An Organizational Review of San Bernardino County’s Response to the December 2, 2015 Terrorist Attack June 18, 2018 CPARS Consulting, Inc. San Bernardino County Organizational Review Response to 12/2/15 Terrorist Attack This page is intentionally blank. Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Dedication This report is dedicated to the San Bernardino County employees present during the December 2, 2015 terrorist attack, including fourteen (14) deceased victims1 and fifty-eight (58) survivors that continue to be, and will forever remain, beloved members of the San Bernardino County Family; as well as the countless members of the San Bernardino County Family who worked tirelessly and selflessly to safeguard the community and support those affected with compassion, dedication, and professionalism. 1 One of the fourteen (14) deceased victims was not a San Bernardino County employee, but is nonetheless remembered by this report. Dedication i Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County This page is intentionally blank. ii Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Acknowledgements Critical Preparedness and Response Solutions (CPARS Consulting, Inc.) would like to thank the following individuals with San Bernardino County who recognized the importance of memorializing the County’s response to the December 2, 2015 terrorist attack, who made this report possible, and offered the full commitment of their time and County resources to make this effort a priority and success:  Robert Lovingood, First District Supervisor, Board Chairman  Janice Rutherford, Second District Supervisor  James Ramos, Third District Supervisor  Curt Hagman, Fourth District Supervisor, Board Vice Chairman  Josie Gonzales, Fifth District Supervisor  Gary McBride, Chief Executive Officer (CEO)  Leonard Hernandez, Chief Operating Officer (COO)  Gregory Devereaux, CEO (Ret.)  Dena Smith, COO and Interim CEO (Ret.)  Mary O’Toole, Principal Management Analyst (Ret.) CPARS also wishes to thank the hundreds of County employees, past and present, who contributed information and/or participated in interviews and data gathering efforts. This report would have lacked value without their candor, time, and generosity of spirit. Lastly, CPARS would like to thank its team, which demonstrated great commitment, heart, and professionalism working with San Bernardino County stakeholders in the creation of this report:  Nick Lowe, Project Manager/Co-Author (CPARS Consulting, Inc.)  Kathryn Humphrey, Deputy Project Manager/Co-Author (K-Rise Enterprises, Inc.)  Julie Quinn, Co-Author (QuinnWilliams, LLC)  Katherine Williams, Co-Author (QuinnWilliams, LLC)  Sheri Benninghoven and Scott Summerfield, Communications/Public Information Subject-Matter Experts (SAE Communications)  Jean Roque and Christine Thelen, Human Resources/Employment Subject-Matter Experts (TruppHR, Inc.) Acknowledgements iii Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County This page is intentionally blank. iv Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Executive Summary On December 2, 2015 the San Bernardino County Department of Public Health (DPH) Environmental Health Services (EHS) Division was hosting an annual training event at a conference center that is part of the nearby Inland Regional Center (IRC). Seventy-two (72) County employees were in attendance from the EHS Division and DPH. At approximately 10:30 a.m., an Environmental Health Specialist (the male perpetrator) left the meeting and returned a little less than half an hour later with his wife (the female perpetrator). They were armed with multiple firearms, hundreds of rounds of ammunition, home-made explosives, and were dressed in tactical military-style gear. At 10:58 a.m. they approached the IRC Conference Center first killing two people near the entrance to the building before proceeding into the meeting space where the male perpetrator’s colleagues were gathered. The perpetrators indiscriminately fired upon the attendees killing a total of 14 people, injuring 22, and traumatizing all the survivors who witnessed the attack. The perpetrators fled in a rented vehicle before law enforcement arrived. Later that afternoon they were tracked down by law enforcement and both were killed during a gun battle approximately one mile from the IRC around 3:15 p.m. Two days later, law enforcement and the Federal Bureau of Investigation (FBI) confirmed the attack was a premeditated act of terror inspired by the Islamic State of Iraq and Syria/the Levant (ISIS/ISIL). The attack had direct and serious impacts on the department and division targeted. The deceased (with the exception of an IRC contractor), the survivors, and one of the perpetrators were County employees. Without precedent, the County, including the department and division targeted, was faced with critical decisions associated with personnel accountability, security, benefits, psychological counseling, public information, memorials, and reconstituting a critical division left void of personnel, among other matters. However, the attack would ultimately have an effect on the entirety of San Bernardino County governmentnearly 22,000 employees affectionately and genuinely referred to as the “San Bernardino County Family.” The attack also marked an amalgamation of previously independent threat and response elements simultaneously present in one incident: active shooter incident; terrorism; victim and responder; employer and community service provider. Although there were countless correlations between San Bernardino County’s experience and other incidents, few previous incidents had the complexities of all those characteristics and, at the time, there was no resource available to guide the County’s response. With the complementary 12/2/15 Terrorist Attack Legacy Report2, San Bernardino County hopes its experience will help other jurisdictions and organizations better prepare for, and if necessary, respond to, this new threat environment and improve the care and support for victims. This report endeavors not only to capture the breadth of the impacts on the County, but also to highlight the hundreds of actions taken by dedicated County employees to address those 2 The 12/2/15 Terrorist Attack Legacy Report is available at: http://www.sbcounty.gov/uploads/CAO/reports/December2LegacyDocument.pdf Executive Summary v Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County impacts (personal, operational, fiscal, etc.). As an organizational review, it is intended to capture the most important aspects of the County’s response and the resilience of the County family as a whole. In addition, it aims to understand the performance of the County as a whole unit with some special attention paid to individual programs and/or projects that were uniquely affected. This report is primarily organized into two sections: 1) a timeline of major events and actions that tells the County’s story chronologically; and 2) a selection of narratives organized into six categories that tell the County’s story in-depth by topic. The timeline is intended to be a quick reference that illustrates the momentum, magnitude, and duration of the County’s experience and response efforts. The six topical categories and the narratives contained within are as follows: 1) Emergency Protocols: This section explores those situations San Bernardino County faced, and actions it took within its purview, to address imminent threats to human life, the safety and security of personnel, and the immediate wellbeing of victims and survivors. The narratives in this section address the role County departments played in directly supporting public safety incident response operations, the challenges of implementing actions to protect employees during a quickly evolving incident, the application of security measures, the dismissal of personnel and office closures, accounting for the status of personnel, and the care for victims’ remains and notification to their next-of-kin. 2) Operational Response: This section addresses the actions and resources employed by the County to manage crises, enable necessary emergency actions, and position the County toward recovery. The narratives in this section describe the role of the County’s pre-existing emergency plans in the response to the terrorist attack, including efforts to continue essential operations. In addition, it explores the role of the County’s Emergency Operations Center (EOC) in the coordination of policies, tasks, information, and resources to support incident response operations and recovery, and similar management practices used across departments to strategically select objectives, assign tasks, document activities, and monitor progress. The County’s Proclamation of a State of Local Emergency, addressed in this section, enabled emergency authorities and triggered programmatic eligibility, including emergency procurement and possible State or Federal reimbursement, among other provisions to aid recovery. This section goes on to address a variety of other actions taken by the County to pave the road to recovery. 3) Communications: Perhaps the most integral part of every organization’s ability to effectively respond, manage impacts and crises, and achieve a new steady state, is communication and coordination. Both were at the heart of every situation and present in the activities in which San Bernardino County was engaged following the attack. As such, it is a topic addressed throughout this report. This section, however, focuses on two particular aspects of communications: 1) the resources and processes facilitating information sharing/ situational awareness; and 2) the resources and processes that enabled the mass distribution of information. In some cases, the two overlapped as one entity’s distribution of information provided for another’s awareness. The narratives in this section explore the Executive Summary vi Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County County’s account of becoming aware of the attack and its magnitude, the County’s ability to gather and distribute information, and the process employed to relay information to the public. 4) Employee Support: The County provided a variety of services to the victims of the terrorist attack and their families. The narratives in this section address the services provided to the families of the deceased, the affected County employees and their families. Those services include establishing single points of contact to liaison with victims and families on behalf of the County, the administration of State programs that offered support and benefits to the victims of crime, the provision of crisis counseling, the administration of employment benefits and leave programs, including workers’ compensation, and the management of donations. 5) Continuity of Operations: Using generally accepted national and international standards for continuity programs; this section reviews the County’s implementation of continuity treatments to ensure the continued performance of essential functions in the midst of and following the terrorist attack. The narratives in this section address succession planning and delegations of authority as many County and department leaders were out of the area on the day of the attack or were directly affected by the attack, the status of essential functions affected by the attack and efforts to recover capability levels, and the application of alternate facilities and alternate personnel as strategies to sustain operations. 6) Organizational and Financial Recovery: This section examines actions taken by San Bernardino County to establish a new normal, make the organization fiscally whole, and address the long-term cultural and operational ramifications of the terrorist attack. The narratives in this section explore the ongoing efforts to remember the victims and effects of the attack, long-term strategies to reconstitute staffing and operations in the EHS Division, renovations made to County facilities, and the pursuit of security measures to create an environment in which employees feel safe and have greater awareness and involvement in maintaining a safe environment. This section also addresses the total costs associated with the attack, the County’s efforts to recover some of those costs through State and Federal sources, and the legislative and legal implications associated with the attack. Each aforementioned section offers insights into the foundation laid toward recovery in the two years since the attack. In addition, call-out boxes are presented within some sections to offer deeper insights derived from the reflections of County personnel engaged in the development of this report and, to a lesser extent, the observations of the authors. Having experience with manmade and natural disasters and acts of terrorism, the authors of this report found the decisions made and actions taken by the County were reasonable, and in some cases remarkable, given the circumstances and with the information and resources available. The authors recognize also that less-than-optimal decisions and actions are often better than no action at all. It was generally only with the advantage of hindsight, that County personnel were able to identify lessons, alternate approaches, or opportunities for improvement. Although some opportunities to evaluate and adjust course were missed while efforts were in progress, many lessons had already been identified and acted upon by the Executive Summary vii Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County County to improve its readiness and resilience by the time this report was commissioned; and those items are identified in this report where appropriate. In general, the County demonstrated a “do whatever it takes” mentality at all levels. That perseverance was often rewarded as the County was able to circumvent bureaucracy and red tape to expedite and/or increase services. In a few cases, it was limited by regulation or resource availability beyond its control. The County provided a number of services and offered benefits that went well beyond its legal obligation as an employer and precedents previously set by other jurisdictions/organizations. On December 2, 2015 San Bernardino County, its employees, and community confronted the evils of terrorism and since that day, the County has navigated real and potential crises and has emerged more resilient than ever before. Executive Summary viii Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Table of Contents Dedication ........................................................................................................................................ i Acknowledgements.........................................................................................................................iii Executive Summary..........................................................................................................................v Table of Contents ............................................................................................................................ ix I. Introduction ................................................................................................................................. 1 Background and Context............................................................................................................. 1 Approach and Assumptions ........................................................................................................ 2 Methodology............................................................................................................................... 3 Report Structure ......................................................................................................................... 5 The 12/2/15 Terrorist Attack Legacy Report .............................................................................. 6 II. Timeline of Events and Actions ................................................................................................... 7 III. Narratives and Analysis ............................................................................................................ 19 Category 1: Emergency Protocols ............................................................................................. 19 1.1 Incident Support ............................................................................................................. 19 1.2 Evolution of Situational Information .............................................................................. 23 1.3 Immediate Security Measures/Lockdown ...................................................................... 25 1.4 Personnel Release and Office Closures........................................................................... 29 1.5 Personnel Accountability ................................................................................................ 33 1.6 Notification of Next-of-Kin .............................................................................................. 37 Category 2: Operational Response ........................................................................................... 41 2.1 Department Emergency Operations Plans (DEOPs) ....................................................... 41 2.2 County Emergency Operations Center (EOC) ................................................................. 45 2.3 Proclamation(s) of Emergency ........................................................................................ 53 2.4 Management Practices and Documentation .................................................................. 57 2.5 Emergency Procurement ................................................................................................ 61 2.6 Addressing the Perpetrator’s Footprint .......................................................................... 65 Category 3: Communications.................................................................................................... 67 3.1 Initial Notification ........................................................................................................... 67 3.2 Emergency Contacts ....................................................................................................... 71 3.3 Mass Notification/Communications ............................................................................... 73 3.4 Public Information .......................................................................................................... 76 Table of Contents ix Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Category 4: Employee Support ................................................................................................. 85 4.1 Victim Liaisons................................................................................................................. 87 4.2 Victims of Crime Services ................................................................................................ 91 4.3 Emotional Support .......................................................................................................... 95 4.4 Employee Benefits and Leave ......................................................................................... 99 4.5 Workers’ Compensation ............................................................................................... 105 4.6 Donations ...................................................................................................................... 108 Category 5: Continuity of Operations ..................................................................................... 115 5.1 Evolution of Leadership (Succession and Delegations of Authority) ............................ 115 5.2 Continuity of Essential Functions.................................................................................. 121 5.3 Alternate Facilities ........................................................................................................ 127 5.4 Alternate Personnel ...................................................................................................... 131 Category 6: Organizational and Financial Recovery ............................................................... 137 6.1 Memorials and Remembrances .................................................................................... 137 6.2 Reconstituting Employment Levels and Practices ........................................................ 141 6.3 Facility Renovations ...................................................................................................... 145 6.4 Long-Term Security ....................................................................................................... 149 6.5 Total Cost Accounting ................................................................................................... 153 6.6 Cost Recovery/Reimbursement .................................................................................... 157 6.7 Litigation ....................................................................................................................... 161 6.8 Legislation ..................................................................................................................... 163 IV. Conclusion.............................................................................................................................. 167 Appendix A: Bibliography............................................................................................................. A-1 Appendix B: State’s Workers’ Compensation System Review ..................................................... B-1 Table of Contents x Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County I. Introduction On December 2, 2015 San Bernardino County became the victim of a horrific act of terrorism that was unique in the United States at the time of this report. The attack simultaneously exhibited characteristics consistent with organized and strategic terrorism, spontaneous lone wolf attacks on soft targets, and active shooter incidents. Given its role as a government entity, County personnel were both victims and responders, the County was the employer of both the perpetrator and the victims, and the provider of essential and mandated services to the community that had been targeted. The attack was inspired by the Islamic State of Iraq and Syria/the Levant (ISIS/ISIL), so to the world outside of San Bernardino County government it was seen as a terrorist attack akin to the attacks in Paris the month before, or as simply the latest in a series of horrific mass shootings occurring across the country. But to some County employees, particularly those in the Environmental Health Services (EHS) Division, it was much more. It was a deeply personal betrayal carried out against them by a fellow County employee. Just months earlier, the perpetrator’s colleagues had held a baby shower to celebrate the pending birth of his first child. In addition, personnel from the County’s departments involved in the public safety response, including Public Health, Sheriff-Coroner, Probation, Behavioral Health, and others worked closely with the staff from the EHS Division targeted that day. At the time of this reporttwo years laterthe incident was still fresh in the minds of County employees and the public and the resulting feelings of grief, anger, and betrayal may never completely subside. Despite the lasting effects of the attack, San Bernardino County’s spirit has proven stronger and this report attempts to tell that story. Background and Context On December 2, 2015 the San Bernardino County Department of Public Health (DPH) Environmental Health Services (EHS) Division was hosting an annual training event at a conference center a short distance from their San Bernardino offices that is part of the Inland Regional Center (IRC)3. Seventy-two (72) individuals from the EHS Division and DPH were in attendance. At approximately 10:30 a.m., one EHS Specialist (the male perpetrator) left the meeting. He returned a little less than half an hour later with his wife (the female perpetrator).4 They were armed with multiple firearms, hundreds of rounds of ammunition, home-made explosives, and were dressed in tactical military-style gear. At 10:58 a.m. they approached the IRC Conference Center first killing two people near the entrance to the building before proceeding into the meeting space where the male perpetrator’s colleagues were gathered. The perpetrators indiscriminately fired upon the attendees killing a total of 14 people, injuring 22, and traumatizing all the survivors that witnessed the attack. The perpetrators fled in a rented vehicle before law enforcement arrived. Later that afternoon they were tracked down by law enforcement and both were killed during a gun battle approximately one mile from the 3 The IRC is a government-funded not-for-profit corporation that provides services and programs to people with developmental disabilities and their families. Its headquarters includes a conference center located in the City of San Bernardino. 4 At the County’s request, the authors of this report chose not to give attention to the perpetrators of the attack and have thereby not referred to them by name. Introduction 1 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County IRC around 3:15 p.m. Two days later, law enforcement and the Federal Bureau of Investigation (FBI) confirmed the attack was a premeditated act of terror inspired by a radical Islamic terrorist organization. The attack had widespread impacts on San Bernardino County. Most obviously, the deceased (with the exception of an IRC contractor), the survivors, and one of the perpetrators were County employees. Without precedent, the County was faced with critical decisions associated with personnel accountability, security, benefits, psychological counseling, public information, memorials, and reconstituting a division left void of personnel, among other matters. However, the attack would ultimately have an effect on the entirety of San Bernardino County governmentnearly 22,000 employees affectionately and genuinely referred to as the “San Bernardino County Family.” Some of those far reaching consequences would include removing the perpetrator’s work-related vestiges in the community, addressing the sufficiency of emergency action plans, donations management, litigation, legislation, effects on workplace culture, financial implications, and attempts at cost recovery under uncharted circumstances. Critical Preparedness and Response Solutions (CPARS Consulting, Inc.) was commissioned by the San Bernardino County Board of Supervisors and County Administrative Office (CAO) to document the short- and long-term impacts and actions of the County of San Bernardino, as an organization, as it responded to, and attempts to recover from the terrorist attack. This report does not address the perpetrators, what led to the attack, or the tactical public safety and investigative response, which are addressed in other reports.5 As an organizational review, this report aims to understand the actions taken and performance of the County as a whole versus individual programs and/or projects (although some programs were uniquely affected by the attack and warranted being addressed individually). This report also addresses topics such as business continuity, the role and evolution of leadership, organizational culture, management practices/processes, and employee support. Approach and Assumptions This documentation effort consisted of two components: 1) a report documenting and reviewing the County’s response to and recovery efforts since the terrorist attack (this document); and 2) a resource document with issues and considerations gleaned from San Bernardino County’s experience intended to assist other organizations planning for, or responding to, similar types of incidents (further explained in the section titled “The 12/2/15 Terrorist Attack Legacy Report” below). This report is intended primarily for use by San Bernardino County to document what actions it took and the actual or perceived effectiveness of those actions. This report was intended to be a self-assessment process guided and facilitated by the authors. Therefore, it was with the advantage of hindsight that County personnel were able to identify lessons, alternate approaches, or opportunities for 5 More details on the attack and the public safety response can be found in a report commissioned by the U.S. Department of Justice authored by The Police Foundation titled “Bringing Calm to Chaos: A critical incident review of the San Bernardino public safety response to the December 2, 2015, terrorist shooting incident at the Inland Regional Center” and another commissioned by the City of San Bernardino Fire Department (now part of the San Bernardino County Fire Protection District) titled “Tactical Improvisation: After-Action/Comprehensive Analysis of the Active Shooter Incident Response by the San Bernardino City Fire Department.” Introduction 2 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County improvement derived from their reflections and, to a lesser extent, the observations of the authors. Those are included in call-out boxes as appropriate and are intended for the County’s awareness and consideration. They do not imply an error occurred or a corrective action is necessary, but rather suggest alternate perspectives. Assumptions  There were no existing standards to dictate how the County, or any other organization, should have responded under similar conditions. As a result, this report evaluates the County’s response against its own intended outcomes. County representatives told the authors what they hoped to achieve, how they intended to achieve it, and whether they felt they met the objective(s). It was essentially the CPARS Team’s role to lead the County through a self-assessment process and to create an open and effective environment for doing so.  This report does not focus on any one individual, program, or department, nor individual strengths or opportunities for improvement. Rather, the report attempts to focus on strengths and opportunities for improvement applicable across the County organization. None of this report is intended to find fault or lay blame.  Results found in this report are based on individual recollections of what occurred, why, and how. The authors have attempted to present information objectively, but also recognize individuals’ perceptions were, in many cases, just as important as reality. Those engaged in this process were always encouraged to share their story from their personal perspective.  In the course of the review, where there were differing perspectives among the stakeholders, this report attempts to capture the spectrum of recollections related to the given topic, but does not make a determination as to which perspective or recollection was “right” or “wrong.”  All claims of psychological or emotional distress were assumed to be legitimate.  Where documentation offered sufficient insight into what happened, the CPARS Team did not reiterate those topics in interviews and may not have engaged individuals in further discussion; assuming individuals’ recollections were clearer and more complete when they documented them than they would have been at the time of this report’s data collection phase (about 16 months later).  The narratives in this report are a result of those interviewed and the documentation reviewed as identified in this report’s bibliography and is not inclusive of every involved department/group/individual.  Effects of the attack were still evolving at the time of this report’s completion and some long-term implications of the attack and the County’s response may not be known for years, if ever. The authors have attempted to identify these situations where appropriate and it may be necessary for annexes to be added to this report in the future. Methodology This review is intended to be a useful tool for identifying the organization’s strengths and opportunities for improvement at a certain point in time; in this case December 2, 2015 and the days and years after that contributed to San Bernardino County’s response to the terrorist Introduction 3 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County attack. The approach employed by the CPARS Team included passive and active research, data gathering and interviews, feedback, and re-evaluation mechanisms. The mechanism for the County to provide CPARS with feedback on the developing report was of particular importance because: 1) the results of the County’s response and recovery efforts were still evolving during the writing of this report; and 2) County personnel had equally valuable insights into the County’s response as did the CPARS Team. Research Phase and Work Plan Development During the first phase of this effort, the CPARS Team reviewed hundreds of documents provided by the County and gathered through open-source research, including after-action reports from other organizations/disciplines, County Board of Supervisors actions, documented recollections of events and actions, presentations, news coverage, as well as documentation created during, or in response to, the attack (e.g., department reports, situation reports, procurement records, unit logs/records, emails, social media postings). Initially, the CPARS Team intended to survey all County departments/agencies regarding their experiences during and following the terrorist attack and their perceptions regarding the County’s performance as a whole. However, with great foresight, the County had already done so. Approximately three months after the attack, each department was asked to document actions it took, how it was affected, and other impacts.6 Those reflective reports proved extremely valuable to the creation of this report. The passive review at this phase of the effort helped the CPARS Team develop a baseline understanding of the County’s response upon which to structure more active data gathering. The Team then developed a strategic Work Plan identifying information gaps and proposed strategies for addressing the gaps (i.e., who needed to be engaged, how, and when) including the lines of questioning and topics necessary to complete the County’s story. The Work Plan was presented to the County for review and approval and as more engagements were deemed necessary, the Work Plan was updated and again reviewed and approved by the County. Individual and Group Interviews Based on the Work Plan, the CPARS Team conducted nearly 40 interview sessions with more than 90 County staff between May and August 2017. The vast majority of sessions were conducted in-person with a few conducted telephonically. There was a mix of group and individual interviews depending on the topic, purpose, and need for privacy. Some individuals participated in more than one session in order to contribute perspectives on multiple topics. The purpose of all engagements was for participants to tell their story from their perspective so the CPARS Team could fully and accurately document the County’s response and recovery efforts. Because a significant amount of documentation was reviewed in preparation for these engagements, questioning was typically very specific and intended to fill information gaps. As many of the discussions were deeply emotional, participants were offered the involvement of counselors from the County’s Department of Behavioral Health (DBH) if they so desired. Data gathering focused on the most impacted departments/agencies, those most actively involved in the County’s direct response to the incident and those indirectly involved by 6 More information on the County’s surveys is available in narrative 2.4 Management Practices and Documentation on page 57. Introduction 4 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County cascading impacts. This prioritization process did not preclude the CPARS Team from then actively engaging other organizational elements as it learned more about the County’s response and later followed the trail of relevant information. County Employee Review and Input Workshop As the report began to take shape, the County came to the realization many employees had spoken with the CPARS Team, but few had formally engaged with one another to discuss their experiences. As a result, CPARS’ contract was amended in January 2018 to have the CPARS Team facilitate a workshop for select County employees that previously provided input via interviews or documentation. In March 2018, the workshop was held with two objectives: 1) to serve as a forum for identifying, considering, and discussing shared experiences and lessons related to the incident for inclusion in this report; and 2) to identify topics of greatest interest to other organizations for inclusion in the Legacy Report, with particular reflection on questions/requests posed to the County in the wake of subsequent tragedies (e.g., Orlando and Las Vegas mass shootings, North Park Elementary School shooting). Report Development During this phase, the CPARS Team analyzed the data and information gathered. Since the CPARS Team was comprised of members with a wide variety of experiences and expertise, collective discussion often resulted in better conclusions or solutions than its members would have individually. In some cases, this team dialogue led to the re-evaluation of data/ information or additional research or data gathering. At regular intervals, the CAO had an opportunity to review the draft narratives and provide feedback. The integrity of the review was of utmost importance to the CPARS Team. Each comment/question received from the County was reviewed and adjudicated by the CPARS Team. Ultimately, and after multiple rounds of review, the completed report was provided to the County on June 18, 2018. Report Structure Beyond this introductory section (Section 1), this report is organized into two primary sections: 1) a timeline of major events and actions that tells the County’s story chronologically (Section 2); and 2) a selection of narratives organized into six categories that tell the County’s story indepth by topic (Section 3). The timeline is intended to be a quick reference that illustrates the momentum, magnitude, and duration of the County’s response and recovery efforts. The entries are not intended to represent every action the County took, but rather items of significance. Each entry in the timeline is color-coded to match the associated topical categories and detailed narratives in Section 3 organized into the following six categories: 1) 2) 3) 4) 5) 6) Introduction Emergency Protocols Operational Response Communications Employee Support Continuity of Operations Organizational and Financial Recovery 5 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Each individual narrative within a category in Section 3 is intended to provide a stand-alone understanding of a topic. The authors of this report believed readers will likely review the specific sections most applicable to their purpose and/or interests. As such, each narrative may provide background on the County’s circumstances to put topics in context and defines acronyms on the first use. Narratives do not, however, reiterate other narratives; though crossreferences to other narratives are provided to direct the reader’s attention to additional information or context as necessary. Call-out boxes include additional insights, lessons, alternate approaches, or opportunities for improvement primarily derived from the reflections of County personnel or, to a lesser extent, the CPARS Team. Following a brief Conclusion (Section 4), this report includes a Bibliography as an appendix. Anonymity was essential to obtaining the unvarnished and candid input of those engaged. It was also important in the writing of this report to maintain an organization-wide perspective not construed as any one person’s perspective. As such, the topical/programmatic narratives have not been written to cite their sources unless specifically necessary. Instead, a nonattributable bibliography is provided as a record of all documents that contributed to this review as well as the individuals interviewed, whether in group or individual settings. The 12/2/15 Terrorist Attack Legacy Report The County was genuinely interested in learning from its experience and, more importantly, sharing information to strengthen the preparedness and resilience of other communities and organizations that may be faced with, or want to prepare for, similar emergencies. On December 2, 2015 there was no formal reference document available regarding what to anticipate during such a situation. While San Bernardino County reached out to communities that were previous victims of mass shootings (e.g., Newtown, CT and Aurora, CO), those experiences did not quite mirror the scenario that faced San Bernardino. The focus of The 12/2/15 Terrorist Attack Legacy Report is to provide best practices, lessons learned, and considerations for other jurisdictions and organizations. The Legacy Report is not intended to be prescriptive (i.e., telling another organization what decisions to make or actions to take), but instead, it is intended to help them anticipate the nature and urgency of the decisions and actions they will face. The Legacy Report presents lists of reference items to consider before and in the midst of crisis. San Bernardino County hopes the document will make the decision-making of others more proactive and informed, reduce elements of surprise, and help simplify complexities associated with these horrid experiences. For a copy of The 12/2/15 Terrorist Attack Legacy Report please visit: http://www.sbcounty.gov/uploads/CAO/reports/December2LegacyDocument.pdf Introduction 6 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County II. Timeline of Events and Actions The following timeline illustrates the momentum, magnitude, and duration of the County’s response and recovery efforts. Entries are not representative of every event that occurred or action the County took, but rather items of significance. Each entry in the timeline is color coordinated to the associated topical categories in Section 3, which includes detailed narratives. Time and/ Events/Actions or Date Wednesday 12/02/15 First reports of shots fired at the Inland 10:58 Regional Center (IRC) Conference Center. First City of San Bernardino Police units 11:04 arrive on scene. Triage area established at San Bernardino 11:15 Public Golf Club. Department of Public Health (DPH) and County Administrative Office (CAO) learn 11:20 of incident from sources on-scene. Other departments hear through the media and other sources. CAO begins to receive hundreds of media 11:43 and public inquiries. 1st County/Operational Area (OA) 11:50 Emergency Operations Center (EOC) Flash Report distributed. Explosive Ordnance Disposal (EOD) 11:51 identifies suspicious package at IRC. Email distributed from County Chief 12:04 Executive Officer (CEO) instructing all County personnel to stay indoors. County facilities begin implementing 12:05 various forms of lockdown procedures. CAO Public Information Officer (PIO) 12:02 releases first Tweet stating the County is monitoring the situation. County/OA EOC is declared operational. 12:05 The media releases information that 12:08 victims are County employees. DPH and CAO begin receiving calls from concerned family members of employees 12:15 believed to be at the Environmental Health Services (EHS) Division event. Events/Actions Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 7 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Time and/ or Date Events/Actions 12:30 Unified Command Post with San Bernardino Police Dept. (SBPD), County Sheriff's Dept. (SBCSD), and Inland Valley SWAT established at IRC. Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions Suspect vehicle stops and gun battle ensues approximately 1 mile from IRC. 15:14 15:22 4th EOC Flash Report distributed. Bomb threat reported at Loma Linda University Hospital. Later determined unfounded. 15:08 15:09 Gun battle terminates with suspects deceased. CAO/Coordination Conference Call with Department Heads #1 14:20 14:45 First shots fired during police pursuit of suspect vehicle. 2nd EOC Flash Report distributed. 13:50 14:00 3rd EOC Flash Report distributed. Report of active shooter at Patton State Hospital determined to be unfounded. 13:48 13:50 Rock Church and Hernandez Community Center selected by Incident Command Post (ICP) for witness interviews and reunification/release, respectively. Emergency Closed Session Meeting of Board of Supervisors (San Bernardino and Monterey, CA) with situation update and waiver of BOS travel policy to facilitate timely return of Supervisors. 13:00 13:04 CEO email instructs department heads to release personnel within the city of San Bernardino not involved in the response. Human Resources (HR) and Behavioral Health (DBH) Departments coordinate the deployment of crisis counseling teams to incident and support sites. 12:38 13:00 Acting CEO email instructs all department heads to return to San Bernardino. Events/Actions Message from Board of Supervisors Chairman distributed via Postmaster email and Countywire blog post to all County personnel with access. 16:20 Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 8 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Events/Actions CEO and County Supervisors who were out of town return to the area. Time and/ or Date Events/Actions 16:39 After ensuring HIPAA compliance, Inland Counties Emergency Medical Agency (ICEMA) provides list of transported patients to CAO.  17:00  17:00 Undetonated explosive devices located at IRC. 17:08 18:00 Witness interviews conclude at the Rock Church. Timeline of Events and Actions IRC explosive devices #2 and #3 rendered safe. 20:40 20:50 Non-County Event/Incident Emergency Protocol Operational Response SBCSD/Coroner Division establishes 24hour inquiry phone line and DBH advertises locations/contact information for crisis counseling centers. 20:30 21:45 20:37 CAO completes accounting of all 72 personnel at the EHS event. List of victims and deceased is accurate. Sheriff's Deputy at County Government Center evacuates building and relocates executives to SBCSD Headquarters to mitigate any potential bomb threats (perpetrator's office was located in the building). 19:54 20:00 Emergency Closed Session Meeting of Board of Supervisors (San Bernardino, CA) resulting in decision to close all nonessential County operations on December 3rd and 4th, except EHS staff who are approved to be off on paid leave until 12/14/15. CAO has accounted for all but 15 personnel known to be at the IRC.  19:00 19:30 IRC explosive device #1 rendered safe. DBH establishes a crisis hotline and disseminates information to all employees via HR. 18:30 18:30 Sheriff/Coroner Division establishes Hampton Inn in the City of Highland as a Family Assistance Center (FAC). District Attorney's Office initiates State and Federal services for victims of crime. 5th EOC Flash Report distributed. Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 9 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Time and/ or Date Events/Actions IRC building cleared by law enforcement and released to investigators. 21:29 22:00 and Thereafter Hernandez Community Center reunification site closes. Events/Actions Most Departments activate email and phone trees to notify personnel of office closures on December 3rd - 4th. 22:30 Thursday 12/03/15 All non-essential County functions closed 12/03/15 for the day. County launches Victim Liaison program modeled after a similar San Bernardino County Fire Protection District (SBCFPD) 12/03/15 concept. First group of Victim Liaisons assigned to families of the deceased and the physically injured. CAO/Coordination Conference Call with 8:30 Department Heads #2 9:00 6th EOC Flash Report distributed. SBCSD/Coroner Division completes positive identification of all deceased victims. Official notification to next-of-kin 9:00 commences with Federal Bureau of Investigation (FBI) and District Attorney Victim Advocates. Postmaster email and Countywire blog 10:14 post instruct all non-essential personnel to remain home on December 3 and 4. Board of Supervisors posts video message of condolence to Countywire blog for all 15:15 County employees. All notifications to the next-of-kin of 15:30 deceased victims completed. 7th EOC Flash Report distributed. 16:00 Emergency Meeting of Board of Supervisors. Closed session to authorize 16:30 emergency procurement authorities and expenditures to temporarily relocate EHS personnel to alternate facilities. Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 10 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Time and/ or Date Events/Actions California Governor visits injured survivors. 19:00 20:15 CAO/Coordination Conference Call with Department Heads #3. Events/Actions 8th EOC Flash Report distributed. 20:30 Friday 12/04/15 All non-essential County functions closed for the day. 12/04/15 15:30 County and Arrowhead United Way establish and make public "SB United Relief Fund" for victims and families. 16:25 17:30 9th (final) EOC Flash Report distributed. Incident Command transferred from SBPD to the FBI upon confirmation of an act of terrorism. County/OA EOC deactivates upon FBI instruction and CEO consensus. 18:05 12/04/15 Real Estate "Project Team" begins identifying and planning alternate facilities for EHS relocation. December 2015 All County offices (except the EHS Division) re-open. . DBH and contracted counselors are available at County offices for any employees in need and in some cases will continue to be on-site for months or years to come. 12/07/15 12/07/15 to 12/18/15 12/07/15 12/07/15 Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions County enhances Sheriff’s Dept. and contracted security presence at appropriate County facilities (e.g., at and around the County Government Center and DPH offices) to reassure employees and encourage their return to work. County press conference features Sheriff, County Supervisors, and ARMC Emergency Department doctors treating victims. Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 11 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Time and/ or Date Events/Actions SBCSD/Coroner Division completes all victim autopsies. 12/07/15 12/08/15 First CAO Post-Incident Coordination Group meeting. Subsequent meetings held weekly, bi-weekly, or monthly until 02/08/17. Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions HR issues guidelines on time reporting during the County closure and extended absence period for EHS and LUS employees. 12/10/15 12/10/15 Riverside County Environmental Health Inspectors change out 350 restaurant grade cards issued by the perpetrator. Revised return to work date of 12/21/15 established for EHS staff. 12/09/15 12/09/15 CEO officially Proclaims the Existence of a State of Local Emergency. IRC ICP demobilizes. 12/09/15 to 12/11/15 12/09/15 County Office of Emergency Services (OES) initiates the Initial Damage Estimate (IDE) and estimates initial County costs at $4.2 million. HR deploys a dedicated, passwordprotected website with resources and information for EHS employees. 12/08/15 12/08/15 FBI establishes and manages a FAC. The first day is for families of the deceased and the injured, including a private briefing. The subsequent days are for other victims, witnesses, families, and other County employees. Land Use Services (LUS) Department Code Enforcement Division staff colocated with EHS in Rancho Cucamonga authorized to take the rest of the week off with pay and return on 12/14/15 at alternate facilities. 12/08/15 12/08/15 A second group of County Victim Liaisons is created to assist employees who were present during the attack, but uninjured and other co-workers of the deceased. Events/Actions First two funerals/memorials for deceased victims held. 12/10/15 12/12/15 Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 12 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Time and/ or Date Events/Actions 12/11/15 Information Services Department (ISD) Multimedia Services Division requests to temporarily relocate from office space shared with EHS Division in County Government Center. Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions One funeral service for a deceased victim held. 12/18/15 12/18/15 Planning for the “County Family Gathering" memorial event begins. County Board of Supervisors hold a Remembrance Ceremony during the regularly scheduled Board meeting. 12/15/15 12/18/15 California Governor Proclaims a State of Emergency for San Bernardino County. The CEO's Proclamation of a State of Local Emergency is ratified by the Board of Supervisors and re-approved every two weeks thereafter until 08/08/17. 12/15/15 12/15/15 One memorial service for a deceased victim held. State and regional mutual aid personnel begin to arrive to support EHS operations and initiate continuity of functions at alternate facilities. 12/14/15 12/15/15 OES updates County costs to $13,071,735. Four funerals/memorials for deceased victims held. 12/14/15 12/14/2015 12/18/2015 Return to work date for EHS staff updated to 01/04/16 with paid leave expiring no later than 01/11/16. All EHS offices/functions remain closed. 12/11/15 12/13/15 12/12/15 One memorial service for a deceased victim held. Two funerals/memorials for deceased victims held. 12/11/15 12/07/15 12/11/15 Real Estate "Project Team" and contractors finalize alternate facilities plans and renovate, equip, and prepare 3 alternate facilities over the weekend. Events/Actions President of the United States and First Lady meet with the families of the deceased. 12/18/15 Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 13 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Time and/ or Date Events/Actions 12/19/15 One funeral service for a deceased victim held. One memorial service for a deceased victim held. 12/23/15 12/23/15 County's ad hoc "Security Task Force" is reinstated to assess long-term security needs at County facilities. Two funerals/memorials for deceased victims held. 12/20/15 12/22/15 CEO encourages department heads to gather and submit cost-related documentation to OES. Events/Actions "SB Strong" County logo released.  12/30/2015 2016 “County Family Gathering" Memorial event is held. 01/04/16 01/04/16 End of paid leave period for EHS personnel. Staff remaining off work must utilize alternative compensation methods (e.g., accrued leave, temporary disability, workers' compensation). 01/11/16 01/11/16 CEO memo directs departments to track and record incident-related activities, decisions, and costs for historical and cost recovery purposes. Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions California Governor's Office of Emergency Services (CalOES) conducts Applicant's Briefing to initiate State and/or Federal cost recovery efforts. 01/22/16 01/31/16 48 EHS staff members return to work during January. Approximately 37 report to work each business day on modified schedules. Only 11 return full-time. First claim against the County filed by the family of a deceased victim. 01/19/16 01/21/16 Additional claims against the County are filed by the families of deceased victims in amounts exceeding $200 million. EHS staff able to return to work begins reporting for duty at alternate facilities. One memorial for a deceased victim held. 01/01/16 01/31/16 Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 14 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Events/Actions Board of Supervisors approves budget amendment to accommodate the complete renovation of EHS facilities. Time and/ or Date Events/Actions 01/01/16 01/31/16 Fast track hiring begins for EHS positions in January and continues through April. New hires are sent to Riverside County to receive training. 03/01/16 03/01/16 Board of Supervisors approves contract with California Association of Environmental Health Administrators (CAEHA) to provide long-term EHS staffing through 2/28/17. Contract staff begins work at EHS the week of 3/22/16. 03/22/16 03/30/16 Distribution plan for "SB United Relief Fund" is finalized and distributions begin and continue into 2017. Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions EHS staff and family members of deceased are allowed to visit former workspaces before demolition. 05/01/16 05/24/16 Autopsy Reports for deceased victims released by the Sheriff/Coroner Division. CAO initiates a formal effort to collect incident documentation from departments for historical and cost recovery purposes. 04/01/16 04/30/16 4/20/16 & 4/25/16 Permanent renovations of facilities begin. December 2 Permanent Memorial Committee is formed, including victims' family members, EHS employees, and County officials. 04/04/16 04/04/16 After multiple rounds of review and feedback, plans for EHS, Multimedia Services, and Code Enforcement facility renovations are finalized and approved. Board of Supervisors approves increase in value of existing contract with Counseling Team International (CTI) to provide ongoing emotional support and counseling to County employees. Board of Supervisors approves two oncall contracts with security firms to evaluate security needs and provide recommendations for County facilities. 5/27/16 Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 15 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Events/Actions All State and regional mutual aid provided to EHS permanently demobilizes. Time and/ or Date Events/Actions 06/28/16 Department of Justice awards $500,000 to the California Board of State and Community Corrections to be distributed to law enforcement agencies involved in the 12/2/15 terrorist attack. 06/30/16 12/2/15 6/30/16 Board of Supervisors approves second increase in value of existing contract with Counseling Team International (CTI) to provide ongoing emotional support and counseling to County employees. 08/23/16 09/13/16 U.S. Department of Justice/Police Foundation releases review of the public safety response to the terrorist attack. Timeline of Events and Actions EHS and Code Enforcement Division staff returns to renovated facilities in Rancho Cucamonga. 12/02/16 12/31/16 Non-County Event/Incident Emergency Protocol Operational Response California Governor vetoes SB-1385, which would have permitted the State to reimburse San Bernardino County for up to 100% of the costs associated with a terrorist attack instead of the previous standard of 75%. 10/03/16 11/17/16 The County hosts an anniversary memorial at San Bernardino Airport for victims and EHS employees. Board of Supervisors approves contract extension with CAEHA to continue EHS staffing through 12/30/17. 09/09/16 09/25/16 EHS and Multimedia Services Division staff returns to renovated facilities in the County Government Center. Compared to the previous year, EHS conducts 44% fewer plan checks and construction inspections, 24% fewer food facility inspections, 41% fewer pool inspections, 69% fewer vector control inspections, discontinues food handler field enforcement, and devolves other functions to State or local agencies. EHS service levels improve as a result of returning staff, new hires, and contractor support, but deficits remain. Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 16 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Time and/ or Date 2017 Events/Actions CAO and OES update final County cost estimate to $22,600,000. 01/12/17 01/27/17 The last CAO Post-Incident Coordination Group Meeting is held. Non-County Event/Incident Emergency Protocol Operational Response Timeline of Events and Actions Final grant agreement issued between the California Victims Compensation Board (CalVCB) and San Bernardino County granting eligibility for $1.15 million in reimbursable costs. 09/12/17 10/13/17 California Disaster Assistance Act (CDAA) reimburses San Bernardino County for $310,215 of its original $18 million request. The second team of Victim Liaisons (for non-injured employees who were present at the attack and colleagues of the deceased) is retired after being reduced from 29 to 8 in January 2016. 08/08/17 08/15/17 Board of Supervisors approves and County rolls out new “SB Safe” Mass Notification System for Employees California Department of Industrial Relations releases a review of the County's handling of Workers' Compensation claims. 05/02/17 06/05/17 Board of Supervisors terminates the County's Proclamation of a State of Local Emergency. The first team of Victim Liaisons (for family members of deceased and the injured) is retired after being reduced to 14 liaisons in January 2016, 11 in June 2016, and then 4 since September 2016. 02/08/17 02/23/17 Board of Supervisors approves second contract extension with CAEHA to continue EHS staffing through 12/2018. Events/Actions California Governor signs an amended AB-44 into law requiring nurse case managers to support workers' compensation claims following a terrorist attack based on San Bernardino County precedent. 