An Organizational Review of

San Bernardino County’s Response to

the December 2, 2015 Terrorist Attack
June 18, 2018

CPARS Consulting, Inc.

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

This page is intentionally blank.

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Dedication
This report is dedicated to the San Bernardino County employees present during the December
2, 2015 terrorist attack, including fourteen (14) deceased victims1 and fifty-eight (58) survivors
that continue to be, and will forever remain, beloved members of the San Bernardino County
Family; as well as the countless members of the San Bernardino County Family who worked
tirelessly and selflessly to safeguard the community and support those affected with
compassion, dedication, and professionalism.

1
One of the fourteen (14) deceased victims was not a San Bernardino County employee, but is nonetheless
remembered by this report.
Dedication i
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

This page is intentionally blank.

ii
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Acknowledgements
Critical Preparedness and Response Solutions (CPARS Consulting, Inc.) would like to thank the
following individuals with San Bernardino County who recognized the importance of
memorializing the County’s response to the December 2, 2015 terrorist attack, who made this
report possible, and offered the full commitment of their time and County resources to make
this effort a priority and success:
 Robert Lovingood, First District Supervisor, Board Chairman
 Janice Rutherford, Second District Supervisor
 James Ramos, Third District Supervisor
 Curt Hagman, Fourth District Supervisor, Board Vice Chairman
 Josie Gonzales, Fifth District Supervisor
 Gary McBride, Chief Executive Officer (CEO)
 Leonard Hernandez, Chief Operating Officer (COO)
 Gregory Devereaux, CEO (Ret.)
 Dena Smith, COO and Interim CEO (Ret.)
 Mary O’Toole, Principal Management Analyst (Ret.)

CPARS also wishes to thank the hundreds of County employees, past and present, who
contributed information and/or participated in interviews and data gathering efforts. This
report would have lacked value without their candor, time, and generosity of spirit.

Lastly, CPARS would like to thank its team, which demonstrated great commitment, heart, and
professionalism working with San Bernardino County stakeholders in the creation of this report:
 Nick Lowe, Project Manager/Co-Author (CPARS Consulting, Inc.)
 Kathryn Humphrey, Deputy Project Manager/Co-Author (K-Rise Enterprises, Inc.)
 Julie Quinn, Co-Author (QuinnWilliams, LLC)
 Katherine Williams, Co-Author (QuinnWilliams, LLC)
 Sheri Benninghoven and Scott Summerfield, Communications/Public Information
Subject-Matter Experts (SAE Communications)
 Jean Roque and Christine Thelen, Human Resources/Employment Subject-Matter
Experts (TruppHR, Inc.)

Acknowledgements iii
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

This page is intentionally blank.

iv
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Executive Summary
On December 2, 2015 the San Bernardino County Department of Public Health (DPH)
Environmental Health Services (EHS) Division was hosting an annual training event at a
conference center that is part of the nearby Inland Regional Center (IRC). Seventy-two (72)
County employees were in attendance from the EHS Division and DPH. At approximately 10:30
a.m., an Environmental Health Specialist (the male perpetrator) left the meeting and returned a
little less than half an hour later with his wife (the female perpetrator). They were armed with
multiple firearms, hundreds of rounds of ammunition, home-made explosives, and were
dressed in tactical military-style gear. At 10:58 a.m. they approached the IRC Conference Center
first killing two people near the entrance to the building before proceeding into the meeting
space where the male perpetrator’s colleagues were gathered. The perpetrators
indiscriminately fired upon the attendees killing a total of 14 people, injuring 22, and
traumatizing all the survivors who witnessed the attack. The perpetrators fled in a rented
vehicle before law enforcement arrived. Later that afternoon they were tracked down by law
enforcement and both were killed during a gun battle approximately one mile from the IRC
around 3:15 p.m. Two days later, law enforcement and the Federal Bureau of Investigation (FBI)
confirmed the attack was a premeditated act of terror inspired by the Islamic State of Iraq and
Syria/the Levant (ISIS/ISIL).

The attack had direct and serious impacts on the department and division targeted. The
deceased (with the exception of an IRC contractor), the survivors, and one of the perpetrators
were County employees. Without precedent, the County, including the department and division
targeted, was faced with critical decisions associated with personnel accountability, security,
benefits, psychological counseling, public information, memorials, and reconstituting a critical
division left void of personnel, among other matters. However, the attack would ultimately
have an effect on the entirety of San Bernardino County governmentnearly 22,000
employees affectionately and genuinely referred to as the “San Bernardino County Family.”

The attack also marked an amalgamation of previously independent threat and response
elements simultaneously present in one incident: active shooter incident; terrorism; victim and
responder; employer and community service provider. Although there were countless
correlations between San Bernardino County’s experience and other incidents, few previous
incidents had the complexities of all those characteristics and, at the time, there was no
resource available to guide the County’s response. With the complementary 12/2/15 Terrorist
Attack Legacy Report2, San Bernardino County hopes its experience will help other jurisdictions
and organizations better prepare for, and if necessary, respond to, this new threat environment
and improve the care and support for victims.

This report endeavors not only to capture the breadth of the impacts on the County, but also to
highlight the hundreds of actions taken by dedicated County employees to address those

2
The 12/2/15 Terrorist Attack Legacy Report is available at:
http://www.sbcounty.gov/uploads/CAO/reports/December2LegacyDocument.pdf
Executive Summary v
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

impacts (personal, operational, fiscal, etc.). As an organizational review, it is intended to

capture the most important aspects of the County’s response and the resilience of the County
family as a whole. In addition, it aims to understand the performance of the County as a whole
unit with some special attention paid to individual programs and/or projects that were uniquely
affected.

This report is primarily organized into two sections: 1) a timeline of major events and actions
that tells the County’s story chronologically; and 2) a selection of narratives organized into six
categories that tell the County’s story in-depth by topic. The timeline is intended to be a quick
reference that illustrates the momentum, magnitude, and duration of the County’s experience
and response efforts. The six topical categories and the narratives contained within are as
follows:

1) Emergency Protocols: This section explores those situations San Bernardino County faced,
and actions it took within its purview, to address imminent threats to human life, the safety
and security of personnel, and the immediate wellbeing of victims and survivors. The
narratives in this section address the role County departments played in directly supporting
public safety incident response operations, the challenges of implementing actions to
protect employees during a quickly evolving incident, the application of security measures,
the dismissal of personnel and office closures, accounting for the status of personnel, and
the care for victims’ remains and notification to their next-of-kin.

2) Operational Response: This section addresses the actions and resources employed by the
County to manage crises, enable necessary emergency actions, and position the County
toward recovery. The narratives in this section describe the role of the County’s pre-existing
emergency plans in the response to the terrorist attack, including efforts to continue
essential operations. In addition, it explores the role of the County’s Emergency Operations
Center (EOC) in the coordination of policies, tasks, information, and resources to support
incident response operations and recovery, and similar management practices used across
departments to strategically select objectives, assign tasks, document activities, and
monitor progress. The County’s Proclamation of a State of Local Emergency, addressed in
this section, enabled emergency authorities and triggered programmatic eligibility,
including emergency procurement and possible State or Federal reimbursement, among
other provisions to aid recovery. This section goes on to address a variety of other actions
taken by the County to pave the road to recovery.

3) Communications: Perhaps the most integral part of every organization’s ability to

effectively respond, manage impacts and crises, and achieve a new steady state, is
communication and coordination. Both were at the heart of every situation and present in
the activities in which San Bernardino County was engaged following the attack. As such, it
is a topic addressed throughout this report. This section, however, focuses on two particular
aspects of communications: 1) the resources and processes facilitating information sharing/
situational awareness; and 2) the resources and processes that enabled the mass
distribution of information. In some cases, the two overlapped as one entity’s distribution
of information provided for another’s awareness. The narratives in this section explore the

Executive Summary vi
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

County’s account of becoming aware of the attack and its magnitude, the County’s ability to
gather and distribute information, and the process employed to relay information to the
public.

4) Employee Support: The County provided a variety of services to the victims of the terrorist
attack and their families. The narratives in this section address the services provided to the
families of the deceased, the affected County employees and their families. Those services
include establishing single points of contact to liaison with victims and families on behalf of
the County, the administration of State programs that offered support and benefits to the
victims of crime, the provision of crisis counseling, the administration of employment
benefits and leave programs, including workers’ compensation, and the management of
donations.

5) Continuity of Operations: Using generally accepted national and international standards for
continuity programs; this section reviews the County’s implementation of continuity
treatments to ensure the continued performance of essential functions in the midst of and
following the terrorist attack. The narratives in this section address succession planning and
delegations of authority as many County and department leaders were out of the area on
the day of the attack or were directly affected by the attack, the status of essential
functions affected by the attack and efforts to recover capability levels, and the application
of alternate facilities and alternate personnel as strategies to sustain operations.

6) Organizational and Financial Recovery: This section examines actions taken by San
Bernardino County to establish a new normal, make the organization fiscally whole, and
address the long-term cultural and operational ramifications of the terrorist attack. The
narratives in this section explore the ongoing efforts to remember the victims and effects of
the attack, long-term strategies to reconstitute staffing and operations in the EHS Division,
renovations made to County facilities, and the pursuit of security measures to create an
environment in which employees feel safe and have greater awareness and involvement in
maintaining a safe environment. This section also addresses the total costs associated with
the attack, the County’s efforts to recover some of those costs through State and Federal
sources, and the legislative and legal implications associated with the attack.

Each aforementioned section offers insights into the foundation laid toward recovery in the two
years since the attack. In addition, call-out boxes are presented within some sections to offer
deeper insights derived from the reflections of County personnel engaged in the development
of this report and, to a lesser extent, the observations of the authors.

Having experience with manmade and natural disasters and acts of terrorism, the authors of
this report found the decisions made and actions taken by the County were reasonable, and in
some cases remarkable, given the circumstances and with the information and resources
available. The authors recognize also that less-than-optimal decisions and actions are often
better than no action at all. It was generally only with the advantage of hindsight, that County
personnel were able to identify lessons, alternate approaches, or opportunities for
improvement. Although some opportunities to evaluate and adjust course were missed while
efforts were in progress, many lessons had already been identified and acted upon by the
Executive Summary vii
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

County to improve its readiness and resilience by the time this report was commissioned; and
those items are identified in this report where appropriate.

In general, the County demonstrated a “do whatever it takes” mentality at all levels. That
perseverance was often rewarded as the County was able to circumvent bureaucracy and red
tape to expedite and/or increase services. In a few cases, it was limited by regulation or
resource availability beyond its control. The County provided a number of services and offered
benefits that went well beyond its legal obligation as an employer and precedents previously
set by other jurisdictions/organizations. On December 2, 2015 San Bernardino County, its
employees, and community confronted the evils of terrorism and since that day, the County has
navigated real and potential crises and has emerged more resilient than ever before.

Executive Summary viii

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Table of Contents
Dedication ........................................................................................................................................ i
Acknowledgements.........................................................................................................................iii
Executive Summary..........................................................................................................................v
Table of Contents ............................................................................................................................ ix
I. Introduction ................................................................................................................................. 1
Background and Context............................................................................................................. 1
Approach and Assumptions ........................................................................................................ 2
Methodology............................................................................................................................... 3
Report Structure ......................................................................................................................... 5
The 12/2/15 Terrorist Attack Legacy Report .............................................................................. 6
II. Timeline of Events and Actions ................................................................................................... 7
III. Narratives and Analysis ............................................................................................................ 19
Category 1: Emergency Protocols ............................................................................................. 19
1.1 Incident Support ............................................................................................................. 19
1.2 Evolution of Situational Information .............................................................................. 23
1.3 Immediate Security Measures/Lockdown ...................................................................... 25
1.4 Personnel Release and Office Closures........................................................................... 29
1.5 Personnel Accountability ................................................................................................ 33
1.6 Notification of Next-of-Kin .............................................................................................. 37
Category 2: Operational Response ........................................................................................... 41
2.1 Department Emergency Operations Plans (DEOPs) ....................................................... 41
2.2 County Emergency Operations Center (EOC) ................................................................. 45
2.3 Proclamation(s) of Emergency ........................................................................................ 53
2.4 Management Practices and Documentation .................................................................. 57
2.5 Emergency Procurement ................................................................................................ 61
2.6 Addressing the Perpetrator’s Footprint .......................................................................... 65
Category 3: Communications.................................................................................................... 67
3.1 Initial Notification ........................................................................................................... 67
3.2 Emergency Contacts ....................................................................................................... 71
3.3 Mass Notification/Communications ............................................................................... 73
3.4 Public Information .......................................................................................................... 76

Table of Contents ix
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Category 4: Employee Support ................................................................................................. 85

4.1 Victim Liaisons................................................................................................................. 87
4.2 Victims of Crime Services ................................................................................................ 91
4.3 Emotional Support .......................................................................................................... 95
4.4 Employee Benefits and Leave ......................................................................................... 99
4.5 Workers’ Compensation ............................................................................................... 105
4.6 Donations ...................................................................................................................... 108
Category 5: Continuity of Operations ..................................................................................... 115
5.1 Evolution of Leadership (Succession and Delegations of Authority) ............................ 115
5.2 Continuity of Essential Functions.................................................................................. 121
5.3 Alternate Facilities ........................................................................................................ 127
5.4 Alternate Personnel ...................................................................................................... 131
Category 6: Organizational and Financial Recovery ............................................................... 137
6.1 Memorials and Remembrances .................................................................................... 137
6.2 Reconstituting Employment Levels and Practices ........................................................ 141
6.3 Facility Renovations ...................................................................................................... 145
6.4 Long-Term Security ....................................................................................................... 149
6.5 Total Cost Accounting ................................................................................................... 153
6.6 Cost Recovery/Reimbursement .................................................................................... 157
6.7 Litigation ....................................................................................................................... 161
6.8 Legislation ..................................................................................................................... 163
IV. Conclusion.............................................................................................................................. 167
Appendix A: Bibliography............................................................................................................. A-1
Appendix B: State’s Workers’ Compensation System Review ..................................................... B-1

Table of Contents x
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

I. Introduction
On December 2, 2015 San Bernardino County became the victim of a horrific act of terrorism
that was unique in the United States at the time of this report. The attack simultaneously
exhibited characteristics consistent with organized and strategic terrorism, spontaneous lone
wolf attacks on soft targets, and active shooter incidents. Given its role as a government entity,
County personnel were both victims and responders, the County was the employer of both the
perpetrator and the victims, and the provider of essential and mandated services to the
community that had been targeted. The attack was inspired by the Islamic State of Iraq and
Syria/the Levant (ISIS/ISIL), so to the world outside of San Bernardino County government it
was seen as a terrorist attack akin to the attacks in Paris the month before, or as simply the
latest in a series of horrific mass shootings occurring across the country. But to some County
employees, particularly those in the Environmental Health Services (EHS) Division, it was much
more. It was a deeply personal betrayal carried out against them by a fellow County employee.
Just months earlier, the perpetrator’s colleagues had held a baby shower to celebrate the
pending birth of his first child. In addition, personnel from the County’s departments involved
in the public safety response, including Public Health, Sheriff-Coroner, Probation, Behavioral
Health, and others worked closely with the staff from the EHS Division targeted that day. At the
time of this reporttwo years laterthe incident was still fresh in the minds of County
employees and the public and the resulting feelings of grief, anger, and betrayal may never
completely subside. Despite the lasting effects of the attack, San Bernardino County’s spirit has
proven stronger and this report attempts to tell that story.

Background and Context

On December 2, 2015 the San Bernardino County Department of Public Health (DPH)
Environmental Health Services (EHS) Division was hosting an annual training event at a
conference center a short distance from their San Bernardino offices that is part of the Inland
Regional Center (IRC)3. Seventy-two (72) individuals from the EHS Division and DPH were in
attendance. At approximately 10:30 a.m., one EHS Specialist (the male perpetrator) left the
meeting. He returned a little less than half an hour later with his wife (the female perpetrator).4
They were armed with multiple firearms, hundreds of rounds of ammunition, home-made
explosives, and were dressed in tactical military-style gear. At 10:58 a.m. they approached the
IRC Conference Center first killing two people near the entrance to the building before
proceeding into the meeting space where the male perpetrator’s colleagues were gathered.
The perpetrators indiscriminately fired upon the attendees killing a total of 14 people, injuring
22, and traumatizing all the survivors that witnessed the attack. The perpetrators fled in a
rented vehicle before law enforcement arrived. Later that afternoon they were tracked down
by law enforcement and both were killed during a gun battle approximately one mile from the

3
The IRC is a government-funded not-for-profit corporation that provides services and programs to people with
developmental disabilities and their families. Its headquarters includes a conference center located in the City of
San Bernardino.
4
At the County’s request, the authors of this report chose not to give attention to the perpetrators of the attack
and have thereby not referred to them by name.
Introduction 1
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

IRC around 3:15 p.m. Two days later, law enforcement and the Federal Bureau of Investigation
(FBI) confirmed the attack was a premeditated act of terror inspired by a radical Islamic
terrorist organization.

The attack had widespread impacts on San Bernardino County. Most obviously, the deceased
(with the exception of an IRC contractor), the survivors, and one of the perpetrators were
County employees. Without precedent, the County was faced with critical decisions associated
with personnel accountability, security, benefits, psychological counseling, public information,
memorials, and reconstituting a division left void of personnel, among other matters. However,
the attack would ultimately have an effect on the entirety of San Bernardino County
governmentnearly 22,000 employees affectionately and genuinely referred to as the “San
Bernardino County Family.” Some of those far reaching consequences would include removing
the perpetrator’s work-related vestiges in the community, addressing the sufficiency of
emergency action plans, donations management, litigation, legislation, effects on workplace
culture, financial implications, and attempts at cost recovery under uncharted circumstances.
Critical Preparedness and Response Solutions (CPARS Consulting, Inc.) was commissioned by
the San Bernardino County Board of Supervisors and County Administrative Office (CAO) to
document the short- and long-term impacts and actions of the County of San Bernardino, as an
organization, as it responded to, and attempts to recover from the terrorist attack.

This report does not address the perpetrators, what led to the attack, or the tactical public
safety and investigative response, which are addressed in other reports.5 As an organizational
review, this report aims to understand the actions taken and performance of the County as a
whole versus individual programs and/or projects (although some programs were uniquely
affected by the attack and warranted being addressed individually). This report also addresses
topics such as business continuity, the role and evolution of leadership, organizational culture,
management practices/processes, and employee support.

Approach and Assumptions

This documentation effort consisted of two components: 1) a report documenting and
reviewing the County’s response to and recovery efforts since the terrorist attack (this
document); and 2) a resource document with issues and considerations gleaned from San
Bernardino County’s experience intended to assist other organizations planning for, or
responding to, similar types of incidents (further explained in the section titled “The 12/2/15
Terrorist Attack Legacy Report” below). This report is intended primarily for use by San
Bernardino County to document what actions it took and the actual or perceived effectiveness
of those actions. This report was intended to be a self-assessment process guided and
facilitated by the authors. Therefore, it was with the advantage of hindsight that County
personnel were able to identify lessons, alternate approaches, or opportunities for

5
More details on the attack and the public safety response can be found in a report commissioned by the U.S.
Department of Justice authored by The Police Foundation titled “Bringing Calm to Chaos: A critical incident review
of the San Bernardino public safety response to the December 2, 2015, terrorist shooting incident at the Inland
Regional Center” and another commissioned by the City of San Bernardino Fire Department (now part of the San
Bernardino County Fire Protection District) titled “Tactical Improvisation: After-Action/Comprehensive Analysis of
the Active Shooter Incident Response by the San Bernardino City Fire Department.”
Introduction 2
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

improvement derived from their reflections and, to a lesser extent, the observations of the
authors. Those are included in call-out boxes as appropriate and are intended for the County’s
awareness and consideration. They do not imply an error occurred or a corrective action is
necessary, but rather suggest alternate perspectives.

Assumptions
 There were no existing standards to dictate how the County, or any other organization,
should have responded under similar conditions. As a result, this report evaluates the
County’s response against its own intended outcomes. County representatives told the
authors what they hoped to achieve, how they intended to achieve it, and whether they
felt they met the objective(s). It was essentially the CPARS Team’s role to lead the
County through a self-assessment process and to create an open and effective
environment for doing so.
 This report does not focus on any one individual, program, or department, nor
individual strengths or opportunities for improvement. Rather, the report attempts to
focus on strengths and opportunities for improvement applicable across the County
organization. None of this report is intended to find fault or lay blame.
 Results found in this report are based on individual recollections of what occurred, why,
and how. The authors have attempted to present information objectively, but also
recognize individuals’ perceptions were, in many cases, just as important as reality.
Those engaged in this process were always encouraged to share their story from their
personal perspective.
 In the course of the review, where there were differing perspectives among the
stakeholders, this report attempts to capture the spectrum of recollections related to
the given topic, but does not make a determination as to which perspective or
recollection was “right” or “wrong.”
 All claims of psychological or emotional distress were assumed to be legitimate.
 Where documentation offered sufficient insight into what happened, the CPARS Team
did not reiterate those topics in interviews and may not have engaged individuals in
further discussion; assuming individuals’ recollections were clearer and more complete
when they documented them than they would have been at the time of this report’s
data collection phase (about 16 months later).
 The narratives in this report are a result of those interviewed and the documentation
reviewed as identified in this report’s bibliography and is not inclusive of every involved
department/group/individual.
 Effects of the attack were still evolving at the time of this report’s completion and some
long-term implications of the attack and the County’s response may not be known for
years, if ever. The authors have attempted to identify these situations where
appropriate and it may be necessary for annexes to be added to this report in the
future.

Methodology
This review is intended to be a useful tool for identifying the organization’s strengths and
opportunities for improvement at a certain point in time; in this case December 2, 2015 and the
days and years after that contributed to San Bernardino County’s response to the terrorist

Introduction 3
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

attack. The approach employed by the CPARS Team included passive and active research, data
gathering and interviews, feedback, and re-evaluation mechanisms. The mechanism for the
County to provide CPARS with feedback on the developing report was of particular importance
because: 1) the results of the County’s response and recovery efforts were still evolving during
the writing of this report; and 2) County personnel had equally valuable insights into the
County’s response as did the CPARS Team.

Research Phase and Work Plan Development

During the first phase of this effort, the CPARS Team reviewed hundreds of documents
provided by the County and gathered through open-source research, including after-action
reports from other organizations/disciplines, County Board of Supervisors actions, documented
recollections of events and actions, presentations, news coverage, as well as documentation
created during, or in response to, the attack (e.g., department reports, situation reports,
procurement records, unit logs/records, emails, social media postings). Initially, the CPARS
Team intended to survey all County departments/agencies regarding their experiences during
and following the terrorist attack and their perceptions regarding the County’s performance as
a whole. However, with great foresight, the County had already done so. Approximately three
months after the attack, each department was asked to document actions it took, how it was
affected, and other impacts.6 Those reflective reports proved extremely valuable to the
creation of this report.

The passive review at this phase of the effort helped the CPARS Team develop a baseline
understanding of the County’s response upon which to structure more active data gathering.
The Team then developed a strategic Work Plan identifying information gaps and proposed
strategies for addressing the gaps (i.e., who needed to be engaged, how, and when) including
the lines of questioning and topics necessary to complete the County’s story. The Work Plan
was presented to the County for review and approval and as more engagements were deemed
necessary, the Work Plan was updated and again reviewed and approved by the County.

Individual and Group Interviews

Based on the Work Plan, the CPARS Team conducted nearly 40 interview sessions with more
than 90 County staff between May and August 2017. The vast majority of sessions were
conducted in-person with a few conducted telephonically. There was a mix of group and
individual interviews depending on the topic, purpose, and need for privacy. Some individuals
participated in more than one session in order to contribute perspectives on multiple topics.
The purpose of all engagements was for participants to tell their story from their perspective so
the CPARS Team could fully and accurately document the County’s response and recovery
efforts. Because a significant amount of documentation was reviewed in preparation for these
engagements, questioning was typically very specific and intended to fill information gaps. As
many of the discussions were deeply emotional, participants were offered the involvement of
counselors from the County’s Department of Behavioral Health (DBH) if they so desired.

Data gathering focused on the most impacted departments/agencies, those most actively
involved in the County’s direct response to the incident and those indirectly involved by
6
More information on the County’s surveys is available in narrative 2.4 Management Practices and Documentation
on page 57.
Introduction 4
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

cascading impacts. This prioritization process did not preclude the CPARS Team from then
actively engaging other organizational elements as it learned more about the County’s response
and later followed the trail of relevant information.

County Employee Review and Input Workshop

As the report began to take shape, the County came to the realization many employees had
spoken with the CPARS Team, but few had formally engaged with one another to discuss their
experiences. As a result, CPARS’ contract was amended in January 2018 to have the CPARS
Team facilitate a workshop for select County employees that previously provided input via
interviews or documentation. In March 2018, the workshop was held with two objectives: 1) to
serve as a forum for identifying, considering, and discussing shared experiences and lessons
related to the incident for inclusion in this report; and 2) to identify topics of greatest interest
to other organizations for inclusion in the Legacy Report, with particular reflection on
questions/requests posed to the County in the wake of subsequent tragedies (e.g., Orlando and
Las Vegas mass shootings, North Park Elementary School shooting).

Report Development
During this phase, the CPARS Team analyzed the data and information gathered. Since the
CPARS Team was comprised of members with a wide variety of experiences and expertise,
collective discussion often resulted in better conclusions or solutions than its members would
have individually. In some cases, this team dialogue led to the re-evaluation of data/
information or additional research or data gathering.

At regular intervals, the CAO had an opportunity to review the draft narratives and provide
feedback. The integrity of the review was of utmost importance to the CPARS Team. Each
comment/question received from the County was reviewed and adjudicated by the CPARS
Team. Ultimately, and after multiple rounds of review, the completed report was provided to
the County on June 18, 2018.

Report Structure
Beyond this introductory section (Section 1), this report is organized into two primary sections:
1) a timeline of major events and actions that tells the County’s story chronologically (Section
2); and 2) a selection of narratives organized into six categories that tell the County’s story in-
depth by topic (Section 3). The timeline is intended to be a quick reference that illustrates the
momentum, magnitude, and duration of the County’s response and recovery efforts. The
entries are not intended to represent every action the County took, but rather items of
significance. Each entry in the timeline is color-coded to match the associated topical categories
and detailed narratives in Section 3 organized into the following six categories:

1) Emergency Protocols
2) Operational Response
3) Communications
4) Employee Support
5) Continuity of Operations
6) Organizational and Financial Recovery

Introduction 5
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Each individual narrative within a category in Section 3 is intended to provide a stand-alone

understanding of a topic. The authors of this report believed readers will likely review the
specific sections most applicable to their purpose and/or interests. As such, each narrative may
provide background on the County’s circumstances to put topics in context and defines
acronyms on the first use. Narratives do not, however, reiterate other narratives; though cross-
references to other narratives are provided to direct the reader’s attention to additional
information or context as necessary. Call-out boxes include additional insights, lessons,
alternate approaches, or opportunities for improvement primarily derived from the reflections
of County personnel or, to a lesser extent, the CPARS Team.

Following a brief Conclusion (Section 4), this report includes a Bibliography as an appendix.
Anonymity was essential to obtaining the unvarnished and candid input of those engaged. It
was also important in the writing of this report to maintain an organization-wide perspective
not construed as any one person’s perspective. As such, the topical/programmatic narratives
have not been written to cite their sources unless specifically necessary. Instead, a non-
attributable bibliography is provided as a record of all documents that contributed to this
review as well as the individuals interviewed, whether in group or individual settings.

The 12/2/15 Terrorist Attack Legacy Report

The County was genuinely interested in learning from its experience and, more importantly,
sharing information to strengthen the preparedness and resilience of other communities and
organizations that may be faced with, or want to prepare for, similar emergencies. On
December 2, 2015 there was no formal reference document available regarding what to
anticipate during such a situation. While San Bernardino County reached out to communities
that were previous victims of mass shootings (e.g., Newtown, CT and Aurora, CO), those
experiences did not quite mirror the scenario that faced San Bernardino.

The focus of The 12/2/15 Terrorist Attack Legacy Report is to provide best practices, lessons
learned, and considerations for other jurisdictions and organizations. The Legacy Report is not
intended to be prescriptive (i.e., telling another organization what decisions to make or actions
to take), but instead, it is intended to help them anticipate the nature and urgency of the
decisions and actions they will face. The Legacy Report presents lists of reference items to
consider before and in the midst of crisis. San Bernardino County hopes the document will
make the decision-making of others more proactive and informed, reduce elements of surprise,
and help simplify complexities associated with these horrid experiences.

For a copy of The 12/2/15 Terrorist Attack Legacy Report please visit:

http://www.sbcounty.gov/uploads/CAO/reports/December2LegacyDocument.pdf

Introduction 6
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

II. Timeline of Events and Actions

The following timeline illustrates the momentum, magnitude, and duration of the County’s
response and recovery efforts. Entries are not representative of every event that occurred or
action the County took, but rather items of significance. Each entry in the timeline is color
coordinated to the associated topical categories in Section 3, which includes detailed
narratives.
Time and/
Events/Actions Events/Actions
or Date
Wednesday 12/02/15
First reports of shots fired at the Inland
10:58
Regional Center (IRC) Conference Center.
First City of San Bernardino Police units
11:04
arrive on scene.
Triage area established at San Bernardino
11:15
Public Golf Club.
Department of Public Health (DPH) and
County Administrative Office (CAO) learn
11:20 of incident from sources on-scene. Other
departments hear through the media and
other sources.
CAO begins to receive hundreds of media
11:43
and public inquiries.
1st County/Operational Area (OA)
11:50 Emergency Operations Center (EOC)
Flash Report distributed.
Explosive Ordnance Disposal (EOD)
11:51
identifies suspicious package at IRC.
Email distributed from County Chief
12:04 Executive Officer (CEO) instructing all
County personnel to stay indoors.
County facilities begin implementing
12:05
various forms of lockdown procedures.
CAO Public Information Officer (PIO)
12:02 releases first Tweet stating the County is
monitoring the situation.
County/OA EOC is declared operational. 12:05
The media releases information that
12:08
victims are County employees.
DPH and CAO begin receiving calls from
concerned family members of employees
12:15
believed to be at the Environmental
Health Services (EHS) Division event.

Timeline Color Coding Key

Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 7
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
Human Resources (HR) and Behavioral
Health (DBH) Departments coordinate
12:30
the deployment of crisis counseling
teams to incident and support sites.
Unified Command Post with San
Bernardino Police Dept. (SBPD), County
12:38
Sheriff's Dept. (SBCSD), and Inland Valley
SWAT established at IRC.
Emergency Closed Session Meeting of
Board of Supervisors (San Bernardino and
13:00 Monterey, CA) with situation update and
waiver of BOS travel policy to facilitate
timely return of Supervisors.
Acting CEO email instructs all department
13:00
heads to return to San Bernardino.
Report of active shooter at Patton State
13:04
Hospital determined to be unfounded.
CEO email instructs department heads to
release personnel within the city of San 13:48
Bernardino not involved in the response.
13:50 2nd EOC Flash Report distributed.
Rock Church and Hernandez Community
Center selected by Incident Command
13:50
Post (ICP) for witness interviews and
reunification/release, respectively.
CAO/Coordination Conference Call with
14:00
Department Heads #1
3rd EOC Flash Report distributed. 14:20
Bomb threat reported at Loma Linda
14:45 University Hospital. Later determined
unfounded.
First shots fired during police pursuit of
15:08
suspect vehicle.
Suspect vehicle stops and gun battle
15:09
ensues approximately 1 mile from IRC.
Gun battle terminates with suspects
15:14
deceased.
Message from Board of Supervisors
Chairman distributed via Postmaster
15:22
email and Countywire blog post to all
County personnel with access.
4th EOC Flash Report distributed. 16:20

Timeline Color Coding Key

Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 8
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
After ensuring HIPAA compliance, Inland
Counties Emergency Medical Agency
16:39
(ICEMA) provides list of transported
patients to CAO.
CEO and County Supervisors who were out
 17:00
of town return to the area.
District Attorney's Office initiates State
 17:00
and Federal services for victims of crime.
Undetonated explosive devices located at
17:08
IRC.
DBH establishes a crisis hotline and
18:00 disseminates information to all
employees via HR.
Witness interviews conclude at the Rock
18:30
Church.
CAO has accounted for all but 15
18:30
personnel known to be at the IRC.
Sheriff/Coroner Division establishes
Hampton Inn in the City of Highland as a  19:00
Family Assistance Center (FAC).
Sheriff's Deputy at County Government
Center evacuates building and relocates
executives to SBCSD Headquarters to
19:30
mitigate any potential bomb threats
(perpetrator's office was located in the
building).
IRC explosive device #1 rendered safe. 19:54
SBCSD/Coroner Division establishes 24-
hour inquiry phone line and DBH
20:00
advertises locations/contact information
for crisis counseling centers.
Emergency Closed Session Meeting of
Board of Supervisors (San Bernardino, CA)
resulting in decision to close all non-
20:30 -
essential County operations on December
21:45
3rd and 4th, except EHS staff who are
approved to be off on paid leave until
12/14/15.
IRC explosive devices #2 and #3 rendered
20:37
safe.
CAO completes accounting of all 72
personnel at the EHS event. List of victims 20:40
and deceased is accurate.
20:50 5th EOC Flash Report distributed.
Timeline Color Coding Key
Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 9
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
IRC building cleared by law enforcement 21:29
and released to investigators.
Most Departments activate email and
22:00 and
phone trees to notify personnel of office
Thereafter
closures on December 3rd - 4th.
Hernandez Community Center
22:30
reunification site closes.

Thursday 12/03/15
All non-essential County functions closed
12/03/15
for the day.
County launches Victim Liaison program
modeled after a similar San Bernardino
County Fire Protection District (SBCFPD)
12/03/15
concept. First group of Victim Liaisons
assigned to families of the deceased and
the physically injured.
CAO/Coordination Conference Call with
8:30
Department Heads #2
9:00 6th EOC Flash Report distributed.
SBCSD/Coroner Division completes
positive identification of all deceased
victims. Official notification to next-of-kin
9:00
commences with Federal Bureau of
Investigation (FBI) and District Attorney
Victim Advocates.
Postmaster email and Countywire blog
10:14 post instruct all non-essential personnel
to remain home on December 3 and 4.
Board of Supervisors posts video message
of condolence to Countywire blog for all 15:15
County employees.
All notifications to the next-of-kin of
15:30
deceased victims completed.
7th EOC Flash Report distributed. 16:00
Emergency Meeting of Board of
Supervisors. Closed session to authorize
16:30 emergency procurement authorities and
expenditures to temporarily relocate EHS
personnel to alternate facilities.

Timeline Color Coding Key

Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 10
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
California Governor visits injured
19:00
survivors.
20:15 8th EOC Flash Report distributed.
CAO/Coordination Conference Call with
20:30
Department Heads #3.

Friday 12/04/15
All non-essential County functions closed
12/04/15
for the day.
Incident Command transferred from
15:30 SBPD to the FBI upon confirmation of an
act of terrorism.
County and Arrowhead United Way
establish and make public "SB United 16:25
Relief Fund" for victims and families.
County/OA EOC deactivates upon FBI
17:30
instruction and CEO consensus.
9th (final) EOC Flash Report distributed. 18:05
Real Estate "Project Team" begins
12/04/15 identifying and planning alternate
facilities for EHS relocation.

December 2015
All County offices (except the EHS Division)
12/07/15
re-open.
County enhances Sheriff’s Dept. and
contracted security presence at
12/07/15 to appropriate County facilities (e.g., at and
.
12/18/15 around the County Government Center
and DPH offices) to reassure employees
and encourage their return to work.
DBH and contracted counselors are
available at County offices for any
employees in need and in some cases will 12/07/15
continue to be on-site for months or years
to come.
County press conference features Sheriff,
County Supervisors, and ARMC
12/07/15
Emergency Department doctors treating
victims.
Timeline Color Coding Key
Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 11
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
SBCSD/Coroner Division completes all
12/07/15
victim autopsies.
Land Use Services (LUS) Department
Code Enforcement Division staff co-
located with EHS in Rancho Cucamonga
12/08/15
authorized to take the rest of the week
off with pay and return on 12/14/15 at
alternate facilities.
First CAO Post-Incident Coordination
Group meeting. Subsequent meetings held
12/08/15
weekly, bi-weekly, or monthly until
02/08/17.
HR deploys a dedicated, password-
12/08/15 protected website with resources and
information for EHS employees.
A second group of County Victim Liaisons
is created to assist employees who were
12/08/15
present during the attack, but uninjured
and other co-workers of the deceased.
12/08/15 IRC ICP demobilizes.
FBI establishes and manages a FAC. The
first day is for families of the deceased and
the injured, including a private briefing. 12/09/15 to
The subsequent days are for other victims, 12/11/15
witnesses, families, and other County
employees.
Revised return to work date of 12/21/15
12/09/15
established for EHS staff.
County Office of Emergency Services (OES)
initiates the Initial Damage Estimate (IDE)
12/09/15
and estimates initial County costs at $4.2
million.
HR issues guidelines on time reporting
during the County closure and extended
12/09/15
absence period for EHS and LUS
employees.
CEO officially Proclaims the Existence of a
12/10/15
State of Local Emergency.
First two funerals/memorials for
12/10/15
deceased victims held.
Riverside County Environmental Health
12/10/15 -
Inspectors change out 350 restaurant
12/12/15
grade cards issued by the perpetrator.

Timeline Color Coding Key

Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 12
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
Two funerals/memorials for deceased
12/11/15
victims held.
Information Services Department (ISD)
Multimedia Services Division requests to
temporarily relocate from office space 12/11/15
shared with EHS Division in County
Government Center.
12/07/15 -
All EHS offices/functions remain closed.
12/11/15
Real Estate "Project Team" and
contractors finalize alternate facilities 12/11/15 -
plans and renovate, equip, and prepare 3 12/13/15
alternate facilities over the weekend.
Four funerals/memorials for deceased
12/12/15
victims held.
One memorial service for a deceased
12/14/15
victim held.
State and regional mutual aid personnel
12/14/2015
begin to arrive to support EHS operations
-
and initiate continuity of functions at
12/18/2015
alternate facilities.
Return to work date for EHS staff updated
to 01/04/16 with paid leave expiring no 12/14/15
later than 01/11/16.
The CEO's Proclamation of a State of
Local Emergency is ratified by the Board
12/15/15
of Supervisors and re-approved every
two weeks thereafter until 08/08/17.
OES updates County costs to $13,071,735. 12/15/15
County Board of Supervisors hold a
12/15/15 Remembrance Ceremony during the
regularly scheduled Board meeting.
One memorial service for a deceased
12/15/15
victim held.
One funeral service for a deceased victim
12/18/15
held.
California Governor Proclaims a State of
12/18/15
Emergency for San Bernardino County.
President of the United States and First
12/18/15 Lady meet with the families of the
deceased.
Planning for the “County Family
12/18/15
Gathering" memorial event begins.

Timeline Color Coding Key

Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 13
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
Two funerals/memorials for deceased
12/19/15
victims held.
One funeral service for a deceased victim
12/20/15
held.
One memorial service for a deceased
12/22/15
victim held.
CEO encourages department heads to
gather and submit cost-related 12/23/15
documentation to OES.
12/23/15 "SB Strong" County logo released.
County's ad hoc "Security Task Force" is

reinstated to assess long-term security
12/30/2015
needs at County facilities.

2016
“County Family Gathering" Memorial
01/04/16
event is held.
EHS staff able to return to work begins
01/04/16
reporting for duty at alternate facilities.
End of paid leave period for EHS
personnel. Staff remaining off work must
utilize alternative compensation methods 01/11/16
(e.g., accrued leave, temporary disability,
workers' compensation).
First claim against the County filed by the
01/11/16
family of a deceased victim.
CEO memo directs departments to track
and record incident-related activities,
01/19/16
decisions, and costs for historical and cost
recovery purposes.
California Governor's Office of Emergency
Services (CalOES) conducts Applicant's
01/21/16
Briefing to initiate State and/or Federal
cost recovery efforts.
Additional claims against the County are
filed by the families of deceased victims in 01/22/16
amounts exceeding $200 million.
01/31/16 One memorial for a deceased victim held.
48 EHS staff members return to work
during January. Approximately 37 report 01/01/16 -
to work each business day on modified 01/31/16
schedules. Only 11 return full-time.
Timeline Color Coding Key
Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 14
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
Fast track hiring begins for EHS positions
01/01/16 - in January and continues through April.
01/31/16 New hires are sent to Riverside County to
receive training.
Board of Supervisors approves budget
amendment to accommodate the 03/01/16
complete renovation of EHS facilities.
Board of Supervisors approves increase in
value of existing contract with Counseling
03/01/16 Team International (CTI) to provide
ongoing emotional support and
counseling to County employees.
Board of Supervisors approves contract
with California Association of
Environmental Health Administrators
03/22/16
(CAEHA) to provide long-term EHS staffing
through 2/28/17. Contract staff begins
work at EHS the week of 3/22/16.
December 2 Permanent Memorial
Committee is formed, including victims'
03/30/16
family members, EHS employees, and
County officials.
Distribution plan for "SB United Relief
Fund" is finalized and distributions begin 04/04/16
and continue into 2017.
CAO initiates a formal effort to collect
incident documentation from
04/04/16
departments for historical and cost
recovery purposes.
After multiple rounds of review and
feedback, plans for EHS, Multimedia 04/01/16 -
Services, and Code Enforcement facility 04/30/16
renovations are finalized and approved.
EHS staff and family members of
4/20/16 &
deceased are allowed to visit former
4/25/16
workspaces before demolition.
Permanent renovations of facilities begin. 05/01/16
Board of Supervisors approves two on-
call contracts with security firms to
05/24/16
evaluate security needs and provide
recommendations for County facilities.
Autopsy Reports for deceased victims
5/27/16
released by the Sheriff/Coroner Division.

Timeline Color Coding Key

Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 15
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
Department of Justice awards $500,000
to the California Board of State and
06/28/16 Community Corrections to be distributed
to law enforcement agencies involved in
the 12/2/15 terrorist attack.
All State and regional mutual aid provided
06/30/16
to EHS permanently demobilizes.
Compared to the previous year, EHS
conducts 44% fewer plan checks and
construction inspections, 24% fewer food
12/2/15 - facility inspections, 41% fewer pool
6/30/16 inspections, 69% fewer vector control
inspections, discontinues food handler
field enforcement, and devolves other
functions to State or local agencies.
Board of Supervisors approves second
increase in value of existing contract with
Counseling Team International (CTI) to 08/23/16
provide ongoing emotional support and
counseling to County employees.
Board of Supervisors approves contract
09/13/16 extension with CAEHA to continue EHS
staffing through 12/30/17.
U.S. Department of Justice/Police
Foundation releases review of the public 09/09/16
safety response to the terrorist attack.
California Governor vetoes SB-1385,
which would have permitted the State to
reimburse San Bernardino County for up
09/25/16
to 100% of the costs associated with a
terrorist attack instead of the previous
standard of 75%.
EHS and Multimedia Services Division staff
returns to renovated facilities in the 10/03/16
County Government Center.
EHS and Code Enforcement Division staff
11/17/16 returns to renovated facilities in Rancho
Cucamonga.
The County hosts an anniversary memorial
at San Bernardino Airport for victims and 12/02/16
EHS employees.
EHS service levels improve as a result of
12/31/16 returning staff, new hires, and contractor
support, but deficits remain.
Timeline Color Coding Key
Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 16
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
2017
CAO and OES update final County cost
01/12/17
estimate to $22,600,000.
The first team of Victim Liaisons (for
family members of deceased and the
01/27/17 injured) is retired after being reduced to
14 liaisons in January 2016, 11 in June
2016, and then 4 since September 2016.
The last CAO Post-Incident Coordination
02/08/17
Group Meeting is held.
California Department of Industrial
Relations releases a review of the
02/23/17
County's handling of Workers'
Compensation claims.
Board of Supervisors approves second
contract extension with CAEHA to 05/02/17
continue EHS staffing through 12/2018.
The second team of Victim Liaisons (for
non-injured employees who were
06/05/17 present at the attack and colleagues of
the deceased) is retired after being
reduced from 29 to 8 in January 2016.
Board of Supervisors terminates the
County's Proclamation of a State of Local 08/08/17
Emergency.
Final grant agreement issued between
the California Victims Compensation
08/15/17 Board (CalVCB) and San Bernardino
County granting eligibility for $1.15
million in reimbursable costs.
Board of Supervisors approves and County
rolls out new “SB Safe” Mass Notification 09/12/17
System for Employees
California Governor signs an amended
AB-44 into law requiring nurse case
managers to support workers'
10/13/17
compensation claims following a terrorist
attack based on San Bernardino County
precedent.
California Disaster Assistance Act (CDAA)
reimburses San Bernardino County for
12/31/17
$310,215 of its original $18 million
request.
Timeline Color Coding Key
Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 17
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Time and/
Events/Actions Events/Actions
or Date
Ongoing in 2018
First round of facility security
improvements begin and second round of Ongoing in
facility security assessments by contracted 2018
on-call security firms continue.
Planning for a permanent memorial on
Ongoing in
the grounds of the County Government
2018
Center with an expected contract award.
Management of EHS personnel requests
Ongoing in
for associated leave, modified work
2018
schedules, and transfer requests.
Continued hiring, training, and promotion
Ongoing in
of EHS staff to reach necessary staffing
2018
levels.
Contracted staffing to support EHS Ongoing in
operations. 2018
Continued administration of employee
Ongoing in benefits, leave, and counseling services
2018 for employee victims and the families of
the deceased, as applicable.

Timeline Color Coding Key

Non-County Event/Incident Communications/Coordination Organizational/Financial Recovery
Emergency Protocol Employee Support
Operational Response Continuity of Operations
Timeline of Events and Actions 18
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

III. Narratives and Analysis

Category 1: Emergency Protocols
This report defines “emergency protocols” as those situations San Bernardino County faced,
and actions it took within its purview, to address imminent threats to human life, the safety and
security of personnel, and the immediate wellbeing of victims and survivors. The six narratives E
in this category explore the role County departments played in directly supporting incident M
response operations, the challenges of selecting protective measures during a quickly evolving
incident, the application of security measures, personnel dismissals and office closures, E
personnel accountability, and the care for victims’ remains and notification to their next-of-kin.
Since the terrorist attack did not take place on County property, absent from this category is a R
review of County facility Emergency Action Plans (EAPs), which would have been activated in G
the case of evacuations, fires, medical emergencies, etc.
E
1.1 Incident Support
As the introduction to this report noted, the County was both a victim and responder during the
N
terrorist attack. Although the purpose of this report is not to review the County’s tactical/public C
safety response to the incident, it is necessary and appropriate to nonetheless acknowledge the
contributions many dedicated men and women of a number of County departments and Y
agencies made to directly support the tactical/public safety response and the care or treatment
for those affected. The County’s preparedness to tactically address an incident of this size and
complexity appeared strong. No departments involved in the tactical/public safety response P
spoke of major policy or procedural changes being implemented during, or modified later, as a
result of its experiences. In addition, no significant staff turnover or staffing changes were R
reported among public safety agencies. Detailed reviews of the tactical responses can be found
in a report commissioned by the U.S. Department of Justice authored by The Police Foundation
O
titled “Bringing Calm to Chaos: A critical incident review of the San Bernardino public safety T
response to the December 2, 2015, terrorist shooting incident at the Inland Regional Center”
and another commissioned by the City of San Bernardino Fire Department (now part of the San O
Bernardino County Fire Protection District) titled “Tactical Improvisation: After-Action/
Comprehensive Analysis of the Active Shooter Incident Response by the San Bernardino City
C
Fire Department.” O
Arrowhead Regional Medical Center (ARMC) L
The ARMC, a County operated hospital, received six (6) victims of the terrorist attack. The
hospital’s medical and administrative professionals worked tirelessly to save lives and limit
S
human suffering. All six (6) victims transported to ARMC survived. The hospital also worked
with local law enforcement to maintain a safe and secure environment while still serving the
community’s normal medical needs on December 2nd and in the days after.

Behavioral Health, Department of (DBH)

The DBH oversees a program of Community Crisis Response Teams (CCRT)mobile teams of
crisis counselors who can be quickly dispatched to respond to emergencies that unfold
throughout San Bernardino County. The day of the attack, CCRT teams were deployed, along
Narratives and Analysis 19
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

with DBH management and counselors, to multiple locations including the Rock Church (law
enforcement interviews), Hernandez Community Center (reunification site), Hampton Inn
(Coroner Division Family Assistance Center [FAC]), ARMC, and Probation Department offices to
provide crisis services to victims, families, and first responders. Because of the large scale of the
event, additional DBH clinicians were called in to augment the CCRTs and by 3:00 p.m. the day
of the attack, DBH had coordinated and deployed over 100 clinical therapists and psychiatrists.
E
District Attorney’s Office
M Staff from the District Attorney’s Bureau of Victims Services deployed to both the Rock Church,
E (where law enforcement interviews with Inland Regional Center [IRC] evacuees took place) and
the Hernandez Center (where IRC evacuees were released and reunited with their loved ones).
R At those locations they provided information on services available to victims, witnesses, and
others affected by the incident (e.g., evacuees). As narrative 4.2 Victims of Crime Services on
G page 91 explains, the work of this group will continue for years after the incident.
E
Fleet Management Department
N The Fleet Management Department coordinated the ongoing provision of fuel to the incident
scenes and ancillary locations for generators and vehicles and provided portable lighting to
C those sites. The Department also deployed mechanics and provided vehicle services at those
Y sites for the convenience of public safety and investigative agencies. Once the site was cleared,
Fleet Management moved and reclaimed County-owned vehicles that had been left at the IRC
by employees present during the attack so the employees would not have to return to the site
to do so.
P
R Information Services Department (ISD)
Personnel from the ISD responded to the IRC Incident Command Post (ICP) to provide laptop
O computers, internet connectivity, and ongoing information technology (IT) assistance for the
IRC ICP throughout its operation. The ISD’s Multimedia Services Division provided law
T enforcement with images of potential victims and the presumed perpetrator from their
O database of employee identification badge photos. Access cards allowing free entry to the
County Government Center were also provided to law enforcement and the Federal Bureau of
C Investigation (FBI) to facilitate their access for the duration of their investigations.
O Inland Counties Emergency Medical Agency (ICEMA)
L Because of the proximity of ICEMA’s Department Operations Center (DOC) to the scene of the
terrorist attack, its DOC was ultimately moved to the County’s Emergency Operations Center
S (EOC). Over the course of the incident, ICEMA assisted with the coordination of resources for
emergency medical care at the scene, including a precautionary request for 3 ambulance strike
teams (15 ambulances total), and the allocation of victims to appropriate treatment centers
through its mass casualty coordination role with fire departments, private ambulance
companies, medical helicopter providers, prehospital providers, and hospitals. ICEMA
maintained awareness of hospital availability, available and committed transportation assets,
and accountability for all transported victims.

