May 2018, a joint wrongful death suit against the County filed by the families of three of the deceased employees for damages exceeding $200 million was still pending. Cost Recovery/Reimbursement: From the onset, County leadership was aware many of the expenditures related to the terrorist attack and their ‘do whatever it takes’ mentality would likely not be reimbursed. However, they would still responsibly seek to identify and pursue all available avenues for reimbursement. The process was laborious, but ultimately, three viable funding sources were identified and leveraged: the California Disaster Assistance Act (CDAA); the U.S. Department of Justice’s (DOJ’s) Antiterrorism and Emergency Assistance Program (AEAP), and the U.S. DOJ’s Bureau of Justice Assistance Grants. Only a small portion ($2.41 million) of the County’s $22.6 million in costs was deemed eligible and reimbursed (CDAA = $310,215; AEAP = $1.5 million; BJA = $600,000). At the time of this report, the County was still negotiating potential reimbursement for costs incurred by DPH, Legislation: The legislative efforts supported by the County of San Bernardino included recovering costs associated with the response to and recovery from the attack, in addition to lobbying for services and support for victims (e.g., AEAP grant). The Office of Governmental and Legislative Affairs worked closely with lawmakers to pursue cost recovery funding and other funding sources for services to assist the victims. Additionally, in the two years since the attack, legislators Org & Financial Recovery: SBC Snapshot 53 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County had proposed bills related to workers’ compensation and other issues to better prepare for and mitigate the repercussions of future terrorist attacks. In 2016, the California Org & Financial Recovery: SBC Snapshot legislature approved a bill to allow the State’s contribution to local governments in the event of a terrorist attack to increase from 75% to 100%, but the Governor vetoed it. 54 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Organizational & Financial Recovery Considerations Topic/Keywords Initial Memorials/ Remembrances Expense Tracking Public Records Requests Response Considerations Memorial or gathering events can be very important for honoring those deceased/injured, healing for others, and setting a resilient and compassionate tone moving forward. Attempt to schedule memorial events when the majority of personnel are able to attend or provide permission for them to take leave to attend. Be sure to target all personnel as leaving out employees who work in satellite locations or on different shifts can create resentment. Ensure there are no conflicts with the memorials and/or funeral services for the deceased, holidays, or other major events. When possible, reach out to the victims and their families for suggestions on content and approach. Tracking expenses related to your incident will be time consuming, meticulous, and will require involvement/contributions from all affected organizational elements. The process is essential for applying for state (if applicable) or federal reimbursement or other grant programs. Accurately capturing these costs in real-time in appropriate forms/means is a must as it is very difficult to recreate them after the fact. Some of the following may significantly aid your success in cost recovery: creating specific incident-related codes in payroll and procurement systems; following established agency policy for overtime and emergency procurement; documenting not only employees’ time but the hourly use of equipment; recording the purchase of supplies and other resource allocations specifically associated with the incident; photographing any damage caused by the incident; and documenting the rationale for decisions. If your organization is a public entity, anticipate an uncountable number of requests for the release of all types of documentation and communications associated with the incident (e.g., employment records, incident documentation, audits/investigation reports, emails). Be familiar with applicable federal and state exemptions to the Freedom of Information Act (FOIA) and relevant sunshine laws and be prepared to defend your decisions regarding what is protected information. Topic/Keywords Ongoing Remembrances Content of Memorials/ Remembrances Permanent Memorials Recovery Considerations Consider holding annual memorials or remembrances for the foreseeable future. They may not need to be as elaborate as time passes, but recognizing the anniversary of the incident is typically important. Plan to hold such events outside of the workplace with attendance being optional. This will allow those who would like to attend to do so while others may continue a normal workday if they prefer. Do not strive for consensus regarding the planning and content of memorials and remembrances. You will not please every stakeholder and not delaying the event/action may be of greater importance. If a process is delayed, be prepared to communicate what is causing the delay and emphasize that your organization is “trying to get things right.” Determine if your organization wants to pursue the building of a permanent memorial. This may be a long and complex effort involving the input of many stakeholders, funding/budgeting, site selection, concept evaluation, competitive proposals, construction, inauguration, and ongoing maintenance and costs. Org & Financial Recovery: Considerations 55 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Recovery Considerations Consider establishing a committee of relevant organizational elements and victims or their representatives and families of the deceased to lead the effort. Ulterior Motives Be mindful that external entities that may arrange memorial activities and donations may have their own motives, such as being publicly recognized for the good they are doing versus genuinely honoring the victims. Recruitment Organizational elements that lose personnel, including those deceased, injured, or those who do not return to work, will likely need to hire personnel to fully Incentives reconstitute operations. If there is competition in the market for the same positions or limited supply, be prepared to seek out prospective hires from Targeted Outreach atypical sources (e.g., academia, associations, distant locations, alternate industries) or provide competitive incentives (e.g., hiring bonuses, referral bonuses, higher salaries, relocation assistance, promises of advancement, education