12/31/17 Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 17 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Events/Actions Time and/ or Date Ongoing in 2018 First round of facility security improvements begin and second round of facility security assessments by contracted on-call security firms continue. Ongoing in 2018 Ongoing in 2018 Management of EHS personnel requests for associated leave, modified work schedules, and transfer requests. Timeline of Events and Actions Continued hiring, training, and promotion of EHS staff to reach necessary staffing levels. Ongoing in 2018 Ongoing in 2018 Non-County Event/Incident Emergency Protocol Operational Response Planning for a permanent memorial on the grounds of the County Government Center with an expected contract award. Ongoing in 2018 Ongoing in 2018 Contracted staffing to support EHS operations. Events/Actions Continued administration of employee benefits, leave, and counseling services for employee victims and the families of the deceased, as applicable. Timeline Color Coding Key Communications/Coordination Employee Support Continuity of Operations 18 Organizational/Financial Recovery Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County III. Narratives and Analysis Category 1: Emergency Protocols This report defines “emergency protocols” as those situations San Bernardino County faced, and actions it took within its purview, to address imminent threats to human life, the safety and security of personnel, and the immediate wellbeing of victims and survivors. The six narratives in this category explore the role County departments played in directly supporting incident response operations, the challenges of selecting protective measures during a quickly evolving incident, the application of security measures, personnel dismissals and office closures, personnel accountability, and the care for victims’ remains and notification to their next-of-kin. Since the terrorist attack did not take place on County property, absent from this category is a review of County facility Emergency Action Plans (EAPs), which would have been activated in the case of evacuations, fires, medical emergencies, etc. 1.1 Incident Support As the introduction to this report noted, the County was both a victim and responder during the terrorist attack. Although the purpose of this report is not to review the County’s tactical/public safety response to the incident, it is necessary and appropriate to nonetheless acknowledge the contributions many dedicated men and women of a number of County departments and agencies made to directly support the tactical/public safety response and the care or treatment for those affected. The County’s preparedness to tactically address an incident of this size and complexity appeared strong. No departments involved in the tactical/public safety response spoke of major policy or procedural changes being implemented during, or modified later, as a result of its experiences. In addition, no significant staff turnover or staffing changes were reported among public safety agencies. Detailed reviews of the tactical responses can be found in a report commissioned by the U.S. Department of Justice authored by The Police Foundation titled “Bringing Calm to Chaos: A critical incident review of the San Bernardino public safety response to the December 2, 2015, terrorist shooting incident at the Inland Regional Center” and another commissioned by the City of San Bernardino Fire Department (now part of the San Bernardino County Fire Protection District) titled “Tactical Improvisation: After-Action/ Comprehensive Analysis of the Active Shooter Incident Response by the San Bernardino City Fire Department.” Arrowhead Regional Medical Center (ARMC) The ARMC, a County operated hospital, received six (6) victims of the terrorist attack. The hospital’s medical and administrative professionals worked tirelessly to save lives and limit human suffering. All six (6) victims transported to ARMC survived. The hospital also worked with local law enforcement to maintain a safe and secure environment while still serving the community’s normal medical needs on December 2nd and in the days after. Behavioral Health, Department of (DBH) The DBH oversees a program of Community Crisis Response Teams (CCRT)mobile teams of crisis counselors who can be quickly dispatched to respond to emergencies that unfold throughout San Bernardino County. The day of the attack, CCRT teams were deployed, along Narratives and Analysis 19 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M E R G E N C Y P R O T O C O L S with DBH management and counselors, to multiple locations including the Rock Church (law enforcement interviews), Hernandez Community Center (reunification site), Hampton Inn (Coroner Division Family Assistance Center [FAC]), ARMC, and Probation Department offices to provide crisis services to victims, families, and first responders. Because of the large scale of the event, additional DBH clinicians were called in to augment the CCRTs and by 3:00 p.m. the day of the attack, DBH had coordinated and deployed over 100 clinical therapists and psychiatrists. District Attorney’s Office Staff from the District Attorney’s Bureau of Victims Services deployed to both the Rock Church, (where law enforcement interviews with Inland Regional Center [IRC] evacuees took place) and the Hernandez Center (where IRC evacuees were released and reunited with their loved ones). At those locations they provided information on services available to victims, witnesses, and others affected by the incident (e.g., evacuees). As narrative 4.2 Victims of Crime Services on page 91 explains, the work of this group will continue for years after the incident. Fleet Management Department The Fleet Management Department coordinated the ongoing provision of fuel to the incident scenes and ancillary locations for generators and vehicles and provided portable lighting to those sites. The Department also deployed mechanics and provided vehicle services at those sites for the convenience of public safety and investigative agencies. Once the site was cleared, Fleet Management moved and reclaimed County-owned vehicles that had been left at the IRC by employees present during the attack so the employees would not have to return to the site to do so. Information Services Department (ISD) Personnel from the ISD responded to the IRC Incident Command Post (ICP) to provide laptop computers, internet connectivity, and ongoing information technology (IT) assistance for the IRC ICP throughout its operation. The ISD’s Multimedia Services Division provided law enforcement with images of potential victims and the presumed perpetrator from their database of employee identification badge photos. Access cards allowing free entry to the County Government Center were also provided to law enforcement and the Federal Bureau of Investigation (FBI) to facilitate their access for the duration of their investigations. Inland Counties Emergency Medical Agency (ICEMA) Because of the proximity of ICEMA’s Department Operations Center (DOC) to the scene of the terrorist attack, its DOC was ultimately moved to the County’s Emergency Operations Center (EOC). Over the course of the incident, ICEMA assisted with the coordination of resources for emergency medical care at the scene, including a precautionary request for 3 ambulance strike teams (15 ambulances total), and the allocation of victims to appropriate treatment centers through its mass casualty coordination role with fire departments, private ambulance companies, medical helicopter providers, prehospital providers, and hospitals. ICEMA maintained awareness of hospital availability, available and committed transportation assets, and accountability for all transported victims. Narratives and Analysis 20 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Fire Protection District, San Bernardino County (SBCFPD) The SBCFPD played multiple roles during the incident. As first responders, fire/rescue and emergency medical service (EMS) personnel from the District provided mutual aid to the City of San Bernardino Fire Department (SBFD)7 to triage, treat, and transport victims. In addition, the County’s Office of Emergency Services (OES), housed in the SBCFPD, activated the County’s Emergency Operations Center (EOC) within an hour of the incident and it remained operational to coordinate information, resources, mapping, and multi-agency support until the afternoon of Friday, December 4th.8 On the evening of December 2nd, the SBCFPD also dispatched a Type III Incident Management Team (IMT) with large-incident experience to support the Unified Command (UC) at the IRC. The District’s IMT was later credited with facilitating the cohesion of response efforts among involved agencies (local to federal), improving the ICP’s application of, and efficiency with, Incident Command System (ICS) principles, and addressing necessary ICP logistics (e.g., ICP resources, feeding). Probation Department The proximity of the IRC to Probation Department facilities allowed for an immediate and significant response of sworn probation officers to the IRC. They were some of the first law enforcement personnel on-scene following the City of San Bernardino and Fontana Police Departments. Dozens of probation officers ultimately supported evacuation efforts, extraction of the injured, and EMS providers with managing the triage and transportation of victims. They secured the perimeter of the IRC evacuation and triage area (San Bernardino Public Golf Course). Beyond the primary incident scene, Probation Department personnel managed the Hernandez Center reunification site when they discovered no command structure in place upon arrival. This involved establishing a safe area where those exiting buses into the Hernandez Center were protected from the media, coordinating or providing psychological support, and addressing the needs of individuals with disabilities, access, and/or functional needs. For days after the attack, Probation personnel supported security and access control at the IRC, the perpetrator’s City of Redlands home, ARMC, Patton State Hospital, and Loma Linda University Medical Center. Sheriff’s Department (SBCSD) The Sheriff’s Department was part of the Unified Command at the IRC and provided officers in support of the law enforcement activities at that site, including the search for perpetrators, evacuating and clearing the buildings, supporting the search for secondary devices, and the investigation. In addition, Sheriff’s deputies were involved in the gun battle with perpetrators later that day and ultimately took control of that incident scene and the investigation at that second site. The Sheriff’s Department played a significant role managing real-time public information associated with the incidents. The Sheriff’s Department’s Public Affairs Unit deployed to the IRC after being unable to reach San Bernardino Police Department’s Public Information Officer 7 The City of San Bernardino Fire Department was annexed into the San Bernardino County Fire Protection District on July 1, 2016. Plans had already been formulated to do so prior to December 2, 2015. 8 Additional information on the County EOC is contained in narrative 2.2 on page 45. Narratives and Analysis 21 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County (PIO). They were immediately enveloped into the ICP and established a robust structure for media monitoring, rumor control, social media, and public inquiry. Later, the County Administrative Office (CAO) PIOs credited much of their success to the quality and timeliness of information being produced by the Sheriff’s Public Affairs Unit on behalf of the incidents. E M E R G E N C Y P R O T O C O L S Like the Probation Department, the Sheriff’s Department would also go on to support security and access control at the IRC, the County Government Center, the area around the gun battle, ARMC, and Loma Linda Medical Center. Sheriff’s Department - Coroner Division Personnel from the Coroner Division immediately responded to the IRC ICP to support fatality investigations and the respectful transport, identification, notification, autopsy, and release of remains for final disposition. More information on that process can be found in narrative 1.6 Notification of Next-of-Kin on page 37. Coroner Division personnel also deployed to the Hernandez Center being used for reunification. Like the Probation Department described above, Coroner Division personnel trained in crisis counseling filled a void they encountered at the site by providing counseling services and relevant information to those present. The Coroner Division recognized the cacophony of activity at the Hernandez Center was not an appropriate place for those not yet reunited to wait for news regarding their loved ones, including possible death notifications. As a result, the Coroner Division coordinated with the San Manuel Band of Mission Indians, which operated a Hampton Inn hotel on the other side of the central valley, to use that site as a quiet and secure waiting area. Within approximately 40 minutes, the Coroner Division had worked to secure the site and acquire private space and catering at no cost from the San Manuel Tribe. People at the Hernandez Center not reunited with their loved ones were presented with the Hampton Inn as an option. Over the course of the night, a few families sought refuge at the Hampton Inn until official notifications to next-of-kin were able to begin the next morning. Narratives and Analysis 22 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 1.2 Evolution of Situational Information In any emergency, one of the most complicating factors to response planning and operations is the accuracy and reliability of information. This event was no exception. In the first few hours following the attack misinformation was prevalent, posing challenges to the County’s decisionmaking capabilities. As addressed in the incident review commissioned by the U.S. Department of Justice,9 law enforcement was on scene within minutes of the attack. Although on scene, law enforcement was initially unsure of the totality of the situation as they prioritized clearing the Inland Regional Center (IRC) complex for an active shooter and later explosives, and then began the manhunt for the perpetrators. As the situation evolved in the field, it impacted the quality and accuracy of information on the civilian-side. For example, as noted in narrative 3.1 Initial Notification on page 67, the County Administrative Office (CAO) began receiving calls and emails at 11:20 a.m., initially indicating that San Bernardino County staff was not involved. Over the course of the next 15 minutes information received directly from staff at the IRC site confirmed that staff was involved, but none were believed injured; and further updates later reflected the severity of the attack and the injuries. There was also speculation for a number of hours to follow as to the intended targetservice providers to persons with developmental disabilities like the IRC, any government entity, San Bernardino County employees in general, specifically the County’s Department of Public Health (DPH) or DPH Environmental Health Services (EHS) Division, or something altogether different. In the immediate aftermath of the attack the identities of the perpetrators were unknown so intent could not be determined. Even after the perpetrators were identified, the motive remained unclearwas this a case of workplace violence, a terrorist attack, or something else? The constant evolution of information made it difficult to assess the situation, set County-wide policies and priorities, and release information internally and publicly. Elsewhere, it had initially been communicated in error through the news media that the attack had taken place at the County of San Bernardino Department of Behavioral Health (DBH), which was located approximately one block from the IRC. Additionally, it was miscommunicated that the assailants, described at the time as three white males, were targeting behavioral health sites and rumor was spreading they had attacked Patton State Hospitala state-operated forensic psychiatric hospital located in San Bernardino County just a few miles from the IRC. This caused significant concern among staff at DBH who believed they might be the target. Reinforcing that concern, a public safety staging area had been established by law enforcement in the DBH parking lot, but personnel inside the building were unaware it was a staging area and not an active response scene to a threat at their worksite. Meanwhile, the Inland Counties Emergency Medical Agency (ICEMA), whose offices are about 4,000 feet across an open golf course from the IRC, had been incorrectly informed one of the 9 Braziel, Rick, Frank Straub, George Watson, and Rod Hoops. 2016. Bringing Calm to Chaos: A Critical Incident Review of the San Bernardino Public Safety Response to the December 2, 2015, Terrorist Shooting Incident at the Inland Regional Center. U.S. Department of Justice, Critical Response Initiative. Washington, DC: Office of Community Oriented Policing Services. Narratives and Analysis 23 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County shooters was seen fleeing across the golf course in the direction of the ICEMA offices. This caused ICEMA to evacuate its first floor and barricade doors and exits on the second floor thinking the perpetrator was en route to that site. E M E R G E N C Y Later in the day, an additional threat was reported at a nearby warehouse on the eastern border of the City of San Bernardino where County employees called police after hearing gunfire at their worksiteultimately it was linked to the gun battle the perpetrators had with police only a short distance away. As far away as Pasadena, CA (approximately 50 miles to the west) an unrelated police operation to apprehend a fleeing burglary suspect, occurring at about the same time as the San Bernardino attack, was briefly thought to be linked to San Bernardino. While these instances of misinformation were clarified within the first several hours, they illustrate the challenges the County and its departments faced planning appropriate response and recovery operations. Some personnel were more comfortable operating in this ambiguous environment than others. Decisions had to be made based on the information available, frequently re-evaluated, and adjusted as appropriate (e.g., relocations [i.e. the ICEMA Department Operations Center to the County Emergency Operations Center], personnel accountability, shelter-in-place/lockdown, staff dismissal, psychological care). Incident management on both the civilian and public safety sides had to adapt to known misinformation and non-vetted information then administer strategies and actions based on their best judgment. P R O T O C O L S Narratives and Analysis 24 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 1.3 Immediate Security Measures/Lockdown Word of a mass shooting on Waterman Avenue in the City of San Bernardino quickly spread among County personnel, but details initially lacked specificity. As a result, most County executives and department heads were concerned about safety but did not feel they had enough vetted information to take further action at that time. Some County facilities within earshot or eyeshot of the Inland Regional Center (IRC) immediately secured their sites as they assumed there might be a threat having observed the magnitude of the public safety response. These included the administrative headquarters of the Inland Counties Emergency Medical Agency (ICEMA) and the Department of Behavioral Health (DBH), and the Americas Job Center of California, operated by the County’s Workforce Development Department (WDD). Around 11:30 a.m., the Sherriff’s Deputy assigned to oversee security at the County Government Center returned to that site from a meeting accompanied by an additional Deputy. They did not immediately lockdown10 the building, but one deployed to the roof and the other to the parking lot to monitor and potentially suppress any security threat if needed. The first security action disseminated to the Board of Supervisors, County executives, and department heads was from the County Chief Executive Officer (CEO) at 12:04 p.m. instructing the following: “Due to the incident at subject location [referenced subject line: Shooting Incident at Inland Regional Center on South Waterman Ave., SB], we are advising County staff stay indoors [sic] and not leave their buildings.” While the email did not specifically say “lockdown” the majority of executives and department heads ultimately interpreted it as such, but most also commented that they initially struggled to determine what the notification meant (e.g., “shelter-in-place”11 versus “lockdown,” recall staff in the field or send them home, etc.). Some departments, like Public Works, the Library Administration, and County Registrar interpreted the CEO’s message more as “keep employees inside and do not leave the premises,” as one of them stated, but did not infer that tangible security actions were necessary. The commonality across nearly all departments was that the CEO’s notice triggered department heads and supervisors to account for their staff, confirm their locations and safety, and ensure they knew of the incident and to avoid the area around the IRC. Beyond that, the response to this directive then varied widely among departments and County facilities. Few facilities had someone qualified with whom to seek guidance on the topic (i.e., other than County courthouses, law enforcement agencies, and the Arrowhead Regional Medical Center (ARMC), the only County building with sworn law enforcement present was the County 10 There are several definitions for the term "lockdown." A lockdown is typically an emergency protocol to prevent people from escaping or protecting people inside a facility from a dangerous external event. A partial lockdown typically means entryways leading outside the building are locked and people may not enter or leave the building. A full lockdown means that people must stay where they are within the facility and may not exit or enter the building. Lockdowns may be augmented with security personnel stationed at entries, approved entries on a caseby-case basis, security checks by personnel making rounds, or other protocols applicable to the situation. 11 A technical term for environmentally isolating a facility from a possible contaminant in the atmosphere. Narratives and Analysis 25 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Government Center and only a few other sites had contracted security guards qualified to consult on the topic)). E M E R G E N C Y Around noon, the Sheriff’s Department deployed a contingent of additional, heavily-armed deputies to the County Government Center to place it under what would traditionally be considered a partial “lockdown” in the law enforcement community. All entrances and exits were secured, though staff and visitors were allowed to leave but not return after leaving (with only a few exceptions granted for staff later in the day). Likewise, the Sheriff’s Department and Fontana and Rialto Police Departments deployed officers to ARMC to fully secure that site and keep it as such for the next 24 hours. Elsewhere, administrators and facility staff did what they felt best constituted a “lockdown” or was consistent with the CEO’s directions, the variations of which are captured below:    P R O T O C O L S      The campus of the County Emergency Operations Center (EOC) was secured (gates and entries locked) by staff and construction crews working on the street in front of the compound were instructed to leave the area and block the street with heavy equipment. Hearing a perpetrator was seen heading from the IRC toward its headquarters, ICEMA locked the building entries and evacuated its first floor to the second floor and placed fire extinguishers at each entrance to the second floor as potential last resort defensive weapons. DBH secured the entries to the building and implemented a systematic approach for keeping personnel calm, monitoring the status of personnel, and conducting routine checks of all floors and areas for security breaches. This was particularly appropriate since a public safety staging area had been established in the department’s parking lot; leading staff to believe the perpetrators were at, or en route to, their location. At one of the offices of the County Assessor/Recorder/Clerk, the building was locked, but security staff was instructed to let the public in one at a time. In a similar fashion, the Auditor-Controller/Treasurer/Tax Collector and Department of Child Support Services implemented a similar form of “soft” lockdown of their facilities, securing and positioning staff or guards at entrances, but allowing customers to enter one at a time. At a separate Recorder’s Office, entryways to the building were secured and the public was not allowed to enter. At the Land Use Services (LUS) Department in the County Government Center, customers in the building were asked to leave when the Sheriff’s lockdown took effect, but were not given an option to stay even though a threat may have loomed outside. The Department of Agricultural Weights and Measures (AWM) was hosting a state training with attendees from across California. The meeting was adjourned and attendees were asked to leave and were given instructions on how to exit the immediate area while staff remained. The WDD and Veterans Affairs allowed clients to leave if they chose, but no one was required to and they were assured they would be safe if they stayed with staff onsite. The San Bernardino County Museum had nearly 100 school children on site. Access to the Museum campus was secured (gates and entryways locked) and the museum and school staff entertained the children for a few hours until the school informed the Narratives and Analysis 26 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County      excursion it was safe for them to return. The children were then securely loaded into their buses unaware of anything related to the incident. LUS and WDD secured their facilities as mentioned above, but also instructed staff to stay away from windows. Staff of the San Bernardino First 5 Commission went as far as to gather all staff in a semi-secure conference room in the center of the building similar to a “shelter-in-place” procedure. DBH used its public address system to make all building occupants aware of the lockdown. The Department of Aging and Adult Services (DAAS) which had secured its offices felt a public announcement would cause panic and did not use the system for said purposes because formal protocols were not in place. AWM and DAAS instructed all staff that was off-site to immediately return to their offices, including ones located in the City of San Bernardino near the site of the attack. Meanwhile, DBH and Purchasing Department personnel not in their buildings at the time were instructed not to return until the lockdown was lifted. Buildings inhabited by multiple departments without a common security authority often took different actions right next to each other. For example, at the General Services Facility at 777 E. Rialto Avenue, the Purchasing Department and AWM locked down their offices, loading docks, and dismissed the public. Meanwhile, in the same building, the Registrar of Voters, Regional Parks Administration, and Library Administration implemented no security precautions and did not ask visitors to leave. Multiple departments were unsure if they could permit personnel in the field to take County vehicles home rather than requiring them to return to a potentially at risk area. Mail couriers running routes were in limbo as Purchasing Department staff explored options, based on their residential addresses, for taking County vehicles home if necessary. The Department of Public Works had similar questions regarding its staff with vehicles in the field. Mail couriers and public works crews were eventually allowed to return County vehicles to their departments and retrieve personal vehicles. At 1:48 p.m., the CEO issued another notification to the Board of Supervisors, County executives, department heads, and executive assistants instructing staff as follows: “County employees in buildings within the City of SB who are not responding to the incident are released from work for the remainder of the day.” In most facilities in the City of San Bernardino, this notification essentially ended the lockdown as personnel slowly left facilities and the buildings were closed. Where essential functions had to be maintained or where word of the authorization to release personnel took longer to be received (some reported as late as 4:00 p.m.) and at sites outside the City of San Bernardino, many facilities remained in “lockdown,” just had personnel remain indoors, or maintained heightened security levels until after the perpetrators were killed in a gun battle around 3:15 p.m. and word of that occurrence spread. Although the known threat had been eliminated the afternoon of December 2, 2015, County leadership felt it was necessary to at least temporarily increase law enforcement and security presence at County buildings after the attack to encourage employees to return to work by Narratives and Analysis 27 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M E R G E N C Y P R O T O C O L S putting them at ease and ensuring offices were safe. For approximately two weeks after the attack, San Bernardino County Sheriff’s deputies and the County’s contracted security services significantly increased their presence and made it visible; namely at and around the County Government Center and at Department of Public Health (DPH) facilities. Narrative 6.4 Longterm Security on page 149 provides information on the County’s efforts beyond this short-term augmentation to address security vulnerabilities and the expectations of employees. Lockdown Procedures and Security Measures… Existing Department Emergency Operations Plans (DEOPs) did not include lockdown procedures and no training or education on the topic had previously occurred (except at a select few locations). Other than courthouses, law enforcement agencies, ARMC, and ICEMA, no other County department spoke of having plans or training associated with a lockdown. The majority of department heads voiced a desire for common lockdown guidance including: clear definitions of “lockdown”; conditions warranting implementation and associated activation levels; specific protocols for securing premises and maintaining vigilance; instructions on handling staff, the public/visitors, and personnel in the field; the temporary release of County vehicles for personal use; appropriate messaging (e.g., use of public address systems, signage, website messages); and actions for maintaining readiness (e.g., training, drills). The County may find value in developing such a policy for use County-wide. If developed, future notifications activating the policy should use associated defined terminology. A separate concern was voiced by personnel in buildings staffed with contracted security guardsa program managed by the Sheriff’s Department. A few staff reported approaching contracted security staff after receiving notifications about the severity of the attack asking what security precautions were being taken and whether a lockdown was necessary. In those reported cases, the security staff on duty did not feel they had the authority to make a security policy decision and were awaiting orders on how to proceed from an outside source (it is unknown whether that source was in reference to a contractor/company source or a public safety agency [i.e., Sheriff’s Department]). The recommendation was made that protocols be established and on-site contracted security personnel be empowered to make security policy decisions, such as a building lockdown, without having to await direction/ approval. Lastly on the topic of immediate security measures, a number of departments discussed placing formal requests for sworn law enforcement to support building lockdowns, mostly via the County EOC, but none of those requests were satisfied. Not surprisingly, the resources of the Sheriff’s Department and many local law enforcement agencies were fully committed to the incident response and the search for the perpetrators. In addition, some of those requests may not have been appropriate or a judgment may have been made by law enforcement regarding the level of risk. Nonetheless, security support is a suitable request for activating the law enforcement mutual aid system per California’s Law Enforcement Mutual Aid Plan. Had the perpetrators gone unaccounted for longer or the threat to government facilities been greater, then the County, via the Sheriff’s Department (as the Operational Area Mutual Aid Coordinator), could have requested sworn officers from outside the affected region to temporarily support security needs at government office buildings or for other purposes. Narratives and Analysis 28 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 1.4 Personnel Release and Office Closures The decision to release all non-essential County employees in the City of San Bernardino for the remainder of the day on December 2, 2015 occurred just before 2:00 p.m. The decision was made by the Chief Executive Officer (CEO) while in remote communication with the Acting CEO (the Assistant Executive Officer [AEO] for Finance and Administration) and upon consultation with the Sheriff. At the time, it was unknown whether the attack was random or targeted on County government, or whether it was the first of potentially multiple attacks in the County or on County government. In addition, the CEO immediately recognized the psychological and emotional toll on County employees once it was revealed that their peers and friends were the victims. Citing these reasons, the CEO authorized all non-essential functions first within the City of San Bernardino (the seat of County government) and later throughout the County shuttered for the remainder of the day. Notification of the closures and release of employees occurred in a number of ways. At 1:48 p.m., the CEO sent an email to the Board of Supervisors, all department heads, and the County’s senior executives that stated: “County employees in buildings within the City of SB who are not responding to the incident are released from work for the remainder of the day.” Immediately following this notice at 2:00 p.m., the Acting CEO held a conference call with all department heads to share what she knew about the status of the incident and subsequent response actions. She included in that call direction to department heads to instruct County staff in the City of San Bernardino, except those responding to the event, to be sent home. Department heads were responsible for alerting staff and closing offices as appropriate. A Postmaster12 email notice was sent from the Chair of the Board of Supervisors to all staff at 3:10 p.m. followed by one from the CEO at 3:24 p.m. that reinforced the closures and release of employees within the City of San Bernardino. A number of divisions and individuals within departments reported a delay in receiving this information with some entities not being informed until as late as 4:20 p.m. As the notification was not directed as a mandate or emergency evacuation, alternate directives were established or interpretations made of the notice by supervisors/directors at individual facilities or within divisions of departments. Most departments reported personnel leaving facilities, including the County Government Center, gradually over the remainder of the day. The decision to close all non-essential County functions/offices throughout the County (both within and beyond the City of San Bernardino) for the remainder of the week (until Monday December 7, 2015) was initiated by the CEO, but had to be approved by the Board of Supervisors (Board). Those privy to the discussion explained that a lot of time was spent during the Board Closed Session held at the Sheriff’s Department Headquarters between 8:30 p.m. and 9:45 p.m. mulling over the decision and the potential consequences. There was still uncertainty at the time whether this was a lone attack or potentially the first of multiple. Closing offices would give the County time to consider temporary security at government offices. In addition, 12 Postmaster is the name for San Bernardino County’s mass emails that are sent to all County employees. Narratives and Analysis 29 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M E R G E N C Y P R O T O C O L S around the time the Board meeting was commencing, the County Administrative Office (CAO) was completing its accounting of county personnel that were at the event. The severity of the attack became more evident to the decision-makers with 14 deceased county employees (including the male perpetrator), 22 injured, and 36 other survivors. In addition, it had been determined the perpetrator was a County employee and the colleague of the victims. The CEO, Board, and other County executives who themselves were traumatized by the event, recognized that every County employee was likely sharing their sense of grief, violation, disbelief, and fear. For those reasons, they felt it was necessary and appropriate to close nonessential functions throughout the County for the remainder of the week. The County’s leadership recognized this would be a costly decision, but felt it was the right one to make. Ultimately, the closing of offices for those two days would account for the largest single expense incurred by the County associated with the terrorist attack (approximately $5 million). Although most County departments were closed, those required to be open by law, offices of elected officials, and those necessary for public safety and welfare remained open on December 3 and 4, 2015 with limited and essential staff. County Counsel was consulted on what functions could not legally be closed. Some of the offices that remained open included the Assessor/Hall of Records and County Clerk, District Attorney, Clerk of the Board, Information Services Department Multimedia Services Division (to support messaging from the Board), Sheriff including the Coroner (only sworn personnel), CAO, and the San Bernardino County Fire Protection District (County Fire). Understanding Essential Functions to Inform Operational Decisions… As narrative 2.1 Department Emergency Operations Plans (DEOPs) on page 41 describes, most DEOPs did not include well defined essential functions, thereby requiring department heads to make those selections at the time the decision to close non-essential operations was made. Department heads noted that it would have been helpful to have that information in advance or for it to be shared at the time. One reason cited was so security could have been prioritized to operating locations on those days (some reported no additional security in locations that remained open despite the extent of the threat remaining unknown and considering the comfort-level of staff during the days after the attack). Second is that some essential function decisions are based on the needs of other departments/entities. For example, the Purchasing Department would not typically consider mail service an essential function; however, since the Courts remained open, mail service had to be maintained. Knowledge of what was determined essential and what locations were operating would have been beneficial. Notification to County employees of the closures on December 3rd and 4th happened in a number of ways, and occurred throughout the night. Most employees received notification through email or telephone calling trees from within their departments initiated by department heads. For example, the AEO for Finance and Administration called or sent an email to all of the department heads under her purview (e.g., Economic Development, Workforce Development, Information Services, Fleet Management, Real Estate) and the Clerk of the Board, stating: Narratives and Analysis 30 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County “Only essential staff may come to work at any county building anywhere in the county on Thurs and Fri. It is your call who is essential. Essential would be legally required to be open to serving the public.” Others were informed by Twitter, Facebook and website postings issued by the Chairman of the Board of Supervisors at about midnight on December 2, 2015. All employees later received a Postmaster email notice sent at 10:14 a.m. December 3, 2015 stating: “The Board of Supervisors have asked non-essential County employees to stay home today, Thursday, Dec. 3 and Friday, Dec. 4 out of respect and concern for our co-workers who have been impacted by the tragedy on Wednesday.” Some employees, having no means to be reached during off-duty hours, did not receive the notice and arrived at work as usual on December 3, 2015. Anticipating this possibility, many department heads went to their offices to provide the notification in-person to anyone arriving at work that did not need to be there. At the County Government Center, for example, the Sheriff’s Deputy assigned to the building and CAO staff, including the Chief Operating Officer (COO), positioned themselves at the lobby doors to instruct non-essential personnel to return home. At approximately 7:47 a.m., the CAO’s Public Information Officer (PIO) emailed department heads a sign to post in public access areas and at entryways to indicate that offices would be closed for the next two business days with County libraries and museums returning to normal operation on Saturday, December 5, 2015. As County offices reopened on December 7, 2015, the Environmental Health Services (EHS) Division was the only office that did not open. Initially, County executives in consultation with Department of Public Health (DPH) leadership, set a date of December 14 th for EHS staff to return to work. As the week of December 7th wore on, it became clear EHS staff needed additional time for recovery. On December 9th the EHS return to work date was updated to December 21st, and then again on December 14th it was updated to January 4, 2016 with paid administrative leave expiring no later than January 11, 2016. Anyone still out after that date would be required to use alternative compensation (e.g., accrued leave, temporary disability, workers’ compensation, etc.). However, EHS functions, most of which are state-mandated and essential, could not be discontinued during the time EHS staff was on leave. As narrative 5.2 Continuity of Essential Functions on page 121 explains, some EHS leadership, but mostly personnel provided through mutual aid and volunteers, would begin reconstituting EHS functions as soon as December 14th at an alternate location. Timing of Closure/Release Decisions… During interviews, significant feedback emerged regarding the timing of the decision to close non-essential offices on December 3rd and 4th; namely that it was made late in the evening on December 2nd and could not efficiently be communicated to all County employees prior to them arriving for work on December 3rd. Likewise, some EHS staff expressed frustration with the changing dates for their return. The authors of this report felt that under the conditions, especially with limited and evolving information on the gravity and extent of the impacts, and with the significant ramifications of the decisions, County executives could not have been Narratives and Analysis 31 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County reasonably expected to make these decisions any faster. Several other sections of this report discuss communication challenges resulting from the December 2, 2015 terrorist attack as well as the County’s efforts to improve and enhance its communication and employee notification systems since. E M E R G E N C Y P R O T O C O L S Narratives and Analysis 32 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 1.5 Personnel Accountability As the incident unfolded, and it became known the attack targeted an Environmental Health Services (EHS) Division training event, the top priority of the County became accounting for personnel that may have been present. The planned EHS activity was intended to include about 90 personnel. With limited information coming from the scene as first responders were taking action, the Acting CEO (the Assistant Executive Officer for Finance and Administration) directed a multi-faceted approach to determining the identity and status of personnel at the scene. The first course of action was to obtain the expected attendance list from the Department of Public Health (DPH). The County Administrative Office (CAO) was able to acquire the list from the Executive Secretary to the Director of DPH. The next action was to determine who was actually at the eventa challenge because the sign-in sheet was in the room. As a result, staff from the Human Resources (HR) Department accessed the County’s payroll system (Employee Management and Compensation System [EMACS]) to first ascertain who would not have been at the event due to being on sick leave, annual leave, jury duty, or another formally excused absence. That part of the EMACS system is secure and has limited user access as it contains protected personally identifiable information. Only one staff member who happened to be present had such authorization. The list of potential attendees was evaluated for the first time following the EMACS research. From there, the accountability process came down to gathering information through one of five options as described below. The Chief Financial Officer (CFO) was recruited to lead the CAO’s accounting process because he was a former DPH employee familiar with the EHS staff. These efforts were closely supported by the Director of the HR Department and a simultaneous accountability process being led from within DPH. 1. Direct contact with each person that may have been in attendance. Direct contact with each person that may have been in attendance at the event at the Inland Regional Center (IRC) was difficult because mobile phones, purses, and other personal items were left behind in the chaos to evacuate or were instructed to be left behind by law enforcement. However, in some cases, the CAO team or a team at DPH Headquarters that was working simultaneously to contact personnel, were able to directly reach survivors that had evacuated, were being treated, or had been transported. When the DPH team gained awareness, they shared it with the CAO. 2. Contact with those in attendance that may have witnessed others who were in attendance and their status. This was one of the most effective avenues for gathering information on the status of those in attendance. A few survivors that escaped with their mobile phones became a significant conduit for information. Some of these communications went through the DPH team and others through various contacts in the CAO (e.g., CFO, CAO Executive Assistants). To the best of their recollection, the surviving witnesses shared who they had seen at the event, where they thought they were at the time of the attack, who they had seen injured or deceased, and where they had seen survivors since. While individual pieces of information were frequently inaccurate, correlations developed as conversations were had with more people. Narratives and Analysis 33 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Of particular help, EHS was a close-knit group with many friendships that went beyond work. As a result, many EHS staff had personal contact information for each other as well as contact information for spouses and loved ones of colleagues that the County would not otherwise have had. E M E R G E N C Y 3. Contact with employee’s emergency contacts to determine if they had heard from a loved one in attendance. Based on the information in its records, the HR Department contacted the emergency contacts for all personnel that were believed to be at the event with whom they or the DPH team had not directly spoken. In a few select cases, they were able to gather information from emergency contacts that had reached their loved ones. In a number of cases, the emergency contact had not communicated with their loved one and was not able to provide an update. In most cases, as narrative 3.2 Emergency Contacts on page 71 explains, the County’s central database of emergency contact information proved to be inaccurate; so many emergency contacts could not be reached at all. As a result, this method for accounting for personnel was not as successful as it may have otherwise been. P R O T O C O L S 5. Information from Other Departments/Organizations As discussed, in parallel with the accountability effort at the CAO, the DPH leadership team had been creating its own list and was making calls to everyone it knew to be at the event. As DPH became aware of the status of personnel it communicated updates to the CFO who was spearheading the effort for the CAO. 4. Media Monitoring The CFO and others in the CAO watched television to see who was being shown and who they recognized in media coverage of the incident. As they recognized individuals and could ascertain their status, the accountability list was updated. Initially, the CAO tried to gather information directly from hospitals that were being reported as receiving patients. However, because of HIPAA13 regulations, phone calls to Loma Linda University Medical Center (LLMC) and Arrowhead Regional Medical Center (ARMC)a county-operated hospitaldid not generate any useful information as only authorized family members are allowed to receive medical information, including the names of admitted individuals. A request was made to the medical centers to ask families to contact the CAO with the status of their loved ones, but that request yielded few results. After ensuring there would be no violation of HIPAA, information on those transported to hospitals would later become available through the Inland Counties Emergency Medical Agency (ICEMA). ICEMA coordinates the transfer of patients among private and countyoperated hospitals and tracks the bed availability and diversion status of 9-1-1 receiving hospitals round-the-clock. As such, it had an accounting of all those by name that were transported to medical facilities. This information was provided to the CAO at 4:39 p.m. and to the County/Operational Area Emergency Operations Center at approximately 7:35 p.m. 13 Health Insurance Portability and Accountability Act of 1996 Narratives and Analysis 34 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County It would be an all-day effort to determine and account for the 72 county employees that were in attendance at the EHS event (including the County employee that would later prove to be the perpetrator). Around 6:30 p.m., the CAO’s status list had accounted for all but 14 employees. By 8:40 p.m., the CAO list was complete and accurate, accounting for County personnel as follows:  58 Survivors o 22 Seriously injured and transported to local area hospitals, including 6 transported to Arrowhead Regional Medical Center (a county-operated hospital)  13 Deceased Victims (not including one IRC contractor)  1 Deceased Perpetrator (a County employee) Information Sharing Associated with Personnel Status… With multiple efforts ongoing to identify the status of the employees involved in the DPH/EHS event, information sharing between the parties could have been improved to maintain realtime situational awareness. Specifically, the CAO’s accountability process was supported by a DPH team conducting outreach to staff believed to be in attendance, including through their family members and colleagues. DPH communicated updates to the CFO leading the CAO effort once they became aware of the status of personnel, but similar updates were not transmitted to DPH when the CAO/CFO received information from other sources. This information would have been particularly important to the DPH team to help them more accurately prioritize their outreach efforts and avoid duplication of effort. On a more personal note, they felt they deserved the courtesy of being made aware of the status of their colleagues/employees once the information was known. The same could be said for the ICEMA list of transported victims (See narrative 1.6 Notification of Next-of-Kin on page 37), which after HIPAA concerns had been addressed, was not communicated beyond the CAO or County/OA EOC which had deferred to the CAO. Narratives and Analysis 35 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M E R G E N C Y This page is intentionally blank. P R O T O C O L S Narratives and Analysis 36 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 1.6 Notification of Next-of-Kin The San Bernardino County Sheriff’s Department Coroner Division is responsible for investigating and determining the cause and manner of death for those who die in San Bernardino County. By law the Coroner must investigate certain deaths, and as necessary, autopsies are performed to determine the medical cause of death. The Coroner Division has three (3) Board Certified Forensic Pathologists, an Anthropologist, an Odontologist, Deputy Coroner Investigators, Autopsy Assistants, Sheriff's Service Specialists, clerical staff, and an Indigent Burial Specialist. The Coroner Division also employs a Volunteer Unit to support operations as appropriate. Deputy Coroner Investigators gather the facts of the death, collect evidence for presentation in a court of law, and are responsible for providing next-of-kin notifications. The Coroner Division has offices and investigative locations in the City of San Bernardino and Victorville. On December 2, 2015, the Commander of the Coroner Division was advised of the incident directly via telephone from the Sheriff. Upon notification, the Commander immediately advised Sheriff’s Coroner staff and both the Commander of the Division and the Lead Supervisor established a presence at the Inland Regional Center (IRC) Incident Command Post (ICP), which facilitated communication and expedited decedent operations. Once staff was made aware of the incident and its implications, they chose to cancel vacations/leave and report for duty, including one Forensic Investigator who immediately returned from vacation in Southeast Asia. As every Wednesday is a “swing shift” where two shifts temporarily overlap as one replaces the other, on December 2, 2015, the full contingent of Coroner Division staff was present at the Main Office in the City of San Bernardino. The Commander of the Division quickly established the top priority as victim identification for the purposes of next-of-kin notification, followed closely by expedited autopsies. All available professional staff and investigators were engaged in this process guided by established protocols. Processes were not changed in the performance of duties, however, all staff members committed to the enhanced degree of urgency as they do with all large, complex, and sensitive matters of similar magnitude. Although the County has a mass fatality plan, the plan only differs from standard response practices when the number of required identifications/autopsies exceeds the County’s capabilities and identifies when outside resources are required. In the case of the December 2, 2015 terrorist attack, the Sheriff’s Coroner Division had sufficient resources to complete investigation, identification, and autopsy processes for the 14 deceased victims and two deceased perpetrators in a timely manner. Therefore, the only parts of the mass fatality plan that were activated were those addressing the need for increased and proactive public information and expanded next-of-kin notification. As the day unfolded on December 2, 2015, the Sheriff’s Coroner staff performed a number of activities simultaneously. First, once the IRC was declared safe, the Deputy Coroner Investigators began to investigate the scene. Two Forensic Pathologists were also deployed to the scene. After on scene investigations were completed, the Sheriff’s Coroner’s professional Autopsy Assistants transported the remains throughout the night to the Coroner’s facility in the City of San Bernardino. To do so, Sheriff’s Coroner staff used nondescript Coroner Division vans Narratives and Analysis 37 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County rather than typical contracted transportation services. The Commander of the Division was concerned contract service vehicles would be too easily identified by the media/public. He wanted to ensure utmost privacy/confidentiality by keeping all efforts internal to Division staff out of respect for the victims, citing prior experience when a photo of the remains of Christopher Dorner was leaked to the media in 2013. E M E R G E N C Y P R O T O C O L S In parallel, as families were gathering at the Hernandez Community Center to be reunited with IRC evacuees, Sheriff’s Coroner staff established a presence there to advise and counsel families awaiting the arrival of evacuees coming from witness interviews at the Rock Church. Coroner Division staff and investigators were deployed by the Division Commander without a formal request from the IRC ICP. Each Coroner’s Division staff member has a minimum of 80 hours of crisis and grievance counseling training and countless hours of real-world experience. As a result, the Division Commander knew such support would be required and it turned out a similar resource was not being provided to families at the Hernandez Community Center. At that point, the Coroner Division staff had no additional information as to who was transported to local hospitals, who was among the deceased victims, or who had been accounted for through other means. Therefore, the Coroner Division staff felt it necessary to prepare all remaining families for the worst-case scenario. For more information, see narrative 1.5 Personnel Accountability on page 33. While at the Hernandez Community Center, it became obvious to the Coroner Division staff that official communication with the families with respect to next-of-kin notification could not be respectfully performed at that location. The Hernandez Center was inundated with media, had a significant lack of security, no privacy, and no other personal care amenities. Once realized, the Coroner Division staff and Division Commander began working with the Sheriff’s Public Affairs Unit to establish a separate Family Assistance Center (FAC). Through the generosity of the San Manuel Band of Mission Indians, the Hampton Inn (about 10 miles away from the IRC and other incident activities) was secured. Unfortunately, once the last buses arrived at the Hernandez Community Center, families did not seem interested in going to yet another facility to await further notifications. In addition, the media had already begun to report on possible fatalities and some families essentially knew the terrible news already. As a result, only a handful of family members briefly visited the Hampton Inn FAC during its operation. For more information about operations at this facility, see narrative 1.1 Incident Support on page 19. Although the Coroner Division staff provided immediate counseling support at the Hernandez Community Center and Hampton Inn, it was understood their first priority was positive victim identification. The Coroner Division staff worked through the night on December 2nd to positively identify all victims. What made the process emotionally difficult for many staff was that those being identified were fellow County employees and Coroner staff had now closely interacted with many of the victim’s families at the Hernandez Community Center and Hampton Inn and could associate the deceased with their grieving loved ones. Typically, any engagement between the Coroner’s staff and loved ones is at arm’s length, at best, prior to next-of-kin notification. The Coroner Division staff persevered through these emotional challenges and by 9:00 a.m. on December 3rd, all positive identifications of victims had been Narratives and Analysis 38 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County made and Deputy Coroner Investigators were assembling to begin notifications. The start of next-of-kin notifications was delayed by about an hour as the Federal Bureau of Investigation (FBI) insisted that notification not be done without the FBI Victim Assistance Team even though the San Bernardino District Attorney (DA) Victim Advocates were ready to accompany Coroner Division staff. Once the FBI Team arrived, they joined the Coroner Division Deputy Coroner Investigators in conducting in-person notifications. The procedure for the notification of next-of-kin in San Bernardino County is well established and steeped in tradition. Deputy Coroner Investigators are specifically trained to make such notifications and do so personally, making face-to-face contact with victim’s loved ones, and providing information on available services and next steps. This procedure was not altered for this event. All next-of-kin notifications were completed by mid-afternoon on December 3rd. Once completed, the Division Commander used Twitter to notify the public and media that notifications were complete. As notifications were being made, a number of families expressed to Coroner Division staff that they had wished the notification had been done by telephone to expedite the process. Once positive identification of victims was completed, the equally important priority of expedited autopsies began. Again, no processes were changed or altered in the performance of the autopsies, but the intent to expedite was elevated. Initially to facilitate this process, as previously noted, two Forensic Pathologists were dispatched to the IRC while other investigations were still being performed. This was followed by the implementation of 12-hour rotating shifts at the Coroner Division. In total, 14 victim autopsies were completed by December 7th. The two perpetrators’ autopsies were completed on December 8th. Throughout the entire process, the Coroner Division paid close attention to media reporting and public information. Even six (6) months after the attack (May 27, 2016), as official autopsy reports were being readied for release, great care was taken to ensure confidentiality, quality and consistency amongst the reports, and respect for the victim’s families. The Division worked closely with the Sheriff’s Public Affairs Unit during this time to provide accurate and timely information about the autopsy report process to the victim’s families. As a matter of practice, all public information releases, were preceded by advance notice to the victim’s loved ones with respect to the content and timing of the reports. Some families chose to receive copies of the report and others did not. Under the California Public Records Act, all autopsy reports are available to the public upon request and the media had already requested copies well in advance of their completion. Notification Processes and Coroner Communications… Although both victim identification and autopsies were expedited, additional information sharing across San Bernardino County could have further facilitated many processes, including the Coroner’s positive identification and next-of-kin notification. For example, the Inland Counties Emergency Medical Agency (ICEMA) had developed a list of injured victims transported to hospitals. At the same time, the County Administrative Office (CAO) and Department of Public Health (DPH) had been working to account for all personnel at the incident. This information, which had been accumulated by the CAO, was not shared with the Narratives and Analysis 39 E M E R G E N C Y P R O T O C O L S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Coroner Division. Because the information had been shared with the CAO, originating parties did not share it through typical channels/protocols assuming the CAO would do so. This information could have informed and facilitated the Coroner’s identification and notification process as well as further informed how loved ones were addressed at the Hernandez Community Center and Hampton Inn. E M E R G E N C Y P R O T O C O L S Coroner Division staff revealed that, although current protocols and tradition demand next-ofkin notification be done in person, they will reconsider this long-standing protocol with respect to the speed at which information is shared in the modern age. Typically, the Coroner Division staff has some contact with the families of victims or potential victims prior to the official nextof-kin notification. This presents an opportunity to potentially query families about their preference for receiving notifications (e.g., in-person, via telephone, or other means). At the time of this report, the Coroner Division was expanding its notification protocol to allow families to state their communication preferences at initial engagements. In a County as geographically large as San Bernardino, this could also help to reduce delays caused by distances that have to be traveled to make in-person notifications. Had this protocol existed at the time of the terrorist attack and had families communicated a preference for telephonic notification, the Coroner Division acknowledged next-of-kin notifications could have occurred as much as six hours sooner. Finally, Coroner Division staff indicated that for an event of this type, where Coroner resources are being actively engaged in response (rather than recovery) operations, a Coroner Division representative should be present in the County/Operational Area (OA) Emergency Operations Center (EOC). A Coroner Division representative could facilitate timely situational and operational information exchange to benefit coroner operations as well as the entire operation. Current protocols have information being relayed to the Coroner Division by either an overall Sheriff’s Department representative at the County/OA EOC or via the Sheriff’s Department Operations Center (DOC). Narratives and Analysis 40 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Category 2: Operational Response Closely related to the County’s emergency protocols, “operational response” is defined in this report as the actions and resources employed by the County to manage crises, enable necessary emergency actions, and facilitate and position the County toward recovery. The six narratives in this category describe the role each County department’s pre-existing emergency plans played in the response to, and recovery from, the terrorist attack, including efforts to continue essential operations. In addition, it explores the role of the County’s Emergency Operations Center (EOC) in the coordination of policies, tasks, information, and resources to support incident operations and recovery, and similar management practices used across departments to strategically select objectives, assign tasks, document activities, and monitor progress. The County’s Proclamation of a State of Local Emergency, addressed in this section, enabled emergency authorities and triggered programmatic eligibility, including emergency procurement and State or Federal reimbursement, among other provisions to aid recovery. A critical element to facilitating both the County’s and community’s emotional recovery was a need to eliminate the work-related vestiges of the perpetrator as explored in this section. While emergency protocols were mostly retired within a few days of December 2, 2015once the threat was eliminated, personnel were accounted for, and the County had addressed its responsibility to the remains of the victimsthe operational response actions that helped empower the County’s journey toward recovery continued for months and years. 2.1 Department Emergency Operations Plans (DEOPs) Each County department is required to develop and maintain a Department Emergency Operations Plan (DEOP). Per the County DEOP template, the plans are intended to serve two purposes: 1) provide guidance and procedures in preparation for, and response to, significant natural, environmental or conflict-related risks/events to protect life and property, preserve infrastructure, and facilitate coordinated response; and 2) ensure the continued operation of government services. The program is administered by the County Office of Emergency Services (OES). The OES develops DEOP templates to aid departments in the development of their plans, provides guidance and recommendations on DEOP content, issues notices to departments to update plans, and archives copies of plans to ensure departments have completed the task. This report’s documentation process included the review of the OES DEOP template, interviews with OES staff regarding program administration, interviews with County department and division leadership regarding use of the DEOPs during and following the December 2, 2015 terrorist attack, and the review of 42 DEOPs in effect as of the date of the attack; most belonging to departments and some belonging to larger divisions of departments. DEOP Template At the time of this report’s publication, the OES was in the process of revising the County’s DEOP template and had intentions to issue a new version in 2018. This review is based on the template in circulation on December 2, 2015. As it relates to the DEOP’s first goal (provide guidance and procedures…to protect life and property, preserve infrastructure, and facilitate coordinated response) the authors of this report determined the template’s strengths were more toward facilitating coordinated response than the protection of life and property or Narratives and Analysis 41 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L R E S P O N S E preservation of infrastructure. For example, the DEOP template provided clear descriptions of expected coordination between departments and the County Emergency Operations Center (EOC), the establishment of Department Operations Centers (DOCs) to facilitate internal coordination, and prompts to identify interdependencies and contact information for external stakeholders. While the template provided references to some emergency protocols (e.g., protecting life and safety, accounting for personnel, providing for evacuation needs) it did not provide guidance on how to do so or what constitutes a sufficient strategy. The template included only placeholders to “[i]ndicate here how the department will respond to an emergency.” Departments may be in need of greater guidance and specific prompts to ensure all emergency protocols are addressed. The San Bernardino County Fire Protection District (SBCFPD) DEOP, for example, included a set of emergency protocol annexes addressing fire, earthquake, evacuation, and bomb threat procedures. Similar annexes or examples thereof were not included in the DEOP template and as a result were not found in other DEOPs. Similar annexes or prompts could have had benefit during the December 2, 2015 terrorist attack; namely ones related to lockdown procedures and personnel accounting.14 As it relates to the DEOP template’s second objective (ensure the continued operation of government services), the template is not fully compliant with any domestic or international continuity standards, including:    Federal Emergency Management Agency Continuity Guidance Circular (CGC): the domestic public sector standard. Disaster Recovery Institute (DRI) International 10 Professional Practices: the domestic private sector standard. International Standards Organization (ISO) 22301 “Societal Security - Business Continuity Management Systems - Requirements”: the international private sector standard. The template provides good prompts and guidance for addressing some of the critical elements of a continuity plan, including identification of essential functions, essential personnel, alternate facilities, orders of succession, delegations of authority, vital records, and alternate communications. However, the template’s detail in those areas may not have been sufficient to facilitate the selection and implementation of appropriate continuity strategies. For example, the template does not include the identification of recovery point and time objectives15 (RPOs/RTOs) associated with each essential function (something critical to all elements of continuity planning), the personnel and resources that would be needed to achieve the RPOs and RTOs, succession or continuity strategies for essential personnel beyond the administrative executive, continuity strategies for essential functions beyond relocation (e.g., devolution of control, alternate processes, alternate personnel, etc.), and others. A few DEOPs which appeared to be built on an older template did have prompts for identifying whether a function 14 See narrative 1.3 Immediate Security Measures/Lockdown on page 25 for more information on the implementation of lockdown procedures following the attack. 