Narratives and Analysis 20

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Fire Protection District, San Bernardino County (SBCFPD)

The SBCFPD played multiple roles during the incident. As first responders, fire/rescue and
emergency medical service (EMS) personnel from the District provided mutual aid to the City of
San Bernardino Fire Department (SBFD)7 to triage, treat, and transport victims. In addition, the
County’s Office of Emergency Services (OES), housed in the SBCFPD, activated the County’s
Emergency Operations Center (EOC) within an hour of the incident and it remained operational
to coordinate information, resources, mapping, and multi-agency support until the afternoon of E
Friday, December 4th.8 On the evening of December 2nd, the SBCFPD also dispatched a Type III
Incident Management Team (IMT) with large-incident experience to support the Unified
M
Command (UC) at the IRC. The District’s IMT was later credited with facilitating the cohesion of E
response efforts among involved agencies (local to federal), improving the ICP’s application of,
and efficiency with, Incident Command System (ICS) principles, and addressing necessary ICP R
logistics (e.g., ICP resources, feeding).
G
Probation Department E
The proximity of the IRC to Probation Department facilities allowed for an immediate and
significant response of sworn probation officers to the IRC. They were some of the first law N
enforcement personnel on-scene following the City of San Bernardino and Fontana Police
Departments. Dozens of probation officers ultimately supported evacuation efforts, extraction
C
of the injured, and EMS providers with managing the triage and transportation of victims. They Y
secured the perimeter of the IRC evacuation and triage area (San Bernardino Public Golf
Course). Beyond the primary incident scene, Probation Department personnel managed the
Hernandez Center reunification site when they discovered no command structure in place upon
arrival. This involved establishing a safe area where those exiting buses into the Hernandez
P
Center were protected from the media, coordinating or providing psychological support, and R
addressing the needs of individuals with disabilities, access, and/or functional needs. For days
after the attack, Probation personnel supported security and access control at the IRC, the O
perpetrator’s City of Redlands home, ARMC, Patton State Hospital, and Loma Linda University
Medical Center.
T
O
Sheriff’s Department (SBCSD)
The Sheriff’s Department was part of the Unified Command at the IRC and provided officers in C
support of the law enforcement activities at that site, including the search for perpetrators,
evacuating and clearing the buildings, supporting the search for secondary devices, and the
O
investigation. In addition, Sheriff’s deputies were involved in the gun battle with perpetrators L
later that day and ultimately took control of that incident scene and the investigation at that
second site. S
The Sheriff’s Department played a significant role managing real-time public information
associated with the incidents. The Sheriff’s Department’s Public Affairs Unit deployed to the IRC
after being unable to reach San Bernardino Police Department’s Public Information Officer

7
The City of San Bernardino Fire Department was annexed into the San Bernardino County Fire Protection District
on July 1, 2016. Plans had already been formulated to do so prior to December 2, 2015.
8
Additional information on the County EOC is contained in narrative 2.2 on page 45.
Narratives and Analysis 21
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

(PIO). They were immediately enveloped into the ICP and established a robust structure for
media monitoring, rumor control, social media, and public inquiry. Later, the County
Administrative Office (CAO) PIOs credited much of their success to the quality and timeliness of
information being produced by the Sheriff’s Public Affairs Unit on behalf of the incidents.

Like the Probation Department, the Sheriff’s Department would also go on to support security
E and access control at the IRC, the County Government Center, the area around the gun battle,
ARMC, and Loma Linda Medical Center.
M
E Sheriff’s Department - Coroner Division
Personnel from the Coroner Division immediately responded to the IRC ICP to support fatality
R investigations and the respectful transport, identification, notification, autopsy, and release of
remains for final disposition. More information on that process can be found in narrative 1.6
G Notification of Next-of-Kin on page 37.
E
Coroner Division personnel also deployed to the Hernandez Center being used for reunification.
N Like the Probation Department described above, Coroner Division personnel trained in crisis
counseling filled a void they encountered at the site by providing counseling services and
C relevant information to those present. The Coroner Division recognized the cacophony of
Y activity at the Hernandez Center was not an appropriate place for those not yet reunited to
wait for news regarding their loved ones, including possible death notifications. As a result, the
Coroner Division coordinated with the San Manuel Band of Mission Indians, which operated a
Hampton Inn hotel on the other side of the central valley, to use that site as a quiet and secure
P waiting area. Within approximately 40 minutes, the Coroner Division had worked to secure the
R site and acquire private space and catering at no cost from the San Manuel Tribe. People at the
Hernandez Center not reunited with their loved ones were presented with the Hampton Inn as
O an option. Over the course of the night, a few families sought refuge at the Hampton Inn until
official notifications to next-of-kin were able to begin the next morning.
T
O
C
O
L
S

Narratives and Analysis 22

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

1.2 Evolution of Situational Information

In any emergency, one of the most complicating factors to response planning and operations is
the accuracy and reliability of information. This event was no exception. In the first few hours
following the attack misinformation was prevalent, posing challenges to the County’s decision-
making capabilities.

As addressed in the incident review commissioned by the U.S. Department of Justice,9 law E
enforcement was on scene within minutes of the attack. Although on scene, law enforcement M
was initially unsure of the totality of the situation as they prioritized clearing the Inland
Regional Center (IRC) complex for an active shooter and later explosives, and then began the E
manhunt for the perpetrators. As the situation evolved in the field, it impacted the quality and
accuracy of information on the civilian-side. For example, as noted in narrative 3.1 Initial R
Notification on page 67, the County Administrative Office (CAO) began receiving calls and G
emails at 11:20 a.m., initially indicating that San Bernardino County staff was not involved. Over
the course of the next 15 minutes information received directly from staff at the IRC site E
confirmed that staff was involved, but none were believed injured; and further updates later
reflected the severity of the attack and the injuries. There was also speculation for a number of N
hours to follow as to the intended targetservice providers to persons with developmental C
disabilities like the IRC, any government entity, San Bernardino County employees in general,
specifically the County’s Department of Public Health (DPH) or DPH Environmental Health Y
Services (EHS) Division, or something altogether different. In the immediate aftermath of the
attack the identities of the perpetrators were unknown so intent could not be determined.
Even after the perpetrators were identified, the motive remained unclearwas this a case of P
workplace violence, a terrorist attack, or something else? The constant evolution of information
made it difficult to assess the situation, set County-wide policies and priorities, and release R
information internally and publicly.
O
Elsewhere, it had initially been communicated in error through the news media that the attack T
had taken place at the County of San Bernardino Department of Behavioral Health (DBH), which
was located approximately one block from the IRC. Additionally, it was miscommunicated that O
the assailants, described at the time as three white males, were targeting behavioral health
sites and rumor was spreading they had attacked Patton State Hospitala state-operated
C
forensic psychiatric hospital located in San Bernardino County just a few miles from the IRC. O
This caused significant concern among staff at DBH who believed they might be the target.
Reinforcing that concern, a public safety staging area had been established by law enforcement L
in the DBH parking lot, but personnel inside the building were unaware it was a staging area
and not an active response scene to a threat at their worksite.
S
Meanwhile, the Inland Counties Emergency Medical Agency (ICEMA), whose offices are about
4,000 feet across an open golf course from the IRC, had been incorrectly informed one of the

9
Braziel, Rick, Frank Straub, George Watson, and Rod Hoops. 2016. Bringing Calm to Chaos: A Critical Incident
Review of the San Bernardino Public Safety Response to the December 2, 2015, Terrorist Shooting Incident at the
Inland Regional Center. U.S. Department of Justice, Critical Response Initiative. Washington, DC: Office of
Community Oriented Policing Services.
Narratives and Analysis 23
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

shooters was seen fleeing across the golf course in the direction of the ICEMA offices. This
caused ICEMA to evacuate its first floor and barricade doors and exits on the second floor
thinking the perpetrator was en route to that site.

Later in the day, an additional threat was reported at a nearby warehouse on the eastern
border of the City of San Bernardino where County employees called police after hearing
E gunfire at their worksiteultimately it was linked to the gun battle the perpetrators had with
M police only a short distance away. As far away as Pasadena, CA (approximately 50 miles to the
west) an unrelated police operation to apprehend a fleeing burglary suspect, occurring at about
E the same time as the San Bernardino attack, was briefly thought to be linked to San Bernardino.

R While these instances of misinformation were clarified within the first several hours, they
G illustrate the challenges the County and its departments faced planning appropriate response
and recovery operations. Some personnel were more comfortable operating in this ambiguous
E environment than others. Decisions had to be made based on the information available,
frequently re-evaluated, and adjusted as appropriate (e.g., relocations [i.e. the ICEMA
N Department Operations Center to the County Emergency Operations Center], personnel
C accountability, shelter-in-place/lockdown, staff dismissal, psychological care). Incident
management on both the civilian and public safety sides had to adapt to known misinformation
Y and non-vetted information then administer strategies and actions based on their best
judgment.

P
R
O
T
O
C
O
L
S

Narratives and Analysis 24

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

1.3 Immediate Security Measures/Lockdown

Word of a mass shooting on Waterman Avenue in the City of San Bernardino quickly spread
among County personnel, but details initially lacked specificity. As a result, most County
executives and department heads were concerned about safety but did not feel they had
enough vetted information to take further action at that time. Some County facilities within
earshot or eyeshot of the Inland Regional Center (IRC) immediately secured their sites as they
assumed there might be a threat having observed the magnitude of the public safety response. E
These included the administrative headquarters of the Inland Counties Emergency Medical M
Agency (ICEMA) and the Department of Behavioral Health (DBH), and the Americas Job Center
of California, operated by the County’s Workforce Development Department (WDD). Around E
11:30 a.m., the Sherriff’s Deputy assigned to oversee security at the County Government Center
returned to that site from a meeting accompanied by an additional Deputy. They did not R
immediately lockdown10 the building, but one deployed to the roof and the other to the parking G
lot to monitor and potentially suppress any security threat if needed.
E
The first security action disseminated to the Board of Supervisors, County executives, and
department heads was from the County Chief Executive Officer (CEO) at 12:04 p.m. instructing N
the following: C
“Due to the incident at subject location [referenced subject line: Shooting Incident at Y
Inland Regional Center on South Waterman Ave., SB], we are advising County staff stay
indoors [sic] and not leave their buildings.”
P
While the email did not specifically say “lockdown” the majority of executives and department
heads ultimately interpreted it as such, but most also commented that they initially struggled to R
determine what the notification meant (e.g., “shelter-in-place”11 versus “lockdown,” recall staff
in the field or send them home, etc.). Some departments, like Public Works, the Library O
Administration, and County Registrar interpreted the CEO’s message more as “keep employees T
inside and do not leave the premises,” as one of them stated, but did not infer that tangible
security actions were necessary. The commonality across nearly all departments was that the O
CEO’s notice triggered department heads and supervisors to account for their staff, confirm
their locations and safety, and ensure they knew of the incident and to avoid the area around C
the IRC. Beyond that, the response to this directive then varied widely among departments and O
County facilities.
L
Few facilities had someone qualified with whom to seek guidance on the topic (i.e., other than
County courthouses, law enforcement agencies, and the Arrowhead Regional Medical Center S
(ARMC), the only County building with sworn law enforcement present was the County

10
There are several definitions for the term "lockdown." A lockdown is typically an emergency protocol to prevent
people from escaping or protecting people inside a facility from a dangerous external event. A partial lockdown
typically means entryways leading outside the building are locked and people may not enter or leave the building.
A full lockdown means that people must stay where they are within the facility and may not exit or enter the
building. Lockdowns may be augmented with security personnel stationed at entries, approved entries on a case-
by-case basis, security checks by personnel making rounds, or other protocols applicable to the situation.
11
A technical term for environmentally isolating a facility from a possible contaminant in the atmosphere.
Narratives and Analysis 25
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Government Center and only a few other sites had contracted security guards qualified to
consult on the topic)).

Around noon, the Sheriff’s Department deployed a contingent of additional, heavily-armed

deputies to the County Government Center to place it under what would traditionally be
considered a partial “lockdown” in the law enforcement community. All entrances and exits
E were secured, though staff and visitors were allowed to leave but not return after leaving (with
only a few exceptions granted for staff later in the day). Likewise, the Sheriff’s Department and
M Fontana and Rialto Police Departments deployed officers to ARMC to fully secure that site and
E keep it as such for the next 24 hours. Elsewhere, administrators and facility staff did what they
felt best constituted a “lockdown” or was consistent with the CEO’s directions, the variations of
R which are captured below:
G  The campus of the County Emergency Operations Center (EOC) was secured (gates and
E entries locked) by staff and construction crews working on the street in front of the
compound were instructed to leave the area and block the street with heavy
N equipment.
C  Hearing a perpetrator was seen heading from the IRC toward its headquarters, ICEMA
locked the building entries and evacuated its first floor to the second floor and placed
Y fire extinguishers at each entrance to the second floor as potential last resort defensive
weapons.
 DBH secured the entries to the building and implemented a systematic approach for
P keeping personnel calm, monitoring the status of personnel, and conducting routine
checks of all floors and areas for security breaches. This was particularly appropriate
R since a public safety staging area had been established in the department’s parking lot;
leading staff to believe the perpetrators were at, or en route to, their location.
O  At one of the offices of the County Assessor/Recorder/Clerk, the building was locked,
T but security staff was instructed to let the public in one at a time. In a similar fashion,
the Auditor-Controller/Treasurer/Tax Collector and Department of Child Support
O Services implemented a similar form of “soft” lockdown of their facilities, securing and
positioning staff or guards at entrances, but allowing customers to enter one at a time.
C At a separate Recorder’s Office, entryways to the building were secured and the public
O was not allowed to enter.
 At the Land Use Services (LUS) Department in the County Government Center,
L customers in the building were asked to leave when the Sheriff’s lockdown took effect,
but were not given an option to stay even though a threat may have loomed outside.
S  The Department of Agricultural Weights and Measures (AWM) was hosting a state
training with attendees from across California. The meeting was adjourned and
attendees were asked to leave and were given instructions on how to exit the
immediate area while staff remained.
 The WDD and Veterans Affairs allowed clients to leave if they chose, but no one was
required to and they were assured they would be safe if they stayed with staff onsite.
 The San Bernardino County Museum had nearly 100 school children on site. Access to
the Museum campus was secured (gates and entryways locked) and the museum and
school staff entertained the children for a few hours until the school informed the
Narratives and Analysis 26
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

excursion it was safe for them to return. The children were then securely loaded into
their buses unaware of anything related to the incident.
 LUS and WDD secured their facilities as mentioned above, but also instructed staff to
stay away from windows. Staff of the San Bernardino First 5 Commission went as far as
to gather all staff in a semi-secure conference room in the center of the building similar
to a “shelter-in-place” procedure.
 DBH used its public address system to make all building occupants aware of the E
lockdown. The Department of Aging and Adult Services (DAAS) which had secured its
offices felt a public announcement would cause panic and did not use the system for
M
said purposes because formal protocols were not in place. E
 AWM and DAAS instructed all staff that was off-site to immediately return to their
offices, including ones located in the City of San Bernardino near the site of the attack. R
Meanwhile, DBH and Purchasing Department personnel not in their buildings at the
time were instructed not to return until the lockdown was lifted.
G
 Buildings inhabited by multiple departments without a common security authority often E
took different actions right next to each other. For example, at the General Services
Facility at 777 E. Rialto Avenue, the Purchasing Department and AWM locked down N
their offices, loading docks, and dismissed the public. Meanwhile, in the same building, C
the Registrar of Voters, Regional Parks Administration, and Library Administration
implemented no security precautions and did not ask visitors to leave. Y
 Multiple departments were unsure if they could permit personnel in the field to take
County vehicles home rather than requiring them to return to a potentially at risk area.
Mail couriers running routes were in limbo as Purchasing Department staff explored P
options, based on their residential addresses, for taking County vehicles home if
necessary. The Department of Public Works had similar questions regarding its staff with R
vehicles in the field. Mail couriers and public works crews were eventually allowed to
return County vehicles to their departments and retrieve personal vehicles.
O
T
At 1:48 p.m., the CEO issued another notification to the Board of Supervisors, County
executives, department heads, and executive assistants instructing staff as follows: O
“County employees in buildings within the City of SB who are not responding to the
C
incident are released from work for the remainder of the day.” O
In most facilities in the City of San Bernardino, this notification essentially ended the lockdown L
as personnel slowly left facilities and the buildings were closed. Where essential functions had
to be maintained or where word of the authorization to release personnel took longer to be
S
received (some reported as late as 4:00 p.m.) and at sites outside the City of San Bernardino,
many facilities remained in “lockdown,” just had personnel remain indoors, or maintained
heightened security levels until after the perpetrators were killed in a gun battle around 3:15
p.m. and word of that occurrence spread.

Although the known threat had been eliminated the afternoon of December 2, 2015, County
leadership felt it was necessary to at least temporarily increase law enforcement and security
presence at County buildings after the attack to encourage employees to return to work by
Narratives and Analysis 27
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

putting them at ease and ensuring offices were safe. For approximately two weeks after the
attack, San Bernardino County Sheriff’s deputies and the County’s contracted security services
significantly increased their presence and made it visible; namely at and around the County
Government Center and at Department of Public Health (DPH) facilities. Narrative 6.4 Long-
term Security on page 149 provides information on the County’s efforts beyond this short-term
augmentation to address security vulnerabilities and the expectations of employees.
E
Lockdown Procedures and Security Measures…
M
Existing Department Emergency Operations Plans (DEOPs) did not include lockdown procedures
E and no training or education on the topic had previously occurred (except at a select few
R locations). Other than courthouses, law enforcement agencies, ARMC, and ICEMA, no other
County department spoke of having plans or training associated with a lockdown. The majority
G of department heads voiced a desire for common lockdown guidance including: clear
definitions of “lockdown”; conditions warranting implementation and associated activation
E levels; specific protocols for securing premises and maintaining vigilance; instructions on
N handling staff, the public/visitors, and personnel in the field; the temporary release of County
vehicles for personal use; appropriate messaging (e.g., use of public address systems, signage,
C website messages); and actions for maintaining readiness (e.g., training, drills). The County may
find value in developing such a policy for use County-wide. If developed, future notifications
Y activating the policy should use associated defined terminology.

A separate concern was voiced by personnel in buildings staffed with contracted security
P guardsa program managed by the Sheriff’s Department. A few staff reported approaching
contracted security staff after receiving notifications about the severity of the attack asking
R what security precautions were being taken and whether a lockdown was necessary. In those
O reported cases, the security staff on duty did not feel they had the authority to make a security
policy decision and were awaiting orders on how to proceed from an outside source (it is
T unknown whether that source was in reference to a contractor/company source or a public
safety agency [i.e., Sheriff’s Department]). The recommendation was made that protocols be
O established and on-site contracted security personnel be empowered to make security policy
C decisions, such as a building lockdown, without having to await direction/ approval.

O Lastly on the topic of immediate security measures, a number of departments discussed placing
formal requests for sworn law enforcement to support building lockdowns, mostly via the
L County EOC, but none of those requests were satisfied. Not surprisingly, the resources of the
S Sheriff’s Department and many local law enforcement agencies were fully committed to the
incident response and the search for the perpetrators. In addition, some of those requests may
not have been appropriate or a judgment may have been made by law enforcement regarding
the level of risk. Nonetheless, security support is a suitable request for activating the law
enforcement mutual aid system per California’s Law Enforcement Mutual Aid Plan. Had the
perpetrators gone unaccounted for longer or the threat to government facilities been greater,
then the County, via the Sheriff’s Department (as the Operational Area Mutual Aid
Coordinator), could have requested sworn officers from outside the affected region to
temporarily support security needs at government office buildings or for other purposes.

Narratives and Analysis 28

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

1.4 Personnel Release and Office Closures

The decision to release all non-essential County employees in the City of San Bernardino for the
remainder of the day on December 2, 2015 occurred just before 2:00 p.m. The decision was
made by the Chief Executive Officer (CEO) while in remote communication with the Acting CEO
(the Assistant Executive Officer [AEO] for Finance and Administration) and upon consultation
with the Sheriff. At the time, it was unknown whether the attack was random or targeted on
County government, or whether it was the first of potentially multiple attacks in the County or E
on County government. In addition, the CEO immediately recognized the psychological and M
emotional toll on County employees once it was revealed that their peers and friends were the
victims. Citing these reasons, the CEO authorized all non-essential functions first within the City E
of San Bernardino (the seat of County government) and later throughout the County shuttered
for the remainder of the day. R
G
Notification of the closures and release of employees occurred in a number of ways. At 1:48
p.m., the CEO sent an email to the Board of Supervisors, all department heads, and the E
County’s senior executives that stated:
N
“County employees in buildings within the City of SB who are not responding to the C
incident are released from work for the remainder of the day.”
Y
Immediately following this notice at 2:00 p.m., the Acting CEO held a conference call with all
department heads to share what she knew about the status of the incident and subsequent
response actions. She included in that call direction to department heads to instruct County P
staff in the City of San Bernardino, except those responding to the event, to be sent home.
Department heads were responsible for alerting staff and closing offices as appropriate. A R
Postmaster12 email notice was sent from the Chair of the Board of Supervisors to all staff at
3:10 p.m. followed by one from the CEO at 3:24 p.m. that reinforced the closures and release of O
employees within the City of San Bernardino. A number of divisions and individuals within T
departments reported a delay in receiving this information with some entities not being
informed until as late as 4:20 p.m. As the notification was not directed as a mandate or O
emergency evacuation, alternate directives were established or interpretations made of the
notice by supervisors/directors at individual facilities or within divisions of departments. Most C
departments reported personnel leaving facilities, including the County Government Center, O
gradually over the remainder of the day.
L
The decision to close all non-essential County functions/offices throughout the County (both
within and beyond the City of San Bernardino) for the remainder of the week (until Monday S
December 7, 2015) was initiated by the CEO, but had to be approved by the Board of
Supervisors (Board). Those privy to the discussion explained that a lot of time was spent during
the Board Closed Session held at the Sheriff’s Department Headquarters between 8:30 p.m. and
9:45 p.m. mulling over the decision and the potential consequences. There was still uncertainty
at the time whether this was a lone attack or potentially the first of multiple. Closing offices
would give the County time to consider temporary security at government offices. In addition,

12
Postmaster is the name for San Bernardino County’s mass emails that are sent to all County employees.
Narratives and Analysis 29
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

around the time the Board meeting was commencing, the County Administrative Office (CAO)
was completing its accounting of county personnel that were at the event. The severity of the
attack became more evident to the decision-makers with 14 deceased county employees
(including the male perpetrator), 22 injured, and 36 other survivors. In addition, it had been
determined the perpetrator was a County employee and the colleague of the victims. The CEO,
Board, and other County executives who themselves were traumatized by the event,
E recognized that every County employee was likely sharing their sense of grief, violation,
disbelief, and fear. For those reasons, they felt it was necessary and appropriate to close non-
M essential functions throughout the County for the remainder of the week. The County’s
E leadership recognized this would be a costly decision, but felt it was the right one to make.
Ultimately, the closing of offices for those two days would account for the largest single
R expense incurred by the County associated with the terrorist attack (approximately $5 million).
G Although most County departments Understanding Essential Functions to Inform
E were closed, those required to be open Operational Decisions…
by law, offices of elected officials, and
N those necessary for public safety and As narrative 2.1 Department Emergency
welfare remained open on December 3 Operations Plans (DEOPs) on page 41 describes,
C and 4, 2015 with limited and essential most DEOPs did not include well defined essential
Y staff. County Counsel was consulted on functions, thereby requiring department heads to
make those selections at the time the decision to
what functions could not legally be
closed. Some of the offices that close non-essential operations was made.
remained open included the Department heads noted that it would have been
P Assessor/Hall of Records and County helpful to have that information in advance or for
R Clerk, District Attorney, Clerk of the it to be shared at the time. One reason cited was
so security could have been prioritized to
Board, Information Services
O Department Multimedia Services operating locations on those days (some reported
Division (to support messaging from no additional security in locations that remained
T the Board), Sheriff including the open despite the extent of the threat remaining
O Coroner (only sworn personnel), CAO, unknown and considering the comfort-level of
staff during the days after the attack). Second is
and the San Bernardino County Fire
C Protection District (County Fire). that some essential function decisions are based
on the needs of other departments/entities. For
O Notification to County employees of example, the Purchasing Department would not
L the closures on December 3rd and 4th typically consider mail service an essential
function; however, since the Courts remained
happened in a number of ways, and
S occurred throughout the night. Most open, mail service had to be maintained.
employees received notification Knowledge of what was determined essential and
through email or telephone calling what locations were operating would have been
trees from within their departments beneficial.
initiated by department heads. For
example, the AEO for Finance and Administration called or sent an email to all of the
department heads under her purview (e.g., Economic Development, Workforce Development,
Information Services, Fleet Management, Real Estate) and the Clerk of the Board, stating:

Narratives and Analysis 30

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

“Only essential staff may come to work at any county building anywhere in the county
on Thurs and Fri. It is your call who is essential. Essential would be legally required to be
open to serving the public.”

Others were informed by Twitter, Facebook and website postings issued by the Chairman of the
Board of Supervisors at about midnight on December 2, 2015. All employees later received a
Postmaster email notice sent at 10:14 a.m. December 3, 2015 stating: E
“The Board of Supervisors have asked non-essential County employees to stay home
M
today, Thursday, Dec. 3 and Friday, Dec. 4 out of respect and concern for our co-workers E
who have been impacted by the tragedy on Wednesday.”
R
Some employees, having no means to be reached during off-duty hours, did not receive the
notice and arrived at work as usual on December 3, 2015. Anticipating this possibility, many
G
department heads went to their offices to provide the notification in-person to anyone arriving E
at work that did not need to be there. At the County Government Center, for example, the
Sheriff’s Deputy assigned to the building and CAO staff, including the Chief Operating Officer N
(COO), positioned themselves at the lobby doors to instruct non-essential personnel to return
home. At approximately 7:47 a.m., the CAO’s Public Information Officer (PIO) emailed
C
department heads a sign to post in public access areas and at entryways to indicate that offices Y
would be closed for the next two business days with County libraries and museums returning to
normal operation on Saturday, December 5, 2015.

As County offices reopened on December 7, 2015, the Environmental Health Services (EHS)
P
Division was the only office that did not open. Initially, County executives in consultation with R
Department of Public Health (DPH) leadership, set a date of December 14 th for EHS staff to
return to work. As the week of December 7th wore on, it became clear EHS staff needed O
additional time for recovery. On December 9th the EHS return to work date was updated to
December 21st, and then again on December 14th it was updated to January 4, 2016 with paid
T
administrative leave expiring no later than January 11, 2016. Anyone still out after that date O
would be required to use alternative compensation (e.g., accrued leave, temporary disability,
workers’ compensation, etc.). However, EHS functions, most of which are state-mandated and C
essential, could not be discontinued during the time EHS staff was on leave. As narrative 5.2
Continuity of Essential Functions on page 121 explains, some EHS leadership, but mostly
O
personnel provided through mutual aid and volunteers, would begin reconstituting EHS L
functions as soon as December 14th at an alternate location.
S
Timing of Closure/Release Decisions…
During interviews, significant feedback emerged regarding the timing of the decision to close
non-essential offices on December 3rd and 4th; namely that it was made late in the evening on
December 2nd and could not efficiently be communicated to all County employees prior to them
arriving for work on December 3rd. Likewise, some EHS staff expressed frustration with the
changing dates for their return. The authors of this report felt that under the conditions,
especially with limited and evolving information on the gravity and extent of the impacts, and
with the significant ramifications of the decisions, County executives could not have been
Narratives and Analysis 31
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

reasonably expected to make these decisions any faster. Several other sections of this report
discuss communication challenges resulting from the December 2, 2015 terrorist attack as well
as the County’s efforts to improve and enhance its communication and employee notification
systems since.

E
M
E
R
G
E
N
C
Y

P
R
O
T
O
C
O
L
S

Narratives and Analysis 32

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

1.5 Personnel Accountability

As the incident unfolded, and it became known the attack targeted an Environmental Health
Services (EHS) Division training event, the top priority of the County became accounting for
personnel that may have been present. The planned EHS activity was intended to include about
90 personnel. With limited information coming from the scene as first responders were taking
action, the Acting CEO (the Assistant Executive Officer for Finance and Administration) directed
a multi-faceted approach to determining the identity and status of personnel at the scene. E
M
The first course of action was to obtain the expected attendance list from the Department of
Public Health (DPH). The County Administrative Office (CAO) was able to acquire the list from E
the Executive Secretary to the Director of DPH. The next action was to determine who was
actually at the eventa challenge because the sign-in sheet was in the room. As a result, staff
R
from the Human Resources (HR) Department accessed the County’s payroll system (Employee G
Management and Compensation System [EMACS]) to first ascertain who would not have been
at the event due to being on sick leave, annual leave, jury duty, or another formally excused E
absence. That part of the EMACS system is secure and has limited user access as it contains
protected personally identifiable information. Only one staff member who happened to be
N
present had such authorization. The list of potential attendees was evaluated for the first time C
following the EMACS research.
Y
From there, the accountability process came down to gathering information through one of five
options as described below. The Chief Financial Officer (CFO) was recruited to lead the CAO’s
accounting process because he was a former DPH employee familiar with the EHS staff. These P
efforts were closely supported by the Director of the HR Department and a simultaneous
accountability process being led from within DPH. R
1. Direct contact with each person that may have been in attendance.
O
Direct contact with each person that may have been in attendance at the event at the Inland T
Regional Center (IRC) was difficult because mobile phones, purses, and other personal items
were left behind in the chaos to evacuate or were instructed to be left behind by law O
enforcement. However, in some cases, the CAO team or a team at DPH Headquarters that
was working simultaneously to contact personnel, were able to directly reach survivors that
C
had evacuated, were being treated, or had been transported. When the DPH team gained O
awareness, they shared it with the CAO.
L
2. Contact with those in attendance that may have witnessed others who were in attendance
and their status.
S
This was one of the most effective avenues for gathering information on the status of those
in attendance. A few survivors that escaped with their mobile phones became a significant
conduit for information. Some of these communications went through the DPH team and
others through various contacts in the CAO (e.g., CFO, CAO Executive Assistants). To the best
of their recollection, the surviving witnesses shared who they had seen at the event, where
they thought they were at the time of the attack, who they had seen injured or deceased,
and where they had seen survivors since. While individual pieces of information were
frequently inaccurate, correlations developed as conversations were had with more people.
Narratives and Analysis 33
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Of particular help, EHS was a close-knit group with many friendships that went beyond work.
As a result, many EHS staff had personal contact information for each other as well as
contact information for spouses and loved ones of colleagues that the County would not
otherwise have had.

3. Contact with employee’s emergency contacts to determine if they had heard from a loved
E one in attendance.
Based on the information in its records, the HR Department contacted the emergency
M contacts for all personnel that were believed to be at the event with whom they or the DPH
E team had not directly spoken. In a few select cases, they were able to gather information
from emergency contacts that had reached their loved ones. In a number of cases, the
R emergency contact had not communicated with their loved one and was not able to provide
an update. In most cases, as narrative 3.2 Emergency Contacts on page 71 explains, the
G County’s central database of emergency contact information proved to be inaccurate; so
E many emergency contacts could not be reached at all. As a result, this method for
accounting for personnel was not as successful as it may have otherwise been.
N
4. Media Monitoring
C The CFO and others in the CAO watched television to see who was being shown and who
Y they recognized in media coverage of the incident. As they recognized individuals and could
ascertain their status, the accountability list was updated.

5. Information from Other Departments/Organizations

P As discussed, in parallel with the accountability effort at the CAO, the DPH leadership team
R had been creating its own list and was making calls to everyone it knew to be at the event.
As DPH became aware of the status of personnel it communicated updates to the CFO who
O was spearheading the effort for the CAO.
T Initially, the CAO tried to gather information directly from hospitals that were being reported
O as receiving patients. However, because of HIPAA13 regulations, phone calls to Loma Linda
University Medical Center (LLMC) and Arrowhead Regional Medical Center (ARMC)a
C county-operated hospitaldid not generate any useful information as only authorized
O family members are allowed to receive medical information, including the names of
admitted individuals. A request was made to the medical centers to ask families to contact
L the CAO with the status of their loved ones, but that request yielded few results.

S After ensuring there would be no violation of HIPAA, information on those transported to

hospitals would later become available through the Inland Counties Emergency Medical
Agency (ICEMA). ICEMA coordinates the transfer of patients among private and county-
operated hospitals and tracks the bed availability and diversion status of 9-1-1 receiving
hospitals round-the-clock. As such, it had an accounting of all those by name that were
transported to medical facilities. This information was provided to the CAO at 4:39 p.m. and
to the County/Operational Area Emergency Operations Center at approximately 7:35 p.m.

13
Health Insurance Portability and Accountability Act of 1996
Narratives and Analysis 34
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

It would be an all-day effort to determine and account for the 72 county employees that were
in attendance at the EHS event (including the County employee that would later prove to be the
perpetrator). Around 6:30 p.m., the CAO’s status list had accounted for all but 14 employees.
By 8:40 p.m., the CAO list was complete and accurate, accounting for County personnel as
follows:
 58 Survivors
o 22 Seriously injured and transported to local area hospitals, including 6 E
transported to Arrowhead Regional Medical Center (a county-operated hospital)
 13 Deceased Victims (not including one IRC contractor)
M
 1 Deceased Perpetrator (a County employee) E
Information Sharing Associated with Personnel Status… R
With multiple efforts ongoing to identify the status of the employees involved in the DPH/EHS G
event, information sharing between the parties could have been improved to maintain real-
time situational awareness. Specifically, the CAO’s accountability process was supported by a E
DPH team conducting outreach to staff believed to be in attendance, including through their N
family members and colleagues. DPH communicated updates to the CFO leading the CAO effort
once they became aware of the status of personnel, but similar updates were not transmitted C
to DPH when the CAO/CFO received information from other sources. This information would
have been particularly important to the DPH team to help them more accurately prioritize their Y
outreach efforts and avoid duplication of effort. On a more personal note, they felt they
deserved the courtesy of being made aware of the status of their colleagues/employees once
the information was known. The same could be said for the ICEMA list of transported victims P
(See narrative 1.6 Notification of Next-of-Kin on page 37), which after HIPAA concerns had been
addressed, was not communicated beyond the CAO or County/OA EOC which had deferred to R
the CAO. O
T
O
C
O
L
S

Narratives and Analysis 35

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

E
M
E
R
G
E
N
C This page is intentionally blank.
Y

P
R
O
T
O
C
O
L
S

Narratives and Analysis 36

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

1.6 Notification of Next-of-Kin

The San Bernardino County Sheriff’s Department Coroner Division is responsible for
investigating and determining the cause and manner of death for those who die in San
Bernardino County. By law the Coroner must investigate certain deaths, and as necessary,
autopsies are performed to determine the medical cause of death. The Coroner Division has
three (3) Board Certified Forensic Pathologists, an Anthropologist, an Odontologist, Deputy
Coroner Investigators, Autopsy Assistants, Sheriff's Service Specialists, clerical staff, and an E
Indigent Burial Specialist. The Coroner Division also employs a Volunteer Unit to support M
operations as appropriate. Deputy Coroner Investigators gather the facts of the death, collect
evidence for presentation in a court of law, and are responsible for providing next-of-kin E
notifications. The Coroner Division has offices and investigative locations in the City of San
Bernardino and Victorville. R
G
On December 2, 2015, the Commander of the Coroner Division was advised of the incident
directly via telephone from the Sheriff. Upon notification, the Commander immediately advised E
Sheriff’s Coroner staff and both the Commander of the Division and the Lead Supervisor
established a presence at the Inland Regional Center (IRC) Incident Command Post (ICP), which N
facilitated communication and expedited decedent operations. Once staff was made aware of C
the incident and its implications, they chose to cancel vacations/leave and report for duty,
including one Forensic Investigator who immediately returned from vacation in Southeast Asia. Y
As every Wednesday is a “swing shift” where two shifts temporarily overlap as one replaces the
other, on December 2, 2015, the full contingent of Coroner Division staff was present at the P
Main Office in the City of San Bernardino. The Commander of the Division quickly established
the top priority as victim identification for the purposes of next-of-kin notification, followed R
closely by expedited autopsies. All available professional staff and investigators were engaged
in this process guided by established protocols. Processes were not changed in the O
performance of duties, however, all staff members committed to the enhanced degree of T
urgency as they do with all large, complex, and sensitive matters of similar magnitude.
O
Although the County has a mass fatality plan, the plan only differs from standard response
practices when the number of required identifications/autopsies exceeds the County’s C
capabilities and identifies when outside resources are required. In the case of the December 2, O
2015 terrorist attack, the Sheriff’s Coroner Division had sufficient resources to complete
investigation, identification, and autopsy processes for the 14 deceased victims and two L
deceased perpetrators in a timely manner. Therefore, the only parts of the mass fatality plan
that were activated were those addressing the need for increased and proactive public S
information and expanded next-of-kin notification.

As the day unfolded on December 2, 2015, the Sheriff’s Coroner staff performed a number of
activities simultaneously. First, once the IRC was declared safe, the Deputy Coroner
Investigators began to investigate the scene. Two Forensic Pathologists were also deployed to
the scene. After on scene investigations were completed, the Sheriff’s Coroner’s professional
Autopsy Assistants transported the remains throughout the night to the Coroner’s facility in the
City of San Bernardino. To do so, Sheriff’s Coroner staff used nondescript Coroner Division vans
Narratives and Analysis 37
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

rather than typical contracted transportation services. The Commander of the Division was
concerned contract service vehicles would be too easily identified by the media/public. He
wanted to ensure utmost privacy/confidentiality by keeping all efforts internal to Division staff
out of respect for the victims, citing prior experience when a photo of the remains of
Christopher Dorner was leaked to the media in 2013.

E In parallel, as families were gathering at the Hernandez Community Center to be reunited with
IRC evacuees, Sheriff’s Coroner staff established a presence there to advise and counsel families
M awaiting the arrival of evacuees coming from witness interviews at the Rock Church. Coroner
E Division staff and investigators were deployed by the Division Commander without a formal
request from the IRC ICP. Each Coroner’s Division staff member has a minimum of 80 hours of
R crisis and grievance counseling training and countless hours of real-world experience. As a
result, the Division Commander knew such support would be required and it turned out a
G similar resource was not being provided to families at the Hernandez Community Center. At
E that point, the Coroner Division staff had no additional information as to who was transported
to local hospitals, who was among the deceased victims, or who had been accounted for
N through other means. Therefore, the Coroner Division staff felt it necessary to prepare all
remaining families for the worst-case scenario. For more information, see narrative 1.5
C Personnel Accountability on page 33.
Y
While at the Hernandez Community Center, it became obvious to the Coroner Division staff
that official communication with the families with respect to next-of-kin notification could not
be respectfully performed at that location. The Hernandez Center was inundated with media,
P had a significant lack of security, no privacy, and no other personal care amenities. Once
R realized, the Coroner Division staff and Division Commander began working with the Sheriff’s
Public Affairs Unit to establish a separate Family Assistance Center (FAC). Through the
O generosity of the San Manuel Band of Mission Indians, the Hampton Inn (about 10 miles away
from the IRC and other incident activities) was secured. Unfortunately, once the last buses
T arrived at the Hernandez Community Center, families did not seem interested in going to yet
O another facility to await further notifications. In addition, the media had already begun to
report on possible fatalities and some families essentially knew the terrible news already. As a
C result, only a handful of family members briefly visited the Hampton Inn FAC during its
operation. For more information about operations at this facility, see narrative 1.1 Incident
O Support on page 19.
L
Although the Coroner Division staff provided immediate counseling support at the Hernandez
S Community Center and Hampton Inn, it was understood their first priority was positive victim
identification. The Coroner Division staff worked through the night on December 2nd to
positively identify all victims. What made the process emotionally difficult for many staff was
that those being identified were fellow County employees and Coroner staff had now closely
interacted with many of the victim’s families at the Hernandez Community Center and
Hampton Inn and could associate the deceased with their grieving loved ones. Typically, any
engagement between the Coroner’s staff and loved ones is at arm’s length, at best, prior to
next-of-kin notification. The Coroner Division staff persevered through these emotional
challenges and by 9:00 a.m. on December 3rd, all positive identifications of victims had been

Narratives and Analysis 38

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

made and Deputy Coroner Investigators were assembling to begin notifications. The start of
next-of-kin notifications was delayed by about an hour as the Federal Bureau of Investigation
(FBI) insisted that notification not be done without the FBI Victim Assistance Team even though
the San Bernardino District Attorney (DA) Victim Advocates were ready to accompany Coroner
Division staff. Once the FBI Team arrived, they joined the Coroner Division Deputy Coroner
Investigators in conducting in-person notifications.
E
The procedure for the notification of next-of-kin in San Bernardino County is well established
and steeped in tradition. Deputy Coroner Investigators are specifically trained to make such
M
notifications and do so personally, making face-to-face contact with victim’s loved ones, and E
providing information on available services and next steps. This procedure was not altered for
this event. All next-of-kin notifications were completed by mid-afternoon on December 3rd. R
Once completed, the Division Commander used Twitter to notify the public and media that
notifications were complete. As notifications were being made, a number of families expressed
G
to Coroner Division staff that they had wished the notification had been done by telephone to E
expedite the process.
N
Once positive identification of victims was completed, the equally important priority of
expedited autopsies began. Again, no processes were changed or altered in the performance of
C
the autopsies, but the intent to expedite was elevated. Initially to facilitate this process, as Y
previously noted, two Forensic Pathologists were dispatched to the IRC while other
investigations were still being performed. This was followed by the implementation of 12-hour
rotating shifts at the Coroner Division. In total, 14 victim autopsies were completed by
December 7th. The two perpetrators’ autopsies were completed on December 8th.
P
R
Throughout the entire process, the Coroner Division paid close attention to media reporting
and public information. Even six (6) months after the attack (May 27, 2016), as official autopsy O
reports were being readied for release, great care was taken to ensure confidentiality, quality
and consistency amongst the reports, and respect for the victim’s families. The Division worked
T
closely with the Sheriff’s Public Affairs Unit during this time to provide accurate and timely O
information about the autopsy report process to the victim’s families. As a matter of practice,
all public information releases, were preceded by advance notice to the victim’s loved ones C
with respect to the content and timing of the reports. Some families chose to receive copies of
the report and others did not. Under the California Public Records Act, all autopsy reports are
O
available to the public upon request and the media had already requested copies well in L
advance of their completion.
S
Notification Processes and Coroner Communications…
Although both victim identification and autopsies were expedited, additional information
sharing across San Bernardino County could have further facilitated many processes, including
the Coroner’s positive identification and next-of-kin notification. For example, the Inland
Counties Emergency Medical Agency (ICEMA) had developed a list of injured victims
transported to hospitals. At the same time, the County Administrative Office (CAO) and
Department of Public Health (DPH) had been working to account for all personnel at the
incident. This information, which had been accumulated by the CAO, was not shared with the
Narratives and Analysis 39
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Coroner Division. Because the information had been shared with the CAO, originating parties
did not share it through typical channels/protocols assuming the CAO would do so. This
information could have informed and facilitated the Coroner’s identification and notification
process as well as further informed how loved ones were addressed at the Hernandez
Community Center and Hampton Inn.

E Coroner Division staff revealed that, although current protocols and tradition demand next-of-
kin notification be done in person, they will reconsider this long-standing protocol with respect
M to the speed at which information is shared in the modern age. Typically, the Coroner Division
E staff has some contact with the families of victims or potential victims prior to the official next-
of-kin notification. This presents an opportunity to potentially query families about their
R preference for receiving notifications (e.g., in-person, via telephone, or other means). At the
time of this report, the Coroner Division was expanding its notification protocol to allow
G families to state their communication preferences at initial engagements. In a County as
E geographically large as San Bernardino, this could also help to reduce delays caused by
distances that have to be traveled to make in-person notifications. Had this protocol existed at
N the time of the terrorist attack and had families communicated a preference for telephonic
notification, the Coroner Division acknowledged next-of-kin notifications could have occurred
C as much as six hours sooner.
Y
Finally, Coroner Division staff indicated that for an event of this type, where Coroner resources
are being actively engaged in response (rather than recovery) operations, a Coroner Division
representative should be present in the County/Operational Area (OA) Emergency Operations
P Center (EOC). A Coroner Division representative could facilitate timely situational and
R operational information exchange to benefit coroner operations as well as the entire operation.
Current protocols have information being relayed to the Coroner Division by either an overall
O Sheriff’s Department representative at the County/OA EOC or via the Sheriff’s Department
Operations Center (DOC).
T
O
C
O
L
S

Narratives and Analysis 40

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Category 2: Operational Response

Closely related to the County’s emergency protocols, “operational response” is defined in this
report as the actions and resources employed by the County to manage crises, enable
necessary emergency actions, and facilitate and position the County toward recovery. The six
narratives in this category describe the role each County department’s pre-existing emergency
plans played in the response to, and recovery from, the terrorist attack, including efforts to O
continue essential operations. In addition, it explores the role of the County’s Emergency
Operations Center (EOC) in the coordination of policies, tasks, information, and resources to P
support incident operations and recovery, and similar management practices used across
departments to strategically select objectives, assign tasks, document activities, and monitor
E
progress. The County’s Proclamation of a State of Local Emergency, addressed in this section, R
enabled emergency authorities and triggered programmatic eligibility, including emergency
procurement and State or Federal reimbursement, among other provisions to aid recovery. A A
critical element to facilitating both the County’s and community’s emotional recovery was a
need to eliminate the work-related vestiges of the perpetrator as explored in this section. While
T
emergency protocols were mostly retired within a few days of December 2, 2015once the I
threat was eliminated, personnel were accounted for, and the County had addressed its
responsibility to the remains of the victimsthe operational response actions that helped O
empower the County’s journey toward recovery continued for months and years.
N
2.1 Department Emergency Operations Plans (DEOPs) A
Each County department is required to develop and maintain a Department Emergency
Operations Plan (DEOP). Per the County DEOP template, the plans are intended to serve two L
purposes: 1) provide guidance and procedures in preparation for, and response to, significant
natural, environmental or conflict-related risks/events to protect life and property, preserve
infrastructure, and facilitate coordinated response; and 2) ensure the continued operation of R
government services. The program is administered by the County Office of Emergency Services
(OES). The OES develops DEOP templates to aid departments in the development of their plans, E
provides guidance and recommendations on DEOP content, issues notices to departments to
update plans, and archives copies of plans to ensure departments have completed the task.
S
P
This report’s documentation process included the review of the OES DEOP template, interviews
with OES staff regarding program administration, interviews with County department and O
division leadership regarding use of the DEOPs during and following the December 2, 2015
terrorist attack, and the review of 42 DEOPs in effect as of the date of the attack; most
N
belonging to departments and some belonging to larger divisions of departments. S
DEOP Template E
At the time of this report’s publication, the OES was in the process of revising the County’s
DEOP template and had intentions to issue a new version in 2018. This review is based on the
template in circulation on December 2, 2015. As it relates to the DEOP’s first goal (provide
guidance and procedures…to protect life and property, preserve infrastructure, and facilitate
coordinated response) the authors of this report determined the template’s strengths were
more toward facilitating coordinated response than the protection of life and property or

Narratives and Analysis 41

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

preservation of infrastructure. For example, the DEOP template provided clear descriptions of
expected coordination between departments and the County Emergency Operations Center
(EOC), the establishment of Department Operations Centers (DOCs) to facilitate internal
coordination, and prompts to identify interdependencies and contact information for external
stakeholders. While the template provided references to some emergency protocols (e.g.,
protecting life and safety, accounting for personnel, providing for evacuation needs) it did not
O provide guidance on how to do so or what constitutes a sufficient strategy. The template
P included only placeholders to “[i]ndicate here how the department will respond to an
emergency.” Departments may be in need of greater guidance and specific prompts to ensure
E all emergency protocols are addressed. The San Bernardino County Fire Protection District
(SBCFPD) DEOP, for example, included a set of emergency protocol annexes addressing fire,
R earthquake, evacuation, and bomb threat procedures. Similar annexes or examples thereof
A were not included in the DEOP template and as a result were not found in other DEOPs. Similar
annexes or prompts could have had benefit during the December 2, 2015 terrorist attack;
T namely ones related to lockdown procedures and personnel accounting.14

I As it relates to the DEOP template’s second objective (ensure the continued operation of
O government services), the template is not fully compliant with any domestic or international
continuity standards, including:
N  Federal Emergency Management Agency Continuity Guidance Circular (CGC): the
A domestic public sector standard.
 Disaster Recovery Institute (DRI) International 10 Professional Practices: the domestic
L private sector standard.
 International Standards Organization (ISO) 22301 “Societal Security - Business Continuity
Management Systems - Requirements”: the international private sector standard.
R
The template provides good prompts and guidance for addressing some of the critical elements
E of a continuity plan, including identification of essential functions, essential personnel,
alternate facilities, orders of succession, delegations of authority, vital records, and alternate
S communications. However, the template’s detail in those areas may not have been sufficient to
P facilitate the selection and implementation of appropriate continuity strategies. For example,
the template does not include the identification of recovery point and time objectives15
O (RPOs/RTOs) associated with each essential function (something critical to all elements of
continuity planning), the personnel and resources that would be needed to achieve the RPOs
N and RTOs, succession or continuity strategies for essential personnel beyond the administrative
S executive, continuity strategies for essential functions beyond relocation (e.g., devolution of
control, alternate processes, alternate personnel, etc.), and others. A few DEOPs which
E appeared to be built on an older template did have prompts for identifying whether a function

14
See narrative 1.3 Immediate Security Measures/Lockdown on page 25 for more information on the
implementation of lockdown procedures following the attack.
15
Recovery Time Objective is the duration of time within which a business process must be restored to avoid
exceeding the entity’s risk tolerance associated with a break in business continuity and Recovery Point Objective is
the degree or service level to which the business process must be restored to avoid the same unacceptable
consequences.
Narratives and Analysis 42
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

is “deferrable,” which may have previously been an attempt to categorize the RTO and others
identified minimum personnel requirements, which may have been a way of previously
attempting to define the RPO. It appears various continuity elements have existed in the DEOP
template at different times, but all the elements needed for a robust continuity capability, per
the aforementioned standards, have not been addressed in the template.

Department Compliance O
Of the 42 DEOPs reviewed, there were widespread differences in quality, content, and
approach. Although the DEOP template in use at the time of the attack presented opportunities
P
for improvement as described above, experienced emergency and/or continuity planners could E
have likely interpreted the template’s purpose and prompts to create a fairly effective plan. In
many cases, however, it appears departments applied minimal effort to populating and R
implementing their associated DEOP. In the majority of cases the following applied:
 Where the OES had provided examples of content and strategies and then instructed
A
that each section “…be tailored for each Department,” the vast majority of departments T
did not tailor the content and left the template as is resulting in in-actionable and non-
specific information for the department. I
 The majority of departments left in their DEOP only the emergency protocol examples O
provided as essential functions in the template (e.g., account for personnel, perform
damage assessments, support building evacuation needs), but did not look beyond N
those to consider essential functions associated with their department’s mission or in
some cases the essential functions were just a restatement of the department’s mission. A
Both significantly reduce the applicability of the plan to real continuity events.
 Most plans illustrated an approach that assumed, when the plan was activated, the
L
department would be supporting the community during an emergency, but the
emergency would have minimal effect on the department, thereby assuming most
department resources, facilities, or processes would be unaffected and available for use. R
The December 2, 2015 terrorist attack is perhaps the best example of the need for
continuity capabilities when the department is the victim, not the community.
E
 Continuity strategies in most plans were essentially “plans for plans” in that the actual S
tactics for achieving continuity were not captured in the DEOP, but rather statements of
department intent to take some later action or make an assignment in hopes of later P
selecting the tactics. O
 Alternate facilities were generally listed as the department’s other facilities without
consideration for capacity, capability, or proximity and likelihood to experience the N
same emergency as the principal facility.
 There was no evidence in any DEOP that action had been taken to make the plan
S
implementable. For example, if the plan stated the department would create E
emergency kits for personnel, there was no associated information on the content of
those kits, where they’re kept, or how often they’re updated. If the department
identified alternate facilities, there was no information on the pre-positioning of
resources, the allocation of space, the execution of usage agreements, etc.