assistance/loan repayment, generous leave policies). Vacant Protected Positions within your organization filled by employees on extended leave may Positions be protected by law or collective bargaining agreements (i.e., others may not be hired in those same budgeted positions until they are permanently vacated). It Dual Fill may be necessary to hire temporary employees to fill protected, but currently vacant positions, commonly known as a “dual fill.” Traditionally, recruited staff onboarded as “dual fill” employees may have their positions eliminated if permanent staff returns to work, which affects the prospects of the recruitment. If your organization must “dual fill” positions, consider a strategy that promises to find new full-time positions within the organization for the “dual fill” hires should staff return to those positions and advertise that commitment accordingly. Recruitment Maintain flexibility with hiring practices when staffing an affected organization. Considerations Strive to match personalities and not just skill sets with the new workplace environment (potentially characterized by trauma). Be candid with prospective hires and encourage them to ask any question they have about the workplace environment. Those ill prepared for the workplace environment will likely terminate their employment. Recruitment Surge If the recruitment effort is large enough, it may tax the organization’s Capacity recruitment capacity (e.g., ability to review applications, schedule interviews, conduct interviews, negotiate employment contracts). Consider partnerships, contractors, outsourcing, reciprocal agreements with other organizations, or the reassignment and dedication of staff from other organizational elements to the task to provide recruitment assistance until the demand turns or your organization is able to meet the demand. In San Bernardino County’s case, for example, nearly 100 candidate interviews were conducted in only a few months. This required San Bernardino County to involve its mutual aid partners in the conduct of interviews because the in-house staff was not sufficient. Training/Onboarding A large recruitment effort may also tax the organization’s capacity to onboard Surge Capacity and train incoming personnel, particularly if they outnumber the existing staff. Consider partnerships, contractors, or reciprocal agreements with other organizations to provide onboarding or training assistance until your organization is able to meet the demand. Benefits of New New hires may contribute to the organization’s attempt to establish a new Hires normal by bringing an infusion of new energy and new ideas to the Org & Financial Recovery: Considerations 56 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Team Building Institutional Knowledge and Experience Deficits Balancing Individual and Workplace Needs Transition Plan Manage External Expectations Permanent Facility Changes Facility Planning Team Recovery Considerations organization. Having not been involved in the incident that led to the organization’s current situation, they will not have the same psychological legacy or biases that others might. Employees that have been through trauma together may develop a bond that may appear to be unwelcoming to outsiders. New hires may not initially be integrated into the workplace. Provide multiple and ongoing team building events, activities, and assignments designed to familiarize staff with each other and create closer working relationships. Be cognizant that organizational elements that lose personnel may lose significant institutional knowledge among their workforce. It may take years to rebuild this knowledge base. This may create burdens on certain groups or individuals (e.g., supervisors), may extend the period of diminished functional capacity, or may itself exacerbate the problem by leading to increased attrition rates among overburdened staff. Initially, your organization may be especially accommodating to the workplace needs of affected individuals (e.g., modified work schedules, attitudes/behavior, performance), but as time passes the organization may need to find a balance between those individuals’ needs and the organization’s long-term business and operating needs. This transition is ultimately important to establishing a new normal, but it may be aided by the involvement of third-party counselors or mental health professionals who can assess the current state of the workplace, guide supervisor decision-making, counsel affected employees, and craft appropriate messaging. As soon as practicable, consider and develop a longterm transition strategy for achieving your organization’s new normal. Although the incident will likely live on in the minds of all the organization’s personnel, those not directly affected or involved in the recovery will likely return to a normal mindset with pre-incident expectations faster than those directly affected. Do your best to manage outside expectations and continue to communicate the status of your organization’s affected operations and recovery efforts. The process will likely be much slower than outsiders would anticipate and may be complicated by employees’ trauma. If your organization, with the input of victims or those affected, has decided to renovate, demolish, and/or permanently relocate personnel, be sure new spaces are both functional and sufficient to meet the business needs of the employees, and “look, feel, and smell” completely different than previous facilities that may now have psychological trauma or a stigma attached. Attempt not to reuse anything from the old space in the new space as even the smallest items may trigger a psychological reaction. If not addressed during the process to select, prepare, and relocate to alternate facilities, consider creating a team consisting of personnel representing real estate/facilities, information technology, and security interests, construction and supply vendors, counselors/mental health support, and the affected divisions/departments/organizations to identify, design/plan, and construct/ remodel permanent facilities. Be sure the interests of the victims and affected personnel are addressed by the planning team (e.g., security/access control, ingress/egress, business needs, color, layout). Org & Financial Recovery: Considerations 57 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Recovery Considerations Facility Final Walk Through for Victims and Families Victims and their loved ones or families of the deceased, may receive solace from visiting their associated