15 Recovery Time Objective is the duration of time within which a business process must be restored to avoid exceeding the entity’s risk tolerance associated with a break in business continuity and Recovery Point Objective is the degree or service level to which the business process must be restored to avoid the same unacceptable consequences. Narratives and Analysis 42 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County is “deferrable,” which may have previously been an attempt to categorize the RTO and others identified minimum personnel requirements, which may have been a way of previously attempting to define the RPO. It appears various continuity elements have existed in the DEOP template at different times, but all the elements needed for a robust continuity capability, per the aforementioned standards, have not been addressed in the template. Department Compliance Of the 42 DEOPs reviewed, there were widespread differences in quality, content, and approach. Although the DEOP template in use at the time of the attack presented opportunities for improvement as described above, experienced emergency and/or continuity planners could have likely interpreted the template’s purpose and prompts to create a fairly effective plan. In many cases, however, it appears departments applied minimal effort to populating and implementing their associated DEOP. In the majority of cases the following applied:  Where the OES had provided examples of content and strategies and then instructed that each section “…be tailored for each Department,” the vast majority of departments did not tailor the content and left the template as is resulting in in-actionable and nonspecific information for the department.  The majority of departments left in their DEOP only the emergency protocol examples provided as essential functions in the template (e.g., account for personnel, perform damage assessments, support building evacuation needs), but did not look beyond those to consider essential functions associated with their department’s mission or in some cases the essential functions were just a restatement of the department’s mission. Both significantly reduce the applicability of the plan to real continuity events.  Most plans illustrated an approach that assumed, when the plan was activated, the department would be supporting the community during an emergency, but the emergency would have minimal effect on the department, thereby assuming most department resources, facilities, or processes would be unaffected and available for use. The December 2, 2015 terrorist attack is perhaps the best example of the need for continuity capabilities when the department is the victim, not the community.  Continuity strategies in most plans were essentially “plans for plans” in that the actual tactics for achieving continuity were not captured in the DEOP, but rather statements of department intent to take some later action or make an assignment in hopes of later selecting the tactics.  Alternate facilities were generally listed as the department’s other facilities without consideration for capacity, capability, or proximity and likelihood to experience the same emergency as the principal facility.  There was no evidence in any DEOP that action had been taken to make the plan implementable. For example, if the plan stated the department would create emergency kits for personnel, there was no associated information on the content of those kits, where they’re kept, or how often they’re updated. If the department identified alternate facilities, there was no information on the pre-positioning of resources, the allocation of space, the execution of usage agreements, etc. There were, of course, multiple exceptions to each of the above concerns. For example, the Transitional Assistance Department assigned an order of use to its alternate facilities for each Narratives and Analysis 43 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L R E S P O N S E principal site; Arrowhead Regional Medical Center included a comprehensive list of essential functions (emergency and mission critical); the Auditor/Controller/Treasurer included lists of resources and equipment associated with each essential function; and other plans exhibited different areas of strength. However, no department had a comprehensive or fully customized plan that would warrant complete confidence in the department’s ability to respond or sustain its own operations. One reason for this may be that the OES did not previously review each DEOP for quality or compliance and provide feedback. DEOP Implementation on December 2, 2015 One could assume the DEOPs would be widely referenced during the December 2, 2015 terrorist attack. First when departments were attempting to lockdown facilities and later when departments were instructed to shutter all but mission-essential operations from the afternoon of December 2nd through Friday, December 4th. Most department heads never referenced their respective DEOP during or in the days after the attack. All department heads engaged during this review process were aware of the existence of their respective DEOPs, but the vast majority did not find value in the DEOP for the situation in question. Those results were not unexpected as the review of DEOPs above confirmed that most either did not include information relevant to the situation (e.g., lockdown procedures) or were not developed well enough to offer significant value (e.g., identification of essential functions and minimum staffing levels to inform the release of non-essential personnel). Most of the department heads that referenced the DEOP on that day stated using it for the emergency contact lists (i.e., staff calling trees) contained within. Improving DEOPs… At the time of this report, the OES had identified updates required for the DEOP template and was in the process of implementing them. The updates were not shared with the authors of this report. As this narrative alludes, some suggested improvements may include providing more specific prompts for the inclusion of information, suggested strategies and/or approaches for both emergency protocol and continuity responsibilities, and compliance with a national or international continuity standard. On the compliance front, the County may want to consider applying additional resources to provide greater coaching during the DEOP development/revision process as well as time to audit and provide feedback on submitted DEOPs (e.g., OES, County Safety Committee). In addition, the Office of Emergency Services (OES) may need to be further empowered to enforce complianceconfirming departments not only submit updated DEOPs, but submit ones of sufficient quality with evidence of implementation to impart confidence in department abilities to respond to emergencies and sustain government operations. Narratives and Analysis 44 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 2.2 County Emergency Operations Center (EOC) San Bernardino County’s Emergency Operations Center (EOC) is administered by the San Bernardino County Fire Protection District (SBCFPD; more commonly referred to as “County Fire”). The SBCFPD is a separate legal entity from the County, but the County Board of Supervisors serves as its Board of Directors. The Office of Emergency Services (OES), created by San Bernardino County Code of Ordinances Division 1, Chapter 1, §21.0103, manages the County EOC per §21.0104 of the same ordinance. The County’s Chief Executive Officer (CEO) is the County’s Director of Emergency Services. The OES is organizationally housed in the SBCFPD and reports to the SBCFPD Fire Chief on a daily basis, but serves a County-wide purpose described below. The Manager of OES (Emergency Services Manager [ESM]) oversees the OES, the County EOC, and is responsible for carrying out the responsibilities of the OES on a daily basis. The ESM assists the Director of Emergency Services in implementing the emergency plans and capabilities of the County. The OES is responsible for coordinating and supporting county-wide mitigation, emergency preparedness, response support, and recovery efforts. The County EOC also serves as the Operational Area (OA) EOC in accordance with California’s Standardized Emergency Management System (SEMS). As such, the County/OA EOC serves as an intermediary level of government/emergency management responsible for facilitating communications, inter-agency coordination, priorities, county-level and inter-agency/municipality policies, and managing information and resources among County departments/agencies, unincorporated areas of the County, twenty-four (24) incorporated cities in the County, special districts, tribal governments, and other political subdivisions within the geographic boundaries of San Bernardino County. The County/OA EOC is located in a building complex in the City of Rialto that also houses dispatch, communications, and other functions. The County’s alternate EOC is located in a County facility in the City of Hesperia. On December 2, 2015 approximately thirty (30) first responders from various agencies (including six [6] from the City of San Bernardino Police Department [SBPD] Special Weapons and Tactics [SWAT] Unit and two [2] County Fire Battalion Chiefs) were at the OES building for a “Terrorism II-Domestic Terrorism” Course being conducted by the California Specialized Training Institute (CSTI); a division of the California Governor’s Office of Emergency Services (CalOES). At approximately 11:10 a.m., SBPD SWAT Officers and County Fire personnel were alerted to the incident through their respective dispatches, which triggered their mobilization to the incident scene. As they departed, they advised OES staff there was an active shooter incident in the City of San Bernardino at the Department of Motor Vehicles (DMV)soon after clarified to be the Inland Regional Center (IRC)with about twenty (20) people down. The OES Duty Officer (DO) contacted the OES Assistant Emergency Services Manager (AESM) who was attending training in Orange County. The AESM instructed the DO to confirm the facts, especially the number of people reported down. Within five minutes, the DO advised the incident was actually at the IRC building but the number of people affected remained the same. By this time the OES ESM had been contacted and was on his way to the County/OA EOC from a meeting in Riverside, CA. Narratives and Analysis 45 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L R E S P O N S E The County/OA EOC has a unique relationship with the City of San Bernardino. Traditionally under California’s SEMS, municipal emergency management organizations, and their respective EOCs, are responsible for facilitating city-level emergency management and support to field operations. They in turn coordinate and seek support from the OA EOC, which facilitates efforts among all political subdivisions within the geographic boundaries of the County. During the City of San Bernardino’s bankruptcy (August 2012 to June 2017), the City reached an agreement with SBCFPD for OES to provide emergency support during incidents and Emergency Services Officers (ESOs) on a task-by-task basis for preparedness efforts, funded by a portion of the City’s Emergency Management Performance Grant (EMPG) award. At the time of the incident, the City had only one (1) Sergeant in the Police Department tasked with emergency management. At approximately 12:00 p.m. on December 2, 2015 that Sergeant, the lone administrator for the City of San Bernardino’s EOC, was named Deputy Incident Commander (IC) at the IRC Incident Command Post (ICP). County OES management immediately knew the City of San Bernardino was not in a position to activate its EOC. For that and other required reasons under SEMS, the County/OA EOC was activated and officially became operational at 12:05 p.m. An OES Emergency Services Officer (ESO) ordered a lockdown of the County/OA EOC compound and instructed construction crews working on the street in front of the compound to leave the area and block the street with heavy equipment. At approximately 12:20 p.m., and upon learning the incident scene was safe enough for a liaison to be deployed, the County/OA EOC deployed an EOC Liaison to the IRC ICP. This was a practice regularly used by OES during County-led or SBCFPD-led response efforts. The EOC Liaison integrated into the ICP as an Agency Representative. The liaison proved invaluable for facilitating information sharing and resource requests between the ICP and County/OA EOC and for providing assistance to the ICP with its application of Incident Command System (ICS) principles. Similar liaisons from OES would later be deployed to the Coroner’s Family Assistance Center (FAC) at the Hampton Inn, the Hernandez Community Center where reunification took place, and the Federal Bureau of Investigation’s (FBI’s) FAC established the following week at the National Orange Show. For more information on those incident operations, see narrative 1.1 Incident Support on page 19. Aiding the County/OA EOC with information gathering was its access to the Computer Aided Dispatch (CAD) system used by the majority of response entities in San Bernardino County with the exception of the City of San Bernardino and the California Department of Forestry and Fire Protection (CAL FIRE). The OES DO first accessed the CAD system at approximately 11:12 a.m. when she was notified of the incident, and from that point forward, including after the EOC’s activation, OES and EOC staff was able to monitor the multiple incidents throughout the County (e.g., IRC, Redlands, Waterman Ave. gun battle) and their progression in real time. This is a protocol employed by the OES on a daily basis. During its activation, the County/OA EOC served a dual purpose as traditional County/OA EOC (supporting County government response efforts and all political subdivisions within the geographic county) and municipal EOC (providing direct support to the City of San Bernardino ICP/field responders), compared to the City of Redlands, for example, that activated its EOC only to support the ICP associated with activities at the perpetrators’ Redlands’ residence. At Narratives and Analysis 46 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County the County/OA EOC, agency representatives from the Sheriff’s Department, Inland Counties Emergency Medical Agency (ICEMA), Department of Behavioral Health (DBH), and CalOES were mobilized to fill necessary positions. During its two and half day activation, an average of 26 personnel staffed the EOC each day. Four of those individuals were from ICEMA, which relocated its Department Operations Center (DOC) functions from its primary location to the Medical and Health Branch in the County/OA EOC due to the proximity of the primary site to the active incident scene (just over half a mile west of the IRC across the San Bernardino Public Golf Course). County leadership that convened at the County Government Center, and at one point the Sheriff’s Department Headquarters (i.e., the Assistant Executive Officer [AEO] for Finance and Administration later transitioning to the Chief Executive Officer [CEO]) serve as the Policy Group for the County/OA EOC. When activated, the County/OA EOC reports directly to County CEO as Director of Emergency Services. During this incident, the EOC and County leadership were less integrated than they typically have been during historical incidents per interviewed stakeholders (discussed further in the call-out box beginning on page 49). Other than coordinating eight Coordination Conference Calls (also referred to as CAO Conference Calls), there was little substantive connection between the County OA/EOC and its Policy Group. In San Bernardino County, the EOC has not traditionally provided input on county-level policies or continuity strategies as is the norm in much of California. The Coordination Conference Calls logistically managed by the EOC were primarily used to communicate executive policies and directives rather than facilitate coordination and solicit discussiontypically the role an EOC plays. The calls were successful at getting necessary stakeholders together with little notice to hear instructions from County leadership. However, because access to Coordination Conference Calls could not be securely controlled, the information shared on the calls was watered down. The EOC issued its first Flash Report at 11:45 a.m., which provided information on road closures and areas to avoid. The EOC Flash Reports are intended to provide concise, non-restricted, and actionable information to a broad audience (a few hundred stakeholders throughout San Bernardino County receive the Flash Reports, including elected officials, county departments/ agencies, city, tribal government, and special district representatives, critical infrastructure owner/operators, appropriate State and Federal partners, etc.). Flash Reports are not intended to serve as a comprehensive/detailed Situation Report (referred to in San Bernardino County as a Situation Summary Reportnone of which were issued during its activation for the December 2, 2015 terrorist attack). Over the course of its activation, the EOC distributed eight additional Flash Reports as follows:  (2) 1:50 p.m. (12/2/15)  Identified EOC and Department Operations Center (DOC) activations, school districts under lockdown, road closures and transportation system stoppages, addressed misinformation related to Patton State Hospital, and provided public and media inquiry points of contact.  (3) 2:20 p.m. (12/2/15)  Corrected the media point of contact phone number from the previous Flash Report. Narratives and Analysis 47 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County  O P E R A T I O N A L R E S P O N S E      (4) 4:20 p.m. (12/2/15)  Identified the estimated number of deceased and injured, EOC and County DOC activations, government office closures and lockdowns, the Hampton Inn reunification center, event cancelations by the City of Fontana, instructions for accessing resources via the County/OA EOC, and an expanded list of public and media inquiry points of contact. (5) 8:50 p.m. (12/2/15)  Updated estimates of the number of deceased and injured, updated reunification information to include the Hernandez Community Center, provided press conference information, City EOC status levels, and crisis counseling locations and points of contact. (6) 9:00 a.m. (12/3/15)  Updated estimates of the number of deceased and injured, identified Incident Management Team (IMT) deployment to the IRC ICP, updated the status of road closures, City EOC activation levels, provided a Coroner Division public inquiry phone number, and a list of complete and partial closures of County departments. (7) 4:00 p.m. (12/3/15)  Updated road closures and County department closures, provided additional crisis counseling locations and points of contact, expanded public inquiry contact numbers, directed readers to victim/witness resources from the District Attorney’s Office, and provided vigil event information. (8) 8:15 p.m. (12/3/15)  Updated the status of City EOC and County DOC activations, provided information on the United Way Relief Fund, and updates regarding the incident scene in the City of Redlands. (9) 6:05 p.m. (12/4/15)  Provided a brief summary of actions taken by the County/OA EOC and other County departments, the status of the County/OA EOC and County DOC deactivations, a cautionary message regarding hoaxes/conspiracy theories/rumors, and a status of County government re-openings. Over the course of its activation, the County/OA EOC also coordinated the following resources in support of field operations. Unless otherwise noted, the resources/services were provided by County departments or existing contracts through County departments. All requests were filled within the OA and none were elevated to the CalOES Southern Region.  Canteen service for the Hernandez Community Center reunification operation provided by the American Red Cross (ARC).  County Fire Incident Management Team (IMT) deployed to the IRC ICP.  Mapping support to the IRC ICP.  Portable lighting for the incident location and IRC ICP.  Fuel for generators and vehicles.  Mechanics and vehicle services.  Laptop computers for the IRC ICP.  Internet connectivity and information technology (IT) support for the IRC ICP. The County/OA EOC uses a web-based emergency management information system, which runs on County Information Services Department (ISD) infrastructure. After the attack, ISD bandwidth was taxed during the incident because of the number of people trying to stream incident coverage over its network. As a result, the EOC’s use of the web-based system to Narratives and Analysis 48 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County gather, manage, and disseminate information and facilitate resource requests was dramatically reduced. Per OES staff, this was the first time in memory they recall the otherwise reliable ISD network being overtaxed.16 At approximately 10:00 a.m. on December 4, 2015, the IRC ICP tasked the County/OA EOC with developing a strategy for reuniting evacuated IRC individuals with their personal property and vehicles left behind. The County/OA EOC developed an action plan and was standing ready to implement said plan when, at approximately 5:00 p.m., the EOC Director (the OES ESM) was contacted by the FBI via the EOC Liaison at the ICP. During the call, the EOC Director was told to cease all activities (including those related to the return of personal property and vehicles) and immediately deactivate the EOC as the FBI would be handling all activities since the transition of command from the SBPD to the FBI at 3:30 p.m. that day. After consulting with the County CEO, the EOC Director complied with the FBI directive and the EOC was deactivated at 5:30 p.m. EOC personnel reported the abrupt stop to EOC activities as a result of federal involvement was jarring. They voiced frustration about feeling unable to complete their mission or support forthcoming efforts for which the County/OA EOC and OES had detailed plans, capabilities, and experience. Upon deactivating, ICEMA representatives present at the County/OA EOC coordinated a well-received Critical Incident Stress Debriefing (CISD), which EOC responders participated in that evening before departing. After its deactivation, OES would go on to support the County’s cost recovery efforts (discussed in narrative 6.6 Cost Recovery/Reimbursement on page 157), ongoing Proclamations of Local Emergency (discussed in narrative 2.3 Proclamation(s) of Emergency on page 53), the PostIncident Coordination Group, and other assignments. Enhancing the County/OA EOC Role… Per National, State, and industry standards and practices, the County/OA EOC was underutilized during the response to the December 2, 2015 terrorist attack. This can be attributed to two primary factors exhibited from both within the County/OA EOC and among other County departments/agencies/offices. First, a majority of those involved applied an assumption that “this incident is different” and therefore believed standardized, proven, and historical protocols do not apply or must be modified. And second, the County and the EOC itself exhibited only a partial understanding of the potential role and value of EOCs in holistic emergency management (e.g., support, coordination, communications, information management, resource management, incident/resource prioritization, policy facilitation), including during nontraditional emergencies such as the terrorist attack. San Bernardino County has a history of emergency incidents, including major wildfires, landslides/mudslides, flooding, earthquakes, water quality emergencies, and atypical law enforcement events such as the 2013 Dorner attacks and manhunt. Most stakeholders interviewed as part of this assessment commented that the County typically demonstrated 16 The web-based system used by the County for essential communications with hospitals was also affected by the number of users attempting to watch streaming coverage of the incident on County networks. Narratives and Analysis 49 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County more effective information sharing and coordination via the County/OA EOC than was exhibited during this incident. O P E R A T I O N A L R E S P O N S E When queried about the role of the EOC during this incident, the three (3) most senior County executives commented that the terrorist attack was not a traditional emergency and that the incident itself belonged to the City of San Bernardino not the County. As a result, they saw no primary role for the County/OA EOC beyond monitoring situations and assisting with resources. This sentiment was echoed by many department representatives, including some from more traditional public safety backgrounds. There was only a limited understanding of the County EOC’s role as OA administrator supporting all political subdivisions in the County boundaries, its unique “backfill” relationship with the City of San Bernardino, and emergency management’s role in more broad resilience missions (beyond incident support) such as continuity of operations, policy facilitation, mass care/reunification, public information, and mutual aid/ assistance for non-traditional public safety functions. For example:  The IRC ICP (under Unified Command with the Sheriff’s Department) did not request support from the EOC to support IRC evacuees that were congregated at the San Bernardino Public Golf Course before transport to the Rock Church for witness interviews. Likewise, the IRC ICP did not request the EOC’s support with the management of reunification/release efforts at the Hernandez Community Center. Both of these are mass care and reunification functions typical of EOC involvement in California. That engagement did not change until the County Fire IMT, whose members had a greater understanding of the potential role of the EOC, integrated with the IRC ICP late in the night on December 2, 2015.  OES has a standing responsibility for managing continuity of operations (COOP) planning efforts among County departments/agencies and vetting Department Emergency Operations Plans (DEOPs), which are expected to contain continuity strategies. The CAO did not directly solicit OES or EOC input when closing government offices, developing directives for maintaining essential functions, or determining how those functions might be maintained and what resources may be needed to do so. Nor did OES or the EOC willingly offer input on these and other subjects when given an opportunity during the CAO Coordination Conference Calls.  Some information collection functions typically housed in an EOC were subsumed by the CAO without also adopting the associated information dissemination or interagency coordination functions. As a result, many departments stated coordination among departments was not facilitated by the CAO as would be the norm via the EOC. Information was received and used by the County Executive Management Team, but information essential for situational awareness and department-level decision-making and coordination was not distributed out.  The FBI connected with San Bernardino County Human Services to establish its Family Assistance Center (FAC), which operated from December 9 - 11, 2015. County Human Services did not have a FAC plan yet OES did. The FBI could not have been expected to know the capabilities of San Bernardino County at the time and arrived with the assumption it would need to lead all efforts in the absence of local capabilities. However, County Human Services or others in the County aware of the FAC did not direct the FBI and Human Services to OES, which had FAC capabilities. Narratives and Analysis 50 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County o It’s important to note, since the December 2, 2015 terrorist attack, the OES has gone on to forge a stronger relationship with the regional FBI office in Riverside, CA. Through multiple meetings, the OES and FBI have shared information regarding their capabilities so future assumptions about capabilities, or the lack thereof, can be avoided. OES representatives were encouraged by the growing relationship between the two entities and anticipated a more collaborative effort in the future. The OES has now added an Agency Representative “seat” in the County/OA EOC for the FBI and a Memorandum of Understanding (MOU) was in development between the two at the time of this report. Decisions were made at the County/OA EOC, regarding information related to this incident being more sensitive than normal because County personnel were affected and FBI involvement created concern about the mishandling of what might later be construed as confidential or classified information. In most cases, the redaction of information could have been limited to the names of those directly affected. Instead there was an excessive degree of caution applied to all communications out of concern for upsetting or affecting fellow County personnel which resulted in lack of situational awareness or the sharing of non-actionable, low value information. For example, information safeguarding or redaction led to generic Flash Reports (with limited actionable intelligence) and no daily Situation Summaries were produced (to provide detailed incident information and a chronicle of response and recovery activities). Multiple departments familiar with the role of the EOC were perplexed that the information they are accustomed to receiving from the EOC to inform their decisions and facilitate coordination was not available. As a result, they acknowledged some efforts were duplicated or were not coordinated across departments/agencies, which would have otherwise been facilitated by the EOC. EOC staff made assumptions that the CAO would decide who needs what information since it had partially assumed the information management function, but never discussed or confirmed that delineation of responsibilities with the CAO. For example, both the EOC and CAO were in receipt of a list of the injured victims that had been transported to local hospitals late in the afternoon on December 2, 2015 (more information on this is available in narrative 1.5 Personnel Accountability on page 33). The EOC did not distribute the information to other departments with a need-to-know as it typically would, assuming the CAO would do so, but the CAO did not. At that same time, the Coroner Division was responding at the Hernandez Community Center during reunification. Without knowing which survivors had been transported, Coroner Division staff told every loved one that was not reunited at that location to expect the worst, possibly including the loved ones of survivors. Additionally, the OES regularly offers EOC training, runs exercises, and brings in external training partners to improve EOC preparedness. OES staff boasted of a tremendous amount of County executive support for both emergency preparedness and the EOC. When queried about the level of actual executive engagement in preparedness programs (e.g., training), the OES acknowledged such programs/events are typically attended by designees and not the principles. As an example, OES offers emergency preparedness training for the Board of Supervisors. That training includes the role of the EOC and its association with the Policy Group Narratives and Analysis 51 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L as well as clear instructions for County Supervisors on what to do and avoid during emergency situations (they are also provided a quick reference sheet reinforcing the training for quick reference). The training is offered every two years, with the expectation Supervisors and staff will attend at least once (likely at the beginning of their term or employment). Because of turnover, the course is offered every two years to keep new Supervisors and staff up to speed. The training was perhaps less impactful than anticipated because only two County Supervisors had a vague recollection of it. Likewise, despite acknowledging recent training, many department personnel did not demonstrate those trained emergency coordination skills during the incident. The adage “if you don’t use it, you lose it” may have been applicable. Personnel cannot be expected to possess optimal capabilities or understanding after attendance at one training session without regular and ongoing refresher training and opportunities for real-world implementation. The EOC capabilities in San Bernardino County may benefit from a discussion between the CAO and OES to explore the potential roles of the County/OA EOC in a changing world with new hazards, the definition of an “emergency” requiring EOC activation, the delineation of responsibilities, expectations, and relationship between the two, and actions for fostering greater EOC awareness and process across the County. R E S P O N S E Narratives and Analysis 52 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 2.3 Proclamation(s) of Emergency The legal authority for a political subdivision of the State of California to proclaim a local state of emergency is codified in California Government Code §8630; as part of the California Emergency Services Act (California Government Codes §8550 - 8668). Within San Bernardino County, such authority is delineated in San Bernardino County Code of Ordinances §21.0105. In times of actual or pending crisis, a state of local emergency is typically justified and employed, per State and County code, for one or more of the five reasons below: 1. Empower the Director of Emergency Services (County Chief Executive Officer [CEO]) to organize, control, and direct the efforts and resources of County entities to collectively achieve emergency objectives, including: • Ensuring cooperation between, and coordination of, services and staff. • Adjudicating issues of authority and responsibility. • Requiring emergency service of any County officer or employee. • Requisitioning necessary personnel or materials of any County department or agency. 2. Activate the emergency authorities of the Director of Emergency Services to make and issue emergency rules, regulations, and orders reasonably related to the protection of life and preservation of property (e.g., curfews, restricted/closed areas, price gouging ordinances, restrictions on sales, direction of the allocation of private resources). 3. Access resources necessary for emergency purposes not otherwise available or in a more expedited manner, including: • Providing and/or receiving mutual aid to/from State Agencies and other political subdivisions of the State. • Activating emergency procurement authorities to expedite or avoid typical procurement restrictions. • Requiring and directing the aid of citizens of the County. • Authorizing resource commandeering for the public good. 4. Legal and liability protections to include the amplification of privileges, benefits, and immunities provided by State law for registered disaster service workers to engage citizens of the County or volunteers. 5. Position the County to potentially have eligible costs qualify for State reimbursement under the California Disaster Assistance Act (CDAA) in the event of an associated Governor’s Proclamation of a State of Emergency and/or Federal reimbursement under the U.S. Stafford Act in the event of an associated Presidential Declaration of Emergency or Major Disaster. The County’s Director of Emergency Services (County CEO) signed a proclamation of emergency for the County on December 10, 2015. California law affords political subdivisions of the State up to ten days from the time of the emergency to issue a proclamation. The aforementioned authorities and flexibilities may, in some cases, be permitted in advance of the proclamation and then be retroactively covered. Per State law, the governing body of a political subdivision must ratify the proclamation if not proclaimed by the governing body, within seven days of its original signing. As a result, the Director of Emergency Service’s proclamation was unanimously ratified by the County Board of Supervisors on December 15, 2015. State law then requires the Narratives and Analysis 53 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L R E S P O N S E proclamation to be reviewed and approved for continuation at least once every 30 days until the governing body terminates the local emergency. As such, the proclamation was reintroduced to the Board of Supervisors at least monthly, if not twice monthly depending on the Board’s meeting schedule, until August 8, 2017 when it was terminated. The County’s proclamation was in effect for approximately 20 months and the mandated process was effectively followed the entire time. The reasons cited for the County’s proclamation primarily related to items 3 and 5 in the aforementioned list. First, mutual aid from State and neighboring jurisdictions had been requested and was being mobilized in support of the Department of Public Health (DPH) Environmental Health Services (EHS) Division as early as December 7, 2015. Technically, under the California Emergency Services Act, a proclamation is needed each time mutual aid is activated. This requirement is not typically enforced for smaller day-to-day mutual aid activations across jurisdictions (i.e., among law enforcement or fire/rescue), but is enforced during larger and/or extended mutual aid activations. The County recognized large quantities of mutual aid would be needed for an extended duration (at least until June 30, 2016 as authorized by the Board of Supervisors) to backfill EHS functions. As such, a proclamation was necessary. Secondly, the County wanted to position itself for potential State reimbursement under the CDAA and/or Federal reimbursement under the Stafford Act for “unprecedented response, mitigation, and recovery costs.” Once again, a local proclamation would be necessary to trigger a State proclamation or Federal declaration, respectively, and thereby activate associated cost recovery programs. Although not specifically stated in Board documents, the County’s proclamation was also used to activate the County’s emergency procurement authorities.17 One could also argue the proclamation was used by the CEO to organize departments of the County and their resources to assist with recovery operations (e.g., PostIncident Coordination Group activities, continuity of operations, facility renovations, counseling services, victim liaison services, memorial events, etc.). The Governor proclaimed a state of emergency associated with the terrorist attack on December 18, 2016 in response to the County’s request. The Governor’s proclamation ordered the following:  The California Department of Public Health (CDPH) to assist the County EHS Division in resuming normal staffing levels.18  The California Governor’s Office of Emergency Services (CalOES) to provide assistance to San Bernardino County under the CDAA.  The suspension of fees associated with the disposition of victim remains and copies of death certificates for the next-of-kin. As it stated, the Governor’s proclamation made certain eligible costs available for reimbursement.19 Not knowing the cumulative total cost for response, recovery, and continuity 17 See narrative 2.5 Emergency Procurement on page 61 for more information on how that authority was applied following the terrorist attack. 18 See narrative 5.4 Alternate Personnel on page 131 for more information on how CDPH supported the EHS Division. Narratives and Analysis 54 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County efforts at the time, the County requested that the Governor request a Presidential Declaration of Emergency. However, a Federal declaration was not issued associated with the terrorist attack. Ultimately, it would not have made a difference for cost recovery purposes. Under the Stafford Act, the Federal Emergency Management Agency (FEMA) sets expense thresholds for reimbursement that a jurisdiction must exceed before being eligible for Federal reimbursement. The County’s total cost associated with the incident was ultimately calculated at approximately $22.6 million. In 2016, the County’s threshold for reimbursement was $7,245,345 which was exceeded, but the State’s threshold of $52,528,078 was not exceeded, which disqualified the incident from eligibility for federal reimbursement. Because the County’s need for mutual aid, emergency contracts, and recovery coordination continued through 2017, the County’s emergency proclamation was renewed for as long as it was deemed necessary to facilitate those activities. By August 8, 2017, most of the proclamation’s value had been realized and per State law requiring the termination of proclamations at the earliest possible date that conditions warrant, the Board of Supervisors approved the termination on that date. Additional Information… The cities of San Bernardino and Redlands, being incident sites and serving as the primary responders, also proclaimed local states of emergency for their jurisdictions on December 10 and 11, 2015, respectively. As the administrator for the Operational Area, the County’s Office of Emergency Services (OES) supported the transmission of those proclamations to the State. O P E R A T I O N A L R E S P O N S E 19 See narrative 6.6 Cost Recovery/Reimbursement on page 157 for more information on the application for CDAA associated with the terrorist attack. Narratives and Analysis 55 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L This page is intentionally blank. R E S P O N S E Narratives and Analysis 56 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 2.4 Management Practices and Documentation As the entirety of this report demonstrates, the County was engaged in dozens, if not hundreds, of tasks and activities associated with its response to and recovery from the December 2, 2015 terrorist attack. Some of those activities occurred over the course of only minutes and hours in the immediate aftermath of the incident (e.g., accounting for personnel, addressing immediate media requests, supporting incident operations) and others would unfold over the course of months and years (e.g., psychological support, continuity of operations, employee benefits). Throughout this review process, the authors queried department heads, supervisors, and operations-level staff regarding the tools and practices they employed to select goals, identify and understand needed tasks, make assignments, monitor progress, ensure quality, coordinate with other entities, etc. In the days following the terrorist attack, operations-level staff across the most affected departments and offices generally self-directed actions and tasks amongst themselves or assumed responsibility when a void was identified versus receiving strategic direction from higher levels of authority. As a result, there was some duplication of efforts and lack of coordination across departments. Some assignments fell to staff that may not have been optimal for reasons ranging from skillset, to workload, to psychological condition. Once the Chief Executive Officer’s (CEO’s) Post-Incident Coordination Group20 meetings began on the afternoon of December 8, 2015 some semblance of strategic planning, deliberate assignments, cross-department awareness and information sharing became more solidified and then improved over time. Although some conference calls had been held prior to that, those did not achieve the same level of measured planning. The Post-Incident Coordination Group met weekly, bi-weekly, or monthly through February 8, 2018 on an as needed basis. Participation was augmented as needed (e.g., Sheriff, County Fire, County Counsel, Environmental Health Services), but permanent membership on the Post-Incident Coordination Group included representatives from the following departments:              Behavioral Health County Administrative Office (CAO) CAO Public Information District Attorney Finance and Administration Human Resources Human Services Information Services Land Use Services Office of Emergency Services Public Health Real Estate Risk Management Given the speed at which actions and incidents were moving, few seemed to take notes, keep a log, or track actions and associated progress in the immediate aftermath of the event. For 20 Under the Code of Ordinances (§21.0106), the County has a Disaster Council which focuses on emergency preparedness (e.g., plan approvals, mutual aid agreements). Although its focus is not response, the County may have benefited from activating the Disaster Council, or an equivalent body, to collectively understand issues, impacts, and needs, brainstorm solutions, and delineate assignments and roles. Approximately half (10) of the Disaster Council’s 20 members were represented in the Post-Incident Coordination Group, but initial meetings of the entire group could have helped improve the management of tasks and resources, including the Victim Liaison program and disparate security enhancements that began immediately following the attack (See narrative 6.4 Long-Term Security on page 149 for more information). Narratives and Analysis 57 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L R E S P O N S E example, the authors of this report struggled to clearly define the timeline of events on the day of the incident and those immediately following because most staff did not maintain any records from those days. Most evidence of those days’ events was based on reflection after the fact and there were various conflicting recollections. Although logs/records could have benefited historical efforts like this one, the greater purpose would have been to keep personnel on track, provide reminders of necessary actions or follow-up activities, and ensure against any omissions or duplications of effort. Those departments that activated Department Operations Centers (DOCs) and the County Emergency Operations Center (EOC) appeared to do better establishing objectives, making assignments, and tracking actions and incidents. They had processes and documentation in place for managing those types of activities. These existed as a result of the required application of Incident Command System (ICS) principles, California’s Standardized Emergency Management System (SEMS), and the National Incident Management System (NIMS). Use of these tools and practices, or equivalents, may have been of value to other County departments and agencies involved in response and recovery activities even if those were administrative in nature. This narrative is not to imply that any efforts failed or were overlooked as a result of the lack of immediate management structure, but opportunities for improved efficiency and enhanced effectiveness were likely. Although notes from Post-Incident Coordination Group sessions recorded encouragement for those present to take notes and keep logs, County executives felt a more formal approach was necessary for all departments. As a result, on January 19, 2016, the CEO issued a memorandum to Elected Department Heads, Assistant Executive Officers, the County Chief Operating Officer, County Chief Financial Officer, Deputy Executive Officers, and Department Heads to initiate a formal incident documentation effort, stating: “As we continue the transition from emergency response to reporting and documentation, as previously requested, I ask that you continue and intensify the tracking of event-related activities to date and on a go-forward basis. …I’m asking that you begin the process of recording your event-related actions and responses, and that you ask the same of your staff. For me personally, I found the retracing of my steps difficult so I encourage you to start as soon as possible so as to not lose invaluable data and information. Capturing this information may allow the County to seek out multiple sources of reimbursement for our costs resulting from the incident and will be critical to the long-term endeavor to create a historic and best-practices document.” Recognizing the need to now collect the information departments were encouraged to maintain, the County Administrative Office (CAO) initiated a collection effort on April 4, 2016, including a new strategy of providing “prompts” much like a survey for departments to respond to. This effort included a request to return documentation to the CAO by April 20, 2016. “Since we are now more than 90 days post-incident, we have attached some documents that may be helpful with your reconstruction and recollection of the Narratives and Analysis 58 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County events taking place during this period. These include the Flash Reports, Message from the Chairman, and an abbreviated County Office of Emergency Services incident timeline. We have also provided a series of ‘prompt’ questions and recommend you review phone and email messages to further assist with your review of the sequence of events, communications and actions you took during this time. • • • • • • • • • • • • Describe when and how you first became aware of the attack and your immediate thoughts and actions. Describe in detail how you implemented your Department Emergency Operations Plan. In what ways did you find the Plan to be effective? Did you find any areas of the plan in need of improvement? If you didn’t implement your Department Emergency Operations Plan, explain why not. What were some of your immediate thoughts and considerations as you began evaluating actual/potential impact of this incident to your staff and/or department operations? When and in what manner did you communicate with staff on 12/2? Summarize the communication. Did you rely on Emergency Contact information and, if so, how did you access that information and was it accurate? How were you notified that most County operations would be closed on 12/3 and 12/4? Did you maintain any department operations on those dates and, if so, which ones? Describe in detail how you determined which services and personnel were ‘essential.’ As you interacted with staff regarding the impact of the attack on them, their colleagues and co-workers, the department and/or the County overall, what are some of the key concerns that surfaced? Describe any concerns or ideas you and your staff felt and/or expressed about security at County facilities and events. Did you receive requests from staff for assistance or counseling support to deal with the attack? If so, describe your experience accessing and utilizing the counseling resources made available by the County. Describe how you responded to questions and contacts from outside groups/individuals and/or members of the public regarding the attack. From whom did you hear? What did they want to know? What did you tell them? How did you acquire the information needed to respond? What kind of feedback did you receive from your staff about the County Family Gathering event? Describe in detail how the County’s response to the incident (e.g., communication, supportive services, media relations, etc.) during the first 30 days could have been better. Describe in detail your “lessons learned” so far and what you would do differently if something like this were to happen again. Please include information about any changes or preparations you have made or plan to make within the next 90 days. Narratives and Analysis 59 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O P E R A T I O N A L R E S P O N S E Please note that we offer these questions only to spur your thinking; we are not suggesting that your response should include only the answers to these questions. Rather, we are interested in knowing how you and your staff were impacted by and responded to the attack. We also want to hear your thoughts, observations and suggestions regarding the County’s overall response...” This request resulted in the submission of forty-three (43) “90-day reports,” most of which used the “prompt” questions to document their efforts. Ultimately another valuable source of incident documentation that emerged was the development of numerous presentations given by County personnel after the event. In the months and years following the terrorist attack, a number of County officials were asked to be guest speakers at local and national events to share their stories from their particular perspectives (Environmental Health Services, Human Resources, legal, management, facilities, etc.). Most of these engagements included PowerPoint or other types of presentation documents which, combined with the logs and documentation reports made up a substantial part of the pre-recorded non-public safety response documentation of the County’s response to the December 2, 2015 terrorist attack. In a continued effort to more formally document the response and recovery actions of the County, the County issued a Request for Proposal (RFP) on August 1, 2016, to hire an independent consulting firm to create: 1) a report documenting and assessing the County’s response to and recovery since the terrorist attack; and 2) a separate guidance document for other jurisdictions or organizations to assist with their planning for, or response to, similar types of emergencies with recommendations gleaned from San Bernardino County’s experience. On January 24, 2017, Critical Preparedness and Response Solutions (CPARS Consulting, Inc.) was selected to perform this work resulting in this document. The Importance of Documentation… As noted throughout this section, the importance of event documentation is critical. As time passes and memories wane, the real-time documentation of events becomes even more important. State and National standards such as the National Incident Management System (NIMS) and California’s Standardized Emergency Management System (SEMS) encourage a concerted effort at the onset of any event to document and maintain event logs, meeting minutes, and overall situational/incident reporting in both the response and recovery phases. More importantly, such logs/records can be used to improve worker efficiency by keeping personnel on track, providing reminders of necessary actions or follow-up activities, and ensuring against any omissions or duplications of effort. Narratives and Analysis 60 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 2.5 Emergency Procurement The ability to rapidly acquire resources necessary for response, recovery, and continuity capabilities is a critical component of an organization’s emergency protocols. Day-to-day procurement processes for most public entities like San Bernardino County are usually governed by State law and County policies and established procedures to ensure a competitive process and the best use of public funds, which can be obstacles to immediate resource acquisition for emergency purposes. This narrative discusses the County’s procedures for emergency procurement and the implementation of said procedures during and following the December 2, 2015 terrorist attack. This narrative does not discuss the application of resources owned by, or previously contracted with, the County that were coordinated by the County Emergency Operations Center (EOC) and are discussed in narrative 2.2 County EOC on page 45. County Procurement Policy San Bernardino County’s procurement policies are codified in County Code of Ordinances §14.0101 through §14.0116. Said regulations are further detailed and associated procedures presented in a variety of County policies, the following of which were most relevant to, and implemented following the December 2, 2015 terrorist attack: Policy #11-04 (Procurement of Goods, Supplies, and Equipment) and Policy #11-05 (Procurement of Services).21 The County’s standard procurement policies in place at the time of the attack were fairly typical of most California political subdivisions with some additional County-specific requirements as summarized below:  Required approval of the Purchasing Agent (County Purchasing Department Director) and competitive bid process for all procurements.22  Approval by the Board of Supervisors for all service contracts valued over $100,000 for a single annual period.  Approval of service contracts valued between $50,000 and $100,000 for a single annual period by the Chief Executive Officer (CEO) or designee.23  Documentation of competitive bid maintained by the Purchasing Department for all procurements above $3,000 for services and $7,500 for goods and by each department/agency/office for those under the respective threshold.24  Non-competitive bid process approved by the Purchasing Agent allowed for acquisitions less than $100,000 under documented special circumstances: availability through only one source, proprietary items or systems, matching system compatibility, manufacturer-direct acquisitions, no functional equivalency, or geographicallyprotected distribution.  Non-competitive bid process approved by the Board of Supervisors allowed for acquisitions greater than $100,000 under documented special circumstances. 21 County Policies #11-04 and #11-05 were revised and combined into an updated #11-04 addressing goods, supplies, equipment, and services on February 14, 2017. The revised policy is more aligned with State of California Government Code and modifies or eliminates a number of San Bernardino County requirements that were in place at the time of the attack, some of which are cited in this narrative. 22 Requirement changed to all procurements above $1,000 in the February 14, 2017 #11-04 policy update. 23 Requirement removed in the February 14, 2017 #11-04 policy update. 24 Requirement threshold changed to $5,000 for both services and goods in the February 14, 2017 #11-04 policy update. Narratives and Analysis 61 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County    O P E R A T I O N A L R E S P O N S E Board of Supervisors approval for any fixed asset acquisition of $10,000 or more beyond those in the currently approved Budget. Maximum contract term of 3 years.25 Standards to ensure the integrity of the selection process. The procurement requirements identified above can be time consuming and cumbersome; something counterproductive in an emergency situation. Foreseeing the needs of emergency circumstances, both the County Code §14.0106 (Emergency Purchases) and County Policies #11-04 and #11-05 provided exceptions to the aforementioned policies. While one may assume every public sector entity would have emergency procurement policies, it is less common than one would anticipate. As a result, San Bernardino County was to be commended for thoroughly codifying the following emergency protocols:  Emergency purchases may be made by any person or official authorized to sign requisitions when: (a) the Board of Supervisors or an official designated by ordinance has proclaimed a local emergency; (b) such item(s) are immediately necessary for the preservation of life or property; and/or (c) the Purchasing Agent or any deputy or assistant authorized to make purchases is not immediately available, and the item(s) are immediately necessary for the continued operation of the entity, and undue delay would cause substantial loss to the County.  Timely approval and confirmation by the Board of Supervisors for the procurement of services above $100,000 and fixed assets above $10,000.26  If the incident prevents the timely submission of the request to the Board of Supervisors, then it should be presented for consideration and approval/confirmation as soon as reasonably possible following the emergency.  Standard procurement policies should be applied to the degree practicable. Implementation following the December 2, 2015 Terrorist Attack A Proclamation of Emergency was signed by the County CEO on December 10, 2015 and ratified by the Board of Supervisors on December 15th. The Proclamation was continued until August 8, 2017. As the above policy exemptions identified, the Proclamation could have automatically triggered the County’s emergency procurement authorities, but action was taken sooner to do so without the Proclamation. As early as Friday, December 4th, the County began to recognize the forthcoming need for emergency procurement authorities. On that day the Board of Supervisors waived the competitive solicitation process and authorized the CEO and Purchasing Agent to issue required purchase orders for emergency repairs and renovations needed for alternate facilities to house relocating Department of Public Health (DPH) Environmental Health Services (EHS) Division functions and coordinate necessary security services. These were authorized under California Public Contract Code §2203527 and §22050.28 25 Requirement changed to 5 years in the February 14, 2017 #11-04 policy update. The $100,000 requirement was applied for the non-competitive procurement of goods, supplies, and equipment in the February 14, 2017 #11-04 policy update. A threshold for Board of Supervisors approval/confirmation for the non-competitive procurement of goods, supplies, and equipment was not codified in policy at the time of the attack. 27 §22035 states “In cases of emergency when repair or replacements are necessary, the governing body may proceed at once to replace or repair any public facility without adopting plans, specifications, strain sheets, or 26 Narratives and Analysis 62 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County At its Monday, December 7, 2015 meeting, the Board of Supervisors officially activated County Code §14.0106 and the emergency procedures in County Policies #11-04 and #11-05. Since the Proclamation of Emergency had yet to be signed, the Board cited justifications (b) and (c) from the previous section to authorize emergency procurement procedures, stating: “…a number of County employees, specifically in the Environmental Health [Division], a division of the County Public Health Department, were victims in the mass shooting. The health and welfare of the citizens of the County of San Bernardino as well as that of County employees is of paramount importance to the Board of Supervisors and the County administration. The Board wants to assure that the important services provided by the Environmental Health [Division] will continue to be provided to the public in the wake of the December 2 tragedy.” The Board then authorized the following during that meeting:  The Purchasing Agent to acquire any goods, services, equipment and personnel needed for the continued operation of the County, including, but not limited to, contracts with other public agencies to provide aid, and contracts with entities to provide personnel and services needed to preserve life or property and provide essential services to the public until June 30, 2016.  To do so without following any of the competitive processes which may have been required by County Policies #11-04 and #11-05.  Present the Board with any items anticipated to exceed $100,000 in value for consideration and confirmation at the next Board meeting.  The Purchasing Agent to render as surplus and dispose of existing furnishings valued at $10,000 or more (including equipment) associated with the repair, preparation, and/or renovation of permanent or alternate facilities associated with personnel relocations. Likewise, acquire or lease unbudgeted fixed assets of $10,000 or more to provide needed services and present such items to the Board for consideration and confirmation at the next closest Board meeting.  