There were, of course, multiple exceptions to each of the above concerns. For example, the
Transitional Assistance Department assigned an order of use to its alternate facilities for each
Narratives and Analysis 43
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

principal site; Arrowhead Regional Medical Center included a comprehensive list of essential
functions (emergency and mission critical); the Auditor/Controller/Treasurer included lists of
resources and equipment associated with each essential function; and other plans exhibited
different areas of strength. However, no department had a comprehensive or fully customized
plan that would warrant complete confidence in the department’s ability to respond or sustain
its own operations. One reason for this may be that the OES did not previously review each
O DEOP for quality or compliance and provide feedback.
P DEOP Implementation on December 2, 2015
E One could assume the DEOPs would be widely referenced during the December 2, 2015
terrorist attack. First when departments were attempting to lockdown facilities and later when
R departments were instructed to shutter all but mission-essential operations from the afternoon
A of December 2nd through Friday, December 4th. Most department heads never referenced their
respective DEOP during or in the days after the attack. All department heads engaged during
T this review process were aware of the existence of their respective DEOPs, but the vast
majority did not find value in the DEOP for the situation in question. Those results were not
I unexpected as the review of DEOPs above confirmed that most either did not include
O information relevant to the situation (e.g., lockdown procedures) or were not developed well
enough to offer significant value (e.g., identification of essential functions and minimum
N staffing levels to inform the release of non-essential personnel). Most of the department heads
that referenced the DEOP on that day stated using it for the emergency contact lists (i.e., staff
A calling trees) contained within.
L Improving DEOPs…
At the time of this report, the OES had identified updates required for the DEOP template and
R was in the process of implementing them. The updates were not shared with the authors of this
report. As this narrative alludes, some suggested improvements may include providing more
E specific prompts for the inclusion of information, suggested strategies and/or approaches for
both emergency protocol and continuity responsibilities, and compliance with a national or
S international continuity standard.
P On the compliance front, the County may want to consider applying additional resources to
O provide greater coaching during the DEOP development/revision process as well as time to
audit and provide feedback on submitted DEOPs (e.g., OES, County Safety Committee). In
N addition, the Office of Emergency Services (OES) may need to be further empowered to enforce
S complianceconfirming departments not only submit updated DEOPs, but submit ones of
sufficient quality with evidence of implementation to impart confidence in department abilities
E to respond to emergencies and sustain government operations.

Narratives and Analysis 44

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

2.2 County Emergency Operations Center (EOC)

San Bernardino County’s Emergency Operations Center (EOC) is administered by the San
Bernardino County Fire Protection District (SBCFPD; more commonly referred to as “County
Fire”). The SBCFPD is a separate legal entity from the County, but the County Board of
Supervisors serves as its Board of Directors. The Office of Emergency Services (OES), created by
San Bernardino County Code of Ordinances Division 1, Chapter 1, §21.0103, manages the
County EOC per §21.0104 of the same ordinance. The County’s Chief Executive Officer (CEO) is O
the County’s Director of Emergency Services. The OES is organizationally housed in the SBCFPD P
and reports to the SBCFPD Fire Chief on a daily basis, but serves a County-wide purpose
described below. The Manager of OES (Emergency Services Manager [ESM]) oversees the OES, E
the County EOC, and is responsible for carrying out the responsibilities of the OES on a daily
basis. The ESM assists the Director of Emergency Services in implementing the emergency plans R
and capabilities of the County. A
The OES is responsible for coordinating and supporting county-wide mitigation, emergency T
preparedness, response support, and recovery efforts. The County EOC also serves as the
Operational Area (OA) EOC in accordance with California’s Standardized Emergency I
Management System (SEMS). As such, the County/OA EOC serves as an intermediary level of O
government/emergency management responsible for facilitating communications, inter-agency
coordination, priorities, county-level and inter-agency/municipality policies, and managing N
information and resources among County departments/agencies, unincorporated areas of the
County, twenty-four (24) incorporated cities in the County, special districts, tribal governments, A
and other political subdivisions within the geographic boundaries of San Bernardino County. L
The County/OA EOC is located in a building complex in the City of Rialto that also houses
dispatch, communications, and other functions. The County’s alternate EOC is located in a
County facility in the City of Hesperia.
R
On December 2, 2015 approximately thirty (30) first responders from various agencies E
(including six [6] from the City of San Bernardino Police Department [SBPD] Special Weapons
and Tactics [SWAT] Unit and two [2] County Fire Battalion Chiefs) were at the OES building for a S
“Terrorism II-Domestic Terrorism” Course being conducted by the California Specialized
Training Institute (CSTI); a division of the California Governor’s Office of Emergency Services P
(CalOES). At approximately 11:10 a.m., SBPD SWAT Officers and County Fire personnel were O
alerted to the incident through their respective dispatches, which triggered their mobilization
to the incident scene. As they departed, they advised OES staff there was an active shooter N
incident in the City of San Bernardino at the Department of Motor Vehicles (DMV)soon after
clarified to be the Inland Regional Center (IRC)with about twenty (20) people down.
S
E
The OES Duty Officer (DO) contacted the OES Assistant Emergency Services Manager (AESM)
who was attending training in Orange County. The AESM instructed the DO to confirm the facts,
especially the number of people reported down. Within five minutes, the DO advised the
incident was actually at the IRC building but the number of people affected remained the same.
By this time the OES ESM had been contacted and was on his way to the County/OA EOC from a
meeting in Riverside, CA.

Narratives and Analysis 45

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

The County/OA EOC has a unique relationship with the City of San Bernardino. Traditionally
under California’s SEMS, municipal emergency management organizations, and their respective
EOCs, are responsible for facilitating city-level emergency management and support to field
operations. They in turn coordinate and seek support from the OA EOC, which facilitates efforts
among all political subdivisions within the geographic boundaries of the County. During the City
of San Bernardino’s bankruptcy (August 2012 to June 2017), the City reached an agreement
O with SBCFPD for OES to provide emergency support during incidents and Emergency Services
P Officers (ESOs) on a task-by-task basis for preparedness efforts, funded by a portion of the
City’s Emergency Management Performance Grant (EMPG) award. At the time of the incident,
E the City had only one (1) Sergeant in the Police Department tasked with emergency
management. At approximately 12:00 p.m. on December 2, 2015 that Sergeant, the lone
R administrator for the City of San Bernardino’s EOC, was named Deputy Incident Commander
A (IC) at the IRC Incident Command Post (ICP). County OES management immediately knew the
City of San Bernardino was not in a position to activate its EOC.
T
For that and other required reasons under SEMS, the County/OA EOC was activated and
I officially became operational at 12:05 p.m. An OES Emergency Services Officer (ESO) ordered a
O lockdown of the County/OA EOC compound and instructed construction crews working on the
street in front of the compound to leave the area and block the street with heavy equipment.
N At approximately 12:20 p.m., and upon learning the incident scene was safe enough for a
liaison to be deployed, the County/OA EOC deployed an EOC Liaison to the IRC ICP. This was a
A practice regularly used by OES during County-led or SBCFPD-led response efforts. The EOC
L Liaison integrated into the ICP as an Agency Representative. The liaison proved invaluable for
facilitating information sharing and resource requests between the ICP and County/OA EOC and
for providing assistance to the ICP with its application of Incident Command System (ICS)
principles. Similar liaisons from OES would later be deployed to the Coroner’s Family Assistance
R Center (FAC) at the Hampton Inn, the Hernandez Community Center where reunification took
E place, and the Federal Bureau of Investigation’s (FBI’s) FAC established the following week at
the National Orange Show. For more information on those incident operations, see narrative
S 1.1 Incident Support on page 19.

P Aiding the County/OA EOC with information gathering was its access to the Computer Aided
O Dispatch (CAD) system used by the majority of response entities in San Bernardino County with
the exception of the City of San Bernardino and the California Department of Forestry and Fire
N Protection (CAL FIRE). The OES DO first accessed the CAD system at approximately 11:12 a.m.
when she was notified of the incident, and from that point forward, including after the EOC’s
S activation, OES and EOC staff was able to monitor the multiple incidents throughout the County
E (e.g., IRC, Redlands, Waterman Ave. gun battle) and their progression in real time. This is a
protocol employed by the OES on a daily basis.

During its activation, the County/OA EOC served a dual purpose as traditional County/OA EOC
(supporting County government response efforts and all political subdivisions within the
geographic county) and municipal EOC (providing direct support to the City of San Bernardino
ICP/field responders), compared to the City of Redlands, for example, that activated its EOC
only to support the ICP associated with activities at the perpetrators’ Redlands’ residence. At

Narratives and Analysis 46

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

the County/OA EOC, agency representatives from the Sheriff’s Department, Inland Counties
Emergency Medical Agency (ICEMA), Department of Behavioral Health (DBH), and CalOES were
mobilized to fill necessary positions. During its two and half day activation, an average of 26
personnel staffed the EOC each day. Four of those individuals were from ICEMA, which
relocated its Department Operations Center (DOC) functions from its primary location to the
Medical and Health Branch in the County/OA EOC due to the proximity of the primary site to
the active incident scene (just over half a mile west of the IRC across the San Bernardino Public O
Golf Course).
P
County leadership that convened at the County Government Center, and at one point the E
Sheriff’s Department Headquarters (i.e., the Assistant Executive Officer [AEO] for Finance and
Administration later transitioning to the Chief Executive Officer [CEO]) serve as the Policy Group R
for the County/OA EOC. When activated, the County/OA EOC reports directly to County CEO as
Director of Emergency Services. During this incident, the EOC and County leadership were less
A
integrated than they typically have been during historical incidents per interviewed T
stakeholders (discussed further in the call-out box beginning on page 49). Other than
coordinating eight Coordination Conference Calls (also referred to as CAO Conference Calls), I
there was little substantive connection between the County OA/EOC and its Policy Group. In
San Bernardino County, the EOC has not traditionally provided input on county-level policies or
O
continuity strategies as is the norm in much of California. N
The Coordination Conference Calls logistically managed by the EOC were primarily used to A
communicate executive policies and directives rather than facilitate coordination and solicit
discussiontypically the role an EOC plays. The calls were successful at getting necessary
L
stakeholders together with little notice to hear instructions from County leadership. However,
because access to Coordination Conference Calls could not be securely controlled, the
information shared on the calls was watered down. R
The EOC issued its first Flash Report at 11:45 a.m., which provided information on road closures
E
and areas to avoid. The EOC Flash Reports are intended to provide concise, non-restricted, and S
actionable information to a broad audience (a few hundred stakeholders throughout San
Bernardino County receive the Flash Reports, including elected officials, county departments/ P
agencies, city, tribal government, and special district representatives, critical infrastructure
owner/operators, appropriate State and Federal partners, etc.). Flash Reports are not intended
O
to serve as a comprehensive/detailed Situation Report (referred to in San Bernardino County as N
a Situation Summary Reportnone of which were issued during its activation for the December
2, 2015 terrorist attack). Over the course of its activation, the EOC distributed eight additional S
Flash Reports as follows:
 (2) 1:50 p.m. (12/2/15)  Identified EOC and Department Operations Center (DOC)
E
activations, school districts under lockdown, road closures and transportation system
stoppages, addressed misinformation related to Patton State Hospital, and provided
public and media inquiry points of contact.
 (3) 2:20 p.m. (12/2/15)  Corrected the media point of contact phone number from the
previous Flash Report.

Narratives and Analysis 47

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

 (4) 4:20 p.m. (12/2/15)  Identified the estimated number of deceased and injured, EOC
and County DOC activations, government office closures and lockdowns, the Hampton
Inn reunification center, event cancelations by the City of Fontana, instructions for
accessing resources via the County/OA EOC, and an expanded list of public and media
inquiry points of contact.
 (5) 8:50 p.m. (12/2/15)  Updated estimates of the number of deceased and injured,
O updated reunification information to include the Hernandez Community Center,
P provided press conference information, City EOC status levels, and crisis counseling
locations and points of contact.
E  (6) 9:00 a.m. (12/3/15)  Updated estimates of the number of deceased and injured,
identified Incident Management Team (IMT) deployment to the IRC ICP, updated the
R status of road closures, City EOC activation levels, provided a Coroner Division public
A inquiry phone number, and a list of complete and partial closures of County
departments.
T  (7) 4:00 p.m. (12/3/15)  Updated road closures and County department closures,
provided additional crisis counseling locations and points of contact, expanded public
I inquiry contact numbers, directed readers to victim/witness resources from the District
O Attorney’s Office, and provided vigil event information.
 (8) 8:15 p.m. (12/3/15)  Updated the status of City EOC and County DOC activations,
N provided information on the United Way Relief Fund, and updates regarding the
incident scene in the City of Redlands.
A  (9) 6:05 p.m. (12/4/15)  Provided a brief summary of actions taken by the County/OA
L EOC and other County departments, the status of the County/OA EOC and County DOC
deactivations, a cautionary message regarding hoaxes/conspiracy theories/rumors, and
a status of County government re-openings.
R Over the course of its activation, the County/OA EOC also coordinated the following resources
E in support of field operations. Unless otherwise noted, the resources/services were provided by
County departments or existing contracts through County departments. All requests were filled
S within the OA and none were elevated to the CalOES Southern Region.
 Canteen service for the Hernandez Community Center reunification operation provided
P by the American Red Cross (ARC).
O  County Fire Incident Management Team (IMT) deployed to the IRC ICP.
 Mapping support to the IRC ICP.
N  Portable lighting for the incident location and IRC ICP.
S  Fuel for generators and vehicles.
 Mechanics and vehicle services.
E  Laptop computers for the IRC ICP.
 Internet connectivity and information technology (IT) support for the IRC ICP.

The County/OA EOC uses a web-based emergency management information system, which
runs on County Information Services Department (ISD) infrastructure. After the attack, ISD
bandwidth was taxed during the incident because of the number of people trying to stream
incident coverage over its network. As a result, the EOC’s use of the web-based system to

Narratives and Analysis 48

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

gather, manage, and disseminate information and facilitate resource requests was dramatically
reduced. Per OES staff, this was the first time in memory they recall the otherwise reliable ISD
network being overtaxed.16

At approximately 10:00 a.m. on December 4, 2015, the IRC ICP tasked the County/OA EOC with
developing a strategy for reuniting evacuated IRC individuals with their personal property and
vehicles left behind. The County/OA EOC developed an action plan and was standing ready to O
implement said plan when, at approximately 5:00 p.m., the EOC Director (the OES ESM) was
contacted by the FBI via the EOC Liaison at the ICP. During the call, the EOC Director was told to
P
cease all activities (including those related to the return of personal property and vehicles) and E
immediately deactivate the EOC as the FBI would be handling all activities since the transition
of command from the SBPD to the FBI at 3:30 p.m. that day. After consulting with the County R
CEO, the EOC Director complied with the FBI directive and the EOC was deactivated at 5:30 p.m.
EOC personnel reported the abrupt stop to EOC activities as a result of federal involvement was
A
jarring. They voiced frustration about feeling unable to complete their mission or support T
forthcoming efforts for which the County/OA EOC and OES had detailed plans, capabilities, and
experience. Upon deactivating, ICEMA representatives present at the County/OA EOC I
coordinated a well-received Critical Incident Stress Debriefing (CISD), which EOC responders
participated in that evening before departing.
O
N
After its deactivation, OES would go on to support the County’s cost recovery efforts (discussed
in narrative 6.6 Cost Recovery/Reimbursement on page 157), ongoing Proclamations of Local A
Emergency (discussed in narrative 2.3 Proclamation(s) of Emergency on page 53), the Post-
Incident Coordination Group, and other assignments.
L
Enhancing the County/OA EOC Role…
Per National, State, and industry standards and practices, the County/OA EOC was underutilized
R
during the response to the December 2, 2015 terrorist attack. This can be attributed to two E
primary factors exhibited from both within the County/OA EOC and among other County
departments/agencies/offices. First, a majority of those involved applied an assumption that S
“this incident is different” and therefore believed standardized, proven, and historical protocols
do not apply or must be modified. And second, the County and the EOC itself exhibited only a
P
partial understanding of the potential role and value of EOCs in holistic emergency O
management (e.g., support, coordination, communications, information management, resource
management, incident/resource prioritization, policy facilitation), including during non- N
traditional emergencies such as the terrorist attack. S
San Bernardino County has a history of emergency incidents, including major wildfires, E
landslides/mudslides, flooding, earthquakes, water quality emergencies, and atypical law
enforcement events such as the 2013 Dorner attacks and manhunt. Most stakeholders
interviewed as part of this assessment commented that the County typically demonstrated

16
The web-based system used by the County for essential communications with hospitals was also affected by the
number of users attempting to watch streaming coverage of the incident on County networks.
Narratives and Analysis 49
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

more effective information sharing and coordination via the County/OA EOC than was exhibited
during this incident.

When queried about the role of the EOC during this incident, the three (3) most senior County
executives commented that the terrorist attack was not a traditional emergency and that the
incident itself belonged to the City of San Bernardino not the County. As a result, they saw no
O primary role for the County/OA EOC beyond monitoring situations and assisting with resources.
P This sentiment was echoed by many department representatives, including some from more
traditional public safety backgrounds. There was only a limited understanding of the County
E EOC’s role as OA administrator supporting all political subdivisions in the County boundaries, its
unique “backfill” relationship with the City of San Bernardino, and emergency management’s
R role in more broad resilience missions (beyond incident support) such as continuity of
A operations, policy facilitation, mass care/reunification, public information, and mutual aid/
assistance for non-traditional public safety functions. For example:
T  The IRC ICP (under Unified Command with the Sheriff’s Department) did not request
support from the EOC to support IRC evacuees that were congregated at the San
I Bernardino Public Golf Course before transport to the Rock Church for witness
O interviews. Likewise, the IRC ICP did not request the EOC’s support with the
management of reunification/release efforts at the Hernandez Community Center. Both
N of these are mass care and reunification functions typical of EOC involvement in
California. That engagement did not change until the County Fire IMT, whose members
A had a greater understanding of the potential role of the EOC, integrated with the IRC
L ICP late in the night on December 2, 2015.
 OES has a standing responsibility for managing continuity of operations (COOP)
planning efforts among County departments/agencies and vetting Department
Emergency Operations Plans (DEOPs), which are expected to contain continuity
R strategies. The CAO did not directly solicit OES or EOC input when closing government
E offices, developing directives for maintaining essential functions, or determining how
those functions might be maintained and what resources may be needed to do so. Nor
S did OES or the EOC willingly offer input on these and other subjects when given an
opportunity during the CAO Coordination Conference Calls.
P  Some information collection functions typically housed in an EOC were subsumed by
O the CAO without also adopting the associated information dissemination or inter-
agency coordination functions. As a result, many departments stated coordination
N among departments was not facilitated by the CAO as would be the norm via the EOC.
Information was received and used by the County Executive Management Team, but
S information essential for situational awareness and department-level decision-making
E and coordination was not distributed out.
 The FBI connected with San Bernardino County Human Services to establish its Family
Assistance Center (FAC), which operated from December 9 - 11, 2015. County Human
Services did not have a FAC plan yet OES did. The FBI could not have been expected to
know the capabilities of San Bernardino County at the time and arrived with the
assumption it would need to lead all efforts in the absence of local capabilities.
However, County Human Services or others in the County aware of the FAC did not
direct the FBI and Human Services to OES, which had FAC capabilities.
Narratives and Analysis 50
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

o It’s important to note, since the December 2, 2015 terrorist attack, the OES has
gone on to forge a stronger relationship with the regional FBI office in Riverside,
CA. Through multiple meetings, the OES and FBI have shared information
regarding their capabilities so future assumptions about capabilities, or the lack
thereof, can be avoided. OES representatives were encouraged by the growing
relationship between the two entities and anticipated a more collaborative
effort in the future. The OES has now added an Agency Representative “seat” in O
the County/OA EOC for the FBI and a Memorandum of Understanding (MOU)
was in development between the two at the time of this report.
P
E
Decisions were made at the County/OA EOC, regarding information related to this incident
being more sensitive than normal because County personnel were affected and FBI R
involvement created concern about the mishandling of what might later be construed as
confidential or classified information. In most cases, the redaction of information could have
A
been limited to the names of those directly affected. Instead there was an excessive degree of T
caution applied to all communications out of concern for upsetting or affecting fellow County
personnel which resulted in lack of situational awareness or the sharing of non-actionable, low I
value information. For example, information safeguarding or redaction led to generic Flash
Reports (with limited actionable intelligence) and no daily Situation Summaries were produced
O
(to provide detailed incident information and a chronicle of response and recovery activities). N
Multiple departments familiar with the role of the EOC were perplexed that the information
they are accustomed to receiving from the EOC to inform their decisions and facilitate A
coordination was not available. As a result, they acknowledged some efforts were duplicated or
were not coordinated across departments/agencies, which would have otherwise been
L
facilitated by the EOC.

EOC staff made assumptions that the CAO would decide who needs what information since it R
had partially assumed the information management function, but never discussed or confirmed
that delineation of responsibilities with the CAO. For example, both the EOC and CAO were in
E
receipt of a list of the injured victims that had been transported to local hospitals late in the S
afternoon on December 2, 2015 (more information on this is available in narrative 1.5
Personnel Accountability on page 33). The EOC did not distribute the information to other P
departments with a need-to-know as it typically would, assuming the CAO would do so, but the
CAO did not. At that same time, the Coroner Division was responding at the Hernandez
O
Community Center during reunification. Without knowing which survivors had been N
transported, Coroner Division staff told every loved one that was not reunited at that location
to expect the worst, possibly including the loved ones of survivors. S
Additionally, the OES regularly offers EOC training, runs exercises, and brings in external
E
training partners to improve EOC preparedness. OES staff boasted of a tremendous amount of
County executive support for both emergency preparedness and the EOC. When queried about
the level of actual executive engagement in preparedness programs (e.g., training), the OES
acknowledged such programs/events are typically attended by designees and not the
principles. As an example, OES offers emergency preparedness training for the Board of
Supervisors. That training includes the role of the EOC and its association with the Policy Group

Narratives and Analysis 51

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

as well as clear instructions for County Supervisors on what to do and avoid during emergency
situations (they are also provided a quick reference sheet reinforcing the training for quick
reference). The training is offered every two years, with the expectation Supervisors and staff
will attend at least once (likely at the beginning of their term or employment). Because of
turnover, the course is offered every two years to keep new Supervisors and staff up to speed.
The training was perhaps less impactful than anticipated because only two County Supervisors
O had a vague recollection of it. Likewise, despite acknowledging recent training, many
P department personnel did not demonstrate those trained emergency coordination skills during
the incident. The adage “if you don’t use it, you lose it” may have been applicable. Personnel
E cannot be expected to possess optimal capabilities or understanding after attendance at one
training session without regular and ongoing refresher training and opportunities for real-world
R implementation.
A The EOC capabilities in San Bernardino County may benefit from a discussion between the CAO
T and OES to explore the potential roles of the County/OA EOC in a changing world with new
hazards, the definition of an “emergency” requiring EOC activation, the delineation of
I responsibilities, expectations, and relationship between the two, and actions for fostering
O greater EOC awareness and process across the County.

N
A
L

R
E
S
P
O
N
S
E

Narratives and Analysis 52

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

2.3 Proclamation(s) of Emergency

The legal authority for a political subdivision of the State of California to proclaim a local state
of emergency is codified in California Government Code §8630; as part of the California
Emergency Services Act (California Government Codes §8550 - 8668). Within San Bernardino
County, such authority is delineated in San Bernardino County Code of Ordinances §21.0105. In
times of actual or pending crisis, a state of local emergency is typically justified and employed,
per State and County code, for one or more of the five reasons below: O
1. Empower the Director of Emergency Services (County Chief Executive Officer [CEO]) to P
organize, control, and direct the efforts and resources of County entities to collectively
achieve emergency objectives, including:
E
• Ensuring cooperation between, and coordination of, services and staff. R
• Adjudicating issues of authority and responsibility.
• Requiring emergency service of any County officer or employee. A
• Requisitioning necessary personnel or materials of any County department or
agency.
T
2. Activate the emergency authorities of the Director of Emergency Services to make and I
issue emergency rules, regulations, and orders reasonably related to the protection of
life and preservation of property (e.g., curfews, restricted/closed areas, price gouging O
ordinances, restrictions on sales, direction of the allocation of private resources).
3. Access resources necessary for emergency purposes not otherwise available or in a
N
more expedited manner, including: A
• Providing and/or receiving mutual aid to/from State Agencies and other
political subdivisions of the State. L
• Activating emergency procurement authorities to expedite or avoid typical
procurement restrictions.
• Requiring and directing the aid of citizens of the County. R
• Authorizing resource commandeering for the public good.
4. Legal and liability protections to include the amplification of privileges, benefits, and E
immunities provided by State law for registered disaster service workers to engage
citizens of the County or volunteers.
S
5. Position the County to potentially have eligible costs qualify for State reimbursement P
under the California Disaster Assistance Act (CDAA) in the event of an associated
Governor’s Proclamation of a State of Emergency and/or Federal reimbursement O
under the U.S. Stafford Act in the event of an associated Presidential Declaration of
Emergency or Major Disaster.
N
S
The County’s Director of Emergency Services (County CEO) signed a proclamation of emergency
for the County on December 10, 2015. California law affords political subdivisions of the State E
up to ten days from the time of the emergency to issue a proclamation. The aforementioned
authorities and flexibilities may, in some cases, be permitted in advance of the proclamation
and then be retroactively covered. Per State law, the governing body of a political subdivision
must ratify the proclamation if not proclaimed by the governing body, within seven days of its
original signing. As a result, the Director of Emergency Service’s proclamation was unanimously
ratified by the County Board of Supervisors on December 15, 2015. State law then requires the

Narratives and Analysis 53

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

proclamation to be reviewed and approved for continuation at least once every 30 days until
the governing body terminates the local emergency. As such, the proclamation was
reintroduced to the Board of Supervisors at least monthly, if not twice monthly depending on
the Board’s meeting schedule, until August 8, 2017 when it was terminated. The County’s
proclamation was in effect for approximately 20 months and the mandated process was
effectively followed the entire time.
O
P The reasons cited for the County’s proclamation primarily related to items 3 and 5 in the
aforementioned list. First, mutual aid from State and neighboring jurisdictions had been
E requested and was being mobilized in support of the Department of Public Health (DPH)
Environmental Health Services (EHS) Division as early as December 7, 2015. Technically, under
R the California Emergency Services Act, a proclamation is needed each time mutual aid is
A activated. This requirement is not typically enforced for smaller day-to-day mutual aid
activations across jurisdictions (i.e., among law enforcement or fire/rescue), but is enforced
T during larger and/or extended mutual aid activations. The County recognized large quantities of
mutual aid would be needed for an extended duration (at least until June 30, 2016 as
I authorized by the Board of Supervisors) to backfill EHS functions. As such, a proclamation was
O necessary. Secondly, the County wanted to position itself for potential State reimbursement
under the CDAA and/or Federal reimbursement under the Stafford Act for “unprecedented
N response, mitigation, and recovery costs.” Once again, a local proclamation would be necessary
to trigger a State proclamation or Federal declaration, respectively, and thereby activate
A associated cost recovery programs. Although not specifically stated in Board documents, the
L County’s proclamation was also used to activate the County’s emergency procurement
authorities.17 One could also argue the proclamation was used by the CEO to organize
departments of the County and their resources to assist with recovery operations (e.g., Post-
Incident Coordination Group activities, continuity of operations, facility renovations, counseling
R services, victim liaison services, memorial events, etc.).
E The Governor proclaimed a state of emergency associated with the terrorist attack on
S December 18, 2016 in response to the County’s request. The Governor’s proclamation ordered
the following:
P  The California Department of Public Health (CDPH) to assist the County EHS Division in
O resuming normal staffing levels.18
 The California Governor’s Office of Emergency Services (CalOES) to provide assistance
N to San Bernardino County under the CDAA.
 The suspension of fees associated with the disposition of victim remains and copies of
S death certificates for the next-of-kin.
E
As it stated, the Governor’s proclamation made certain eligible costs available for
reimbursement.19 Not knowing the cumulative total cost for response, recovery, and continuity

17
See narrative 2.5 Emergency Procurement on page 61 for more information on how that authority was applied
following the terrorist attack.
18
See narrative 5.4 Alternate Personnel on page 131 for more information on how CDPH supported the EHS
Division.
Narratives and Analysis 54
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

efforts at the time, the County requested that the Governor request a Presidential Declaration
of Emergency. However, a Federal declaration was not issued associated with the terrorist
attack. Ultimately, it would not have made a difference for cost recovery purposes. Under the
Stafford Act, the Federal Emergency Management Agency (FEMA) sets expense thresholds for
reimbursement that a jurisdiction must exceed before being eligible for Federal
reimbursement. The County’s total cost associated with the incident was ultimately calculated
at approximately $22.6 million. In 2016, the County’s threshold for reimbursement was O
$7,245,345 which was exceeded, but the State’s threshold of $52,528,078 was not exceeded,
which disqualified the incident from eligibility for federal reimbursement.
P
E
Because the County’s need for mutual aid, Additional Information…
emergency contracts, and recovery coordination The cities of San Bernardino and
R
continued through 2017, the County’s emergency
proclamation was renewed for as long as it was
Redlands, being incident sites and A
serving as the primary responders, also
deemed necessary to facilitate those activities. By proclaimed local states of emergency T
August 8, 2017, most of the proclamation’s value for their jurisdictions on December 10
had been realized and per State law requiring the and 11, 2015, respectively. As the
I
termination of proclamations at the earliest
possible date that conditions warrant, the Board
administrator for the Operational Area, O
the County’s Office of Emergency
of Supervisors approved the termination on that Services (OES) supported the N
date. transmission of those proclamations to
the State.
A
L

R
E
S
P
O
N
S
E

19
See narrative 6.6 Cost Recovery/Reimbursement on page 157 for more information on the application for CDAA
associated with the terrorist attack.
Narratives and Analysis 55
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

O
P
E
R
A
T
I
O This page is intentionally blank.
N
A
L

R
E
S
P
O
N
S
E

Narratives and Analysis 56

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

2.4 Management Practices and Documentation

As the entirety of this report demonstrates, the County was engaged in dozens, if not hundreds,
of tasks and activities associated with its response to and recovery from the December 2, 2015
terrorist attack. Some of those activities occurred over the course of only minutes and hours in
the immediate aftermath of the incident (e.g., accounting for personnel, addressing immediate
media requests, supporting incident operations) and others would unfold over the course of
months and years (e.g., psychological support, continuity of operations, employee benefits). O
Throughout this review process, the authors queried department heads, supervisors, and P
operations-level staff regarding the tools and practices they employed to select goals, identify
and understand needed tasks, make assignments, monitor progress, ensure quality, coordinate E
with other entities, etc.
R
In the days following the terrorist attack, operations-level staff across the most affected A
departments and offices generally self-directed actions and tasks amongst themselves or
assumed responsibility when a void was identified versus receiving strategic direction from T
higher levels of authority. As a result, there was some duplication of efforts and lack of
coordination across departments. Some assignments fell to staff that may not have been I
optimal for reasons ranging from skillset, to workload, to psychological condition. Once the O
Chief Executive Officer’s (CEO’s) Post-Incident Coordination Group20 meetings began on the
afternoon of December 8, 2015 some semblance of strategic planning, deliberate assignments, N
cross-department awareness and information sharing became more solidified and then
improved over time. Although some conference calls had been held prior to that, those did not A
achieve the same level of measured planning. The Post-Incident Coordination Group met L
weekly, bi-weekly, or monthly through February 8, 2018 on an as needed basis. Participation
was augmented as needed (e.g., Sheriff, County Fire, County Counsel, Environmental Health
Services), but permanent membership on the Post-Incident Coordination Group included
representatives from the following departments: R
 Behavioral Health  Information Services E
 County Administrative Office (CAO)  Land Use Services
 CAO Public Information  Office of Emergency Services
S
 District Attorney  Public Health P
 Finance and Administration  Real Estate
 Human Resources  Risk Management O
 Human Services N
Given the speed at which actions and incidents were moving, few seemed to take notes, keep a
log, or track actions and associated progress in the immediate aftermath of the event. For
S
E
20
Under the Code of Ordinances (§21.0106), the County has a Disaster Council which focuses on emergency
preparedness (e.g., plan approvals, mutual aid agreements). Although its focus is not response, the County may
have benefited from activating the Disaster Council, or an equivalent body, to collectively understand issues,
impacts, and needs, brainstorm solutions, and delineate assignments and roles. Approximately half (10) of the
Disaster Council’s 20 members were represented in the Post-Incident Coordination Group, but initial meetings of
the entire group could have helped improve the management of tasks and resources, including the Victim Liaison
program and disparate security enhancements that began immediately following the attack (See narrative 6.4
Long-Term Security on page 149 for more information).
Narratives and Analysis 57
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

example, the authors of this report struggled to clearly define the timeline of events on the day
of the incident and those immediately following because most staff did not maintain any
records from those days. Most evidence of those days’ events was based on reflection after the
fact and there were various conflicting recollections. Although logs/records could have
benefited historical efforts like this one, the greater purpose would have been to keep
personnel on track, provide reminders of necessary actions or follow-up activities, and ensure
O against any omissions or duplications of effort.
P Those departments that activated Department Operations Centers (DOCs) and the County
E Emergency Operations Center (EOC) appeared to do better establishing objectives, making
assignments, and tracking actions and incidents. They had processes and documentation in
R place for managing those types of activities. These existed as a result of the required
A application of Incident Command System (ICS) principles, California’s Standardized Emergency
Management System (SEMS), and the National Incident Management System (NIMS). Use of
T these tools and practices, or equivalents, may have been of value to other County departments
and agencies involved in response and recovery activities even if those were administrative in
I nature. This narrative is not to imply that any efforts failed or were overlooked as a result of the
O lack of immediate management structure, but opportunities for improved efficiency and
enhanced effectiveness were likely.
N
Although notes from Post-Incident Coordination Group sessions recorded encouragement for
A those present to take notes and keep logs, County executives felt a more formal approach was
L necessary for all departments. As a result, on January 19, 2016, the CEO issued a memorandum
to Elected Department Heads, Assistant Executive Officers, the County Chief Operating Officer,
County Chief Financial Officer, Deputy Executive Officers, and Department Heads to initiate a
formal incident documentation effort, stating:
R
E “As we continue the transition from emergency response to reporting and
documentation, as previously requested, I ask that you continue and intensify
S the tracking of event-related activities to date and on a go-forward basis. …I’m
asking that you begin the process of recording your event-related actions and
P responses, and that you ask the same of your staff. For me personally, I found
O the retracing of my steps difficult so I encourage you to start as soon as possible
so as to not lose invaluable data and information. Capturing this information
N may allow the County to seek out multiple sources of reimbursement for our
costs resulting from the incident and will be critical to the long-term endeavor to
S create a historic and best-practices document.”
E Recognizing the need to now collect the information departments were encouraged to
maintain, the County Administrative Office (CAO) initiated a collection effort on April 4, 2016,
including a new strategy of providing “prompts” much like a survey for departments to respond
to. This effort included a request to return documentation to the CAO by April 20, 2016.

“Since we are now more than 90 days post-incident, we have attached some
documents that may be helpful with your reconstruction and recollection of the

Narratives and Analysis 58

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

events taking place during this period. These include the Flash Reports, Message
from the Chairman, and an abbreviated County Office of Emergency Services
incident timeline. We have also provided a series of ‘prompt’ questions and
recommend you review phone and email messages to further assist with your
review of the sequence of events, communications and actions you took during
this time.
O
• Describe when and how you first became aware of the attack and your
immediate thoughts and actions.
P
• Describe in detail how you implemented your Department Emergency E
Operations Plan. In what ways did you find the Plan to be effective? Did you
find any areas of the plan in need of improvement? If you didn’t implement R
your Department Emergency Operations Plan, explain why not.
• What were some of your immediate thoughts and considerations as you
A
began evaluating actual/potential impact of this incident to your staff and/or T
department operations?
• When and in what manner did you communicate with staff on 12/2? I
Summarize the communication. Did you rely on Emergency Contact
information and, if so, how did you access that information and was it
O
accurate? N
• How were you notified that most County operations would be closed on 12/3
and 12/4? Did you maintain any department operations on those dates and, A
if so, which ones? Describe in detail how you determined which services and
personnel were ‘essential.’
L
• As you interacted with staff regarding the impact of the attack on them, their
colleagues and co-workers, the department and/or the County overall, what
are some of the key concerns that surfaced? R
• Describe any concerns or ideas you and your staff felt and/or expressed
about security at County facilities and events.
E
• Did you receive requests from staff for assistance or counseling support to S
deal with the attack? If so, describe your experience accessing and utilizing
the counseling resources made available by the County. P
• Describe how you responded to questions and contacts from outside
groups/individuals and/or members of the public regarding the attack. From
O
whom did you hear? What did they want to know? What did you tell them? N
How did you acquire the information needed to respond?
• What kind of feedback did you receive from your staff about the County S
Family Gathering event?
• Describe in detail how the County’s response to the incident (e.g.,
E
communication, supportive services, media relations, etc.) during the first 30
days could have been better.
• Describe in detail your “lessons learned” so far and what you would do
differently if something like this were to happen again. Please include
information about any changes or preparations you have made or plan to
make within the next 90 days.

Narratives and Analysis 59

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Please note that we offer these questions only to spur your thinking; we are not
suggesting that your response should include only the answers to these
questions. Rather, we are interested in knowing how you and your staff were
impacted by and responded to the attack. We also want to hear your thoughts,
observations and suggestions regarding the County’s overall response...”
O
P This request resulted in the submission of forty-three (43) “90-day reports,” most of which used
the “prompt” questions to document their efforts.
E
Ultimately another valuable source of incident documentation that emerged was the
R development of numerous presentations given by County personnel after the event. In the
A months and years following the terrorist attack, a number of County officials were asked to be
guest speakers at local and national events to share their stories from their particular
T perspectives (Environmental Health Services, Human Resources, legal, management, facilities,
etc.). Most of these engagements included PowerPoint or other types of presentation
I documents which, combined with the logs and documentation reports made up a substantial
O part of the pre-recorded non-public safety response documentation of the County’s response
to the December 2, 2015 terrorist attack.
N
In a continued effort to more formally document the response and recovery actions of the
A County, the County issued a Request for Proposal (RFP) on August 1, 2016, to hire an
L independent consulting firm to create: 1) a report documenting and assessing the County’s
response to and recovery since the terrorist attack; and 2) a separate guidance document for
other jurisdictions or organizations to assist with their planning for, or response to, similar
types of emergencies with recommendations gleaned from San Bernardino County’s
R experience. On January 24, 2017, Critical Preparedness and Response Solutions (CPARS
E Consulting, Inc.) was selected to perform this work resulting in this document.

S The Importance of Documentation…

P As noted throughout this section, the importance of event documentation is critical. As time
passes and memories wane, the real-time documentation of events becomes even more
O important. State and National standards such as the National Incident Management System
(NIMS) and California’s Standardized Emergency Management System (SEMS) encourage a
N concerted effort at the onset of any event to document and maintain event logs, meeting
S minutes, and overall situational/incident reporting in both the response and recovery phases.
More importantly, such logs/records can be used to improve worker efficiency by keeping
E personnel on track, providing reminders of necessary actions or follow-up activities, and
ensuring against any omissions or duplications of effort.

Narratives and Analysis 60

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

2.5 Emergency Procurement

The ability to rapidly acquire resources necessary for response, recovery, and continuity
capabilities is a critical component of an organization’s emergency protocols. Day-to-day
procurement processes for most public entities like San Bernardino County are usually
governed by State law and County policies and established procedures to ensure a competitive
process and the best use of public funds, which can be obstacles to immediate resource
acquisition for emergency purposes. This narrative discusses the County’s procedures for O
emergency procurement and the implementation of said procedures during and following the P
December 2, 2015 terrorist attack. This narrative does not discuss the application of resources
owned by, or previously contracted with, the County that were coordinated by the County E
Emergency Operations Center (EOC) and are discussed in narrative 2.2 County EOC on page 45.
R
County Procurement Policy A
San Bernardino County’s procurement policies are codified in County Code of Ordinances
§14.0101 through §14.0116. Said regulations are further detailed and associated procedures T
presented in a variety of County policies, the following of which were most relevant to, and
implemented following the December 2, 2015 terrorist attack: Policy #11-04 (Procurement of I
Goods, Supplies, and Equipment) and Policy #11-05 (Procurement of Services).21 The County’s O
standard procurement policies in place at the time of the attack were fairly typical of most
California political subdivisions with some additional County-specific requirements as N
summarized below:
 Required approval of the Purchasing Agent (County Purchasing Department Director)
A
and competitive bid process for all procurements.22 L
 Approval by the Board of Supervisors for all service contracts valued over $100,000 for
a single annual period.
 Approval of service contracts valued between $50,000 and $100,000 for a single annual
period by the Chief Executive Officer (CEO) or designee.23
R
 Documentation of competitive bid maintained by the Purchasing Department for all E
procurements above $3,000 for services and $7,500 for goods and by each
department/agency/office for those under the respective threshold.24 S
 Non-competitive bid process approved by the Purchasing Agent allowed for P
acquisitions less than $100,000 under documented special circumstances: availability
through only one source, proprietary items or systems, matching system compatibility, O
manufacturer-direct acquisitions, no functional equivalency, or geographically-
protected distribution. N
 Non-competitive bid process approved by the Board of Supervisors allowed for S
acquisitions greater than $100,000 under documented special circumstances.
E
21
County Policies #11-04 and #11-05 were revised and combined into an updated #11-04 addressing goods,
supplies, equipment, and services on February 14, 2017. The revised policy is more aligned with State of California
Government Code and modifies or eliminates a number of San Bernardino County requirements that were in place
at the time of the attack, some of which are cited in this narrative.
22
Requirement changed to all procurements above $1,000 in the February 14, 2017 #11-04 policy update.
23
Requirement removed in the February 14, 2017 #11-04 policy update.
24
Requirement threshold changed to $5,000 for both services and goods in the February 14, 2017 #11-04 policy
update.
Narratives and Analysis 61
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

 Board of Supervisors approval for any fixed asset acquisition of $10,000 or more
beyond those in the currently approved Budget.
 Maximum contract term of 3 years.25
 Standards to ensure the integrity of the selection process.

The procurement requirements identified above can be time consuming and cumbersome;
O something counterproductive in an emergency situation. Foreseeing the needs of emergency
P circumstances, both the County Code §14.0106 (Emergency Purchases) and County Policies
#11-04 and #11-05 provided exceptions to the aforementioned policies. While one may assume
E every public sector entity would have emergency procurement policies, it is less common than
one would anticipate. As a result, San Bernardino County was to be commended for thoroughly
R codifying the following emergency protocols:
A  Emergency purchases may be made by any person or official authorized to sign
requisitions when: (a) the Board of Supervisors or an official designated by ordinance
T has proclaimed a local emergency; (b) such item(s) are immediately necessary for the
preservation of life or property; and/or (c) the Purchasing Agent or any deputy or
I assistant authorized to make purchases is not immediately available, and the item(s) are
O immediately necessary for the continued operation of the entity, and undue delay
would cause substantial loss to the County.
N  Timely approval and confirmation by the Board of Supervisors for the procurement of
services above $100,000 and fixed assets above $10,000.26
A  If the incident prevents the timely submission of the request to the Board of
L Supervisors, then it should be presented for consideration and approval/confirmation as
soon as reasonably possible following the emergency.
 Standard procurement policies should be applied to the degree practicable.
R Implementation following the December 2, 2015 Terrorist Attack
E A Proclamation of Emergency was signed by the County CEO on December 10, 2015 and ratified
by the Board of Supervisors on December 15th. The Proclamation was continued until August 8,
S 2017. As the above policy exemptions identified, the Proclamation could have automatically
triggered the County’s emergency procurement authorities, but action was taken sooner to do
P so without the Proclamation. As early as Friday, December 4th, the County began to recognize
O the forthcoming need for emergency procurement authorities. On that day the Board of
Supervisors waived the competitive solicitation process and authorized the CEO and Purchasing
N Agent to issue required purchase orders for emergency repairs and renovations needed for
alternate facilities to house relocating Department of Public Health (DPH) Environmental Health
S Services (EHS) Division functions and coordinate necessary security services. These were
E authorized under California Public Contract Code §2203527 and §22050.28

25
Requirement changed to 5 years in the February 14, 2017 #11-04 policy update.
26
The $100,000 requirement was applied for the non-competitive procurement of goods, supplies, and equipment
in the February 14, 2017 #11-04 policy update. A threshold for Board of Supervisors approval/confirmation for the
non-competitive procurement of goods, supplies, and equipment was not codified in policy at the time of the
attack.
27
§22035 states “In cases of emergency when repair or replacements are necessary, the governing body may
proceed at once to replace or repair any public facility without adopting plans, specifications, strain sheets, or
Narratives and Analysis 62
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

At its Monday, December 7, 2015 meeting, the Board of Supervisors officially activated County
Code §14.0106 and the emergency procedures in County Policies #11-04 and #11-05. Since the
Proclamation of Emergency had yet to be signed, the Board cited justifications (b) and (c) from
the previous section to authorize emergency procurement procedures, stating:

“…a number of County employees, specifically in the Environmental Health

[Division], a division of the County Public Health Department, were victims in the O
mass shooting. The health and welfare of the citizens of the County of San
Bernardino as well as that of County employees is of paramount importance to the
P
Board of Supervisors and the County administration. The Board wants to assure that E
the important services provided by the Environmental Health [Division] will continue
to be provided to the public in the wake of the December 2 tragedy.” R
The Board then authorized the following during that meeting:
A
 The Purchasing Agent to acquire any goods, services, equipment and personnel needed T
for the continued operation of the County, including, but not limited to, contracts with
other public agencies to provide aid, and contracts with entities to provide personnel I
and services needed to preserve life or property and provide essential services to the
public until June 30, 2016.
O
 To do so without following any of the competitive processes which may have been N
required by County Policies #11-04 and #11-05.
 Present the Board with any items anticipated to exceed $100,000 in value for A
consideration and confirmation at the next Board meeting. L
 The Purchasing Agent to render as surplus and dispose of existing furnishings valued at
$10,000 or more (including equipment) associated with the repair, preparation, and/or
renovation of permanent or alternate facilities associated with personnel relocations.
Likewise, acquire or lease unbudgeted fixed assets of $10,000 or more to provide R
needed services and present such items to the Board for consideration and confirmation E
at the next closest Board meeting.
 Temporarily increase CAL-Card (purchase card) limits as needed for all those authorized S
to acquire the goods and equipment necessary without following competitive process
requirements or additional administrative approvals through January 12, 2016.
P
O
The County Purchasing Agent immediately took action to implement the emergency
procurement procedures. First, the Purchasing Department established a new “department” in N
its procurement system (ePro) under which all associated emergency acquisitions could be
submitted, expedited, and collectively tracked. The Purchasing Agent ensured all relevant
S
department purchasing officers and CAL-Card coordinators would have access to the ePro E
system for viewing purchase orders, processing payments, and uploading invoices. She also

working details, or giving notice for bids to let contracts. The work may be done by day labor under the direction of
the governing body, by contractor, or by a combination of the two.”
28
§22050 states “In the case of an emergency, a public agency, pursuant to a four-fifths vote of its governing body,
may repair or replace a public facility, take any directly related and immediate action required by that emergency,
and procure the necessary equipment, services, and supplies for those purposes, without giving notice for bids to
let contracts.”
Narratives and Analysis 63
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

dedicated a Lead Buyer to support County departments with all emergency procurements
associated with the terrorist attack. Notifications and instructions on the emergency
procurement process were then sent in memorandums from the Purchasing Agent to all
department heads, County executives, department purchasing contacts, and department CAL-
Card coordinators on December 10, 2015.

O Between December 7, 2015 and August 2016, the emergency procurement process was used
P 46 times for acquisitions totaling approximately $920,000. Procurements were wide-ranging
and included:
E  CAL-Card purchases often less than $100 at grocery stores and office supply retailers.
 Cleaning, repair, and/or replacement of emergency services vehicles involved in the
R response.29
A  Security personnel and system upgrades.30
 Memorial items and Memorial Services (e.g., lapel pins, picture frames, video
T production, audio/visual support, speaker stipends, food services).
 Alternate facility costs (e.g., custodial, construction services, furniture/equipment,
I moving services).31
O  Counseling Services provided by Counseling Team International.32
 Reimbursement to mutual aid providers that backfilled EHS functions.
N  Long-term contracted staffing for the EHS Division through the California Association of
A Environmental Health Administrators (CAEHA).33

L The County’s emergency procurement processes appear to have been well positioned and
prepared to support the emergency needs of this incident. In addition, the program was
effectively optimized and implemented following the terrorist attack. Although emergency
R procurements were not needed to support immediate life/safety and emergency missions on
December 2, 2015as those needs were satisfied with the County’s own resources or existing
E contractsthe program’s implementation following the incident provides assurances that the
program could have been implemented in a moment’s notice had the situation required it.
S
P 29
Although replacement vehicles exceeded the $100,000 threshold to trigger Board of Supervisors approval, it was
O executed under an existing contract (September 1, 2013 through August 31, 2016) with a dealership whose
contract value was not exceeded and thereby did not have to be approved separately.
30
N Although security system upgrades exceeded the $100,000 threshold to trigger Board of Supervisors approval, it
was executed under an existing contract (August 26, 2015 through May 5, 2017) with a vendor whose contract
S value was not exceeded and thereby did not have to be approved separately.
31
Alternate facility costs exceeded $100,000, and as required, were brought to the Board of Supervisors for
E approval beginning January 12, 2016. The issue was reintroduced as necessary thereafter (e.g., on April 4, 2016
when funds were reallocated from one alternate site to the other). The renovations of permanent facilities were
not pursued under emergency authorities, but under standard contracting procedures. See narrative 6.3 Facility
Renovations on page 145 for more information.
32
Counseling services costs exceeded $100,000, and as required, were brought to the Board of Supervisors for
approval on March 1, 2016 when the existing contract ceiling was exceeded and again on August 23, 2016 when
the ceiling was increased again.
33
Contract staffing costs exceeded $100,000, and as required, were brought to the Board of Supervisors for
approval when the contract was executed on March 22, 2016 and again on September 13, 2016 when the value
was increased and performance period extended.
Narratives and Analysis 64
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

2.6 Addressing the Perpetrator’s Footprint

The male perpetrator of the December 2, 2015 terrorist attack was a San Bernardino County
employee. He worked for the Department of Public Health (DPH) Environmental Health Services
(EHS) Division as a health inspector assigned to food facilities. Inspectors assigned to food
facilities perform health and safety inspections on retail food and food handling establishments,
which in California result in a Retail Food Inspection Grade of “A,” “B,” or “C” and an associated
inspection report. Grade cards and inspection reports are signed by the food inspector and the O
Grade Card is publicly posted. P
Almost immediately following the attack, as the male perpetrator’s identity became widely E
known, dozens of retail food establishments began contacting the County asking that the Grade
Cards with the perpetrator’s signature be replaced. In addition, it came to the County’s R
attention that some individuals were trying to collect the Grade Cards with the intent to sell A
them online. As the San Bernardino County offices reopened on December 7, 2015, a priority
task for the DPH was to replace all the EHS Division’s publicly posted food inspection Grade T
Cards bearing the perpetrator’s signature.34 To accomplish this task, mutual aid Environmental
Health Specialists from neighboring Riverside County engaged in a concentrated effort to I
replace 368 grade cards at food establishments throughout San Bernardino County that O
included evidence of the perpetrator’s work. Twenty-two (22) Riverside County inspectors
began the process on December 10th. By Friday, December 12th, 350 Grade Cards had been N
replaced. The remaining 18 cards, which belonged to food establishments significantly farther
away in the high desert, were replaced on December 22nd. In a complementary effort, EHS staff A
removed the perpetrator’s name from records associated with his inspections that were posted L
and searchable on the DPH website.