work area or that of their loved ones before the facility is demolished or renovated. Consider providing a few opportunities to these individuals to visit the site before a change occurs. If you do so, ensure the site is secured, counselors are available, visitors are escorted, and the environment is peaceful and respectful. In addition, if there are areas that may cause discomfort or trauma, consider closing off those areas and diverting visitors from them. For example, in San Bernardino County, the perpetrator’s cubicle was blocked off and visitors were routed away from it. Personnel that have been through trauma may be particularly sensitive to the type and quality of service they are afforded. Delays or inaccuracies in addressing facility needs may be one of those service areas. Anticipate facility challenges will occur following a return or relocation to permanent facilities (e.g., glitches, access issues, supply shortages). Consider having dedicated personnel and expedited processes to quickly address these issues. If your incident is the result of a criminal or malicious act, anticipate security being a primary long-term concern of all personnel, not just those directly affected. The demands from personnel may be beyond the capabilities of the organization or out of balance with the reality of your organization’s risks and vulnerabilities. Do not expect personnel to be satisfied with those arguments. Where significant risks and vulnerabilities exist, consider appropriate permanent security measures. Where risks and vulnerabilities do not justify the demands being heard from personnel, consider at least some degree of security change or enhancement to demonstrate a commitment to security and create the perception of increased security. These may be lower cost or small changes such as adding security cameras, badged/controlled access, barricades, changing from unarmed to armed security personnel, conducting more frequent security sweeps, etc. Some action may satisfy many personnel, but no action or delayed action will likely result in resentment. Anticipate personnel may become aware of, and particularly sensitive to, all of the organization’s security policies or those of the jurisdiction within which it resides. For example, the carrying of concealed weapons in jurisdictions where it is permitted, workplace violence policies (including threats/comments made on social media platforms), and employee background checks (at hiring and later in careers), may all become topics of concern. Most cost recovery programs in the United States are not structured to reimburse organizations for costs associated with acts of terrorism or the types of costs that may resultnamely non-public safety response costs associated with business continuity, benefits, facilities, counseling, recruitment, etc. Anticipate many of your costs will not qualify for reimbursement (only approximately 10% of San Bernardino County’s costs ultimately qualified). Responsiveness to Facility Needs Permanent and Direct Security Measures Tangential Security Concerns Cost Recovery/ Reimbursement San Bernardino County was potentially eligible for funding reimbursement from the following sources:  California Disaster Assistance Act (CDAA) (California only): http://www.caloes.ca.gov/cal-oes-divisions/recovery/publicassistance/california-disaster-assistance-act Org & Financial Recovery: Considerations 58 The 12/2/15 Terrorist Attack Legacy Report San Bernardino County Topic/Keywords Recovery Considerations  Litigation Litigation and Media Coverage Lobbying Legislation Government Hearings Antiterrorism and Emergency Assistance Program (AEAP), U.S. Department of Justice, Office for Victims of Crime: https://www.ovc.gov/AEAP/  Assistance Grants, U.S. Department of Justice, Bureau of Justice: https://www.bja.gov/funding.aspx  Robert T. Stafford Disaster Relief and Emergency Assistance Act: https://www.fema.gov/robert-t-stafford-disaster-relief-and-emergencyassistance-act-public-law-93-288-amended Note: San Bernardino County’s costs did not exceed California’s threshold for eligibility under this program, but other organizations may meet eligibility requirements for public or individual assistance under this program depending on the magnitude of their incident. Anticipate claims and lawsuits being filed against your organization for any number of issues. Understand the consequences on your liability insurance policies if the incident is officially declared an act of terrorism (e.g., many policies have an exemption for terrorism unless additional coverage has been acquired for it). Similarly, consider a court’s or jury’s potential views of your organization’s liability in the event of an officially declared act of terrorism versus not officially declared. Beyond the risk of paying potential awards, anticipate the legal costs of just engaging in claims and lawsuits. Anticipate such actions and costs continuing for years to decades. Be prepared for attorneys that may take advantage of the media coverage to create public sympathy for defendants in order to secure more lucrative settlements against your organization. Have a team trained and experienced with the legislative process and lobbying to push your organization’s legislative agenda associated with the incident in appropriate venues. Engage your local elected officials early and often as advocates for your legislative agenda. If your organization does not have a legislative affairs or equivalent unit, consider hiring a lobbying firm if needed/ desired. Anticipate moderate costs associated lobbying including salaries, contracts, travel, etc. Additionally, anticipate legislators using your incident as justification for their legislative agendas. Your organization may need to determine if it wants to take a position on those indirect legislative items and how best to craft your associated public messaging. While it was not a significant issue for San Bernardino County, major incidents often result in state or federal legislative hearings. Your organization may need to be prepared to support or participate in such hearings and should be prepared for any possible public perceptions associated. Org & Financial Recovery: Considerations 59 12.2.15 EACH THERE COMES IN THEIR LIFETIME A SPECIAL MOMENT WHEN THEY ARE FIGURATIVELY TAPPED ON THE SHOULDER AND OFFERED THE CHANCE TO DO A VERY SPECIAL THING, UNIQUE TO THEM AND FITTED TO THEIR TALENTS. WHAT A TRAGEDY IF THAT MOMENT FINDS THEM UNPREPARED OR UNQUALIFIED FOR THAT WHICH COULD HAVE BEEN THEIR FINEST - WINSTON CHURCHILL