Temporarily increase CAL-Card (purchase card) limits as needed for all those authorized to acquire the goods and equipment necessary without following competitive process requirements or additional administrative approvals through January 12, 2016. The County Purchasing Agent immediately took action to implement the emergency procurement procedures. First, the Purchasing Department established a new “department” in its procurement system (ePro) under which all associated emergency acquisitions could be submitted, expedited, and collectively tracked. The Purchasing Agent ensured all relevant department purchasing officers and CAL-Card coordinators would have access to the ePro system for viewing purchase orders, processing payments, and uploading invoices. She also working details, or giving notice for bids to let contracts. The work may be done by day labor under the direction of the governing body, by contractor, or by a combination of the two.” 28 §22050 states “In the case of an emergency, a public agency, pursuant to a four-fifths vote of its governing body, may repair or replace a public facility, take any directly related and immediate action required by that emergency, and procure the necessary equipment, services, and supplies for those purposes, without giving notice for bids to let contracts.” Narratives and Analysis 63 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County dedicated a Lead Buyer to support County departments with all emergency procurements associated with the terrorist attack. Notifications and instructions on the emergency procurement process were then sent in memorandums from the Purchasing Agent to all department heads, County executives, department purchasing contacts, and department CALCard coordinators on December 10, 2015. O P E R A T I O N A L R E S P O N S E Between December 7, 2015 and August 2016, the emergency procurement process was used 46 times for acquisitions totaling approximately $920,000. Procurements were wide-ranging and included:  CAL-Card purchases often less than $100 at grocery stores and office supply retailers.  Cleaning, repair, and/or replacement of emergency services vehicles involved in the response.29  Security personnel and system upgrades.30  Memorial items and Memorial Services (e.g., lapel pins, picture frames, video production, audio/visual support, speaker stipends, food services).  Alternate facility costs (e.g., custodial, construction services, furniture/equipment, moving services).31  Counseling Services provided by Counseling Team International.32  Reimbursement to mutual aid providers that backfilled EHS functions.  Long-term contracted staffing for the EHS Division through the California Association of Environmental Health Administrators (CAEHA).33 The County’s emergency procurement processes appear to have been well positioned and prepared to support the emergency needs of this incident. In addition, the program was effectively optimized and implemented following the terrorist attack. Although emergency procurements were not needed to support immediate life/safety and emergency missions on December 2, 2015as those needs were satisfied with the County’s own resources or existing contractsthe program’s implementation following the incident provides assurances that the program could have been implemented in a moment’s notice had the situation required it. 29 Although replacement vehicles exceeded the $100,000 threshold to trigger Board of Supervisors approval, it was executed under an existing contract (September 1, 2013 through August 31, 2016) with a dealership whose contract value was not exceeded and thereby did not have to be approved separately. 30 Although security system upgrades exceeded the $100,000 threshold to trigger Board of Supervisors approval, it was executed under an existing contract (August 26, 2015 through May 5, 2017) with a vendor whose contract value was not exceeded and thereby did not have to be approved separately. 31 Alternate facility costs exceeded $100,000, and as required, were brought to the Board of Supervisors for approval beginning January 12, 2016. The issue was reintroduced as necessary thereafter (e.g., on April 4, 2016 when funds were reallocated from one alternate site to the other). The renovations of permanent facilities were not pursued under emergency authorities, but under standard contracting procedures. See narrative 6.3 Facility Renovations on page 145 for more information. 32 Counseling services costs exceeded $100,000, and as required, were brought to the Board of Supervisors for approval on March 1, 2016 when the existing contract ceiling was exceeded and again on August 23, 2016 when the ceiling was increased again. 33 Contract staffing costs exceeded $100,000, and as required, were brought to the Board of Supervisors for approval when the contract was executed on March 22, 2016 and again on September 13, 2016 when the value was increased and performance period extended. Narratives and Analysis 64 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 2.6 Addressing the Perpetrator’s Footprint The male perpetrator of the December 2, 2015 terrorist attack was a San Bernardino County employee. He worked for the Department of Public Health (DPH) Environmental Health Services (EHS) Division as a health inspector assigned to food facilities. Inspectors assigned to food facilities perform health and safety inspections on retail food and food handling establishments, which in California result in a Retail Food Inspection Grade of “A,” “B,” or “C” and an associated inspection report. Grade cards and inspection reports are signed by the food inspector and the Grade Card is publicly posted. Almost immediately following the attack, as the male perpetrator’s identity became widely known, dozens of retail food establishments began contacting the County asking that the Grade Cards with the perpetrator’s signature be replaced. In addition, it came to the County’s attention that some individuals were trying to collect the Grade Cards with the intent to sell them online. As the San Bernardino County offices reopened on December 7, 2015, a priority task for the DPH was to replace all the EHS Division’s publicly posted food inspection Grade Cards bearing the perpetrator’s signature.34 To accomplish this task, mutual aid Environmental Health Specialists from neighboring Riverside County engaged in a concentrated effort to replace 368 grade cards at food establishments throughout San Bernardino County that included evidence of the perpetrator’s work. Twenty-two (22) Riverside County inspectors began the process on December 10th. By Friday, December 12th, 350 Grade Cards had been replaced. The remaining 18 cards, which belonged to food establishments significantly farther away in the high desert, were replaced on December 22nd. In a complementary effort, EHS staff removed the perpetrator’s name from records associated with his inspections that were posted and searchable on the DPH website. The perpetrator had a workspace alongside his colleaguesmany now deceased or injured because of his actionswithin the EHS offices in the County Government Center at 385 N. Arrowhead Avenue in San Bernardino. Immediately after the incident, law enforcement and the Federal Bureau of Investigation (FBI) secured the perpetrator’s cubicle, declared it a crime scene, and ultimately removed all the belongings.35 When loved ones of the victims were allowed to visit the EHS offices prior to their demolition for renovation, the perpetrator’s cubicle, which had already been emptied of personal effects by the FBI, was blocked off and staff attempted to route loved ones away from it. As the EHS offices were temporarily relocated to the 172 West 3rd Street alternate facility, the floor plan of cubicles was intentionally crafted to mirror the configuration at the County Government Center with the exception of the perpetrator’s workstation. A deliberate effort was made to eliminate the equivalent location of the perpetrator’s cubicle at the alternate facility. While later planning the return to renovated offices at the County Government Center, the location of the perpetrator’s former workstation (based on its position relative to structural support columns that could not be moved) was made into a storage area so no employee’s new workstation would be placed in the same area. 34 Authority to replace Grade Cards and update inspection reports was allowed under the authorities of the County Health Officer, specifically under the State’s retail food code and the public beach and swimming pool codes. 35 The FBI also requested all of the male perpetrator’s employment records from the Human Resources Department. Narratives and Analysis 65 O P E R A T I O N A L R E S P O N S E Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Since the attack, efforts have been made throughout the County to direct attention to the victims and not recognize the male perpetrator, just as this report avoids addressing the perpetrator by name. County documentation, memorials, displays, and remembrance events have all been designed to focus on the victims. O P E R A T I O N A L As a provider of emergency and social services, addressing the perpetrator’s footprint also meant rising above the potential for personal biases and animosities toward the perpetrator for many County personnel. For example, staff at the Coroner’s Division of the Sheriff’s Department investigated the perpetrator’s death, transported, autopsied, and released the remains of the perpetrator to the next-of-kin with the same level of professionalism and respect they paid to the victims and all others they serve. Likewise, the Department of Public Health coordinated security for the safety of both staff and the family of the deceased perpetrators when they came to retrieve the official death certificates from DPH’s Vital Statistics Registration Office. In addition, the male and female perpetrators were the parents of an infant child. Once both perpetrators were deceased, the child became the ward of the San Bernardino County Department of Children and Family Services (CFS). Staff at CFS was admittedly conflicted about who was to take on the case. Within the same Department, staff was concurrently serving as Victim Liaisons to survivors. But as duty and professionalism demanded, the child was provided with all the care and services due a ward of the County until she was eventually placed with relatives. Other occurrences of attacks on co-workers may have similarities to the issues San Bernardino County confronted when addressing the perpetrator’s footprint, however, having the integrity that San Bernardino County demonstrated to go about professionally servicing the perpetrator and his/her family is less common. R E S P O N S E Narratives and Analysis 66 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Category 3: Communications Communication is perhaps the most integral part of every organization’s ability to effectively respond to emergencies, manage impacts and crises, and achieve a new normal. Communication and coordination is also at the heart of every situation and present in all the activities which San Bernardino County was engaged following the December 2, 2015 terrorist attack. As such, it is weaved into every narrative in this report. This category of the report addresses two particular aspects of communications: 1) the resources and processes facilitating information sharing/situational awareness; and 2) the resources and processes that enable the distribution of information. In some cases, the two overlap as one entity’s distribution of information provides for another’s awareness. The four narratives in this section will explore the County’s account of becoming aware of the attack and its magnitude, the County’s ability to internally gather and distribute information within the County, as well as the process employed to relay information to the public. 3.1 Initial Notification The initial notification of the terrorist attack was received at the County Administrative Office (CAO) on December 2, 2015, at 11:20 a.m. The Executive Secretary to the Director of the Department of Public Health (DPH) called the CAO Executive Assistant, relaying a message from the DPH Director and Assistant Director to the Assistant Executive Officer for Human Services. The DPH Executive Secretary indicated there was a shooter at the Inland Regional Center (IRC) where the DPH Environmental Health Services (EHS) Division was holding an event and relayed the severity of the incident from eyewitness accounts provided by the DPH Director and Assistant Director. Approximately one (1) minute later, the CAO Executive Assistant sent the below message to the Chief Executive Officer (CEO) and the Chief Operating Officer (COO) who were both out of town. This first message inaccurately minimized the severity of the incident and led to additional misinformation regarding the situation. As narrative 1.2 Evolution of Situational Information on page 23 explained, it is not unusual for misinformation to thrive under these conditions. Assumptions, a misunderstanding, or failing to verify or vet content can easily lead to misinformation. In this case, the email from the CAO Executive Assistant misclassified “all staff” at the event as being fine, when it had been relayed from the DPH Executive Secretary that only the DPH Director and Assistant Director had identified themselves as safe. The email stated: “County EHS is having an event at IRC; [DPH Assistant Director] called [DPH Executive Secretary]…to advise an active shooter at subject location. Building is in lock-down. [DPH Director, Assistant Director] and staff are fine. Sheriff’s Department there.” Upon hearing the above message, the CAO Deputy Public Information Officer (PIO) who was in the office with the Executive Assistant staff then emailed the Board of Supervisors, CEO, COO, and primary PIO with the following similar message at 11:27 a.m.: “…there is an active shooter at the Inland Regional Center in the 1600 block of S. Waterman Avenue in San Bernardino. County EHS is having an event at the center and the building is on lockdown but [DPH Assistant Director] is reporting he and [DPH Narratives and Analysis 67 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Director] and staff are OK. We are following developments and will update when we have more information.” Approximately one (1) minute later, the CAO Executive Assistant received another call from the DPH Executive Secretary providing up-to-date information on the situation. Fortunately, that follow up call put a quick end to the previous misinformation, which may have otherwise spread further. While still in conversation, the CAO Executive Assistant sent the following email to the CEO and COO at 11:28 a.m., which was a response to an email from the CEO inquiring as to whether all County employees were in a secure location: C O M M U N I C A T I O N S “[DPH Director] was able to leave with a group of employees. [DPH Assistant Director] locked in room inside with other staff. [Some] of our employees have been shot. On phone now getting this. Two gunmen with machine guns started shooting. Seemed like typical terrorist attack per [DPH Director] says [Executive Secretary to DPH Director]. Got away in van. Looking at building.” By 11:40 a.m. the news media was reporting the incident. Immediately, the phones at the CAO began to ring non-stop. The CAO Executive Assistant and three (3) other Executive Assistants from the CAO self-organized to field the calls. One Executive Assistant was assigned to take media inquiries (in support of the CAO Deputy PIO),36 another took calls from concerned family members/loved ones/colleagues, and another fielded all other calls such as those from department heads asking what to do. The Executive Assistants were given minimal instruction and used their years of experience and institutional knowledge to triage calls, maintain call logs, provide only appropriate information to each caller, and maintain a level of information control during what was an otherwise chaotic situation. They continued to field those calls until approximately 7:30 p.m. that evening and, for the next two days, two of them continued to do so for nearly ten hours each day. In the initial hours, information continued to be uncertain and sometimes inaccurate. The CAO staff was able to start receiving credible information from the Assistant Sheriff, who made regular calls to the CAO, as well as additional information from the on-site Deputy Sheriff at the IRC. Most of this information was related to security. For more information see narrative 1.3 Immediate Security Measures/Lockdown on page 25. The first official “County” notification disseminated beyond the CAO was sent to the Board of Supervisors, County executives, and department heads at 12:04 p.m. from the CEO, who was emailing from the Dallas/Fort Worth Airport, instructing staff as follows: “Due to the incident at subject location [referenced subject line: Shooting Incident at Inland Regional Center on South Waterman Ave., SB], we are advising County staff stay indoors [sic] and not leave their buildings.” 36 For more information see narrative 3.4 Public Information on page 76. Narratives and Analysis 68 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County By that time, it was assumed most County staff were aware of the incident because of media coverage, word-of-mouth, concerned phone calls, or another source. The next official Countywide notification was an email from the CEO to the Board of Supervisors, County executives, department heads, and executive assistants at 1:48 p.m. instructing staff as follows: “County employees in buildings within the City of SB who are not responding to the incident are released from work for the remainder of the day.” Following both the first and second email from the CEO, most department heads then relayed the messages to their staff in-person, via email, or via radio as appropriate. At 2:00 p.m., the Acting CEO (Assistant Executive Officer [AEO] for Finance and Administration) held a conference call with all department heads to share what she knew about the status of the terrorist attack, subsequent response actions, and to reiterate instructions to release County staff. The call was coordinated by the County Emergency Operations Center (EOC); the notification of which would have also alerted department heads to the incident if they were previously unaware. Postmaster email notices were sent from the Board of Supervisors at 3:10 p.m. followed closely by a notice from the CEO at 3:24 p.m. notifying all non-essential County employees working in the City of San Bernardino of their release for the day as a result of the attack.37 37 Postmaster is the name for San Bernardino County’s mass emails that are sent to all County employees. Narratives and Analysis 69 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O M M U N I C A T I O N S This page is intentionally blank. Narratives and Analysis 70 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 3.2 Emergency Contacts As part of the effort to account for personnel,38 the County Administrative Office (CAO) tried to make contact with the designated emergency contacts for employees believed to be in attendance at the Department of Public Health (DPH) Environmental Health Services (EHS) Division event at the Inland Regional Center (IRC). Based on the information in the County’s Employee Management and Compensation System (EMACS), the Human Resources Department tried to contact associated emergency contacts. In most cases, the County’s emergency contact information proved to be inaccurate and out-of-date so many emergency contacts could not be reached. While select departments, including the EHS Division, had up-to-date and useful emergency contact information that they maintained, most departments reported their internal emergency contact information had not been maintained. Department representatives often noted that many employees were not willing to share their own personal contact information or that of loved ones/emergency contacts with the County. The reasons for this were not further investigated as part of this report. In either case, much of the emergency contact information that would have been valuable during the incident was largely unavailable or inaccurate. A New Process for Emergency Contacts… Soon after the attack, the County instituted a policy requiring personnel to update emergency points of contact and associated contact information to coincide with the annual renewal of employee benefits. As a result, the County’s EMACS should now contain up-to-date emergency contacts and contact information for each employee, reviewed at least annually. 38 For more information see narrative 1.5 Personnel Accountability on page 33. Narratives and Analysis 71 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O M M U N I C A T I O N S This page is intentionally blank. Narratives and Analysis 72 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 3.3 Mass Notification/Communications At the time of the attack, the County did not have a mass notification system capable of automatically and simultaneously utilizing multiple voice, text, and email options to contact its nearly 22,000 County personnel. In most cases, for instance, the County’s standard approach for notifying employees was initial emails to department heads who in turn disseminated messages to their personnel as appropriate through means available to their department. In the aftermath of the attack, multiple critical policy decisions were made by executives. Notification of pertinent information to County employees during the attack happened in a number of ways. Some New Mass Notification Systems… employees received Immediately after the attack, some departments notification directly from independently procured mass notification systems for department heads or through their department’s use. On September 12, 2017, the Board supervisors, while others of Superiors adopted County policy #13-08 establishing the learned through social media Employee Emergency Notification System (also known as and website posts. All the “SB Safe Employee Alert System”) and associated employees with a County operational guidance for use county-wide. The SB Safe email address received Employee Alert System can send text messages and/or Postmaster emails and had emails to County employees in the event of an emergency access to CountyWire blog that potentially threatens the health and safety of County posts, but those only worked if employees. Employees participate in the program by employees had access to and entering a mobile device number for text alerts and/or up were monitoring their email to two email addresses for email alerts. These modes of accounts. Some employees, contact are entered in the County’s payroll and having no means to be compensation system (EMACS) in a similar fashion as reached when not at their emergency points of contact. Employees are now asked work computers or when not and reminded regularly to update their contact physically present, did not information. The first widespread test of the SB Safe receive essential notifications Employee Alert System was successfully conducted on (e.g., instructions for nonOctober 19, 2017 as part of the Great California Shakeout essential personnel not to drill with a follow up in March 2018 during the change to report for work on December rd th Daylight Savings Time. 3 and 4 ). Modes of Communication and Information Dissemination Communication with affected Department of Public Health (DPH) and Environmental Health Services (EHS) Division staff and affected loved ones immediately following and in the months after the attack was complicated for two main reasons: 1) Some communication devices had been left at the Inland Region Center (IRC), in purses and on tables, when people evacuated the premises in the chaos of the moment. Many of these items were damaged by the sprinkler system that had gone off in the room where the attack occurred or became evidence and were not released for some time while the law enforcement investigation was underway. Any communication with these units went unanswered. Narratives and Analysis 73 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 2) In addition, the tenacious media, in their desire to speak with victims’ families and survivors, acquired personal phone numbers, email addresses, and home addresses; and began hounding victim’s loved ones and survivors both in-person and remotely. As a result, many individuals turned off or stopped answering their phones, emails, and stopped reading their mail in an attempt to stop the onslaught. C O M M U N I C A T I O N S As the County, including the EHS Division, DPH, the County Administrative Office (CAO) and Human Resources (HR) Department among others, needed to communicate with the victims’ families and survivors, the above issues limited the modes and speed of communications. Those County departments and divisions had to resort to the following tactics:  Personal Networking – Many EHS employees used their personal relationships and personal contact information to relay information to each other. This initially included invitations to private gatherings at a personal residence, knowing who had been physically impacted, or suggestions for handling the media.  Social Media – An EHS employee created a private Facebook page for EHS staff only accessible via invitation. Information on funerals and other pertinent information was posted there. For nearly six months, EHS would email the Facebook page creator to request postings for upcoming events.  Website – The County created a password-protected website (“EHS Support Site”), which EHS staff then maintained. The access information was emailed and sent through regular mail to all EHS employees soon after the attack.  Mailings – The County developed a mailer template. The CAO would provide EHS with relevant information needing to be disseminated and EHS would add the information to the template, reproduce, and mail the materials to applicable EHS employees. All mailed information was also emailed and then posted to the “EHS Support Site.”  Email – All EHS employees retained their ability to access their work email accounts from home. This helped in some situations to provide employees with a continuous link to relevant information.  Victim Liaisons – County Victim Liaisons that worked directly with victims and staff hand delivered written correspondence or verbally passed on critical information.39 These actions, however, were not foolproof. Some intended recipients did not check their mail, others chose not to have a Victim Liaison assigned, some employees claimed they did not get access to the password-protected website, and others were not aware of the online resources. While labor intensive, this multi-faceted approach to information sharing was generally successful. It respected confidentiality and utilized the trusted channels and sources of information with which employees were most comfortable. Reaching Intended Audiences… The information needs of affected families and employees were diverse. Individuals were receptive to information at different times, via different modes, and from different sources. While the County attempted to provide messages multiple times and through multiple channels 39 For more information see narrative 4.1 Victim Liaisons on page 87. Narratives and Analysis 74 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County (e.g., website, Victim Liaisons, emails, and mailers), it acknowledged that did not always mean the messages were received or understood. In some cases, victims and/or affected families desired more information than the County was able to share because of confidentiality or the sensitive nature of the topic. As a result, some victims felt the provision of critical information was overlooked. In other cases, information was received, but victims and families voiced frustration about the source; namely citing that more information was not coming directly from the Board of Supervisors, Chief Executive Officer, or Chief Operating Officer, but rather Department personnel. The County also commented that information was not always interpreted by affected families and survivors as the County intended. Communications under such situations are challenging and the County learned significant lessons regarding how, when, and what to communicate when emotions are high, topics are sensitive, and time is of the essence. Narratives and Analysis 75 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O M M U N I C A T I O N S This page is intentionally blank. Narratives and Analysis 76 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 3.4 Public Information The County Administrative Office (CAO) had two full-time positions dedicated to public informationa primary CAO Public Information Officer (PIO) and a Deputy PIO, who worked together as a team. The typical responsibilities of the CAO public information team were to coordinate and support public information, media liaison, and external and internal communications, provide advisory services, serve as spokesperson, and manage social media, and websites specific to the CAO, the County’s executive leadership within the CAO, and public information on behalf of the Board of Supervisors. Many County departments had their own public information officers or teams as did each County Supervisor. Each of those had the autonomy to coordinate and release information respective to their departments or offices. The County Office of Emergency Services (OES) could activate a Joint Information System (JIS) to coordinate public information efforts and messaging across County departments and with other members of the Operational Area when conditions warrant. The OES did not activate a JIS or physical Joint Information Center (JIC) during the response to the December 2, 2015 terrorist attack. As a result, this report will address only the public information activities that occurred at the County-wide level via the CAO. However, multiple department PIOs supported the management and release of emergency information to the public during and immediately following the terrorist attack; most notably the Sheriff’s Department public information team. As those efforts were associated with the tactical public safety response to the incident, they are not addressed in this report, but can be found in The Police Foundation’s evaluation of the public safety response commissioned by the U.S. Department of Justice.40 At the time of the attacks, the CAO PIO had served the County for over sixteen (16) years, while the Deputy PIO had been on the job for two and a half (2½) years. However, the two had a close working relationship that greatly enhanced their ability to deal with the incredible demands placed on them the day of the attacks and into the following weeks and months. During that time, the CAO PIOs worked individually and as a team to: monitor the attacks to gain clarity on the details surrounding the events at the IRC; keep the CAO, County Executives, and Board of Supervisors informed, and assist them with crafting public statements; disseminate accurate information to families and co-workers seeking answers; disseminate accurate information to all County employees as events unfolded; and keep the media informed of County-level efforts (including retweeting much of the information from law enforcement and first responders). The Deputy PIO worked with other CAO staff members to help monitor traditional and social media and attempt to vet information. The Day of the Attack News of a possible active shooter in the City of San Bernardino first appeared on Twitter at 11:14 a.m. The City of San Bernardino Fire Department (SBFD) tweeted "SBFD responding to reports of 20 victim shooting incident in 1300 block of S. Waterman." Because of her regular monitoring of information sources related to the County, the Deputy PIO saw the tweet immediately. 40 “Bringing Calm to Chaos: A critical incident review of the San Bernardino public safety response to the December 2, 2015, terrorist shooting incident at the Inland Regional Center” is available at: https://www.justice.gov/usaocdca/file/891996/download Narratives and Analysis 77 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County The Deputy PIO immediately contacted the primary CAO PIO and the Chief Operating Officer (COO) who were with three (3) of the Board of Supervisors in Monterey, California attending the California State Association of Counties (CSAC) Conference. For the rest of the day, until the PIO returned to San Bernardino at approximately 5:00 p.m., the Deputy PIO and PIO were in regular contact with each other via text message, phone calls, and email. The Deputy PIO was also communicating with the Sheriff’s Department, Department of Public Health and other Board staff members. C O M M U N I C A T I O N S At 11:18 a.m., the San Bernardino County Sheriff’s Department tweeted "Hard closure at Orange Show Rd/Waterman and Park Center Circle in San Bernardino. AVOID THE AREA POLICE ACTIVITY." A few minutes later, the Deputy CAO PIO received an email from the CEO’s Executive Assistant stating the Environmental Health Services (EHS) Division was having an off-site meeting at the Inland Regional Center (IRC) where the shooting had occurred. The email misstated that EHS staff was unharmed when it had only been relayed that the DPH Director and Assistant Director who were present during the attack were safe. Twenty minutes later it became apparent to the Deputy PIO that County personnel had been targeted, when she received information from EHS staff members stating “one of our employees got shot in the back but not killed” and “[DPH Director] reports two men with machine guns started shooting” though at that time, the Deputy PIO still had “no reports of any employees dead.” At 11:48 a.m. ABC News sent a Tweet that twelve (12) people were dead. By 11:50 a.m. news outlets were reporting deaths at the scene. The Deputy PIO forwarded the information about the shooting at the IRC to the primary CAO PIO and COO in Monterey, as well as the CEO who was on-board his connecting flight to Washington, DC from Dallas, Texas. The CEO asked the Deputy PIO to keep him informed as events unfolded. The first media calls to the CAO PIO office were received at approximately 11:43 a.m. The CAO PIO's office received over one hundred (100) calls in the next half hour. The Deputy PIO told CAO staff receiving calls to direct all news media to the CAO’s Twitter handle, @CountyWire. 41 This decision slowed the incoming phone calls, but according to the Deputy PIO, the media was frustrated because she did not have time to post much information to Twitter until midafternoon. In the hours following the attack, while law enforcement was still focused on tracking the perpetrators, the CAO PIOs were pulled in different directions. The Deputy PIO was working to confirm whether the victims were County employees and coordinating with hospitals to determine the location of the injured and deceased. Meanwhile in Monterey, the CAO PIO was helping to coordinate logistics for an emergency Board of Supervisors (BOS) meeting, drafting and disseminating press releases on behalf of the BOS, and supporting efforts to get County officials back to San Bernardino. 41 At the time of the incident, the County Twitter handle was @CountyWire. The County transitioned to a new Twitter handle, @SBCounty, in April 2016. Narratives and Analysis 78 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County At 12:06 p.m., the CAO's first tweet about the incident went out: "We are monitoring reports from law enforcement about today's shooting and do not have any information to release at this time." By 12:15 p.m. (roughly an hour after first becoming aware of the attack), the CAO PIO office began receiving calls from family members looking for information about their loved ones believed to have been at the scene of the attack. This quest for information became a growing problem because she did not yet have definitive information to share, but the people seeking information were also her co-workers and friends, making it more difficult to not be able to answer them. At 12:31 p.m., the CAO Deputy PIO alerted the media that the Board of Supervisors would be having an emergency meeting in closed session at 1:00 p.m. during which they would receive a briefing from the Sheriff. This meeting was attended by the CAO PIO. The first official statement from the Board of Supervisors was released via Postmaster and Twitter at 3:10 p.m.42 The statement, from the Chairman of the Board of Supervisors, announced that County employees who worked within the City of San Bernardino were being sent home, but the County still had not officially confirmed that their employees were among the victims. The shoot-out with the perpetrators occurred at 3:15 p.m. At 3:45 p.m., the Deputy PIO received a call from NBC asking to confirm if the perpetrator was a County employee. This was the first time the Deputy PIO heard the perpetrator’s namethere had been no prior thought that one of the shooters could be a County employee. At this time, the CEO, COO, primary PIO, and all executive staff were en route back to San Bernardino. The Deputy PIO decided not to speak with the media again until she had communicated internally with her colleagues. At 3:55 p.m., the CAO PIO released a statement on Twitter confirming that the victims of the attack were County employees: “This afternoon several County employees were inside the Inland Regional Center building in San Bernardino when the shooting occurred. Because this is an active law enforcement investigation and out of respect for the victims and their families, the County will not be releasing any more information at this time about our employees. The County will be providing a multitude of services to help our employees and their families with this horrible tragedy.” By 5:00 p.m., the primary PIO was back in San Bernardino, physically working alongside the Deputy PIO. She briefed him on the alleged identity of the shooter. During the next several hours, the PIO and Deputy PIO continued to work to verify the facts of the shooting and work with the CAO to identify the victims. 42 Postmaster is the name for San Bernardino County’s mass emails that are sent to all County employees. Narratives and Analysis 79 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Just before 9:00 p.m. the PIO and Deputy PIO were told to evacuate the Government Center because of a possible bomb threat. They relocated to the Sheriff's Department along with CAO leadership, where the Board of Supervisors was about to hold another emergency Closed Session. At 10:30 p.m. the Supervisors emerged from the meeting and announced that all County offices would be closed for the remainder of the week with the exception of essential services. The CAO PIO posted this announcement to Twitter, but then rescinded the tweet after being told it was confusing. The decision was made that the notice of the closures would occur within each department, with information flowing top down from the department head to the rest of their staff. C O M M U N I C A T I O N S The CAO PIO and Deputy PIO worked with the Chairman of the Board to prepare one final statement. Around midnight, the Chairman issued the following statement on Twitter, Facebook, and CountyWire:43 “Words cannot describe the sadness and horror the Board of Supervisors feels in the wake of this unimaginable tragedy. The county’s role and focus at this point is providing support and safety to our employees, their loved ones, and our community. For that reason, the Board of Supervisors tonight took action to suspend all but only the most essential county services tomorrow, December 3, and Friday, December 4. The Board will do everything within its power to assist, provide services, and comfort everyone affected by this traumatic event. Law enforcement has the county’s full support in its effort to address this incident, find out what happened and why, and bring those responsible to justice. I would like to thank Governor Brown for personally contacting me to offer his condolences and support during this difficult time. The county is thankful for the support our agencies have received from the state, the federal government, and our neighboring cities and counties.” PIO Surge Capabilities and Succession Planning… Given the extreme time pressures they were facing at the time, the Deputy PIO had since expressed a desire to accept more of the offers of assistance from her colleagues. For example, the Deputy PIO assumed the PIO responsibilities for the Arrowhead Regional Medical Center (ARMC), which did not have a PIO or communications plan at the time. It was an added responsibility that left her overwhelmed since the ARMC was receiving an equally high volume of inquiries and requests from the media. The County Fire District’s PIO, experienced with HIPAA and comfortable in high-media-demand environments, who offered to help that day, could have taken on the role of ARMC PIO. In the mayhem of the day, however, the Deputy PIO did not have the time to connect the dots. Planning for PIO surge capacity and also PIO succession (in the case of the ARMC) may have eased the burden on the CAO PIOs. Public Information in the Weeks and Months after the Attack The CAO PIOs returned to work early the next morning. They were inundated with media requests specifically seeking information about the perpetrator's employment at the County. At 4:00 p.m. on December 3rd, the Sheriff's Department issued a press release with the names of 43 CountyWire is the County of San Bernardino’s official blog. Narratives and Analysis 80 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County the deceased victims (after notification to next-of-kin had been completed). Around the same time, the County Counsel asked the CAO PIOs to refer any California Public Records Act (CPRA) requests related to the shooting and the perpetrator to his office for review. The Board of Supervisors and the CAO PIO office developed key talking points to convey the message the County would take care of the victims, their loved ones, County employees, and the community. The CAO PIOs also put together, with assistance from the Multimedia Services Division of the Information Services Department (ISD), a video that conveyed this message to County employees from the Board of Supervisors, and released it via YouTube. Almost immediately, the media began directly approaching individuals associated with the attack, including victims and family members of the deceased. The CAO PIO and Deputy PIO fielded interview requests and offered to help prepare any individuals planning for interviews. Specifically, they worked individually with interviewees and also created a list of fifty questions they believed the media might pose and accompanying answers so participating individuals would have a better sense of what was to come. They continued to assist in this capacity for the more than two weeks the national media remained in San Bernardino. Several victims expressed to the CAO PIO and Deputy PIO that they did not want to be referred to as “victims,” but as survivors. Others wanted the messaging to underscore that their loved ones were not “lost,” but were “taken.” The CAO PIOs worked to reinforce this messaging strategy in their communications. The Deputy PIO was later tasked with coordinating with the Arrowhead United Way regarding the fund established on behalf of the victims (see narrative 4.6 Donations on page 108 for more information). The CAO PIOs organized the press release and used their leverage with the news media to get the media to widely publicize the fund. For example, the PIOs had a SB United Relief Fund poster made for press conferences to take advantage of the screen time. In addition, the CAO PIOs required networks to show SB United Relief Fund information on the news crawl at the bottom of the screen during interviews with family members and County officials when coordinated by the CAO PIOs. The CAO PIOs scheduled the first major press conference related to the attack for the morning of December 7th. Present at the conference were all five Supervisors, three of the doctors from ARMC who had treated victims, and the Director and Assistant Director of the San Bernardino County Department of Public Health, both of whom were in the room at the time of the attack. The conference was covered by local and national media. The timing of the conference7:30 a.m.was set to coincide with the start of the first day for County employees returning to work following the attack. As employees returned to work, the media were inside the Board Chambers in the Government Center covering the press conference, allowing the employees to enter in peace. Additionally, the Director and Assistant Director of the San Bernardino County Department of Public Health participated in over a dozen interviews with the media to help relieve some of the pressure from the media on victims, their families, and EHS staff. Just on December 7, 2015 Narratives and Analysis 81 C O M M U N I C A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County alone, they were interviewed by ABC, CBS, NBC, CNN, the Associated Press, and local print reporters. The CAO PIOs also took part in the planning of the “County Family Gathering,” helping to decide who would be invited, who would perform and what access the media would have. Media outlets were invited to the family gathering, but they had to register in advance and they were not allowed access to the families or County employees. The CAO Deputy PIO also received logistical and planning advice for the event after reaching out to a previous work contact in Aurora, Colorado; a community that planned its own memorial service following the 2012 movie theatre mass shooting. C O M M U N I C A T I O N S The CAO PIOs continued to deal with issues related to the attacks for many months afterwards. They also worked to make sure the County was represented in follow-up stories. For example, the CAO PIOs invited a trusted reporter to the January 14, 2016 Post-Incident Coordination Group Meeting so the behind-the-scenes hard work and efforts of the County to meet the needs of those affected could get some coverage. In February 2016, the CAO PIOs handled media inquiries as to why the County was unable to provide access to the perpetrator’s County-issued cell phone.44 Additionally, the County frequently was in the spotlight for over a year for issues related to Worker’s Compensation (see narrative 4.4 Employee Benefits and Leave on page 99 for more information). At the time of this report, the CAO PIOs anticipated the media coverage would continue for years to come, particularly as other shootings and terrorist attacks occur, on anniversaries of the incident, and as legal claims move forward. The CAO PIOs faced an incredible challenge the day of the terrorist attack. Not only were they operating from separate locations, but they were responsible for disseminating information that was changing by the minute. Initially, they believed County employees were not involved. As this initial assessment was quickly found to be inaccurate, the PIOs worked to piece together what had actually transpired. While doing so, they were fielding calls from emotionally distraught friends and colleagues searching for news of their loved ones; putting the PIOs in an unusual and challenging position. Like all PIOs under similar circumstances, they struggled with incomplete and un-vetted information and had to navigate when and how it was appropriate to disseminate information as the demand for it became insatiable. Although they were minimally 44 The County of San Bernardino provides every EHS inspector with a work phone. At the time of the attack, the assailant was in possession of an iPhone 5C, which was running the newest version of the Apple's iPhone operating system, which required a passcode and cannot be accessed by the Apple Corporation. Additionally, the phone was configured to erase data after ten consecutive unsuccessful unlocking attempts. Investigators from the FBI believed the phone might hold valuable information about the assailants' network of connections and/or where the two may have traveled. The FBI asked Apple to create a new version of the operating system that could be installed thereby overriding the security feature which erases data after ten failed login attempts. Apple declined to comply and the FBI took the issue to court. On February 16, 2016 a United States Magistrate Judge ordered Apple to supply the highly specialized software to the FBI. Ultimately, Apple stalled and the FBI found an outside third party to unlock the phone and withdrew its request to the court. Narratives and Analysis 82 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County staffed, the experience and teamwork of the CAO PIOs helped to ensure about as a good of an information campaign as could be expected under the circumstances. C O M M U N I C A T I O N S Narratives and Analysis 83 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O M M U N I C A T I O N S This page is intentionally blank. Narratives and Analysis 84 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Category 4: Employee Support The County provided a variety of services to the victims of the terrorist attack and their families. Since the County was both victim and responder, some of those services, like those provided by the District Attorney’s Bureau of Victim Services and the County’s Department of Behavioral Health, were provided to employees and the community. Other services were provided only to County employees or the families of the deceased. The below table provides a snapshot of the services administered by the County to support the victims of the terrorist attack; both employees and the community. The six narratives in this category address the services as they were provided to County employees or the families of deceased County employees. Those services included establishing single points of contact to liaison with victims and families on behalf of the County, the administration of State programs that offer support and benefits to the victims of crime, the provision of crisis counseling, the administration of employment benefits and leave programs, including workers’ compensation, and the facilitation of donations to equitably benefit victims and survivors. Non-Employees San Bernardino residents affected by the shoot-out between law enforcement and the perpetrators Narratives and Analysis Workers‘ Compensation X X X X X X X X X X X X X X X X X X X X X X X X X X X 85 Donations Management Specialized County Employee Benefits X Short-Term Disability Victims of Crime Services/Benefits X Death Benefits County Victim Liaisons County Employees Eligible Categories Environmental Health Services (EHS) Division employees present at the attack Families of deceased County employee victims EHS employees not present at the attack; County employees co-located with EHS employees (LUS Code Enforcement Division and ISD Multimedia Services Division) Responding County public safety employees (e.g., Fire, Probation, Sheriff) All other County employees Family of the deceased non-County employee victim Those present at the IRC on 12/2/15 Contracted Mental Health Counseling County Services DBH Community Counseling and Clinical Services Services Administered by the County to Support Terror Attack Victims X E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M P L O Y E E This page is intentionally blank. S U P P O R T Narratives and Analysis 86 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 4.1 Victim Liaisons Within minutes of the terrorist attack, County executives anticipated the onslaught of paperwork and bureaucracy that each victim and the families of the deceased would face as they navigated issues ranging from official death notifications, workers’ compensation, medical and death benefits, employment leave, funeral arrangements, crime victim services, etc. Not only would the processes be extremely difficult and unfamiliar, but County executives recognized the victims and families of the deceased would be confronting these issues while facing extraordinary emotional and psychological trauma. County executives were concerned the complexities of the process would cause additional trauma, frustration, and potential delays and wanted to do everything possible to simplify and streamline the process. On the afternoon of December 2, 2015 the CEO relayed a concept to the head of the Department of Behavioral Health (DBH) for creating a victim liaison program to support victims with the many County programs now applicable to them. The County launched the unprecedented Victim Liaison program the day after the attack on December 3, 2015. The program was inspired by, but did not necessarily replicate, the San Bernardino County Fire Protection District’s (County Fire’s) Funeral Support Policy, which includes a single point of contact for victim’s familiespreferably someone with a history with the familyreferred to in the County Fire policy as the Family Liaison Officer (FLO).45 Per the County Fire Funeral Support Policy, the FLO serves as the single point of contact between County Fire and the family, supports the family with decisions regarding funeral arrangements, supports the collection of information necessary for County Fire to process appropriate benefits/services, can make notifications to life insurance companies and other entities, and advises the family of available benefits/assistance. Individuals selected to serve as Victim Liaisons were county employees from DBH, Children and Family Services (CFS), and the Transitional Assistance Department (TAD). Victim Liaisons were selected because they were identified as being organized, personable, and comfortable in high stress situations involving morbidity and mortality. The first team of Victim Liaisons was established to assist injured employees and the families of the deceased. Twenty-eight (28) Victim Liaisons were selected. The team lead was a licensed clinician, but the liaisons came from non-clinical positions, such as staff analysts and program specialists. These “Team One” Victim Liaisons were deployed to the Family Assistance Center (FAC) established by the Federal Bureau of Investigation (FBI) on December 7, 2015 to meet with families for the first time. After focusing first on the families of the deceased and injured survivors, the DBH and Human Resources (HR) Department46 turned their attention to creating a second team of liaisons to assist the Environmental Health Services (EHS) employees who were present during the attack, as well as their co-workers throughout EHS and the Department of Public Health (DPH), and the 45 The single point of contact concept is used by many fire/rescue and law enforcement agencies, including the San Bernardino County Sheriff’s Department and Fire Protection District. 46 The HR Department worked extensively with the Victim Liaison program. During the first month following the attack, HR representatives debriefed with the first victim liaison team-lead on a daily basis to identify victim needs. Narratives and Analysis 87 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Land Use Services Department.47 Thus, a second group of Victim Liaisons was established on December 8, 2015. This team of an additional 29 Victim Liaisons was tasked with supporting approximately 100 affected personnel. As the program was established very quickly, there was initially insufficient time to develop written guidelines, parameters, or procedures outlining the specific duties and expectations of the Victim Liaisons. General parameters established by the team leads were as follows:   E M P L O Y E E     S U P P O R T  Be available 24 hours a day, 7 days a week. Assist program recipients48 with paperwork, death benefits, time cards, obtaining death certificates, navigating support and resource systems/programs, and press inquiries. Convey information about memorials, meetings, and available resources from the County.49 Victim Liaison Roles… Help with funeral arrangements, provide Both HR staff and the DA Victim transportation to and from funerals, as well Advocates Office commented that, in as other events and meetings related to the an effort to mitigate the burden on the attack. victims, Victim Liaisons sometimes Be available to provide program recipients assumed a subject-matter expert role any services and additional support, such as directly guiding program recipients on during funerals and trigger events (e.g., how to complete paperwork and what subsequent terrorist attacks or shootings in programmatic options to select. In a the country, special occasions/holidays). few instances, the paperwork was Deliver well wishes, cards, offers of completed incorrectly or inappropriate support, and deliver donated goods to the selections made and Victim Liaisons injured and deceased victim’s families that were advised to direct the recipients were routed through the County. to the points of contact with the Work with the District Attorney’s (DA’s) requisite expertise to assist on specific Victim Advocates and Claims Unit to issues rather than provide direction facilitate services available through the 50 themselves. Bureau of Victim Services (BVS) . Victim Liaisons were given cell phones to communicate with their program recipients beginning on December 8, 2015. At the conclusion of each liaison/recipient relationship, the cell phone was returned to the County. 47 Some personnel from the Land Use Services Department shared office space with EHS staff, including those injured and deceased. 48 The County referred to all program recipients as “victims.” However, not all victims chose to have a Victim Liaison and not all direct and indirect “victims” were County employees. As a result, this narrative has used the term “program recipient” to refer to those that received Victim Liaison services versus the collective “victims” so there is no confusion regarding who is represented as receiving the support described herein. 49 HR initially set up a Victim Liaison password-protected website with information and resources of need to Victim Liaisons. Later, HR provided the Victim Liaisons with access to an EHS website set up by the Economic Development Agency where information was being posted. 50 See narrative 4.2 Victims of Crime Services on page 91 for more information on how Victim Liaisons coordinated with the DA Bureau of Victim Services. Narratives and Analysis 88 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Since no formal parameters were set for the Victim Liaisons program, each Victim Liaison had a degree of latitude to determine what services to offer. County executives had very generously told Victim Liaisons to do whatever those affected needed to ease their burden. Some Victim Liaisons became more intimately involved in the personal lives of their recipients, providing babysitting for children, shopping for birthday and holiday gifts for loved ones, decorating homes for holidays, grocery shopping, and helping to paint homes. Unfortunately, there was no formal feedback mechanism established by which program recipients could report on the quality of the program or whether the relationship with their assigned Victim Liaison was going well.51 Victim Liaisons were instructed to report to their team leader any concerns that were expressed by the program recipient. The team leaders would then forward those concerns and questions to appropriate County departments to be addressed. The Victim Liaisons program was originally envisioned as a short-term program under the assumption the need for liaisons would diminish in a month or two; a definitive termination date was never established. By January 21, 2016, the first team was reduced to 14 liaisons, and further reduced to 11 by June 2016, and then to four by September 2016. On January 27, 2017, the first team was completely retired when injured employees and the families of the deceased no longer had a demand for the service. The second team of liaisons was in place until the termination of the Victim Liaisons program in June 2017. On December 10, 2015, there were 29 liaisons on team two. As of January 11, 2016, there were 8 active liaisons in team two and that number would remain constant for nearly 18 months, officially ending on June 5, 2017. At the conclusion of the program, there were still 8 liaisons working actively as part of the second team when the County determined the program had fulfilled its purpose. In most cases, Victim Liaisons were pulled from their regular County work assignments to be dedicated to their Victim Liaison function. All department heads whose departments provided Victim Liaisons mentioned they were able to balance assignments among remaining staff to cover for the absence of the Victim Liaisons. While it was a challenge, it was seen as a critical service and other department staff was supportive and eager to contribute to the effort by assisting with the workload. In addition, as Victim Liaisons were available around the clock, many of them accumulated overtime pay. This provided a challenge for department leadership, who had to determine how time should be coded and how the Victim Liaisons would be compensated. 51 As there was no formal feedback process in place for the Victim Liaison program, it is difficult to determine satisfaction levels and the ultimate success of the program from the perspective of the program recipients. As the demand for Victim Liaisons continued for 18 months, it is reasonable to assume many recipients utilized their Victim Liaisons and found value in the program. Narratives and Analysis 89 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Enhancing the Victim Liaison Program… The County is to be commended for its selfless efforts to develop an innovative program to expedite and improve communications with, and support to, more than 100 employee victims and the families of the deceased. The Victim Liaisons became the embodiment of the County’s efforts to “do whatever it takes” to support its employee family. E M P L O Y E E S U P P O R T In general, program stakeholders commented that Victim Liaisons formed a compassionate support system and were an effective point of contact for many of those affected and their families. Had the County not instituted such a program, it is hard to know how or if program recipients would have been able to navigate the extensive and complicated bureaucracy associated with the programs they needed (e.g., workers’ compensation, death benefits, health insurance, leave) while simultaneously dealing with physical and/or psychological/emotional trauma. However, as the County developed and ultimately continued the Victim Liaison program, it would have been useful for program administrators to seek further guidance from public safety agencies to better understand their pre-existing models. The County public safety agencies each have codified policies that clearly define the parameters of service, roles, and responsibilities, which the County program lacked. At times this created confusion regarding program services and expectations and challenges with consistency and quality of service. Beyond the concept, the models upon which the Victim Liaison program was loosely built were not referenced again. In hindsight, there are several components the County could have considered that may have strengthened the Victim Liaison program: 1) Clearly defined program goals, parameters, and procedures. The responsibilities of Victim Liaisons were not clearly defined. Without clear guidelines, the liaisons provided varied and sometimes inconsistent support to program recipients. Some Victim Liaisons experienced complications as they developed friendships with the victims that affected their objectivity. In addition, setting an anticipated end date for the program would have helped manage the expectations of the program supervisors, the Victim Liaisons, the program recipients, and the departments lending their staff to serve as liaisons. 2) Program Recipient Information. It would have been beneficial to create a summary reference document for the program recipients including information about the purpose and parameters of the liaison program, who the liaisons were, their responsibilities, and contact information for program leads to address questions. 