The perpetrator had a workspace alongside his colleaguesmany now deceased or injured
because of his actionswithin the EHS offices in the County Government Center at 385 N.
R
Arrowhead Avenue in San Bernardino. Immediately after the incident, law enforcement and the E
Federal Bureau of Investigation (FBI) secured the perpetrator’s cubicle, declared it a crime
scene, and ultimately removed all the belongings.35 When loved ones of the victims were S
allowed to visit the EHS offices prior to their demolition for renovation, the perpetrator’s
cubicle, which had already been emptied of personal effects by the FBI, was blocked off and
P
staff attempted to route loved ones away from it. As the EHS offices were temporarily relocated O
to the 172 West 3rd Street alternate facility, the floor plan of cubicles was intentionally crafted
to mirror the configuration at the County Government Center with the exception of the N
perpetrator’s workstation. A deliberate effort was made to eliminate the equivalent location of
the perpetrator’s cubicle at the alternate facility. While later planning the return to renovated
S
offices at the County Government Center, the location of the perpetrator’s former workstation E
(based on its position relative to structural support columns that could not be moved) was
made into a storage area so no employee’s new workstation would be placed in the same area.

34
Authority to replace Grade Cards and update inspection reports was allowed under the authorities of the County
Health Officer, specifically under the State’s retail food code and the public beach and swimming pool codes.
35
The FBI also requested all of the male perpetrator’s employment records from the Human Resources
Department.
Narratives and Analysis 65
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Since the attack, efforts have been made throughout the County to direct attention to the
victims and not recognize the male perpetrator, just as this report avoids addressing the
perpetrator by name. County documentation, memorials, displays, and remembrance events
have all been designed to focus on the victims.

As a provider of emergency and social services, addressing the perpetrator’s footprint also
O meant rising above the potential for personal biases and animosities toward the perpetrator for
P many County personnel. For example, staff at the Coroner’s Division of the Sheriff’s
Department investigated the perpetrator’s death, transported, autopsied, and released the
E remains of the perpetrator to the next-of-kin with the same level of professionalism and
respect they paid to the victims and all others they serve. Likewise, the Department of Public
R Health coordinated security for the safety of both staff and the family of the deceased
A perpetrators when they came to retrieve the official death certificates from DPH’s Vital
Statistics Registration Office. In addition, the male and female perpetrators were the parents of
T an infant child. Once both perpetrators were deceased, the child became the ward of the San
Bernardino County Department of Children and Family Services (CFS). Staff at CFS was
I admittedly conflicted about who was to take on the case. Within the same Department, staff
O was concurrently serving as Victim Liaisons to survivors. But as duty and professionalism
demanded, the child was provided with all the care and services due a ward of the County until
N she was eventually placed with relatives. Other occurrences of attacks on co-workers may have
similarities to the issues San Bernardino County confronted when addressing the perpetrator’s
A footprint, however, having the integrity that San Bernardino County demonstrated to go about
L professionally servicing the perpetrator and his/her family is less common.

R
E
S
P
O
N
S
E

Narratives and Analysis 66

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Category 3: Communications
Communication is perhaps the most integral part of every organization’s ability to effectively
respond to emergencies, manage impacts and crises, and achieve a new normal.
Communication and coordination is also at the heart of every situation and present in all the
activities which San Bernardino County was engaged following the December 2, 2015 terrorist
attack. As such, it is weaved into every narrative in this report. This category of the report
addresses two particular aspects of communications: 1) the resources and processes facilitating
information sharing/situational awareness; and 2) the resources and processes that enable the
distribution of information. In some cases, the two overlap as one entity’s distribution of
information provides for another’s awareness. The four narratives in this section will explore
the County’s account of becoming aware of the attack and its magnitude, the County’s ability to C
internally gather and distribute information within the County, as well as the process employed
to relay information to the public. O
3.1 Initial Notification
M
The initial notification of the terrorist attack was received at the County Administrative Office M
(CAO) on December 2, 2015, at 11:20 a.m. The Executive Secretary to the Director of the
Department of Public Health (DPH) called the CAO Executive Assistant, relaying a message from U
the DPH Director and Assistant Director to the Assistant Executive Officer for Human Services.
The DPH Executive Secretary indicated there was a shooter at the Inland Regional Center (IRC)
N
where the DPH Environmental Health Services (EHS) Division was holding an event and relayed I
the severity of the incident from eyewitness accounts provided by the DPH Director and
Assistant Director. Approximately one (1) minute later, the CAO Executive Assistant sent the C
below message to the Chief Executive Officer (CEO) and the Chief Operating Officer (COO) who
were both out of town. This first message inaccurately minimized the severity of the incident
A
and led to additional misinformation regarding the situation. As narrative 1.2 Evolution of T
Situational Information on page 23 explained, it is not unusual for misinformation to thrive
under these conditions. Assumptions, a misunderstanding, or failing to verify or vet content can I
easily lead to misinformation. In this case, the email from the CAO Executive Assistant
misclassified “all staff” at the event as being fine, when it had been relayed from the DPH
O
Executive Secretary that only the DPH Director and Assistant Director had identified themselves N
as safe. The email stated:
S
“County EHS is having an event at IRC; [DPH Assistant Director] called [DPH Executive
Secretary]…to advise an active shooter at subject location. Building is in lock-down.
[DPH Director, Assistant Director] and staff are fine. Sheriff’s Department there.”

Upon hearing the above message, the CAO Deputy Public Information Officer (PIO) who was in
the office with the Executive Assistant staff then emailed the Board of Supervisors, CEO, COO,
and primary PIO with the following similar message at 11:27 a.m.:

“…there is an active shooter at the Inland Regional Center in the 1600 block of S.
Waterman Avenue in San Bernardino. County EHS is having an event at the center and
the building is on lockdown but [DPH Assistant Director] is reporting he and [DPH

Narratives and Analysis 67

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Director] and staff are OK. We are following developments and will update when we
have more information.”

Approximately one (1) minute later, the CAO Executive Assistant received another call from the
DPH Executive Secretary providing up-to-date information on the situation. Fortunately, that
follow up call put a quick end to the previous misinformation, which may have otherwise
spread further. While still in conversation, the CAO Executive Assistant sent the following email
to the CEO and COO at 11:28 a.m., which was a response to an email from the CEO inquiring as
to whether all County employees were in a secure location:

“[DPH Director] was able to leave with a group of employees. [DPH Assistant Director]
C locked in room inside with other staff. [Some] of our employees have been shot. On
O phone now getting this. Two gunmen with machine guns started shooting. Seemed like
typical terrorist attack per [DPH Director] says [Executive Secretary to DPH Director].
M Got away in van. Looking at building.”

M By 11:40 a.m. the news media was reporting the incident. Immediately, the phones at the CAO
U began to ring non-stop. The CAO Executive Assistant and three (3) other Executive Assistants
from the CAO self-organized to field the calls. One Executive Assistant was assigned to take
N media inquiries (in support of the CAO Deputy PIO),36 another took calls from concerned family
members/loved ones/colleagues, and another fielded all other calls such as those from
I department heads asking what to do. The Executive Assistants were given minimal instruction
C and used their years of experience and institutional knowledge to triage calls, maintain call logs,
provide only appropriate information to each caller, and maintain a level of information control
A during what was an otherwise chaotic situation. They continued to field those calls until
approximately 7:30 p.m. that evening and, for the next two days, two of them continued to do
T so for nearly ten hours each day.
I In the initial hours, information continued to be uncertain and sometimes inaccurate. The CAO
O staff was able to start receiving credible information from the Assistant Sheriff, who made
regular calls to the CAO, as well as additional information from the on-site Deputy Sheriff at the
N IRC. Most of this information was related to security. For more information see narrative 1.3
S Immediate Security Measures/Lockdown on page 25.

The first official “County” notification disseminated beyond the CAO was sent to the Board of
Supervisors, County executives, and department heads at 12:04 p.m. from the CEO, who was
emailing from the Dallas/Fort Worth Airport, instructing staff as follows:

“Due to the incident at subject location [referenced subject line: Shooting Incident at
Inland Regional Center on South Waterman Ave., SB], we are advising County staff stay
indoors [sic] and not leave their buildings.”

36
For more information see narrative 3.4 Public Information on page 76.
Narratives and Analysis 68
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

By that time, it was assumed most County staff were aware of the incident because of media
coverage, word-of-mouth, concerned phone calls, or another source. The next official County-
wide notification was an email from the CEO to the Board of Supervisors, County executives,
department heads, and executive assistants at 1:48 p.m. instructing staff as follows:

“County employees in buildings within the City of SB who are not responding to the
incident are released from work for the remainder of the day.”

Following both the first and second email from the CEO, most department heads then relayed
the messages to their staff in-person, via email, or via radio as appropriate. At 2:00 p.m., the
Acting CEO (Assistant Executive Officer [AEO] for Finance and Administration) held a conference
call with all department heads to share what she knew about the status of the terrorist attack, C
subsequent response actions, and to reiterate instructions to release County staff. The call was
coordinated by the County Emergency Operations Center (EOC); the notification of which
O
would have also alerted department heads to the incident if they were previously unaware. M
Postmaster email notices were sent from the Board of Supervisors at 3:10 p.m. followed closely
by a notice from the CEO at 3:24 p.m. notifying all non-essential County employees working in M
the City of San Bernardino of their release for the day as a result of the attack.37
U
N
I
C
A
T
I
O
N
S

37
Postmaster is the name for San Bernardino County’s mass emails that are sent to all County employees.
Narratives and Analysis 69
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
M
M
U This page is intentionally blank.
N
I
C
A
T
I
O
N
S

Narratives and Analysis 70

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

3.2 Emergency Contacts

As part of the effort to account for personnel,38 the County Administrative Office (CAO) tried to
make contact with the designated emergency contacts for employees believed to be in
attendance at the Department of Public Health (DPH) Environmental Health Services (EHS)
Division event at the Inland Regional Center (IRC). Based on the information in the County’s
Employee Management and Compensation System (EMACS), the Human Resources
Department tried to contact associated emergency contacts. In most cases, the County’s
emergency contact information proved to be inaccurate and out-of-date so many emergency
contacts could not be reached.

While select departments, including the EHS Division, had up-to-date and useful emergency
contact information that they maintained, most departments reported their internal C
emergency contact information had not been maintained. Department representatives often O
noted that many employees were not willing to share their own personal contact information
or that of loved ones/emergency contacts with the County. The reasons for this were not M
further investigated as part of this report. In either case, much of the emergency contact
information that would have been valuable during the incident was largely unavailable or M
inaccurate. U
A New Process for Emergency Contacts… N
Soon after the attack, the County instituted a policy requiring personnel to update emergency I
points of contact and associated contact information to coincide with the annual renewal of
employee benefits. As a result, the County’s EMACS should now contain up-to-date emergency C
contacts and contact information for each employee, reviewed at least annually.
A
T
I
O
N
S

38
For more information see narrative 1.5 Personnel Accountability on page 33.
Narratives and Analysis 71
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
M
M
U This page is intentionally blank.
N
I
C
A
T
I
O
N
S

Narratives and Analysis 72

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

3.3 Mass Notification/Communications

At the time of the attack, the County did not have a mass notification system capable of
automatically and simultaneously utilizing multiple voice, text, and email options to contact its
nearly 22,000 County personnel. In most cases, for instance, the County’s standard approach
for notifying employees was initial emails to department heads who in turn disseminated
messages to their personnel as appropriate through means available to their department. In
the aftermath of the attack, multiple critical policy decisions were made by executives.
Notification of pertinent information to County employees during the attack happened in a
number of ways. Some
New Mass Notification Systems…
employees received
notification directly from Immediately after the attack, some departments
department heads or through independently procured mass notification systems for C
supervisors, while others their department’s use. On September 12, 2017, the Board
of Superiors adopted County policy #13-08 establishing the
O
learned through social media
and website posts. All Employee Emergency Notification System (also known as M
employees with a County the “SB Safe Employee Alert System”) and associated
email address received operational guidance for use county-wide. The SB Safe M
Postmaster emails and had Employee Alert System can send text messages and/or
emails to County employees in the event of an emergency
U
access to CountyWire blog
posts, but those only worked if that potentially threatens the health and safety of County N
employees had access to and employees. Employees participate in the program by
were monitoring their email entering a mobile device number for text alerts and/or up I
accounts. Some employees, to two email addresses for email alerts. These modes of
contact are entered in the County’s payroll and
C
having no means to be
reached when not at their compensation system (EMACS) in a similar fashion as A
work computers or when not emergency points of contact. Employees are now asked
physically present, did not and reminded regularly to update their contact T
receive essential notifications information. The first widespread test of the SB Safe
Employee Alert System was successfully conducted on
I
(e.g., instructions for non-
essential personnel not to October 19, 2017 as part of the Great California Shakeout O
report for work on December drill with a follow up in March 2018 during the change to
rd
3 and 4 ).th
Daylight Savings Time. N
S
Modes of Communication and Information Dissemination
Communication with affected Department of Public Health (DPH) and Environmental Health
Services (EHS) Division staff and affected loved ones immediately following and in the months
after the attack was complicated for two main reasons:

1) Some communication devices had been left at the Inland Region Center (IRC), in
purses and on tables, when people evacuated the premises in the chaos of the moment.
Many of these items were damaged by the sprinkler system that had gone off in the
room where the attack occurred or became evidence and were not released for some
time while the law enforcement investigation was underway. Any communication with
these units went unanswered.

Narratives and Analysis 73

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

2) In addition, the tenacious media, in their desire to speak with victims’ families and
survivors, acquired personal phone numbers, email addresses, and home addresses; and
began hounding victim’s loved ones and survivors both in-person and remotely. As a
result, many individuals turned off or stopped answering their phones, emails, and
stopped reading their mail in an attempt to stop the onslaught.

As the County, including the EHS Division, DPH, the County Administrative Office (CAO) and
Human Resources (HR) Department among others, needed to communicate with the victims’
families and survivors, the above issues limited the modes and speed of communications. Those
County departments and divisions had to resort to the following tactics:
 Personal Networking – Many EHS employees used their personal relationships and
C personal contact information to relay information to each other. This initially included
O invitations to private gatherings at a personal residence, knowing who had been
physically impacted, or suggestions for handling the media.
M  Social Media – An EHS employee created a private Facebook page for EHS staff only
accessible via invitation. Information on funerals and other pertinent information was
M posted there. For nearly six months, EHS would email the Facebook page creator to
U request postings for upcoming events.
 Website – The County created a password-protected website (“EHS Support Site”),
N which EHS staff then maintained. The access information was emailed and sent through
regular mail to all EHS employees soon after the attack.
I  Mailings – The County developed a mailer template. The CAO would provide EHS with
C relevant information needing to be disseminated and EHS would add the information to
the template, reproduce, and mail the materials to applicable EHS employees. All
A mailed information was also emailed and then posted to the “EHS Support Site.”
 Email – All EHS employees retained their ability to access their work email accounts
T from home. This helped in some situations to provide employees with a continuous link
I to relevant information.
 Victim Liaisons – County Victim Liaisons that worked directly with victims and staff hand
O delivered written correspondence or verbally passed on critical information.39
N These actions, however, were not foolproof. Some intended recipients did not check their mail,
S others chose not to have a Victim Liaison assigned, some employees claimed they did not get
access to the password-protected website, and others were not aware of the online resources.
While labor intensive, this multi-faceted approach to information sharing was generally
successful. It respected confidentiality and utilized the trusted channels and sources of
information with which employees were most comfortable.

Reaching Intended Audiences…

The information needs of affected families and employees were diverse. Individuals were
receptive to information at different times, via different modes, and from different sources.
While the County attempted to provide messages multiple times and through multiple channels

39
For more information see narrative 4.1 Victim Liaisons on page 87.
Narratives and Analysis 74
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

(e.g., website, Victim Liaisons, emails, and mailers), it acknowledged that did not always mean
the messages were received or understood. In some cases, victims and/or affected families
desired more information than the County was able to share because of confidentiality or the
sensitive nature of the topic. As a result, some victims felt the provision of critical information
was overlooked. In other cases, information was received, but victims and families voiced
frustration about the source; namely citing that more information was not coming directly from
the Board of Supervisors, Chief Executive Officer, or Chief Operating Officer, but rather
Department personnel. The County also commented that information was not always
interpreted by affected families and survivors as the County intended. Communications under
such situations are challenging and the County learned significant lessons regarding how, when,
and what to communicate when emotions are high, topics are sensitive, and time is of the
essence. C
O
M
M
U
N
I
C
A
T
I
O
N
S

Narratives and Analysis 75

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
M
M
U This page is intentionally blank.
N
I
C
A
T
I
O
N
S

Narratives and Analysis 76

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

3.4 Public Information

The County Administrative Office (CAO) had two full-time positions dedicated to public
informationa primary CAO Public Information Officer (PIO) and a Deputy PIO, who worked
together as a team. The typical responsibilities of the CAO public information team were to
coordinate and support public information, media liaison, and external and internal
communications, provide advisory services, serve as spokesperson, and manage social media,
and websites specific to the CAO, the County’s executive leadership within the CAO, and public
information on behalf of the Board of Supervisors. Many County departments had their own
public information officers or teams as did each County Supervisor. Each of those had the
autonomy to coordinate and release information respective to their departments or offices.
The County Office of Emergency Services (OES) could activate a Joint Information System (JIS)
to coordinate public information efforts and messaging across County departments and with
C
other members of the Operational Area when conditions warrant. The OES did not activate a JIS O
or physical Joint Information Center (JIC) during the response to the December 2, 2015 terrorist
attack. As a result, this report will address only the public information activities that occurred at M
the County-wide level via the CAO. However, multiple department PIOs supported the
management and release of emergency information to the public during and immediately
M
following the terrorist attack; most notably the Sheriff’s Department public information team. U
As those efforts were associated with the tactical public safety response to the incident, they
are not addressed in this report, but can be found in The Police Foundation’s evaluation of the N
public safety response commissioned by the U.S. Department of Justice.40
I
At the time of the attacks, the CAO PIO had served the County for over sixteen (16) years, while C
the Deputy PIO had been on the job for two and a half (2½) years. However, the two had a close
working relationship that greatly enhanced their ability to deal with the incredible demands A
placed on them the day of the attacks and into the following weeks and months. During that
time, the CAO PIOs worked individually and as a team to: monitor the attacks to gain clarity on
T
the details surrounding the events at the IRC; keep the CAO, County Executives, and Board of I
Supervisors informed, and assist them with crafting public statements; disseminate accurate
information to families and co-workers seeking answers; disseminate accurate information to O
all County employees as events unfolded; and keep the media informed of County-level efforts
(including retweeting much of the information from law enforcement and first responders). The
N
Deputy PIO worked with other CAO staff members to help monitor traditional and social media S
and attempt to vet information.

The Day of the Attack

News of a possible active shooter in the City of San Bernardino first appeared on Twitter at
11:14 a.m. The City of San Bernardino Fire Department (SBFD) tweeted "SBFD responding to
reports of 20 victim shooting incident in 1300 block of S. Waterman." Because of her regular
monitoring of information sources related to the County, the Deputy PIO saw the tweet
immediately.

40
“Bringing Calm to Chaos: A critical incident review of the San Bernardino public safety response to the December
2, 2015, terrorist shooting incident at the Inland Regional Center” is available at: https://www.justice.gov/usao-
cdca/file/891996/download
Narratives and Analysis 77
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

The Deputy PIO immediately contacted the primary CAO PIO and the Chief Operating Officer
(COO) who were with three (3) of the Board of Supervisors in Monterey, California attending
the California State Association of Counties (CSAC) Conference. For the rest of the day, until the
PIO returned to San Bernardino at approximately 5:00 p.m., the Deputy PIO and PIO were in
regular contact with each other via text message, phone calls, and email. The Deputy PIO was
also communicating with the Sheriff’s Department, Department of Public Health and other
Board staff members.

At 11:18 a.m., the San Bernardino County Sheriff’s Department tweeted "Hard closure at
Orange Show Rd/Waterman and Park Center Circle in San Bernardino. AVOID THE AREA POLICE
ACTIVITY." A few minutes later, the Deputy CAO PIO received an email from the CEO’s Executive
C Assistant stating the Environmental Health Services (EHS) Division was having an off-site
O meeting at the Inland Regional Center (IRC) where the shooting had occurred. The email
misstated that EHS staff was unharmed when it had only been relayed that the DPH Director
M and Assistant Director who were present during the attack were safe.

M Twenty minutes later it became apparent to the Deputy PIO that County personnel had been
U targeted, when she received information from EHS staff members stating “one of our
employees got shot in the back but not killed” and “[DPH Director] reports two men with
N machine guns started shooting” though at that time, the Deputy PIO still had “no reports of any
employees dead.” At 11:48 a.m. ABC News sent a Tweet that twelve (12) people were dead. By
I 11:50 a.m. news outlets were reporting deaths at the scene.
C The Deputy PIO forwarded the information about the shooting at the IRC to the primary CAO
A PIO and COO in Monterey, as well as the CEO who was on-board his connecting flight to
Washington, DC from Dallas, Texas. The CEO asked the Deputy PIO to keep him informed as
T events unfolded.
I The first media calls to the CAO PIO office were received at approximately 11:43 a.m. The CAO
O PIO's office received over one hundred (100) calls in the next half hour. The Deputy PIO told
CAO staff receiving calls to direct all news media to the CAO’s Twitter handle, @CountyWire. 41
N This decision slowed the incoming phone calls, but according to the Deputy PIO, the media was
S frustrated because she did not have time to post much information to Twitter until mid-
afternoon.

In the hours following the attack, while law enforcement was still focused on tracking the
perpetrators, the CAO PIOs were pulled in different directions. The Deputy PIO was working to
confirm whether the victims were County employees and coordinating with hospitals to
determine the location of the injured and deceased. Meanwhile in Monterey, the CAO PIO was
helping to coordinate logistics for an emergency Board of Supervisors (BOS) meeting, drafting
and disseminating press releases on behalf of the BOS, and supporting efforts to get County
officials back to San Bernardino.

41
At the time of the incident, the County Twitter handle was @CountyWire. The County transitioned to a new
Twitter handle, @SBCounty, in April 2016.
Narratives and Analysis 78
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

At 12:06 p.m., the CAO's first tweet about the incident went out: "We are monitoring reports
from law enforcement about today's shooting and do not have any information to release at
this time."

By 12:15 p.m. (roughly an hour after first becoming aware of the attack), the CAO PIO office
began receiving calls from family members looking for information about their loved ones
believed to have been at the scene of the attack. This quest for information became a growing
problem because she did not yet have definitive information to share, but the people seeking
information were also her co-workers and friends, making it more difficult to not be able to
answer them.

At 12:31 p.m., the CAO Deputy PIO alerted the media that the Board of Supervisors would be C
having an emergency meeting in closed session at 1:00 p.m. during which they would receive a
briefing from the Sheriff. This meeting was attended by the CAO PIO.
O
M
The first official statement from the Board of Supervisors was released via Postmaster and
Twitter at 3:10 p.m.42 The statement, from the Chairman of the Board of Supervisors, M
announced that County employees who worked within the City of San Bernardino were being
sent home, but the County still had not officially confirmed that their employees were among
U
the victims. N
The shoot-out with the perpetrators occurred at 3:15 p.m. At 3:45 p.m., the Deputy PIO I
received a call from NBC asking to confirm if the perpetrator was a County employee. This was
the first time the Deputy PIO heard the perpetrator’s namethere had been no prior thought
C
that one of the shooters could be a County employee. At this time, the CEO, COO, primary PIO, A
and all executive staff were en route back to San Bernardino. The Deputy PIO decided not to
speak with the media again until she had communicated internally with her colleagues. T
At 3:55 p.m., the CAO PIO released a statement on Twitter confirming that the victims of the
I
attack were County employees: O
“This afternoon several County employees were inside the Inland Regional Center N
building in San Bernardino when the shooting occurred. Because this is an active law
enforcement investigation and out of respect for the victims and their families, the
S
County will not be releasing any more information at this time about our employees.
The County will be providing a multitude of services to help our employees and their
families with this horrible tragedy.”

By 5:00 p.m., the primary PIO was back in San Bernardino, physically working alongside the
Deputy PIO. She briefed him on the alleged identity of the shooter. During the next several
hours, the PIO and Deputy PIO continued to work to verify the facts of the shooting and work
with the CAO to identify the victims.

42
Postmaster is the name for San Bernardino County’s mass emails that are sent to all County employees.
Narratives and Analysis 79
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Just before 9:00 p.m. the PIO and Deputy PIO were told to evacuate the Government Center
because of a possible bomb threat. They relocated to the Sheriff's Department along with CAO
leadership, where the Board of Supervisors was about to hold another emergency Closed
Session. At 10:30 p.m. the Supervisors emerged from the meeting and announced that all
County offices would be closed for the remainder of the week with the exception of essential
services. The CAO PIO posted this announcement to Twitter, but then rescinded the tweet after
being told it was confusing. The decision was made that the notice of the closures would occur
within each department, with information flowing top down from the department head to the
rest of their staff.

The CAO PIO and Deputy PIO worked with the Chairman of the Board to prepare one final
C statement. Around midnight, the Chairman issued the following statement on Twitter,
O Facebook, and CountyWire:43

M “Words cannot describe the sadness and horror the Board of Supervisors feels in the
wake of this unimaginable tragedy. The county’s role and focus at this point is providing
M support and safety to our employees, their loved ones, and our community. For that
U reason, the Board of Supervisors tonight took action to suspend all but only the most
essential county services tomorrow, December 3, and Friday, December 4. The Board
N will do everything within its power to assist, provide services, and comfort everyone
affected by this traumatic event. Law enforcement has the county’s full support in its
I effort to address this incident, find out what happened and why, and bring those
C responsible to justice. I would like to thank Governor Brown for personally contacting
me to offer his condolences and support during this difficult time. The county is thankful
A for the support our agencies have received from the state, the federal government, and
our neighboring cities and counties.”
T
I PIO Surge Capabilities and Succession Planning…
Given the extreme time pressures they were facing at the time, the Deputy PIO had since
O expressed a desire to accept more of the offers of assistance from her colleagues. For example,
N the Deputy PIO assumed the PIO responsibilities for the Arrowhead Regional Medical Center
(ARMC), which did not have a PIO or communications plan at the time. It was an added
S responsibility that left her overwhelmed since the ARMC was receiving an equally high volume
of inquiries and requests from the media. The County Fire District’s PIO, experienced with
HIPAA and comfortable in high-media-demand environments, who offered to help that day,
could have taken on the role of ARMC PIO. In the mayhem of the day, however, the Deputy PIO
did not have the time to connect the dots. Planning for PIO surge capacity and also PIO
succession (in the case of the ARMC) may have eased the burden on the CAO PIOs.

Public Information in the Weeks and Months after the Attack

The CAO PIOs returned to work early the next morning. They were inundated with media
requests specifically seeking information about the perpetrator's employment at the County. At
4:00 p.m. on December 3rd, the Sheriff's Department issued a press release with the names of

43
CountyWire is the County of San Bernardino’s official blog.
Narratives and Analysis 80
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

the deceased victims (after notification to next-of-kin had been completed). Around the same
time, the County Counsel asked the CAO PIOs to refer any California Public Records Act (CPRA)
requests related to the shooting and the perpetrator to his office for review.

The Board of Supervisors and the CAO PIO office developed key talking points to convey the
message the County would take care of the victims, their loved ones, County employees, and
the community. The CAO PIOs also put together, with assistance from the Multimedia Services
Division of the Information Services Department (ISD), a video that conveyed this message to
County employees from the Board of Supervisors, and released it via YouTube.

Almost immediately, the media began directly approaching individuals associated with the
attack, including victims and family members of the deceased. The CAO PIO and Deputy PIO C
fielded interview requests and offered to help prepare any individuals planning for interviews.
Specifically, they worked individually with interviewees and also created a list of fifty questions
O
they believed the media might pose and accompanying answers so participating individuals M
would have a better sense of what was to come. They continued to assist in this capacity for the
more than two weeks the national media remained in San Bernardino. M
Several victims expressed to the CAO PIO and Deputy PIO that they did not want to be referred
U
to as “victims,” but as survivors. Others wanted the messaging to underscore that their loved N
ones were not “lost,” but were “taken.” The CAO PIOs worked to reinforce this messaging
strategy in their communications. I
The Deputy PIO was later tasked with coordinating with the Arrowhead United Way regarding
C
the fund established on behalf of the victims (see narrative 4.6 Donations on page 108 for more A
information). The CAO PIOs organized the press release and used their leverage with the news
media to get the media to widely publicize the fund. For example, the PIOs had a SB United T
Relief Fund poster made for press conferences to take advantage of the screen time. In
addition, the CAO PIOs required networks to show SB United Relief Fund information on the
I
news crawl at the bottom of the screen during interviews with family members and County O
officials when coordinated by the CAO PIOs.
N
The CAO PIOs scheduled the first major press conference related to the attack for the morning
of December 7th. Present at the conference were all five Supervisors, three of the doctors from
S
ARMC who had treated victims, and the Director and Assistant Director of the San Bernardino
County Department of Public Health, both of whom were in the room at the time of the attack.
The conference was covered by local and national media. The timing of the conference7:30
a.m.was set to coincide with the start of the first day for County employees returning to work
following the attack. As employees returned to work, the media were inside the Board
Chambers in the Government Center covering the press conference, allowing the employees to
enter in peace.

Additionally, the Director and Assistant Director of the San Bernardino County Department of
Public Health participated in over a dozen interviews with the media to help relieve some of the
pressure from the media on victims, their families, and EHS staff. Just on December 7, 2015
Narratives and Analysis 81
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

alone, they were interviewed by ABC, CBS, NBC, CNN, the Associated Press, and local print
reporters.

The CAO PIOs also took part in the planning of the “County Family Gathering,” helping to decide
who would be invited, who would perform and what access the media would have. Media
outlets were invited to the family gathering, but they had to register in advance and they were
not allowed access to the families or County employees. The CAO Deputy PIO also received
logistical and planning advice for the event after reaching out to a previous work contact in
Aurora, Colorado; a community that planned its own memorial service following the 2012
movie theatre mass shooting.

C The CAO PIOs continued to deal with issues related to the attacks for many months afterwards.
O They also worked to make sure the County was represented in follow-up stories. For example,
the CAO PIOs invited a trusted reporter to the January 14, 2016 Post-Incident Coordination
M Group Meeting so the behind-the-scenes hard work and efforts of the County to meet the
needs of those affected could get some coverage.
M
U In February 2016, the CAO PIOs handled media inquiries as to why the County was unable to
provide access to the perpetrator’s County-issued cell phone.44 Additionally, the County
N frequently was in the spotlight for over a year for issues related to Worker’s Compensation (see
narrative 4.4 Employee Benefits and Leave on page 99 for more information). At the time of
I this report, the CAO PIOs anticipated the media coverage would continue for years to come,
C particularly as other shootings and terrorist attacks occur, on anniversaries of the incident, and
as legal claims move forward.
A
The CAO PIOs faced an incredible challenge the day of the terrorist attack. Not only were they
T operating from separate locations, but they were responsible for disseminating information
I that was changing by the minute. Initially, they believed County employees were not involved.
As this initial assessment was quickly found to be inaccurate, the PIOs worked to piece together
O what had actually transpired. While doing so, they were fielding calls from emotionally
distraught friends and colleagues searching for news of their loved ones; putting the PIOs in an
N unusual and challenging position. Like all PIOs under similar circumstances, they struggled with
S incomplete and un-vetted information and had to navigate when and how it was appropriate to
disseminate information as the demand for it became insatiable. Although they were minimally

44
The County of San Bernardino provides every EHS inspector with a work phone. At the time of the attack, the
assailant was in possession of an iPhone 5C, which was running the newest version of the Apple's iPhone operating
system, which required a passcode and cannot be accessed by the Apple Corporation. Additionally, the phone was
configured to erase data after ten consecutive unsuccessful unlocking attempts.
Investigators from the FBI believed the phone might hold valuable information about the assailants' network of
connections and/or where the two may have traveled. The FBI asked Apple to create a new version of the
operating system that could be installed thereby overriding the security feature which erases data after ten failed
login attempts. Apple declined to comply and the FBI took the issue to court. On February 16, 2016 a United
States Magistrate Judge ordered Apple to supply the highly specialized software to the FBI. Ultimately, Apple
stalled and the FBI found an outside third party to unlock the phone and withdrew its request to the court.

Narratives and Analysis 82

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

staffed, the experience and teamwork of the CAO PIOs helped to ensure about as a good of an
information campaign as could be expected under the circumstances.

C
O
M
M
U
N
I
C
A
T
I
O
N
S

Narratives and Analysis 83

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
M
M
U This page is intentionally blank.
N
I
C
A
T
I
O
N
S

Narratives and Analysis 84

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Category 4: Employee Support

The County provided a variety of services to the victims of the terrorist attack and their
families. Since the County was both victim and responder, some of those services, like those
provided by the District Attorney’s Bureau of Victim Services and the County’s Department of
Behavioral Health, were provided to employees and the community. Other services were
provided only to County employees or the families of the deceased. The below table provides a
snapshot of the services administered by the County to support the victims of the terrorist
attack; both employees and the community. The six narratives in this category address the
services as they were provided to County employees or the families of deceased County
employees. Those services included establishing single points of contact to liaison with victims
E
and families on behalf of the County, the administration of State programs that offer support M
and benefits to the victims of crime, the provision of crisis counseling, the administration of
employment benefits and leave programs, including workers’ compensation, and the P
facilitation of donations to equitably benefit victims and survivors.
L
Services Administered by the County to Support Terror Attack Victims
County Services
O

Donations Management
Workers‘ Compensation
Counseling and Clinical

Y
County Victim Liaisons

Short-Term Disability
Contracted Mental

Specialized County
Employee Benefits
Health Counseling

Services/Benefits
DBH Community

Victims of Crime

Death Benefits
E
Services

E
Eligible Categories
Environmental Health Services (EHS) S
Division employees present at the X X X X X X X
attack U
Families of deceased County
X X X X X X X
P
County Employees

employee victims
EHS employees not present at the
attack; County employees co-located P
with EHS employees (LUS Code X X X X
Enforcement Division and ISD O
Multimedia Services Division)
Responding County public safety R
employees (e.g., Fire, Probation, X X X
Sheriff) T
All other County employees X X
Family of the deceased non-County
X X X
Non-Employees

employee victim
Those present at the IRC on 12/2/15 X X
San Bernardino residents affected by
the shoot-out between law X X
enforcement and the perpetrators

Narratives and Analysis 85

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

E
M
P
L
O
Y This page is intentionally blank.
E
E

S
U
P
P
O
R
T

Narratives and Analysis 86

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

4.1 Victim Liaisons

Within minutes of the terrorist attack, County executives anticipated the onslaught of
paperwork and bureaucracy that each victim and the families of the deceased would face as
they navigated issues ranging from official death notifications, workers’ compensation, medical
and death benefits, employment leave, funeral arrangements, crime victim services, etc. Not
only would the processes be extremely difficult and unfamiliar, but County executives
recognized the victims and families of the deceased would be confronting these issues while
facing extraordinary emotional and psychological trauma. County executives were concerned
the complexities of the process would cause additional trauma, frustration, and potential
delays and wanted to do everything possible to simplify and streamline the process. E
On the afternoon of December 2, 2015 the CEO relayed a concept to the head of the M
Department of Behavioral Health (DBH) for creating a victim liaison program to support victims P
with the many County programs now applicable to them. The County launched the
unprecedented Victim Liaison program the day after the attack on December 3, 2015. The L
program was inspired by, but did not necessarily replicate, the San Bernardino County Fire
Protection District’s (County Fire’s) Funeral Support Policy, which includes a single point of O
contact for victim’s familiespreferably someone with a history with the familyreferred to in Y
the County Fire policy as the Family Liaison Officer (FLO).45 Per the County Fire Funeral Support
Policy, the FLO serves as the single point of contact between County Fire and the family, E
supports the family with decisions regarding funeral arrangements, supports the collection of
information necessary for County Fire to process appropriate benefits/services, can make
E
notifications to life insurance companies and other entities, and advises the family of available
benefits/assistance.
S
Individuals selected to serve as Victim Liaisons were county employees from DBH, Children and
Family Services (CFS), and the Transitional Assistance Department (TAD). Victim Liaisons were
U
selected because they were identified as being organized, personable, and comfortable in high P
stress situations involving morbidity and mortality. The first team of Victim Liaisons was
established to assist injured employees and the families of the deceased. Twenty-eight (28) P
Victim Liaisons were selected. The team lead was a licensed clinician, but the liaisons came
from non-clinical positions, such as staff analysts and program specialists. These “Team One”
O
Victim Liaisons were deployed to the Family Assistance Center (FAC) established by the Federal R
Bureau of Investigation (FBI) on December 7, 2015 to meet with families for the first time.
T
After focusing first on the families of the deceased and injured survivors, the DBH and Human
Resources (HR) Department46 turned their attention to creating a second team of liaisons to
assist the Environmental Health Services (EHS) employees who were present during the attack,
as well as their co-workers throughout EHS and the Department of Public Health (DPH), and the

45
The single point of contact concept is used by many fire/rescue and law enforcement agencies, including the San
Bernardino County Sheriff’s Department and Fire Protection District.
46
The HR Department worked extensively with the Victim Liaison program. During the first month following the
attack, HR representatives debriefed with the first victim liaison team-lead on a daily basis to identify victim needs.
Narratives and Analysis 87
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Land Use Services Department.47 Thus, a second group of Victim Liaisons was established on
December 8, 2015. This team of an additional 29 Victim Liaisons was tasked with supporting
approximately 100 affected personnel.

As the program was established very quickly, there was initially insufficient time to develop
written guidelines, parameters, or procedures outlining the specific duties and expectations of
the Victim Liaisons. General parameters established by the team leads were as follows:

 Be available 24 hours a day, 7 days a week.

E  Assist program recipients48 with paperwork, death benefits, time cards, obtaining death
certificates, navigating support and resource systems/programs, and press inquiries.
M  Convey information about memorials, meetings, and available resources from the
P County.49
Victim Liaison Roles…
 Help with funeral arrangements, provide
L transportation to and from funerals, as well Both HR staff and the DA Victim
as other events and meetings related to the Advocates Office commented that, in
O attack. an effort to mitigate the burden on the
Y  Be available to provide program recipients victims, Victim Liaisons sometimes
any services and additional support, such as assumed a subject-matter expert role
E during funerals and trigger events (e.g., directly guiding program recipients on
subsequent terrorist attacks or shootings in how to complete paperwork and what
E the country, special occasions/holidays). programmatic options to select. In a
 Deliver well wishes, cards, offers of few instances, the paperwork was
support, and deliver donated goods to the completed incorrectly or inappropriate
S injured and deceased victim’s families that selections made and Victim Liaisons
were routed through the County. were advised to direct the recipients
U  Work with the District Attorney’s (DA’s) to the points of contact with the
P Victim Advocates and Claims Unit to requisite expertise to assist on specific
facilitate services available through the issues rather than provide direction
P Bureau of Victim Services (BVS) .50 themselves.
O Victim Liaisons were given cell phones to communicate with their program recipients beginning
R on December 8, 2015. At the conclusion of each liaison/recipient relationship, the cell phone
was returned to the County.
T
47
Some personnel from the Land Use Services Department shared office space with EHS staff, including those
injured and deceased.
48
The County referred to all program recipients as “victims.” However, not all victims chose to have a Victim
Liaison and not all direct and indirect “victims” were County employees. As a result, this narrative has used the
term “program recipient” to refer to those that received Victim Liaison services versus the collective “victims” so
there is no confusion regarding who is represented as receiving the support described herein.
49
HR initially set up a Victim Liaison password-protected website with information and resources of need to Victim
Liaisons. Later, HR provided the Victim Liaisons with access to an EHS website set up by the Economic
Development Agency where information was being posted.
50
See narrative 4.2 Victims of Crime Services on page 91 for more information on how Victim Liaisons coordinated
with the DA Bureau of Victim Services.
Narratives and Analysis 88
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Since no formal parameters were set for the Victim Liaisons program, each Victim Liaison had a
degree of latitude to determine what services to offer. County executives had very generously
told Victim Liaisons to do whatever those affected needed to ease their burden. Some Victim
Liaisons became more intimately involved in the personal lives of their recipients, providing
babysitting for children, shopping for birthday and holiday gifts for loved ones, decorating
homes for holidays, grocery shopping, and helping to paint homes.

Unfortunately, there was no formal feedback mechanism established by which program

recipients could report on the quality of the program or whether the relationship with their
assigned Victim Liaison was going well.51 Victim Liaisons were instructed to report to their team E
leader any concerns that were expressed by the program recipient. The team leaders would
then forward those concerns and questions to appropriate County departments to be M
addressed.
P
The Victim Liaisons program was originally envisioned as a short-term program under the L
assumption the need for liaisons would diminish in a month or two; a definitive termination
date was never established. By January 21, 2016, the first team was reduced to 14 liaisons, and O
further reduced to 11 by June 2016, and then to four by September 2016. On January 27, 2017,
the first team was completely retired when injured employees and the families of the deceased
Y
no longer had a demand for the service. E
The second team of liaisons was in place until the termination of the Victim Liaisons program in E
June 2017. On December 10, 2015, there were 29 liaisons on team two. As of January 11, 2016,
there were 8 active liaisons in team two and that number would remain constant for nearly 18
months, officially ending on June 5, 2017. At the conclusion of the program, there were still 8 S
liaisons working actively as part of the second team when the County determined the program
had fulfilled its purpose. U
In most cases, Victim Liaisons were pulled from their regular County work assignments to be
P
dedicated to their Victim Liaison function. All department heads whose departments provided P
Victim Liaisons mentioned they were able to balance assignments among remaining staff to
cover for the absence of the Victim Liaisons. While it was a challenge, it was seen as a critical O
service and other department staff was supportive and eager to contribute to the effort by
assisting with the workload. In addition, as Victim Liaisons were available around the clock,
R
many of them accumulated overtime pay. This provided a challenge for department leadership, T
who had to determine how time should be coded and how the Victim Liaisons would be
compensated.

51
As there was no formal feedback process in place for the Victim Liaison program, it is difficult to determine
satisfaction levels and the ultimate success of the program from the perspective of the program recipients. As the
demand for Victim Liaisons continued for 18 months, it is reasonable to assume many recipients utilized their
Victim Liaisons and found value in the program.
Narratives and Analysis 89
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Enhancing the Victim Liaison Program…

The County is to be commended for its selfless efforts to develop an innovative program to
expedite and improve communications with, and support to, more than 100 employee victims
and the families of the deceased. The Victim Liaisons became the embodiment of the County’s
efforts to “do whatever it takes” to support its employee family.

In general, program stakeholders commented that Victim Liaisons formed a compassionate

support system and were an effective point of contact for many of those affected and their
families. Had the County not instituted such a program, it is hard to know how or if program
E recipients would have been able to navigate the extensive and complicated bureaucracy
M associated with the programs they needed (e.g., workers’ compensation, death benefits, health
insurance, leave) while simultaneously dealing with physical and/or psychological/emotional
P trauma.

L However, as the County developed and ultimately continued the Victim Liaison program, it
O would have been useful for program administrators to seek further guidance from public safety
agencies to better understand their pre-existing models. The County public safety agencies
Y each have codified policies that clearly define the parameters of service, roles, and
responsibilities, which the County program lacked. At times this created confusion regarding
E program services and expectations and challenges with consistency and quality of service.
E Beyond the concept, the models upon which the Victim Liaison program was loosely built were
not referenced again.

In hindsight, there are several components the County could have considered that may have
S strengthened the Victim Liaison program:
U 1) Clearly defined program goals, parameters, and procedures. The responsibilities of
P Victim Liaisons were not clearly defined. Without clear guidelines, the liaisons provided
varied and sometimes inconsistent support to program recipients. Some Victim Liaisons
P experienced complications as they developed friendships with the victims that affected
O their objectivity. In addition, setting an anticipated end date for the program would
have helped manage the expectations of the program supervisors, the Victim Liaisons,
R the program recipients, and the departments lending their staff to serve as liaisons.

T 2) Program Recipient Information. It would have been beneficial to create a summary

reference document for the program recipients including information about the
purpose and parameters of the liaison program, who the liaisons were, their
responsibilities, and contact information for program leads to address questions.

3) Feedback Mechanism. The program lacked a mechanism by which program recipients

could offer feedback to ensure the Victim Liaison program was meeting their needs.
There was no process in place for recipients to express their positive experiences or
raise concerns to the County except through their Victim Liaison, which sometimes
presented an uncomfortable option.

Narratives and Analysis 90

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

4.2 Victims of Crime Services

The San Bernardino County Bureau of Victim Services (BVS) is part of the County District
Attorney’s Office and offers a wide range of services to those who have been the victim of a
crime. BVS support services include: crime-related crisis counseling; emergency services such as
food, shelter, clothing, medical care and transportation; orientation to the criminal justice
system; court support; special services to victims of sexual assault; and referrals for mental
health services. The BVS members that work with victims of crime are referred to as “Victim
Advocates.” The BVS also has a Claims Unit that helps victims of crime file claims and seek
compensation through the California Victim Compensation Board (CalVCB).
E
All victims of the terrorist attack were eligible for services from BVS. “Victims” included the
families of the deceased, the injured, those present during the attack (including approximately M
600 non-County personnel that were on-site at the IRC complex that day52), and residents living P
along San Bernardino Ave. where the shoot-out with the perpetrators took place. BVS
immediately assigned ten Victim Advocates to exclusively assist with the short- and long-term L
needs of the associated victims.
O
The California Victim Compensation Board (CalVCB) made immediate contact with BVS once it Y
learned of the incident. CalVCB provides compensation to victims of violent crime who are
injured or threatened with injury. Victims may be reimbursed for services including medical E
costs, income loss, funeral expenses, home security, mental health treatment, and other
matters on a case-by-case basis. CalVCB has a Joint Powers Agreement (JPA) with the San E
Bernardino County DA’s Office which enables the DA’s Office to process victim compensation
claims locally. The December 2nd attack was closely monitored by both BVS and CalVCB and
conference calls were scheduled between the two throughout the day to assess the situation S
and the potential needs of victims. Additionally, emergency claims processing procedures were
activated by both agencies. Two BVS Claims Unit staff were immediately assigned to work U
exclusively on claims from the terrorist attack, and they continued to be dedicated to P
December 2, 2015 claims processing as of the writing of this report.
P
The morning after the attack, the Sheriff’s Department requested Victim Advocates be
dispatched to the Coroner’s Office to accompany the Sheriff’s Department/Coroner Division O
and Federal Bureau of Investigation (FBI) Victim Specialists in the delivery of official death R
notifications to next-of-kin. The goal was to ensure information on available BVS and CalVCB
services would be immediately available to families as the notification was made. The BVS staff T
also traveled to various hospitals. The Victim Services Bureau Chief contacted local hotels to set
up direct billing accounts so BVS could provide temporary hotel stays for the loved ones of the
injured and deceased who would need lodging. Victim Advocates also provided purchase cards
to victims or their families for the various needs they presented: such as replacement eye
glasses, cell phones, key fobs, prescriptions, and clothing, among other items.

52
The IRC consists of a conference center, which is where the attack took place, and two other large stand-alone
office buildings where normal IRC business was taking place on the day of the attack.
Narratives and Analysis 91
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

In the days after the attack, Victim Advocates participated in the FBI’s Family Assistance Center
(FAC) and informed victims in attendance of available services. Victim Advocates attended both
FBI- and County-hosted meetings with victims to let them know about available services and
coordinate support through the BVS. As the relationship between the Victim Advocates and the
FBI evolved, in particular, the Victim Advocates found themselves serving as an intermediary
between the FBI and victims facilitating case updates, victim feedback, and access to personal
property.

Initially, BVS staff explained that few departments in the County knew they existed or what
E they did. As a result, it took some time and advocacy for BVS staff to work their way into the
appropriate groups. Ultimately, BVS came to coordinate extensively with other County
M departments. The Victim Services Bureau Chief regularly attended the Post-Incident
P Coordination Group meetings organized by the County Administrative Office (CAO) to report on
BVS activities related to the incident and to discuss victim needs. The BVS Claims Unit worked
L with the County Risk Management and Human Resources (HR) Departments on laws and
documentation requirements, and to coordinate compensation.
O
Y The Claims Unit helped victims request compensation from the CalVCB, including those who
wanted to complete the CalVCB application for funeral and burial assistance. Through CalVCB,
E compensation is available for "direct victims" (someone who is physically injured, threatened
with injury, or dies as a direct result of a qualifying crime) and "derivative victims" (usually
E family members or dependents of direct victims who are eligible for limited benefits). As of
October 2017, the Claims Unit had processed nearly 1,400 bills covering costs related to mental
health, income loss, home security, medical, relocation, and funeral/burial expenses for both
S direct and derivative victims.

U A substantial number of claims to CalVCB were related to income loss. County employee victims
P eligible for workers’ compensation could receive temporary disability compensation that
covered up to two thirds of salary losses. Compensation from CalVCB helped to make their
P paycheck “whole.” The BVS coordinated with the County’s HR Department to ensure employees
received full compensation and benefits without interruption. Of significance, the HR
O Department worked directly with the BVS to issue a single check for employees that integrated
R income from various sources, as opposed to multiple checks at multiple times from multiple
sources, which is the norm in comparable situations. At the time of the writing of this report,
T the Victim Services Bureau Chief and a representative from the HR Department continued to
hold bi-weekly case management meetings to support the ongoing coordination efforts
between the two groups (see narrative 4.4 Employee Benefits and Leave on page 99 for more
information). State law mandates employees are eligible for workers' compensation or
temporary disability benefits for up to 104 weeks in a 5-year period. Once employees reach
that limit, CalVCB became or would become the primary option for recovering lost wages.

CalVCB implemented multiple first-ever exceptions to their standard policies and practices for
San Bernardino victims as nontraditional victim expenses related to this incident would be
eligible for reimbursement through the U.S. Office for Victims of Crime (OVC) Antiterrorism and
Emergency Assistance Program (AEAP) grant. For example, many of the families exceeded the

Narratives and Analysis 92

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

funeral/burial limit of $7,500 allowed by CalVCB and also exceeded the workers’ compensation
limit. CalVCB reimbursed the additional costs right away. Additionally, the timeframe for
eligible direct victims to claim reimbursement for income loss was extended from two years to
five years for the first time. For derivative victims, the timeframe of eligibility was extended
from one year to two years, which also doubled income loss payments for derivative victims
from $63,000 for one year to a maximum of $126,000 for two years. At the time of this report,
CalVCB was still creating or adapting exceptions to its standard policies associated with the
terrorist attack.

The Victim Advocates also coordinated with various entities to arrange for donated items to be E
delivered to the families of the deceased and the injured victims. In order to ensure the items
were delivered, this effort was coordinated with the County Victim Liaisons (see narrative 4.1 M
Victim Liaisons on page 87 for more information). Victim Liaisons also assisted victims with the
collection of BVS forms and communicated victim needs to the DA Victim Advocates. Victim
P
Advocates also assisted the Arrowhead United Way with the administration of the “SB United L
Relief Fund” by reviewing applications for distributions to ensure they were legitimate (see
narrative 4.6 Donations on page 108 for more information). O
On any given day, the BVS handles a myriad of tasks and responsibilities as they support victims
Y
across the County. The BVS staff are trained on and have practical experience with trauma E
experienced in the aftermath of violent crime. However, addressing the magnitude of the
December 2, 2015 attack proved a challenge for even this group of victim service professionals E
due to the sheer number of victims. The response required an unprecedented level of
coordination with other County departments to navigate unmet victim needs, manage the
volume of claims, and adapt to changing policies and exceptions beyond normal statutory S
limits. The BVS team dedicated, and continued to dedicate at the time of this report, a
significant amount of resources to the processing of victim claims and to meet victims’ needs in U
a timely, compassionate, and professional manner.
P
P
O
R
T

Narratives and Analysis 93

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

E
M
P
L
O
Y This page is intentionally blank.
E
E

S
U
P
P
O
R
T

Narratives and Analysis 94

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

4.3 Emotional Support

Following the December 2, 2015 terrorist attack, the County of San Bernardino was confronted
with a traumatized workforce. Within hours of the attack, the County’s leadership, with
particular input from the County’s Department of Behavioral Health (DBH), recognized the
emotional consequences of the attack would be substantial. The County would go on to provide
a wide range of emotional and psychological support services both to County employees and
the greater community in the aftermath of the attack. The County regularly encouraged any
and all employees to anonymously take advantage of counseling services at any time they so
needed. Three entitiesone internal to the County and two externalwere crucial in the
delivery of emotional support services: the DBH and two private contractors, the Counseling E
Team International (CTI) which had a pre-existing relationship with multiple County
Departments, and the International Trauma Center (ITC).
M
P
Beyond the formal counseling services offered, many staff reported that they turned to each
other for emotional support for themselves and their families. This informal, peer-to-peer care L
became critical support for their emotional needs. In many cases, it was cited as being as or
more important than the formal counseling services. Many departments/divisions commented
O
on becoming closer as a group after relying on each other so intimately. It was frequently cited Y
as the factor that defines the San Bernardino County “family.”
E
Department of Behavioral Health
DBH's mission is to provide mental health and substance abuse services to residents (usually
E
underserved communities) of the County. DBH has ten Community Crisis Response Teams
(CCRTs), which are mobile teams comprised of counselors dispatched to respond to
emergencies that unfold within San Bernardino County. The CCRTs are on-call 24/7 and are S
funded through the California Department of Mental Health.53 Teams of three or four
counselors are able to rapidly respond and provide trauma assistance in the community. In
U
addition to the CCRTs, the DBH operates multiple Crisis Walk-In Centers (CWICs) across the P
county, some of which are open 24 hours. CWICs offer screening services for potential self-
harm or harm to others, psychiatric medication services, and referrals to other mental health P
resources.
O
DBH leadership and several staff members were in a weekly staff meeting when cell phone R
alerts notified them of the terrorist attack. Emergency procedures dictated that the multiple
DBH locations were to be locked down, including the Department’s headquarters one block T
from the Inland Regional Center (IRC). Members of the CCRTs not affected by the lockdown
immediately deployed to incident sites. Once the perpetrators were located, management and
additional counselors were sent to multiple locations including the Rock Church, Hernandez
Community Center, Hampton Inn, Arrowhead Regional Medical Center, and Probation
Department to provide crisis services to victims, families, and responders. Given the large scale
of the incident, additional DBH clinicians were called upon to provide support. By 3:00 p.m. the
day of the attack, DBH had coordinated and deployed over 100 therapists.

53
Funded through Proposition 63, the California Mental Health Services Act.
Narratives and Analysis 95
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

As part of the response to the attack, the DBH provided guidance to its therapists for their own
self-care, including information on the signs and effects of trauma, crisis hotline phone
numbers, and resources for coping with traumatic events. Numerous staff took advantage of
CTI services (see the next section) and critical incident stress debriefings offered by mental
health mutual aid from several neighboring counties. The DBH Public Information Officer (PIO)
provided information about available counseling services to all county employees via multiple
communication outlets, including social media, e-mail, and newsletters.

In the eight weeks following the attack, DBH arranged for 300 behavioral health professionals
E to service 10 County departments and 9 community organizations for 24 hour coverage. As with
many County departments, DBH staff members were spouses, friends, and co-workers of those
M injured or killed in the attack. The DBH staff had to navigate this unique circumstance while
P performing their duties. DBH employees reported the addition of intense media scrutiny,
abundance of funerals, and new security protocols compounded the emotional issues DBH staff
L had to overcome. Self-care became an important issue within the Department and it continued
to be as of the writing of this report.
O
Y The DBH also managed the Victim Liaison program (see narrative 4.1 Victim Liaisons on page 87
for more information) intended to help County victims and their families. While the liaisons
E functioned as more practical support, they were also tasked with providing information about
psychological counseling resources. Information regarding self-care, coping with traumatic
E events, and available counseling resources were also posted on the website set up for the
Environmental Health Services (EHS) Division, known as the “EHS Support Site.”

S The DBH and DPH also coordinated the receipt of mutual aid from the U.S. Department of
Health and Human Services (U.S. HHS) through the Substance Abuse and Mental Health
U Services Administration (SAMHSA). SAMHSA counselors were instrumental in providing
P guidance to EHS management on employee and supervisory expectations and the handling of
traumatized staff as employees returned to work. The SAMHSA services provided for five days
P of on-site counseling and training for EHS managers and would later lead the International
Trauma Center (ITC) contract discussed below.
O
R The DBH’s long-term recovery efforts for EHS and County employees included planned
community resiliency forums, post-trauma workshops, and supporting a Wellness Coordinator
T for EHS responsible for coordinating long-term counseling services and group sessions for
Division employees and Human Resources (HR) related paperwork. DPH and EHS developed the
job description, recruited, and hired the Wellness Coordinator position in February 2017.

Nearly two years after the attack, the DBH was still being engaged to provide support in
advance of anniversaries and other trigger events (e.g., other mass shootings). For example,
DBH responded again when a County employee was killed in the October 1, 2017 Las Vegas
mass shooting. During such events, the DBH also reached out to the community with counseling
opportunities, such as free drop-in mental health clinics and support groups.

Narratives and Analysis 96

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Counseling Team International

CTI is a private company specializing in psychological trauma and emotional support services to
law enforcement, fire/rescue, emergency services, and other governmental agencies. CTI's
mental health professionals had responded to major incidents across the country including the
Oklahoma City bombing, the September 11, 2001 terrorist attack on the World Trade Center,
and the shooting at Los Angeles International Airport that claimed the life of a Transportation
Security Administration (TSA) agent. CTI had contracted with the San Bernardino County
Sheriff’s Department for over thirty years, providing critical incident stress management
services after Sheriff-involved shootings and other traumatic events. CTI's on-call support was
available 24 hours. E
The day of the attack, County departments with existing relationships with CTI, including the M
Sheriff’s Department and District Attorney Bureau of Victim Services, reached out for support.
CTI responded immediately with available counselors and called in additional clinicians from
P
surrounding counties; setting up a command post for on-site critical incident stress debriefings L
and management (CISD/M).
O
On December 3rd, DBH requested additional assistance and resources from CTI to handle the
large volume of incoming crisis intervention and mental counseling requests. DBH also
Y
requested assistance in managing its crisis hotline, which was receiving an overwhelming E
number of calls. CTI established an additional hotline for County employees.
E
At the time of the attack, CTI was a known and trusted resource among County employees. CTI
counselors were present in and around many of the County departments to assist on an as-
needed basis, even in departments with which CTI did not previously have existing S
relationships. The HR Department’s existing contract with CTI was increased by $300,000 to
allow CTI to provide increased counseling county-wide and extensive counseling for EHS U
employees in particular.
P
The environment at EHS was unique. Some returning staff had been present at the IRC the day P
of the attack, others had not. Some were in the room when the shooting began, others were
elsewhere in the facility. Some dealt with the grief by returning to work quickly, others needed O
weeks, months, even years to recuperate. These differences created tension among staff. In
addition, there were many new hires, contractors, and mutual aid staff brought in to fill the
R
vacancies created by those on leave.54 Those initially unknown and/or revolving members of T
the staff made some returning EHS personnel feel uneasy. For more than a year following the
attack, CTI counselors maintained an on-going physical presence at the EHS offices five days a
week. Employees could avail themselves of the counselors any time they felt necessary. CTI
counselors also assisted the EHS managers with best practices for supporting traumatized staff.
In June 2017, CTI’s presence at the EHS Division went from 5 to 2 days a week and they
continued to be available as needed at the time of this report.

54
See narratives 5.4 Alternate Personnel on page 131 and 6.2 Reconstituting Employment Levels and Practices on
page 141 for more information.
Narratives and Analysis 97
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

CTI counselors also advised the County on the emotional repercussions that may be associated
with County policy decisions made in the aftermath of the attack. CTI assisted County
leadership in making specific policy decisions about the EHS Division’s alternate work space,
subsequent permanent renovations, and also assisted management with decisions about
employees returning to work.

International Trauma Center (ITC)

As part of a federal mutual aid agreement with SAMSA, assistance was offered to DPH by the
International Trauma Center (ITC). The trauma specialists initially provided 40 hours of
E dedicated management-level counseling services to DPH and EHS management. The success of
the initial program led the County to contract with ITC in May 2017 for a year of additional
M training support associated with trauma response and crisis counseling for DPH employees,
P with a focus on EHS. Through in-person seminars, telephonic and email contact, ITC provided
services to management and survivors to include:
L  Trauma assessments
 Group interventions
O  Seminars on trauma processing
Y  Training in post-traumatic stress management
 Skills for psychological recovery training
E  Treatment planning and ongoing recovery strategies
E Crediting Emotional Support Services…
The DBH’s experience in emergency response via its CCRTs allowed for a rapid, successful
S emotional support response. The use of the trauma professionals at CTI and ITC also supported
a successful program that was committed to the emotional well-being of not just victims and
U their families, but the County’s entire work force.

P The County is to be commended for the utilization of third-party counselors, especially to

P support the EHS Division most affected by the attack. While DBH clinicians were trained to
respond to crises, the nature of this event meant that the DBH clinicians were themselves
O emotionally impacted by the incident. The CTI and ITC counselors were not part of the “County
family” and were not colleagues of the EHS staff. Having the CTI counselors onsite and the ITC
R management level counseling services provided an additional message to EHS employees that
T the County was supportive of, and had prioritized, employees’ emotional health.

Narratives and Analysis 98

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

4.4 Employee Benefits and Leave

The County Human Resources (HR) Department administers a wide range of employee and
recruitment services and benefits. Approximately 100 HR staff members are responsible for the
needs of 22,000 County employees. Each County department has a dedicated Human
Resources Officer (HRO), in addition to representatives from its Employee Benefits Division and
the Department of Risk Management. Together, they work as a team to provide comprehensive
human resource services to each department.

The HR Employee Benefits and Services Division administers the County’s health, dental, vision,
and life insurance plans, as well as its integrated leave programs. There are a number of E
policies, procedures and guidelines that govern the administration of benefits for County
employees in the event of death, injury, or other circumstances. This report does not examine M
the “quality” and detail of the benefits offered by the County, but rather describes the County’s P
efforts to administer the benefits per policy following the terrorist attack, especially as it
pertains to coordination with other County departments and external organizations. The L
County has a robust benefits program and, partly due to the sheer size of its workforce, a very
experienced HR staff well-versed in administering benefits when an employee death or injury O
occurs. Y
Once the HR Department became aware of the attack on December 2, 2015, the priority E
became identification of County employees who were present at the Inland Regional Center
(IRC) as addressed in narrative 1.5 Personnel Accountability on page 33. At the same time, HR E
focused on ensuring County employees were able to access mental health services. The
Department of Public Health (DPH) HRO, for example, contacted the Counseling Team
International (CTI) to acquire additional counseling support for County personnel as described S
in narrative 4.3 Emotional Support on page 95. The HR Department also began assembling
customized packets of information on benefits and resources for families of the deceased, U
those injured, and those present at the attack. P
Benefits P
Following the attack, one of the primary goals of the County was to ensure survivors’ benefits
were uninterrupted while County officials determined next steps. The December 2, 2015 O
terrorist attack was unique for the County due to the number of County employees who were R
victims. County employees present during the attack were eligible for workers’ compensation
payments of up to two thirds of lost wages. Additional potential County sources of T
compensation and benefits for those employees included paid leave and short-term disability
programs. In addition, because the incident was a crime, employees were eligible to claim lost
wages and other impacts through the California Victims Compensation Board (CalVCB)
program, administered locally by the District Attorney’s Office. As a payer of last resort, CalVCB
helped to fill “gaps” left once all other payment sources had been exhausted (i.e., Workers’
Compensation paid up to two-thirds of an employee’s salary [taxable], but CalVCB covered the
remaining one-third [non-taxable])(see narrative 4.2 Victims of Crime Services on page 91).

The HR Department partnered with the District Attorney Bureau of Victim Services and
Department of Risk Management to ensure victims of the December 2, 2015 terrorist attack
Narratives and Analysis 99
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

continued to receive full compensation and benefits. They arrived at a novel solution in which
the County issued a single paycheck that covered each employee’s total compensation
regardless of the source of income; be it regular time, paid leave, workers' compensation, or
CalVCB. Traditionally, with multiple payers involved, victims would have received individual
payments from each source, each according to a different payment schedule and covering
different payment periods (see narratives 4.2 Victims of Crime Services on page 91 and 4.5
Workers' Compensation on page 105 for more detail on associated payments). In addition to
easing reconciliation burdens on the victims and ensuring a steady and predictable level of
income, administering a single paycheck through the County payroll system also ensured
E employee benefits such as paid leave and retirement credits continued to accrue. This
approach required significant effort on the part of the HR Department as the calculations could
M vary for each 2-week pay period and had to be reviewed and entered manually by HR staff.
P On the day after the attack, HR staff under the direction of the Employee Benefits Division Chief
L began gathering information on death benefits for beneficiaries of the deceased. HR
administered benefits included life insurance pay outs, continuation of health insurance
O benefits, deferred compensation, retirement medical trusts, cash out of leave balances, and
Y accidental death and dismemberment benefits.

E There were approximately 20 Environmental Health Services (EHS) Division employees not
present at the December 2, 2015 training event held at the IRC. Those employees were not
E eligible for workers’ compensation or CalVCB income loss benefits. However, those employees
were eligible to apply for short-term disability benefits through the County’s plan. EHS
employees who applied for short-term disability with the required doctor’s note for
S psychological trauma were all approved.

U Payroll
P On December 9, 2015, the HR Assistant Director sent out two memos regarding time reporting
for the pay period ending December 11, 2015one for non-EHS employees and the other for
P EHS Division and certain Land Use Services (LUS) staff that shared office space with EHS.

O The memo with time reporting instructions for non-EHS employees advised non-EHS employees
R to code regular time, “REG,” for hours actually worked on December 2, 2015 and code “EVAC”
for the remaining hours for personnel released from duty on that work day through Sunday,
T December 6 since non-essential functions were closed December 3rd - 4th. Employees who
were deemed essential and required to work were to code payroll code “REG” to record their
work time. Employees who were on pre-approved absences were to code the appropriate leave
category for those dates.

The memo with time reporting instructions for EHS and certain LUS staff would ensure
employee time reporting was completed, submitted and approved on behalf of all EHS and LUS
staff. Time was to be recoded as “REG” through 11:00 a.m. on December 2, 2015 and “EVAC”
for the remainder of the day through Sunday, December 6 th. Beginning on Monday, December
7th, the departments would use payroll code “EMLV” for the duration of excused absences for
those employees. For payroll processing purposes, both the “EVAC” and “EMLV” payroll codes

Narratives and Analysis 100

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

were treated as equivalent to “REG” time. Accordingly, employees were compensated in the
same manner for those hours as if they had worked regular time.

The time for deceased employees was coded on Wednesday, December 2, 2015 as “REG” until
11:00 a.m., after which the department used the payroll code “EVAC” through the end of the
day on Friday, December 4, 2015. Coding of the “EVAC” time resulted in deceased employees
receiving 41 hours of paid time, thereby ensuring continuation of health and dental benefits for
their dependents through the next pay period, ending December 24, 2015.

From the time of the incident through January 4, 2016 payroll coding for all EHS staff was E
inputted by DPH payroll specialists so EHS staff wouldn’t have to be concerned with how to
input their time using the various codes during the period of approved leave. M
Paid Leave
P
On December 11, 2015 it was determined that County-paid leave would be extended at least L
through December 21, 2015 for EHS employees and LUS staff that shared space with EHS. On
December 15, 2015, an item went before the Board of Supervisors, and was approved, O
authorizing the CEO to extend payment of salary and benefits for EHS and affected Code
Enforcement staff through early January 2016.
Y
E
On December 17, 2015, the Director of the DPH sent a letter55 to all EHS employees stating:
E
“Your well-being remains our greatest concern and County-paid leave has been
extended for you through January 3, 2016. We continue to understand that all
employees may not be ready to come back to work at the same time and I want to once S
again assure you that no employee will be required to return before they are ready.
Some of you have expressed an interest in returning to work before the exhaustion of U
your County-paid leave and we welcome your return.”
P
Few EHS employees returned to work on January 4, 2016. As every employee had an P
individualized plan, the HR staff worked to ensure all pay and benefits went through payroll in a
manner that ensured continuity, regardless of the source of the income or benefit. O
Paid leave was also covered for 3 spouses, one mother-in-law, and 3 sisters of injured/deceased
R
victims who were also County employees. T
Modified Work Schedules
Per County policy, departments reasonably accommodate modified duty requests for medical
reasons with a goal to return employees to work. This process is typically administered by
department management, but due to the impact on DPH and EHS leadership following the
December 2nd attack, the Human Resource Officers (HROs) were more heavily involved in
accommodating modified work requests. The EHS Division, with HRO support, attempted to

55
This letter was posted on the EHS website and the information was also shared with Victim Liaisons to relay to
program recipients.
Narratives and Analysis 101
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

accommodate every request, including modified duty (reduced work schedules or alternate
hours), transfers, and reassignments.

In accordance with County procedures, employees requesting a modified work schedule were
required to present a note from their doctor proposing the modified work schedule in the best
interest of the employee. Doctor’s notes were presented to a supervisor at EHS and the
requested restrictions, length of time, and type of accommodations were reviewed and,
whenever possible, approved.

E Dependent Health/Dental Benefits

An employee’s death, regardless of the cause, is technically considered a termination of
M employment and employee health and dental benefits expire the payroll period after
P employment is terminated. As such, the deceased victims’ effective “termination” date was
December 11, 2015 and their health and dental insurance coverage, including coverage for
L enrolled dependents, would expire on December 24, 2015 (end of the following payroll period).
The HR Employee Benefits Chief brought this to the attention of the County Chief Operating
O Officer/Interim HR Director and County Chief Executive Officer (CEO). On December 15, 2015,
Y the County Board of Supervisors authorized the County to make COBRA 56 payments on behalf
of the families as a temporary measure to ensure health and dental benefits were not
E immediately discontinued for dependents of the deceased. As of the writing of this report
(more than 2 years after the attack), COBRA payments from the County on behalf of six families
E still continued. The County’s cost for these payments to date had been deemed an approved
expense, eligible for reimbursement under the Antiterrorism and Emergency Assistance
Program (AEAP) grant administered by CalVCB. The grant provides for COBRA payments to
S continue for the maximum allowable period of three years (COBRA is available for the
continuation of coverage for three years when an employee dies [18 months under California
U law and an additional 18 months under Federal law]).
P Life Insurance
P The HR Employee Benefits Chief requested that the County’s life insurance carrier waive the
investigation process and the requirement that victim families' produce death certificates in
O order to qualify for death benefits. At that time, there was widespread publication of the
R victims’ names and the life insurance carrier agreed to this request. They quickly issued death
benefits to the families of the 13 deceased County employee victims based on a list provided by
T the County. The death benefit to the next-of-kin of the male perpetrator was still being
contested by the life insurance carrier at the time of this report.

Retirement
The San Bernardino County Employees’ Retirement Association (SBCERA) administers the
pension for retirement-eligible County employees. Because their deaths occurred in the line of
duty, the families of the deceased County employees were eligible for survivor retirement
benefits. Permanently disabled victims unable to return to work were also able to apply for
disability retirement through SBCERA. The HR Department served as an intermediary,

56
Consolidated Omnibus Budget Reconciliation Act (COBRA).
Narratives and Analysis 102
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

answering SBCERA questions as they arose. In addition, ensuring the payroll of affected
employees remained “whole,” also ensured employees continued to accrue retirement credits.

Non-County Benefits
The HR Department provided contact information for resources not administered through the
County. Deceased and injured employees were eligible for non-county benefits through County
Veteran’s Affairs and the U.S. Social Security Administration. The two labor unions representing
affected employees (i.e., Service Employees International Union [SEIU] and the Teamsters) also
provided support to many of the employees and their families. Among others, the State’s
Franchise Tax Board offered tax assistance and the California Department of Motor Vehicles E
offered support for the transfer of vehicle registrations.
M
Program Management
The magnitude of the attack and the sheer number of victims created a nearly overwhelming
P
task for those administering benefits. While sometimes constrained by County policy and L
outside provider/carrier restrictions, the HR Department’s commitment to the care and
recovery of the victims led the Department to implement some innovative tactics. For example, O
HR developed two matrices outlining the various benefits to which different categories of
victims were entitled to guide administration efforts (e.g., one for families of the deceased and
Y
one for those who were injured). E
By December 8, 2015, the San Bernardino County Economic Development Agency created, with E
collaboration from HR staff, a dedicated password-protected website, which became known as
the “EHS Support Site.” The support site had resources available for EHS employees in response
to requests for information related to workers’ compensation, expended leave, time off, time S
coding, and bereavement/grief policies and leave. HR staff also developed a Frequently Asked
Questions (FAQ) document to answer many common inquiries. The FAQ document was posted U
on the website and updated frequently. The team also posted information on funerals and
other memorials, tips for dealing with trauma, tips for handling the media, and information on
P
FBI resources for family travel. In addition, HR initially developed a separate website for the P
Victim Liaisons with similar information, though eventually Victim Liaisons were given access to
the “EHS Support Site,” ensuring both the Liaisons and EHS employees had the same O
information at the same time.
R
Formal information sessions were held for EHS employees in the months following the attack T
with staff from HR, County Administrative Office (CAO), Risk Management, BVS, Department of
Behavioral Health (DBH), and SBCERA to explain victim compensation claims processes and
victim benefits. Union representatives often attended these meetings as did counselors from
Counseling Team International (CTI) to provide emotional support. These sessions were created
after two employees expressed frustration and concern through their Victim Liaisons about
benefits and claims information being confusing. Victims and their families were struggling to
understand the enormous amount of paperwork, their eligibility, and the claims process. The
first session was held on January 17, 2016 for EHS staff and injured victims. Four additional
sessions were held for EHS staff: February 18, 2016, March 23, 2016, November 17, 2016, and
June 27, 2017. Two additional sessions were held for injured victims and their families:

Narratives and Analysis 103

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

February 8, 2016 and February 18, 2016. Each meeting started with a few words from County
leadership and then transitioned to presentations from subject-matter experts from the various
programs previously mentioned. At the conclusion of the presentations, panelists took
questions or stayed behind to answer individual questions. There were also multiple scribes at
each meeting to take notes, which were soon after turned into FAQ documents and made
available to EHS staff.

Through close inter-departmental collaboration, the County did its best to ease the financial
burdens and remove the barriers to benefits more common to benefits administration.
E However, the HR staff was in a challenging position, as they were frequently the first and
primary recipients of the victims' frustration. Despite every effort to be the "good cop," the HR
M staff was at times labelled the "bad cop;" a difficult label to bear in the midst of the good they
P believed they were trying to accomplish.

L Value of Formal Information Sessions…

O The interdepartmental formal information sessions were created in response to EHS staff
members expressing confusion over benefits and the administrative process. This was an
Y innovative approach to addressing the many concerns that were being posed by employees and
families. The department subject-matter experts agreed that communicating through a variety
E of channels, including these sessions, and at multiple times was the best way to ensure the
E victims had the information and understanding they needed. Likewise, the subsequent
development and distribution of FAQ documents was a further best practice.

S
U
P
P
O
R
T

Narratives and Analysis 104

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

4.5 Workers’ Compensation

Workers’ compensation was the primary means through which medical care and other benefits
were provided to County employees present at the work-related function that was the target of
the December 2, 2015 terrorist attack. The workers’ compensation program in California is
highly regulated and the authors of this report did not conduct a review of the program or its
implementation. A report specific to this topic was commissioned by the California Department
of Industrial Relations Division of Workers’ Compensation and is attached to this report as an
appendix: Department of Industrial Relations (DIR) Report on the Role of California’s Workers’
Compensation System in the San Bernardino Shootings.
E
The County’s Department of Risk Management administers the County’s workers’
compensation program.57 The County’s workers’ compensation program is self-insured and self- M
administered. As such, Risk Management staff is responsible for administering all claims. An P
employer is required to provide a workers’ compensation claim form to an injured worker
within 24 hours of becoming aware of a potential injury/claim and the injured worker has one L
year from the date of injury to initiate a claim. The Risk Management Department wanted to
ensure all those potentially eligible had a claim open even if they didn’t need it. So in the days O
following the attack, Risk Management initiated claims for the deceased, injured, those County Y
employees present at the attack, and eligible first responders (93 survivor claims, 13 deceased).
Risk Management staff contacted hospitals to determine the whereabouts of County E
employees and personally met with victims and their families at various hospitals to provide
workers’ compensation program information. They also contacted treating hospitals to discuss E
and authorize necessary medical treatment. Risk Management participated in the Family
Assistance Center (FAC) established by the Federal Bureau of Investigation (FBI) and at other
meetings to assist victims and/or their families with their claims. The Director of Risk S
Management also participated in the interdepartmental Post-Incident Coordination Group
Meetings led by the County Administrative Office (CAO), allowing for increased coordination U
and communication about the process and benefits eligibility. P
For approximately the first five months following the attack, the vast majority of employee P
claims were reviewed and approved within days by County claims administrators under their
existing authority. There were few complaints and the program’s recipients became O
accustomed to quick claims processing. However, the State of California requires every R
workers’ compensation program to have a Utilization Review (UR) process under which a third
party reviews proposed treatments to ensure consistency with guidelines established by the T
Medical Treatment Utilization Schedule (MTUS). If a proposed treatment is not determined to
be consistent with MTUS guidelines, it can be denied. Denials can then be appealed through an
Independent Medical Review (IMR) process administered by the California Department of
Industrial Relations Division of Workers’ Compensation. By April 2016, the claims and
treatments had reached thresholds that initiated the UR process, now inserting third-party
medical experts into the previously internal review and approval process for each claim. This

57
In July 2015, the County converted its workers’ compensation program from a self-insured cash basis to a
program with excess insurance purchased from CSAC-EIA (California State Association of Counties - Excess
Insurance Authority) by procuring a policy with statutory limits and a self-insured retention of $2.0 million.
Narratives and Analysis 105
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

added layer of review created frustration among many program recipients who wondered why
processing was now taking longer and why previously approved treatments were now being
questioned, and in some cases, denied.

The California Department of Industrial Relations received a number of complaints regarding

how San Bernardino County and the workers’ compensation system responded following the
attack. Victims’ concerns regarding the County and program made local and national news
headlines. In response, the Department of Industrial Relations initiated an investigation in
February 2017.
E
To help address this situation, the County contracted with third-party nurse case managers58 in
M January 2017 in the amount of $400,000. The nurse case managers were tasked with
P proactively addressing administrative matters, including ensuring paperwork was completed in
a timely manner pertaining to an employee’s case. The California Department of Industrial
L Relations investigation would later determine claims were typically delayed or denied because
employee physicians “…had failed to document or fully explain their requests” in the claims
O paperwork. As noted in the cover letter to the Department of Industrial Relations report, “the
Y County took the positive step of hiring a nurse case manager to serve as an ombudsperson to
help facilitate the presentation of treatment requests in a way that [would] satisfy the workers’
E compensation system’s treatment guidelines.”

E The Department of Industrial Relations’ report also found that of the total 2,146 treatment
decisions, 90% were approved and 3% received modified approval. The report concluded,
“…looking at the volume of treatment requests as a whole, denials or modifications of requests
S that did not fit within MTUS guidelines were clearly an exception to the overall pattern of
treatment requests being routinely accepted or approved through UR.” The County’s excess
U insurance carriers had also reviewed its case management decisions and came to similar
P conclusions.

P Through workers’ compensation, employees who experience wage loss are eligible for
temporary disability benefits for up to 104 weeks within a five year period. Eighteen (18)
O employees who had been off continuously since December 2, 2015, exhausted the 104-week
R limit at the end of November 2017. As of June 2017, the Director of Risk Management reported
workers’ compensation claims had incurred $23 million in total costs, of which the County had
T paid approximately $2 million.

Workers’ Compensation Process…

Workers’ compensation is a formulaic and highly regulated system in California. The behind-
the-scenes nature of many of the decisions can lead to misunderstandings and even foster an
environment of distrust. However, it was reported that Risk Management staff did their best,
working incredibly long hours, to ensure claim reviews were expedited. On numerous
occasions, staff members personally reached out to the treating and/or reviewing physicians to

58
The County had separate nurse case managers coordinating the medical aspects of employee cases since the
onset of the workers’ compensation claims process for the terrorist attack.
Narratives and Analysis 106
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

ensure treatments could be approved without delay or to find out-of-the-box solutions to

ensure continuity of treatment.

Additionally, it is worth noting the Department of Risk Management approved nearly every
claim without delay or question during the first five months after the incident. This may have
established expectations for employees that were not sustainable in the long-term. In order to
maintain the integrity of the program and to be responsible to its insurers and maintain
eligibility for future coverage, Risk Management felt it was necessary to ultimately employ the
more standard process that included the Utilization Review element.
E
M
P
L
O
Y
E
E

S
U
P
P
O
R
T

Narratives and Analysis 107

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

E
M
P
L
O
Y This page is intentionally blank.

E
E

S
U
P
P
O
R
T

Narratives and Analysis 108

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

4.6 Donations
Local and national organizations, as well as the general public, looked for ways to help the San
Bernardino community in the days and weeks following the attack. County employees fielded
offers of monetary and in-kind donations for the victims of the attack and their families, but the
County had no pre-existing protocols for accepting those donations at the time.

Due to the many logistical and policy challenges involved with accepting and distributing
donations directly to victims, County officials acted as liaisons between donors and victims and
their families.59 Donors frequently turned to the County for help identifying the victims and
sought their contact information. Given the media attention and privacy requirements the E
County, specifically the Human Resources (HR) Department, was neither allowed nor inclined to
disclose employee contact information. Additionally, determining who qualified as a “victim” M
posed a significant challenge to all involved as there were many victims within and outside the P
County organization: the deceased, the families of the deceased, the injured, those who
witnessed the attack, and the first responders. L
Monetary Donations O
Offers of monetary donations began immediately following the terrorist attack. However, there Y
was no practical mechanism in place by which the County could receive donations and then
distribute them to individuals. Additionally, the County is not a qualified 501(c)3, which would E
allow donations to be tax deductible, so finding a mechanism for the County to do so would
have complicated the donations’ tax-exempt status. As a result, the County administrators E
collaborated with the Arrowhead United Way (AUW) to establish the “SB United Relief Fund;”
the largest of the funds established in the days following the attack.
S
SB United Relief Fund
Following the attacks of December 2, 2015, the AUW was prepared to establish a relief fund for U
the victims of the attack. AUW reached out to the County Board of Supervisors via the County P
Administrative Office (CAO) Public Information Officers (PIOs) for approval of their press release
language prior to publicly announcing the fund. At the same time, the County had been P
approached by institutions around the country wanting to donate. The County made the
decision to partner with the AUW and direct all donation inquiries to it. The AUW had O
previously established funds and a long-term recovery committee to support San Bernardino R
communities after major fires in 2003 and 2007. This pre-existing relationship was a great
benefit in the early days after the attack. T
The AUW staff was initially concerned about the complexities of managing the primary fund for
monetary donations for a tragedy of this nature. Additionally, it was outside the United Way’s
normal fundraising practices to raise money that would be distributed to individuals without
being administered by a separate charity. However, according to AUW President/CEO Doug
Rowand, an exception was made because the attack was determined to be an act of terrorism.

59
The County was the direct recipient of a $25,000 donation from the Robert Wood Johnson Foundation to be
utilized for the support of County employees who provided aid to the victims and families impacted by the
December 2 attack.
Narratives and Analysis 109
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

The SB United Relief Fund was launched two days after the attack on December 4, 2015. A
week later, on Friday, December 11, 2015, the County HR Department added the SB United
Relief Fund as one of its eligible charitable organizations for combined giving, thereby allowing
County employees to donate directly through payroll deductions. Ultimately, the fund raised
and distributed more than $2.5 million.

Oversight for the SB United Relief Fund was ultimately conducted by a fifteen-person volunteer
committee, chaired by former City of San Bernardino Mayor Patrick Morris. Before the
committee had even assembled, the AUW Board of Directors heard from members of other
E communities who had been victims of terrorism. Their advice was to make some of the money
raised available to victims immediately. By the time the oversight committee convened in
M January 2016, the fund exceeded $2 million. The AUW suggested an immediate $5,000
P allocation to families of those who had been killed in the attack, but some County officials
voiced caution about distributing funds without having a full picture of the needs of victims. To
L balance these concerns, the AUW Board approved the release of up to $10,000 for each family
of a deceased victim if the family requested funds and demonstrated a financial need in the
O months before the fund was ready to distribute the donations. County Victim Advocates from
Y the District Attorney’s Office assisted the Fund Committee with the review of the applications.
Any funds distributed in the early release would be deducted from the final amount decided
E upon, and families would still have to demonstrate need. The final amount distributed on an as-
needed, case by case basis, in the immediate term was $21,821.43.
E
The Committee met every two weeks from January 2016 until the fund was exhausted at the
end of March 2016. In addition to former Mayor Morris, Committee members included County
S employees, tribal representatives, community leaders, labor union representatives, and law
enforcement representatives. In addition, while not a Committee member, a representative
U from the Bureau of Victims Services at the District Attorney’s Office was consulted as a resource
P on a regular basis regarding victims’ needs. See the listing below for a full accounting of SB
United Relief Fund Committee members.
P
SB United Relief Fund Committee Members
O  Kara Adams – VP of Marketing, Altura Credit Union
R  Dr. Joshua Beckley – Senior Pastor, Ecclesia Christian Fellowship
 Bill Carnegie – President and CEO, Feeding America Food Bank Riverside/San Bernardino
T  Taif Kaissi, MD – VP & Executive Director, MiNDS
 Ray King – Captain, San Bernardino Police Department
 Steve Kovensky - Deputy Chief, San Bernardino County Sheriff’s Department
 Keith Lee - Arrowhead United Way Board Member
 Patrick Morris - Former Mayor, City of San Bernardino, Retired Judge
 Vici Nagel - President/CEO, Academy for Grassroots Organizations
 Ken Ramirez - Tribal Secretary, San Manuel Band of Mission Indians
 Deidre Rodriguez - General Manager, Teamsters Local 1932
 James Siva - Tribal Council Member, Morongo Band of Mission Indians
 Dena Smith - Chief Operating Officer, San Bernardino County

Narratives and Analysis 110

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

SB United Relief Fund Committee Members

 Laurie Stalnaker - Secretary/Treasurer, AFL-CIO Central Labor Council
 CaSonya Thomas - Director, Behavioral Health, San Bernardino County

The Committee also solicited advice from communities and organizations representing the
Newtown/Sandy Hook, Virginia Tech, Boston Marathon, and 9/11 attacks, and consulted and
received advice on their final strategy from Ken Feinberg, a Washington attorney recognized for
his work in victim’s compensation plans.

On March 30, 2016, in an open meeting, the Committee announced their plan to divide the E
$2.5 million raised by the fund. Eighty percent (80%) of the amount raised went to the families
of the deceased (approximately $141,000 per victim), 15.5% was allocated to those injured M
($5,000 plus an additional $1,000 per overnight hospital stay) and the remainder went to those P
who were present at the time of the attacks. Audited financial statements from the SB United
Relief Fund, as part of AUW disclosures, show that a total of $2,522,095 was distributed to L
victims and families during the fiscal year ending June 2016. The remaining $45,145.59 was paid
out the next fiscal year, ending in June 2017. One hundred percent (100%) of the funds O
collected were distributed to victims. Y
Other Monetary Donations E
Local union chapters, neighboring cities and counties, and individuals also set up funds to help
the victims and their families. County officials were not involved in helping third parties make E
decisions, but County employees often acted as liaisons between victims, their families and the
multitude of funds to help communicate victim needs to the fund managers. In an effort to
ensure “no stone went unturned,” the County frequently suggested that victims reach out S
directly to fund sponsors for assistance, particularly in situations where the fund or activity
sponsor was better positioned to meet a specific victim need. U
P
Unions and Professional Associations
Two local union chapters also set up relief funds after the attack. Service Employees P
International Union (SEIU) 721 and Teamsters Joint Council 42, the parent body to Teamsters
Local 1932, each established funds in the name of the victims to address the long-term needs of O
the victims and their families. These funds were often used to supplement traditional sources. R
The County HR Department and the District Attorney’s Office’s Victim’s Advocates were used to
facilitate communication between the unions and recipients of funds when appropriate. T
The CAO and HR Department fielded inquiries from family members looking for monetary
assistance for their lost wages while taking time off to care for victims. Human Resources liaised
with SEIU to communicate those requests. County representatives were not involved in
decisions regarding the distribution of the union funds.60

60
The amount of money raised and how it was distributed was not documented by the County, nor investigated as
part of this report. It was noted in Post-Incident Coordination Group meeting minutes that as of November 2016,
the SEIU fund had raised $215,000.
Narratives and Analysis 111
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

As the professional association for the County’s Environmental Health Services (EHS)
employees, the California Environmental Health Association (CEHA) established a relief fund
that raised over $50,000 as of July 2016. The EHS Division and County HR Department were
aware of the relief fund and suggested it as a funding source to victims and their families, but
were not involved in the management or distribution of those funds.

Crowdsourcing
A number of individuals established “GoFundMe” or other crowdsourcing accounts set up in
the names of victims or families of victims. One of the largest was set up by the City of San
E Bernardino’s Mayor, Carey Davis, who raised over $136,000. At the time of the writing of this
report, the only available information regarding that fund stated the funds were to be split
M evenly among the victims and their families.
P In-Kind Donations
L Within hours of the attacks, local businesses and organizations responded with donations of
food and water for first responders, witnesses and family members. In the months after the
O attack, tangible items and memorial tributes were offered to the County and the EHS Division.
Y Individuals throughout the County fielded these offers, including individuals from the CAO,
CAO’s Public Information Office, Department of Public Health, EHS Division, and the Board of
E Supervisors.

E Food and Water Donations

The first donations were food and water for the first responders, victims and witnesses, which
were received and coordinated by first responders at the scene of the attack and at the
S locations set up for victims/witnesses and family members.

U In the months that followed the attack, the EHS Division continued to receive offers and
P donations of food. Because EHS is responsible for reviewing and grading restaurants for health
code compliance, EHS had a stated policy of not accepting donated food from any sources as it
P may be construed as a conflict of interest. However, following the attack, the Department of
Public Health allowed individuals and groups to donate food to EHS. These were coordinated by
O EHS Division managers who reported that donated food boosted morale for employees and
R offered an opportunity to gather and provide emotional support to each other as they returned
to work. However, the job of coordinating these donations fell to those in EHS whose time was
T already taxed in the understaffed division.

Other Items/Tribute Events

As the emergency response transitioned into long-term recovery, the in-kind offers became
more difficult to accept and coordinate. Several agencies were accepting offers without
communicating with each other and many groups were attempting to engage the victims as
participants or honorees at events. In late January 2016, an important informational meeting
for victims and their families was scheduled at the same time as a high-profile tribute event
with the Los Angeles Dodgers baseball team. The conflict led the CAO to assume responsibility
for verifying and communicating donations and tribute events.

Narratives and Analysis 112

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

A Principal Management Analyst in the CAO was identified as the primary point of contact for
donations and tribute events. The Analyst was tasked with clarifying and verifying the offers/
events and communicating them to EHS management which in turn, communicated the offers
to the victims and EHS staff.

Additionally, the County received the famous “Comfort Quilt,” which was created by
schoolchildren from St. Hilary School in Ohio to be sent to a school in New Jersey following the
attacks of September 11, 2001. Since then, it has traveled the country to bring comfort to
communities recovering from tragedy. It was sent to San Bernardino County from Umpqua
Community College where a previous mass shooting had taken place. The County initially had E
some concerns about formally accepting and displaying the quilt because of its religious
connotations, but did not have long to determine the best course of action before the Pulse M
Nightclub tragedy occurred in Orlando, Florida in June 2016 and the Comfort Quilt was then
forwarded to the Mayor of Orange County, Florida.
P
L
A painting by artist Calvin Canepa and bronze plaque commissioned by the California State
Association of Counties and the County Administrative Officers Association of California was O
also accepted by the County and now hangs on the second floor of the County Government
Center near the EHS Division offices.
Y
E
Tribute events included invitations to victims to attend sporting and/or art events as honored
guests. The County vetted and shared the information with the EHS Division, which in turn E
published them as an internal Public Health news release and posted information on the events
to the “EHS Support Site.”61 The County did not coordinate attendance and gave no
recommendation on acceptance or attendance to invitees. In the fall of 2016, as the one year S
anniversary of the attacks approached, a new wave of offers and tribute events were received.
U
The following events provide a representative sample, but are not inclusive of all, the tribute
events which were offered and continued to be offered through the date of this report’s
P
publication: P
 Los Angeles Kings hockey team breakfast and skate-around for families of the deceased.
 NASCAR Sprint Cup grandstand seats for families of the deceased. O
 2016 Annual Peace Choral Festival to honor victims of the attack. R
 “SB Strong” night at an Inland Empire 66ers baseball game with proceeds donated to
the AUW relief fund. T
 IRC Awards Ceremony honoring first responders and their actions on the day of the
attack. This was sponsored by San Bernardino law enforcement agencies with
preferential seating for EHS staff and family members.
 A National Crime Victims’ Rights Week Memorial sponsored by the SBC DA’s office.
 Bridges of Grief from Shadows of Grief event in November 2016 to promote peace and
community understanding as the community approached the first anniversary of the
attack.

61
For more information see narrative 4.4 Employee Benefits and Leave on page 99.
Narratives and Analysis 113
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

 Service of Remembrance sponsored by the Diocese of San Bernardino to mark the first
anniversary of the attack.
 City of San Bernardino Mayor’s event to mark the anniversary and honor those affected.
 “Planting Day” for the Hal Bowman healing grove memorial approved by the Upland City
Council and Public Works Division.
 A barbeque fundraiser sponsored by the Fontana Police Department.
 A LifeStream Blood Bank blood drive to mark the first anniversary of the attacks.

The County’s Donations Experience…

E The County did not have a pre-existing policy defining its potential donations management role
M following an emergency. Decisions with regards to donations quickly overwhelmed the people
tasked with making these decisions. At first, in-kind donations were directed to EHS Division
P staff under the assumption they would know best how to distribute them. For a Division that
was already understaffed and burdened with other mattes, this became an additional
L challenge. Later, CAO staff became involved to help manage some of this burden and this
O seemed to alleviate the concern.

Y It may have been beneficial for CAO staff, or another group, to manage in-kind donations
earlier and, looking ahead to the next emergency situation, appoint a person or position to
E manage donations and create policy/guidelines regarding acceptable and unacceptable
E donations. Conversely, the County could have also made the decision not to be involved in the
distribution of in-kind donations, much as it did for monetary donations. There is no single
policy that would have been ideal, but it may have been useful for everyone that was contacted
by potential donors to have guidelines for managing the donations process.
S
U
P
P
O
R
T

Narratives and Analysis 114

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Category 5: Continuity of Operations

Of the six topical categories addressed in this report, continuity of operations (COOP) is the
most cut and dried. There are generally accepted national and international standards for C
establishing, maintaining, and evaluating continuity programs,62 which were cited in narrative
2.1 Department Emergency Operations Plans (DEOPs) on page 41. Likewise, that narrative
O
previously addressed the status of the County’s intended continuity plans. This category N
reviews the County’s implementation of continuity treatments to ensure the continued
performance of essential functions in the midst of and following the terrorist attack. The four T
narratives in this section will address succession planning and delegations of authority as many
County and department leaders were out of the area on the day of the attack or were directly
I
affected by the attack, the status of essential functions affected by the attack and efforts to N
fully recover capability levels, and the application of alternate facilities and alternate personnel
as strategies to sustain operations. The final topical category in this report (Category 6: U
Organizational and Financial Recovery) addresses the ongoing efforts to transition the
organization from a state of continuity to a new steady state.
I
T
5.1 Evolution of Leadership (Succession and Delegations of Authority)
At the time of the attack on December 2, 2015, a large number of San Bernardino County’s Y
senior officials were out of the area. The Chief Executive Officer (CEO) was en route to
Washington, DC and was on a layover at the Dallas/Fort Worth International Airport ( 1,200
miles away). Three (3) members of the Board of Supervisors, the Clerk of the Board, the O
County’s Chief Operating Officer (COO), and the County Administrative Office (CAO) Public
Information Officer (PIO) were at a conference in Monterey, CA ( 370 miles). The Chief of the F
Fire Protection District was at another conference near San Francisco, CA ( 430 miles) and
other department heads were scattered at various meetings, trainings, and assignments
throughout Southern California. Those who were in Southern California returned to their posts O
as quickly as possible. Those traveling returned either that evening or by the next morning.
Present during the attack, the Director and Assistant Director of the Department of Public P
Health (DPH) and the Environmental Health Services (EHS) Division’s Program Managers (one of E
whom was acting as Interim Division Chief), Interim Program Manager, and Program
Coordinator returned to workor made themselves available if taking leavebut were R
consumed with extraordinary matters resulting from the attack. In a number of the above
cases, lines of succession were implemented authorizing formal delegations of authority where
A
they existed. As an essential element of continuity planning and emergency preparedness, this T
section will discuss the County’s succession and delegation capabilities at the time of the attack
and will explain how they were implemented. I
Board of Supervisors
O
As previously mentioned, three of the elected members of the Board of Supervisors (BOS) were N
attending the California State Association of Counties (CSAC) Conference in Monterey, CA while
the remaining two were attending a regularly scheduled meeting locally within the County. S
62
This section applies technical continuity terminology used in Federal Emergency Management Agency’s
Continuity Guidance Circular, the Disaster Recovery Institute (DRI) International 10 Professional Practices, and
International Standards Organization (ISO) 22301.
Narratives and Analysis 115
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Although three of the BOS members were out of the area at the time of the attack, they
retained their authority and no delegation was required.
C Upon notification of the terrorist attack, the two BOS members who remained local returned to
O the County Government Center with the Deputy Sheriff who had escorted them to the meeting.
Those in Monterey assembled in a hotel conference room and joined the others and County
N executives via conference call for a Closed Session with the Sheriff at 1:00 p.m. At that time,
T they were able to waive County policy prohibiting more than two BOS members from traveling
together, in order to facilitate their rapid return to the County. The Sheriff’s Department
I dispatched one of its fixed-wing aircrafts to Monterey to pick up the BOS members and the CAO
PIO.63 Each BOS member individually monitored the situation and communicated with his/her
N staff.64 The fact that delegations of authority are not permitted for BOS members was not a
U concern during this incident because the BOS members were in communication with relevant
stakeholders the entire time.
I
County Administrative Office (CAO)
T On December 2, 2015, the CEO was traveling to Washington, D.C. as a Fellow for the National
Y Academy of Public Administration. At the time of the attack, the CAO had an established line of
succession for the Chief Executive Officer (CEO) codified in the Office’s 2013 Emergency Plan as
follows:
 Deputy Executive Officer (DEO) for Special Projects65
O  Assistant Executive Officer (AEO) for Finance and Administration, in the absence of the
F DEO Special Projects
 County Chief Financial Officer (CFO), in the absence of the DEO Special Projects and AEO
 Director, Office of Governmental and Legislative Affairs (GLA), in the absence of the DEO
Special Projects, AEO, and CFO
O  Public Information Officer (PIO), in the absence of the DEO Special Projects, AEO, CFO,
P and Director of GLA
 Principal Management Analyst, in the absence of the DEO Special Projects, AEO, CFO,
E Director of GLA, and PIO
 Deputy Executive Officer (DEO), Finance and Budgets, in the absence of the DEO Special
R Projects, AEO, CFO, Director of GLA, PIO, and Principal Management Analyst
A
Succession was regularly planned and activated weekly as senior officials of the County
T traveled, were on leave, or were unavailable for other reasons. Notice of this particular
activation of the line of succession was communicated via memo prior to the CEO’s departure
I on December 1, 2015, indicating the AEO for Finance and Administration would be “acting on
O
63
N The Sheriff’s Department’s aircraft only had capacity for four passengers. It was deemed essential for the Board
members and the PIO to return the soonest. The COO and the Clerk of the Board returned by car together and
S arrived late that night. They remained in communication with County executives during the drive.
64
One local BOS member had a Sheriff’s Department radio that was retained from a prior assignment and was able
to keep apprised of the situation using it. Otherwise, no radio or alternate communication methods were provided
to the BOS members at the time.
65
On December 22, 2015 the CAO Emergency Plan was updated to replace the DEO for Special Projects with the
Chief Operating Officer (COO).
Narratives and Analysis 116
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

my [the CEO’s] behalf while I’m out” because the Deputy Executive Officer for Special Projects
was also scheduled to be out of town during that time. The memo was sent to the Board of
Supervisors and copied to the department heads of the following:
 Arrowhead Regional Medical Center
C
 Community Services O
 County Administrative Office, DEO for Special Projects
 County Counsel N
 County Fire T
 Finance & Administration
 Housing Authority of the County of San Bernardino I
 Human Services
 Inland Counties Emergencies Medical Agency
N
 Land Use Services Department U
 Probation Department
 Public Defender I
 Public Works Department T
 Real Estate Services Department
 Special Districts Department Y
Per the CAO’s Emergency Plan, “authority for daily operational decisions” was thereby
delegated to the AEO for Finance and Administration. Although two BOS members remained in O
their offices at the County Government Center for much of the day, the Acting CEO stated she
was unaware of their presence and no consultation with them occurred or was deemed F
necessary. Similarly, those two BOS members, despite receiving the memo from the CEO
regarding his absence, stated they were unaware of the delegation of authority to the Acting
CEO. Immediately upon acquiring knowledge of the terrorist attack, the CEO suspended his trip O
mid-route and made plans to return to San Bernardino. While on his return to San Bernardino,
the CEO continued to guide operations, such as directing the decision for employees in County P
buildings within the City of San Bernardino to remain indoors and later the release of
employees for the remainder of the day on December 2, 2015. The AEO for Finance and
E
Administration was Acting CEO from December 1st until approximately 5:00 p.m. on December R
2nd when the CEO returned to the County.
A
Delegations of Authority…
T
During discussions with County executives for this report, none were completely clear regarding
which authorities were specifically granted to them during times of succession. This could I
potentially be linked to the ambiguity of the delegation language: “authority for daily
operational decisions.” If “daily” implies “typical” then certainly nothing that happened on
O
December 2, 2015 was typical and the person delegated authority would not be empowered to N
act. If “daily” implies “anything that occurs on a given day” then perhaps it conveys greater
authority. Likewise, “operational” decisions may not include policy, strategic, fiscal, or other S
decisions. The language seems like it was clearly selected to convey limited authority, but to
what degree is unclear. Formal delegation letters/protocols should be developed that clearly
identify the authorities successors are granted, to what degree, and for how long.
Narratives and Analysis 117
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Department of Public Health (DPH)

In the days that followed the terrorist attack, the DPH Director and Assistant Director, who
C were both present in the room during the attack, did not take time off from work. However,
their time was occupied with visiting the injured, attending funerals, serving as a liaison
O between the County and affected personnel, engaging with the media, self-care, etc. For all
intents and purposes, they were available, but absent from their normal administrative and
N operational responsibilities. At the time of the attack, the established line of succession for the
T department codified in the Department’s 2011 Emergency Plan was as follows:
 DPH Director
I  DPH Assistant Director
 DPH Health Officer
N  DPH Division Chief of Nursing
U  DPH Chief Medical Officer
 DPH Chief Financial Officer
I
Per the DPH Emergency Plan, designated successors have complete authority to exercise
T agency direction, including the authority to re-delegate functions and activities as appropriate.
Y However, even without said delegation, the Health Officer, as a statutory position under
California law, had all the authority necessary to act on behalf of the DPH Director and Assistant
Director while they were otherwise occupied.66 As necessary, the Health Officer made decisions
in the absence of the Director and Assistant Director. Since the Health Officer’s focus is typically
O medical, not administrative, and recognizing the support the Health Officer would need in
F making decisions associated with recovering the EHS Division, the DPH Executive Team
(including the DPH Chief Financial Officer, Division Chief of Nursing, Division Chief of Animal
Care and Control, Division Chief of Disease Control, the Quality and Compliance Officer, and the
Human Resources Officer) self-organized to advise the Health Officer and address all matters of
O the department while the Director and Assistant Director were occupied with the matters
P previously described. In addition, the DPH Executive Team wanted to alleviate the pressure on
the Director and Assistant Director so they could focus on their personal self-care and recovery
E as well as that of the affected staff. Although succession was never officially activated through a
written delegation of authority, the Health Officer (who had official statutory authority) and
R DPH Executive Team essentially implemented succession as needed, but did so with a
A consensus-driven, team approach rather than a more traditional hierarchical approach more
common in position-specific succession planning.
T
Somewhat complicating the leadership environment at DPH, the AEO for Human Services (who
I oversees the DPH) called upon and appointed a retired Department of Behavioral Health (DBH)
O department-head to assist with DPH recovery and the continuity of department
operations.67 Before doing so, the AEO communicated her intentions to the DPH Director. The
N Health Officer and DPH Executive Team commented that the involvement of the former DBH
S
66
An email between the County Counsel and the Health Officer on December 9, 2015, confirmed the Health Officer
had the broad authority to implement many DPH functions, and in particular many of the statutory and regulatory
functions required to be performed by the DPH/Environment Health Services (EHS) Division.
67
The former DBH department-head had a six (6) week contract with the CAO to assist the DPH.
Narratives and Analysis 118
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

department-head was awkward as that individual’s role was not clear (e.g., whether the AEO
expected the former DBH department-head to make administrative decisions instead of the
Health Officer or was it simply an advisory position). In addition, the former DBH department-
head often brought the then current Director of DBH to most DPH meetings and would defer to
C
the DBH Director, which seemed peculiar and not always relevant to DPH activities in the eyes O
of the DPH Executive Team. The AEO for Human Services had strictly good intentions; thinking
an additional person with knowledge of the department would be an asset to the group, but N
the communication regarding the former department-head’s role was never completely clear
and it sent an unintended “lack of confidence” message to the existing DPH Executive Team.
T
I
Once the DPH Director and Assistant Director resumed their normal duties on January 4, 2016
leadership roles returned to normal and the former DBH department-head departed. N
Environmental Health Services (EHS) Division
U
The leadership of the Environment Health Services (EHS) Division within DPH was the most I
impacted of any business unit. At the time of the attack, the line of succession for the EHS
Division was as follows: T
 Division Chief
 Program Manager
Y
 Program Coordinator
 Supervisor
O
Of the Division’s 92 positions that were filled on December 2, 2017, 72 were present during the F
attack, including the only two EHS Program Managers (one of whom was acting as the Interim
Division Chief as the former Division Chief had recently been promoted to DPH Assistant
Director), an Interim Program Manager, and the Program Coordinator. With great dedication
and resilience, both Program Managers, the Interim Program Manager, and Program O
Coordinator returned to work on December 3, 2015. Although they were permitted to take P
administrative leave with all other EHS staff through January 4, 2016 they were either physically
on-site or were available to support recovery efforts during their personal time. Like the DPH E
Director and Assistant Director, during that initial month, they too were consumed with visiting
the injured, attending funerals, serving as a liaison between the County and affected personnel, R
self-care, etc. Although lower-level positions were in the line of succession for the Program A
Managers and the Program Coordinator, the line of succession was intended to back-fill one or
a few positions under normal conditions; not assume leadership over a Division that had been T
decimated and required rebuilding from the ground up. As such, the defined line of succession
was not helpful for this situation. I
O
As narrative 5.4 Alternate Personnel on page 131 explains in greater detail, the staffing of the
EHS Division and its leadership for the first month would consist of mutual aid support from the N
State and fellow counties, recent retirees, and volunteers. The California Department of Public
Health (CDPH) appointed a number of senior-level personnel to assist in temporarily staffing S
the Division. On December 9th, the CDPH Director assigned the CDPH Environmental
Management Branch Chief to visit San Bernardino’s EHS Division and determine the Division’s
needs, including leadership. That effort would lead CDPH to recruit a recently retired county-
Narratives and Analysis 119
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

level Chief of Public Health with 25 years of experience as a county-level environmental health
director to provide independent and continuous leadership presence until EHS staff returned.
C Although the individual recruited by the CDPH was never officially appointed acting/interim
Division Chief, nor were written delegations of authority issued, the role essentially defaulted
O to that individual as the State’s lead representative and all other returning staff or mutual aid
fell in line to support him. That included four retired or former EHS Division Chiefs who
N generously gave their time as needed and offered advisory services. The temporary Division
T Chief, senior mutual aid staff, and volunteers met on a daily basis to prioritize tasks with the
intention of doing whatever it took to at least minimally re-establish and sustain operations for
I essential programs. EHS Program Managers and the Interim Program Manager offered their
support either in-person or remotely and the Program Coordinator worked full-time and played
N an advisory role during this time. As a result, until January 4, 2016, an ad hoc group of
U individuals collectively supported each other and drove the efforts of the Division.