3) Feedback Mechanism. The program lacked a mechanism by which program recipients could offer feedback to ensure the Victim Liaison program was meeting their needs. There was no process in place for recipients to express their positive experiences or raise concerns to the County except through their Victim Liaison, which sometimes presented an uncomfortable option. Narratives and Analysis 90 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 4.2 Victims of Crime Services The San Bernardino County Bureau of Victim Services (BVS) is part of the County District Attorney’s Office and offers a wide range of services to those who have been the victim of a crime. BVS support services include: crime-related crisis counseling; emergency services such as food, shelter, clothing, medical care and transportation; orientation to the criminal justice system; court support; special services to victims of sexual assault; and referrals for mental health services. The BVS members that work with victims of crime are referred to as “Victim Advocates.” The BVS also has a Claims Unit that helps victims of crime file claims and seek compensation through the California Victim Compensation Board (CalVCB). All victims of the terrorist attack were eligible for services from BVS. “Victims” included the families of the deceased, the injured, those present during the attack (including approximately 600 non-County personnel that were on-site at the IRC complex that day52), and residents living along San Bernardino Ave. where the shoot-out with the perpetrators took place. BVS immediately assigned ten Victim Advocates to exclusively assist with the short- and long-term needs of the associated victims. The California Victim Compensation Board (CalVCB) made immediate contact with BVS once it learned of the incident. CalVCB provides compensation to victims of violent crime who are injured or threatened with injury. Victims may be reimbursed for services including medical costs, income loss, funeral expenses, home security, mental health treatment, and other matters on a case-by-case basis. CalVCB has a Joint Powers Agreement (JPA) with the San Bernardino County DA’s Office which enables the DA’s Office to process victim compensation claims locally. The December 2nd attack was closely monitored by both BVS and CalVCB and conference calls were scheduled between the two throughout the day to assess the situation and the potential needs of victims. Additionally, emergency claims processing procedures were activated by both agencies. Two BVS Claims Unit staff were immediately assigned to work exclusively on claims from the terrorist attack, and they continued to be dedicated to December 2, 2015 claims processing as of the writing of this report. The morning after the attack, the Sheriff’s Department requested Victim Advocates be dispatched to the Coroner’s Office to accompany the Sheriff’s Department/Coroner Division and Federal Bureau of Investigation (FBI) Victim Specialists in the delivery of official death notifications to next-of-kin. The goal was to ensure information on available BVS and CalVCB services would be immediately available to families as the notification was made. The BVS staff also traveled to various hospitals. The Victim Services Bureau Chief contacted local hotels to set up direct billing accounts so BVS could provide temporary hotel stays for the loved ones of the injured and deceased who would need lodging. Victim Advocates also provided purchase cards to victims or their families for the various needs they presented: such as replacement eye glasses, cell phones, key fobs, prescriptions, and clothing, among other items. 52 The IRC consists of a conference center, which is where the attack took place, and two other large stand-alone office buildings where normal IRC business was taking place on the day of the attack. Narratives and Analysis 91 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County In the days after the attack, Victim Advocates participated in the FBI’s Family Assistance Center (FAC) and informed victims in attendance of available services. Victim Advocates attended both FBI- and County-hosted meetings with victims to let them know about available services and coordinate support through the BVS. As the relationship between the Victim Advocates and the FBI evolved, in particular, the Victim Advocates found themselves serving as an intermediary between the FBI and victims facilitating case updates, victim feedback, and access to personal property. E M P L O Y E E S U P P O R T Initially, BVS staff explained that few departments in the County knew they existed or what they did. As a result, it took some time and advocacy for BVS staff to work their way into the appropriate groups. Ultimately, BVS came to coordinate extensively with other County departments. The Victim Services Bureau Chief regularly attended the Post-Incident Coordination Group meetings organized by the County Administrative Office (CAO) to report on BVS activities related to the incident and to discuss victim needs. The BVS Claims Unit worked with the County Risk Management and Human Resources (HR) Departments on laws and documentation requirements, and to coordinate compensation. The Claims Unit helped victims request compensation from the CalVCB, including those who wanted to complete the CalVCB application for funeral and burial assistance. Through CalVCB, compensation is available for "direct victims" (someone who is physically injured, threatened with injury, or dies as a direct result of a qualifying crime) and "derivative victims" (usually family members or dependents of direct victims who are eligible for limited benefits). As of October 2017, the Claims Unit had processed nearly 1,400 bills covering costs related to mental health, income loss, home security, medical, relocation, and funeral/burial expenses for both direct and derivative victims. A substantial number of claims to CalVCB were related to income loss. County employee victims eligible for workers’ compensation could receive temporary disability compensation that covered up to two thirds of salary losses. Compensation from CalVCB helped to make their paycheck “whole.” The BVS coordinated with the County’s HR Department to ensure employees received full compensation and benefits without interruption. Of significance, the HR Department worked directly with the BVS to issue a single check for employees that integrated income from various sources, as opposed to multiple checks at multiple times from multiple sources, which is the norm in comparable situations. At the time of the writing of this report, the Victim Services Bureau Chief and a representative from the HR Department continued to hold bi-weekly case management meetings to support the ongoing coordination efforts between the two groups (see narrative 4.4 Employee Benefits and Leave on page 99 for more information). State law mandates employees are eligible for workers' compensation or temporary disability benefits for up to 104 weeks in a 5-year period. Once employees reach that limit, CalVCB became or would become the primary option for recovering lost wages. CalVCB implemented multiple first-ever exceptions to their standard policies and practices for San Bernardino victims as nontraditional victim expenses related to this incident would be eligible for reimbursement through the U.S. Office for Victims of Crime (OVC) Antiterrorism and Emergency Assistance Program (AEAP) grant. For example, many of the families exceeded the Narratives and Analysis 92 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County funeral/burial limit of $7,500 allowed by CalVCB and also exceeded the workers’ compensation limit. CalVCB reimbursed the additional costs right away. Additionally, the timeframe for eligible direct victims to claim reimbursement for income loss was extended from two years to five years for the first time. For derivative victims, the timeframe of eligibility was extended from one year to two years, which also doubled income loss payments for derivative victims from $63,000 for one year to a maximum of $126,000 for two years. At the time of this report, CalVCB was still creating or adapting exceptions to its standard policies associated with the terrorist attack. The Victim Advocates also coordinated with various entities to arrange for donated items to be delivered to the families of the deceased and the injured victims. In order to ensure the items were delivered, this effort was coordinated with the County Victim Liaisons (see narrative 4.1 Victim Liaisons on page 87 for more information). Victim Liaisons also assisted victims with the collection of BVS forms and communicated victim needs to the DA Victim Advocates. Victim Advocates also assisted the Arrowhead United Way with the administration of the “SB United Relief Fund” by reviewing applications for distributions to ensure they were legitimate (see narrative 4.6 Donations on page 108 for more information). On any given day, the BVS handles a myriad of tasks and responsibilities as they support victims across the County. The BVS staff are trained on and have practical experience with trauma experienced in the aftermath of violent crime. However, addressing the magnitude of the December 2, 2015 attack proved a challenge for even this group of victim service professionals due to the sheer number of victims. The response required an unprecedented level of coordination with other County departments to navigate unmet victim needs, manage the volume of claims, and adapt to changing policies and exceptions beyond normal statutory limits. The BVS team dedicated, and continued to dedicate at the time of this report, a significant amount of resources to the processing of victim claims and to meet victims’ needs in a timely, compassionate, and professional manner. Narratives and Analysis 93 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M P L O Y E E This page is intentionally blank. S U P P O R T Narratives and Analysis 94 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 4.3 Emotional Support Following the December 2, 2015 terrorist attack, the County of San Bernardino was confronted with a traumatized workforce. Within hours of the attack, the County’s leadership, with particular input from the County’s Department of Behavioral Health (DBH), recognized the emotional consequences of the attack would be substantial. The County would go on to provide a wide range of emotional and psychological support services both to County employees and the greater community in the aftermath of the attack. The County regularly encouraged any and all employees to anonymously take advantage of counseling services at any time they so needed. Three entitiesone internal to the County and two externalwere crucial in the delivery of emotional support services: the DBH and two private contractors, the Counseling Team International (CTI) which had a pre-existing relationship with multiple County Departments, and the International Trauma Center (ITC). Beyond the formal counseling services offered, many staff reported that they turned to each other for emotional support for themselves and their families. This informal, peer-to-peer care became critical support for their emotional needs. In many cases, it was cited as being as or more important than the formal counseling services. Many departments/divisions commented on becoming closer as a group after relying on each other so intimately. It was frequently cited as the factor that defines the San Bernardino County “family.” Department of Behavioral Health DBH's mission is to provide mental health and substance abuse services to residents (usually underserved communities) of the County. DBH has ten Community Crisis Response Teams (CCRTs), which are mobile teams comprised of counselors dispatched to respond to emergencies that unfold within San Bernardino County. The CCRTs are on-call 24/7 and are funded through the California Department of Mental Health.53 Teams of three or four counselors are able to rapidly respond and provide trauma assistance in the community. In addition to the CCRTs, the DBH operates multiple Crisis Walk-In Centers (CWICs) across the county, some of which are open 24 hours. CWICs offer screening services for potential selfharm or harm to others, psychiatric medication services, and referrals to other mental health resources. DBH leadership and several staff members were in a weekly staff meeting when cell phone alerts notified them of the terrorist attack. Emergency procedures dictated that the multiple DBH locations were to be locked down, including the Department’s headquarters one block from the Inland Regional Center (IRC). Members of the CCRTs not affected by the lockdown immediately deployed to incident sites. Once the perpetrators were located, management and additional counselors were sent to multiple locations including the Rock Church, Hernandez Community Center, Hampton Inn, Arrowhead Regional Medical Center, and Probation Department to provide crisis services to victims, families, and responders. Given the large scale of the incident, additional DBH clinicians were called upon to provide support. By 3:00 p.m. the day of the attack, DBH had coordinated and deployed over 100 therapists. 53 Funded through Proposition 63, the California Mental Health Services Act. Narratives and Analysis 95 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County As part of the response to the attack, the DBH provided guidance to its therapists for their own self-care, including information on the signs and effects of trauma, crisis hotline phone numbers, and resources for coping with traumatic events. Numerous staff took advantage of CTI services (see the next section) and critical incident stress debriefings offered by mental health mutual aid from several neighboring counties. The DBH Public Information Officer (PIO) provided information about available counseling services to all county employees via multiple communication outlets, including social media, e-mail, and newsletters. E M P L O Y E E S U P P O R T In the eight weeks following the attack, DBH arranged for 300 behavioral health professionals to service 10 County departments and 9 community organizations for 24 hour coverage. As with many County departments, DBH staff members were spouses, friends, and co-workers of those injured or killed in the attack. The DBH staff had to navigate this unique circumstance while performing their duties. DBH employees reported the addition of intense media scrutiny, abundance of funerals, and new security protocols compounded the emotional issues DBH staff had to overcome. Self-care became an important issue within the Department and it continued to be as of the writing of this report. The DBH also managed the Victim Liaison program (see narrative 4.1 Victim Liaisons on page 87 for more information) intended to help County victims and their families. While the liaisons functioned as more practical support, they were also tasked with providing information about psychological counseling resources. Information regarding self-care, coping with traumatic events, and available counseling resources were also posted on the website set up for the Environmental Health Services (EHS) Division, known as the “EHS Support Site.” The DBH and DPH also coordinated the receipt of mutual aid from the U.S. Department of Health and Human Services (U.S. HHS) through the Substance Abuse and Mental Health Services Administration (SAMHSA). SAMHSA counselors were instrumental in providing guidance to EHS management on employee and supervisory expectations and the handling of traumatized staff as employees returned to work. The SAMHSA services provided for five days of on-site counseling and training for EHS managers and would later lead the International Trauma Center (ITC) contract discussed below. The DBH’s long-term recovery efforts for EHS and County employees included planned community resiliency forums, post-trauma workshops, and supporting a Wellness Coordinator for EHS responsible for coordinating long-term counseling services and group sessions for Division employees and Human Resources (HR) related paperwork. DPH and EHS developed the job description, recruited, and hired the Wellness Coordinator position in February 2017. Nearly two years after the attack, the DBH was still being engaged to provide support in advance of anniversaries and other trigger events (e.g., other mass shootings). For example, DBH responded again when a County employee was killed in the October 1, 2017 Las Vegas mass shooting. During such events, the DBH also reached out to the community with counseling opportunities, such as free drop-in mental health clinics and support groups. Narratives and Analysis 96 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Counseling Team International CTI is a private company specializing in psychological trauma and emotional support services to law enforcement, fire/rescue, emergency services, and other governmental agencies. CTI's mental health professionals had responded to major incidents across the country including the Oklahoma City bombing, the September 11, 2001 terrorist attack on the World Trade Center, and the shooting at Los Angeles International Airport that claimed the life of a Transportation Security Administration (TSA) agent. CTI had contracted with the San Bernardino County Sheriff’s Department for over thirty years, providing critical incident stress management services after Sheriff-involved shootings and other traumatic events. CTI's on-call support was available 24 hours. The day of the attack, County departments with existing relationships with CTI, including the Sheriff’s Department and District Attorney Bureau of Victim Services, reached out for support. CTI responded immediately with available counselors and called in additional clinicians from surrounding counties; setting up a command post for on-site critical incident stress debriefings and management (CISD/M). On December 3rd, DBH requested additional assistance and resources from CTI to handle the large volume of incoming crisis intervention and mental counseling requests. DBH also requested assistance in managing its crisis hotline, which was receiving an overwhelming number of calls. CTI established an additional hotline for County employees. At the time of the attack, CTI was a known and trusted resource among County employees. CTI counselors were present in and around many of the County departments to assist on an asneeded basis, even in departments with which CTI did not previously have existing relationships. The HR Department’s existing contract with CTI was increased by $300,000 to allow CTI to provide increased counseling county-wide and extensive counseling for EHS employees in particular. The environment at EHS was unique. Some returning staff had been present at the IRC the day of the attack, others had not. Some were in the room when the shooting began, others were elsewhere in the facility. Some dealt with the grief by returning to work quickly, others needed weeks, months, even years to recuperate. These differences created tension among staff. In addition, there were many new hires, contractors, and mutual aid staff brought in to fill the vacancies created by those on leave.54 Those initially unknown and/or revolving members of the staff made some returning EHS personnel feel uneasy. For more than a year following the attack, CTI counselors maintained an on-going physical presence at the EHS offices five days a week. Employees could avail themselves of the counselors any time they felt necessary. CTI counselors also assisted the EHS managers with best practices for supporting traumatized staff. In June 2017, CTI’s presence at the EHS Division went from 5 to 2 days a week and they continued to be available as needed at the time of this report. 54 See narratives 5.4 Alternate Personnel on page 131 and 6.2 Reconstituting Employment Levels and Practices on page 141 for more information. Narratives and Analysis 97 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County CTI counselors also advised the County on the emotional repercussions that may be associated with County policy decisions made in the aftermath of the attack. CTI assisted County leadership in making specific policy decisions about the EHS Division’s alternate work space, subsequent permanent renovations, and also assisted management with decisions about employees returning to work. E M P L O Y E E S U P P O R T International Trauma Center (ITC) As part of a federal mutual aid agreement with SAMSA, assistance was offered to DPH by the International Trauma Center (ITC). The trauma specialists initially provided 40 hours of dedicated management-level counseling services to DPH and EHS management. The success of the initial program led the County to contract with ITC in May 2017 for a year of additional training support associated with trauma response and crisis counseling for DPH employees, with a focus on EHS. Through in-person seminars, telephonic and email contact, ITC provided services to management and survivors to include:  Trauma assessments  Group interventions  Seminars on trauma processing  Training in post-traumatic stress management  Skills for psychological recovery training  Treatment planning and ongoing recovery strategies Crediting Emotional Support Services… The DBH’s experience in emergency response via its CCRTs allowed for a rapid, successful emotional support response. The use of the trauma professionals at CTI and ITC also supported a successful program that was committed to the emotional well-being of not just victims and their families, but the County’s entire work force. The County is to be commended for the utilization of third-party counselors, especially to support the EHS Division most affected by the attack. While DBH clinicians were trained to respond to crises, the nature of this event meant that the DBH clinicians were themselves emotionally impacted by the incident. The CTI and ITC counselors were not part of the “County family” and were not colleagues of the EHS staff. Having the CTI counselors onsite and the ITC management level counseling services provided an additional message to EHS employees that the County was supportive of, and had prioritized, employees’ emotional health. Narratives and Analysis 98 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 4.4 Employee Benefits and Leave The County Human Resources (HR) Department administers a wide range of employee and recruitment services and benefits. Approximately 100 HR staff members are responsible for the needs of 22,000 County employees. Each County department has a dedicated Human Resources Officer (HRO), in addition to representatives from its Employee Benefits Division and the Department of Risk Management. Together, they work as a team to provide comprehensive human resource services to each department. The HR Employee Benefits and Services Division administers the County’s health, dental, vision, and life insurance plans, as well as its integrated leave programs. There are a number of policies, procedures and guidelines that govern the administration of benefits for County employees in the event of death, injury, or other circumstances. This report does not examine the “quality” and detail of the benefits offered by the County, but rather describes the County’s efforts to administer the benefits per policy following the terrorist attack, especially as it pertains to coordination with other County departments and external organizations. The County has a robust benefits program and, partly due to the sheer size of its workforce, a very experienced HR staff well-versed in administering benefits when an employee death or injury occurs. Once the HR Department became aware of the attack on December 2, 2015, the priority became identification of County employees who were present at the Inland Regional Center (IRC) as addressed in narrative 1.5 Personnel Accountability on page 33. At the same time, HR focused on ensuring County employees were able to access mental health services. The Department of Public Health (DPH) HRO, for example, contacted the Counseling Team International (CTI) to acquire additional counseling support for County personnel as described in narrative 4.3 Emotional Support on page 95. The HR Department also began assembling customized packets of information on benefits and resources for families of the deceased, those injured, and those present at the attack. Benefits Following the attack, one of the primary goals of the County was to ensure survivors’ benefits were uninterrupted while County officials determined next steps. The December 2, 2015 terrorist attack was unique for the County due to the number of County employees who were victims. County employees present during the attack were eligible for workers’ compensation payments of up to two thirds of lost wages. Additional potential County sources of compensation and benefits for those employees included paid leave and short-term disability programs. In addition, because the incident was a crime, employees were eligible to claim lost wages and other impacts through the California Victims Compensation Board (CalVCB) program, administered locally by the District Attorney’s Office. As a payer of last resort, CalVCB helped to fill “gaps” left once all other payment sources had been exhausted (i.e., Workers’ Compensation paid up to two-thirds of an employee’s salary [taxable], but CalVCB covered the remaining one-third [non-taxable])(see narrative 4.2 Victims of Crime Services on page 91). The HR Department partnered with the District Attorney Bureau of Victim Services and Department of Risk Management to ensure victims of the December 2, 2015 terrorist attack Narratives and Analysis 99 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M P L O Y E E S U P P O R T continued to receive full compensation and benefits. They arrived at a novel solution in which the County issued a single paycheck that covered each employee’s total compensation regardless of the source of income; be it regular time, paid leave, workers' compensation, or CalVCB. Traditionally, with multiple payers involved, victims would have received individual payments from each source, each according to a different payment schedule and covering different payment periods (see narratives 4.2 Victims of Crime Services on page 91 and 4.5 Workers' Compensation on page 105 for more detail on associated payments). In addition to easing reconciliation burdens on the victims and ensuring a steady and predictable level of income, administering a single paycheck through the County payroll system also ensured employee benefits such as paid leave and retirement credits continued to accrue. This approach required significant effort on the part of the HR Department as the calculations could vary for each 2-week pay period and had to be reviewed and entered manually by HR staff. On the day after the attack, HR staff under the direction of the Employee Benefits Division Chief began gathering information on death benefits for beneficiaries of the deceased. HR administered benefits included life insurance pay outs, continuation of health insurance benefits, deferred compensation, retirement medical trusts, cash out of leave balances, and accidental death and dismemberment benefits. There were approximately 20 Environmental Health Services (EHS) Division employees not present at the December 2, 2015 training event held at the IRC. Those employees were not eligible for workers’ compensation or CalVCB income loss benefits. However, those employees were eligible to apply for short-term disability benefits through the County’s plan. EHS employees who applied for short-term disability with the required doctor’s note for psychological trauma were all approved. Payroll On December 9, 2015, the HR Assistant Director sent out two memos regarding time reporting for the pay period ending December 11, 2015one for non-EHS employees and the other for EHS Division and certain Land Use Services (LUS) staff that shared office space with EHS. The memo with time reporting instructions for non-EHS employees advised non-EHS employees to code regular time, “REG,” for hours actually worked on December 2, 2015 and code “EVAC” for the remaining hours for personnel released from duty on that work day through Sunday, December 6 since non-essential functions were closed December 3rd - 4th. Employees who were deemed essential and required to work were to code payroll code “REG” to record their work time. Employees who were on pre-approved absences were to code the appropriate leave category for those dates. The memo with time reporting instructions for EHS and certain LUS staff would ensure employee time reporting was completed, submitted and approved on behalf of all EHS and LUS staff. Time was to be recoded as “REG” through 11:00 a.m. on December 2, 2015 and “EVAC” for the remainder of the day through Sunday, December 6 th. Beginning on Monday, December 7th, the departments would use payroll code “EMLV” for the duration of excused absences for those employees. For payroll processing purposes, both the “EVAC” and “EMLV” payroll codes Narratives and Analysis 100 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County were treated as equivalent to “REG” time. Accordingly, employees were compensated in the same manner for those hours as if they had worked regular time. The time for deceased employees was coded on Wednesday, December 2, 2015 as “REG” until 11:00 a.m., after which the department used the payroll code “EVAC” through the end of the day on Friday, December 4, 2015. Coding of the “EVAC” time resulted in deceased employees receiving 41 hours of paid time, thereby ensuring continuation of health and dental benefits for their dependents through the next pay period, ending December 24, 2015. From the time of the incident through January 4, 2016 payroll coding for all EHS staff was inputted by DPH payroll specialists so EHS staff wouldn’t have to be concerned with how to input their time using the various codes during the period of approved leave. Paid Leave On December 11, 2015 it was determined that County-paid leave would be extended at least through December 21, 2015 for EHS employees and LUS staff that shared space with EHS. On December 15, 2015, an item went before the Board of Supervisors, and was approved, authorizing the CEO to extend payment of salary and benefits for EHS and affected Code Enforcement staff through early January 2016. On December 17, 2015, the Director of the DPH sent a letter55 to all EHS employees stating: “Your well-being remains our greatest concern and County-paid leave has been extended for you through January 3, 2016. We continue to understand that all employees may not be ready to come back to work at the same time and I want to once again assure you that no employee will be required to return before they are ready. Some of you have expressed an interest in returning to work before the exhaustion of your County-paid leave and we welcome your return.” Few EHS employees returned to work on January 4, 2016. As every employee had an individualized plan, the HR staff worked to ensure all pay and benefits went through payroll in a manner that ensured continuity, regardless of the source of the income or benefit. Paid leave was also covered for 3 spouses, one mother-in-law, and 3 sisters of injured/deceased victims who were also County employees. Modified Work Schedules Per County policy, departments reasonably accommodate modified duty requests for medical reasons with a goal to return employees to work. This process is typically administered by department management, but due to the impact on DPH and EHS leadership following the December 2nd attack, the Human Resource Officers (HROs) were more heavily involved in accommodating modified work requests. The EHS Division, with HRO support, attempted to 55 This letter was posted on the EHS website and the information was also shared with Victim Liaisons to relay to program recipients. Narratives and Analysis 101 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County accommodate every request, including modified duty (reduced work schedules or alternate hours), transfers, and reassignments. In accordance with County procedures, employees requesting a modified work schedule were required to present a note from their doctor proposing the modified work schedule in the best interest of the employee. Doctor’s notes were presented to a supervisor at EHS and the requested restrictions, length of time, and type of accommodations were reviewed and, whenever possible, approved. E M P L O Y E E S U P P O R T Dependent Health/Dental Benefits An employee’s death, regardless of the cause, is technically considered a termination of employment and employee health and dental benefits expire the payroll period after employment is terminated. As such, the deceased victims’ effective “termination” date was December 11, 2015 and their health and dental insurance coverage, including coverage for enrolled dependents, would expire on December 24, 2015 (end of the following payroll period). The HR Employee Benefits Chief brought this to the attention of the County Chief Operating Officer/Interim HR Director and County Chief Executive Officer (CEO). On December 15, 2015, the County Board of Supervisors authorized the County to make COBRA 56 payments on behalf of the families as a temporary measure to ensure health and dental benefits were not immediately discontinued for dependents of the deceased. As of the writing of this report (more than 2 years after the attack), COBRA payments from the County on behalf of six families still continued. The County’s cost for these payments to date had been deemed an approved expense, eligible for reimbursement under the Antiterrorism and Emergency Assistance Program (AEAP) grant administered by CalVCB. The grant provides for COBRA payments to continue for the maximum allowable period of three years (COBRA is available for the continuation of coverage for three years when an employee dies [18 months under California law and an additional 18 months under Federal law]). Life Insurance The HR Employee Benefits Chief requested that the County’s life insurance carrier waive the investigation process and the requirement that victim families' produce death certificates in order to qualify for death benefits. At that time, there was widespread publication of the victims’ names and the life insurance carrier agreed to this request. They quickly issued death benefits to the families of the 13 deceased County employee victims based on a list provided by the County. The death benefit to the next-of-kin of the male perpetrator was still being contested by the life insurance carrier at the time of this report. Retirement The San Bernardino County Employees’ Retirement Association (SBCERA) administers the pension for retirement-eligible County employees. Because their deaths occurred in the line of duty, the families of the deceased County employees were eligible for survivor retirement benefits. Permanently disabled victims unable to return to work were also able to apply for disability retirement through SBCERA. The HR Department served as an intermediary, 56 Consolidated Omnibus Budget Reconciliation Act (COBRA). Narratives and Analysis 102 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County answering SBCERA questions as they arose. In addition, ensuring the payroll of affected employees remained “whole,” also ensured employees continued to accrue retirement credits. Non-County Benefits The HR Department provided contact information for resources not administered through the County. Deceased and injured employees were eligible for non-county benefits through County Veteran’s Affairs and the U.S. Social Security Administration. The two labor unions representing affected employees (i.e., Service Employees International Union [SEIU] and the Teamsters) also provided support to many of the employees and their families. Among others, the State’s Franchise Tax Board offered tax assistance and the California Department of Motor Vehicles offered support for the transfer of vehicle registrations. Program Management The magnitude of the attack and the sheer number of victims created a nearly overwhelming task for those administering benefits. While sometimes constrained by County policy and outside provider/carrier restrictions, the HR Department’s commitment to the care and recovery of the victims led the Department to implement some innovative tactics. For example, HR developed two matrices outlining the various benefits to which different categories of victims were entitled to guide administration efforts (e.g., one for families of the deceased and one for those who were injured). By December 8, 2015, the San Bernardino County Economic Development Agency created, with collaboration from HR staff, a dedicated password-protected website, which became known as the “EHS Support Site.” The support site had resources available for EHS employees in response to requests for information related to workers’ compensation, expended leave, time off, time coding, and bereavement/grief policies and leave. HR staff also developed a Frequently Asked Questions (FAQ) document to answer many common inquiries. The FAQ document was posted on the website and updated frequently. The team also posted information on funerals and other memorials, tips for dealing with trauma, tips for handling the media, and information on FBI resources for family travel. In addition, HR initially developed a separate website for the Victim Liaisons with similar information, though eventually Victim Liaisons were given access to the “EHS Support Site,” ensuring both the Liaisons and EHS employees had the same information at the same time. Formal information sessions were held for EHS employees in the months following the attack with staff from HR, County Administrative Office (CAO), Risk Management, BVS, Department of Behavioral Health (DBH), and SBCERA to explain victim compensation claims processes and victim benefits. Union representatives often attended these meetings as did counselors from Counseling Team International (CTI) to provide emotional support. These sessions were created after two employees expressed frustration and concern through their Victim Liaisons about benefits and claims information being confusing. Victims and their families were struggling to understand the enormous amount of paperwork, their eligibility, and the claims process. The first session was held on January 17, 2016 for EHS staff and injured victims. Four additional sessions were held for EHS staff: February 18, 2016, March 23, 2016, November 17, 2016, and June 27, 2017. Two additional sessions were held for injured victims and their families: Narratives and Analysis 103 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County February 8, 2016 and February 18, 2016. Each meeting started with a few words from County leadership and then transitioned to presentations from subject-matter experts from the various programs previously mentioned. At the conclusion of the presentations, panelists took questions or stayed behind to answer individual questions. There were also multiple scribes at each meeting to take notes, which were soon after turned into FAQ documents and made available to EHS staff. E M P L O Y E E Through close inter-departmental collaboration, the County did its best to ease the financial burdens and remove the barriers to benefits more common to benefits administration. However, the HR staff was in a challenging position, as they were frequently the first and primary recipients of the victims' frustration. Despite every effort to be the "good cop," the HR staff was at times labelled the "bad cop;" a difficult label to bear in the midst of the good they believed they were trying to accomplish. Value of Formal Information Sessions… The interdepartmental formal information sessions were created in response to EHS staff members expressing confusion over benefits and the administrative process. This was an innovative approach to addressing the many concerns that were being posed by employees and families. The department subject-matter experts agreed that communicating through a variety of channels, including these sessions, and at multiple times was the best way to ensure the victims had the information and understanding they needed. Likewise, the subsequent development and distribution of FAQ documents was a further best practice. S U P P O R T Narratives and Analysis 104 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 4.5 Workers’ Compensation Workers’ compensation was the primary means through which medical care and other benefits were provided to County employees present at the work-related function that was the target of the December 2, 2015 terrorist attack. The workers’ compensation program in California is highly regulated and the authors of this report did not conduct a review of the program or its implementation. A report specific to this topic was commissioned by the California Department of Industrial Relations Division of Workers’ Compensation and is attached to this report as an appendix: Department of Industrial Relations (DIR) Report on the Role of California’s Workers’ Compensation System in the San Bernardino Shootings. The County’s Department of Risk Management administers the County’s workers’ compensation program.57 The County’s workers’ compensation program is self-insured and selfadministered. As such, Risk Management staff is responsible for administering all claims. An employer is required to provide a workers’ compensation claim form to an injured worker within 24 hours of becoming aware of a potential injury/claim and the injured worker has one year from the date of injury to initiate a claim. The Risk Management Department wanted to ensure all those potentially eligible had a claim open even if they didn’t need it. So in the days following the attack, Risk Management initiated claims for the deceased, injured, those County employees present at the attack, and eligible first responders (93 survivor claims, 13 deceased). Risk Management staff contacted hospitals to determine the whereabouts of County employees and personally met with victims and their families at various hospitals to provide workers’ compensation program information. They also contacted treating hospitals to discuss and authorize necessary medical treatment. Risk Management participated in the Family Assistance Center (FAC) established by the Federal Bureau of Investigation (FBI) and at other meetings to assist victims and/or their families with their claims. The Director of Risk Management also participated in the interdepartmental Post-Incident Coordination Group Meetings led by the County Administrative Office (CAO), allowing for increased coordination and communication about the process and benefits eligibility. For approximately the first five months following the attack, the vast majority of employee claims were reviewed and approved within days by County claims administrators under their existing authority. There were few complaints and the program’s recipients became accustomed to quick claims processing. However, the State of California requires every workers’ compensation program to have a Utilization Review (UR) process under which a third party reviews proposed treatments to ensure consistency with guidelines established by the Medical Treatment Utilization Schedule (MTUS). If a proposed treatment is not determined to be consistent with MTUS guidelines, it can be denied. Denials can then be appealed through an Independent Medical Review (IMR) process administered by the California Department of Industrial Relations Division of Workers’ Compensation. By April 2016, the claims and treatments had reached thresholds that initiated the UR process, now inserting third-party medical experts into the previously internal review and approval process for each claim. This 57 In July 2015, the County converted its workers’ compensation program from a self-insured cash basis to a program with excess insurance purchased from CSAC-EIA (California State Association of Counties - Excess Insurance Authority) by procuring a policy with statutory limits and a self-insured retention of $2.0 million. Narratives and Analysis 105 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County added layer of review created frustration among many program recipients who wondered why processing was now taking longer and why previously approved treatments were now being questioned, and in some cases, denied. E M P L O Y E E S U P P O R T The California Department of Industrial Relations received a number of complaints regarding how San Bernardino County and the workers’ compensation system responded following the attack. Victims’ concerns regarding the County and program made local and national news headlines. In response, the Department of Industrial Relations initiated an investigation in February 2017. To help address this situation, the County contracted with third-party nurse case managers58 in January 2017 in the amount of $400,000. The nurse case managers were tasked with proactively addressing administrative matters, including ensuring paperwork was completed in a timely manner pertaining to an employee’s case. The California Department of Industrial Relations investigation would later determine claims were typically delayed or denied because employee physicians “…had failed to document or fully explain their requests” in the claims paperwork. As noted in the cover letter to the Department of Industrial Relations report, “the County took the positive step of hiring a nurse case manager to serve as an ombudsperson to help facilitate the presentation of treatment requests in a way that [would] satisfy the workers’ compensation system’s treatment guidelines.” The Department of Industrial Relations’ report also found that of the total 2,146 treatment decisions, 90% were approved and 3% received modified approval. The report concluded, “…looking at the volume of treatment requests as a whole, denials or modifications of requests that did not fit within MTUS guidelines were clearly an exception to the overall pattern of treatment requests being routinely accepted or approved through UR.” The County’s excess insurance carriers had also reviewed its case management decisions and came to similar conclusions. Through workers’ compensation, employees who experience wage loss are eligible for temporary disability benefits for up to 104 weeks within a five year period. Eighteen (18) employees who had been off continuously since December 2, 2015, exhausted the 104-week limit at the end of November 2017. As of June 2017, the Director of Risk Management reported workers’ compensation claims had incurred $23 million in total costs, of which the County had paid approximately $2 million. Workers’ Compensation Process… Workers’ compensation is a formulaic and highly regulated system in California. The behindthe-scenes nature of many of the decisions can lead to misunderstandings and even foster an environment of distrust. However, it was reported that Risk Management staff did their best, working incredibly long hours, to ensure claim reviews were expedited. On numerous occasions, staff members personally reached out to the treating and/or reviewing physicians to 58 The County had separate nurse case managers coordinating the medical aspects of employee cases since the onset of the workers’ compensation claims process for the terrorist attack. Narratives and Analysis 106 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County ensure treatments could be approved without delay or to find out-of-the-box solutions to ensure continuity of treatment. Additionally, it is worth noting the Department of Risk Management approved nearly every claim without delay or question during the first five months after the incident. This may have established expectations for employees that were not sustainable in the long-term. In order to maintain the integrity of the program and to be responsible to its insurers and maintain eligibility for future coverage, Risk Management felt it was necessary to ultimately employ the more standard process that included the Utilization Review element. E M P L O Y E E S U P P O R T Narratives and Analysis 107 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County E M P L O Y E E This page is intentionally blank. S U P P O R T Narratives and Analysis 108 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 4.6 Donations Local and national organizations, as well as the general public, looked for ways to help the San Bernardino community in the days and weeks following the attack. County employees fielded offers of monetary and in-kind donations for the victims of the attack and their families, but the County had no pre-existing protocols for accepting those donations at the time. Due to the many logistical and policy challenges involved with accepting and distributing donations directly to victims, County officials acted as liaisons between donors and victims and their families.59 Donors frequently turned to the County for help identifying the victims and sought their contact information. Given the media attention and privacy requirements the County, specifically the Human Resources (HR) Department, was neither allowed nor inclined to disclose employee contact information. Additionally, determining who qualified as a “victim” posed a significant challenge to all involved as there were many victims within and outside the County organization: the deceased, the families of the deceased, the injured, those who witnessed the attack, and the first responders. Monetary Donations Offers of monetary donations began immediately following the terrorist attack. However, there was no practical mechanism in place by which the County could receive donations and then distribute them to individuals. Additionally, the County is not a qualified 501(c)3, which would allow donations to be tax deductible, so finding a mechanism for the County to do so would have complicated the donations’ tax-exempt status. As a result, the County administrators collaborated with the Arrowhead United Way (AUW) to establish the “SB United Relief Fund;” the largest of the funds established in the days following the attack. SB United Relief Fund Following the attacks of December 2, 2015, the AUW was prepared to establish a relief fund for the victims of the attack. AUW reached out to the County Board of Supervisors via the County Administrative Office (CAO) Public Information Officers (PIOs) for approval of their press release language prior to publicly announcing the fund. At the same time, the County had been approached by institutions around the country wanting to donate. The County made the decision to partner with the AUW and direct all donation inquiries to it. The AUW had previously established funds and a long-term recovery committee to support San Bernardino communities after major fires in 2003 and 2007. This pre-existing relationship was a great benefit in the early days after the attack. The AUW staff was initially concerned about the complexities of managing the primary fund for monetary donations for a tragedy of this nature. Additionally, it was outside the United Way’s normal fundraising practices to raise money that would be distributed to individuals without being administered by a separate charity. However, according to AUW President/CEO Doug Rowand, an exception was made because the attack was determined to be an act of terrorism. 59 The County was the direct recipient of a $25,000 donation from the Robert Wood Johnson Foundation to be utilized for the support of County employees who provided aid to the victims and families impacted by the December 2 attack. Narratives and Analysis 109 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County The SB United Relief Fund was launched two days after the attack on December 4, 2015. A week later, on Friday, December 11, 2015, the County HR Department added the SB United Relief Fund as one of its eligible charitable organizations for combined giving, thereby allowing County employees to donate directly through payroll deductions. Ultimately, the fund raised and distributed more than $2.5 million. E M P L O Y E E S U P P O R T Oversight for the SB United Relief Fund was ultimately conducted by a fifteen-person volunteer committee, chaired by former City of San Bernardino Mayor Patrick Morris. Before the committee had even assembled, the AUW Board of Directors heard from members of other communities who had been victims of terrorism. Their advice was to make some of the money raised available to victims immediately. By the time the oversight committee convened in January 2016, the fund exceeded $2 million. The AUW suggested an immediate $5,000 allocation to families of those who had been killed in the attack, but some County officials voiced caution about distributing funds without having a full picture of the needs of victims. To balance these concerns, the AUW Board approved the release of up to $10,000 for each family of a deceased victim if the family requested funds and demonstrated a financial need in the months before the fund was ready to distribute the donations. County Victim Advocates from the District Attorney’s Office assisted the Fund Committee with the review of the applications. Any funds distributed in the early release would be deducted from the final amount decided upon, and families would still have to demonstrate need. The final amount distributed on an asneeded, case by case basis, in the immediate term was $21,821.43. The Committee met every two weeks from January 2016 until the fund was exhausted at the end of March 2016. In addition to former Mayor Morris, Committee members included County employees, tribal representatives, community leaders, labor union representatives, and law enforcement representatives. In addition, while not a Committee member, a representative from the Bureau of Victims Services at the District Attorney’s Office was consulted as a resource on a regular basis regarding victims’ needs. See the listing below for a full accounting of SB United Relief Fund Committee members.              SB United Relief Fund Committee Members Kara Adams – VP of Marketing, Altura Credit Union Dr. Joshua Beckley – Senior Pastor, Ecclesia Christian Fellowship Bill Carnegie – President and CEO, Feeding America Food Bank Riverside/San Bernardino Taif Kaissi, MD – VP & Executive Director, MiNDS Ray King – Captain, San Bernardino Police Department Steve Kovensky - Deputy Chief, San Bernardino County Sheriff’s Department Keith Lee - Arrowhead United Way Board Member Patrick Morris - Former Mayor, City of San Bernardino, Retired Judge Vici Nagel - President/CEO, Academy for Grassroots Organizations Ken Ramirez - Tribal Secretary, San Manuel Band of Mission Indians Deidre Rodriguez - General Manager, Teamsters Local 1932 James Siva - Tribal Council Member, Morongo Band of Mission Indians Dena Smith - Chief Operating Officer, San Bernardino County Narratives and Analysis 110 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County   SB United Relief Fund Committee Members Laurie Stalnaker - Secretary/Treasurer, AFL-CIO Central Labor Council CaSonya Thomas - Director, Behavioral Health, San Bernardino County The Committee also solicited advice from communities and organizations representing the Newtown/Sandy Hook, Virginia Tech, Boston Marathon, and 9/11 attacks, and consulted and received advice on their final strategy from Ken Feinberg, a Washington attorney recognized for his work in victim’s compensation plans. On March 30, 2016, in an open meeting, the Committee announced their plan to divide the $2.5 million raised by the fund. Eighty percent (80%) of the amount raised went to the families of the deceased (approximately $141,000 per victim), 15.5% was allocated to those injured ($5,000 plus an additional $1,000 per overnight hospital stay) and the remainder went to those who were present at the time of the attacks. Audited financial statements from the SB United Relief Fund, as part of AUW disclosures, show that a total of $2,522,095 was distributed to victims and families during the fiscal year ending June 2016. The remaining $45,145.59 was paid out the next fiscal year, ending in June 2017. One hundred percent (100%) of the funds collected were distributed to victims. Other Monetary Donations Local union chapters, neighboring cities and counties, and individuals also set up funds to help the victims and their families. County officials were not involved in helping third parties make decisions, but County employees often acted as liaisons between victims, their families and the multitude of funds to help communicate victim needs to the fund managers. In an effort to ensure “no stone went unturned,” the County frequently suggested that victims reach out directly to fund sponsors for assistance, particularly in situations where the fund or activity sponsor was better positioned to meet a specific victim need. Unions and Professional Associations Two local union chapters also set up relief funds after the attack. Service Employees International Union (SEIU) 721 and Teamsters Joint Council 42, the parent body to Teamsters Local 1932, each established funds in the name of the victims to address the long-term needs of the victims and their families. These funds were often used to supplement traditional sources. The County HR Department and the District Attorney’s Office’s Victim’s Advocates were used to facilitate communication between the unions and recipients of funds when appropriate. The CAO and HR Department fielded inquiries from family members looking for monetary assistance for their lost wages while taking time off to care for victims. Human Resources liaised with SEIU to communicate those requests. County representatives were not involved in decisions regarding the distribution of the union funds.60 60 The amount of money raised and how it was distributed was not documented by the County, nor investigated as part of this report. It was noted in Post-Incident Coordination Group meeting minutes that as of November 2016, the SEIU fund had raised $215,000. Narratives and Analysis 111 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County As the professional association for the County’s Environmental Health Services (EHS) employees, the California Environmental Health Association (CEHA) established a relief fund that raised over $50,000 as of July 2016. The EHS Division and County HR Department were aware of the relief fund and suggested it as a funding source to victims and their families, but were not involved in the management or distribution of those funds. E M P L O Y E E S U P P O R T Crowdsourcing A number of individuals established “GoFundMe” or other crowdsourcing accounts set up in the names of victims or families of victims. One of the largest was set up by the City of San Bernardino’s Mayor, Carey Davis, who raised over $136,000. At the time of the writing of this report, the only available information regarding that fund stated the funds were to be split evenly among the victims and their families. In-Kind Donations Within hours of the attacks, local businesses and organizations responded with donations of food and water for first responders, witnesses and family members. In the months after the attack, tangible items and memorial tributes were offered to the County and the EHS Division. Individuals throughout the County fielded these offers, including individuals from the CAO, CAO’s Public Information Office, Department of Public Health, EHS Division, and the Board of Supervisors. Food and Water Donations The first donations were food and water for the first responders, victims and witnesses, which were received and coordinated by first responders at the scene of the attack and at the locations set up for victims/witnesses and family members. In the months that followed the attack, the EHS Division continued to receive offers and donations of food. Because EHS is responsible for reviewing and grading restaurants for health code compliance, EHS had a stated policy of not accepting donated food from any sources as it may be construed as a conflict of interest. However, following the attack, the Department of Public Health allowed individuals and groups to donate food to EHS. These were coordinated by EHS Division managers who reported that donated food boosted morale for employees and offered an opportunity to gather and provide emotional support to each other as they returned to work. However, the job of coordinating these donations fell to those in EHS whose time was already taxed in the understaffed division. Other Items/Tribute Events As the emergency response transitioned into long-term recovery, the in-kind offers became more difficult to accept and coordinate. Several agencies were accepting offers without communicating with each other and many groups were attempting to engage the victims as participants or honorees at events. In late January 2016, an important informational meeting for victims and their families was scheduled at the same time as a high-profile tribute event with the Los Angeles Dodgers baseball team. The conflict led the CAO to assume responsibility for verifying and communicating donations and tribute events. Narratives and Analysis 112 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County A Principal Management Analyst in the CAO was identified as the primary point of contact for donations and tribute events. The Analyst was tasked with clarifying and verifying the offers/ events and communicating them to EHS management which in turn, communicated the offers to the victims and EHS staff. Additionally, the County received the famous “Comfort Quilt,” which was created by schoolchildren from St. Hilary School in Ohio to be sent to a school in New Jersey following the attacks of September 11, 2001. Since then, it has traveled the country to bring comfort to communities recovering from tragedy. It was sent to San Bernardino County from Umpqua Community College where a previous mass shooting had taken place. The County initially had some concerns about formally accepting and displaying the quilt because of its religious connotations, but did not have long to determine the best course of action before the Pulse Nightclub tragedy occurred in Orlando, Florida in June 2016 and the Comfort Quilt was then forwarded to the Mayor of Orange County, Florida. A painting by artist Calvin Canepa and bronze plaque commissioned by the California State Association of Counties and the County Administrative Officers Association of California was also accepted by the County and now hangs on the second floor of the County Government Center near the EHS Division offices. Tribute events included invitations to victims to attend sporting and/or art events as honored guests. The County vetted and shared the information with the EHS Division, which in turn published them as an internal Public Health news release and posted information on the events to the “EHS Support Site.”61 The County did not coordinate attendance and gave no recommendation on acceptance or attendance to invitees. In the fall of 2016, as the one year anniversary of the attacks approached, a new wave of offers and tribute events were received. The following events provide a representative sample, but are not inclusive of all, the tribute events which were offered and continued to be offered through the date of this report’s publication:  Los Angeles Kings hockey team breakfast and skate-around for families of the deceased.  NASCAR Sprint Cup grandstand seats for families of the deceased.  2016 Annual Peace Choral Festival to honor victims of the attack.  “SB Strong” night at an Inland Empire 66ers baseball game with proceeds donated to the AUW relief fund.  IRC Awards Ceremony honoring first responders and their actions on the day of the attack. This was sponsored by San Bernardino law enforcement agencies with preferential seating for EHS staff and family members.  A National Crime Victims’ Rights Week Memorial sponsored by the SBC DA’s office.  Bridges of Grief from Shadows of Grief event in November 2016 to promote peace and community understanding as the community approached the first anniversary of the attack. 61 For more information see narrative 4.4 Employee Benefits and Leave on page 99. Narratives and Analysis 113 E M P L O Y E E S U P P O R T Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County      E M P L O Y E E S U P P O R T Service of Remembrance sponsored by the Diocese of San Bernardino to mark the first anniversary of the attack. City of San Bernardino Mayor’s event to mark the anniversary and honor those affected. “Planting Day” for the Hal Bowman healing grove memorial approved by the Upland City Council and Public Works Division. A barbeque fundraiser sponsored by the Fontana Police Department. A LifeStream Blood Bank blood drive to mark the first anniversary of the attacks. The County’s Donations Experience… The County did not have a pre-existing policy defining its potential donations management role following an emergency. Decisions with regards to donations quickly overwhelmed the people tasked with making these decisions. At first, in-kind donations were directed to EHS Division staff under the assumption they would know best how to distribute them. For a Division that was already understaffed and burdened with other mattes, this became an additional challenge. Later, CAO staff became involved to help manage some of this burden and this seemed to alleviate the concern. It may have been beneficial for CAO staff, or another group, to manage in-kind donations earlier and, looking ahead to the next emergency situation, appoint a person or position to manage donations and create policy/guidelines regarding acceptable and unacceptable donations. Conversely, the County could have also made the decision not to be involved in the distribution of in-kind donations, much as it did for monetary donations. There is no single policy that would have been ideal, but it may have been useful for everyone that was contacted by potential donors to have guidelines for managing the donations process. Narratives and Analysis 114 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Category 5: Continuity of Operations Of the six topical categories addressed in this report, continuity of operations (COOP) is the most cut and dried. There are generally accepted national and international standards for establishing, maintaining, and evaluating continuity programs,62 which were cited in narrative 2.1 Department Emergency Operations Plans (DEOPs) on page 41. Likewise, that narrative previously addressed the status of the County’s intended continuity plans. This category reviews the County’s implementation of continuity treatments to ensure the continued performance of essential functions in the midst of and following the terrorist attack. The four narratives in this section will address succession planning and delegations of authority as many County and department leaders were out of the area on the day of the attack or were directly affected by the attack, the status of essential functions affected by the attack and efforts to fully recover capability levels, and the application of alternate facilities and alternate personnel as strategies to sustain operations. The final topical category in this report (Category 6: Organizational and Financial Recovery) addresses the ongoing efforts to transition the organization from a state of continuity to a new steady state. 5.1 Evolution of Leadership (Succession and Delegations of Authority) At the time of the attack on December 2, 2015, a large number of San Bernardino County’s senior officials were out of the area. The Chief Executive Officer (CEO) was en route to Washington, DC and was on a layover at the Dallas/Fort Worth International Airport ( 1,200 miles away). Three (3) members of the Board of Supervisors, the Clerk of the Board, the County’s Chief Operating Officer (COO), and the County Administrative Office (CAO) Public Information Officer (PIO) were at a conference in Monterey, CA ( 370 miles). The Chief of the Fire Protection District was at another conference near San Francisco, CA ( 430 miles) and other department heads were scattered at various meetings, trainings, and assignments throughout Southern California. Those who were in Southern California returned to their posts as quickly as possible. Those traveling returned either that evening or by the next morning. Present during the attack, the Director and Assistant Director of the Department of Public Health (DPH) and the Environmental Health Services (EHS) Division’s Program Managers (one of whom was acting as Interim Division Chief), Interim Program Manager, and Program Coordinator returned to workor made themselves available if taking leavebut were consumed with extraordinary matters resulting from the attack. In a number of the above cases, lines of succession were implemented authorizing formal delegations of authority where they existed. As an essential element of continuity planning and emergency preparedness, this section will discuss the County’s succession and delegation capabilities at the time of the attack and will explain how they were implemented. Board of Supervisors As previously mentioned, three of the elected members of the Board of Supervisors (BOS) were attending the California State Association of Counties (CSAC) Conference in Monterey, CA while the remaining two were attending a regularly scheduled meeting locally within the County. 62 This section applies technical continuity terminology used in Federal Emergency Management Agency’s Continuity Guidance Circular, the Disaster Recovery Institute (DRI) International 10 Professional Practices, and International Standards Organization (ISO) 22301. Narratives and Analysis 115 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Although three of the BOS members were out of the area at the time of the attack, they retained their authority and no delegation was required. C O N T I N U I T Y O F O P E R A T I O N S Upon notification of the terrorist attack, the two BOS members who remained local returned to the County Government Center with the Deputy Sheriff who had escorted them to the meeting. Those in Monterey assembled in a hotel conference room and joined the others and County executives via conference call for a Closed Session with the Sheriff at 1:00 p.m. At that time, they were able to waive County policy prohibiting more than two BOS members from traveling together, in order to facilitate their rapid return to the County. The Sheriff’s Department dispatched one of its fixed-wing aircrafts to Monterey to pick up the BOS members and the CAO PIO.63 Each BOS member individually monitored the situation and communicated with his/her staff.64 The fact that delegations of authority are not permitted for BOS members was not a concern during this incident because the BOS members were in communication with relevant stakeholders the entire time. County Administrative Office (CAO) On December 2, 2015, the CEO was traveling to Washington, D.C. as a Fellow for the National Academy of Public Administration. At the time of the attack, the CAO had an established line of succession for the Chief Executive Officer (CEO) codified in the Office’s 2013 Emergency Plan as follows:  Deputy Executive Officer (DEO) for Special Projects65  Assistant Executive Officer (AEO) for Finance and Administration, in the absence of the DEO Special Projects  County Chief Financial Officer (CFO), in the absence of the DEO Special Projects and AEO  Director, Office of Governmental and Legislative Affairs (GLA), in the absence of the DEO Special Projects, AEO, and CFO  Public Information Officer (PIO), in the absence of the DEO Special Projects, AEO, CFO, and Director of GLA  Principal Management Analyst, in the absence of the DEO Special Projects, AEO, CFO, Director of GLA, and PIO  Deputy Executive Officer (DEO), Finance and Budgets, in the absence of the DEO Special Projects, AEO, CFO, Director of GLA, PIO, and Principal Management Analyst Succession was regularly planned and activated weekly as senior officials of the County traveled, were on leave, or were unavailable for other reasons. Notice of this particular activation of the line of succession was communicated via memo prior to the CEO’s departure on December 1, 2015, indicating the AEO for Finance and Administration would be “acting on 63 The Sheriff’s Department’s aircraft only had capacity for four passengers. It was deemed essential for the Board members and the PIO to return the soonest. The COO and the Clerk of the Board returned by car together and arrived late that night. They remained in communication with County executives during the drive. 64 One local BOS member had a Sheriff’s Department radio that was retained from a prior assignment and was able to keep apprised of the situation using it. Otherwise, no radio or alternate communication methods were provided to the BOS members at the time. 65 On December 22, 2015 the CAO Emergency Plan was updated to replace the DEO for Special Projects with the Chief Operating Officer (COO). Narratives and Analysis 116 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County my [the CEO’s] behalf while I’m out” because the Deputy Executive Officer for Special Projects was also scheduled to be out of town during that time. The memo was sent to the Board of Supervisors and copied to the department heads of the following:  Arrowhead Regional Medical Center  Community Services  County Administrative Office, DEO for Special Projects  County Counsel  County Fire  Finance & Administration  Housing Authority of the County of San Bernardino  Human Services  Inland Counties Emergencies Medical Agency  Land Use Services Department  Probation Department  Public Defender  Public Works Department  Real Estate Services Department  Special Districts Department Per the CAO’s Emergency Plan, “authority for daily operational decisions” was thereby delegated to the AEO for Finance and Administration. Although two BOS members remained in their offices at the County Government Center for much of the day, the Acting CEO stated she was unaware of their presence and no consultation with them occurred or was deemed necessary. Similarly, those two BOS members, despite receiving the memo from the CEO regarding his absence, stated they were unaware of the delegation of authority to the Acting CEO. Immediately upon acquiring knowledge of the terrorist attack, the CEO suspended his trip mid-route and made plans to return to San Bernardino. While on his return to San Bernardino, the CEO continued to guide operations, such as directing the decision for employees in County buildings within the City of San Bernardino to remain indoors and later the release of employees for the remainder of the day on December 2, 2015. The AEO for Finance and Administration was Acting CEO from December 1st until approximately 5:00 p.m. on December 2nd when the CEO returned to the County. Delegations of Authority… During discussions with County executives for this report, none were completely clear regarding which authorities were specifically granted to them during times of succession. This could potentially be linked to the ambiguity of the delegation language: “authority for daily operational decisions.” If “daily” implies “typical” then certainly nothing that happened on December 2, 2015 was typical and the person delegated authority would not be empowered to act. If “daily” implies “anything that occurs on a given day” then perhaps it conveys greater authority. Likewise, “operational” decisions may not include policy, strategic, fiscal, or other decisions. The language seems like it was clearly selected to convey limited authority, but to what degree is unclear. Formal delegation letters/protocols should be developed that clearly identify the authorities successors are granted, to what degree, and for how long. Narratives and Analysis 117 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F O P E R A T I O N S Department of Public Health (DPH) In the days that followed the terrorist attack, the DPH Director and Assistant Director, who were both present in the room during the attack, did not take time off from work. However, their time was occupied with visiting the injured, attending funerals, serving as a liaison between the County and affected personnel, engaging with the media, self-care, etc. For all intents and purposes, they were available, but absent from their normal administrative and operational responsibilities. At the time of the attack, the established line of succession for the department codified in the Department’s 2011 Emergency Plan was as follows:  DPH Director  DPH Assistant Director  DPH Health Officer  DPH Division Chief of Nursing  DPH Chief Medical Officer  DPH Chief Financial Officer Per the DPH Emergency Plan, designated successors have complete authority to exercise agency direction, including the authority to re-delegate functions and activities as appropriate. However, even without said delegation, the Health Officer, as a statutory position under California law, had all the authority necessary to act on behalf of the DPH Director and Assistant Director while they were otherwise occupied.66 As necessary, the Health Officer made decisions in the absence of the Director and Assistant Director. Since the Health Officer’s focus is typically medical, not administrative, and recognizing the support the Health Officer would need in making decisions associated with recovering the EHS Division, the DPH Executive Team (including the DPH Chief Financial Officer, Division Chief of Nursing, Division Chief of Animal Care and Control, Division Chief of Disease Control, the Quality and Compliance Officer, and the Human Resources Officer) self-organized to advise the Health Officer and address all matters of the department while the Director and Assistant Director were occupied with the matters previously described. In addition, the DPH Executive Team wanted to alleviate the pressure on the Director and Assistant Director so they could focus on their personal self-care and recovery as well as that of the affected staff. Although succession was never officially activated through a written delegation of authority, the Health Officer (who had official statutory authority) and DPH Executive Team essentially implemented succession as needed, but did so with a consensus-driven, team approach rather than a more traditional hierarchical approach more common in position-specific succession planning. Somewhat complicating the leadership environment at DPH, the AEO for Human Services (who oversees the DPH) called upon and appointed a retired Department of Behavioral Health (DBH) department-head to assist with DPH recovery and the continuity of department operations.67 Before doing so, the AEO communicated her intentions to the DPH Director. The Health Officer and DPH Executive Team commented that the involvement of the former DBH 66 An email between the County Counsel and the Health Officer on December 9, 2015, confirmed the Health Officer had the broad authority to implement many DPH functions, and in particular many of the statutory and regulatory functions required to be performed by the DPH/Environment Health Services (EHS) Division. 67 The former DBH department-head had a six (6) week contract with the CAO to assist the DPH. Narratives and Analysis 118 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County department-head was awkward as that individual’s role was not clear (e.g., whether the AEO expected the former DBH department-head to make administrative decisions instead of the Health Officer or was it simply an advisory position). In addition, the former DBH departmenthead often brought the then current Director of DBH to most DPH meetings and would defer to the DBH Director, which seemed peculiar and not always relevant to DPH activities in the eyes of the DPH Executive Team. The AEO for Human Services had strictly good intentions; thinking an additional person with knowledge of the department would be an asset to the group, but the communication regarding the former department-head’s role was never completely clear and it sent an unintended “lack of confidence” message to the existing DPH Executive Team. Once the DPH Director and Assistant Director resumed their normal duties on January 4, 2016 leadership roles returned to normal and the former DBH department-head departed. Environmental Health Services (EHS) Division The leadership of the Environment Health Services (EHS) Division within DPH was the most impacted of any business unit. At the time of the attack, the line of succession for the EHS Division was as follows:  Division Chief  Program Manager  Program Coordinator  Supervisor Of the Division’s 92 positions that were filled on December 2, 2017, 72 were present during the attack, including the only two EHS Program Managers (one of whom was acting as the Interim Division Chief as the former Division Chief had recently been promoted to DPH Assistant Director), an Interim Program Manager, and the Program Coordinator. With great dedication and resilience, both Program Managers, the Interim Program Manager, and Program Coordinator returned to work on December 3, 2015. Although they were permitted to take administrative leave with all other EHS staff through January 4, 2016 they were either physically on-site or were available to support recovery efforts during their personal time. Like the DPH Director and Assistant Director, during that initial month, they too were consumed with visiting the injured, attending funerals, serving as a liaison between the County and affected personnel, self-care, etc. Although lower-level positions were in the line of succession for the Program Managers and the Program Coordinator, the line of succession was intended to back-fill one or a few positions under normal conditions; not assume leadership over a Division that had been decimated and required rebuilding from the ground up. As such, the defined line of succession was not helpful for this situation. As narrative 5.4 Alternate Personnel on page 131 explains in greater detail, the staffing of the EHS Division and its leadership for the first month would consist of mutual aid support from the State and fellow counties, recent retirees, and volunteers. The California Department of Public Health (CDPH) appointed a number of senior-level personnel to assist in temporarily staffing the Division. On December 9th, the CDPH Director assigned the CDPH Environmental Management Branch Chief to visit San Bernardino’s EHS Division and determine the Division’s needs, including leadership. That effort would lead CDPH to recruit a recently retired countyNarratives and Analysis 119 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F O P E R A T I O N S level Chief of Public Health with 25 years of experience as a county-level environmental health director to provide independent and continuous leadership presence until EHS staff returned. Although the individual recruited by the CDPH was never officially appointed acting/interim Division Chief, nor were written delegations of authority issued, the role essentially defaulted to that individual as the State’s lead representative and all other returning staff or mutual aid fell in line to support him. That included four retired or former EHS Division Chiefs who generously gave their time as needed and offered advisory services. The temporary Division Chief, senior mutual aid staff, and volunteers met on a daily basis to prioritize tasks with the intention of doing whatever it took to at least minimally re-establish and sustain operations for essential programs. EHS Program Managers and the Interim Program Manager offered their support either in-person or remotely and the Program Coordinator worked full-time and played an advisory role during this time. As a result, until January 4, 2016, an ad hoc group of individuals collectively supported each other and drove the efforts of the Division. On January 4, 2016, the Program Managers (including the one acting as Interim Division Chief and the Interim Program Manager) returned to work full-time. Many of the mutual aid staff who had been acting as Program Managers and Supervisors stayed to assist to some degree for nearly six more months. The temporary Division Chief recruited by the CDPH only stayed for approximately a week after January 4, 2016, which afforded the Interim Division Chief, Program Managers, and Program Coordinator limited time for transition. The initial Interim Division Chief would act in that capacity for another few weeks, but would ultimately retire. The other Program Manager was appointed Interim Division Chief in his place and later appointed permanent Division Chief in March 2016. A Supervisory Environmental Health Specialist was made an Interim Program Manager in addition to the one that had been acting as an Interim Program Manager already. Both were promoted to permanent in May 2016. Although the Division’s leadership would be reconstituted within approximately one month, narrative 6.2 Reconstituting Employment Levels and Practices on page 141 further details the long-term impact to the EHS supervisory hierarchy. The Transition Period between the Temporary EHS Chief and Returning Leadership… The EHS Division’s returning leadership applauded the appointment of an independent “third party” temporary Division Chiefsomeone without a connection to the County that could lead objectively rather than with their heart. In addition, the individual was someone with directly relevant expertise in County-level environmental health services with equally robust leadership experience. That type of leadership and external support would have been welcomed for a much longer period than the one-week transition period. It’s possible the departure of the temporary Division Chief was hastened to avoid any perceptions of threats to positions or lack of confidence in returning staff. Whatever the cause, the returning EHS leadership voiced they did not have those concerns. And while the temporary Division Chief made himself available for telephonic consultation after departing, the returning EHS leadership had wished he remained in a full-time role to support transitions and organizational recovery for a longer period, especially considering most of EHS returning leadership were new to their positions at the time and were immediately faced with the daunting task of defining a new normal for the Division and the path toward achieving it. Narratives and Analysis 120 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 5.2 Continuity of Essential Functions The functions of the Department of Public Health (DPH) Environmental Health Services (EHS) Division protect public health and maintain regulatory compliance within San Bernardino County. The EHS Division provides education, permitting, plan checking, inspections and enforcement in the areas of body art, food operations and facilities, housing and camps, massage clinics, medical waste, mosquito and vector control, public swimming pools, drinking water, solid waste, wastewater, and wholesale food preparation and processing. As a result of the December 2, 2015 terrorist attack, the EHS workforce was seriously impacted (see narrative 5.4 Alternate Personnel on page 131 for more information); however, the demand for service from the public, business, and industry within San Bernardino County remained strong and unchanged. The EHS Division would have to maintain a minimum level of performance to avoid the emergence of public health hazards and regional economic impacts. With only two exceptions, from December 2nd to December 13th, EHS functions were not performed as the DPH, County, and returning EHS managers worked to organize temporary staffing and leadership for the EHS Division.68 During that time, the DPH Department Operations Center (DOC) took responsibility for logging calls and submissions to the EHS Division’s “800” phone number and online complaint/inquiry systema role the DOC would play for a few months. At that time, EHS staff had to change the greeting for the call center and then provide the log-in information to the DPH DOC. With a new call center provider as of November 2016, a pre-recorded message can now be activated during an emergency without EHS staff involvement and the DPH DOC has access information. The DPH DOC did not deploy resources in response to those initial notifications/inquiries, but logged them so they could later be considered and acted upon by EHS staff. Additionally, on December 10th and 11th, Riverside County Department of Environmental Health inspectors replaced nearly 365 grade card placards at food services facilities bearing the name of the perpetrator. While a necessity because of the unique nature of the incident, this would not be considered a traditional emergency function of the EHS Division. Beginning on December 14th, mutual aid and volunteer staff began to perform many of the functions of the EHS Division to the greatest degree possible, but with less capacity than normal. Workload prioritization decisions had to be made on a daily basis to balance demand for service and mandated requirements with limited staffing, short-term staffing assignments (on-boarding and revolving institutional knowledge), and lack of familiarity with San Bernardino County procedures and geography. Priority was given to complaints and reported problems, second to contractual requirements, and lastly to routine inspections. Although understaffed and with staff continuously transitioning, the EHS Division was able to achieve nearly full capability levels for complaint investigations and/or service requests, per its selected continuity priorities, even as the number of complaint inquiries of food facilities, swimming pools, and vector control issues (e.g., rodent, mosquito) remained comparable to the previous year. 68 For more information on efforts to reconstitute staffing and leadership, see narratives 5.1Evolution of Leadership on page 115 and 5.4 Alternate Personnel on page 131. Narratives and Analysis 121 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F Consistent with the functions determined to be lower priority, most routine inspections were delayed. By February 2016, however, it became apparent to the EHS Division and DPH that the delay was growing and would become worrisome as time went on. This was the trigger for the County Chief Executive Officer (CEO) to approve contracting for temporary EHS staff to address the growing inspection void. The contract staff was intended to complement and ultimately replace mutual aid staff. Contract staff began the week of March 21, 2016 and was initially planned for approximately one year. As of the writing of this report, contract support was still needed and contracted through December 31, 2018. Once contract staff began, some service levels began to improve. Most notably during the first six months after the attack, all inspections were reduced significantly. For example, from January 2016 to June 2016 as compared to the same period of time the previous year, the EHS Division conducted 44% fewer plan checks and construction inspections, 41% fewer pool inspections, 69% fewer vector control and mosquito inspections, and 24% fewer food facility inspections. Per its continuity priorities, however, the Division was able to sustain and even increase its number of food complaint investigations year over year. Two years after the attack, the performance levels for this sampling of essential functions had continued to improve, but the EHS Division was still running a deficit of 12% fewer plan checks and construction inspections, 34% fewer pool inspections, 20% fewer vector control and mosquito inspections, and 24% fewer food facility inspections for calendar year 2017 versus 2015 (the year prior to the attack). The diagram on the next page illustrates the service levels of this sampling of EHS functions from January 2015 to December 2017. O P E R A T I O N S Narratives and Analysis 122 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Sampling of EHS Inspection (Essential Function) Levels January 2015 (Year Prior to Attack) to December 2017 (2 Years After Attack) C O N T I N U I T Y O F * Data provided by San Bernardino County EHS Division. Narratives and Analysis 123 O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F O P E R A T I O N S Other programs were affected in various ways:  The medical waste program was able to meet its full caseload from the time of the incident to the time of this report’s publication; initially thanks to mutual aid provided by CDPH through May 2016.  Essential construction inspections were prioritized over routine inspections and the number of total construction inspections was reduced for approximately six months after the attack.  Food handler field enforcement was discontinued completely for nearly a year.  The California Department of Resources Recycling and Recovery (CalRecycle) waived its 2015 fourth quarter regulatory reporting requirement, which would have been due from EHS at the end of December. In January and February 2016, mandated CalRecycle inspections of regulated entities were devolved from EHS back to CalRecycle, which in turn sent personnel to San Bernardino County to conduct necessary inspections. The EHS Division resumed CalRecycle functions in March 2016.  Some State regulatory reporting and work plan requirements associated with the State Water Resources Control Board, including Vector Control, and CDPH Medical Waste Management Program were either waived or postponed. Like CalRecycle and CDPH Medical Waste Programs, CDPH Vector Control staff also worked locally to address much of that responsibility for the EHS Division until June 2016.  Required drinking water inspections were devolved to, and performed by, the California Department of Water Resources (DWR) through June 2016.  Beginning on December 21, 2015 and lasting through June 2016, plan check functions, all of which could be performed remotely, were devolved to Los Angeles County Department of Public Health and Riverside County Department of Environmental Health Services. No plan checks were reported delayed and no backlog was reported. Before assigning that responsibility to Los Angeles and Riverside Counties, the EHS Division’s temporary staff prioritized plan check submittals, initial checks, and final reviews to inform those external efforts. As a result of returning staff, new hires, and continued contractor support, EHS Division capability levels continued to improve through the writing of this report (more than two years after the incident), but deficits remained and functional prioritization decisions were still being made on a daily basis. By any organization’s account, it had been an extended continuity event. Per industry and government continuity standards, organizations are often expected only to plan for continuity events ranging in duration from one to a few months. Regarding the degree to which functions were being performed, it is more difficult to reach a definitive determination as to the adequacy of continuity efforts. As narrative 2.1 Department Emergency Operations Plans (DEOPs) on page 41 describes, the County did not have sufficient continuity plans or strategies in place prior to December 2, 2015 to define minimum performance levels (i.e., recovery point objectives). For example, the DPH DEOP lists only one essential function associated with the EHS Division (“FT Counter Public Service [Ontario, San Bernardino, Victorville]”) and identifies only 6 staff as necessary to maintain the function. Effective continuity plans would have identified all the EHS Division’s essential functions, which from real-world experience were greater than one, and their associated recovery point and time objectives (RPOs/RTOs)this was a concern for all County DEOPs at the time of this report. The Narratives and Analysis 124 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County RPOs and RTOs would have captured the minimum performance level necessary and maximum duration of service outages allowable to avoid serious consequences beyond the County’s and community’s risk tolerance. Had these existed, it would have been easy to objectively determine whether RPOs and RTOs were achieved in San Bernardino’s case. In their absence, such determination would be subjective. While this report did not investigate it, there were no incidents of public health, economic, or other impacts reported to the authors of this report linked to the EHS Division’s diminished capacity. Regardless of the objective assessment of continuity efforts associated with essential functions, compliments are certainly owed to all those involved in the EHS Division’s continuity and resumption because the reality was the Division took on many more responsibilities than it previously had, well beyond resuming and sustaining essential functions. These extraordinary responsibilities included, but were not limited to:  Managing continuously changing mutual aid and contract staff.  Managing the leave, evolving schedules, and paperwork of returning staff.  Coordinating counselors for staff, addressing psychological needs, and changing group dynamics.  Hiring and training new staff, along with processing all necessary documents.  Taking daily attendance of all staff reporting for duty for approximately three months.  Handling communication to returning employees and those on leave via mailers, email, and website posts.  Regularly reviewing workload, demand for service, and staffing to provide ongoing reports to County executives and the media/public.  Managing relocations and supporting facility renovations.  Handling donations, tribute events, and special occasions.  Managing large quantities of incoming mail of support and condolences (e.g., banners, posters, gifts, cards, letters). Narratives and Analysis 125 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y This page is intentionally blank. O F O P E R A T I O N S Narratives and Analysis 126 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 5.3 Alternate Facilities San Bernardino County’s reasons for temporarily relocating personnel to alternate facilities were different than most organizations dealing with an incident affecting the continuity of its operations. The terrorist attack occurred at a non-County facility; technically leaving the County’s physical office spaces unscathed and fully operational. However, three factors would quickly influence the County’s decision to temporarily relocate personnel while undergoing renovations of permanent office facilities: 1) since the male perpetrator was a County employee, his office area became a crime scene being investigated by local and federal law enforcement agencies; 2) the office areas of the deceased and injured victims appeared “frozen in time” and, along with the perpetrator’s office area in the same vicinity, presented psychologic barriers to healing and recovery; and 3) security concerns voiced by survivors would lead the County to make security alterations to make personnel comfortable with returning to work. By December 4, 2015 (two days after the attack), the County had determined either a permanent relocation or complete renovation of existing workspace of affected divisions was necessary. Regardless of the selected option, County leadership felt they could not ask affected personnel to return to their old office space for any amount of time because of the psychological implications. As a result, Department of Public Health (DPH) Environmental Health Services (EHS) Division personnel from two locations were relocated for nearly a year until renovations to permanent facilities (the ultimately selected option) were complete. In addition, personnel from the Land Use Services (LUS) Department Code Enforcement Division and Information Services Department (ISD) Multimedia Services Division who shared office space with EHS at the two locations slated for renovation were also relocated. The majority of EHS personnel present for the terrorist attack, all the deceased and injured victims, and the male perpetrator, worked from EHS’ two primary office locations: 1) County Government Center - 385 N. Arrowhead Ave., 2nd Floor, San Bernardino, CA (hereafter referred to as the County Government Center); and the 2) Rancho Cucamonga County Office Building 8575 Haven Ave., Suite 130 Rancho Cucamonga, CA (hereafter referred to as 8575 Haven Ave.). The EHS and LUS Code Enforcement Division operations at both of these sites were temporarily relocated and the facilities ultimately renovated. The EHS Division also has two small operations at 248 S. Sierra Way in San Bernardino, CA dedicated to Mosquito and Vector Control services and some functions at the County’s High Desert Government Center at 15900 Smoke Tree Street in Hesperia, CA. Operations at these two locations were not relocated nor were facilities renovated. As narrative 2.1 Department Emergency Operations Plans (DEOPs) on page 41 explained, the County’s pre-existing DEOPs did not include sufficient continuity strategies associated with alternate facilities or the relocation of functions. For example, the DPH DEOP listed three other fully-occupied sites as alternate locations for any functions in the central San Bernardino valley that may require relocation (i.e., another DPH office, a DPH Clinic, and a Human Services office building; none of which had available space). As a result, potential temporary facilities had to be identified and prepared to support alternate operations at the time the decision to relocate was made. On Friday, December 4, 2015 a “Project Team” was established by direction of the Narratives and Analysis 127 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F O P E R A T I O N S County Chief Executive Officer (CEO) charged with identifying alternate space, preparing it, and relocating affected divisions by December 14th (the initial anticipated return date for EHS personnel, which was later pushed to January 4, 2016 with paid leave expiring no later than January 11, 2016). The Project Team included 18 individuals from the Real Estate Services Department (RESD), Information Services Department (ISD), Department of Public Health (DPH), and Environmental Health Services (EHS) Division. The Project Team’s first task was to review existing County-owned floor plans and identify vacant space available as well as properties currently leased by the County with potential space available. Over the weekend of December 5th/6th, despite finding building information was not readily available, up-to-date, or backed-up, the Project Team identified two potential alternate sites; both of which came to their attention early as the sites had been slated for assignment to other departments and were known to be vacant. The anticipated plans had EHS’ functions from the County Government Center moving to a vacant space in a building within walking distance of the Government Center and next door to the headquarters of the DPH at 172 W. Third St., 1st Floor, San Bernardino, CA (hereafter referred to as 172 W. Third St.); and the 8575 Haven Ave. functions moving about half a mile to a County Courthouse Building at 8303 Haven Ave., Rancho Cucamonga, CA (hereafter referred to as 8303 Haven Ave.). On Monday, December 7, 2015, members of the Project Team toured the existing EHS office spaces and potential alternate facilities. During the tour of the existing 8575 Haven Ave. offices it was discovered that LUS Code Enforcement Division shared work space with EHS personnel. The Project Team had previously believed the Code Enforcement offices were physically separated from the EHS offices. On Tuesday, December 8th, the LUS Director and County CEO visited with the Code Enforcement staff at that site and immediately authorized them to take leave until January 4, 2016 (a similar timeline as EHS staff) and the CEO directed the Project Team to also relocate Code Enforcement functions until renovations or permanent new EHS facilities were coordinated. The Code Enforcement staff asked to be relocated to the same facility as their EHS colleagues if possible. During this same time, ISD Multimedia Services Division had chosen to remain in their existing office spaces adjoining the EHS Division offices in the County Government Center. It wasn’t until late Friday, December 11, 2015, that the Multimedia staff opted to relocate as well. The relocation would ultimately prove necessary as the Multimedia Services and EHS office spaces in the Government Center were physically flipped during the renovation. By Monday, December 7th, emergency procurement authorities had already been granted through an act of the Board of Supervisors. The CEO and Finance Division had given their blessing to the Project Team to do “whatever was necessary” to prepare the selected spaces in the time allotted. As a result, RESD called upon a few of its existing on-call/Job Order Contracting (JOC) contractors with whom it had long-standing relationships. These were contractors it trusted to consult on, support, and be equally committed to, the relocation effort. Between Tuesday, December 8th and Thursday, December 10th, the Project Team developed floor plans and logistical strategies to support relocation needs and alternate operations. To Narratives and Analysis 128 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County ease the transition and provide a degree of comfort and familiarity, the Project Team’s intent was to mirror the existing primary facility as much as possible. With care and respect, the Project Team documented how each workstation had been laid out and organized, where individuals sat with respect to each other, and the locations of supplies and equipment relative to each workstation. The plan for the 172 W. Third St. alternate site was approved on December 10th and 8303 Haven Ave. on December 11th. An existing ISD office area was identified on the third floor of the County Government Center to accommodate the seven Multimedia Services Division staff. Moving them out of the County Government Center would have been prohibitive as they needed regular access to the production facilities on the second floor of the building. From Friday, December 11th to Sunday December 13th, the Project Team, RESD, ISD, the Human Resources (HR) Department, and contractors worked tirelessly to prepare all the alternate facilities for operations (including the 3rd Floor space in the County Government Center for the Multimedia Services Division). Actions included painting, carpeting, installing lighting, equipment, telephones, moving or acquiring furniture, installing information technology systems and access controls, moving files, documentation, and resources, among others. Of particular note, a small team of DPH, RESD, and HR staff personally boxed up, labeled, and transported the personal effects of each survivor to the associated workstation at the alternate facility. The Project Team had contemplated hiring a moving company to do so, but ultimately wanted to ensure the personal items were treated with the utmost respect and care. On Monday, December 14th, the alternate facilities were operational and ready to accommodate personnel. The cost of renovating and equipping the two temporary spaces totaled approximately $200,000. The 8303 Haven Ave. space was prepared for 14 people, including 9 EHS staff and 5 LUS Code Enforcement staff.69 The 172 W. Third St. site was prepared for 55 EHS staff. Both sites also included a sufficient amount of space and equipment to nearly mirror the storage, supply, and reproduction requirements, meeting/conference spaces, break rooms, reception areas/guest seating, and public counters as the primary sites they were replacing. It took a number of days for signage to be posted at EHS’ primary locations notifying the public of the relocation and partial closure. In addition, the physical closure of the office space and relocation of the EHS offices were not widely communicated to County staff or the public. Staff at the County Government Center, particularly those on the second floor adjacent to the EHS office space, was regularly approached by the public looking for EHS services. Those staff from other departments then had to explain the terrorist attack and attempt to contact EHS. Each of those departments self-initiated and sought out the correct contact information and was usually given the phone number of an acting manager at EHS as a point of contact. Global messaging to County departments on how to handle and direct those public inquires could have been of value. 69 Due to the limited availability of Supervisors, all EHS staff was initially assigned to work from the 172 W. Third St. alternate facility. It wasn’t until months later that some returning EHS staff and new hires were assigned to the 8303 Haven Ave. alternate facility. The 8303 Haven Ave. site was used by the LUS Code Enforcement staff the entire time. Narratives and Analysis 129 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F O P E R A T I O N S Generally, all personnel interviewed and those who submitted documentation were satisfied with the alternate facilities and felt they sufficiently supported functions to the degree they were being performed.70 As can be expected of quick turnaround projects and older facilities, there were some minor facility and coordination matters in the beginning. For example, the 8303 Haven Ave. alternate facility is also an active County Courthouse with heightened security. At the time of the initial relocation, the building’s security staff was not fully informed of the new tenant and therefore some relocated employees and their visitors were denied access or faced challenges accessing the new office space. The matter was addressed within a few days. Personnel from both sites mentioned matters such as minor technical glitches, copy machines and telephones not being connected, minor plumbing problems, and workspaces being tighter and smaller than they were accustomed, but manageable. However, no issues were identified over the course of the relocation that would have threatened the performance of essential functions. All personnel mentioned being pleased alternate facilities had the resources to perform functions. More so, they voiced appreciation for being able to work from alternate facilities and for the many small hospitable gestures that were made by the Project Team (e.g., signage on each workstation designating the staff member’s name and program, the care given to the movement of personal effects). This was a significant feat considering the 10 day turnaround on previously unidentified alternate facilities that would then remain operational for nearly a year. While the Multimedia Services Division’s alternate office space was small, those interviewed mentioned it was functional and convenient to the production studios just one floor below. In addition, the Multimedia Services Division staff mentioned in hindsight that relocating was the best decision even though it was made later than others as remaining in the former space shared with the EHS Division would have had growing psychological and morale challenges. The decision to renovate the permanent facilities rather than permanently relocate was made in late December 2016 (more information on that process can be found in narrative 6.3 Facility Renovations on page 145). As a result, the 172 W. Third St. alternate facility was used until October 2016 and the 8303 Haven St. site until November 2016 when the renovations of the County Government Center and 8575 Haven Ave. were completed, respectively. The transition to newly renovated permanent facilities took place in a phased approach over the course of a few weeks as equipment, resources, and personnel slowly made the migration between sites while maintaining essential functions. 70 For more information on what functions were being performed and to what degree, see narrative 5.2 Continuity of Essential Functions on page 121. Narratives and Analysis 130 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 5.4 Alternate Personnel On the morning of December 2, 2015, the Department of Public Health (DPH) Environmental Health Services (EHS) Division had 92 positions filled. Seventy-two (72), including the male perpetrator, were present for the training event at the Inland Regional Center (IRC). By that afternoon, 39% of the EHS Division’s workforce had been killed or injured.71 The remaining 56 staff, whether present for the attack or not, experienced varying degrees of psychological trauma. The staff available and capable of supporting the EHS Division’s essential functions fundamentally went from 92 to none in a matter of minutes. Although the County’s Department Emergency Operations Plans (DEOPs) did not sufficiently address workforce continuity,72 even the most robust continuity programs do not typically address the complete insolvency of staffing for an entire division or organization. Because EHS functions have a State mandate and direct link to public health, safety, and the regional economy they could not be discontinued for long, and DPH and the County knew almost immediately they would be faced with figuring out alternate staffing strategies. Among other reasons for which it became operational, the DPH Department Operations Center (DOC) was activated by the County Health Officer on the afternoon of December 2, 2015, as was the County’s Medical Health Operational Area Coordinator (MHOAC) program, to begin considering staffing sources to sustain the EHS Division’s essential functions. The training and certification requirements to perform most EHS functions, such as those associated with Registered Environmental Health Specialist (REHS) I, II, III and Supervisory REHS, are set by State regulation. Consequently, any alternate personnel would need to be fully qualified to complete the work. To address this situation in the immediate-term, the decision was made by a combination of DPH and Human Resources (HR) Department leadership to recruit retirees and pursue mutual aid. REHS personnel from other County departments or close partners (e.g., San Bernardino County Fire Protection District’s Hazardous Materials Teams) provided assistance to EHS on weekends and on their days off but was not a long-term solution. Where non-technical staff was needed, the County reassigned personnelprimarily clerical and administrative from other departments to the EHS Division, particularly seeking out staff that had previously worked for the EHS Division. In some cases those staff from other departments remained with the EHS Division for months. When it came to technical staff, the County’s DPH, including its EHS Division, is part of a robust medical and health disaster response and mutual aid system in the State of California, including the MHOAC program. As a result, on December 7th and into the 8th, the Director of the California Department of Public Health (CDPH) reached out and held multiple meetings with County DPH to determine the staffing needs to sustain the EHS Division and mobilize necessary mutual aid. The initial request from County DPH was for: a) staff to replace the restaurant “grade” inspection cards and suppress the perpetrator’s name on associated digital inspection reports;73 b) EHS leadership positions (Division Chief, Manager, and two Supervisors); and c) 71 Thirteen (13) EHS Division employees were killed and 22 physically injured during the terrorist attack. One of the 14 deceased was an employee of the IRC. 72 For more information, see narrative 2.1 Department Emergency Operations Plans (DEOPs) on page 41. 73 For more information, see narrative 2.6 Addressing the Perpetrators Footprint on page 65. Narratives and Analysis 131 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F O P E R A T I O N S operational staff to achieve minimum operations (seven registered environmental health specialists, one water system inspector, four local enforcement agency inspectors [for solid waste], and one vector control specialist). During the week of December 7 th, the CDPH confirmed a recently retired county-level Chief of Public Health with 25 years of experience as a county-level environmental health director would oversee the County EHS Division until the County’s staff began to return in January 2016.74 On December 9th, guidelines were established for all other mutual aid requests, including a preference for rotations of mutual aid staff every two weeks (which would not come to fruition in most cases), reimbursement to mutual aid providers, and support for housing and travel costs. Also on December 7th, a few former EHS Division staff that had retired showed up at the EHS offices to offer support. They initially assisted with answering phone calls, addressing customer needs, and other office matters. Four (4) retirees would ultimately rejoin EHS in early January 2016 on a semi-permanent basis to assist with essential EHS functions. The California Department of Public Health (CDPH) ensured their credentials were reinstated without issue. While the County was fortunate to have retirees return, there were still some costs involved in on-boarding them. For example, some retired staff had great expertise and work ethic, but were not familiar with the computer system then employed by EHS. To accommodate them, they were allowed to use hard copy alternatives and administrative staff later uploaded the necessary data to the EHS’ computer system. On December 10th and 11th, the Riverside County Department of Environmental Health accepted the first mutual aid request and deployed 22 inspectors who worked over the course of two days to replace nearly all 365 placards from food services facilities bearing the name of the perpetrator. The other mutual aid requests, including leadership positions, were set to arrive on Monday, December 14, 2015 to reinstate EHS essential operations. Between December 10th and December 24th, 63 mutual aid personnel were provided to San Bernardino by Riverside and Los Angeles Counties (including the 22 that replaced the perpetrator’s placards) and CDPH. The EHS Division’s Interim Chief, Program Manager, Interim Program Manager, and Program Coordinator returned full-time on January 4, 2016. At that time, CDPH recalled the individuals assigned to EHS leadership positions, but continued to provide supervisory and mutual aid staff for another five months. All other EHS staff was slated to return no later than January 11th when their temporary leave would expire. During the first week, 13 EHS staff returned on modified schedules and it quickly became evident that mutual aid would be needed for much longer than initially expected and would likely need to be replaced with more long-range staffing solutions. Between January and June 2016, the EHS Division would continue to receive mutual aid support. Beyond CDPH, Los Angeles County, and Riverside County, that support would grow to include staff from Orange, Ventura, San Luis Obispo, Contra Costa, and Marin Counties, the California Department of Resources Recycling and Recovery (CalRecycle), and the California Department of Water 74 For more information, see narrative 5.1 Evolution of Leadership on page 115. Narratives and Analysis 132 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Resources Drinking Water Division. Mutual aid support would remain consistent at 44 staff in January and February 2016 (equating to nearly 1,600 labor hours each month), but declined each month thereafter as permanent EHS staff returned, new hires began, and contractors were brought on board. Unfortunately, while the number of mutual aid staff remained stable, the actual individuals assigned often turned over on a daily basis requiring permanent EHS staff to essentially on-board and educate mutual aid staff each day. The diagrams shown on pages 135 and 136 illustrate the level of mutual aid provided to the EHS Division from December 2015 through June 2016.75 During the time mutual aid was in use, the dynamic and time-consuming process of finding, scheduling, and coordinating logistics for mutual aid staff was facilitated on a daily basis through California’s medical and health disaster response and mutual aid system. Both mutual aid providers and permanent EHS staff commented that on-boarding and assigning mutual aid staff was made additionally complicated because there were few to no written guides or “cheat sheets” for basic administrative matters (e.g., getting assigned a County vehicle; how to order supplies; locations of restrooms, break areas, etc.; directions to various points within the County). None of the mutual aid staff could be asked to immediately begin without a training and on-boarding period; a process that had to be repeated on nearly a daily basis as replacement mutual aid staff cycled in. As time went on, some previous mutual aid staff returned for later deployments, which eased this burden. However, permanent EHS staff also had to address more personnel and performance issues because of the revolving nature of mutual aid assignments during that time than was the norm. Recognizing mutual aid could not be a long-term solution to the EHS Division’s staffing needs and seeing that capability levels were falling behind, the DPH and County leadership (the PostIncident Coordination Group) began outreach to various sources in February 2016. By that time, job offers to some new full-time employees had been accepted and they were slated to be onboarded within a month. In addition, EHS staff continued to return, though mostly on modified schedules. It was evident that a resumption of staffing levels was going to take time, particularly since temporarily vacated positions were secured. Post-Incident Coordination Group members and the DPH reached out to local universities with known environmental health programs for current students and alumni that may be interested in assisting. They also reached out to the California Environmental Health Association (CEHA), California Association of Environmental Health Administrators (CAEHA), and the National Environmental Health Association (NEHA) for recommendations and support. It was through that outreach that the possibility of contracting with CAEHA for the provision of qualified EHS staff became a tangible option. On March 22, 2016, the County Board of Supervisors approved a contract with CAEHA for the provision of licensed, professional temporary staff to perform environmental health-related functions normally performed by actively recruited vacant positions or existing staff currently on leave as a result of the terrorist attack. The contract, in an amount not to exceed $1,500,000, was for the period of March 22, 2016 through February 28, 2017, with the option 75 June 30, 2016 was also the date the Board of Supervisors authorization dated December 7, 2015 allowing emergency procurement and reimbursement of mutual aid services expired. Narratives and Analysis 133 C O N T I N U I T Y O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y O F to extend the contract for one additional one-year period. Unlike the constantly rotating assignments available through mutual aid, the CAEHA personnel would be assigned for a minimum of 90 days with the option to renew the assignment at the end of each cycle. This approach allowed the contracted staff to develop institutional knowledge of programs and processes and build relationships with County staff and customers. Meanwhile, the tenure was short enough to allow the contracted position to be retired upon the full-time return of EHS staff or on-boarding of new hires. On September 13, 2016, the County Board of Supervisors approved an increase in the amount of the CAEHA contract by $1,000,000, from $1,500,000 to $2,500,000, and extended the term through December 31, 2017. Similar to the challenges faced with recruiting mutual aid and new hires, even CAEHA experienced some difficulty recruiting the required number of qualified and credentialed environmental health specialists. The County and CAEHA queried CDPH to see if CAEHA could hire REHS staff with lapsed credentials. The request was denied. As the diagram on the next page illustrates, the CAEHA contract provided 5 to 28 full-time staff to EHS as needed, with an average of 20 full-time staff per month in 2016 and an average in 2017 of 9 per month. Nearly a year later, recognizing that the EHS Division still would not reach optimal staffing levels by the end of 2017, the Board of Supervisors approved an additional increase in the contract value by $1,000,000 to a total of $3,500,000 and again extended the term, this time until December 31, 2018. At the time of this report, the EHS Division still had 5 CAEHA contractors working full-time and had planned to maintain those through 2018. As of March 2018, more than two years after the attack, the EHS Division was still short staffed a total of 9.5 equivalent full-time positions from its pre-incident levels and was dealing with the long-term effects of diminished institutional knowledge and leadership.76 O P E R A T I O N S 76 See narrative 6.2 Reconstituting Employment Levels and Practices on page 141 for more information. Narratives and Analysis 134 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y * Diagrams and data provided by San Bernardino County EHS Division. * Diagrams and data provided by San Bernardino County EHS Division. Narratives and Analysis 135 O F O P E R A T I O N S Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O N T I N U I T Y * Diagrams and data provided by San Bernardino County EHS Division. O F O P E R A T I O N S Narratives and Analysis 136 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Category 6: Organizational and Financial Recovery This section examines the situations and actions with which San Bernardino County has been involved to establish a new operational steady state, make the organization fiscally whole, and effect long-term changes to address the cultural and operational ramifications of the terrorist attack. The eight narratives in this category explore the ongoing efforts to remember the victims and effects of the attack, long-term efforts to reconstitute staffing and traditional management practices in the Environmental Health Services (EHS) Division, permanent renovations made to County facilities to address psychological concerns, and long-term security measures to address a new paradigm of threats. In addition, this category addresses the total costs associated with the attack and the County’s efforts to recover some of those costs through State and Federal sources. Horrific incidents such as the December 2, 2015 terrorist attack often have long-range public policy and legal implications, which are also explored. The story of the County’s recovery was still evolving at the time of this report, but this section offers insights into the foundation that had been laid in the two years since the attack to propel the organization toward a new steady state. 