I On January 4, 2016, the Program Managers (including the one acting as Interim Division Chief
and the Interim Program Manager) returned to work full-time. Many of the mutual aid staff
T who had been acting as Program Managers and Supervisors stayed to assist to some degree for
Y nearly six more months. The temporary Division Chief recruited by the CDPH only stayed for
approximately a week after January 4, 2016, which afforded the Interim Division Chief, Program
Managers, and Program Coordinator limited time for transition. The initial Interim Division
Chief would act in that capacity for another few weeks, but would ultimately retire. The other
O Program Manager was appointed Interim Division Chief in his place and later appointed
F permanent Division Chief in March 2016. A Supervisory Environmental Health Specialist was
made an Interim Program Manager in addition to the one that had been acting as an Interim
Program Manager already. Both were promoted to permanent in May 2016. Although the
Division’s leadership would be reconstituted within approximately one month, narrative 6.2
O Reconstituting Employment Levels and Practices on page 141 further details the long-term
P impact to the EHS supervisory hierarchy.

E The Transition Period between the Temporary EHS Chief and Returning Leadership…
The EHS Division’s returning leadership applauded the appointment of an independent “third
R party” temporary Division Chiefsomeone without a connection to the County that could lead
A objectively rather than with their heart. In addition, the individual was someone with directly
relevant expertise in County-level environmental health services with equally robust leadership
T experience. That type of leadership and external support would have been welcomed for a
much longer period than the one-week transition period. It’s possible the departure of the
I temporary Division Chief was hastened to avoid any perceptions of threats to positions or lack
O of confidence in returning staff. Whatever the cause, the returning EHS leadership voiced they
did not have those concerns. And while the temporary Division Chief made himself available for
N telephonic consultation after departing, the returning EHS leadership had wished he remained
in a full-time role to support transitions and organizational recovery for a longer period,
S especially considering most of EHS returning leadership were new to their positions at the time
and were immediately faced with the daunting task of defining a new normal for the Division
and the path toward achieving it.

Narratives and Analysis 120

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

5.2 Continuity of Essential Functions

The functions of the Department of Public Health (DPH) Environmental Health Services (EHS)
Division protect public health and maintain regulatory compliance within San Bernardino C
County. The EHS Division provides education, permitting, plan checking, inspections and
enforcement in the areas of body art, food operations and facilities, housing and camps, O
massage clinics, medical waste, mosquito and vector control, public swimming pools, drinking
water, solid waste, wastewater, and wholesale food preparation and processing. As a result of N
the December 2, 2015 terrorist attack, the EHS workforce was seriously impacted (see narrative T
5.4 Alternate Personnel on page 131 for more information); however, the demand for service
from the public, business, and industry within San Bernardino County remained strong and I
unchanged. The EHS Division would have to maintain a minimum level of performance to avoid
the emergence of public health hazards and regional economic impacts. N
U
With only two exceptions, from December 2nd to December 13th, EHS functions were not
performed as the DPH, County, and returning EHS managers worked to organize temporary I
staffing and leadership for the EHS Division.68 During that time, the DPH Department
Operations Center (DOC) took responsibility for logging calls and submissions to the EHS T
Division’s “800” phone number and online complaint/inquiry systema role the DOC would Y
play for a few months. At that time, EHS staff had to change the greeting for the call center and
then provide the log-in information to the DPH DOC. With a new call center provider as of
November 2016, a pre-recorded message can now be activated during an emergency without
EHS staff involvement and the DPH DOC has access information. The DPH DOC did not deploy
O
resources in response to those initial notifications/inquiries, but logged them so they could F
later be considered and acted upon by EHS staff. Additionally, on December 10th and 11th,
Riverside County Department of Environmental Health inspectors replaced nearly 365 grade
card placards at food services facilities bearing the name of the perpetrator. While a necessity
because of the unique nature of the incident, this would not be considered a traditional
O
emergency function of the EHS Division. P
Beginning on December 14th, mutual aid and volunteer staff began to perform many of the E
functions of the EHS Division to the greatest degree possible, but with less capacity than
normal. Workload prioritization decisions had to be made on a daily basis to balance demand
R
for service and mandated requirements with limited staffing, short-term staffing assignments A
(on-boarding and revolving institutional knowledge), and lack of familiarity with San Bernardino
County procedures and geography. T
Priority was given to complaints and reported problems, second to contractual requirements,
I
and lastly to routine inspections. Although understaffed and with staff continuously O
transitioning, the EHS Division was able to achieve nearly full capability levels for complaint
investigations and/or service requests, per its selected continuity priorities, even as the number N
of complaint inquiries of food facilities, swimming pools, and vector control issues (e.g., rodent,
mosquito) remained comparable to the previous year.
S
68
For more information on efforts to reconstitute staffing and leadership, see narratives 5.1Evolution of
Leadership on page 115 and 5.4 Alternate Personnel on page 131.
Narratives and Analysis 121
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Consistent with the functions determined to be lower priority, most routine inspections were
delayed. By February 2016, however, it became apparent to the EHS Division and DPH that the
C delay was growing and would become worrisome as time went on. This was the trigger for the
County Chief Executive Officer (CEO) to approve contracting for temporary EHS staff to address
O the growing inspection void. The contract staff was intended to complement and ultimately
replace mutual aid staff. Contract staff began the week of March 21, 2016 and was initially
N planned for approximately one year. As of the writing of this report, contract support was still
T needed and contracted through December 31, 2018. Once contract staff began, some service
levels began to improve.
I
Most notably during the first six months after the attack, all inspections were reduced
N significantly. For example, from January 2016 to June 2016 as compared to the same period of
U time the previous year, the EHS Division conducted 44% fewer plan checks and construction
inspections, 41% fewer pool inspections, 69% fewer vector control and mosquito inspections,
I and 24% fewer food facility inspections. Per its continuity priorities, however, the Division was
able to sustain and even increase its number of food complaint investigations year over year.
T Two years after the attack, the performance levels for this sampling of essential functions had
Y continued to improve, but the EHS Division was still running a deficit of 12% fewer plan checks
and construction inspections, 34% fewer pool inspections, 20% fewer vector control and
mosquito inspections, and 24% fewer food facility inspections for calendar year 2017 versus
2015 (the year prior to the attack). The diagram on the next page illustrates the service levels of
O this sampling of EHS functions from January 2015 to December 2017.
F

O
P
E
R
A
T
I
O
N
S

Narratives and Analysis 122

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Sampling of EHS Inspection (Essential Function) Levels

January 2015 (Year Prior to Attack) to December 2017 (2 Years After Attack)
C
O
N
T
I
N
U
I
T
Y

O
F

O
P
E
R
A
T
* Data provided by San Bernardino County EHS Division. I
O
N
S

Narratives and Analysis 123

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Other programs were affected in various ways:

 The medical waste program was able to meet its full caseload from the time of the
C incident to the time of this report’s publication; initially thanks to mutual aid provided
by CDPH through May 2016.
O  Essential construction inspections were prioritized over routine inspections and the
number of total construction inspections was reduced for approximately six months
N after the attack.
T  Food handler field enforcement was discontinued completely for nearly a year.
 The California Department of Resources Recycling and Recovery (CalRecycle) waived its
I 2015 fourth quarter regulatory reporting requirement, which would have been due
from EHS at the end of December. In January and February 2016, mandated CalRecycle
N inspections of regulated entities were devolved from EHS back to CalRecycle, which in
U turn sent personnel to San Bernardino County to conduct necessary inspections. The
EHS Division resumed CalRecycle functions in March 2016.
I  Some State regulatory reporting and work plan requirements associated with the State
Water Resources Control Board, including Vector Control, and CDPH Medical Waste
T Management Program were either waived or postponed. Like CalRecycle and CDPH
Y Medical Waste Programs, CDPH Vector Control staff also worked locally to address
much of that responsibility for the EHS Division until June 2016.
 Required drinking water inspections were devolved to, and performed by, the California
Department of Water Resources (DWR) through June 2016.
O  Beginning on December 21, 2015 and lasting through June 2016, plan check functions,
F all of which could be performed remotely, were devolved to Los Angeles County
Department of Public Health and Riverside County Department of Environmental Health
Services. No plan checks were reported delayed and no backlog was reported. Before
assigning that responsibility to Los Angeles and Riverside Counties, the EHS Division’s
O temporary staff prioritized plan check submittals, initial checks, and final reviews to
P inform those external efforts.

E As a result of returning staff, new hires, and continued contractor support, EHS Division
capability levels continued to improve through the writing of this report (more than two years
R after the incident), but deficits remained and functional prioritization decisions were still being
A made on a daily basis. By any organization’s account, it had been an extended continuity event.
Per industry and government continuity standards, organizations are often expected only to
T plan for continuity events ranging in duration from one to a few months. Regarding the degree
to which functions were being performed, it is more difficult to reach a definitive determination
I as to the adequacy of continuity efforts. As narrative 2.1 Department Emergency Operations
O Plans (DEOPs) on page 41 describes, the County did not have sufficient continuity plans or
strategies in place prior to December 2, 2015 to define minimum performance levels (i.e.,
N recovery point objectives). For example, the DPH DEOP lists only one essential function
associated with the EHS Division (“FT Counter Public Service [Ontario, San Bernardino,
S Victorville]”) and identifies only 6 staff as necessary to maintain the function. Effective
continuity plans would have identified all the EHS Division’s essential functions, which from
real-world experience were greater than one, and their associated recovery point and time
objectives (RPOs/RTOs)this was a concern for all County DEOPs at the time of this report. The
Narratives and Analysis 124
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

RPOs and RTOs would have captured the minimum performance level necessary and maximum
duration of service outages allowable to avoid serious consequences beyond the County’s and
community’s risk tolerance. Had these existed, it would have been easy to objectively
determine whether RPOs and RTOs were achieved in San Bernardino’s case. In their absence,
C
such determination would be subjective. While this report did not investigate it, there were no O
incidents of public health, economic, or other impacts reported to the authors of this report
linked to the EHS Division’s diminished capacity. N
Regardless of the objective assessment of continuity efforts associated with essential functions,
T
compliments are certainly owed to all those involved in the EHS Division’s continuity and I
resumption because the reality was the Division took on many more responsibilities than it
previously had, well beyond resuming and sustaining essential functions. These extraordinary N
responsibilities included, but were not limited to:
 Managing continuously changing mutual aid and contract staff.
U
 Managing the leave, evolving schedules, and paperwork of returning staff. I
 Coordinating counselors for staff, addressing psychological needs, and changing group
dynamics. T
 Hiring and training new staff, along with processing all necessary documents. Y
 Taking daily attendance of all staff reporting for duty for approximately three months.
 Handling communication to returning employees and those on leave via mailers, email,
and website posts.
 Regularly reviewing workload, demand for service, and staffing to provide ongoing
O
reports to County executives and the media/public. F
 Managing relocations and supporting facility renovations.
 Handling donations, tribute events, and special occasions.
 Managing large quantities of incoming mail of support and condolences (e.g., banners, O
posters, gifts, cards, letters).
P
E
R
A
T
I
O
N
S

Narratives and Analysis 125

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
N
T
I
N
U
I
T
Y This page is intentionally blank.

O
F

O
P
E
R
A
T
I
O
N
S

Narratives and Analysis 126

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

5.3 Alternate Facilities

San Bernardino County’s reasons for temporarily relocating personnel to alternate facilities
were different than most organizations dealing with an incident affecting the continuity of its C
operations. The terrorist attack occurred at a non-County facility; technically leaving the
County’s physical office spaces unscathed and fully operational. However, three factors would O
quickly influence the County’s decision to temporarily relocate personnel while undergoing
renovations of permanent office facilities: 1) since the male perpetrator was a County N
employee, his office area became a crime scene being investigated by local and federal law T
enforcement agencies; 2) the office areas of the deceased and injured victims appeared “frozen
in time” and, along with the perpetrator’s office area in the same vicinity, presented I
psychologic barriers to healing and recovery; and 3) security concerns voiced by survivors
would lead the County to make security alterations to make personnel comfortable with N
returning to work. By December 4, 2015 (two days after the attack), the County had U
determined either a permanent relocation or complete renovation of existing workspace of
affected divisions was necessary. Regardless of the selected option, County leadership felt they I
could not ask affected personnel to return to their old office space for any amount of time
because of the psychological implications. As a result, Department of Public Health (DPH) T
Environmental Health Services (EHS) Division personnel from two locations were relocated for Y
nearly a year until renovations to permanent facilities (the ultimately selected option) were
complete. In addition, personnel from the Land Use Services (LUS) Department Code
Enforcement Division and Information Services Department (ISD) Multimedia Services Division
who shared office space with EHS at the two locations slated for renovation were also O
relocated. F
The majority of EHS personnel present for the terrorist attack, all the deceased and injured
victims, and the male perpetrator, worked from EHS’ two primary office locations: 1) County
Government Center - 385 N. Arrowhead Ave., 2nd Floor, San Bernardino, CA (hereafter referred O
to as the County Government Center); and the 2) Rancho Cucamonga County Office Building - P
8575 Haven Ave., Suite 130 Rancho Cucamonga, CA (hereafter referred to as 8575 Haven Ave.).
The EHS and LUS Code Enforcement Division operations at both of these sites were temporarily E
relocated and the facilities ultimately renovated.
R
The EHS Division also has two small operations at 248 S. Sierra Way in San Bernardino, CA A
dedicated to Mosquito and Vector Control services and some functions at the County’s High
Desert Government Center at 15900 Smoke Tree Street in Hesperia, CA. Operations at these T
two locations were not relocated nor were facilities renovated.
I
As narrative 2.1 Department Emergency Operations Plans (DEOPs) on page 41 explained, the O
County’s pre-existing DEOPs did not include sufficient continuity strategies associated with
alternate facilities or the relocation of functions. For example, the DPH DEOP listed three other N
fully-occupied sites as alternate locations for any functions in the central San Bernardino valley
that may require relocation (i.e., another DPH office, a DPH Clinic, and a Human Services office S
building; none of which had available space). As a result, potential temporary facilities had to
be identified and prepared to support alternate operations at the time the decision to relocate
was made. On Friday, December 4, 2015 a “Project Team” was established by direction of the
Narratives and Analysis 127
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

County Chief Executive Officer (CEO) charged with identifying alternate space, preparing it, and
relocating affected divisions by December 14th (the initial anticipated return date for EHS
C personnel, which was later pushed to January 4, 2016 with paid leave expiring no later than
January 11, 2016). The Project Team included 18 individuals from the Real Estate Services
O Department (RESD), Information Services Department (ISD), Department of Public Health
(DPH), and Environmental Health Services (EHS) Division.
N
T The Project Team’s first task was to review existing County-owned floor plans and identify
vacant space available as well as properties currently leased by the County with potential space
I available. Over the weekend of December 5th/6th, despite finding building information was not
readily available, up-to-date, or backed-up, the Project Team identified two potential alternate
N sites; both of which came to their attention early as the sites had been slated for assignment to
U other departments and were known to be vacant. The anticipated plans had EHS’ functions
from the County Government Center moving to a vacant space in a building within walking
I distance of the Government Center and next door to the headquarters of the DPH at 172 W.
Third St., 1st Floor, San Bernardino, CA (hereafter referred to as 172 W. Third St.); and the 8575
T Haven Ave. functions moving about half a mile to a County Courthouse Building at 8303 Haven
Y Ave., Rancho Cucamonga, CA (hereafter referred to as 8303 Haven Ave.).

On Monday, December 7, 2015, members of the Project Team toured the existing EHS office
spaces and potential alternate facilities. During the tour of the existing 8575 Haven Ave. offices
O it was discovered that LUS Code Enforcement Division shared work space with EHS personnel.
F The Project Team had previously believed the Code Enforcement offices were physically
separated from the EHS offices. On Tuesday, December 8th, the LUS Director and County CEO
visited with the Code Enforcement staff at that site and immediately authorized them to take
leave until January 4, 2016 (a similar timeline as EHS staff) and the CEO directed the Project
O Team to also relocate Code Enforcement functions until renovations or permanent new EHS
P facilities were coordinated. The Code Enforcement staff asked to be relocated to the same
facility as their EHS colleagues if possible. During this same time, ISD Multimedia Services
E Division had chosen to remain in their existing office spaces adjoining the EHS Division offices in
the County Government Center. It wasn’t until late Friday, December 11, 2015, that the
R Multimedia staff opted to relocate as well. The relocation would ultimately prove necessary as
A the Multimedia Services and EHS office spaces in the Government Center were physically
flipped during the renovation.
T
By Monday, December 7th, emergency procurement authorities had already been granted
I through an act of the Board of Supervisors. The CEO and Finance Division had given their
O blessing to the Project Team to do “whatever was necessary” to prepare the selected spaces in
the time allotted. As a result, RESD called upon a few of its existing on-call/Job Order
N Contracting (JOC) contractors with whom it had long-standing relationships. These were
contractors it trusted to consult on, support, and be equally committed to, the relocation
S effort.

Between Tuesday, December 8th and Thursday, December 10th, the Project Team developed
floor plans and logistical strategies to support relocation needs and alternate operations. To

Narratives and Analysis 128

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

ease the transition and provide a degree of comfort and familiarity, the Project Team’s intent
was to mirror the existing primary facility as much as possible. With care and respect, the
Project Team documented how each workstation had been laid out and organized, where
individuals sat with respect to each other, and the locations of supplies and equipment relative
C
to each workstation. The plan for the 172 W. Third St. alternate site was approved on O
December 10th and 8303 Haven Ave. on December 11th. An existing ISD office area was
identified on the third floor of the County Government Center to accommodate the seven N
Multimedia Services Division staff. Moving them out of the County Government Center would
have been prohibitive as they needed regular access to the production facilities on the second
T
floor of the building. I
From Friday, December 11th to Sunday December 13th, the Project Team, RESD, ISD, the Human N
Resources (HR) Department, and contractors worked tirelessly to prepare all the alternate
facilities for operations (including the 3rd Floor space in the County Government Center for the
U
Multimedia Services Division). Actions included painting, carpeting, installing lighting, I
equipment, telephones, moving or acquiring furniture, installing information technology
systems and access controls, moving files, documentation, and resources, among others. Of T
particular note, a small team of DPH, RESD, and HR staff personally boxed up, labeled, and
transported the personal effects of each survivor to the associated workstation at the alternate
Y
facility. The Project Team had contemplated hiring a moving company to do so, but ultimately
wanted to ensure the personal items were treated with the utmost respect and care. On
Monday, December 14th, the alternate facilities were operational and ready to accommodate O
personnel. The cost of renovating and equipping the two temporary spaces totaled
approximately $200,000.
F
The 8303 Haven Ave. space was prepared for 14 people, including 9 EHS staff and 5 LUS Code
Enforcement staff.69 The 172 W. Third St. site was prepared for 55 EHS staff. Both sites also O
included a sufficient amount of space and equipment to nearly mirror the storage, supply, and
reproduction requirements, meeting/conference spaces, break rooms, reception areas/guest
P
seating, and public counters as the primary sites they were replacing. E
It took a number of days for signage to be posted at EHS’ primary locations notifying the public R
of the relocation and partial closure. In addition, the physical closure of the office space and
relocation of the EHS offices were not widely communicated to County staff or the public. Staff
A
at the County Government Center, particularly those on the second floor adjacent to the EHS T
office space, was regularly approached by the public looking for EHS services. Those staff from
other departments then had to explain the terrorist attack and attempt to contact EHS. Each of I
those departments self-initiated and sought out the correct contact information and was
usually given the phone number of an acting manager at EHS as a point of contact. Global
O
messaging to County departments on how to handle and direct those public inquires could have N
been of value.
S
69
Due to the limited availability of Supervisors, all EHS staff was initially assigned to work from the 172 W. Third St.
alternate facility. It wasn’t until months later that some returning EHS staff and new hires were assigned to the
8303 Haven Ave. alternate facility. The 8303 Haven Ave. site was used by the LUS Code Enforcement staff the
entire time.
Narratives and Analysis 129
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Generally, all personnel interviewed and those who submitted documentation were satisfied
with the alternate facilities and felt they sufficiently supported functions to the degree they
C were being performed.70 As can be expected of quick turnaround projects and older facilities,
there were some minor facility and coordination matters in the beginning. For example, the
O 8303 Haven Ave. alternate facility is also an active County Courthouse with heightened security.
At the time of the initial relocation, the building’s security staff was not fully informed of the
N new tenant and therefore some relocated employees and their visitors were denied access or
T faced challenges accessing the new office space. The matter was addressed within a few days.
Personnel from both sites mentioned matters such as minor technical glitches, copy machines
I and telephones not being connected, minor plumbing problems, and workspaces being tighter
and smaller than they were accustomed, but manageable. However, no issues were identified
N over the course of the relocation that would have threatened the performance of essential
U functions. All personnel mentioned being pleased alternate facilities had the resources to
perform functions. More so, they voiced appreciation for being able to work from alternate
I facilities and for the many small hospitable gestures that were made by the Project Team (e.g.,
signage on each workstation designating the staff member’s name and program, the care given
T to the movement of personal effects). This was a significant feat considering the 10 day
Y turnaround on previously unidentified alternate facilities that would then remain operational
for nearly a year.

While the Multimedia Services Division’s alternate office space was small, those interviewed
O mentioned it was functional and convenient to the production studios just one floor below. In
F addition, the Multimedia Services Division staff mentioned in hindsight that relocating was the
best decision even though it was made later than others as remaining in the former space
shared with the EHS Division would have had growing psychological and morale challenges.

O The decision to renovate the permanent facilities rather than permanently relocate was made
P in late December 2016 (more information on that process can be found in narrative 6.3 Facility
Renovations on page 145). As a result, the 172 W. Third St. alternate facility was used until
E October 2016 and the 8303 Haven St. site until November 2016 when the renovations of the
County Government Center and 8575 Haven Ave. were completed, respectively. The transition
R to newly renovated permanent facilities took place in a phased approach over the course of a
A few weeks as equipment, resources, and personnel slowly made the migration between sites
while maintaining essential functions.
T
I
O
N
S
70
For more information on what functions were being performed and to what degree, see narrative 5.2 Continuity
of Essential Functions on page 121.
Narratives and Analysis 130
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

5.4 Alternate Personnel

On the morning of December 2, 2015, the Department of Public Health (DPH) Environmental
Health Services (EHS) Division had 92 positions filled. Seventy-two (72), including the male C
perpetrator, were present for the training event at the Inland Regional Center (IRC). By that
afternoon, 39% of the EHS Division’s workforce had been killed or injured.71 The remaining 56 O
staff, whether present for the attack or not, experienced varying degrees of psychological
trauma. The staff available and capable of supporting the EHS Division’s essential functions N
fundamentally went from 92 to none in a matter of minutes. Although the County’s T
Department Emergency Operations Plans (DEOPs) did not sufficiently address workforce
continuity,72 even the most robust continuity programs do not typically address the complete I
insolvency of staffing for an entire division or organization. Because EHS functions have a State
mandate and direct link to public health, safety, and the regional economy they could not be N
discontinued for long, and DPH and the County knew almost immediately they would be faced U
with figuring out alternate staffing strategies.
I
Among other reasons for which it became operational, the DPH Department Operations Center
(DOC) was activated by the County Health Officer on the afternoon of December 2, 2015, as T
was the County’s Medical Health Operational Area Coordinator (MHOAC) program, to begin Y
considering staffing sources to sustain the EHS Division’s essential functions. The training and
certification requirements to perform most EHS functions, such as those associated with
Registered Environmental Health Specialist (REHS) I, II, III and Supervisory REHS, are set by State
regulation. Consequently, any alternate personnel would need to be fully qualified to complete O
the work. To address this situation in the immediate-term, the decision was made by a F
combination of DPH and Human Resources (HR) Department leadership to recruit retirees and
pursue mutual aid. REHS personnel from other County departments or close partners (e.g., San
Bernardino County Fire Protection District’s Hazardous Materials Teams) provided assistance to
EHS on weekends and on their days off but was not a long-term solution. Where non-technical O
staff was needed, the County reassigned personnelprimarily clerical and administrative P
from other departments to the EHS Division, particularly seeking out staff that had previously
worked for the EHS Division. In some cases those staff from other departments remained with E
the EHS Division for months. When it came to technical staff, the County’s DPH, including its
EHS Division, is part of a robust medical and health disaster response and mutual aid system in
R
the State of California, including the MHOAC program. As a result, on December 7th and into the A
8th, the Director of the California Department of Public Health (CDPH) reached out and held
multiple meetings with County DPH to determine the staffing needs to sustain the EHS Division T
and mobilize necessary mutual aid.
I
The initial request from County DPH was for: a) staff to replace the restaurant “grade” O
inspection cards and suppress the perpetrator’s name on associated digital inspection
reports;73 b) EHS leadership positions (Division Chief, Manager, and two Supervisors); and c) N
S
71
Thirteen (13) EHS Division employees were killed and 22 physically injured during the terrorist attack. One of the
14 deceased was an employee of the IRC.
72
For more information, see narrative 2.1 Department Emergency Operations Plans (DEOPs) on page 41.
73
For more information, see narrative 2.6 Addressing the Perpetrators Footprint on page 65.
Narratives and Analysis 131
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

operational staff to achieve minimum operations (seven registered environmental health

specialists, one water system inspector, four local enforcement agency inspectors [for solid
C waste], and one vector control specialist). During the week of December 7 th, the CDPH
confirmed a recently retired county-level Chief of Public Health with 25 years of experience as a
O county-level environmental health director would oversee the County EHS Division until the
County’s staff began to return in January 2016.74 On December 9th, guidelines were established
N for all other mutual aid requests, including a preference for rotations of mutual aid staff every
T two weeks (which would not come to fruition in most cases), reimbursement to mutual aid
providers, and support for housing and travel costs.
I
Also on December 7th, a few former EHS Division staff that had retired showed up at the EHS
N offices to offer support. They initially assisted with answering phone calls, addressing customer
U needs, and other office matters. Four (4) retirees would ultimately rejoin EHS in early January
2016 on a semi-permanent basis to assist with essential EHS functions. The California
I Department of Public Health (CDPH) ensured their credentials were reinstated without issue.
While the County was fortunate to have retirees return, there were still some costs involved in
T on-boarding them. For example, some retired staff had great expertise and work ethic, but
Y were not familiar with the computer system then employed by EHS. To accommodate them,
they were allowed to use hard copy alternatives and administrative staff later uploaded the
necessary data to the EHS’ computer system.

O On December 10th and 11th, the Riverside County Department of Environmental Health
F accepted the first mutual aid request and deployed 22 inspectors who worked over the course
of two days to replace nearly all 365 placards from food services facilities bearing the name of
the perpetrator. The other mutual aid requests, including leadership positions, were set to
arrive on Monday, December 14, 2015 to reinstate EHS essential operations. Between
O December 10th and December 24th, 63 mutual aid personnel were provided to San Bernardino
P by Riverside and Los Angeles Counties (including the 22 that replaced the perpetrator’s
placards) and CDPH.
E
The EHS Division’s Interim Chief, Program Manager, Interim Program Manager, and Program
R Coordinator returned full-time on January 4, 2016. At that time, CDPH recalled the individuals
A assigned to EHS leadership positions, but continued to provide supervisory and mutual aid staff
for another five months.
T
All other EHS staff was slated to return no later than January 11th when their temporary leave
I would expire. During the first week, 13 EHS staff returned on modified schedules and it quickly
O became evident that mutual aid would be needed for much longer than initially expected and
would likely need to be replaced with more long-range staffing solutions. Between January and
N June 2016, the EHS Division would continue to receive mutual aid support. Beyond CDPH, Los
Angeles County, and Riverside County, that support would grow to include staff from Orange,
S Ventura, San Luis Obispo, Contra Costa, and Marin Counties, the California Department of
Resources Recycling and Recovery (CalRecycle), and the California Department of Water

74
For more information, see narrative 5.1 Evolution of Leadership on page 115.
Narratives and Analysis 132
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Resources Drinking Water Division. Mutual aid support would remain consistent at 44 staff in
January and February 2016 (equating to nearly 1,600 labor hours each month), but declined
each month thereafter as permanent EHS staff returned, new hires began, and contractors
were brought on board. Unfortunately, while the number of mutual aid staff remained stable,
C
the actual individuals assigned often turned over on a daily basis requiring permanent EHS staff O
to essentially on-board and educate mutual aid staff each day. The diagrams shown on pages
135 and 136 illustrate the level of mutual aid provided to the EHS Division from December 2015 N
through June 2016.75 During the time mutual aid was in use, the dynamic and time-consuming
process of finding, scheduling, and coordinating logistics for mutual aid staff was facilitated on a
T
daily basis through California’s medical and health disaster response and mutual aid system. I
Both mutual aid providers and permanent EHS staff commented that on-boarding and assigning N
mutual aid staff was made additionally complicated because there were few to no written
guides or “cheat sheets” for basic administrative matters (e.g., getting assigned a County
U
vehicle; how to order supplies; locations of restrooms, break areas, etc.; directions to various I
points within the County). None of the mutual aid staff could be asked to immediately begin
without a training and on-boarding period; a process that had to be repeated on nearly a daily T
basis as replacement mutual aid staff cycled in. As time went on, some previous mutual aid
staff returned for later deployments, which eased this burden. However, permanent EHS staff
Y
also had to address more personnel and performance issues because of the revolving nature of
mutual aid assignments during that time than was the norm.
O
Recognizing mutual aid could not be a long-term solution to the EHS Division’s staffing needs
and seeing that capability levels were falling behind, the DPH and County leadership (the Post-
F
Incident Coordination Group) began outreach to various sources in February 2016. By that time,
job offers to some new full-time employees had been accepted and they were slated to be on-
boarded within a month. In addition, EHS staff continued to return, though mostly on modified O
schedules. It was evident that a resumption of staffing levels was going to take time,
particularly since temporarily vacated positions were secured. Post-Incident Coordination
P
Group members and the DPH reached out to local universities with known environmental E
health programs for current students and alumni that may be interested in assisting. They also
reached out to the California Environmental Health Association (CEHA), California Association of R
Environmental Health Administrators (CAEHA), and the National Environmental Health
Association (NEHA) for recommendations and support. It was through that outreach that the
A
possibility of contracting with CAEHA for the provision of qualified EHS staff became a tangible T
option.
I
On March 22, 2016, the County Board of Supervisors approved a contract with CAEHA for the
provision of licensed, professional temporary staff to perform environmental health-related
O
functions normally performed by actively recruited vacant positions or existing staff currently N
on leave as a result of the terrorist attack. The contract, in an amount not to exceed
$1,500,000, was for the period of March 22, 2016 through February 28, 2017, with the option S
75
June 30, 2016 was also the date the Board of Supervisors authorization dated December 7, 2015 allowing
emergency procurement and reimbursement of mutual aid services expired.
Narratives and Analysis 133
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

to extend the contract for one additional one-year period. Unlike the constantly rotating
assignments available through mutual aid, the CAEHA personnel would be assigned for a
C minimum of 90 days with the option to renew the assignment at the end of each cycle. This
approach allowed the contracted staff to develop institutional knowledge of programs and
O processes and build relationships with County staff and customers. Meanwhile, the tenure was
short enough to allow the contracted position to be retired upon the full-time return of EHS
N staff or on-boarding of new hires. On September 13, 2016, the County Board of Supervisors
T approved an increase in the amount of the CAEHA contract by $1,000,000, from $1,500,000 to
$2,500,000, and extended the term through December 31, 2017. Similar to the challenges faced
I with recruiting mutual aid and new hires, even CAEHA experienced some difficulty recruiting
the required number of qualified and credentialed environmental health specialists. The County
N and CAEHA queried CDPH to see if CAEHA could hire REHS staff with lapsed credentials. The
U request was denied. As the diagram on the next page illustrates, the CAEHA contract provided 5
to 28 full-time staff to EHS as needed, with an average of 20 full-time staff per month in 2016
I and an average in 2017 of 9 per month. Nearly a year later, recognizing that the EHS Division
still would not reach optimal staffing levels by the end of 2017, the Board of Supervisors
T approved an additional increase in the contract value by $1,000,000 to a total of $3,500,000
Y and again extended the term, this time until December 31, 2018. At the time of this report, the
EHS Division still had 5 CAEHA contractors working full-time and had planned to maintain those
through 2018.

O As of March 2018, more than two years after the attack, the EHS Division was still short staffed
F a total of 9.5 equivalent full-time positions from its pre-incident levels and was dealing with the
long-term effects of diminished institutional knowledge and leadership.76

O
P
E
R
A
T
I
O
N
S

76
See narrative 6.2 Reconstituting Employment Levels and Practices on page 141 for more information.
Narratives and Analysis 134
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
N
T
I
N
U
I
T
Y
* Diagrams and data provided by San Bernardino County EHS Division.
O
F

O
P
E
R
A
T
I
O
* Diagrams and data provided by San Bernardino County EHS Division. N
S

Narratives and Analysis 135

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
N
T
I
N
U
* Diagrams and data provided by San Bernardino County EHS Division.
I
T
Y

O
F

O
P
E
R
A
T
I
O
N
S

Narratives and Analysis 136

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Category 6: Organizational and Financial Recovery

This section examines the situations and actions with which San Bernardino County has been
involved to establish a new operational steady state, make the organization fiscally whole, and
effect long-term changes to address the cultural and operational ramifications of the terrorist
attack. The eight narratives in this category explore the ongoing efforts to remember the
victims and effects of the attack, long-term efforts to reconstitute staffing and traditional
management practices in the Environmental Health Services (EHS) Division, permanent
F
renovations made to County facilities to address psychological concerns, and long-term security O I
measures to address a new paradigm of threats. In addition, this category addresses the total
costs associated with the attack and the County’s efforts to recover some of those costs R N
through State and Federal sources. Horrific incidents such as the December 2, 2015 terrorist
attack often have long-range public policy and legal implications, which are also explored. The
G A
story of the County’s recovery was still evolving at the time of this report, but this section offers A N
insights into the foundation that had been laid in the two years since the attack to propel the
organization toward a new steady state. N C
I I
6.1 Memorials and Remembrances
Since the December 2, 2015 terrorist attack, the County hosted several memorial events and Z A
there were ongoing plans for a permanent memorial on the grounds of the County Government A L
Center at the time of this report. County leadership had consistently sought to remember and
honor the victims in a manner that was compassionate, respectful, and inclusive of the entire T
County family.
I R
“County Family Gathering” Memorial Event O E
One month after the attack, on January 4, 2016, the County hosted a memorial event to honor
and commemorate the victims. Planning for the event began the week after the attack as it N C
became clear the “County family” needed an opportunity to collectively heal and triumph over
terror. Since many County employees had spent the first weeks after the attack attending A O
funerals and addressing their own grief, organizers wanted to avoid a funeral atmosphere and L V
indicated so by calling the memorial a “County Family Gathering.” A group of County officials
spent much of their 2015 holiday season planning and organizing the large event that would E
receive national attention.
& R
All County employees not assigned to essential services at the time were invited to participate
in the event and were given paid time off to attend. Many County offices were closed at noon
Y
that day to maximize the opportunity for participation. Other than the loved ones of victims
and first responders and elected officials from the 24 cities in San Bernardino County,
participation from any non-County employees was prohibited. Approximately 2,000 attended
the event held at the Citizens Business Bank Arena in Ontario, California. Former New York City
Mayor Rudy Giuliani and popular evangelist Pastor Rick Warren of Saddleback Church each gave
key note addresses at the event. California Governor Jerry Brown and California Attorney
General Kamala Harris were in attendance.

Narratives and Analysis 137

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Security at the event was a paramount concern. County employees had to present County-
issued identification badges and all attendees had to enter through metal detectors. The media
was allowed to attend, but was not allowed access to victims or families. Separate reserved
C seating was established for the victims, their families, and all other Environmental Health
O Services (EHS) Division employees toward the front of the arena. Those seats were surrounded
by sworn law enforcement to ensure the victims and families felt protected.
NF
In connection with the “County Family Gathering,” the County held a private luncheon for EHS
O TI employees and the families of the deceased that took place at the same location immediately
R IN prior to the Family Gathering. Security was very tight and those participating had the option to
view the Family Gathering from private boxes in the arena if they wanted to stay out of the
G NA crowd.
A UN Anniversary Events
N IC Officials of the County Administrative Office (CAO) and EHS leadership began meeting in
September 2016 to plan an event to mark the first anniversary of the attack. County officials
I TI realized the anniversary was likely to trigger unease and grief for a group that was still in the
midst of the healing process. At the time, the EHS Division remained significantly understaffed
Z YA and had just recently moved back into its renovated permanent office space. EHS managers
A L were concerned about additional publicity and the employees’ anxiety surrounding an
anniversary event. After much planning, the first year anniversary memorial event took place in
TO a Sheriff’s Department aviation hangar at the San Bernardino Airport. Invitations were limited
to EHS staff and victims’ families. The event included a moment of silence and lunch for over
I FR 300 attendees. The facility included private quiet spaces and Department of Behavioral Health
O E (DBH) and Counseling Team International (CTI) counselors were on site, if needed. Like the
“County Family Gathering,” security at the anniversary event was high. Attendees had to pre-
N OC register to attend and only cars with registered attendees were able to access the parking area.
All attendees were subject to bag checks and passed through a metal detector in order to enter
A PO the hangar where there was a significant law enforcement presence outside and inside of the
L EV hangar.

RE Beyond the County-sponsored memorial service, there were several other events organized by
individuals or community organizations, including a ceremony at the Inland Regional Center
& AR (IRC) and a memorial service at California State University, San Bernardino. Special care was
TY taken by the County to ensure the victims and their families, and those present at the attack,
were notified of all anniversary events of which the County became aware.
I
On the second anniversary of the attack, which fell on a Saturday, the County did not host an
O event, but lowered flags to half-staff and asked the public to join in a “Moment of
N Remembrance” at 10:55 a.m. A private event was held with the EHS Division on the Friday
before. The County also paid tribute to the victims on the CountyWire blog and social media
S accounts.77

77
San Bernardino County’s Facebook account Tribute from December 2, 2017 is available online at:
https://www.facebook.com/SanBernardinoCounty/videos/10159697989565010/
Narratives and Analysis 138
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Permanent Memorial
In March 2016, the December 2 Memorial Committee was formed by the County to plan for a
permanent memorial to honor and remember those killed and injured in the terrorist attack.
The committee was led by Board Supervisor Josie Gonzales and included victims' relatives, EHS
employees, the County Chief Executive Officer (CEO) and CAO Public Information Officer (PIO).
Within the first few months, the Committee proposed the County Government Center as the
site for the memorial. In November 2017, the committee announced it was close to selecting a F
consultant with experience in public memorials to facilitate the search for an artist to design
the memorial. While the exact design of the memorial had yet to be decided upon at the time
O I
of this report, Supervisor Gonzales announced the Committee was hoping to create a space for R N
quiet reflection. According to Supervisor Gonzales, the goal of the memorial is to "serve as a
place where all can remember each of those who were taken from us and the beauty they G A
brought into the world" and "to recognize the tenacity of our community to persevere and
move forward." As of the date of this report, the budget for the permanent memorial had yet
A N
to be solidified. N C
I I
Z A
A L
T
I R
O E
N C
A O
L V
E
& R
Y

Narratives and Analysis 139

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
NF
O TI
R IN
G NA
A UN
N IC
I TI
Z YA This page is intentionally blank.
A L
TO
I FR
O E
N OC
A PO
L EV
RE
& AR
TY
I
O
N
S

Narratives and Analysis 140

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

6.2 Reconstituting Employment Levels and Practices

As other sections of this report describe, County administrators looked to a variety of short-
term staffing solutions to address deficits within the Department of Public Health (DPH)
Environmental Health Services (EHS) Division, namely mutual aid and contracted staff intended
to last until EHS staff returned to work or resolved their employment status. Within weeks of
the attack, it became evident a good portion of EHS staff were unlikely to return. Of the 113
EHS budgeted positions, 92 were filled on the day of the attack. Thirty-nine percent (39%) of F
those were deceased or physically injured as a result of the attack. A daily average of 35
returned to work during January and February of 2016. Most of those, however, did not work
O I
full-time, and some were at work for as little as an hour each day. On average, only 11 staff R N
members were working full-time during those two months. Though the numbers continued to
fluctuate, as of the publication of this report, 41% of EHS staff had either never returned to G A
work or were no longer employed with the EHS Division, and 10% were still on modified
schedules. EHS, DPH, and County leadership knew as early as December 2015 that more
A N
permanent resources would be needed beyond what mutual aid and volunteers could provide. N C
Recruitment and Progress I I
Soon after the attack, County administrators looked toward hiring EHS staff to reconstitute the
Division. On December 17, 2015, the Human Resources (HR) Department provided a list of
Z A
nearly 60 candidates for consideration for the 11 budgeted but vacant inspector positions. The A L
candidates were pulled from lists established during previous EHS recruitments so they were
immediately available. Of the 60 candidates only two were selected who met both the T
Division’s business needs and were also believed to be compatible with the unique work
environment. Registered Environmental Health Specialists (REHS), also known as Health
I R
Inspectors, are specialized positions requiring in-depth training. In order to become a REHS O E
registered by the California Department of Public Health (CDPH), one must have a bachelor’s
degree, potentially possess as much as 18 months of on-the-job training depending on their N C
bachelor’s degree, and pass a comprehensive examination. The County made available
recruitment and referral incentive programs in an effort to fill these hard-to-recruit positions.
A O
L V
Multiple challenges faced the County’s recruitment effort. First, positions filled by employees
on leave were protected; others could not be hired in those same budgeted positions until they E
were permanently vacated. Although not unique to this situation, the County, with the
agreement of the Service Employees International Union (SEIU), employed the common
& R
practice of using temporary employees to fill protected, but currently vacant positions, known Y
as a “dual fill.” Newly recruited staff on-boarded as “dual fill” employees could have their
positions eliminated if EHS staff returned to work. However, since the Division’s intent was to
recruit individuals interested in permanent employment despite the temporary sounding
nature of the hiring vehicle used to recruit them, the DPH committed to finding a new home for
the “dual fill” hires should EHS staff return to those positions. In addition, while San Bernardino
County’s salaries for environmental health inspectors were competitive for counties of similar
size and cost of living, they were less than its geographically close, but larger neighboring
counties with higher costs of living (e.g., Los Angeles, Orange), which reportedly posed a
challenge to recruitment. A program of signing bonuses helped to lure applicants.

Narratives and Analysis 141

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

The majority of the health inspector applicants were trainees with limited to no experience in
environmental health. The County targeted these entry-level candidates with opportunities for
training, certification support, and chances for later advancement by reaching out to nearby
C colleges, associations, and other potential sources. The County then needed to take on the role
O of cultivating the hired trainees. Understandably, EHS was initially in no position to provide the
in-depth training to the large numbers of new REHS trainees. Therefore, EHS collaborated with
NF Riverside County Environmental Health Department to send newly hired trainees to Riverside
for the first few months of their employment. Many of Riverside County’s staff were at the
O TI time, or had been, mutual aid support to San Bernardino so they had an understanding of the
R IN San Bernardino process that benefited their ability to on-board San Bernardino new hires. By
late January 2016, ten (10) new staff members had accepted offers and were sent to Riverside
G NA County for initial training. By the time the second group of new hires was on-boarded in March
2016, San Bernardino County EHS had enough capacity to again train new hires without
A UN needing to send them to Riverside County.
N IC
Additional HR Department resources continued to be assigned to support EHS and by August
I TI 2016 a dedicated Human Resources Officer (HRO) was provided to EHS. Because of the limited
availability of EHS staff to participate in interviews as the recruitment effort grew, REHS
Z YA Supervisors from Los Angeles, Riverside, and Orange Counties who were in San Bernardino as
A L mutual aid were asked to serve on interview panels. By the end of March 2016, more than 100
potential candidates had been interviewed and additional prospects had accepted offers.
TO During the interviews, candidates were encouraged to ask any questions and present any
concerns about the attack’s effects on EHS and panelists prided themselves on offering candid
I FR responses to appropriately set expectations and dispel concerns.
O E
The recruitment effort attracted mostly young, energetic, and eager-to-learn staff. Many EHS
N OC staff commented that the infusion of youth and energy likely helped the Division’s healing
process. A perennial challenge that remained at the time of this report was that trainees were
A PO required to attend training using approximately 25% of their work time; meaning every trainee-
L EV level new hire was performing about 75% of the work of a non-trainee full-time equivalent in a
Division still experiencing staffing shortages and workload surpluses. Compounding the matter,
RE EHS experienced attrition typical of any organization and was also expected to grow to match
its service delivery to the growth of the County (e.g., two new budgeted REHS positons were
& AR anticipated in 2018 to match the County’s growth). Considering these factors and total
TY vacancies, the EHS Division would still need to recruit, train, and make fully functional at least
13 positions to reach necessary capability levels as of the writing of this report.
I
As it embarked on 2018, EHS continued the process of recruiting permanent staff by filling
O vacancies or using “dual fills” for budgeted positions until the employment status for EHS staff
N that had not returned was resolved. All “dual fill” personnel hired since the attack were still
employed by EHS as of the writing of this report. The diagrams on the next page illustrate re-
S staffing progress at EHS as a whole and specifically related to health inspectors. While levels
were beginning to normalize as of the writing of this report, significant deficits still existed more
than two years after the attack as explored in the next section.

Narratives and Analysis 142

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

F
O I
R N
G A
A N
N C
I I
Z A
* Diagrams and data provided by San Bernardino County EHS Division. A L
T
I R
O E
N C
A O
L V
E
& R
* Diagrams and data provided by San Bernardino County EHS Division. Y
Management Practices and Challenges
An additional challenge of the EHS Division continues to be the supervisor-to-subordinate ratio.
Supervisors and Lead Inspectors (Specialist III) direct work, manage complex processes, address
sensitive issues, and train new staff. Of the 16 budgeted positions for those two classifications,
only 25% had more than two years of experience in their positions at the time of this report. To
put that in perspective, prior to December 2, 2015, REHS Level II staff (one level lower than a
Lead) had an average of 8.5 years of experience in their current positions and an average of
11.6 years with EHS. Of the 16 Specialist III and Supervisory positions, only 7 were filled with
permanent staff at the time of this report. Specialists I and II were also under-filling some of the
Narratives and Analysis 143
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

vacant Level III positions. The rest of the leadership positions were being filled by 4.5 temporary
contract workers whose contract was expected to expire at the end of calendar year 2018.
C As a State mandated and highly regulated industry, the primary factor governing REHS eligibility
O for promotion from a Level II inspector to Level III was time in position (minimum 18 months)
and the same for Level III to Supervisor (minimum 6 more months). The current Division Chief,
NF two Program Managers, and two Program Coordinators mentioned being taxed by their
supervisory responsibilities and the unique tasks they have faced because of workforce
O TI fluctuations resulting from the attack (e.g., contract staff, modified work schedules). At the
R IN time of this report, the Division’s leadership did not expect a resolution to the supervisor deficit
for another 2 to 3 years as they believed filling supervisory positions would likely have to
G NA happen entirely from within. While a number of REHS positions may soon qualify for
promotion, those leadership staff new to their own positions may still need to spend a good
A UN portion of their time training the staff below them as the Division maintains a dependence on
N IC trainees to fill most vacancies.

I TI While the attack has forever changed the EHS Division, attempting to create a new “normal”
work environment remained an ongoing effort at the time of this report. Team building had
Z YA become a primary focus of the EHS Division as of 2017 with various events, activities, and
A L assignments designed to better expose staff to each other and create closer working
relationships. In addition, as time has progressed, DPH and EHS leadership with the support and
TO recommendations of psychologists recognized a time was approaching to balance the needs of
the organization with those of the individual. To assist with those efforts, the County
I FR contracted with Dr. Robert Macy, President of the International Trauma Center and Dr. Melissa
O E Brymer, Director of Terrorism and Disaster Programs/UCLA–Duke National Center for Child
Traumatic Stress. At the time of this report, Dr. Macy and Dr. Brymer continued to provide
N OC management-level counseling to EHS to provide guidance on transitioning to a new normal and
managing the Division’s unique environment.
A PO
L EV
RE
& AR
TY
I
O
N
S

Narratives and Analysis 144

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

6.3 Facility Renovations

As early as December 4, 2015 there was a consensus among County leadership that a
permanent change would be needed to the existing Department of Public Health (DPH)
Environmental Health Services (EHS) Division offices where victims and the male perpetrator
had worked. Included in this plan were the office spaces at the County Government Center (385
N. Arrowhead Ave., 2nd Floor, San Bernardino, CA; hereafter referred to as the County
Government Center) and the Rancho Cucamonga County Office Building (8575 Haven Ave., F
Suite 130, Rancho Cucamonga, CA, hereafter referred to as the 8575 Haven Ave.). Although the
attack had not taken place in County government facilities, office areas of the deceased and
O I
injured victims appeared “frozen in time” along with the perpetrator’s office area in the same R N
vicinity. County leadership knew this would present psychologic barriers to healing and
recovery. In addition, they knew security concerns being voiced by survivors would need to be G A
addressed to make personnel comfortable returning to work. A N
At that early date, the County did not yet know whether the change would take the form of N C
renovating existing facilities or permanently relocating the affected staff to new or existing
office spaces in other County-owned or leased facilities. The County left that decision to the I I
EHS staff. These options were initially presented and solicited for input at an off-site meeting
with EHS staff on December 8, 2015. At that meeting, some attendees voiced a desire to
Z A
permanently relocate to new facilities. There was no dissention at the time because staff and A L
loved ones had agreed not to publicly disagree with each other. However, in the days after the
meeting, other input from staff began to reach County leadership through EHS and DPH and the T
County’s Victim Liaisons. County leadership then decided to have EHS and DPH leadership and
the Victim Liaisons privately query each survivor and/or their respective loved ones. The result
I R
was that the vast majority preferred to return to their existing work space upon renovations O E
being completed. It was made clear the renovated spaces had to feel and look completely
different than they previously did. N C
The facilities “Project Team,” consisting of representatives from the Real Estate Services
A O
Department (RESD), Information Services Department (ISD), DPH, and EHS Division began L V
renovation planning efforts as of the first of January 2016. The County Chief Executive Officer
(CEO) determined the renovation project would be implemented under normal capital planning E
and expenditure procedures; unlike the remodeling of temporary alternate facilities, which had
been accomplished through an expedited process using emergency procurement authorities.
& R
On January 10, 2016 the Board of Supervisors approved the first of many recurring actions Y
authorizing the renovation efforts. Associated funding would come from the existing budget
appropriation for the remodel/renovation and repair of County facilities (the Capital
Improvement Program budget) with reimbursement from the County’s General Fund.
Ultimately, renovation costs would total $2,025,000 for the County Government Center and
$975,000 for the 8575 Haven Ave. office, and the Board of Supervisors approved the related
budget adjustments on March 1, 2016 and April 19, 2016.

During January 2016, the Project Team worked with contractors and design consultants to
develop preliminary plans and options for the renovated spaces. During the first week of
February, proposed plans were shared with the CEO and with DPH and EHS leadership with the
Narratives and Analysis 145
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

instruction to share designs and options with EHS staff and solicit feedback. Feedback the
Project Team received directly from EHS personnel was provided back to DPH and EHS
leadership to vet and offer to all EHS staff for broader input. The Project Team also met with
C EHS staff on February 18, 2016 to solicit further input and additional meetings were offered if
O needed. Plans were also shared with the Land Use Services Department Code Enforcement
Division and ISD Multimedia Services Division whose facilities would also be affected by the
NF renovations due to their co-location with EHS. Both of those groups deferred to the needs of
the EHS staff and then contributed input for their respective spaces once EHS decisions had
O TI been made. Some of the feedback received from EHS staff included:
R IN  Physically flipping the EHS and Multimedia Services Division spaces at the County
Government Center, thereby moving the Multimedia Services Division to the west side
G NA of the building and the EHS offices to the east side.
 Maintaining shared EHS and Code Enforcement Division office spaces at the 8575 Haven
A UN Ave. office, but creating separate entryways and “counter” service areas for public
N IC interaction.
 Having interior-locking conference rooms at each site that could better serve as a “safe
I TI room.”
 Bullet resistant glass in the entrance area to the EHS lobby at the County Government
Z YA Center.
A L  Moving the entrances for second floor staff restrooms at the County Government
Center from inside the EHS office space to outside of it.
TO  Providing direct access to emergency stairwells from within EHS offices.
I FR  Locations of secure points of entry (employee card access only).
 Format of office spaces (e.g., private offices vs. cubicles vs. bullpen).
O E  Paint and carpet selection and color palette.
N OC Suggestions were also solicited from specialists from the Department of Behavioral Health to
A PO ensure new facilities provided optimal accommodations for psychological health and recovery.
Instruction was given multiple times from the CEO to ensure everything was done right in
L EV accordance with the needs and expectations of EHS staff. After multiple rounds of review and
RE feedback, final plans were approved by all affected departments/divisions by the end of April
2016.
& AR
Bids had been solicited from Job Order Contractors (JOC) in February and March 2016, so
TY contractors were ready to proceed once the plans were approved. Prior to furniture being
I removed and demolition beginning, EHS staff and the loved ones of victims were offered an
opportunity to walk through the existing facilities one last time. Visitation hours were made
O available on April 20 and 25, 2016 for the County Government Center and 8575 Haven Ave.
offices, respectively. The County’s Victim Liaisons and DPH and EHS leadership passed on the
N information to EHS staff and the loved ones of victims. Counseling services, security, RESD, EHS,
S and Human Resources (HR) Department staff were on hand to support those who chose to
attend.

Demolition began on May 1, 2016 and project completion was originally slated for the end of
August as construction was being fast-tracked. Nothing from the old spaces was reused. The
Narratives and Analysis 146
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

renovated spaces had new furniture, equipment, colors, and layout and truly felt like a different
space according to everyone that contributed input to this report. Ultimately, construction
delays and minor modifications to plans would delay the return of staff to the County
Government Center until October 3, 2016. When staff transitioned at that time, some
significant construction and finishing projects were still underway. That proved to be a
distraction to EHS staff and also caused frustration as certain resources that had been available
at the alternate facilities were not yet available at the renovated sites. Having learned from that F
experience, the Project Team delayed the return of staff to the 8575 Haven Ave. office until
November 17, 2016 to ensure the space was complete before inhabiting it. Prior to moving
O I
back into both sites, EHS staff was given opportunities to tour the new sites, with counselors R N
available during those visits.
G A
As can be expected with any new space,
office needs and items for improvement
Perceived Service Levels… A N
continued to be identified in both spaces It was after the return to permanently N C
for months after the return of staff to the renovated facilities that EHS staff felt the
renovated facilities (e.g., additional County had returned to business as usual I I
furniture needs, storage requirements, related to managing facility matters, while
office supplies [e.g., trash cans], security EHS still continued to struggle with recovery. Z A
enhancements [e.g., replacement of glass EHS staff mentioned having to follow normal, A L
conference room doors with solid doors]). cumbersome facility request processes to get
At the time of this report, EHS, Code resources or facility work done, that T
Enforcement, and Multimedia Services requested items were now being denied or
Division personnel had been working from changed, and the sense of urgency previously I R
their renovated permanent facilities for demonstrated had dissipated. Since the EHS O E
more than a year. Representatives Division was still struggling with many
commented that most issues associated ramifications of the attack, and since the N C
with the renovated facilities had been County had previously obliged its facility
addressed or the issue had been retired, needs, it was the perception of the EHS staff A O
and most importantly, they stated the new that these changes in posture seemed both L V
spaces were beautiful, functional, secure, sudden and insensitive.
and had significantly contributed to the EHS E
Division’s returning sense of normalcy.
& R
Y

Narratives and Analysis 147

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

C
O
NF
O TI
R IN
G NA
A UN
N IC
I TI
Z YA This page is intentionally blank.
A L
TO
I FR
O E
N OC
A PO
L EV
RE
& AR
TY
I
O
N
S

Narratives and Analysis 148

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

6.4 Long-Term Security

After the December 2, 2015 terrorist attack, one of the greatest concerns voiced by
stakeholders across County departments was the addition of permanent security measures at
County government facilities (physical resources and processes). At the time, the County owned
or leased space in more than 500 buildings equating to more than 12 million square feet. Staff
in each one of those facilities wanted to feel safe in the aftermath of the attack. As a result,
many departments immediately took independent steps to enhance their security. For F
example, within days of the attack the Information Services Department (ISD) issued a Request
for Quotes (RFQ) for consultants to conduct a comprehensive physical security assessment of
O I
its headquarters. By December 15, 2015 (only 13 days after the attack) quotes had been R N
received and a consultant selected by the end of the month. Many departments where security
staff was present worked with their security to enhance procedures where appropriate (e.g., G A
bag checks, identification requirements, screening procedures). Similar procurement efforts
and process modifications were occurring in countless departments before County leadership
A N
even had time to articulate a countywide strategy. N C
To bring some initial order and efficiency to the independent efforts being undertaken by I I
departments, the County Chief Executive Officer (CEO) issued a memorandum in early January
2016 asking all department heads to first send security-related requests and recommendations
Z A
associated with County-owned facilities to the Facilities Management Division and ISD for A L
consideration, and any related to leased facilities to the Real Estate Services Department (RESD)
to help negotiate with landlords. This would be the start of a set of security and safety related T
strategic efforts the County would later refer to as the “SB Safe” initiative. The top ten
recommendations received over the course of the next few months from this initial information
I R
gathering effort were: O E
1. Employees should wear easily visible County-approved identification badges at all times. N C
2. Personnel should be trained to be alert to surroundings from parking lot to work space.
3. The County should encourage open communication and reporting of anything suspicious
A O
(e.g., “If you see something, say something.”). L V
4. The County should formally evaluate security guard requirements.
5. Have the Sheriff’s Department provide security awareness training to all personnel. E
6. Ensure doors between public and employee work areas are accessible via key card
access only.
& R
7. Remind employees to ensure interior and exterior access doors are closed and locked Y
each time they enter or exit.
8. Install door release controls and intercoms at points of entry as appropriate.
9. Install video cameras in strategic locations.
10. Ensure Department Emergency Operations Plans (DEOPs) and Facility Emergency Action
Plans (EAPs) are up-to-date.

These were relatively inexpensive initial efforts and the County knew early on that a strategic
approach for potentially sweeping assessments and associated changes would be necessary.
Following a shooting at Riverside City Hall in 1998, San Bernardino County had established a
Security Task Force consisting of representatives from the RESD, ISD, the Sheriff’s Department’s
Narratives and Analysis 149
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Office of County Safety and Security, and Risk Management with other advisory members. The
group met as needed thereafter, but most notably in the aftermath of the September 11, 2001
terrorist attacks when the County reviewed security protocols respective to then released
C lessons learned and guidelines. Following the December 2, 2015 terrorist attack, the County
O revitalized the Security Task Force, added the Emergency Services Manager from the County’s
Office of Emergency Services (OES), and tasked the group to develop a strategy for long-range
NF security assessments of County facilities. Although the San Bernardino County Fire Protection
District is a separate legal entity from the County, the County offered to include its facilities in
O TI the County’s assessments. On February 12, 2016 a Request for Proposal (RFP) was issued and
R IN on May 24, 2016 the County Board of Supervisors approved on-call contracts with two
consulting companies to conduct security assessments of County facilities for 3-year terms,
G NA each not to exceed $500,000.
A UN Between January and May 2016, some initial steps were taken to improve security, primarily by
adding key card access to buildings where it didn’t previously exist and modifying security guard
N IC staffing requirements where appropriate. In addition, the County asked the Sheriff’s
I TI Department’s Office of County Safety & Security to begin hosting substantive quarterly security
meetings/forums with County departments. Those offerings began in June 2016 and continued
Z YA quarterly since. Feedback on the content and approach was generally positive at the time of
this report.
A L Security Assessment Contract Objectives…
TO As stated within the security contracts, they were intended to “Conduct security assessments of
I FR County-owned and leased facilities. The assessments shall provide a comprehensive review of
existing security measures and recommendations for each facility that are consistent with an
O E overall County security plan development. The Consultant(s) shall have the capability to assist
the County in prioritization, cost-benefit analysis, and development of standards. The
N OC assessments may include reviewing the following:
A PO  General Site/Building Security o Building Intrusion Detection & Alarm
o Perimeter Security Systems
L EV o Building Interior Security o Emergency Communication Systems
RE o Facility Parking Lots o Property Management and Control
o Facility Exterior Lighting o Shipping, Receiving & Storage Operations
& AR o Facility Vegetation o Lock & Key Control
o Facility Signage o Protection of Utilities, Air Intakes &
TY o Public Interface Critical Infrastructures
I o Security Incident History o Facility Emergency Action Plan
 Physical Security Systems, Technology and  Physical Security Operations
O Controls o Security Staffing and Operations
o Vehicle Access, Traffic & Parking Controls o Security Post Instructions
N o Employee, Visitor & Contractor Access o Security Uniforms and Equipment
S o Visitor Management Systems  Planning and Compliance Monitoring
o Access Control Systems o Security Roles & Responsibilities
o Video Surveillance Systems/CCTV o Security Policies & Procedures
systems

Narratives and Analysis 150

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

o Pre-Employment Screening & o Personal Emergency Response

Termination Practices o Facility Action Plans
o Security Education & Awareness o Training Program Development
o Security Info. & Incident Reporting o Personnel Training
o Security Emergency & Contingency o Compliance Monitoring”
Planning
F
Accounting for the County owned or leased space of more than 500 buildings at the time, 8
categories/classifications of County facilities were defined and prioritized for receiving
O I
assessments by the Security Task Force and consultants. Within the highest priority category, 8 R N
sites were identified. In late autumn 2016, the security consultants completed an assessment of
the High Desert Government Center as a beta-test of the assessment process and approach. G A
Remaining assessments of the highest priority facilities took place later in 2017 after the beta-
test was approved and additional cost estimates were received from the security consultants.
A N
As assessments were completed, security reports and recommendations for each facility were N C
provided to the County for consideration. As of the time of this report, the County and security
consultants were moving on to the second group of facilities to assess while the first phase of I I
improvements were being funded. All selected security enhancements would be pursued under
normal capital improvement budget processes and normal procurement authorities after each
Z A
comprehensive assessment is complete, thereby ensuring consistent and complementary A L
technologies and economies of scale are applied to the County’s security posture.78 At the time
of this report, the security assessment process was still underway. T
Progress Toward New Security Measures…
I R
Since visible facility-specific or county-wide security modifications had not been implemented O E
at the time of this report (2+ years after the attack), a majority of County stakeholders engaged
as part of this review voiced frustration with the perceived lack of progress. County executives
N C
and the Security Task Force were sensitive to these concerns, but understood appropriate A O
strategies take time. Growing impatient, however, many departments continued to pursue
their own independent security enhancements in the early stages. On March 13, 2017 the RESD L V
Director issued a memo to all executives and department heads reminding them that
independent security enhancements would not be approved without first being vetted by the
E
Security Task Force to ensure conformance with the county-wide strategy. Department-specific & R
efforts had been minimized while County-wide enhancements were being awaited. However,
staff expressed that some level of satisfaction may be achieved or additional security felt, if Y
information about the progress or current status of security measures was regularly shared and
continued to be shared as additional accomplishments are realized.

78
Because of the sensitive nature of the security assessment process and findings, the details and results are not
included in this report.
Narratives and Analysis 151
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

F
O I
R N
G A
A N
N C
I I
Z A
A L This page is intentionally blank.
T
I R
O E
N C
A O
L V
E
& R
Y

Narratives and Analysis 152

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

6.5 Total Cost Accounting

The total costs incurred by San Bernardino County associated with the December 2, 2015
terrorist attack reached approximately $22.6 million as of January 12, 2017.79 This total does
not include costs incurred or anticipated after this date, such as legal fees and the planning of
the physical memorial to commemorate the victims. This amount includes costs that could be
clearly tracked and categorized by the County. In addition, there is likely a margin of error for
less tangible costs and/or minor costs that could not be tracked or were incurred by individual F
departments. O I
Business Interruption R N
The personnel costs (salary and benefits) associated with closing all non-essential County
offices and functions between mid-day December 2nd and December 6th is estimated at $5 G A
million. These costs were captured and tracked in the County’s time keeping system for
employees as “EVAC” and constituted the single largest cost borne by the County. The actual
A N
economic impact of standing down non-essential County services in the region during this N C
timeframe was not reviewed as part of this report.
I I
Business Interruption (Evacuation) Costs: $5.0 million
Z A
Mutual Aid/Contract Services for Environmental Health Services
By December 2018, the County will have paid $4.2 million for temporary mutual aid A L
(approximately $700,000) and ongoing contract staffing to backfill Department of Public T
Health/Environmental Health Services (EHS) Division positions ($3.5 million). The contract for
temporary staffing was set to expire in December 2018. If it is extended, then these costs will I R
increase accordingly.
O E
Mutual Aid/Contract Services for Environmental Health Services: $4.2 million
N C
Real Estate (Temporary Relocations and Remodeling)
The temporary office spaces remodeled and equipped to accommodate EHS and Land Use
A O
Services (LUS) Department personnel until permanent office space was remodeled totaled L V
$200,000.80
E
The remodeling and reconfiguring of permanent EHS, LUS, and Multimedia Services Division
offices totaled $3.0 million.81 The office space located at the County Government Center cost
& R
$2.025 million and the Rancho Cucamonga office space totaled $975,000. Y
Real Estate Costs: $3.2 million

79
To put this in context, the San Bernardino County FY 2016-17 adopted budget was approximately $5.5 billion, of
which approximately $839 million was the County’s discretionary general fund. After January 12, 2017 the County
stopped tracking costs specific to the 12/2/15 attack with the exception of the ongoing temporary staffing contract
for the EHS Division.
80
These costs were eligible for reimbursement through the AEAP grant. See narrative 6.6 Cost Recovery/
Reimbursement on page 157 for more information.
81
Minimal costs were incurred related to the relocation of the Multimedia Services Division, other than paint and
basic supplies, because they were relocated to another office space within the County Government Center that
was equipped and capable of supporting their operations.
Narratives and Analysis 153
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Employment Benefits
Direct benefits to the victims and survivors totaled $1.7 million and included 82:
 Payments by the County as of January 2017 to fill the gap between workers’ compensation
coverage and short-term disability for victims at the incident (“make employees whole”):
$500,00083
 One month paid leave for victims who were present at the incident but not physically
F injured: $400,000
O  Paid leave for County employees (EHS and Land Use Services) not at the incident: $200,000
I  Payment of COBRA medical, dental and vision insurance premiums for the dependents of
R N the deceased covered under the County insurance program: $200,000
 Reimbursed lost income and paid sick leave for County employees that were relatives of
G A victims at the incident: $100,000
A N  Contracted counseling services: $300,00084
Direct Employment Benefits to Victims: $1.7 million
N C
I I Administration Costs
Administration costs totaled $2.4 million and included the salaries for County leadership and
Z A executives for time spent dedicated to responding to the terrorist attack, participating in
relevant meetings, and attending to the needs of victims.85
A L
Administration costs: $2.4 million
T
Security Personnel and Physical Security Modifications
I R Security personnel costs and physical security modifications to the Human Services Department
O E facilities during the day of, and in the months after, the attack totaled $1.6 million.86 This
included additional guards, enhanced security, closed-circuit surveillance cameras, and new
N C card access to buildings within Human Services. These costs were reimbursed through various
Human Services claims processes.
A O
L V
E
82
& R Not included in the list are costs associated with nurse case managers as those began January 12, 2017 after the
County’s active accounting of incident-related costs stopped. As of the writing of this report, costs associated with
nurse case managers exceeded $400,000.
Y 83
Not included here are the costs the County paid in workers’ compensation benefit payments since the County
had a self-administered and self-funded program at the time of the attack. These costs were considered part of the
County’s anticipated risk borne by an insurance provider (whether in-house or third party).
84
The costs associated with COBRA premiums, reimbursed lost income, and counseling services were eligible for
reimbursement through the AEAP grant. See narrative 6.6 Cost Recovery/Reimbursement on page 157 for more
information.
85
This amount is based on employee time reporting in the official time keeping system, but does not capture any
time personnel may have charged to non-incident codes.
86
Not included are the costs the County paid in workers’ compensation benefit payments since the County had a
self-administered and self-funded program at the time of the attack. These costs were considered part of the
County’s anticipated risk borne by an insurance provider (whether in-house or third party). Also not included are
costs related to workers’ compensation and general liability premiums that increased for the Department of Public
Health after the attack.
Narratives and Analysis 154
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

The County tracked an additional $300,000 in security costs and security modifications to other
County owned or leased buildings that were not eligible to be reimbursed through the Human
Services claims process.
Security measures: $1.9 million

Victim Liaisons, In-House Counseling Teams and Staff Providing Direct Service to Victims
Victim liaisons, in-house counseling teams, and County staff that provided direct services to
F
victims at incident sites and after the incident totaled $1.6 million. This includes standby time, O I
regular time, and overtime.
R N
The County was reimbursed $1 million for these expenditures through the Human Services
claims process and by the California Victim Compensation Board (CalVCB) through the U.S.
G A
Department of Justice (DOJ) Antiterrorism and Emergency Assistance Program (AEAP) Grant. A N
County staff providing direct service to victims: $1.6 million N C
County First Responders87 and Supporting Staff I I
The Sheriff’s Department’s regular time and overtime costs associated with the terrorist attack
totaled $600,000.88 Information Services Department (ISD) support for first responders totaled Z A
$200,000. A L
First Responders and Supporting Staff Costs: $800,000
T
Memorial Events and Items I R
Memorial costs totaled $300,000 and included the facility/event costs for the January 4, 2016
“County Family Gathering” as well as the costs incurred for the first year anniversary luncheon. O E
Memorial items included “SB Strong” lapel pins, picture frames, and video production.
N C
Memorial Events and Items: $300,000
A O
Miscellaneous Equipment and Supply Costs
Equipment and supply expenditures included food, emergency supplies, fuel, fleet costs, office
L V
supplies, and cell phones for responding departments and agencies, including the Department E
of Public Health, Arrowhead Regional Medical Center, the Office of Emergency Services, Fleet
Management, Probation Department, and the Sheriff’s Department. These expenditures & R
totaled $300,000 and supported crisis intervention services, victims, and emergency personnel.
Y
Equipment and Supply Costs: $300,000

87
The Fire Protection District costs related to the attack totaled $220,000 and are not included in this accounting
as the Fire Protection District is a separate legal entity from the County. However, the Fire Protection District
receives a substantial level of support from the County General Fund so these costs may indirectly affect the
County in the long run. The Probation Department incurred $11,000 in expenditures that are included in the
Miscellaneous Equipment and Supplies costs.
88
These costs were reimbursed through the Bureau of Justice Grant. See narrative 6.6 Cost Recovery/
Reimbursement on page 157 for more information.
Narratives and Analysis 155
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Miscellaneous Costs
Miscellaneous costs including fuel, mileage, and overtime for personnel totaled $100,000.
Miscellaneous Costs: $100,000

Legacy Documentation
The documentation of the County’s efforts following the December 2, 2015 terrorist attack (this
F report), associated Legacy Document, and County Workshop cost $200,000.
O I Legacy Document: $200,000
R N Additional EHS Support Costs
G A The County included in its cost accounting $500,000 for additional staffing for EHS including a
dedicated Human Resources Officer (HRO) and a Wellness Coordinator and $400,000 in
A N anticipated costs for Community Resiliency Forums and post-trauma workshops.89
N C Additional EHS Support Costs: $900,000
I I
Z A
A L
T
I R
O E
N C
A O
L V
E
& R
Y

89
The dedicated HRO began 8/8/2016 and the Wellness Coordinator was hired 2/4/17. Community Resiliency
Forums and post-trauma workshops were eligible for reimbursement through the AEAP grant.
Narratives and Analysis 156
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

6.6 Cost Recovery/Reimbursement

Following the December 2, 2015 terrorist attack, San Bernardino County leadership and County
Supervisors established a precedent to do “whatever it takes” to support victims and affected
employees. From the onset, County leadership was aware many of the expenditures related to
the terrorist attack would likely not be reimbursed, but they would still responsibly seek to
identify and pursue all available avenues for reimbursement. The below pie chart illustrates the
amounts the County recovered through the programs described in this section as of the date of F
this report as compared to its total documented direct expenses of $22.6 million. O I
R N
G A
A N
N C
I I
Z A
A L
T
I R
O E
Identification of Funding Sources
San Bernardino County worked extensively to identify available funding sources to recover
N C
costs incurred by the County, Cities of San Bernardino and Redlands, and others affected by the A O
incident. The County Administrative Office (CAO), the Office of Emergency Services (OES), Office
of Governmental and Legislative Affairs, District Attorney’s Office, and Sheriff’s Department L V
each worked on finding external sources for cost reimbursement. Elected officials supported
these efforts by helping to identify funding sources, writing letters of support and, in a few
E
instances, proposing legislation (discussed in narrative 6.8 Legislation on page 163). These & R
combined efforts identified the following possible monetary resources: U.S. Department of
Justice (DOJ), U.S. Department of Homeland Security (DHS), California Governor’s Office of Y
Emergency Services (CalOES), and the California State Legislature. The County also reached out
to associations such as the National Association of Counties and the California State Association
of Counties, and elected officials at the State and Federal level to help identify additional
resources.

Cost Recovery efforts were coordinated during the Post-Incident Coordination Meetings (PICM)
regularly facilitated by the CAO. During these meetings, updates were given from various
County departments as to the identification of funding sources, the application process, and the
status of submitted applications. Additionally, these meetings were used as opportunities to
ensure information related to costs was being gathered by appropriate departments,
Narratives and Analysis 157
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

appropriately tracked, and submitted to OES. During the January 21, 2016 PICM, for example,
the importance of tracking the grant opportunities each department was applying for was
emphasized by the County CEO to ensure that efforts were not duplicated. It was also stressed
that each department include OES in the application process.

Ultimately, three viable funding sources were identified and leveraged: the California Disaster
F Assistance Act (CDAA), the U.S. DOJ’s Antiterrorism and Emergency Assistance Program (AEAP),
and Bureau of Justice Assistance Grants.90 If all expenditures submitted through these programs
O I were approved, approximately forty percent (40%) of the total incident costs to the County of
R N $22.6 million may have been reimbursed (see narrative 6.5 Total Cost Accounting on page 153
for detailed information on the $22.6 million in costs). However, many of the most costly
G A expenditures associated with the incident were later deemed ineligible for reimbursement by
traditional funding sources, including costs for temporary office/operational closures and
A N business disruption following the incident ( $5 million) and renovation of the Environmental
N C Health Services (EHS) Division offices ( $3 million).

I I California Disaster Assistance Act (CDAA)

CDAA is a disaster assistance program administered by the CalOES at the discretion of the
Z A Governor. San Bernardino County became eligible for CDAA funding when Governor Jerry
A L Brown proclaimed a State of Emergency on December 18, 2015. The OES is the designated
County lead agency that compiles and submits CDAA applications to CalOES. There is a cost
T share for CDAA funding of 75% paid by the State of California and 25% born by the applicant,
excluding administrative costs which are reimbursed at 10% of the approved State
I R reimbursement amount.91
O E
The December 2, 2015 terrorist attack was the first time CalOES managed CDAA for a terrorism
N C event. Accordingly, CalOES created new forms for County departments to use to report related
A O costs. In early February 2016, the County submitted $18 million in costs to CalOES for CDAA
consideration. However, only a small fraction of the costs were reimbursed. CalOES initially
L V determined that only up to $5 million of the $18 million in costs submitted for reimbursement
were eligible for consideration. Costs that were determined to be ineligible included county
E evacuation costs (the funding code used for business closures/business disruption) from
December 3 - 6, 2015 and the remodeling of EHS offices. As of the date of this report, CalOES
& R approved $474,003 in costs as eligible for reimbursement for all County departments except
Y Public Health. The Department of Public Health was still working with CalOES on an estimated
$2.8 million in total eligible costs. Through December 2017, the County had received $310,215
per the State’s 75%/25% cost share requirement for County departments, excluding the
approved Sheriff’s Department reimbursement and the pending Public Health reimbursement.
CDAA Reimbursement: $310,215

90
The December 2, 2015 terrorist attack was not eligible for Federal Disaster Assistance under the Stafford Act as a
Presidential Disaster Declaration was never issued and the total costs did not exceed California’s eligibility
threshold (approximately $48 million at the time).
91
San Bernardino County worked on legislation that would change the cost share for the State portion to 100%.
This was vetoed by Governor Brown (see narrative 6.8 Legislation on page 167 for more information).
Narratives and Analysis 158
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Antiterrorism and Emergency Assistance Program (AEAP), U.S. DOJ Office for Victims of Crime
In December 2016, the California Victims Compensation Board (CalVCB) was awarded just over
$4 million in funding from the U.S. DOJ Office for Victims of Crime (OVC) through the AEAP
grant. The San Bernardino County Bureau of Victims Services (BVS)sponsored by the District
Attorney’s Officehelps to administer compensation claims and other benefits for victims of
crime on behalf of the CalVCB (see narrative 4.2 Victims of Crime Services on page 91 for more
information). F
In June 2017, CalVCB provided a proposed subgrantee agreement to the County. The
O I
agreement went through several revisions and the final version was received by the County on R N
August 15, 2017. The agreement was approved by the Board of Supervisors on September 12,
2017. Through the AEAP grant agreement, the County is eligible to receive up to $1.15 million G A
for the reimbursement of costs associated with: temporary space for the EHS Division
($207,000), a Human Resources Officer (HRO) and Wellness Coordinator for the EHS Division
A N
($473,000), counseling services ($300,000), COBRA insurance premiums for families of the N C
deceased ($126,000), overtime for a few Victim Liaisons ($24,000), security for Department of
Public Health (DPH) facilities ($11,000), and child and dependent care service at the Family I I
Assistance Center (FAC) ($1,600).
Z A
Beyond the publication date of this report, the County may also seek reimbursement of up to A L
$436,000 for new projects and continued work on projects that are partially underway. These
projects include management and wellness training, community resiliency forums, and post- T
trauma workshops.
I R
Potential AEAP Reimbursement: up to $1.5 million
O E
Assistance Grant, U.S. DOJ Bureau of Justice
In January 2016, San Bernardino County Sheriff John McMahon and City of San Bernardino
N C
Police Chief Jerrod Burguan traveled to Washington, D.C. to meet with officials to identify A O
funding mechanisms to recoup the costs law enforcement agencies incurred responding to the
attack. Bureau of Justice Assistance funds were then identified as a possible funding source. L V
In March 2016, U.S. Congressional Representatives Pete Aguilar (CA-31) and Ken Calvert (CA-42)
E
requested that the Bureau of Justice’s Edward Memorial Justice Assistance Grant Program (JAG) & R
and the Emergency Federal Law Enforcement Assistance Program be made available to help
San Bernardino law enforcement agencies recover costs connected with the December 2, 2015 Y
terrorist attack. On June 28, 2016, the Department of Justice awarded the California Board of
State and Community Corrections $500,000 from the JAG program to be distributed directly to
affected local law enforcement agencies.

The San Bernardino County Sheriff’s Department incurred approximately $600,000 in expenses
related to regular time and overtime for first responders during the incident. The California
Board of State and Community Corrections distributed $300,000 to the San Bernardino Sheriff’s
Department. The County anticipates an additional $300,000 will be awarded through the same
program during fiscal year 2017 to complete the reimbursement.

Narratives and Analysis 159

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

All non-Sheriff’s Department, County first responder costs were being applied to the CDAA
application at the time of this report, including Probation Department, Fire Protection District,
and SBCFPD/OES costs.
Anticipated Bureau of Justice Assistance Grant Reimbursement: $600,000
F
O I
R N
G A
A N
N C
I I
Z A
A L
T
I R
O E
N C
A O
L V
E
& R
Y

Narratives and Analysis 160

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

6.7 Litigation
Under the California Tort Claims Act92, an injured party has six (6) months to file a claim against
any public entity related to wrongful death, personal injury or damage to property. The public
entity, in this case the County of San Bernardino, must respond to the claim within forty-five
(45) days. If the public entity denies the claim, the claimant has six (6) months to file suit.

Claims Against the County F

A total of twenty-nine (29) claims were initially filed against the County associated with the
December 2, 2015 terrorist attack; many related to wrongful death, negligence, and claims the
O I
County fostered a hostile work environment. The San Bernardino County Department of Risk R N
Management was responsible for responding to claims filed against the County. All 29 claims
were denied by the County. G A
Lawsuits Against the County
A N
After the 29 claims were rejected, four (4) lawsuits were filed: N C
 One person injured in the attack filed suit against the County for damages in excess of
$150,000. The case was dismissed in State court with prejudice. I I
 The families of three (3) County employees killed in the attack filed a joint wrongful Z A
death suit against the County for damages exceeding $200 million.93 The suit was
scheduled to be moved to federal court in March 2018. A L
 A workers' compensation insurance carrier for the contractor that ran the coffee shop at
the Inland Regional Center (IRC), whose employee was the only non-County fatality,
T
filed a subrogation lawsuit against the County for over $50,000 for the cost for I R
contractor’s workers’ compensation claims and damages. The case was dismissed.
 During the tactical response to the attack, a Sheriff’s Deputy ran a red light and hit O E
another car. The driver injured in that accident filed suit. The County’s position was that
the claim had value, but the two sides had not agreed on compensation at the time of
N C
this report. A O
Future Issues L V
Claimants may ask the Court’s permission to file a late claim after the original six-month
deadline has expired, if the claimant was a minor during the claim period. There is a possibility
E
that the minor children of those killed or injured during the attack may file future claims once & R
they turn 18 years old. Under California law, claimants have 2 years after the date of majority to
file a claim. Y

92
California Government Code §810-996.6. Note the exclusive remedy for a workplace incident is workers’
compensation in accordance with the California Labor Code. See narrative 4.5 Workers’ Compensation on page
105 for more detail on the workers’ compensation claims.
93
Co-defendants also include Allied Universal, Allied Barton Security Services, California Housing Foundation,
Department of Homeland Security, Department of Justice, Inland Regional Center, and the State of California.
Narratives and Analysis 161
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

F
O I
R N
G A
A N
N C
I I
Z A This page is intentionally blank.
A L
T
I R
O E
N C
A O
L V
E
& R
Y

Narratives and Analysis 162

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

6.8 Legislation
The legislative efforts supported by the County of San Bernardino included recovering costs
associated with the response to and recovery from the attack, in addition to lobbying for
services and support for victims (e.g., the Antiterrorism and Emergency Assistance Program
[AEAP] grant). The Office of Governmental and Legislative Affairs within the County
Administrative Office (CAO) worked closely with lawmakers to pursue cost recovery funding
and other funding sources for services to assist the victims. Additionally, in the two years since F
the attack, legislators have proposed bills related to workers’ compensation and other issues to
better prepare for and mitigate the repercussions of future terrorist attacks. An unknown
O I
number of legislators and bills within California and across the country have used the San R N
Bernardino terrorist attack as justification, but this report will only speak to those directly
connected to County. G A
State of California
A N
N C
SB-1385: California Disaster Assistance Act: Inland Regional Center (2015-2016)
The current California Disaster Assistance Act (CDAA) allows the State to reimburse local I I
governments for up to 75% of the costs borne by their first responder agencies while
responding to and recovering from an emergency or natural disaster. The California Governor’s
Z A
Office of Emergency Services (CalOES) oversees administration of the CDAA and for the first A L
time was tasked with determining reimbursement policies for a terrorist attackthe attack in
San Bernardino was the first of its kind in the State. In the past, under special circumstances T
and through legislative action, several events were reimbursed for the full cost94 incurred by I R
their respective agencies, but no event has been reimbursed for 100% of its costs since 2006.
O E
In February 2016, State Senator Connie Leyva (District 20) introduced Senate Bill 1385, which
would have added the December 2, 2015 terrorist attack to the list of events necessitating a N C
100% State reimbursement. The bill contended that law enforcement’s rapid and overwhelming A O
response saved lives and to not reimburse the full cost would financially penalize the agencies
for their success. The bill was sponsored by San Bernardino County and had its full support and L V
endorsement. The County Board of Supervisors also reminded legislators that the City of San
Bernardino was still struggling with bankruptcy. Ultimately, SB-1385 passed the Assembly and E
Senate unopposed. & R
However, in September 2016, California Governor Jerry Brown vetoed SB-1385. While Y
acknowledging the extreme circumstances of the December 2, 2015 terrorist attack and the
extraordinary response by law enforcement, he expressed concern that approving SB-1385
would set an unrealistic precedent for jurisdictions seeking reimbursement for future
emergencies. Governor Brown argued it was unrealistic to expect the State’s General Fund95 to
be capable of providing that level of reimbursement on a regular basis.
94
Prior events for which the state has reimbursed 100% of the costs include the Loma Prieta Earthquake (1989),
East Bay Fire (1991), Southern California fires (1993 and 2003) and San Simeon Earthquake (2003).
95
The State General Fund is the largest of the State’s budget funds and the only one not dedicated to a specific
purpose. As such, lawmakers and the Governor have the most discretion over the General Fund (approximately
$82 billion in 2017).
Narratives and Analysis 163
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

AB-44: Workers’ Compensation: Medical Treatment: Terrorist Attacks: Workplace Violence

(2016-2017)
In December 2016, State Assembly Member Eloise Reyes (District 47) introduced legislation
(AB-44) designed to expedite the workers' compensation process through which the victims of
the attack received their medical benefits. The legislation proposed to remove the Utilization
Review requirement in cases of terrorism and to add terrorist attack and workplace violence
F injuries to the list of medical conditions for which aggregate temporary disability payments may
be made for up to 240 weeks over the course of 5 years. San Bernardino County took a neutral
O I position on AB-44 but offered guidance and advice as requested.
R N
Employees in California are entitled and required to seek compensation through California’s
G A Workers’ Compensation system when they are injured during the course of business. Per the
standard protocols, if a claim or request for medical treatment is received that the employer or
A N insurer feels is inconsistent with requirements or the Medical Treatment Utilization Schedule
N C (MTUS), then the claim/request undergoes a Utilization Review (UR) process, whereby a third-
party physician (or team of physicians) determines if the medical treatment is appropriate
I I and/or necessary. Treatment may be denied as a result of Utilization Review and denials can be
appealed. In January 2017, in response to victim concerns and media coverage related to
Z A denied care and delays due to the UR process, the California Department of Industrial Relations
A L (DIR) conducted a review of the more than 2,000 treatment requests processed by the County
in relation to the attack. The review found that 7% of claims were ultimately denied and that a
T significant number of those initially declined were overturned and reinstated once improved
documentation from patient healthcare providers was received.
I R
O E AB-44 was ultimately amended to call for an advocacy program instead of the suspension of the
Utilization Review process. The advocacy program would require that Nurse Case Managers be
N C assigned to each claimant following an act of terrorism in which the Governor Proclaims a State
of Emergency. AB-44 passed the State Senate and the Assembly, and was sent to the Governor
A O for signature on September 20, 2017. Governor Brown signed AB-44 into law on October 13,
L V 2017.

E San Bernardino County PIO David Wert issued a statement saying the legislation, "modeled
itself on the process created by the county to care for those who were injured on (Dec. 2,
& R 2015).” “…The county provided all of the employees who were physically injured with the
Y immediate services of nurse case managers and counseled them on the medical treatment
options that were available to them,” Wert said, adding “The county eventually extended those
services to other employees who were being treated through workers' compensation.”

Federal Lobbying Directly Related to the San Bernardino Attack

A number of federal representatives, including Congressman Pete Aguilar (CA-31), advocated
for San Bernardino County in the U.S. House of Representatives. As a member of the House
Appropriations Committee, Representative Aguilar sent a formal request to the committee to
support the County’s applications for the Byrne Justice Assistance Grant and the Emergency

Narratives and Analysis 164

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Federal Law Enforcement Assistance Program. Both grants assist state and local governments
with emergency funding. Representative Aguilar also sent a letter encouraging the
Appropriations Subcommittee on Homeland Security to increase the budgeted amount for the
State Homeland Security Grant Program (SHSGP) citing the San Bernardino terrorist attack as
justification.

Other Legislation Associated with the San Bernardino Attack F

Following the attack, California Senator Dianne Feinstein reintroduced legislation that would
require social media companies to report online terrorist activity. At the time of this report,
O I
S.2372 (Requiring Reporting of Online Terrorist Activity Act) had not made it out of committee R N
review. In December 2016, Representative Aguilar and nine other California representatives
sponsored H.R.625 – 115th Congress (2017-2018), which would require the Secretary of the G A
Department of Homeland Security to submit an unclassified report to Congress within one year
of a terrorist attack detailing recommendations and policy changes. H.R.625 passed the House
A N
of Representatives and was awaiting a vote in Senate Committee when this report was N C
published.
I I
Additionally, citing the San Bernardino terrorist attack, California lawmakers passed SB 1446
(Hancock), which limits the use and/or possession of high-capacity magazines and AB 1695
Z A
(Bonta), which targets what is known as ‘straw purchases,’ in which someone who can legally A L
pass a background check buys a weapon and then sells it to someone who cannot pass said
background check. Both bills were signed by California’s Governor Brown on July 1, 2016. T
San Bernardino County did not take a position on either of these bills.
I R
O E
N C
A O
L V
E
& R
Y

Narratives and Analysis 165

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

This page is intentionally blank.

166
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

IV. Conclusion
The December 2, 2015 terrorist attack took the lives of 14 people, 13 of whom were employees
of the Environmental Health Services (EHS) Division of the San Bernardino County Department
of Public Health (DPH). It left an additional 22 County employees injured and those present and
hundreds beyond with emotional trauma. It was perpetrated by a County employee who had
previously been a trusted colleagueand even friendto those he targeted, but who had
become radicalized by the ISIS/ISIL. The impacts of the attack extended well beyond those
physically present. The 22,000 County employees who affectionately refer to themselves as
“the County Family” were concerned for the wellbeing of their affected colleagues and their
own safety and many shared the violation and emotional toll of those much closer to the
incident. The attack also disrupted essential government services upon which the public’s
health depends. The consequences felt and actions taken in response continued in the days,
weeks, and months following the attack and will likely continue for years to come. This report
endeavored not only to capture the breadth of the impacts on the County, but also to highlight
the hundreds of actions taken by dedicated County employees to address those consequences
(personal, operational, fiscal, etc.). As an organizational review this report was intended to
capture the most important aspects of the County’s response and the resilience of the County
Family as a whole.

There was no doubt to the authors of this report that San Bernardino County had the best
intentions in its decision-making for victims, employees, operations, and the community. There
was a “do whatever it takes” mentality at all levels. That perseverance was often rewarded as
the County was able to circumvent bureaucracy and red tape to expedite and/or increase
services; however, in some cases, it was limited by regulation or resource availability beyond its
control. The County provided a number of services and offered benefits that went well beyond
its legal obligation as an employer and the precedents set by other jurisdictions/organizations
under similar circumstances.

The authors of this report found the decisions made and actions taken by the County were
reasonable, and in many cases exceptional, given the circumstances and with the information
and resources available. The authors recognized less-than-optimal decisions and actions were
often better than no action at all as the County demonstrated no hesitation toward addressing
challenges and later reflected upon them. In many cases, it was only with the advantage of
hindsight that lessons, alternate approaches, opportunities for improvement could be
identified. A number of lessons had already been identified and acted upon by the County to
improve its readiness and resilience by the time this report was commissioned.

Certain circumstances also worked to the County’s advantage. Had the attack been part of a
larger plot on County government, the lack of a mass notification system or inconsistent
implementation of lockdown procedures could have had more severe consequences. Where
nearly $25 million in costs may have paralyzed other jurisdictions, it was a relatively small
amount associated with the County’s $800 million annual discretionary fund and $5.5 billion
overall budget. Being part of the four-county Greater Los Angeles region with a population of
Conclusion 167
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

nearly 18 million, the County benefited from immediate access to substantial emergency
services, behavioral health, and environmental health mutual aid and contractual resources
that facilitated a more effective response, the provision of counseling services, and continuity
of essential functions. With operations in more than 500 buildings, the County found it
relatively easy to identify vacant space for alternate facilities despite a lack of pre-existing
plans. The County’s history of frequent emergencies, including natural disasters and major law
enforcement incidents, had given County leadership and departments critical experience
implementing emergency authorities and actions under crisis conditions. The combination of
experience and circumstances presented both challenges and opportunities that were
navigated through keen decision-making to emerge more resilient than before.

On December 2, 2015 there was no guidebook to which San Bernardino County could turn to
direct its path forward. This report, written with the benefit of hindsight, captures the County’s
extraordinary efforts during the most trying times. Through it all, the quick response and
heartfelt effort by County employees to address the many unique challenges posed by the
attack was, and continues to be, truly remarkable.

Conclusion 168
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Appendix A: Bibliography
Anonymity was essential to obtaining candid input from the individuals engaged in the creation
of this report. It was also important in the writing of this report to maintain an organization-
wide perspective. As such, the topical/programmatic narratives in Section 3 of this report were
not written to cite their sources, unless specifically necessary. Instead, the following
bibliography is provided as a record of the documents that contributed to this review as well as
the individuals interviewed in group or individual settings.

Interview and/or Workshop Participants

Adams, Cheryl - San Bernardino County Preschool Services Department
Alarcon, Flerida - San Bernardino County District Attorney, Bureau of Victim Services
Alexander, Diana - San Bernardino County Preschool Services Department
Alvarez, Julie - San Bernardino County District Attorney, Bureau of Victim Services
Antonucci, Michael - San Bernardino County Office of Emergency Services
Basle, Jean-Rene - San Bernardino County, County Counsel
Beaty, Schlyer - San Bernardino County District Attorney, Bureau of Investigation
Blakemore, Michelle - San Bernardino County, County Counsel
Broome, Eric - San Bernardino County Department of Risk Management
Brown, Michelle - San Bernardino County Probation Department
Candelaria, Joshua - San Bernardino County Administrative Office, Office of Governmental and
Legislative Affairs
Cardona, Felisa - San Bernardino County Administrative Office, Public Information
Clay Valerie - San Bernardino County Administrative Office, Finance and Administration
Condon, Christopher - San Bernardino County Probation Department
Cordova, Jake - San Bernardino County Information Services Department
Cronin, Brian - San Bernardino County Department of Public Health, Animal Care and Control
Division
Dalton, Cindy - San Bernardino County Administrative Office
Devereaux, Gregory - San Bernardino County Administrative Office
Dugas, Joshua - San Bernardino County Department of Public Health, Environmental Health
Services Division
Edney, Jessica - San Bernardino County Department of Public Health, Environmental Health
Services Division
Ellis, Meaghan - San Bernardino County Department of Public Health, Community Health and
Nursing Services Division
Fisk, Samuel - San Bernardino County Sheriff’s Department
Gardner, Megan - San Bernardino County, Human Resources Department, Employee Benefits
and Services Division
Goldman, Lori - San Bernardino County, Human Resources Department, Employee Benefits and
Services Division
Gonzales, Josie - San Bernardino County District 5 Supervisor

Appendix A: Bibliography A-1

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Gonzales, Maria - San Bernardino County Land Use Services Department, Code Enforcement
Division
Grooms, Brad - San Bernardino County Information Services Department
Gruchy, Andrew - San Bernardino County Department of Behavioral Health
Hagen, Marlene - San Bernardino County, Department of Children and Family Services
Hagman, Curt - San Bernardino County District 4 Supervisor
Haire, Phabs - San Bernardino County Preschool Services Department
Hartwig, Mark - San Bernardino County Fire Protection District
Haugan, Linda - San Bernardino County Administrative Office, Human Services
Hendrickson, Ellen - San Bernardino County, Human Resources Department, Employee
Relations Division
Henson, Bruce - San Bernardino County Information Services Department, Multimedia Services
Division
Hernandez, Kenneth - San Bernardino County Department of Risk Management
Hernandez, Leonard - San Bernardino County Administrative Office
Hernandez, Maral - San Bernardino County Administrative Office, Office of Governmental and
Legislative Affairs
Hilber, Jennifer - San Bernardino County Information Services Department
Hudson, Tom - San Bernardino County Land Use Services Department
Johnston, Kenneth - San Bernardino County Department of Public Health, Quality and
Compliance Division
Kelley, Veronica - San Bernardino County Department of Behavioral Health
Kiehl, Paul – San Bernardino County Department of Risk Management
Klinkhart, Tracy - San Bernardino County Sheriff’s Department
Kolcheva, Katherine - Office of San Bernardino County District 4 Supervisor
Krumwiede, Troy - San Bernardino County Information Services Department, Multimedia
Services Division
Lacy, Kevin - San Bernardino County Sheriff’s Department, Coroner Division
Locurto, James - San Bernardino County Transitional Assistance Department
Lovingood, Robert - San Bernardino County District 1 Supervisor
Lowe, Janet - San Bernardino County Real Estate Services Department
Lynch, Thomas - Inland Counties Emergency Medical Agency
Mayes, Mary - San Bernardino County Special Districts Department
McBride, Gary - San Bernardino County Administrative Office, Finance and Administration
McMahon, John - San Bernardino County Sheriff
Meza, Maria - San Bernardino County Department of Public Health, Environmental Health
Services Division
Michl, Susan - San Bernardino County Administrative Office
Morell, Lynna - San Bernardino County Clerk of the Board
Morgan, Joshua - San Bernardino County Department of Behavioral Health
Mullenix, Zachary - San Bernardino County Office of Emergency Services
Nelson, Pamela - San Bernardino County Real Estate Services Department
O’Toole, Mary - San Bernardino County Administrative Office
Ohikhuare, Maxwell - San Bernardino County Department of Public Health
Olhasso, Mary Jane - San Bernardino County Administrative Office, Finance and Administration

Appendix A: Bibliography A-2

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Osorio, Jennifer- San Bernardino County Department of Public Health, Environmental Health
Services Division
Perez, Daniel - San Bernardino County Department of Public Health, Disease Control Division
Peterson, Susan - San Bernardino County, Human Resources Department, Employee Relations
Division
Phillippe, Jason - San Bernardino County Department of Public Health, Environmental Health
Services Division
Pilorin, Ron - California Department of Public Health, Environmental Management Branch
Porter, Corwin - San Bernardino County Department of Public Health
Ramos, Gilbert - San Bernardino County Transitional Assistance Department
Ramos, James - San Bernardino County District 3 Supervisor
Randles, Bud - San Bernardino County District Attorney, Bureau of Investigation
Raymundo, Trudy - San Bernardino County Department of Public Health
Rediford, Traci - San Bernardino County District Attorney, Bureau of Victim Services
Reece, Tracy - San Bernardino County Probation Department
Rigney, Jeffrey - San Bernardino County Special Districts Department
Rivera, Marisa - San Bernardino County Economic Development Agency
Rojas-Castro, Angelica - San Bernardino County Administrative Office
Rowand, Douglas - Arrowhead United Way
Rozko, Laurie - San Bernardino County Purchasing Department
Rutherford, Janice - San Bernardino County District 2 Supervisor
Self, Teri - San Bernardino County Department of Children and Family Services
Serrano, Cindy - San Bernardino County, Office of Emergency Services
Smith, Dena - San Bernardino County Administrative Office
Smith, Michael - San Bernardino County District Attorney, Bureau of Investigation
Smith, Scott - Arrowhead Regional Medical Center
Soren, Asusena - San Bernardino County, Human Resources Department, Employee Relations
Division
Thomas, CaSonya - San Bernardino County Administrative Office, Human Services Department
Thompson, Terry - San Bernardino County Real Estate Services Department
Trager, Tim - San Bernardino County Information Services Department
Trapp, Donald - San Bernardino County Fire Protection District
Wagner, Miles - San Bernardino County, Office of Emergency Services
Welch, Laura - San Bernardino County Clerk of the Board
Welty, Kelly - San Bernardino County Department of Public Health
Wert, David - County Administrative Office, Public Information
Williams, LeAnna - San Bernardino County Department of Risk Management
Windle, Bob - San Bernardino County Administrative Office, Labor Relations
Wingert, Andrew - San Bernardino County Land Use Services Department, Code Enforcement
Division

After-Action Reports
Braziel, Rick, Frank Straub, George Watson, and Rod Hoops. 2016. “Bringing Calm to Chaos: A
Critical Incident Review of the San Bernardino Public Safety Response to the December 2, 2015,

Appendix A: Bibliography A-3

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Terrorist Shooting Incident at the Inland Regional Center.” U.S. Department of Justice, Critical
Response Initiative. Washington, DC: Office of Community Oriented Policing Services.