6.1 Memorials and Remembrances Since the December 2, 2015 terrorist attack, the County hosted several memorial events and there were ongoing plans for a permanent memorial on the grounds of the County Government Center at the time of this report. County leadership had consistently sought to remember and honor the victims in a manner that was compassionate, respectful, and inclusive of the entire County family. “County Family Gathering” Memorial Event One month after the attack, on January 4, 2016, the County hosted a memorial event to honor and commemorate the victims. Planning for the event began the week after the attack as it became clear the “County family” needed an opportunity to collectively heal and triumph over terror. Since many County employees had spent the first weeks after the attack attending funerals and addressing their own grief, organizers wanted to avoid a funeral atmosphere and indicated so by calling the memorial a “County Family Gathering.” A group of County officials spent much of their 2015 holiday season planning and organizing the large event that would receive national attention. All County employees not assigned to essential services at the time were invited to participate in the event and were given paid time off to attend. Many County offices were closed at noon that day to maximize the opportunity for participation. Other than the loved ones of victims and first responders and elected officials from the 24 cities in San Bernardino County, participation from any non-County employees was prohibited. Approximately 2,000 attended the event held at the Citizens Business Bank Arena in Ontario, California. Former New York City Mayor Rudy Giuliani and popular evangelist Pastor Rick Warren of Saddleback Church each gave key note addresses at the event. California Governor Jerry Brown and California Attorney General Kamala Harris were in attendance. Narratives and Analysis 137 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O NF O TI R IN G NA A UN N IC I TI Z YA A L TO I FR O E N OC A PO L EV RE & AR TY I O N S Security at the event was a paramount concern. County employees had to present Countyissued identification badges and all attendees had to enter through metal detectors. The media was allowed to attend, but was not allowed access to victims or families. Separate reserved seating was established for the victims, their families, and all other Environmental Health Services (EHS) Division employees toward the front of the arena. Those seats were surrounded by sworn law enforcement to ensure the victims and families felt protected. In connection with the “County Family Gathering,” the County held a private luncheon for EHS employees and the families of the deceased that took place at the same location immediately prior to the Family Gathering. Security was very tight and those participating had the option to view the Family Gathering from private boxes in the arena if they wanted to stay out of the crowd. Anniversary Events Officials of the County Administrative Office (CAO) and EHS leadership began meeting in September 2016 to plan an event to mark the first anniversary of the attack. County officials realized the anniversary was likely to trigger unease and grief for a group that was still in the midst of the healing process. At the time, the EHS Division remained significantly understaffed and had just recently moved back into its renovated permanent office space. EHS managers were concerned about additional publicity and the employees’ anxiety surrounding an anniversary event. After much planning, the first year anniversary memorial event took place in a Sheriff’s Department aviation hangar at the San Bernardino Airport. Invitations were limited to EHS staff and victims’ families. The event included a moment of silence and lunch for over 300 attendees. The facility included private quiet spaces and Department of Behavioral Health (DBH) and Counseling Team International (CTI) counselors were on site, if needed. Like the “County Family Gathering,” security at the anniversary event was high. Attendees had to preregister to attend and only cars with registered attendees were able to access the parking area. All attendees were subject to bag checks and passed through a metal detector in order to enter the hangar where there was a significant law enforcement presence outside and inside of the hangar. Beyond the County-sponsored memorial service, there were several other events organized by individuals or community organizations, including a ceremony at the Inland Regional Center (IRC) and a memorial service at California State University, San Bernardino. Special care was taken by the County to ensure the victims and their families, and those present at the attack, were notified of all anniversary events of which the County became aware. On the second anniversary of the attack, which fell on a Saturday, the County did not host an event, but lowered flags to half-staff and asked the public to join in a “Moment of Remembrance” at 10:55 a.m. A private event was held with the EHS Division on the Friday before. The County also paid tribute to the victims on the CountyWire blog and social media accounts.77 77 San Bernardino County’s Facebook account Tribute from December 2, 2017 is available online at: https://www.facebook.com/SanBernardinoCounty/videos/10159697989565010/ Narratives and Analysis 138 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Permanent Memorial In March 2016, the December 2 Memorial Committee was formed by the County to plan for a permanent memorial to honor and remember those killed and injured in the terrorist attack. The committee was led by Board Supervisor Josie Gonzales and included victims' relatives, EHS employees, the County Chief Executive Officer (CEO) and CAO Public Information Officer (PIO). Within the first few months, the Committee proposed the County Government Center as the site for the memorial. In November 2017, the committee announced it was close to selecting a consultant with experience in public memorials to facilitate the search for an artist to design the memorial. While the exact design of the memorial had yet to be decided upon at the time of this report, Supervisor Gonzales announced the Committee was hoping to create a space for quiet reflection. According to Supervisor Gonzales, the goal of the memorial is to "serve as a place where all can remember each of those who were taken from us and the beauty they brought into the world" and "to recognize the tenacity of our community to persevere and move forward." As of the date of this report, the budget for the permanent memorial had yet to be solidified. O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Narratives and Analysis 139 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O NF O TI R IN G NA A UN N IC I TI Z YA A L TO I FR O E N OC A PO L EV RE & AR TY I O N S This page is intentionally blank. Narratives and Analysis 140 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 6.2 Reconstituting Employment Levels and Practices As other sections of this report describe, County administrators looked to a variety of shortterm staffing solutions to address deficits within the Department of Public Health (DPH) Environmental Health Services (EHS) Division, namely mutual aid and contracted staff intended to last until EHS staff returned to work or resolved their employment status. Within weeks of the attack, it became evident a good portion of EHS staff were unlikely to return. Of the 113 EHS budgeted positions, 92 were filled on the day of the attack. Thirty-nine percent (39%) of those were deceased or physically injured as a result of the attack. A daily average of 35 returned to work during January and February of 2016. Most of those, however, did not work full-time, and some were at work for as little as an hour each day. On average, only 11 staff members were working full-time during those two months. Though the numbers continued to fluctuate, as of the publication of this report, 41% of EHS staff had either never returned to work or were no longer employed with the EHS Division, and 10% were still on modified schedules. EHS, DPH, and County leadership knew as early as December 2015 that more permanent resources would be needed beyond what mutual aid and volunteers could provide. Recruitment and Progress Soon after the attack, County administrators looked toward hiring EHS staff to reconstitute the Division. On December 17, 2015, the Human Resources (HR) Department provided a list of nearly 60 candidates for consideration for the 11 budgeted but vacant inspector positions. The candidates were pulled from lists established during previous EHS recruitments so they were immediately available. Of the 60 candidates only two were selected who met both the Division’s business needs and were also believed to be compatible with the unique work environment. Registered Environmental Health Specialists (REHS), also known as Health Inspectors, are specialized positions requiring in-depth training. In order to become a REHS registered by the California Department of Public Health (CDPH), one must have a bachelor’s degree, potentially possess as much as 18 months of on-the-job training depending on their bachelor’s degree, and pass a comprehensive examination. The County made available recruitment and referral incentive programs in an effort to fill these hard-to-recruit positions. Multiple challenges faced the County’s recruitment effort. First, positions filled by employees on leave were protected; others could not be hired in those same budgeted positions until they were permanently vacated. Although not unique to this situation, the County, with the agreement of the Service Employees International Union (SEIU), employed the common practice of using temporary employees to fill protected, but currently vacant positions, known as a “dual fill.” Newly recruited staff on-boarded as “dual fill” employees could have their positions eliminated if EHS staff returned to work. However, since the Division’s intent was to recruit individuals interested in permanent employment despite the temporary sounding nature of the hiring vehicle used to recruit them, the DPH committed to finding a new home for the “dual fill” hires should EHS staff return to those positions. In addition, while San Bernardino County’s salaries for environmental health inspectors were competitive for counties of similar size and cost of living, they were less than its geographically close, but larger neighboring counties with higher costs of living (e.g., Los Angeles, Orange), which reportedly posed a challenge to recruitment. A program of signing bonuses helped to lure applicants. Narratives and Analysis 141 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O NF O TI R IN G NA A UN N IC I TI Z YA A L TO I FR O E N OC A PO L EV RE & AR TY I O N S The majority of the health inspector applicants were trainees with limited to no experience in environmental health. The County targeted these entry-level candidates with opportunities for training, certification support, and chances for later advancement by reaching out to nearby colleges, associations, and other potential sources. The County then needed to take on the role of cultivating the hired trainees. Understandably, EHS was initially in no position to provide the in-depth training to the large numbers of new REHS trainees. Therefore, EHS collaborated with Riverside County Environmental Health Department to send newly hired trainees to Riverside for the first few months of their employment. Many of Riverside County’s staff were at the time, or had been, mutual aid support to San Bernardino so they had an understanding of the San Bernardino process that benefited their ability to on-board San Bernardino new hires. By late January 2016, ten (10) new staff members had accepted offers and were sent to Riverside County for initial training. By the time the second group of new hires was on-boarded in March 2016, San Bernardino County EHS had enough capacity to again train new hires without needing to send them to Riverside County. Additional HR Department resources continued to be assigned to support EHS and by August 2016 a dedicated Human Resources Officer (HRO) was provided to EHS. Because of the limited availability of EHS staff to participate in interviews as the recruitment effort grew, REHS Supervisors from Los Angeles, Riverside, and Orange Counties who were in San Bernardino as mutual aid were asked to serve on interview panels. By the end of March 2016, more than 100 potential candidates had been interviewed and additional prospects had accepted offers. During the interviews, candidates were encouraged to ask any questions and present any concerns about the attack’s effects on EHS and panelists prided themselves on offering candid responses to appropriately set expectations and dispel concerns. The recruitment effort attracted mostly young, energetic, and eager-to-learn staff. Many EHS staff commented that the infusion of youth and energy likely helped the Division’s healing process. A perennial challenge that remained at the time of this report was that trainees were required to attend training using approximately 25% of their work time; meaning every traineelevel new hire was performing about 75% of the work of a non-trainee full-time equivalent in a Division still experiencing staffing shortages and workload surpluses. Compounding the matter, EHS experienced attrition typical of any organization and was also expected to grow to match its service delivery to the growth of the County (e.g., two new budgeted REHS positons were anticipated in 2018 to match the County’s growth). Considering these factors and total vacancies, the EHS Division would still need to recruit, train, and make fully functional at least 13 positions to reach necessary capability levels as of the writing of this report. As it embarked on 2018, EHS continued the process of recruiting permanent staff by filling vacancies or using “dual fills” for budgeted positions until the employment status for EHS staff that had not returned was resolved. All “dual fill” personnel hired since the attack were still employed by EHS as of the writing of this report. The diagrams on the next page illustrate restaffing progress at EHS as a whole and specifically related to health inspectors. While levels were beginning to normalize as of the writing of this report, significant deficits still existed more than two years after the attack as explored in the next section. Narratives and Analysis 142 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County * Diagrams and data provided by San Bernardino County EHS Division. * Diagrams and data provided by San Bernardino County EHS Division. Management Practices and Challenges An additional challenge of the EHS Division continues to be the supervisor-to-subordinate ratio. Supervisors and Lead Inspectors (Specialist III) direct work, manage complex processes, address sensitive issues, and train new staff. Of the 16 budgeted positions for those two classifications, only 25% had more than two years of experience in their positions at the time of this report. To put that in perspective, prior to December 2, 2015, REHS Level II staff (one level lower than a Lead) had an average of 8.5 years of experience in their current positions and an average of 11.6 years with EHS. Of the 16 Specialist III and Supervisory positions, only 7 were filled with permanent staff at the time of this report. Specialists I and II were also under-filling some of the Narratives and Analysis 143 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County vacant Level III positions. The rest of the leadership positions were being filled by 4.5 temporary contract workers whose contract was expected to expire at the end of calendar year 2018. C O NF O TI R IN G NA A UN N IC I TI Z YA A L TO I FR O E N OC A PO L EV RE & AR TY I O N S As a State mandated and highly regulated industry, the primary factor governing REHS eligibility for promotion from a Level II inspector to Level III was time in position (minimum 18 months) and the same for Level III to Supervisor (minimum 6 more months). The current Division Chief, two Program Managers, and two Program Coordinators mentioned being taxed by their supervisory responsibilities and the unique tasks they have faced because of workforce fluctuations resulting from the attack (e.g., contract staff, modified work schedules). At the time of this report, the Division’s leadership did not expect a resolution to the supervisor deficit for another 2 to 3 years as they believed filling supervisory positions would likely have to happen entirely from within. While a number of REHS positions may soon qualify for promotion, those leadership staff new to their own positions may still need to spend a good portion of their time training the staff below them as the Division maintains a dependence on trainees to fill most vacancies. While the attack has forever changed the EHS Division, attempting to create a new “normal” work environment remained an ongoing effort at the time of this report. Team building had become a primary focus of the EHS Division as of 2017 with various events, activities, and assignments designed to better expose staff to each other and create closer working relationships. In addition, as time has progressed, DPH and EHS leadership with the support and recommendations of psychologists recognized a time was approaching to balance the needs of the organization with those of the individual. To assist with those efforts, the County contracted with Dr. Robert Macy, President of the International Trauma Center and Dr. Melissa Brymer, Director of Terrorism and Disaster Programs/UCLA–Duke National Center for Child Traumatic Stress. At the time of this report, Dr. Macy and Dr. Brymer continued to provide management-level counseling to EHS to provide guidance on transitioning to a new normal and managing the Division’s unique environment. Narratives and Analysis 144 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 6.3 Facility Renovations As early as December 4, 2015 there was a consensus among County leadership that a permanent change would be needed to the existing Department of Public Health (DPH) Environmental Health Services (EHS) Division offices where victims and the male perpetrator had worked. Included in this plan were the office spaces at the County Government Center (385 N. Arrowhead Ave., 2nd Floor, San Bernardino, CA; hereafter referred to as the County Government Center) and the Rancho Cucamonga County Office Building (8575 Haven Ave., Suite 130, Rancho Cucamonga, CA, hereafter referred to as the 8575 Haven Ave.). Although the attack had not taken place in County government facilities, office areas of the deceased and injured victims appeared “frozen in time” along with the perpetrator’s office area in the same vicinity. County leadership knew this would present psychologic barriers to healing and recovery. In addition, they knew security concerns being voiced by survivors would need to be addressed to make personnel comfortable returning to work. At that early date, the County did not yet know whether the change would take the form of renovating existing facilities or permanently relocating the affected staff to new or existing office spaces in other County-owned or leased facilities. The County left that decision to the EHS staff. These options were initially presented and solicited for input at an off-site meeting with EHS staff on December 8, 2015. At that meeting, some attendees voiced a desire to permanently relocate to new facilities. There was no dissention at the time because staff and loved ones had agreed not to publicly disagree with each other. However, in the days after the meeting, other input from staff began to reach County leadership through EHS and DPH and the County’s Victim Liaisons. County leadership then decided to have EHS and DPH leadership and the Victim Liaisons privately query each survivor and/or their respective loved ones. The result was that the vast majority preferred to return to their existing work space upon renovations being completed. It was made clear the renovated spaces had to feel and look completely different than they previously did. The facilities “Project Team,” consisting of representatives from the Real Estate Services Department (RESD), Information Services Department (ISD), DPH, and EHS Division began renovation planning efforts as of the first of January 2016. The County Chief Executive Officer (CEO) determined the renovation project would be implemented under normal capital planning and expenditure procedures; unlike the remodeling of temporary alternate facilities, which had been accomplished through an expedited process using emergency procurement authorities. On January 10, 2016 the Board of Supervisors approved the first of many recurring actions authorizing the renovation efforts. Associated funding would come from the existing budget appropriation for the remodel/renovation and repair of County facilities (the Capital Improvement Program budget) with reimbursement from the County’s General Fund. Ultimately, renovation costs would total $2,025,000 for the County Government Center and $975,000 for the 8575 Haven Ave. office, and the Board of Supervisors approved the related budget adjustments on March 1, 2016 and April 19, 2016. During January 2016, the Project Team worked with contractors and design consultants to develop preliminary plans and options for the renovated spaces. During the first week of February, proposed plans were shared with the CEO and with DPH and EHS leadership with the Narratives and Analysis 145 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O NF O TI R IN G NA A UN N IC I TI Z YA A L TO I FR O E N OC A PO L EV RE & AR TY I O N S instruction to share designs and options with EHS staff and solicit feedback. Feedback the Project Team received directly from EHS personnel was provided back to DPH and EHS leadership to vet and offer to all EHS staff for broader input. The Project Team also met with EHS staff on February 18, 2016 to solicit further input and additional meetings were offered if needed. Plans were also shared with the Land Use Services Department Code Enforcement Division and ISD Multimedia Services Division whose facilities would also be affected by the renovations due to their co-location with EHS. Both of those groups deferred to the needs of the EHS staff and then contributed input for their respective spaces once EHS decisions had been made. Some of the feedback received from EHS staff included:  Physically flipping the EHS and Multimedia Services Division spaces at the County Government Center, thereby moving the Multimedia Services Division to the west side of the building and the EHS offices to the east side.  Maintaining shared EHS and Code Enforcement Division office spaces at the 8575 Haven Ave. office, but creating separate entryways and “counter” service areas for public interaction.  Having interior-locking conference rooms at each site that could better serve as a “safe room.”  Bullet resistant glass in the entrance area to the EHS lobby at the County Government Center.  Moving the entrances for second floor staff restrooms at the County Government Center from inside the EHS office space to outside of it.  Providing direct access to emergency stairwells from within EHS offices.  Locations of secure points of entry (employee card access only).  Format of office spaces (e.g., private offices vs. cubicles vs. bullpen).  Paint and carpet selection and color palette. Suggestions were also solicited from specialists from the Department of Behavioral Health to ensure new facilities provided optimal accommodations for psychological health and recovery. Instruction was given multiple times from the CEO to ensure everything was done right in accordance with the needs and expectations of EHS staff. After multiple rounds of review and feedback, final plans were approved by all affected departments/divisions by the end of April 2016. Bids had been solicited from Job Order Contractors (JOC) in February and March 2016, so contractors were ready to proceed once the plans were approved. Prior to furniture being removed and demolition beginning, EHS staff and the loved ones of victims were offered an opportunity to walk through the existing facilities one last time. Visitation hours were made available on April 20 and 25, 2016 for the County Government Center and 8575 Haven Ave. offices, respectively. The County’s Victim Liaisons and DPH and EHS leadership passed on the information to EHS staff and the loved ones of victims. Counseling services, security, RESD, EHS, and Human Resources (HR) Department staff were on hand to support those who chose to attend. Demolition began on May 1, 2016 and project completion was originally slated for the end of August as construction was being fast-tracked. Nothing from the old spaces was reused. The Narratives and Analysis 146 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County renovated spaces had new furniture, equipment, colors, and layout and truly felt like a different space according to everyone that contributed input to this report. Ultimately, construction delays and minor modifications to plans would delay the return of staff to the County Government Center until October 3, 2016. When staff transitioned at that time, some significant construction and finishing projects were still underway. That proved to be a distraction to EHS staff and also caused frustration as certain resources that had been available at the alternate facilities were not yet available at the renovated sites. Having learned from that experience, the Project Team delayed the return of staff to the 8575 Haven Ave. office until November 17, 2016 to ensure the space was complete before inhabiting it. Prior to moving back into both sites, EHS staff was given opportunities to tour the new sites, with counselors available during those visits. As can be expected with any new space, office needs and items for improvement continued to be identified in both spaces for months after the return of staff to the renovated facilities (e.g., additional furniture needs, storage requirements, office supplies [e.g., trash cans], security enhancements [e.g., replacement of glass conference room doors with solid doors]). At the time of this report, EHS, Code Enforcement, and Multimedia Services Division personnel had been working from their renovated permanent facilities for more than a year. Representatives commented that most issues associated with the renovated facilities had been addressed or the issue had been retired, and most importantly, they stated the new spaces were beautiful, functional, secure, and had significantly contributed to the EHS Division’s returning sense of normalcy. Narratives and Analysis Perceived Service Levels… It was after the return to permanently renovated facilities that EHS staff felt the County had returned to business as usual related to managing facility matters, while EHS still continued to struggle with recovery. EHS staff mentioned having to follow normal, cumbersome facility request processes to get resources or facility work done, that requested items were now being denied or changed, and the sense of urgency previously demonstrated had dissipated. Since the EHS Division was still struggling with many ramifications of the attack, and since the County had previously obliged its facility needs, it was the perception of the EHS staff that these changes in posture seemed both sudden and insensitive. 147 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O NF O TI R IN G NA A UN N IC I TI Z YA A L TO I FR O E N OC A PO L EV RE & AR TY I O N S This page is intentionally blank. Narratives and Analysis 148 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 6.4 Long-Term Security After the December 2, 2015 terrorist attack, one of the greatest concerns voiced by stakeholders across County departments was the addition of permanent security measures at County government facilities (physical resources and processes). At the time, the County owned or leased space in more than 500 buildings equating to more than 12 million square feet. Staff in each one of those facilities wanted to feel safe in the aftermath of the attack. As a result, many departments immediately took independent steps to enhance their security. For example, within days of the attack the Information Services Department (ISD) issued a Request for Quotes (RFQ) for consultants to conduct a comprehensive physical security assessment of its headquarters. By December 15, 2015 (only 13 days after the attack) quotes had been received and a consultant selected by the end of the month. Many departments where security staff was present worked with their security to enhance procedures where appropriate (e.g., bag checks, identification requirements, screening procedures). Similar procurement efforts and process modifications were occurring in countless departments before County leadership even had time to articulate a countywide strategy. To bring some initial order and efficiency to the independent efforts being undertaken by departments, the County Chief Executive Officer (CEO) issued a memorandum in early January 2016 asking all department heads to first send security-related requests and recommendations associated with County-owned facilities to the Facilities Management Division and ISD for consideration, and any related to leased facilities to the Real Estate Services Department (RESD) to help negotiate with landlords. This would be the start of a set of security and safety related strategic efforts the County would later refer to as the “SB Safe” initiative. The top ten recommendations received over the course of the next few months from this initial information gathering effort were: 1. Employees should wear easily visible County-approved identification badges at all times. 2. Personnel should be trained to be alert to surroundings from parking lot to work space. 3. The County should encourage open communication and reporting of anything suspicious (e.g., “If you see something, say something.”). 4. The County should formally evaluate security guard requirements. 5. Have the Sheriff’s Department provide security awareness training to all personnel. 6. Ensure doors between public and employee work areas are accessible via key card access only. 7. Remind employees to ensure interior and exterior access doors are closed and locked each time they enter or exit. 8. Install door release controls and intercoms at points of entry as appropriate. 9. Install video cameras in strategic locations. 10. Ensure Department Emergency Operations Plans (DEOPs) and Facility Emergency Action Plans (EAPs) are up-to-date. These were relatively inexpensive initial efforts and the County knew early on that a strategic approach for potentially sweeping assessments and associated changes would be necessary. Following a shooting at Riverside City Hall in 1998, San Bernardino County had established a Security Task Force consisting of representatives from the RESD, ISD, the Sheriff’s Department’s Narratives and Analysis 149 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County C O NF O TI R IN G NA A UN N IC I TI Z YA A L TO I FR O E N OC A PO L EV RE & AR TY I O N S Office of County Safety and Security, and Risk Management with other advisory members. The group met as needed thereafter, but most notably in the aftermath of the September 11, 2001 terrorist attacks when the County reviewed security protocols respective to then released lessons learned and guidelines. Following the December 2, 2015 terrorist attack, the County revitalized the Security Task Force, added the Emergency Services Manager from the County’s Office of Emergency Services (OES), and tasked the group to develop a strategy for long-range security assessments of County facilities. Although the San Bernardino County Fire Protection District is a separate legal entity from the County, the County offered to include its facilities in the County’s assessments. On February 12, 2016 a Request for Proposal (RFP) was issued and on May 24, 2016 the County Board of Supervisors approved on-call contracts with two consulting companies to conduct security assessments of County facilities for 3-year terms, each not to exceed $500,000. Between January and May 2016, some initial steps were taken to improve security, primarily by adding key card access to buildings where it didn’t previously exist and modifying security guard staffing requirements where appropriate. In addition, the County asked the Sheriff’s Department’s Office of County Safety & Security to begin hosting substantive quarterly security meetings/forums with County departments. Those offerings began in June 2016 and continued quarterly since. Feedback on the content and approach was generally positive at the time of this report. Security Assessment Contract Objectives… As stated within the security contracts, they were intended to “Conduct security assessments of County-owned and leased facilities. The assessments shall provide a comprehensive review of existing security measures and recommendations for each facility that are consistent with an overall County security plan development. The Consultant(s) shall have the capability to assist the County in prioritization, cost-benefit analysis, and development of standards. The assessments may include reviewing the following: o Building Intrusion Detection & Alarm  General Site/Building Security Systems o Perimeter Security o Emergency Communication Systems o Building Interior Security o Property Management and Control o Facility Parking Lots o Shipping, Receiving & Storage Operations o Facility Exterior Lighting o Lock & Key Control o Facility Vegetation o Protection of Utilities, Air Intakes & o Facility Signage Critical Infrastructures o Public Interface o Facility Emergency Action Plan o Security Incident History  Physical Security Operations  Physical Security Systems, Technology and o Security Staffing and Operations Controls o Security Post Instructions o Vehicle Access, Traffic & Parking Controls o Security Uniforms and Equipment o Employee, Visitor & Contractor Access o Visitor Management Systems  Planning and Compliance Monitoring o Access Control Systems o Security Roles & Responsibilities o Video Surveillance Systems/CCTV o Security Policies & Procedures systems Narratives and Analysis 150 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County o Pre-Employment Screening & Termination Practices o Security Education & Awareness o Security Info. & Incident Reporting o Security Emergency & Contingency Planning o o o o o Personal Emergency Response Facility Action Plans Training Program Development Personnel Training Compliance Monitoring” Accounting for the County owned or leased space of more than 500 buildings at the time, 8 categories/classifications of County facilities were defined and prioritized for receiving assessments by the Security Task Force and consultants. Within the highest priority category, 8 sites were identified. In late autumn 2016, the security consultants completed an assessment of the High Desert Government Center as a beta-test of the assessment process and approach. Remaining assessments of the highest priority facilities took place later in 2017 after the betatest was approved and additional cost estimates were received from the security consultants. As assessments were completed, security reports and recommendations for each facility were provided to the County for consideration. As of the time of this report, the County and security consultants were moving on to the second group of facilities to assess while the first phase of improvements were being funded. All selected security enhancements would be pursued under normal capital improvement budget processes and normal procurement authorities after each comprehensive assessment is complete, thereby ensuring consistent and complementary technologies and economies of scale are applied to the County’s security posture.78 At the time of this report, the security assessment process was still underway. Progress Toward New Security Measures… Since visible facility-specific or county-wide security modifications had not been implemented at the time of this report (2+ years after the attack), a majority of County stakeholders engaged as part of this review voiced frustration with the perceived lack of progress. County executives and the Security Task Force were sensitive to these concerns, but understood appropriate strategies take time. Growing impatient, however, many departments continued to pursue their own independent security enhancements in the early stages. On March 13, 2017 the RESD Director issued a memo to all executives and department heads reminding them that independent security enhancements would not be approved without first being vetted by the Security Task Force to ensure conformance with the county-wide strategy. Department-specific efforts had been minimized while County-wide enhancements were being awaited. However, staff expressed that some level of satisfaction may be achieved or additional security felt, if information about the progress or current status of security measures was regularly shared and continued to be shared as additional accomplishments are realized. 78 Because of the sensitive nature of the security assessment process and findings, the details and results are not included in this report. Narratives and Analysis 151 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O R G A N I Z A T I O N A L F I N A N C I A L This page is intentionally blank. R E C O V E & R Y Narratives and Analysis 152 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 6.5 Total Cost Accounting The total costs incurred by San Bernardino County associated with the December 2, 2015 terrorist attack reached approximately $22.6 million as of January 12, 2017.79 This total does not include costs incurred or anticipated after this date, such as legal fees and the planning of the physical memorial to commemorate the victims. This amount includes costs that could be clearly tracked and categorized by the County. In addition, there is likely a margin of error for less tangible costs and/or minor costs that could not be tracked or were incurred by individual departments. Business Interruption The personnel costs (salary and benefits) associated with closing all non-essential County offices and functions between mid-day December 2nd and December 6th is estimated at $5 million. These costs were captured and tracked in the County’s time keeping system for employees as “EVAC” and constituted the single largest cost borne by the County. The actual economic impact of standing down non-essential County services in the region during this timeframe was not reviewed as part of this report. Business Interruption (Evacuation) Costs: $5.0 million Mutual Aid/Contract Services for Environmental Health Services By December 2018, the County will have paid $4.2 million for temporary mutual aid (approximately $700,000) and ongoing contract staffing to backfill Department of Public Health/Environmental Health Services (EHS) Division positions ($3.5 million). The contract for temporary staffing was set to expire in December 2018. If it is extended, then these costs will increase accordingly. Mutual Aid/Contract Services for Environmental Health Services: $4.2 million Real Estate (Temporary Relocations and Remodeling) The temporary office spaces remodeled and equipped to accommodate EHS and Land Use Services (LUS) Department personnel until permanent office space was remodeled totaled $200,000.80 The remodeling and reconfiguring of permanent EHS, LUS, and Multimedia Services Division offices totaled $3.0 million.81 The office space located at the County Government Center cost $2.025 million and the Rancho Cucamonga office space totaled $975,000. Real Estate Costs: $3.2 million 79 To put this in context, the San Bernardino County FY 2016-17 adopted budget was approximately $5.5 billion, of which approximately $839 million was the County’s discretionary general fund. After January 12, 2017 the County stopped tracking costs specific to the 12/2/15 attack with the exception of the ongoing temporary staffing contract for the EHS Division. 80 These costs were eligible for reimbursement through the AEAP grant. See narrative 6.6 Cost Recovery/ Reimbursement on page 157 for more information. 81 Minimal costs were incurred related to the relocation of the Multimedia Services Division, other than paint and basic supplies, because they were relocated to another office space within the County Government Center that was equipped and capable of supporting their operations. Narratives and Analysis 153 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Employment Benefits Direct benefits to the victims and survivors totaled $1.7 million and included 82:  Payments by the County as of January 2017 to fill the gap between workers’ compensation coverage and short-term disability for victims at the incident (“make employees whole”): $500,00083  One month paid leave for victims who were present at the incident but not physically injured: $400,000  Paid leave for County employees (EHS and Land Use Services) not at the incident: $200,000  Payment of COBRA medical, dental and vision insurance premiums for the dependents of the deceased covered under the County insurance program: $200,000  Reimbursed lost income and paid sick leave for County employees that were relatives of victims at the incident: $100,000  Contracted counseling services: $300,00084 Direct Employment Benefits to Victims: $1.7 million Administration Costs Administration costs totaled $2.4 million and included the salaries for County leadership and executives for time spent dedicated to responding to the terrorist attack, participating in relevant meetings, and attending to the needs of victims.85 Administration costs: $2.4 million Security Personnel and Physical Security Modifications Security personnel costs and physical security modifications to the Human Services Department facilities during the day of, and in the months after, the attack totaled $1.6 million.86 This included additional guards, enhanced security, closed-circuit surveillance cameras, and new card access to buildings within Human Services. These costs were reimbursed through various Human Services claims processes. 82 Not included in the list are costs associated with nurse case managers as those began January 12, 2017 after the County’s active accounting of incident-related costs stopped. As of the writing of this report, costs associated with nurse case managers exceeded $400,000. 83 Not included here are the costs the County paid in workers’ compensation benefit payments since the County had a self-administered and self-funded program at the time of the attack. These costs were considered part of the County’s anticipated risk borne by an insurance provider (whether in-house or third party). 84 The costs associated with COBRA premiums, reimbursed lost income, and counseling services were eligible for reimbursement through the AEAP grant. See narrative 6.6 Cost Recovery/Reimbursement on page 157 for more information. 85 This amount is based on employee time reporting in the official time keeping system, but does not capture any time personnel may have charged to non-incident codes. 86 Not included are the costs the County paid in workers’ compensation benefit payments since the County had a self-administered and self-funded program at the time of the attack. These costs were considered part of the County’s anticipated risk borne by an insurance provider (whether in-house or third party). Also not included are costs related to workers’ compensation and general liability premiums that increased for the Department of Public Health after the attack. Narratives and Analysis 154 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County The County tracked an additional $300,000 in security costs and security modifications to other County owned or leased buildings that were not eligible to be reimbursed through the Human Services claims process. Security measures: $1.9 million Victim Liaisons, In-House Counseling Teams and Staff Providing Direct Service to Victims Victim liaisons, in-house counseling teams, and County staff that provided direct services to victims at incident sites and after the incident totaled $1.6 million. This includes standby time, regular time, and overtime. The County was reimbursed $1 million for these expenditures through the Human Services claims process and by the California Victim Compensation Board (CalVCB) through the U.S. Department of Justice (DOJ) Antiterrorism and Emergency Assistance Program (AEAP) Grant. County staff providing direct service to victims: $1.6 million County First Responders87 and Supporting Staff The Sheriff’s Department’s regular time and overtime costs associated with the terrorist attack totaled $600,000.88 Information Services Department (ISD) support for first responders totaled $200,000. First Responders and Supporting Staff Costs: $800,000 Memorial Events and Items Memorial costs totaled $300,000 and included the facility/event costs for the January 4, 2016 “County Family Gathering” as well as the costs incurred for the first year anniversary luncheon. Memorial items included “SB Strong” lapel pins, picture frames, and video production. Memorial Events and Items: $300,000 Miscellaneous Equipment and Supply Costs Equipment and supply expenditures included food, emergency supplies, fuel, fleet costs, office supplies, and cell phones for responding departments and agencies, including the Department of Public Health, Arrowhead Regional Medical Center, the Office of Emergency Services, Fleet Management, Probation Department, and the Sheriff’s Department. These expenditures totaled $300,000 and supported crisis intervention services, victims, and emergency personnel. Equipment and Supply Costs: $300,000 87 The Fire Protection District costs related to the attack totaled $220,000 and are not included in this accounting as the Fire Protection District is a separate legal entity from the County. However, the Fire Protection District receives a substantial level of support from the County General Fund so these costs may indirectly affect the County in the long run. The Probation Department incurred $11,000 in expenditures that are included in the Miscellaneous Equipment and Supplies costs. 88 These costs were reimbursed through the Bureau of Justice Grant. See narrative 6.6 Cost Recovery/ Reimbursement on page 157 for more information. Narratives and Analysis 155 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Miscellaneous Costs Miscellaneous costs including fuel, mileage, and overtime for personnel totaled $100,000. Miscellaneous Costs: $100,000 O R G A N I Z A T I O N A L F I N A N C I A L Legacy Documentation The documentation of the County’s efforts following the December 2, 2015 terrorist attack (this report), associated Legacy Document, and County Workshop cost $200,000. Legacy Document: $200,000 Additional EHS Support Costs The County included in its cost accounting $500,000 for additional staffing for EHS including a dedicated Human Resources Officer (HRO) and a Wellness Coordinator and $400,000 in anticipated costs for Community Resiliency Forums and post-trauma workshops.89 Additional EHS Support Costs: $900,000 R E C O V E & R Y 89 The dedicated HRO began 8/8/2016 and the Wellness Coordinator was hired 2/4/17. Community Resiliency Forums and post-trauma workshops were eligible for reimbursement through the AEAP grant. Narratives and Analysis 156 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 6.6 Cost Recovery/Reimbursement Following the December 2, 2015 terrorist attack, San Bernardino County leadership and County Supervisors established a precedent to do “whatever it takes” to support victims and affected employees. From the onset, County leadership was aware many of the expenditures related to the terrorist attack would likely not be reimbursed, but they would still responsibly seek to identify and pursue all available avenues for reimbursement. The below pie chart illustrates the amounts the County recovered through the programs described in this section as of the date of this report as compared to its total documented direct expenses of $22.6 million. Identification of Funding Sources San Bernardino County worked extensively to identify available funding sources to recover costs incurred by the County, Cities of San Bernardino and Redlands, and others affected by the incident. The County Administrative Office (CAO), the Office of Emergency Services (OES), Office of Governmental and Legislative Affairs, District Attorney’s Office, and Sheriff’s Department each worked on finding external sources for cost reimbursement. Elected officials supported these efforts by helping to identify funding sources, writing letters of support and, in a few instances, proposing legislation (discussed in narrative 6.8 Legislation on page 163). These combined efforts identified the following possible monetary resources: U.S. Department of Justice (DOJ), U.S. Department of Homeland Security (DHS), California Governor’s Office of Emergency Services (CalOES), and the California State Legislature. The County also reached out to associations such as the National Association of Counties and the California State Association of Counties, and elected officials at the State and Federal level to help identify additional resources. Cost Recovery efforts were coordinated during the Post-Incident Coordination Meetings (PICM) regularly facilitated by the CAO. During these meetings, updates were given from various County departments as to the identification of funding sources, the application process, and the status of submitted applications. Additionally, these meetings were used as opportunities to ensure information related to costs was being gathered by appropriate departments, Narratives and Analysis 157 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County appropriately tracked, and submitted to OES. During the January 21, 2016 PICM, for example, the importance of tracking the grant opportunities each department was applying for was emphasized by the County CEO to ensure that efforts were not duplicated. It was also stressed that each department include OES in the application process. O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Ultimately, three viable funding sources were identified and leveraged: the California Disaster Assistance Act (CDAA), the U.S. DOJ’s Antiterrorism and Emergency Assistance Program (AEAP), and Bureau of Justice Assistance Grants.90 If all expenditures submitted through these programs were approved, approximately forty percent (40%) of the total incident costs to the County of $22.6 million may have been reimbursed (see narrative 6.5 Total Cost Accounting on page 153 for detailed information on the $22.6 million in costs). However, many of the most costly expenditures associated with the incident were later deemed ineligible for reimbursement by traditional funding sources, including costs for temporary office/operational closures and business disruption following the incident ( $5 million) and renovation of the Environmental Health Services (EHS) Division offices ( $3 million). California Disaster Assistance Act (CDAA) CDAA is a disaster assistance program administered by the CalOES at the discretion of the Governor. San Bernardino County became eligible for CDAA funding when Governor Jerry Brown proclaimed a State of Emergency on December 18, 2015. The OES is the designated County lead agency that compiles and submits CDAA applications to CalOES. There is a cost share for CDAA funding of 75% paid by the State of California and 25% born by the applicant, excluding administrative costs which are reimbursed at 10% of the approved State reimbursement amount.91 The December 2, 2015 terrorist attack was the first time CalOES managed CDAA for a terrorism event. Accordingly, CalOES created new forms for County departments to use to report related costs. In early February 2016, the County submitted $18 million in costs to CalOES for CDAA consideration. However, only a small fraction of the costs were reimbursed. CalOES initially determined that only up to $5 million of the $18 million in costs submitted for reimbursement were eligible for consideration. Costs that were determined to be ineligible included county evacuation costs (the funding code used for business closures/business disruption) from December 3 - 6, 2015 and the remodeling of EHS offices. As of the date of this report, CalOES approved $474,003 in costs as eligible for reimbursement for all County departments except Public Health. The Department of Public Health was still working with CalOES on an estimated $2.8 million in total eligible costs. Through December 2017, the County had received $310,215 per the State’s 75%/25% cost share requirement for County departments, excluding the approved Sheriff’s Department reimbursement and the pending Public Health reimbursement. CDAA Reimbursement: $310,215 90 The December 2, 2015 terrorist attack was not eligible for Federal Disaster Assistance under the Stafford Act as a Presidential Disaster Declaration was never issued and the total costs did not exceed California’s eligibility threshold (approximately $48 million at the time). 91 San Bernardino County worked on legislation that would change the cost share for the State portion to 100%. This was vetoed by Governor Brown (see narrative 6.8 Legislation on page 167 for more information). Narratives and Analysis 158 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Antiterrorism and Emergency Assistance Program (AEAP), U.S. DOJ Office for Victims of Crime In December 2016, the California Victims Compensation Board (CalVCB) was awarded just over $4 million in funding from the U.S. DOJ Office for Victims of Crime (OVC) through the AEAP grant. The San Bernardino County Bureau of Victims Services (BVS)sponsored by the District Attorney’s Officehelps to administer compensation claims and other benefits for victims of crime on behalf of the CalVCB (see narrative 4.2 Victims of Crime Services on page 91 for more information). In June 2017, CalVCB provided a proposed subgrantee agreement to the County. The agreement went through several revisions and the final version was received by the County on August 15, 2017. The agreement was approved by the Board of Supervisors on September 12, 2017. Through the AEAP grant agreement, the County is eligible to receive up to $1.15 million for the reimbursement of costs associated with: temporary space for the EHS Division ($207,000), a Human Resources Officer (HRO) and Wellness Coordinator for the EHS Division ($473,000), counseling services ($300,000), COBRA insurance premiums for families of the deceased ($126,000), overtime for a few Victim Liaisons ($24,000), security for Department of Public Health (DPH) facilities ($11,000), and child and dependent care service at the Family Assistance Center (FAC) ($1,600). Beyond the publication date of this report, the County may also seek reimbursement of up to $436,000 for new projects and continued work on projects that are partially underway. These projects include management and wellness training, community resiliency forums, and posttrauma workshops. Potential AEAP Reimbursement: up to $1.5 million Assistance Grant, U.S. DOJ Bureau of Justice In January 2016, San Bernardino County Sheriff John McMahon and City of San Bernardino Police Chief Jerrod Burguan traveled to Washington, D.C. to meet with officials to identify funding mechanisms to recoup the costs law enforcement agencies incurred responding to the attack. Bureau of Justice Assistance funds were then identified as a possible funding source. In March 2016, U.S. Congressional Representatives Pete Aguilar (CA-31) and Ken Calvert (CA-42) requested that the Bureau of Justice’s Edward Memorial Justice Assistance Grant Program (JAG) and the Emergency Federal Law Enforcement Assistance Program be made available to help San Bernardino law enforcement agencies recover costs connected with the December 2, 2015 terrorist attack. On June 28, 2016, the Department of Justice awarded the California Board of State and Community Corrections $500,000 from the JAG program to be distributed directly to affected local law enforcement agencies. The San Bernardino County Sheriff’s Department incurred approximately $600,000 in expenses related to regular time and overtime for first responders during the incident. The California Board of State and Community Corrections distributed $300,000 to the San Bernardino Sheriff’s Department. The County anticipates an additional $300,000 will be awarded through the same program during fiscal year 2017 to complete the reimbursement. Narratives and Analysis 159 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County All non-Sheriff’s Department, County first responder costs were being applied to the CDAA application at the time of this report, including Probation Department, Fire Protection District, and SBCFPD/OES costs. Anticipated Bureau of Justice Assistance Grant Reimbursement: $600,000 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Narratives and Analysis 160 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 6.7 Litigation Under the California Tort Claims Act92, an injured party has six (6) months to file a claim against any public entity related to wrongful death, personal injury or damage to property. The public entity, in this case the County of San Bernardino, must respond to the claim within forty-five (45) days. If the public entity denies the claim, the claimant has six (6) months to file suit. Claims Against the County A total of twenty-nine (29) claims were initially filed against the County associated with the December 2, 2015 terrorist attack; many related to wrongful death, negligence, and claims the County fostered a hostile work environment. The San Bernardino County Department of Risk Management was responsible for responding to claims filed against the County. All 29 claims were denied by the County. Lawsuits Against the County After the 29 claims were rejected, four (4) lawsuits were filed:  One person injured in the attack filed suit against the County for damages in excess of $150,000. The case was dismissed in State court with prejudice.  The families of three (3) County employees killed in the attack filed a joint wrongful death suit against the County for damages exceeding $200 million.93 The suit was scheduled to be moved to federal court in March 2018.  A workers' compensation insurance carrier for the contractor that ran the coffee shop at the Inland Regional Center (IRC), whose employee was the only non-County fatality, filed a subrogation lawsuit against the County for over $50,000 for the cost for contractor’s workers’ compensation claims and damages. The case was dismissed.  During the tactical response to the attack, a Sheriff’s Deputy ran a red light and hit another car. The driver injured in that accident filed suit. The County’s position was that the claim had value, but the two sides had not agreed on compensation at the time of this report. Future Issues Claimants may ask the Court’s permission to file a late claim after the original six-month deadline has expired, if the claimant was a minor during the claim period. There is a possibility that the minor children of those killed or injured during the attack may file future claims once they turn 18 years old. Under California law, claimants have 2 years after the date of majority to file a claim. 92 California Government Code §810-996.6. Note the exclusive remedy for a workplace incident is workers’ compensation in accordance with the California Labor Code. See narrative 4.5 Workers’ Compensation on page 105 for more detail on the workers’ compensation claims. 93 Co-defendants also include Allied Universal, Allied Barton Security Services, California Housing Foundation, Department of Homeland Security, Department of Justice, Inland Regional Center, and the State of California. Narratives and Analysis 161 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O R G A N I Z A T I O N A L F I N A N C I A L This page is intentionally blank. R E C O V E & R Y Narratives and Analysis 162 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County 6.8 Legislation The legislative efforts supported by the County of San Bernardino included recovering costs associated with the response to and recovery from the attack, in addition to lobbying for services and support for victims (e.g., the Antiterrorism and Emergency Assistance Program [AEAP] grant). The Office of Governmental and Legislative Affairs within the County Administrative Office (CAO) worked closely with lawmakers to pursue cost recovery funding and other funding sources for services to assist the victims. Additionally, in the two years since the attack, legislators have proposed bills related to workers’ compensation and other issues to better prepare for and mitigate the repercussions of future terrorist attacks. An unknown number of legislators and bills within California and across the country have used the San Bernardino terrorist attack as justification, but this report will only speak to those directly connected to County. State of California SB-1385: California Disaster Assistance Act: Inland Regional Center (2015-2016) The current California Disaster Assistance Act (CDAA) allows the State to reimburse local governments for up to 75% of the costs borne by their first responder agencies while responding to and recovering from an emergency or natural disaster. The California Governor’s Office of Emergency Services (CalOES) oversees administration of the CDAA and for the first time was tasked with determining reimbursement policies for a terrorist attackthe attack in San Bernardino was the first of its kind in the State. In the past, under special circumstances and through legislative action, several events were reimbursed for the full cost94 incurred by their respective agencies, but no event has been reimbursed for 100% of its costs since 2006. In February 2016, State Senator Connie Leyva (District 20) introduced Senate Bill 1385, which would have added the December 2, 2015 terrorist attack to the list of events necessitating a 100% State reimbursement. The bill contended that law enforcement’s rapid and overwhelming response saved lives and to not reimburse the full cost would financially penalize the agencies for their success. The bill was sponsored by San Bernardino County and had its full support and endorsement. The County Board of Supervisors also reminded legislators that the City of San Bernardino was still struggling with bankruptcy. Ultimately, SB-1385 passed the Assembly and Senate unopposed. However, in September 2016, California Governor Jerry Brown vetoed SB-1385. While acknowledging the extreme circumstances of the December 2, 2015 terrorist attack and the extraordinary response by law enforcement, he expressed concern that approving SB-1385 would set an unrealistic precedent for jurisdictions seeking reimbursement for future emergencies. Governor Brown argued it was unrealistic to expect the State’s General Fund95 to be capable of providing that level of reimbursement on a regular basis. 94 Prior events for which the state has reimbursed 100% of the costs include the Loma Prieta Earthquake (1989), East Bay Fire (1991), Southern California fires (1993 and 2003) and San Simeon Earthquake (2003). 95 The State General Fund is the largest of the State’s budget funds and the only one not dedicated to a specific purpose. As such, lawmakers and the Governor have the most discretion over the General Fund (approximately $82 billion in 2017). Narratives and Analysis 163 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y AB-44: Workers’ Compensation: Medical Treatment: Terrorist Attacks: Workplace Violence (2016-2017) In December 2016, State Assembly Member Eloise Reyes (District 47) introduced legislation (AB-44) designed to expedite the workers' compensation process through which the victims of the attack received their medical benefits. The legislation proposed to remove the Utilization Review requirement in cases of terrorism and to add terrorist attack and workplace violence injuries to the list of medical conditions for which aggregate temporary disability payments may be made for up to 240 weeks over the course of 5 years. San Bernardino County took a neutral position on AB-44 but offered guidance and advice as requested. Employees in California are entitled and required to seek compensation through California’s Workers’ Compensation system when they are injured during the course of business. Per the standard protocols, if a claim or request for medical treatment is received that the employer or insurer feels is inconsistent with requirements or the Medical Treatment Utilization Schedule (MTUS), then the claim/request undergoes a Utilization Review (UR) process, whereby a thirdparty physician (or team of physicians) determines if the medical treatment is appropriate and/or necessary. Treatment may be denied as a result of Utilization Review and denials can be appealed. In January 2017, in response to victim concerns and media coverage related to denied care and delays due to the UR process, the California Department of Industrial Relations (DIR) conducted a review of the more than 2,000 treatment requests processed by the County in relation to the attack. The review found that 7% of claims were ultimately denied and that a significant number of those initially declined were overturned and reinstated once improved documentation from patient healthcare providers was received. AB-44 was ultimately amended to call for an advocacy program instead of the suspension of the Utilization Review process. The advocacy program would require that Nurse Case Managers be assigned to each claimant following an act of terrorism in which the Governor Proclaims a State of Emergency. AB-44 passed the State Senate and the Assembly, and was sent to the Governor for signature on September 20, 2017. Governor Brown signed AB-44 into law on October 13, 2017. San Bernardino County PIO David Wert issued a statement saying the legislation, "modeled itself on the process created by the county to care for those who were injured on (Dec. 2, 2015).” “…The county provided all of the employees who were physically injured with the immediate services of nurse case managers and counseled them on the medical treatment options that were available to them,” Wert said, adding “The county eventually extended those services to other employees who were being treated through workers' compensation.” Federal Lobbying Directly Related to the San Bernardino Attack A number of federal representatives, including Congressman Pete Aguilar (CA-31), advocated for San Bernardino County in the U.S. House of Representatives. As a member of the House Appropriations Committee, Representative Aguilar sent a formal request to the committee to support the County’s applications for the Byrne Justice Assistance Grant and the Emergency Narratives and Analysis 164 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Federal Law Enforcement Assistance Program. Both grants assist state and local governments with emergency funding. Representative Aguilar also sent a letter encouraging the Appropriations Subcommittee on Homeland Security to increase the budgeted amount for the State Homeland Security Grant Program (SHSGP) citing the San Bernardino terrorist attack as justification. Other Legislation Associated with the San Bernardino Attack Following the attack, California Senator Dianne Feinstein reintroduced legislation that would require social media companies to report online terrorist activity. At the time of this report, S.2372 (Requiring Reporting of Online Terrorist Activity Act) had not made it out of committee review. In December 2016, Representative Aguilar and nine other California representatives sponsored H.R.625 – 115th Congress (2017-2018), which would require the Secretary of the Department of Homeland Security to submit an unclassified report to Congress within one year of a terrorist attack detailing recommendations and policy changes. H.R.625 passed the House of Representatives and was awaiting a vote in Senate Committee when this report was published. Additionally, citing the San Bernardino terrorist attack, California lawmakers passed SB 1446 (Hancock), which limits the use and/or possession of high-capacity magazines and AB 1695 (Bonta), which targets what is known as ‘straw purchases,’ in which someone who can legally pass a background check buys a weapon and then sells it to someone who cannot pass said background check. Both bills were signed by California’s Governor Brown on July 1, 2016. San Bernardino County did not take a position on either of these bills. Narratives and Analysis 165 O R G A N I Z A T I O N A L F I N A N C I A L R E C O V E & R Y Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County This page is intentionally blank. 166 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County IV. Conclusion The December 2, 2015 terrorist attack took the lives of 14 people, 13 of whom were employees of the Environmental Health Services (EHS) Division of the San Bernardino County Department of Public Health (DPH). It left an additional 22 County employees injured and those present and hundreds beyond with emotional trauma. It was perpetrated by a County employee who had previously been a trusted colleagueand even friendto those he targeted, but who had become radicalized by the ISIS/ISIL. The impacts of the attack extended well beyond those physically present. The 22,000 County employees who affectionately refer to themselves as “the County Family” were concerned for the wellbeing of their affected colleagues and their own safety and many shared the violation and emotional toll of those much closer to the incident. The attack also disrupted essential government services upon which the public’s health depends. The consequences felt and actions taken in response continued in the days, weeks, and months following the attack and will likely continue for years to come. This report endeavored not only to capture the breadth of the impacts on the County, but also to highlight the hundreds of actions taken by dedicated County employees to address those consequences (personal, operational, fiscal, etc.). As an organizational review this report was intended to capture the most important aspects of the County’s response and the resilience of the County Family as a whole. There was no doubt to the authors of this report that San Bernardino County had the best intentions in its decision-making for victims, employees, operations, and the community. There was a “do whatever it takes” mentality at all levels. That perseverance was often rewarded as the County was able to circumvent bureaucracy and red tape to expedite and/or increase services; however, in some cases, it was limited by regulation or resource availability beyond its control. The County provided a number of services and offered benefits that went well beyond its legal obligation as an employer and the precedents set by other jurisdictions/organizations under similar circumstances. The authors of this report found the decisions made and actions taken by the County were reasonable, and in many cases exceptional, given the circumstances and with the information and resources available. The authors recognized less-than-optimal decisions and actions were often better than no action at all as the County demonstrated no hesitation toward addressing challenges and later reflected upon them. In many cases, it was only with the advantage of hindsight that lessons, alternate approaches, opportunities for improvement could be identified. A number of lessons had already been identified and acted upon by the County to improve its readiness and resilience by the time this report was commissioned. Certain circumstances also worked to the County’s advantage. Had the attack been part of a larger plot on County government, the lack of a mass notification system or inconsistent implementation of lockdown procedures could have had more severe consequences. Where nearly $25 million in costs may have paralyzed other jurisdictions, it was a relatively small amount associated with the County’s $800 million annual discretionary fund and $5.5 billion overall budget. Being part of the four-county Greater Los Angeles region with a population of Conclusion 167 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County nearly 18 million, the County benefited from immediate access to substantial emergency services, behavioral health, and environmental health mutual aid and contractual resources that facilitated a more effective response, the provision of counseling services, and continuity of essential functions. With operations in more than 500 buildings, the County found it relatively easy to identify vacant space for alternate facilities despite a lack of pre-existing plans. The County’s history of frequent emergencies, including natural disasters and major law enforcement incidents, had given County leadership and departments critical experience implementing emergency authorities and actions under crisis conditions. The combination of experience and circumstances presented both challenges and opportunities that were navigated through keen decision-making to emerge more resilient than before. On December 2, 2015 there was no guidebook to which San Bernardino County could turn to direct its path forward. This report, written with the benefit of hindsight, captures the County’s extraordinary efforts during the most trying times. Through it all, the quick response and heartfelt effort by County employees to address the many unique challenges posed by the attack was, and continues to be, truly remarkable. Conclusion 168 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Appendix A: Bibliography Anonymity was essential to obtaining candid input from the individuals engaged in the creation of this report. It was also important in the writing of this report to maintain an organizationwide perspective. As such, the topical/programmatic narratives in Section 3 of this report were not written to cite their sources, unless specifically necessary. Instead, the following bibliography is provided as a record of the documents that contributed to this review as well as the individuals interviewed in group or individual settings. Interview and/or Workshop Participants Adams, Cheryl - San Bernardino County Preschool Services Department Alarcon, Flerida - San Bernardino County District Attorney, Bureau of Victim Services Alexander, Diana - San Bernardino County Preschool Services Department Alvarez, Julie - San Bernardino County District Attorney, Bureau of Victim Services Antonucci, Michael - San Bernardino County Office of Emergency Services Basle, Jean-Rene - San Bernardino County, County Counsel Beaty, Schlyer - San Bernardino County District Attorney, Bureau of Investigation Blakemore, Michelle - San Bernardino County, County Counsel Broome, Eric - San Bernardino County Department of Risk Management Brown, Michelle - San Bernardino County Probation Department Candelaria, Joshua - San Bernardino County Administrative Office, Office of Governmental and Legislative Affairs Cardona, Felisa - San Bernardino County Administrative Office, Public Information Clay Valerie - San Bernardino County Administrative Office, Finance and Administration Condon, Christopher - San Bernardino County Probation Department Cordova, Jake - San Bernardino County Information Services Department Cronin, Brian - San Bernardino County Department of Public Health, Animal Care and Control Division Dalton, Cindy - San Bernardino County Administrative Office Devereaux, Gregory - San Bernardino County Administrative Office Dugas, Joshua - San Bernardino County Department of Public Health, Environmental Health Services Division Edney, Jessica - San Bernardino County Department of Public Health, Environmental Health Services Division Ellis, Meaghan - San Bernardino County Department of Public Health, Community Health and Nursing Services Division Fisk, Samuel - San Bernardino County Sheriff’s Department Gardner, Megan - San Bernardino County, Human Resources Department, Employee Benefits and Services Division Goldman, Lori - San Bernardino County, Human Resources Department, Employee Benefits and Services Division Gonzales, Josie - San Bernardino County District 5 Supervisor Appendix A: Bibliography A-1 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Gonzales, Maria - San Bernardino County Land Use Services Department, Code Enforcement Division Grooms, Brad - San Bernardino County Information Services Department Gruchy, Andrew - San Bernardino County Department of Behavioral Health Hagen, Marlene - San Bernardino County, Department of Children and Family Services Hagman, Curt - San Bernardino County District 4 Supervisor Haire, Phabs - San Bernardino County Preschool Services Department Hartwig, Mark - San Bernardino County Fire Protection District Haugan, Linda - San Bernardino County Administrative Office, Human Services Hendrickson, Ellen - San Bernardino County, Human Resources Department, Employee Relations Division Henson, Bruce - San Bernardino County Information Services Department, Multimedia Services Division Hernandez, Kenneth - San Bernardino County Department of Risk Management Hernandez, Leonard - San Bernardino County Administrative Office Hernandez, Maral - San Bernardino County Administrative Office, Office of Governmental and Legislative Affairs Hilber, Jennifer - San Bernardino County Information Services Department Hudson, Tom - San Bernardino County Land Use Services Department Johnston, Kenneth - San Bernardino County Department of Public Health, Quality and Compliance Division Kelley, Veronica - San Bernardino County Department of Behavioral Health Kiehl, Paul – San Bernardino County Department of Risk Management Klinkhart, Tracy - San Bernardino County Sheriff’s Department Kolcheva, Katherine - Office of San Bernardino County District 4 Supervisor Krumwiede, Troy - San Bernardino County Information Services Department, Multimedia Services Division Lacy, Kevin - San Bernardino County Sheriff’s Department, Coroner Division Locurto, James - San Bernardino County Transitional Assistance Department Lovingood, Robert - San Bernardino County District 1 Supervisor Lowe, Janet - San Bernardino County Real Estate Services Department Lynch, Thomas - Inland Counties Emergency Medical Agency Mayes, Mary - San Bernardino County Special Districts Department McBride, Gary - San Bernardino County Administrative Office, Finance and Administration McMahon, John - San Bernardino County Sheriff Meza, Maria - San Bernardino County Department of Public Health, Environmental Health Services Division Michl, Susan - San Bernardino County Administrative Office Morell, Lynna - San Bernardino County Clerk of the Board Morgan, Joshua - San Bernardino County Department of Behavioral Health Mullenix, Zachary - San Bernardino County Office of Emergency Services Nelson, Pamela - San Bernardino County Real Estate Services Department O’Toole, Mary - San Bernardino County Administrative Office Ohikhuare, Maxwell - San Bernardino County Department of Public Health Olhasso, Mary Jane - San Bernardino County Administrative Office, Finance and Administration Appendix A: Bibliography A-2 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Osorio, Jennifer- San Bernardino County Department of Public Health, Environmental Health Services Division Perez, Daniel - San Bernardino County Department of Public Health, Disease Control Division Peterson, Susan - San Bernardino County, Human Resources Department, Employee Relations Division Phillippe, Jason - San Bernardino County Department of Public Health, Environmental Health Services Division Pilorin, Ron - California Department of Public Health, Environmental Management Branch Porter, Corwin - San Bernardino County Department of Public Health Ramos, Gilbert - San Bernardino County Transitional Assistance Department Ramos, James - San Bernardino County District 3 Supervisor Randles, Bud - San Bernardino County District Attorney, Bureau of Investigation Raymundo, Trudy - San Bernardino County Department of Public Health Rediford, Traci - San Bernardino County District Attorney, Bureau of Victim Services Reece, Tracy - San Bernardino County Probation Department Rigney, Jeffrey - San Bernardino County Special Districts Department Rivera, Marisa - San Bernardino County Economic Development Agency Rojas-Castro, Angelica - San Bernardino County Administrative Office Rowand, Douglas - Arrowhead United Way Rozko, Laurie - San Bernardino County Purchasing Department Rutherford, Janice - San Bernardino County District 2 Supervisor Self, Teri - San Bernardino County Department of Children and Family Services Serrano, Cindy - San Bernardino County, Office of Emergency Services Smith, Dena - San Bernardino County Administrative Office Smith, Michael - San Bernardino County District Attorney, Bureau of Investigation Smith, Scott - Arrowhead Regional Medical Center Soren, Asusena - San Bernardino County, Human Resources Department, Employee Relations Division Thomas, CaSonya - San Bernardino County Administrative Office, Human Services Department Thompson, Terry - San Bernardino County Real Estate Services Department Trager, Tim - San Bernardino County Information Services Department Trapp, Donald - San Bernardino County Fire Protection District Wagner, Miles - San Bernardino County, Office of Emergency Services Welch, Laura - San Bernardino County Clerk of the Board Welty, Kelly - San Bernardino County Department of Public Health Wert, David - County Administrative Office, Public Information Williams, LeAnna - San Bernardino County Department of Risk Management Windle, Bob - San Bernardino County Administrative Office, Labor Relations Wingert, Andrew - San Bernardino County Land Use Services Department, Code Enforcement Division After-Action Reports Braziel, Rick, Frank Straub, George Watson, and Rod Hoops. 2016. “Bringing Calm to Chaos: A Critical Incident Review of the San Bernardino Public Safety Response to the December 2, 2015, Appendix A: Bibliography A-3 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Terrorist Shooting Incident at the Inland Regional Center.” U.S. Department of Justice, Critical Response Initiative. Washington, DC: Office of Community Oriented Policing Services. Umscheid, Simon, William Lee, and Lynette Grulke. 3/24/2017. Review of December 2, 2015 Officer Involved Shooting, San Bernardino County District Attorney. San Bernardino, CA. Van Stralen, Daved, Sean D. McKay, George T. Williams, and Thomas A. Mercer. 2018. “Tactical Improvisation: After-Action/Comprehensive Analysis of the Active Shooter Incident Response by the San Bernardino City Fire Department.” San Bernardino City Fire Department/San Bernardino County Fire Protection District. Redlands, CA. Arrowhead Regional Medical Center. 2016. “Waterman Incident: Mass Casualty Shooting: Arrowhead Regional Medical Center After-Action Report/Improvement Plan.” Colton, CA. California Department of Industrial Relations, Division of Workers’ Compensation. February 23, 2017. “The Role of California’s Workers’ Compensation System in the San Bernardino Shootings.” Sacramento, CA. County Board of Supervisors Resolutions, Actions, and Board Meeting Minutes Fair Statement of Emergency Meeting/Closed Session 12/2/2015 Fair Statement of Emergency Meeting/Closed Session 12/7/2015 Meeting Minutes, 12/15/2015 Report on Agenda Item #20: Ratify Proclamation of Local Emergency, 12/15/2015 and all associated reports on the continuation for the proclamation between 12/15/2015 and 8/8/2017 Report on Agenda Item #21: Extension of Salary and Benefits for EHS Employees and Temporary Payment of Medical and Dental Premiums for Dependents of Deceased Employees, 12/15/15 Meeting Minutes, 1/12/2016 Report on Agenda Item #74: Continuation of Emergency Related to Transition of the Department of Public Health Environmental Health Services Division to Temporary Location, 1/12/2016 and all associated reports updating progress on alternate facilities and renovations to permanent facilities between 1/12/2016 and 1/24/2017 Meeting Minutes, 1/26/2016 Report on Agenda Item #13: Resolution Regarding California State Preschool Program Expenses Incurred During Temporary Closure of All Sites Due to a Local Emergency, 1/26/2016 Meeting Minutes, 2/9/2016 Meeting Minutes, 3/1/2016 Report on Agenda Item #32: Crisis Counseling Services for County Employees Meeting Minutes, 3/22/2016 Report on Agenda Item #29: Letter of Support for Senate Bill 893, 3/22/2016 Report on Agenda Item #32: Contract with California Association of Environmental Health Administrators for Environmental Health Temporary Staffing and Mutual Aid Memorandums of Agreement Template, 3/22/2016 Meeting Minutes, 4/19/2016 Appendix A: Bibliography A-4 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Meeting Minutes, 5/3/2016 Report on Agenda Item #18: Donation from the Robert Wood Johnson Foundation, 5/3/2016 Meeting Minutes, 5/24/2016 Report on Agenda Item #137: On-Call Consultant Agreements for Security Consultant Services, 5/24/2016 Meeting Minutes, 6/14/2016 Meeting Minutes, 6/28/2016 Report on Agenda Item #31: Purchase and Distribution of Prepaid Cards, 6/28/2016 Meeting Minutes, 7/12/2016 Meeting Minutes, 8/9/2016 Meeting Minutes, 8/23/2016 Report on Agenda Item #36: Crisis Counseling Services for County Employees and the Families of Victims of the December 2, 2015 Terrorist Attack, 8/23/2016 Meeting Minutes, 9/13/2016 Report on Agenda Item #37: Contract Amendment with California Association of Environmental Health Administrators for Environmental Health Temporary Staffing, 9/13/2016 Meeting Minutes, 9/27/2016 Report on Agenda Item #44: Accept Grant Agreement with the State of California, Board of State and Community Corrections, 9/27/2016 Meeting Minutes, 10/4/2016 Meeting Minutes, 11/1/2016 Report on Agenda Item #26: 2016 Homeland Security Grant Award, 11/1/2016 Meeting Minutes, 11/15/2016 Meeting Minutes, 12/6/2016 Meeting Minutes, 12/20/2016 Meeting Minutes, 1/10/2017 Meeting Minutes, 1/24/2017 Report on Agenda Item #27: Contract with CPARS for 12-2 Organizational Review, 1/24/2017 Meeting Minutes, 5/2/2017 Report on Agenda Item #15: Contract Amendment with California Association of Environmental Health Administrators for Environmental Health Temporary Staffing, 5/2/2017 Meeting Minutes, 8/8/2017 Report on Agenda Item #15: Termination of Local Emergency Related to Act of Terrorism, 8/8/2017 Meeting Minutes, 9/12/2017 Report on Agenda Item #25: Adoption of New County Policy - Employee Emergency Notification System, 9/12/2017 Meeting Minutes, 9/26/2017 Report on Agenda Item #15: Grant Agreement with California Victim Compensation board for Reimbursement of Expenses Resulting from the 12/2/15 Terrorist Attack, 9/26/2017 Meeting Minutes, 1/23/2018 Report on Agenda Item #45: Contract Amendment with CPARS for 12-2 Organizational Review, 1/23/2018 Appendix A: Bibliography A-5 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County “Countywire” Blog Posts A Message from the Chairman, 12/2/2015 A Statement from Board Chairman James Ramos, 12/3/2015 A Message from the Board of Supervisors, 12/3/2015 San Bernardino United Relief Fund Established for Victims, 12/4/2015 To Our Environmental Health Family, 12/2/2015 County New Conference This Morning. Watch it Live, 12/6/205 Photos: January 4 Family Gathering, 1/5/2016 FBI Statement: iCloud Password Reset with FBI Consent, 2/22/2016 Plans Underway for Dec 2 Memorial, 5/5/2016 Plans for December 2 Memorial Moving Forward, 11/23/2016 Department Emergency Operations Plans (DEOPs) Aging and Adult Services, 11/2/2015 Agricultural Weights and Measures, 7/13/2008 Airports, 11/25/2012 Architecture and Engineering, 7/14/2011 Arrowhead Regional Medical Center, 11/24/2015 Assessor/Recorder/County Clerk, 12/21/2015 Auditor/Controller/Treasurer, 9/3/2011 Behavioral Health, 1/19/2016 Board of Supervisors, District 1, 12/12/2014 Board of Supervisors, District 2, 7/3/2013 Board of Supervisors, District 3, 7/1/2013 Board of Supervisors, District 4, 4/4/2015 Board of Supervisors, District 5, 5/9/2015 Child Support Services, 1/11/2016 Children and Family Services, 11/2/2015 Children’s Fund, 9/16/2008* Children’s Network, 12/3/2013* First Five, 12/26/2014* Clerk of the Board, 2/1/2012 Community Development and Housing, 2/22/2013 County Administrative Office, 1/4/2016 and 7/15/2013 County Counsel, 2/1/2012 County Fire Protection District, 1/25/2015** District Attorney, 6/1/2012 Economic Development Agency, 2/22/2013 Facilities Management, 1/27/2011 Fleet Management, 12/18/2015 Human Resources, 8/6/2010 Human Services, 9/15/2010 Information Services, 11/30/2010 Inland Counties Emergency Medical Agency, 11/1/2015** Land Use Services, 12/21/2015 Library Administration, 12/21/2015 Museum, 1/30/2012 Preschool Services, 12/21/2015 Probation, 5/2/2011 Public Defender, 12/17/2015 Public Health, 1/6/2014 Public Works, 12/8/2015 Purchasing, 10/1/2008 Real Estate Services, 11/3/2008 Regional Parks, 2/1/2012 Registrar of Voters, 7/21/2009 Risk Management, 11/1/2013 Sheriff/Coroner, 7/10/2010 Special Districts, 7/20/2010 Transitional Assistance, 11/2/2015 Veterans Affairs, 3/25/2013 Workforce Development Department, 2/22/2013 * Separate, non-County entities not governed by the Board of Supervisors. **Separate, non-County entities governed by the Board of Supervisors. Appendix A: Bibliography A-6 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Department Post-Incident Experience Summaries (A.K.A. 90 Day Reports) Aging and Adult Services, 4/28/2016 Agricultural Weights and Measures, 4/20/2016 Arrowhead Regional Medical Center, 3/1/2016 Assessor/Recorder/County Clerk, 4/20/2016 Auditor/Controller/Treasurer, 3/7/2017 Behavioral Health, 4/20/2016 Child Support Services, 4/20/2016 Children and Family Services, 3/9/2017 Clerk of the Board, 4/20/2016 Community Development and Housing, 4/20/2016 County Administrative Office, Administrative Staff, 4/25/2016 County Administrative Office, Public Information, 4/18/2016 County Fire Protection District, 4/20/2016** District Attorney, 5/6/2016 Economic Development Agency, 3/7/2017 First 5 San Bernardino, 4/20/2016* Fleet Management, 4/21/2016 Human Resources, 4/20/2016*** Human Services, 4/19/2016 Human Services, Emergency Services Unit, 3/9/2016 Information Services, 4/20/2016 Inland Counties Emergency Medical Agency, 4/20/2016** Land Use Services, 3/1/2017 Library Administration, 4/20/2016 Museum, 3/10/2017 Office of Emergency Services, 4/20/2016 Preschool Services, 4/20/2016 Probation, 2/11/2016 Public Defender, 4/20/2016**** Public Health, 4/15/2016 Public Health, Environmental Health Services Division, 5/25/2016 Public Works, 4/7/2016 Purchasing, 4/21/2016 Real Estate Services, 10/15/2008 Regional Parks, 4/20/2016 Registrar of Voters, 4/20/2016 Risk Management, 4/20/2016 Sheriff/Coroner, 7/10/2010 Special Districts, 4/20/2016 Transitional Assistance, 4/19/2016 Veterans Affairs, 3/10/2017 Workforce Development, 3/2/2017 * Separate, non-county entities not governed by the Board of Supervisors. ** Separate, non-County entities governed by the Board of Supervisors. *** Includes 21 personal perspective summaries from individual staff members. **** Includes 8 personal perspective summaries from individual staff members. Environmental Health Services (EHS) Division Memorandums Regarding Tribute Events 2/29/2016 3/14/2016 3/29/2016 4/7/2016 11/15/2016 11/22/2016 11/29/2016 Interoffice Memorandums Devereaux, Gregory to Elected Department Heads, Assistant Executive Officer, County Chief Operating Office, County Chief Financial Officer, Deputy Executives Officers and Department Heads. 1/19/16. “Incident Communication and Documentation.” Rozko, Laurie to Department Purchasing Contacts, Department Cal-Card Coordinators. 12/10/2015. “Emergency Procurement Related to December 2nd.” Appendix A: Bibliography A-7 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Randles, Bud to Mike Smith, San Bernardino County District Attorney’s Office Bureau of Investigation. 12/7/2015. “After Action Report – San Bernardino, Inland Regional Center Shooting.” Smith, Dena to Elected Department Heads, Assistant Executive Officer, County Chief Financial Officer, Deputy Executives Officers and Department Heads. 4/4/16. “Initial Documentation of December 2, 2015 Attack.” Smith, Dena to Elected Department Heads, Assistant Executive Officer, Chief Operating Officer, County Chief Financial Officer, Deputy Executives Officers and Department Heads. 9/12/17. “SB Safe Employee Alert System” Windle, Bob, Assistant Director, Human Resources to Trudy Raymundo, Corwin Porter, Tom Hudson, Gia Kim. 12/9/2015. “Evacuation/Closure Time Reporting for Environmental Health Division and Certain Land Use Services Staff.” Windle, Bob, Assistant Director, Human Resources to Assistant Executive Officers, County Chief Financial Officers, Deputy Executive Officers, Department Heads, and Department of Public Health. 12/9/2015. “Evacuation/Closure Time Reporting for Environmental Health Division and Certain Land Use Services Staff.” Windle, Bob, Assistant Director, Human Resources to Elected Department Heads, Assistant Executive Officers, County Chief Financial Officers, Deputy Executive Officers, and Department Heads. 12/9/2015. “Evacuation/Closure Time Reporting for non-EHS Employees.” Legislative Position Papers Ramos, James, County of San Bernardino Board of Supervisors Chairman to California State Senator Connie Leyva, 5/5/2016. “Re: SB 1385 (Leyva) – As Amended March 29, 2016 – Sponsor.” Ramos, James, County of San Bernardino Board of Supervisors Chairman to California Assembly Member Philip Ting, Chair, Assembly Budget Committee. 5/25/2016. “Re: December 2 nd Terrorist Attack Budget Request.” Ramos, James, County of San Bernardino Board of Supervisors Chairman to California State Senator Mark Leno, Chair, Senate Budget and Fiscal Review Committee. 5/25/2016. “Re: December 2nd Terrorist Attack Budget Request.” Ramos, James, County of San Bernardino Board of Supervisors Chairman to California Assembly Member Philip Ting and California State Senator Mark Leno. 6/1/2016. “Re: December 2 nd Terrorist Attack Budget Request.” Ramos, James, County of San Bernardino Board of Supervisors Chairman to The Honorable Edmund G. Brown, Jr., Governor of California. 9/6/2016. “Re: DB 1385 (Leyva) – Request for Signature.” Appendix A: Bibliography A-8 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Memorial Committee Meeting Agendas and Notes 3/30/2016 4/13/2016 5/4/2016 5/25/2016 6/29/2016 11/17/2016 News Articles Aguilera, Elizabeth. 3/9/2016. “San Bernardino Shooting: How the County Helped Victims Move Forward.” Southern California Public Radio. http://www.scpr.org/news/2016/03/09/58197/sanbernardino-shooting-how-the-county-helped-vict/ Baer, Stephanie. 10/8/2016. “Retired Health Inspectors Give San Bernardino County Department Time to Heal After Terrorist Attack.” Pasadena Star News. https://www.pasadenastarnews.com/2016/10/08/retired-health-inspectors-give-sanbernardino-county-health-department-time-to-heal-after-terrorist-attack/ De Atley, Richard. 3/26/2016. “San Bernardino Shootings: Federal Help Sought to Cover Response Costs.” The Press-Enterprise. https://www.pe.com/2016/03/26/san-bernardinoshootings-federal-help-sought-to-cover-response-costs/ Downey, David and Ryan Hagen. 3/31/2016 “San Bernardino shooting victims’ families grateful for United Way support.” San Bernardino Sun. https://www.sbsun.com/2016/03/31/sanbernardino-shooting-victims-families-grateful-for-united-way-support/ Esquivel, Paloma and Richard Winton. 12/15/2015. “San Bernardino Seeks Help to Pay $1 Million In Costs From Shooting.” Los Angeles Times. http://www.latimes.com/local/california/la-me-1215-sb-terror-costs-20151215-story.html Esquivel, Paloma. 1/4/2016. “A month after attack, Employees Return to Inland Regional Center in San Bernardino.” Los Angeles Times. http://www.latimes.com/local/california/la-me-sbmemorial-20160105-story.html Goldenstein, Taylor. 3/31/2016. “Plan Unveiled for Distribution of San Bernardino Victims’ Fund.” Los Angeles Times.http://www.latimes.com/local/lanow/la-me-ln-san-bernardinoterrorist-attack-donation-payouts-20160330-story.html Hagan, Ryan. “$10.1 Million more in claims filed over San Bernardino mass shooting.” San Bernardino Sun. 6/1/2016. https://www.sbsun.com/2016/06/01/101-million-more-in-claimsfiled-over-san-bernardino-mass-shooting/ Hurt, Suzanne. 11/28/2016. “San Bernardino Terror Attack Survivors Beg County to Help Them Get Medications, Treatment.” Los Angeles Daily News. https://www.dailynews.com/2016/11/28/san-bernardino-terror-attack-survivors-beg-countyto-help-them-get-medications-treatment/ Appendix A: Bibliography A-9 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Karlamangla, Soumya, Cindy Carcamo, Garrett Therolf, and Brittny Mejia. 12/8/2015. “San Bernardino County Offices Reopen, But Health Workers Get More Time to Recover.” Los Angeles Times. http://www.latimes.com/local/california/la-me-public-health-20151208story.html Mejia, Brittny. 6/13/2016. “Widow of San Bernardino Shooting Victim Seeks $58 million in damages from County.” Los Angeles Times. http://www.latimes.com/local/lanow/la-me-ln-sanbernardino-shooting-victim-widow-58-million-20160113-story.html Myers, John. 9/25/2016. “Expansion of State’s Help in Paying the Emergency Costs of San Bernardino Terror Attack Rejected by Gov. Jerry Brown.” Los Angeles Times. http://www.latimes.com/politics/essential/la-pol-sac-essential-politics-updates-state-help-forthe-emergency-costs-of-1474837702-htmlstory.html Nelson, Joe. 2/22/2016. “How Do You Move Forward After a Terrorist Attack? San Bernardino County Public Health Directors Tell Us.” San Bernardino Sun. https://www.sbsun.com/2016/02/23/how-do-you-move-forward-after-a-terrorist-attack-sanbernardino-county-public-health-directors-tell-us/ Nelson, Joe. 5/20/2016. “San Bernardino County Recovering Slowly but Steadily 6 months After Terror Attack.” San Bernardino Sun. https://www.sbsun.com/2016/05/30/san-bernardinocounty-recovering-slowly-but-steadily-6-months-after-terror-attack/ Nelson, Joe. 5/27/2016. “San Bernardino Terrorist Attack Victim Autopsy Reports Released.” San Bernardino Sun. https://www.sbsun.com/2016/05/27/san-bernardino-terrorist-attackvictim-autopsy-reports-released/ Nelson, Joe. 9/12/2016. “More Funding to Be Considered for Temporary Employees After San Bernardino Terror Attack.” San Bernardino Sun. https://www.sbsun.com/2016/09/12/morefunding-to-be-considered-for-temporary-employees-after-san-bernardino-terror-attack/ Nelson, Joe. 8/7/2017. “San Bernardino County Poised to End State of Emergency from 2015 Terror Attack.” San Bernardino Sun. https://www.sbsun.com/2017/08/07/san-bernardinocounty-poised-to-end-state-of-emergency-from-2015-terror-attack/ Saunders, Doug and Joe Nelson. 1/22/2016. “Family of San Bernardino Terror Attack Victim Files $200M Claim.” San Bernardino Sun. https://www.sbsun.com/2016/01/22/family-of-sanbernardino-terror-attack-victim-files-200m-claim/ Saunders, Doug. 12/22/2015. “2 San Bernardino Police Officers Assigned to FBI Joint Terrorism Task Force. San Bernardino Sun. https://www.sbsun.com/2015/12/22/2-san-bernardino-policeofficers-assigned-to-fbi-joint-terrorism-task-force/ Appendix A: Bibliography A-10 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Shultz, Craig. 12/14/2015. “San Bernardino Shooting: Public donates in show of support for victims, families.” The Press-Enterprise. https://www.pe.com/2015/12/14/san-bernardinoshooting-public-donates-in-show-of-support-for-victims-families/ The Sun. 6/4/2016. “New Claims filed Friday Against San Bernardino County in Dec. 2 Terror Attack.” San Bernardino Sun. https://www.sbsun.com/2016/06/04/new-claims-filed-fridayagainst-san-bernardino-county-in-dec-2-terrorist-attack/ Wesson, Gail. “Local Governments Reject Millions in San Bernardino Attack Claims.” 11/26/2016. The Press Enterprise. https://www.pe.com/2016/11/26/local-governments-rejectmillions-in-san-bernardino-attack-claims/ News Releases Wert, David. 12/6/2016. “Board Ok’s Funding to Ease Worker’s Comp for Dec 2 Survivors.” News Release. County Administrative Office. San Bernardino, CA. Cardona, Felisa. 12/11/2015. EHS resumes work Monday; Employees remain on leave.” News Release. County Administrative Office. San Bernardino, CA. Wert, David. 12/20/2016. “County Secures Assistance for December 2 Survivors.” News Release. County Administrative Office. San Bernardino, CA. Cardona, Felisa. 2/22/2016. “Board discusses Dec. 2 emergency response at NACo conference.” News Release. County Administrative Office. San Bernardino, CA. Ramos, James. June-July 2016. “Comfort Quilt Heads to Orlando.” The Ramos Review. Third District Supervisor James Ramos. San Bernardino, CA. Wert, David. 1/17/2017. “County Grant will fill Worker’s Comp Gap for Dec 2 Victims.” News Release. County Administrative Office. San Bernardino, CA. Wert, David. 1/18/2017. “County Requests Its Share of Grant be Allocated to Survivors.” News Release. County Administrative Office. San Bernardino, CA. California State Association of Counties. June 2017. “CSAC, CAOs Honor Victims of 2015 San Bernardino County Terrorist Attack.” Post-Incident Coordination Group Meeting Agendas and Notes 12/28/2015 1/6/2016 1/14/2016 1/21/2016 1/28/2016 2/4/2016 Appendix A: Bibliography 2/11/2016 2/25/2016 3/3/2016 4/7/2016 4/14/2016 5/26/2016 6/23/2016 7/28/2016 8/11/2016 9/8/2016 10/19/2016 11/9/2016 A-11 11/9/2016 11/17/2016 1/12/2017 1/26/2017 2/8/2017 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County “Postmaster” Mass Email Notifications A Message from the Chairman, 12/2/2015 A Statement from Board Chairman James Ramos, 12/3/2015 A Message from the Board of Supervisors, 12/3/2015 San Bernardino United Relief Fund Established for Victims, 12/4/2015 County New Conference This Morning. Watch it Live, 12/6/2015 Statewide Counties Organization Supports San Bernardino, 12/7/2015 Support for Our County Family, 12/10/2015 San Bernardino County United Relief Fund, 12/11/2015 A Message from the Board of Supervisors, 12/11/2015 Join Us as We Remember, Honor and Support Our County Family, 12/17/2015 Additional Details about January 4, 12/23/2015 Important Details about January 4 Event, 12/30/2015 Watch a Live Stream of Today’s County Family Gathering, 1/4/2016 Introducing the SB Safe Employee Alert System, 2017 Presentations Antonucci, Michael, Cindy Serrano, and Robin Lindsay. San Bernardino Office of Emergency Services. 5/5/2016. “San Bernardino Terror Attack: The Emergency Management Response.” Devereaux, Greg, John McMahon, Trudy Raymundo, Dena Smith and David Wert. County Administrative Office, Department of Public Health, and Sheriff’s Department. 10/19-21/2016. County Administrative Officers Association of California Annual Meeting. Monterey, CA. Goldman, Lori, Dena Smith, Suzie Soren and Bob Windle. San Bernardino County Human Resources Department. 11/29/2016. “The December 2, 2015 Terrorist Attack.” County Personnel Administrators Association of California Conference. Lodi, CA. Lynch, Tom. Inland Counties Emergency Medical Agency. “Waterman Incident: The EMS Perspective.” 2016. San Bernardino, CA. Porter, Corwin. San Bernardino County Department of Public Health. 5/24/2016. “December 2, 2015: Impacts, Lessons Learned.” CFED West Conference & Expo. Palm Springs, CA. Porter, Corwin. San Bernardino County Department of Public Health. 5/10/2017. “December 2, 2015: Response and Recovery.” Michigan Terrorism Conference. Grand Rapids, MI. Porter, Corwin. San Bernardino County Department of Public Health. 5/16/2017. “Recovery and Resilience: Navigating Change in San Bernardino County After December 2nd.” Ohio State Public Health Conference. Columbus, OH. Ramirez, John. Loma Linda University Medical Center. 2016. “San Bernardino Mass Shooting December 2, 2015.” Loma Linda, CA. Appendix A: Bibliography A-12 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Thompson, Terry and Janet Lowe. San Bernardino County Real Estate Services Department. 2016. “Waterman Incident [Real Estate Perspective].” San Bernardino, CA. Wert, David and Felisa Cardona. County Administrative Office, Public Information. 11/2912/2/2016. “Lessons from an Act of Terror: Reflection on December 2, 2015.” California State Association of Counties Annual Meeting. Palm Springs, CA. Other Documentation California Victims Compensation Board. 12/8/2016. “Application for Financial Assistance under the Antiterrorism and Emergency Assistance Program (AEAP) (U.S. Office for Victims of Crime) for Costs Related to the Terrorist Mass Shooting and Attempted Bombing in San Bernardino, California on December 2, 2015.” Sacramento, CA.  County Administrative Office, AEAP Grant Application Grant Summary and Cost Breakdown Spreadsheet  AEAP Grant Agreement between the California Victims Compensation Board and the San Bernardino County Administrative Office County Administrative Office, SB Safe Emergency Notification System Bulletins  Instructions for Designation of SB Safe Employee Alert System – Department Assignees, 9/12/2017  Frequently Asked Questions, 9/12/2017 County of San Bernardino Adopted Budget, 2016 - 2017 County of San Bernardino 12/2/15 Incident Cost Tracking Ledgers County of San Bernardino Information Services Department (ISD). 12/2015. Physical Security Assessment Request for Quote and sample submitted proposal from Andrews International. County of San Bernardino Office of Emergency Services (OES). 2015. “Flash Reports”  Flash Report #1: 11:45 a.m. (12/2/15)  Flash Report #2: 1:50 p.m. (12/2/15)  Flash Report #3: 2:20 p.m. (12/2/15)  Flash Report #4: 4:20 p.m. (12/2/15)  Flash Report #5: 8:50 p.m. (12/2/15)  Flash Report #6: 9:00 a.m. (12/3/15)  Flash Report #7: 4:00 p.m. (12/3/15)  Flash Report #8: 8:15 p.m. (12/3/15)  Flash Report #9: 6:05 p.m. (12/4/15) County of San Bernardino Office of Emergency Services (OES). 2016. “Waterman Terrorist Incident Timeline.” Appendix A: Bibliography A-13 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County County of San Bernardino Policy Manual Policies:  No. 11-04 Procurement of Goods, Supplies and Equipment Effective 7/01/2012  No. 11-04 Procurement of Goods, Supplies, Equipment and Services Effective 2/14/2017  No. 11-05 Procurement of Services, Effective 11/5/2010  No. 12-18 Surplus Personal Property, Effective 7/12/2016  No. 13-08 Employee Emergency Notification System, Effective 9/12/17 Office of Governor Edmund G. Brown Jr. 12/18/15. Proclamation of a State of Emergency (December 2, 2015 Terrorist Attack). Office of Justice Programs Grant Notification. Edward Byrne Memorial Justice Grant for Fiscal Year 2016. Grant Number: 2016-DG-BX-0001 for California Board of State and Community Corrections. San Bernardino Fire Protection District. 1/28/14. Revenue Agreement Between the City of San Bernardino and San Bernardino County Fire Protection District for Office of Emergency Services. Note: Not included in the above bibliography are countless emails and individuals’ personal notes provided to the CPARS Team for review. Appendix A: Bibliography A-14 Organizational Review Response to 12/2/15 Terrorist Attack San Bernardino County Appendix B: State’s Workers’ Compensation System Review Appendix B: State Workers’ Comp Report B-1 STATE OF CALIFORNIA DEPARTMENT OF INDUSTRIAL RELATIONS Division of Workers’ Compensation 1515 Clay Street 17th Floor Oakland, CA 94612 EDMUND G. BROWN JR., Governor MAILING ADDRESS: P. O. Box 420603 San Francisco, CA 94142-0603 February 23, 2017 Christine Baker Director Department of Industrial Relations 1515 Clay Street, 17th Floor Oakland, CA 94612 Re: Role of the Workers’ Compensation System in the 12/2/2015 San Bernardino Mass Shooting Dear Director Baker: In light of complaints and inquiries concerning this incident and especially out of concern for the injured workers, you asked us to take a look at the how the County of San Bernardino and the workers’ compensation system responded following the December 2, 2015 mass shooting incident. Because most of the victims were County employees attending a work-related function, workers’ compensation was the primary means through which medical care and other benefits were provided to those victims. The enclosed report summarizes why this was the case and how the County, as a self-insured employer, attended to the needs of its employees and provided benefits authorized under the workers’ compensation laws. Included is an overview of the workers’ compensation system and how it addresses liability for job-related injuries. The incident generated 100 workers’ compensation claims, 96 by County employees or their survivors and four involving other employers. Our study focused on the County’s employees and the County’s handling of their claims. We reviewed summaries of claims and treatment decisions forwarded to us by the County, and we also reviewed information available from independent sources, including Independent Medical Review decisions and Workers’ Compensation Appeals Board case files. Our review shows that of the total 2,146 treatment decisions, 90 percent were approved and 3 percent received modified approval. As the claims matured, the County increased its scrutiny of treatment requests leading to some modifications and denials. A portion of those requests were appealed in the Independent Medical Review (IMR) system. While the IMR decisions generally upheld the County’s actions, often because doctors had failed to document or fully explain their requests, employees who were still suffering and expected their doctors’ recommendations to be followed were frustrated by the denials. More recently, the County took the positive step of hiring a nurse case manager to serve as an ombudsperson to help facilitate the presentation of treatment requests in a way that will satisfy the workers’ compensation system’s treatment guidelines. We think this would be an appropriate first step when dealing with an incident of this nature and that having someone Christine Baker February 23, 2017 Page 2 available throughout to facilitate the approval of claims and treatment requests between providers and claims administrators would likely reduce frustration experienced by some of the victims. Very truly yours, George Parisotto Acting Administrative Director Division of Workers’ Compensation Enclosures: The Role of California’s Workers’ Compensation System in the San Bernardino Shootings Memo on Data Consulted for San Bernardino 12/2/2015 Incident Report The Role of California’s Workers’ Compensation System in the San Bernardino Shootings Introduction On December 2, 2015, two individuals armed with semi-automatic weapons entered the Inland Regional Center in San Bernardino, California, and opened fire on a group of about 80 people gathered for training sessions and a holiday party. The shootings left 14 dead and 22 others seriously injured. The two shooters (a county employee who had been present at the start of the sessions and his wife) also left explosive devices in the Center before fleeing. Both were killed later in a shootout with pursuing law enforcement officers. Two officers also suffered injuries during that gunfight. Almost all of the victims inside the Center were employees of the County of San Bernardino (“County”). 12 died almost immediately, and two more died at a makeshift triage center set up near the building. Seriously wounded survivors were transported to area hospitals. Others suffered physical injuries that did not require immediate emergency treatment, and many of those present, as well as their families, friends and other co-workers, were traumatized by the event. In our system of justice, the perpetrators would bear ultimate responsibility for the costs associated with this terrorist incident. However, the shooters had negligible assets, which left the victims to look to other sources to pay for medical treatment and provide compensation for their injuries. Typically, the victims might look to the host of an event or owner of the premises for insurance coverage to pay for these costs. However, since the shootout occurred in a work-related training session conducted on behalf of the County, the County’s employees were both entitled and required to seek compensation from the County through California’s workers’ compensation system. Overview of Workers’ Compensation California’s current system of workers’ compensation was established pursuant to a constitutional amendment first adopted in 1911. Article 14, Section 4 of the California Constitution now states in part as follows: The Legislature is . . . vested with plenary power . . . to create, and enforce a complete system of workers' compensation, . . . to create and enforce a liability on the part of [employers] to compensate any or all of their workers for injury or disability, and their dependents for death incurred or sustained by the said workers in the course of their employment, irrespective of the fault of any party. A complete system of workers' compensation includes adequate provisions for the comfort, health and safety and general welfare of any and all workers and those dependent upon them for support to the extent of relieving from the consequences of any injury or death incurred or sustained by workers in the course of their employment . . .; also full provision for securing safety in places of employment; full provision for such medical, surgical, hospital and other remedial treatment as is requisite to cure and relieve from the effects of such injury; full provision for adequate insurance coverage against liability to pay or furnish compensation; full provision for regulating such insurance coverage in all its aspects . . .; full provision for otherwise securing the payment of compensation; and full provision for vesting power, authority and jurisdiction in an administrative body . . . to determine any dispute or matter arising under such legislation . . .. Workers’ compensation exists in this and other states as a system for determining liability, providing compensation, and adjudicating disputes for claims and cases involving job-related deaths, injuries and illnesses. The system governs only the liability of employers to their employees, and it operates as a mandated alternative to the tort principles and litigation process that govern civil liability and damages for personal injuries in most other contexts. The monetary compensation available through workers’ compensation is fixed and far less than what might be recovered in a civil action. However, the trade-off for this limitation is that workers’ compensation is provided on a no-fault basis, i.e. without regard to the parties’ relative fault in causing the death, injury or illness; the employer or insurer must bear all the costs of evaluating and resolving claims as well as providing monetary compensation and treatment; and, when functioning properly, the treatment and compensation is relatively swift and certain, rather than requiring years of litigation to resolve. All California employers are required to secure compensation for their employees through this system, either by obtaining a workers’ compensation insurance policy or by obtaining a certificate to self-insure from the Director of Industrial Relations. Like all insurance programs, premiums are calculated to cover and share all anticipated costs. Self-insured employers (typically larger private employers as well as public agencies like the County of San Bernardino) often purchase reinsurance to cover higher claim costs that arise in catastrophic situations involving multiple serious injuries. Employers also pay annual assessments to fund the public costs of administering California’s workers’ compensation system (making it a “user-funded” system). Benefits: In a typical job-related illness or injury case, the employee is entitled to medical treatment and services that are reasonably required to “cure and relieve . . . the effects of [the] injury”. The employee is also entitled to up to two years of temporary total disability benefits based on a percentage of his or her wages. Once the employee’s condition becomes “permanent and stationary,” the employee is entitled to permanent disability benefits based on a percentage of wages and on the amount of permanent disability (from 0 to 100%) caused by the job illness or injury. A comprehensive medical evaluation that assesses the lasting effects of the injury in relation to the employee’s overall medical history and condition is used to determine the percentage of disability, with the employee’s age, occupation, and lost earning capacity are also factored into that determination. Unlike personal injury cases, where amounts of compensation and damages awarded are largely within the discretion of a judge or jury, workers’ compensation is, by design, very detailed and formulaic in specifying what compensation is due for specific types of injuries. American Medical Association guidelines are used to establish permanent disability rating schedules, and, similar to Medicare, there are extensive regulatory guidelines governing the scope and extent of available medical treatment, as well as Official Medical Fee Schedules governing what must be paid for that treatment. Family members and dependents of employees are not entitled to any form of compensation through workers’ compensation unless the employee suffers a job-related death. In those cases, the spouse, minor children, and other dependents of the decedent are entitled to prescribed death benefits of up to $320,000 depending on the number of dependents (with the cap sometimes exceeded due to the ongoing dependency of children). In addition, the employer is liable to pay or reimburse a claimant for up to $10,000 for burial expenses, regardless of whether there is a dependency relationship. Procedure: A workers’ compensation claim ordinarily begins when the employee is provided with a claim form referred to as a DWC-1. The employer is required to provide this form within 24 hours after becoming aware of a potential claim, either because of something communicated by the employee or through other available information. Once the employee submits a claim, the employer has 90 days within which to investigate and then accept or deny the claim. Normally the employer turns over the claim to its insurer, or in the case of a self-insured employer such as San Bernardino County, to a claims administrator. The insurer or claims administrator then handles all of the employer’s responsibilities, including the responsibility to pay any benefits that are due. -2- While the investigation is pending and the claim is subject to denial, the employer must authorize and pay for up to $10,000 in necessary medical treatment. Once the claim is accepted, the employer (through the insurer or claims administrator) assumes responsibility to provide and pay for required medical treatment as well as the weekly wage replacement benefits due to the employee. The employer may also assert control over the employee’s medical treatment, usually by directing the employee to seek treatment through an established Medical Provider Network and by requiring documentation to show that a particular procedure or course of treatment is necessary and appropriate for the employee. Similar to Medicare and private health insurance plans, the employer must have a utilization review (UR) program to help ensure these decisions are made in accordance with evidence-based expert medical guidelines. 1 Initial decisions to approve a treatment request can be made by a claims administrator. However, a decision to deny or modify a request can only be made by a licensed physician with expertise in the clinical issues raised. This level of review is sometimes referred to as “elevated UR.” There are strict time limits for making UR decisions, and a treating physician’s failure to provide an adequate clinical rationale or documentation to support a request falling outside the established treatment guidelines will lead to denials on that basis. If a formal UR decision results in the denial, modification, or delay of a recommended treatment, the employee or treating physician has a further right to appeal that decision to the Administrative Director of the state’s Division of Workers’ Compensation, through a process known as Independent Medical Review (IMR). In IMR, another medical expert, acting on behalf of the state and following the same expert medical guidelines, reviews the documentation and determines whether the requested treatment is necessary and appropriate for the employee. Accepted workers’ compensation claims can be administered and resolved without ever going through formal adjudication. However, in the event of an unresolved dispute over issues such as whether an employee suffered a job-related illness or injury, the extent of that illness or injury, or the amount of compensation due, a party can start a case by filing an Application for Adjudication of Claim (commonly referred to simply as an “Application”) with the state’s Division of Workers’ Compensation. Disputed issues can then be adjudicated before a Workers’ Compensation Administrative Law Judge (WCALJ) in accordance with procedures and standards governed by the Workers’ Compensation Appeals Board (WCAB). The trial court system is administered by the Division of Workers’ Compensation at 24 venues across the state and handles over 300,000 cases a year. WCALJ decisions can be appealed to the WCAB through a process known as a Petition for Reconsideration, and WCAB decisions can be reviewed by one of California’s courts of appeal. Employees may but are not required to be represented by attorneys in these cases. Attorneys cannot charge employees directly for representation but may recover a percentage fee of up to 15% of the benefits due to the employee, plus hourly fees for attending depositions, with all fees subject to approval by the WCALJ and paid directly by the employer. San Bernardino County’s Immediate Response to the Incident In the immediate aftermath of the shootings, first responders provided immediate care and transported 1 These guidelines are set forth in an extensive set of regulations known as the Medical Treatment Utilization Schedule (MTUS). For treatments or conditions that are not fully addressed in the MTUS, other nationallyrecognized evidence-based treatment guidelines may be consulted, including the Occupational Medicine Practice Guidelines established by the American College of Occupational and Environmental Medicine (ACOEM) and the Official Disability Guidelines (ODG) published by the Work Loss Data Institute. -3- surviving victims to area medical facilities, without regard to who was responsible or authorized to provide or pay for those services. According to County representatives, senior County leaders, including members of the Board of Supervisors and County executives, met that evening to discuss and implement response mechanisms, and at that time learned that nearly all the victims and one of the shooters were employees of the County’s Environmental Health Services division attending an off-site training event. The County reports that it established a team of liaisons to interact with each victim or victim’s family individually and address the full range of potential concerns, including pay, benefits, sick leave, workers’ compensation claims, and recovering vehicles and personal effects from the training site or other work locations. Claim files were created for each employee believed to have been present at the incident, and the County says that it initiated outreach to known victims and families through phone calls and home and hospital visits. The County reports that within a few weeks after the incident the FBI conducted a closed-door Family Assistance Center event for victims and families, with representatives from federal, state, and local agencies, as well as unions and local charities present to offer a range of information and assistance. Thereafter, there were several meetings with affected employees to discuss benefits and other assistance, with many of these meetings taking place at a “safe house” where victims could gather without drawing media attention. Handling of Workers’ Compensation Claims related to the Incident A review of available data 2 shows nearly 100 workers’ compensation claims that may have been related to this incident (based on the date of injury, general location, and description). The County’s own records show 96 claims by County employees or their survivors, which break down further into 13 death benefits’ claims, 58 injury claims that were accepted by the County, and 25 denied claims. The earliest of these claims was submitted five days after the incident and the latest nearly 11 months later. Death Benefits Claims: 13 of the 14 decedents were county employees, 3 and the County reports that it identified family members or other contacts from personnel records, and assisted them in filling out forms and obtaining supporting documentation (such as marriage and birth certificates needed to establish dependency relationships). The County says that it paid the allowable funeral costs of up to $10,000 through the workers’ compensation system, and that additional funds to cover higher costs were available through the California Victims Compensation Board. Nine death benefits claims were approved and benefit payments to the eligible dependents commenced within two to four months after the incident. 4 Two claims are open but remain unresolved pending proof of dependency by those claiming entitlement to benefits. For the other two, burial expenses were paid, but no dependents have been identified or come forward to claim monetary benefits. 5 2 See attached memo on data consulted for purposes of preparing this report. 3 The other decedent was a vendor working at the Inland Regional Center. 4 The disposition of these claims is shown in formal Stipulations filed with the Division of Workers’ Compensation and approved by a WCALJ. This is a necessary step to confirm the identity of dependents eligible for death benefits and the amounts due. As with temporary and permanent disability benefits, death benefits are paid out on a weekly basis until the maximum is reached or the parties agree to a discounted lump-sum payout. 5 As of mid-January of 2017, the County reported payouts of over $500,000 in death and funeral expenses benefits, with future incurred liability of approximately $4.6 million. -4- Accepted Claims from Survivors: Overall the County accepted 58 workers’ compensation claims filed by employees who survived the shooting. The accepted claims included employees with both physical and psychological injuries and those with only the latter. The County has provided one chart listing all treatments and bills that were authorized and paid as a matter of course without additional scrutiny. Another chart lists the requests that went through Utilization Review (UR), including requests reviewed and approved by the County’s Department of Risk Management and others that went through elevated UR by medical experts associated with County’s UR Plan. The chart of routine approvals lists 1321 items for 38 employees at an aggregate cost of approximately $1.6 million. Nearly 70% are categorized as bills for physician services, with the balance covering prescriptions, hospital and surgical costs, physical therapy, and prosthetics. The chart of UR decisions shows that the County was receiving and approving prospective requests for treatments, tests, prescriptions, and medical equipment within days of the incident. The County was routinely approving nearly all requests through approximately mid-April of 2016, by which time a substantial volume of medical reports had been accumulated for many of the survivors with serious injuries. The County then began submitting more of the requests through elevated UR. 6 The County’s chart documents 825 UR decisions that break down as follows: Total Approved 606 (73%) [Approved by County Risk Mgt. 424] [Approved in Elevated UR 182] Modified Approval Denied Other 7 73 ( 9%) 144 (17%) 2 Adding the routine approvals and UR decisions together yields a combined total of 2146 treatment decisions that break down as follows: Total Approved Modified Approval Denied Other 1927 (90%) 73 ( 3%) 144 ( 7%) 2 47 of the 58 employees with accepted claims had one or more requests that went through UR. The numbers vary widely, from one employee with over 150 requests going through UR, another with nearly 70, eight with between 21 and 50 requests, fifteen with 11 – 20 requests, twenty-two with 1-10 6 75% of the Utilization Review evaluations fell within categories of requests for particular types of pharmaceuticals, psychiatric treatments, physical therapy, or durable medical equipment. Most UR decisions were made within a few days after receipt of the request, and less than six percent of the decisions, including decisions made through elevated UR, took longer than a week. 7 One item lists the decision as “disputed liability”, and another provides no information about the request or decision. -5- requests, and nine with no requests. 8 27 of the employees had at least one denial or modification of a request. Eleven employees have appealed one or more of their denied requests through the Independent Medical Review (IMR) process. Through the first week of January of 2017, a total of 19 substantive IMR decisions had been issued, addressing 68 separate items. 9 Collectively, these decisions upheld 37 UR decisions to deny or modify a request, overturned 9 UR decisions, and did not review 22 others because the requests had been authorized by the County sometime after the initial denial. 10 Without access to UR files and decisions it is difficult to make assumptions about what caused some requests to be accepted and others to be modified or denied by the County. However, a review of the IMR decisions, which are available, offers some insight. Typically, the problem identified in IMR decisions was a provider’s failure to provide an adequate clinical rationale or appropriate documentation to justify requests for extended or new prescriptions, extended or alternative therapies, or special equipment that veered away from standard medical treatment guidelines and limits. There also appear to have been a fair number of duplicate or overlapping requests. The fact that several requests were denied and then authorized upon further review suggests that better communication by providers to the County’s claims administrators and better documentation at the time requests were first submitted might have reduced the number of UR denials and IMR requests. 11 19 of the employees with accepted claims have filed Applications for Adjudication before the DWC/WCAB. All are represented by attorneys. Only seven of the cases reflect litigation activity in the form of requests for hearings before a WCALJ on claims administration or benefit rights. Two involved Temporary Total Disability payments (continuation or amount), one involved the choice of treating physicians, four (including two in one case) involved claims of untimely or ineffective denials of treatment requests, and one involved obtaining an evaluation of the employee’s permanent disability. Six of these disputes appear to have been resolved without need for a trial. One dispute over late denial of treatment went to trial in early October and remained undecided at the end of January. In the other case, the County requested a hearing on getting a medical evaluator, with that hearing still pending. 12 Denied Claims: The County denied the workers’ compensation claims of 25 other employees alleging psychological injury arising out of the incident. According to the County, a common thread among these denials was that the employees were not present at the training center when the incident occurred. Three of the denials were appealed through the filling of Applications for Adjudication with the DWC/ WCAB. One was settled by Compromise and Release for $7,000; one was voluntarily dismissed without prejudice; and the other one remains open. The low rate of appeal and results of those appeals thus far 8 The chart identifies one employee for whom treatment and benefits were authorized but declined. 9 We have not been able to discern whether each IMR request corresponds to an individual UR request or whether some involve combined UR requests. 10 There were also two dismissals, one because the treatments were authorized when the IMR request was filed, and the other because the type of UR decision being appealed was not subject to IMR. 11 The fact that a large percentage of the denials was concentrated among a relatively small number of providers further suggests that this was a particular problem with certain providers and not typical or characteristic of interactions as a whole. 12 Many of the cases were filed within a few months after the incident and with no indication of a genuine dispute or need to litigate any issue in the claim. Although attorneys may file applications to protect the clients’ right and ability to litigate future disputes, they also place the employee and employer in an adversarial relationship that may further hinder communication and cooperation. -6- suggests that the denials were largely accepted as appropriate decisions by the claimants and their advocates. Conclusion The County reported that it had paid over $ 4 million for benefits and medical care as of mid-January of 2017, and had a reserve amount of nearly $ 22 million for continuing and future costs. The County’s Department of Risk Management continues to administer the claims, but reinsurers are responsible for costs in excess of $ 2 million, and representatives of the reinsurers have also reviewed case management decisions. Looking at the volume of treatment requests as a whole, denials or modifications of requests that did not fit within MTUS guidelines were clearly an exception to the overall pattern of treatment requests being routinely accepted or approved through UR. Persons who suffered injuries or other financial losses due to the incident are not limited to claiming workers’ compensation benefits. Victims can also seek, and some have received, crime-related expense reimbursements from the California Victim Compensation Board. 13 In addition, we understand that other special funds were set up by other agencies and local charities to aid victims of the mass shooting. 13 Expenses that potentially may be covered by this Board include income loss, medical and dental treatment, mental health services, residential security, home or vehicle modifications for disabled victims, relocation, and funeral and burial expenses. -7- Memo on Data Consulted for County of San Bernardino 12/2/2015 Incident Report San Bernardino Claims Data: On January 20, 2017, San Bernardino County sent to the Department of Industrial Relations (DIR) information on the 96 claims filed to date. This information contained the claim status, claim type, county division, claim dates, and claim paid and incurred amounts. These claims were verified for accuracy with information previously sent to the Workers’ Compensation Information System (WCIS) First Reports of Injury and Subsequent Reports of Injury (FRO-SROI) database for San Bernardino claims with a date of injury of 12/2/2015. WCIS found 100 claims that appeared to match the incident. However, the four claims that did not match the County of San Bernardino’s list were found to belong to different employers, with injuries similar to those experienced by employees of the County of San Bernardino. San Bernardino Utilization Review (UR) Data: San Bernardino County also sent DIR information on the UR activity for the injured workers. This information contained 830 rows of data in a master file, a summation and separate entries for each injured worker with at least one UR. The master file record contained the claim information, request date, request completed date, request category and type, name of the requesting provider, the decision, additional information on the appeal, and additional information on the decision. Five records in the master file did not have a UR decision. San Bernardino Medical Data: San Bernardino later provided DIR with a list of treatments approved and bills paid for treatments not subject to UR. Independent Medical Review (IMR) Data: DIR reviewed the Maximus Federal Services (MFS) Entellitrak system to identify all requests for IMR and IMR decisions through mid-January. 21 separate IMR determinations, including two dismissals without review and 19 substantive decisions, were obtained and reviewed. San Bernardino County Cases and Electronic Adjudication Management System (EAMS) Data: Using the claim data received from San Bernardino County, DIR verified and reviewed each WCAB case in the EAMS system that was filed on behalf of an employee with an accepted or denied claim arising out of the incident on 12/2/15. (Death benefits cases were not reviewed.)