Umscheid, Simon, William Lee, and Lynette Grulke. 3/24/2017. Review of December 2, 2015
Officer Involved Shooting, San Bernardino County District Attorney. San Bernardino, CA.

Van Stralen, Daved, Sean D. McKay, George T. Williams, and Thomas A. Mercer. 2018. “Tactical
Improvisation: After-Action/Comprehensive Analysis of the Active Shooter Incident Response
by the San Bernardino City Fire Department.” San Bernardino City Fire Department/San
Bernardino County Fire Protection District. Redlands, CA.

Arrowhead Regional Medical Center. 2016. “Waterman Incident: Mass Casualty Shooting:
Arrowhead Regional Medical Center After-Action Report/Improvement Plan.” Colton, CA.

California Department of Industrial Relations, Division of Workers’ Compensation. February 23,

2017. “The Role of California’s Workers’ Compensation System in the San Bernardino
Shootings.” Sacramento, CA.

County Board of Supervisors Resolutions, Actions, and Board Meeting Minutes

Fair Statement of Emergency Meeting/Closed Session 12/2/2015
Fair Statement of Emergency Meeting/Closed Session 12/7/2015
Meeting Minutes, 12/15/2015
Report on Agenda Item #20: Ratify Proclamation of Local Emergency, 12/15/2015 and all
associated reports on the continuation for the proclamation between 12/15/2015 and
8/8/2017
Report on Agenda Item #21: Extension of Salary and Benefits for EHS Employees and Temporary
Payment of Medical and Dental Premiums for Dependents of Deceased Employees,
12/15/15
Meeting Minutes, 1/12/2016
Report on Agenda Item #74: Continuation of Emergency Related to Transition of the
Department of Public Health Environmental Health Services Division to Temporary
Location, 1/12/2016 and all associated reports updating progress on alternate facilities
and renovations to permanent facilities between 1/12/2016 and 1/24/2017
Meeting Minutes, 1/26/2016
Report on Agenda Item #13: Resolution Regarding California State Preschool Program Expenses
Incurred During Temporary Closure of All Sites Due to a Local Emergency, 1/26/2016
Meeting Minutes, 2/9/2016
Meeting Minutes, 3/1/2016
Report on Agenda Item #32: Crisis Counseling Services for County Employees
Meeting Minutes, 3/22/2016
Report on Agenda Item #29: Letter of Support for Senate Bill 893, 3/22/2016
Report on Agenda Item #32: Contract with California Association of Environmental Health
Administrators for Environmental Health Temporary Staffing and Mutual Aid
Memorandums of Agreement Template, 3/22/2016
Meeting Minutes, 4/19/2016
Appendix A: Bibliography A-4
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Meeting Minutes, 5/3/2016

Report on Agenda Item #18: Donation from the Robert Wood Johnson Foundation, 5/3/2016
Meeting Minutes, 5/24/2016
Report on Agenda Item #137: On-Call Consultant Agreements for Security Consultant Services,
5/24/2016
Meeting Minutes, 6/14/2016
Meeting Minutes, 6/28/2016
Report on Agenda Item #31: Purchase and Distribution of Prepaid Cards, 6/28/2016
Meeting Minutes, 7/12/2016
Meeting Minutes, 8/9/2016
Meeting Minutes, 8/23/2016
Report on Agenda Item #36: Crisis Counseling Services for County Employees and the Families
of Victims of the December 2, 2015 Terrorist Attack, 8/23/2016
Meeting Minutes, 9/13/2016
Report on Agenda Item #37: Contract Amendment with California Association of Environmental
Health Administrators for Environmental Health Temporary Staffing, 9/13/2016
Meeting Minutes, 9/27/2016
Report on Agenda Item #44: Accept Grant Agreement with the State of California, Board of
State and Community Corrections, 9/27/2016
Meeting Minutes, 10/4/2016
Meeting Minutes, 11/1/2016
Report on Agenda Item #26: 2016 Homeland Security Grant Award, 11/1/2016
Meeting Minutes, 11/15/2016
Meeting Minutes, 12/6/2016
Meeting Minutes, 12/20/2016
Meeting Minutes, 1/10/2017
Meeting Minutes, 1/24/2017
Report on Agenda Item #27: Contract with CPARS for 12-2 Organizational Review, 1/24/2017
Meeting Minutes, 5/2/2017
Report on Agenda Item #15: Contract Amendment with California Association of Environmental
Health Administrators for Environmental Health Temporary Staffing, 5/2/2017
Meeting Minutes, 8/8/2017
Report on Agenda Item #15: Termination of Local Emergency Related to Act of Terrorism,
8/8/2017
Meeting Minutes, 9/12/2017
Report on Agenda Item #25: Adoption of New County Policy - Employee Emergency Notification
System, 9/12/2017
Meeting Minutes, 9/26/2017
Report on Agenda Item #15: Grant Agreement with California Victim Compensation board for
Reimbursement of Expenses Resulting from the 12/2/15 Terrorist Attack, 9/26/2017
Meeting Minutes, 1/23/2018
Report on Agenda Item #45: Contract Amendment with CPARS for 12-2 Organizational Review,
1/23/2018

Appendix A: Bibliography A-5

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

“Countywire” Blog Posts

A Message from the Chairman, 12/2/2015
A Statement from Board Chairman James Ramos, 12/3/2015
A Message from the Board of Supervisors, 12/3/2015
San Bernardino United Relief Fund Established for Victims, 12/4/2015
To Our Environmental Health Family, 12/2/2015
County New Conference This Morning. Watch it Live, 12/6/205
Photos: January 4 Family Gathering, 1/5/2016
FBI Statement: iCloud Password Reset with FBI Consent, 2/22/2016
Plans Underway for Dec 2 Memorial, 5/5/2016
Plans for December 2 Memorial Moving Forward, 11/23/2016

Department Emergency Operations Plans (DEOPs)

Aging and Adult Services, 11/2/2015 District Attorney, 6/1/2012
Agricultural Weights and Measures, Economic Development Agency, 2/22/2013
7/13/2008 Facilities Management, 1/27/2011
Airports, 11/25/2012 Fleet Management, 12/18/2015
Architecture and Engineering, 7/14/2011 Human Resources, 8/6/2010
Arrowhead Regional Medical Center, Human Services, 9/15/2010
11/24/2015 Information Services, 11/30/2010
Assessor/Recorder/County Clerk, Inland Counties Emergency Medical Agency,
12/21/2015 11/1/2015**
Auditor/Controller/Treasurer, 9/3/2011 Land Use Services, 12/21/2015
Behavioral Health, 1/19/2016 Library Administration, 12/21/2015
Board of Supervisors, District 1, 12/12/2014 Museum, 1/30/2012
Board of Supervisors, District 2, 7/3/2013 Preschool Services, 12/21/2015
Board of Supervisors, District 3, 7/1/2013 Probation, 5/2/2011
Board of Supervisors, District 4, 4/4/2015 Public Defender, 12/17/2015
Board of Supervisors, District 5, 5/9/2015 Public Health, 1/6/2014
Child Support Services, 1/11/2016 Public Works, 12/8/2015
Children and Family Services, 11/2/2015 Purchasing, 10/1/2008
Children’s Fund, 9/16/2008* Real Estate Services, 11/3/2008
Children’s Network, 12/3/2013* Regional Parks, 2/1/2012
First Five, 12/26/2014* Registrar of Voters, 7/21/2009
Clerk of the Board, 2/1/2012 Risk Management, 11/1/2013
Community Development and Housing, Sheriff/Coroner, 7/10/2010
2/22/2013 Special Districts, 7/20/2010
County Administrative Office, 1/4/2016 and Transitional Assistance, 11/2/2015
7/15/2013 Veterans Affairs, 3/25/2013
County Counsel, 2/1/2012 Workforce Development Department,
County Fire Protection District, 1/25/2015** 2/22/2013
* Separate, non-County entities not governed by the Board of Supervisors.
**Separate, non-County entities governed by the Board of Supervisors.

Appendix A: Bibliography A-6

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Department Post-Incident Experience Summaries (A.K.A. 90 Day Reports)

Aging and Adult Services, 4/28/2016 Information Services, 4/20/2016
Agricultural Weights and Measures, 4/20/2016 Inland Counties Emergency Medical Agency,
Arrowhead Regional Medical Center, 3/1/2016 4/20/2016**
Assessor/Recorder/County Clerk, 4/20/2016 Land Use Services, 3/1/2017
Auditor/Controller/Treasurer, 3/7/2017 Library Administration, 4/20/2016
Behavioral Health, 4/20/2016 Museum, 3/10/2017
Child Support Services, 4/20/2016 Office of Emergency Services, 4/20/2016
Children and Family Services, 3/9/2017 Preschool Services, 4/20/2016
Clerk of the Board, 4/20/2016 Probation, 2/11/2016
Community Development and Housing, Public Defender, 4/20/2016****
4/20/2016 Public Health, 4/15/2016
County Administrative Office, Administrative Public Health, Environmental Health Services
Staff, 4/25/2016 Division, 5/25/2016
County Administrative Office, Public Public Works, 4/7/2016
Information, 4/18/2016 Purchasing, 4/21/2016
County Fire Protection District, 4/20/2016** Real Estate Services, 10/15/2008
District Attorney, 5/6/2016 Regional Parks, 4/20/2016
Economic Development Agency, 3/7/2017 Registrar of Voters, 4/20/2016
First 5 San Bernardino, 4/20/2016* Risk Management, 4/20/2016
Fleet Management, 4/21/2016 Sheriff/Coroner, 7/10/2010
Human Resources, 4/20/2016*** Special Districts, 4/20/2016
Human Services, 4/19/2016 Transitional Assistance, 4/19/2016
Human Services, Emergency Services Unit, Veterans Affairs, 3/10/2017
3/9/2016 Workforce Development, 3/2/2017
* Separate, non-county entities not governed by the Board of Supervisors.
** Separate, non-County entities governed by the Board of Supervisors.
*** Includes 21 personal perspective summaries from individual staff members.
**** Includes 8 personal perspective summaries from individual staff members.

Environmental Health Services (EHS) Division Memorandums Regarding Tribute Events

2/29/2016 4/7/2016 11/29/2016
3/14/2016 11/15/2016
3/29/2016 11/22/2016

Interoffice Memorandums
Devereaux, Gregory to Elected Department Heads, Assistant Executive Officer, County Chief
Operating Office, County Chief Financial Officer, Deputy Executives Officers and Department
Heads. 1/19/16. “Incident Communication and Documentation.”

Rozko, Laurie to Department Purchasing Contacts, Department Cal-Card Coordinators.

12/10/2015. “Emergency Procurement Related to December 2nd.”

Appendix A: Bibliography A-7

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Randles, Bud to Mike Smith, San Bernardino County District Attorney’s Office Bureau of
Investigation. 12/7/2015. “After Action Report – San Bernardino, Inland Regional Center
Shooting.”

Smith, Dena to Elected Department Heads, Assistant Executive Officer, County Chief Financial
Officer, Deputy Executives Officers and Department Heads. 4/4/16. “Initial Documentation of
December 2, 2015 Attack.”

Smith, Dena to Elected Department Heads, Assistant Executive Officer, Chief Operating Officer,
County Chief Financial Officer, Deputy Executives Officers and Department Heads. 9/12/17. “SB
Safe Employee Alert System”

Windle, Bob, Assistant Director, Human Resources to Trudy Raymundo, Corwin Porter, Tom
Hudson, Gia Kim. 12/9/2015. “Evacuation/Closure Time Reporting for Environmental Health
Division and Certain Land Use Services Staff.”

Windle, Bob, Assistant Director, Human Resources to Assistant Executive Officers, County Chief
Financial Officers, Deputy Executive Officers, Department Heads, and Department of Public
Health. 12/9/2015. “Evacuation/Closure Time Reporting for Environmental Health Division and
Certain Land Use Services Staff.”

Windle, Bob, Assistant Director, Human Resources to Elected Department Heads, Assistant
Executive Officers, County Chief Financial Officers, Deputy Executive Officers, and Department
Heads. 12/9/2015. “Evacuation/Closure Time Reporting for non-EHS Employees.”

Legislative Position Papers

Ramos, James, County of San Bernardino Board of Supervisors Chairman to California State
Senator Connie Leyva, 5/5/2016. “Re: SB 1385 (Leyva) – As Amended March 29, 2016 –
Sponsor.”

Ramos, James, County of San Bernardino Board of Supervisors Chairman to California Assembly
Member Philip Ting, Chair, Assembly Budget Committee. 5/25/2016. “Re: December 2 nd
Terrorist Attack Budget Request.”

Ramos, James, County of San Bernardino Board of Supervisors Chairman to California State
Senator Mark Leno, Chair, Senate Budget and Fiscal Review Committee. 5/25/2016. “Re:
December 2nd Terrorist Attack Budget Request.”

Ramos, James, County of San Bernardino Board of Supervisors Chairman to California Assembly
Member Philip Ting and California State Senator Mark Leno. 6/1/2016. “Re: December 2 nd
Terrorist Attack Budget Request.”

Ramos, James, County of San Bernardino Board of Supervisors Chairman to The Honorable
Edmund G. Brown, Jr., Governor of California. 9/6/2016. “Re: DB 1385 (Leyva) – Request for
Signature.”
Appendix A: Bibliography A-8
 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Memorial Committee Meeting Agendas and Notes

3/30/2016 5/4/2016 6/29/2016
4/13/2016 5/25/2016 11/17/2016

News Articles
Aguilera, Elizabeth. 3/9/2016. “San Bernardino Shooting: How the County Helped Victims Move
Forward.” Southern California Public Radio. http://www.scpr.org/news/2016/03/09/58197/san-
bernardino-shooting-how-the-county-helped-vict/

Baer, Stephanie. 10/8/2016. “Retired Health Inspectors Give San Bernardino County
Department Time to Heal After Terrorist Attack.” Pasadena Star News.
https://www.pasadenastarnews.com/2016/10/08/retired-health-inspectors-give-san-
bernardino-county-health-department-time-to-heal-after-terrorist-attack/

De Atley, Richard. 3/26/2016. “San Bernardino Shootings: Federal Help Sought to Cover
Response Costs.” The Press-Enterprise. https://www.pe.com/2016/03/26/san-bernardino-
shootings-federal-help-sought-to-cover-response-costs/

Downey, David and Ryan Hagen. 3/31/2016 “San Bernardino shooting victims’ families grateful
for United Way support.” San Bernardino Sun. https://www.sbsun.com/2016/03/31/san-
bernardino-shooting-victims-families-grateful-for-united-way-support/

Esquivel, Paloma and Richard Winton. 12/15/2015. “San Bernardino Seeks Help to Pay $1
Million In Costs From Shooting.” Los Angeles Times.
http://www.latimes.com/local/california/la-me-1215-sb-terror-costs-20151215-story.html

Esquivel, Paloma. 1/4/2016. “A month after attack, Employees Return to Inland Regional Center
in San Bernardino.” Los Angeles Times. http://www.latimes.com/local/california/la-me-sb-
memorial-20160105-story.html

Goldenstein, Taylor. 3/31/2016. “Plan Unveiled for Distribution of San Bernardino Victims’
Fund.” Los Angeles Times.http://www.latimes.com/local/lanow/la-me-ln-san-bernardino-
terrorist-attack-donation-payouts-20160330-story.html

Hagan, Ryan. “$10.1 Million more in claims filed over San Bernardino mass shooting.” San
Bernardino Sun. 6/1/2016. https://www.sbsun.com/2016/06/01/101-million-more-in-claims-
filed-over-san-bernardino-mass-shooting/

Hurt, Suzanne. 11/28/2016. “San Bernardino Terror Attack Survivors Beg County to Help Them
Get Medications, Treatment.” Los Angeles Daily News.
https://www.dailynews.com/2016/11/28/san-bernardino-terror-attack-survivors-beg-county-
to-help-them-get-medications-treatment/

Appendix A: Bibliography A-9

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Karlamangla, Soumya, Cindy Carcamo, Garrett Therolf, and Brittny Mejia. 12/8/2015. “San
Bernardino County Offices Reopen, But Health Workers Get More Time to Recover.” Los
Angeles Times. http://www.latimes.com/local/california/la-me-public-health-20151208-
story.html

Mejia, Brittny. 6/13/2016. “Widow of San Bernardino Shooting Victim Seeks $58 million in
damages from County.” Los Angeles Times. http://www.latimes.com/local/lanow/la-me-ln-san-
bernardino-shooting-victim-widow-58-million-20160113-story.html

Myers, John. 9/25/2016. “Expansion of State’s Help in Paying the Emergency Costs of San
Bernardino Terror Attack Rejected by Gov. Jerry Brown.” Los Angeles Times.
http://www.latimes.com/politics/essential/la-pol-sac-essential-politics-updates-state-help-for-
the-emergency-costs-of-1474837702-htmlstory.html

Nelson, Joe. 2/22/2016. “How Do You Move Forward After a Terrorist Attack? San Bernardino
County Public Health Directors Tell Us.” San Bernardino Sun.
https://www.sbsun.com/2016/02/23/how-do-you-move-forward-after-a-terrorist-attack-san-
bernardino-county-public-health-directors-tell-us/

Nelson, Joe. 5/20/2016. “San Bernardino County Recovering Slowly but Steadily 6 months After
Terror Attack.” San Bernardino Sun. https://www.sbsun.com/2016/05/30/san-bernardino-
county-recovering-slowly-but-steadily-6-months-after-terror-attack/

Nelson, Joe. 5/27/2016. “San Bernardino Terrorist Attack Victim Autopsy Reports Released.”
San Bernardino Sun. https://www.sbsun.com/2016/05/27/san-bernardino-terrorist-attack-
victim-autopsy-reports-released/

Nelson, Joe. 9/12/2016. “More Funding to Be Considered for Temporary Employees After San
Bernardino Terror Attack.” San Bernardino Sun. https://www.sbsun.com/2016/09/12/more-
funding-to-be-considered-for-temporary-employees-after-san-bernardino-terror-attack/

Nelson, Joe. 8/7/2017. “San Bernardino County Poised to End State of Emergency from 2015
Terror Attack.” San Bernardino Sun. https://www.sbsun.com/2017/08/07/san-bernardino-
county-poised-to-end-state-of-emergency-from-2015-terror-attack/

Saunders, Doug and Joe Nelson. 1/22/2016. “Family of San Bernardino Terror Attack Victim
Files $200M Claim.” San Bernardino Sun. https://www.sbsun.com/2016/01/22/family-of-san-
bernardino-terror-attack-victim-files-200m-claim/

Saunders, Doug. 12/22/2015. “2 San Bernardino Police Officers Assigned to FBI Joint Terrorism
Task Force. San Bernardino Sun. https://www.sbsun.com/2015/12/22/2-san-bernardino-police-
officers-assigned-to-fbi-joint-terrorism-task-force/

Appendix A: Bibliography A-10

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Shultz, Craig. 12/14/2015. “San Bernardino Shooting: Public donates in show of support for
victims, families.” The Press-Enterprise. https://www.pe.com/2015/12/14/san-bernardino-
shooting-public-donates-in-show-of-support-for-victims-families/

The Sun. 6/4/2016. “New Claims filed Friday Against San Bernardino County in Dec. 2 Terror
Attack.” San Bernardino Sun. https://www.sbsun.com/2016/06/04/new-claims-filed-friday-
against-san-bernardino-county-in-dec-2-terrorist-attack/

Wesson, Gail. “Local Governments Reject Millions in San Bernardino Attack Claims.”
11/26/2016. The Press Enterprise. https://www.pe.com/2016/11/26/local-governments-reject-
millions-in-san-bernardino-attack-claims/

News Releases
Wert, David. 12/6/2016. “Board Ok’s Funding to Ease Worker’s Comp for Dec 2 Survivors.”
News Release. County Administrative Office. San Bernardino, CA.

Cardona, Felisa. 12/11/2015. EHS resumes work Monday; Employees remain on leave.” News
Release. County Administrative Office. San Bernardino, CA.

Wert, David. 12/20/2016. “County Secures Assistance for December 2 Survivors.” News
Release. County Administrative Office. San Bernardino, CA.

Cardona, Felisa. 2/22/2016. “Board discusses Dec. 2 emergency response at NACo conference.”
News Release. County Administrative Office. San Bernardino, CA.

Ramos, James. June-July 2016. “Comfort Quilt Heads to Orlando.” The Ramos Review. Third
District Supervisor James Ramos. San Bernardino, CA.

Wert, David. 1/17/2017. “County Grant will fill Worker’s Comp Gap for Dec 2 Victims.” News
Release. County Administrative Office. San Bernardino, CA.

Wert, David. 1/18/2017. “County Requests Its Share of Grant be Allocated to Survivors.” News
Release. County Administrative Office. San Bernardino, CA.

California State Association of Counties. June 2017. “CSAC, CAOs Honor Victims of 2015 San
Bernardino County Terrorist Attack.”

Post-Incident Coordination Group Meeting Agendas and Notes

12/28/2015 2/11/2016 6/23/2016 11/9/2016
1/6/2016 2/25/2016 7/28/2016 11/17/2016
1/14/2016 3/3/2016 8/11/2016 1/12/2017
1/21/2016 4/7/2016 9/8/2016 1/26/2017
1/28/2016 4/14/2016 10/19/2016 2/8/2017
2/4/2016 5/26/2016 11/9/2016

Appendix A: Bibliography A-11

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

“Postmaster” Mass Email Notifications

A Message from the Chairman, 12/2/2015
A Statement from Board Chairman James Ramos, 12/3/2015
A Message from the Board of Supervisors, 12/3/2015
San Bernardino United Relief Fund Established for Victims, 12/4/2015
County New Conference This Morning. Watch it Live, 12/6/2015
Statewide Counties Organization Supports San Bernardino, 12/7/2015
Support for Our County Family, 12/10/2015
San Bernardino County United Relief Fund, 12/11/2015
A Message from the Board of Supervisors, 12/11/2015
Join Us as We Remember, Honor and Support Our County Family, 12/17/2015
Additional Details about January 4, 12/23/2015
Important Details about January 4 Event, 12/30/2015
Watch a Live Stream of Today’s County Family Gathering, 1/4/2016
Introducing the SB Safe Employee Alert System, 2017

Presentations
Antonucci, Michael, Cindy Serrano, and Robin Lindsay. San Bernardino Office of Emergency
Services. 5/5/2016. “San Bernardino Terror Attack: The Emergency Management Response.”

Devereaux, Greg, John McMahon, Trudy Raymundo, Dena Smith and David Wert. County
Administrative Office, Department of Public Health, and Sheriff’s Department. 10/19-21/2016.
County Administrative Officers Association of California Annual Meeting. Monterey, CA.

Goldman, Lori, Dena Smith, Suzie Soren and Bob Windle. San Bernardino County Human
Resources Department. 11/29/2016. “The December 2, 2015 Terrorist Attack.” County
Personnel Administrators Association of California Conference. Lodi, CA.

Lynch, Tom. Inland Counties Emergency Medical Agency. “Waterman Incident: The EMS
Perspective.” 2016. San Bernardino, CA.

Porter, Corwin. San Bernardino County Department of Public Health. 5/24/2016. “December 2,
2015: Impacts, Lessons Learned.” CFED West Conference & Expo. Palm Springs, CA.

Porter, Corwin. San Bernardino County Department of Public Health. 5/10/2017. “December 2,
2015: Response and Recovery.” Michigan Terrorism Conference. Grand Rapids, MI.

Porter, Corwin. San Bernardino County Department of Public Health. 5/16/2017. “Recovery
and Resilience: Navigating Change in San Bernardino County After December 2nd.” Ohio State
Public Health Conference. Columbus, OH.

Ramirez, John. Loma Linda University Medical Center. 2016. “San Bernardino Mass Shooting
December 2, 2015.” Loma Linda, CA.

Appendix A: Bibliography A-12

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Thompson, Terry and Janet Lowe. San Bernardino County Real Estate Services Department.
2016. “Waterman Incident [Real Estate Perspective].” San Bernardino, CA.

Wert, David and Felisa Cardona. County Administrative Office, Public Information. 11/29-
12/2/2016. “Lessons from an Act of Terror: Reflection on December 2, 2015.” California State
Association of Counties Annual Meeting. Palm Springs, CA.

Other Documentation
California Victims Compensation Board. 12/8/2016. “Application for Financial Assistance under
the Antiterrorism and Emergency Assistance Program (AEAP) (U.S. Office for Victims of Crime)
for Costs Related to the Terrorist Mass Shooting and Attempted Bombing in San Bernardino,
California on December 2, 2015.” Sacramento, CA.
 County Administrative Office, AEAP Grant Application Grant Summary and Cost
Breakdown Spreadsheet
 AEAP Grant Agreement between the California Victims Compensation Board and the San
Bernardino County Administrative Office

County Administrative Office, SB Safe Emergency Notification System Bulletins

 Instructions for Designation of SB Safe Employee Alert System – Department Assignees,
9/12/2017
 Frequently Asked Questions, 9/12/2017

County of San Bernardino Adopted Budget, 2016 - 2017

County of San Bernardino 12/2/15 Incident Cost Tracking Ledgers

County of San Bernardino Information Services Department (ISD). 12/2015. Physical Security
Assessment Request for Quote and sample submitted proposal from Andrews International.

County of San Bernardino Office of Emergency Services (OES). 2015. “Flash Reports”
 Flash Report #1: 11:45 a.m. (12/2/15)
 Flash Report #2: 1:50 p.m. (12/2/15)
 Flash Report #3: 2:20 p.m. (12/2/15)
 Flash Report #4: 4:20 p.m. (12/2/15)
 Flash Report #5: 8:50 p.m. (12/2/15)
 Flash Report #6: 9:00 a.m. (12/3/15)
 Flash Report #7: 4:00 p.m. (12/3/15)
 Flash Report #8: 8:15 p.m. (12/3/15)
 Flash Report #9: 6:05 p.m. (12/4/15)

County of San Bernardino Office of Emergency Services (OES). 2016. “Waterman Terrorist
Incident Timeline.”

Appendix A: Bibliography A-13

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

County of San Bernardino Policy Manual Policies:

 No. 11-04 Procurement of Goods, Supplies and Equipment Effective 7/01/2012
 No. 11-04 Procurement of Goods, Supplies, Equipment and Services Effective 2/14/2017
 No. 11-05 Procurement of Services, Effective 11/5/2010
 No. 12-18 Surplus Personal Property, Effective 7/12/2016
 No. 13-08 Employee Emergency Notification System, Effective 9/12/17

Office of Governor Edmund G. Brown Jr. 12/18/15. Proclamation of a State of Emergency

(December 2, 2015 Terrorist Attack).

Office of Justice Programs Grant Notification. Edward Byrne Memorial Justice Grant for Fiscal
Year 2016. Grant Number: 2016-DG-BX-0001 for California Board of State and Community
Corrections.

San Bernardino Fire Protection District. 1/28/14. Revenue Agreement Between the City of San
Bernardino and San Bernardino County Fire Protection District for Office of Emergency Services.

Note: Not included in the above bibliography are countless emails and individuals’ personal
notes provided to the CPARS Team for review.

Appendix A: Bibliography A-14

 Organizational Review
San Bernardino County Response to 12/2/15 Terrorist Attack

Appendix B: State’s Workers’ Compensation

System Review

Appendix B: State Workers’ Comp Report B-1

STATE OF CALIFORNIA EDMUND G. BROWN JR., Governor
DEPARTMENT OF INDUSTRIAL RELATIONS
Division of Workers’ Compensation
MAILING ADDRESS:
1515 Clay Street 17th Floor
P. O. Box 420603
Oakland, CA 94612 San Francisco, CA 94142-0603

February 23, 2017

Christine Baker
Director
Department of Industrial Relations
1515 Clay Street, 17th Floor
Oakland, CA 94612

Re: Role of the Workers’ Compensation System in the 12/2/2015 San Bernardino
Mass Shooting

Dear Director Baker:

In light of complaints and inquiries concerning this incident and especially out of concern for the
injured workers, you asked us to take a look at the how the County of San Bernardino and the
workers’ compensation system responded following the December 2, 2015 mass shooting
incident. Because most of the victims were County employees attending a work-related function,
workers’ compensation was the primary means through which medical care and other benefits
were provided to those victims. The enclosed report summarizes why this was the case and how
the County, as a self-insured employer, attended to the needs of its employees and provided
benefits authorized under the workers’ compensation laws. Included is an overview of the
workers’ compensation system and how it addresses liability for job-related injuries.

The incident generated 100 workers’ compensation claims, 96 by County employees or their
survivors and four involving other employers. Our study focused on the County’s employees and
the County’s handling of their claims. We reviewed summaries of claims and treatment decisions
forwarded to us by the County, and we also reviewed information available from independent
sources, including Independent Medical Review decisions and Workers’ Compensation Appeals
Board case files. Our review shows that of the total 2,146 treatment decisions, 90 percent were
approved and 3 percent received modified approval.

As the claims matured, the County increased its scrutiny of treatment requests leading to some
modifications and denials. A portion of those requests were appealed in the Independent Medical
Review (IMR) system. While the IMR decisions generally upheld the County’s actions, often
because doctors had failed to document or fully explain their requests, employees who were still
suffering and expected their doctors’ recommendations to be followed were frustrated by the
denials. More recently, the County took the positive step of hiring a nurse case manager to serve
as an ombudsperson to help facilitate the presentation of treatment requests in a way that will
satisfy the workers’ compensation system’s treatment guidelines. We think this would be an
appropriate first step when dealing with an incident of this nature and that having someone
Christine Baker
February 23, 2017
Page 2

available throughout to facilitate the approval of claims and treatment requests between
providers and claims administrators would likely reduce frustration experienced by some of the
victims.

Very truly yours,

George Parisotto
Acting Administrative Director
Division of Workers’ Compensation

Enclosures:
The Role of California’s Workers’ Compensation System in the San Bernardino Shootings
Memo on Data Consulted for San Bernardino 12/2/2015 Incident Report
 The Role of California’s Workers’ Compensation System in the San Bernardino Shootings

Introduction
On December 2, 2015, two individuals armed with semi-automatic weapons entered the Inland Regional
Center in San Bernardino, California, and opened fire on a group of about 80 people gathered for
training sessions and a holiday party. The shootings left 14 dead and 22 others seriously injured. The
two shooters (a county employee who had been present at the start of the sessions and his wife) also
left explosive devices in the Center before fleeing. Both were killed later in a shootout with pursuing law
enforcement officers. Two officers also suffered injuries during that gunfight.
Almost all of the victims inside the Center were employees of the County of San Bernardino (“County”).
12 died almost immediately, and two more died at a makeshift triage center set up near the building.
Seriously wounded survivors were transported to area hospitals. Others suffered physical injuries that
did not require immediate emergency treatment, and many of those present, as well as their families,
friends and other co-workers, were traumatized by the event.
In our system of justice, the perpetrators would bear ultimate responsibility for the costs associated
with this terrorist incident. However, the shooters had negligible assets, which left the victims to look to
other sources to pay for medical treatment and provide compensation for their injuries. Typically, the
victims might look to the host of an event or owner of the premises for insurance coverage to pay for
these costs. However, since the shootout occurred in a work-related training session conducted on
behalf of the County, the County’s employees were both entitled and required to seek compensation
from the County through California’s workers’ compensation system.

Overview of Workers’ Compensation

California’s current system of workers’ compensation was established pursuant to a constitutional
amendment first adopted in 1911. Article 14, Section 4 of the California Constitution now states in part
as follows:
The Legislature is . . . vested with plenary power . . . to create, and enforce a complete
system of workers' compensation, . . . to create and enforce a liability on the part of
[employers] to compensate any or all of their workers for injury or disability, and their
dependents for death incurred or sustained by the said workers in the course of their
employment, irrespective of the fault of any party. A complete system of workers'
compensation includes adequate provisions for the comfort, health and safety and
general welfare of any and all workers and those dependent upon them for support to
the extent of relieving from the consequences of any injury or death incurred or
sustained by workers in the course of their employment . . .; also full provision for
securing safety in places of employment; full provision for such medical, surgical,
hospital and other remedial treatment as is requisite to cure and relieve from the
effects of such injury; full provision for adequate insurance coverage against liability to
pay or furnish compensation; full provision for regulating such insurance coverage in all
its aspects . . .; full provision for otherwise securing the payment of compensation; and
full provision for vesting power, authority and jurisdiction in an administrative body . . .
to determine any dispute or matter arising under such legislation . . ..
Workers’ compensation exists in this and other states as a system for determining liability, providing
compensation, and adjudicating disputes for claims and cases involving job-related deaths, injuries and
illnesses. The system governs only the liability of employers to their employees, and it operates as a
mandated alternative to the tort principles and litigation process that govern civil liability and damages
for personal injuries in most other contexts. The monetary compensation available through workers’
compensation is fixed and far less than what might be recovered in a civil action. However, the trade-off
for this limitation is that workers’ compensation is provided on a no-fault basis, i.e. without regard to
the parties’ relative fault in causing the death, injury or illness; the employer or insurer must bear all the
costs of evaluating and resolving claims as well as providing monetary compensation and treatment;
and, when functioning properly, the treatment and compensation is relatively swift and certain, rather
than requiring years of litigation to resolve.
All California employers are required to secure compensation for their employees through this system,
either by obtaining a workers’ compensation insurance policy or by obtaining a certificate to self-insure
from the Director of Industrial Relations. Like all insurance programs, premiums are calculated to cover
and share all anticipated costs. Self-insured employers (typically larger private employers as well as
public agencies like the County of San Bernardino) often purchase reinsurance to cover higher claim
costs that arise in catastrophic situations involving multiple serious injuries. Employers also pay annual
assessments to fund the public costs of administering California’s workers’ compensation system
(making it a “user-funded” system).
Benefits: In a typical job-related illness or injury case, the employee is entitled to medical treatment and
services that are reasonably required to “cure and relieve . . . the effects of [the] injury”. The employee
is also entitled to up to two years of temporary total disability benefits based on a percentage of his or
her wages. Once the employee’s condition becomes “permanent and stationary,” the employee is
entitled to permanent disability benefits based on a percentage of wages and on the amount of
permanent disability (from 0 to 100%) caused by the job illness or injury. A comprehensive medical
evaluation that assesses the lasting effects of the injury in relation to the employee’s overall medical
history and condition is used to determine the percentage of disability, with the employee’s age,
occupation, and lost earning capacity are also factored into that determination.
Unlike personal injury cases, where amounts of compensation and damages awarded are largely within
the discretion of a judge or jury, workers’ compensation is, by design, very detailed and formulaic in
specifying what compensation is due for specific types of injuries. American Medical Association
guidelines are used to establish permanent disability rating schedules, and, similar to Medicare, there
are extensive regulatory guidelines governing the scope and extent of available medical treatment, as
well as Official Medical Fee Schedules governing what must be paid for that treatment.
Family members and dependents of employees are not entitled to any form of compensation through
workers’ compensation unless the employee suffers a job-related death. In those cases, the spouse,
minor children, and other dependents of the decedent are entitled to prescribed death benefits of up to
$320,000 depending on the number of dependents (with the cap sometimes exceeded due to the
ongoing dependency of children). In addition, the employer is liable to pay or reimburse a claimant for
up to $10,000 for burial expenses, regardless of whether there is a dependency relationship.
Procedure: A workers’ compensation claim ordinarily begins when the employee is provided with a
claim form referred to as a DWC-1. The employer is required to provide this form within 24 hours after
becoming aware of a potential claim, either because of something communicated by the employee or
through other available information. Once the employee submits a claim, the employer has 90 days
within which to investigate and then accept or deny the claim. Normally the employer turns over the
claim to its insurer, or in the case of a self-insured employer such as San Bernardino County, to a claims
administrator. The insurer or claims administrator then handles all of the employer’s responsibilities,
including the responsibility to pay any benefits that are due.

-2-
While the investigation is pending and the claim is subject to denial, the employer must authorize and
pay for up to $10,000 in necessary medical treatment. Once the claim is accepted, the employer
(through the insurer or claims administrator) assumes responsibility to provide and pay for required
medical treatment as well as the weekly wage replacement benefits due to the employee. The
employer may also assert control over the employee’s medical treatment, usually by directing the
employee to seek treatment through an established Medical Provider Network and by requiring
documentation to show that a particular procedure or course of treatment is necessary and appropriate
for the employee.
Similar to Medicare and private health insurance plans, the employer must have a utilization review (UR)
program to help ensure these decisions are made in accordance with evidence-based expert medical
guidelines. 1 Initial decisions to approve a treatment request can be made by a claims administrator.
However, a decision to deny or modify a request can only be made by a licensed physician with
expertise in the clinical issues raised. This level of review is sometimes referred to as “elevated UR.”
There are strict time limits for making UR decisions, and a treating physician’s failure to provide an
adequate clinical rationale or documentation to support a request falling outside the established
treatment guidelines will lead to denials on that basis.
If a formal UR decision results in the denial, modification, or delay of a recommended treatment, the
employee or treating physician has a further right to appeal that decision to the Administrative Director
of the state’s Division of Workers’ Compensation, through a process known as Independent Medical
Review (IMR). In IMR, another medical expert, acting on behalf of the state and following the same
expert medical guidelines, reviews the documentation and determines whether the requested
treatment is necessary and appropriate for the employee.
Accepted workers’ compensation claims can be administered and resolved without ever going through
formal adjudication. However, in the event of an unresolved dispute over issues such as whether an
employee suffered a job-related illness or injury, the extent of that illness or injury, or the amount of
compensation due, a party can start a case by filing an Application for Adjudication of Claim (commonly
referred to simply as an “Application”) with the state’s Division of Workers’ Compensation. Disputed
issues can then be adjudicated before a Workers’ Compensation Administrative Law Judge (WCALJ) in
accordance with procedures and standards governed by the Workers’ Compensation Appeals Board
(WCAB). The trial court system is administered by the Division of Workers’ Compensation at 24 venues
across the state and handles over 300,000 cases a year. WCALJ decisions can be appealed to the WCAB
through a process known as a Petition for Reconsideration, and WCAB decisions can be reviewed by one
of California’s courts of appeal.
Employees may but are not required to be represented by attorneys in these cases. Attorneys cannot
charge employees directly for representation but may recover a percentage fee of up to 15% of the
benefits due to the employee, plus hourly fees for attending depositions, with all fees subject to
approval by the WCALJ and paid directly by the employer.

San Bernardino County’s Immediate Response to the Incident

In the immediate aftermath of the shootings, first responders provided immediate care and transported
1
These guidelines are set forth in an extensive set of regulations known as the Medical Treatment Utilization
Schedule (MTUS). For treatments or conditions that are not fully addressed in the MTUS, other nationally-
recognized evidence-based treatment guidelines may be consulted, including the Occupational Medicine Practice
Guidelines established by the American College of Occupational and Environmental Medicine (ACOEM) and the
Official Disability Guidelines (ODG) published by the Work Loss Data Institute.

-3-
surviving victims to area medical facilities, without regard to who was responsible or authorized to
provide or pay for those services. According to County representatives, senior County leaders, including
members of the Board of Supervisors and County executives, met that evening to discuss and
implement response mechanisms, and at that time learned that nearly all the victims and one of the
shooters were employees of the County’s Environmental Health Services division attending an off-site
training event.
The County reports that it established a team of liaisons to interact with each victim or victim’s family
individually and address the full range of potential concerns, including pay, benefits, sick leave, workers’
compensation claims, and recovering vehicles and personal effects from the training site or other work
locations. Claim files were created for each employee believed to have been present at the incident,
and the County says that it initiated outreach to known victims and families through phone calls and
home and hospital visits. The County reports that within a few weeks after the incident the FBI
conducted a closed-door Family Assistance Center event for victims and families, with representatives
from federal, state, and local agencies, as well as unions and local charities present to offer a range of
information and assistance. Thereafter, there were several meetings with affected employees to discuss
benefits and other assistance, with many of these meetings taking place at a “safe house” where victims
could gather without drawing media attention.

Handling of Workers’ Compensation Claims related to the Incident

A review of available data 2 shows nearly 100 workers’ compensation claims that may have been related
to this incident (based on the date of injury, general location, and description). The County’s own
records show 96 claims by County employees or their survivors, which break down further into 13 death
benefits’ claims, 58 injury claims that were accepted by the County, and 25 denied claims. The earliest
of these claims was submitted five days after the incident and the latest nearly 11 months later.

Death Benefits Claims: 13 of the 14 decedents were county employees, 3 and the County reports that it
identified family members or other contacts from personnel records, and assisted them in filling out
forms and obtaining supporting documentation (such as marriage and birth certificates needed to
establish dependency relationships). The County says that it paid the allowable funeral costs of up to
$10,000 through the workers’ compensation system, and that additional funds to cover higher costs
were available through the California Victims Compensation Board. Nine death benefits claims were
approved and benefit payments to the eligible dependents commenced within two to four months after
the incident. 4 Two claims are open but remain unresolved pending proof of dependency by those
claiming entitlement to benefits. For the other two, burial expenses were paid, but no dependents have
been identified or come forward to claim monetary benefits. 5

2
See attached memo on data consulted for purposes of preparing this report.
3
The other decedent was a vendor working at the Inland Regional Center.
4
The disposition of these claims is shown in formal Stipulations filed with the Division of Workers’ Compensation
and approved by a WCALJ. This is a necessary step to confirm the identity of dependents eligible for death
benefits and the amounts due. As with temporary and permanent disability benefits, death benefits are paid out
on a weekly basis until the maximum is reached or the parties agree to a discounted lump-sum payout.
5
As of mid-January of 2017, the County reported payouts of over $500,000 in death and funeral expenses benefits,
with future incurred liability of approximately $4.6 million.

-4-
Accepted Claims from Survivors: Overall the County accepted 58 workers’ compensation claims filed by
employees who survived the shooting. The accepted claims included employees with both physical and
psychological injuries and those with only the latter. The County has provided one chart listing all
treatments and bills that were authorized and paid as a matter of course without additional scrutiny.
Another chart lists the requests that went through Utilization Review (UR), including requests reviewed
and approved by the County’s Department of Risk Management and others that went through elevated
UR by medical experts associated with County’s UR Plan.
The chart of routine approvals lists 1321 items for 38 employees at an aggregate cost of approximately
$1.6 million. Nearly 70% are categorized as bills for physician services, with the balance covering
prescriptions, hospital and surgical costs, physical therapy, and prosthetics.
The chart of UR decisions shows that the County was receiving and approving prospective requests for
treatments, tests, prescriptions, and medical equipment within days of the incident. The County was
routinely approving nearly all requests through approximately mid-April of 2016, by which time a
substantial volume of medical reports had been accumulated for many of the survivors with serious
injuries. The County then began submitting more of the requests through elevated UR. 6
The County’s chart documents 825 UR decisions that break down as follows:
Total Approved 606 (73%)
[Approved by County Risk Mgt. 424]
[Approved in Elevated UR 182]
Modified Approval 73 ( 9%)
Denied 144 (17%)
Other 7 2

Adding the routine approvals and UR decisions together yields a combined total of 2146 treatment
decisions that break down as follows:
Total Approved 1927 (90%)
Modified Approval 73 ( 3%)
Denied 144 ( 7%)
Other 2

47 of the 58 employees with accepted claims had one or more requests that went through UR. The
numbers vary widely, from one employee with over 150 requests going through UR, another with nearly
70, eight with between 21 and 50 requests, fifteen with 11 – 20 requests, twenty-two with 1-10

6
75% of the Utilization Review evaluations fell within categories of requests for particular types of
pharmaceuticals, psychiatric treatments, physical therapy, or durable medical equipment. Most UR decisions were
made within a few days after receipt of the request, and less than six percent of the decisions, including decisions
made through elevated UR, took longer than a week.
7
One item lists the decision as “disputed liability”, and another provides no information about the request or
decision.

-5-
requests, and nine with no requests. 8 27 of the employees had at least one denial or modification of a
request. Eleven employees have appealed one or more of their denied requests through the
Independent Medical Review (IMR) process. Through the first week of January of 2017, a total of 19
substantive IMR decisions had been issued, addressing 68 separate items. 9 Collectively, these decisions
upheld 37 UR decisions to deny or modify a request, overturned 9 UR decisions, and did not review 22
others because the requests had been authorized by the County sometime after the initial denial. 10
Without access to UR files and decisions it is difficult to make assumptions about what caused some
requests to be accepted and others to be modified or denied by the County. However, a review of the
IMR decisions, which are available, offers some insight. Typically, the problem identified in IMR
decisions was a provider’s failure to provide an adequate clinical rationale or appropriate
documentation to justify requests for extended or new prescriptions, extended or alternative therapies,
or special equipment that veered away from standard medical treatment guidelines and limits. There
also appear to have been a fair number of duplicate or overlapping requests. The fact that several
requests were denied and then authorized upon further review suggests that better communication by
providers to the County’s claims administrators and better documentation at the time requests were
first submitted might have reduced the number of UR denials and IMR requests. 11
19 of the employees with accepted claims have filed Applications for Adjudication before the
DWC/WCAB. All are represented by attorneys. Only seven of the cases reflect litigation activity in the
form of requests for hearings before a WCALJ on claims administration or benefit rights. Two involved
Temporary Total Disability payments (continuation or amount), one involved the choice of treating
physicians, four (including two in one case) involved claims of untimely or ineffective denials of
treatment requests, and one involved obtaining an evaluation of the employee’s permanent disability.
Six of these disputes appear to have been resolved without need for a trial. One dispute over late denial
of treatment went to trial in early October and remained undecided at the end of January. In the other
case, the County requested a hearing on getting a medical evaluator, with that hearing still pending. 12

Denied Claims: The County denied the workers’ compensation claims of 25 other employees alleging
psychological injury arising out of the incident. According to the County, a common thread among these
denials was that the employees were not present at the training center when the incident occurred.
Three of the denials were appealed through the filling of Applications for Adjudication with the DWC/
WCAB. One was settled by Compromise and Release for $7,000; one was voluntarily dismissed without
prejudice; and the other one remains open. The low rate of appeal and results of those appeals thus far

8
The chart identifies one employee for whom treatment and benefits were authorized but declined.
9
We have not been able to discern whether each IMR request corresponds to an individual UR request or whether
some involve combined UR requests.
10
There were also two dismissals, one because the treatments were authorized when the IMR request was filed,
and the other because the type of UR decision being appealed was not subject to IMR.
11
The fact that a large percentage of the denials was concentrated among a relatively small number of providers
further suggests that this was a particular problem with certain providers and not typical or characteristic of
interactions as a whole.
12
Many of the cases were filed within a few months after the incident and with no indication of a genuine dispute
or need to litigate any issue in the claim. Although attorneys may file applications to protect the clients’ right and
ability to litigate future disputes, they also place the employee and employer in an adversarial relationship that
may further hinder communication and cooperation.

-6-
suggests that the denials were largely accepted as appropriate decisions by the claimants and their
advocates.

Conclusion
The County reported that it had paid over $ 4 million for benefits and medical care as of mid-January of
2017, and had a reserve amount of nearly $ 22 million for continuing and future costs. The County’s
Department of Risk Management continues to administer the claims, but reinsurers are responsible for
costs in excess of $ 2 million, and representatives of the reinsurers have also reviewed case
management decisions. Looking at the volume of treatment requests as a whole, denials or
modifications of requests that did not fit within MTUS guidelines were clearly an exception to the overall
pattern of treatment requests being routinely accepted or approved through UR.
Persons who suffered injuries or other financial losses due to the incident are not limited to claiming
workers’ compensation benefits. Victims can also seek, and some have received, crime-related expense
reimbursements from the California Victim Compensation Board. 13 In addition, we understand that
other special funds were set up by other agencies and local charities to aid victims of the mass shooting.

13
Expenses that potentially may be covered by this Board include income loss, medical and dental treatment,
mental health services, residential security, home or vehicle modifications for disabled victims, relocation, and
funeral and burial expenses.

-7-
Memo on Data Consulted for County of San Bernardino 12/2/2015 Incident Report

San Bernardino Claims Data:

On January 20, 2017, San Bernardino County sent to the Department of Industrial Relations (DIR)
information on the 96 claims filed to date. This information contained the claim status, claim type,
county division, claim dates, and claim paid and incurred amounts.

These claims were verified for accuracy with information previously sent to the Workers’ Compensation
Information System (WCIS) First Reports of Injury and Subsequent Reports of Injury (FRO-SROI) database
for San Bernardino claims with a date of injury of 12/2/2015. WCIS found 100 claims that appeared to
match the incident. However, the four claims that did not match the County of San Bernardino’s list
were found to belong to different employers, with injuries similar to those experienced by employees of
the County of San Bernardino.

San Bernardino Utilization Review (UR) Data:

San Bernardino County also sent DIR information on the UR activity for the injured workers. This
information contained 830 rows of data in a master file, a summation and separate entries for each
injured worker with at least one UR. The master file record contained the claim information, request
date, request completed date, request category and type, name of the requesting provider, the
decision, additional information on the appeal, and additional information on the decision. Five records
in the master file did not have a UR decision.

San Bernardino Medical Data:

San Bernardino later provided DIR with a list of treatments approved and bills paid for treatments not
subject to UR.

Independent Medical Review (IMR) Data:

DIR reviewed the Maximus Federal Services (MFS) Entellitrak system to identify all requests for IMR and
IMR decisions through mid-January. 21 separate IMR determinations, including two dismissals without
review and 19 substantive decisions, were obtained and reviewed.

San Bernardino County Cases and Electronic Adjudication Management System (EAMS) Data:

Using the claim data received from San Bernardino County, DIR verified and reviewed each WCAB case
in the EAMS system that was filed on behalf of an employee with an accepted or denied claim arising
out of the incident on 12/2/15. (Death benefits cases were not reviewed.)