Glenn County Civil Grand Jury Superior Court of California

- The Glenn County CARE Court R1 - We recommend a broader outreach program. program represents a significant step To ensure that all entities, medical forward in addressing the mental health professionals, and anyone else able to refer to crisis in the state but lacks visibility. this program has knowledge of it. Conclusion Invited Responses By requiring counties to have CARE Court, the Pursuant to Penal Code section 933.05, the program aims to connect individuals with agencies are invited to respond: untreated mental illness to the care and support  Glenn County Behavioral Health they need with a voluntary and community- based approach. It offers an alternative to incarceration and forced conservatorships, Commendations: promoting individual autonomy while ensuring public safety. The CARE Court program holds The Glenn County Civil Grand Jury com- the potential to improve the lives of individuals mends the great effort made by the county struggling with mental illness, and it con- health workers who were given the task of tributes to more compassionate and effective putting together a CARE Court program for mental health. Glenn County, a small rural county, and make it functional and available for the community. Required Responses We hope that they will continue to work with Pursuant to Penal Code section 933.05, the those who are qualified to identify and governing bodies of the following agencies are recommend those individuals appropriate for required to respond: CARE Court and inform them of how this is a valuable resource to Glenn County.  Glenn County Board of Supervisors References:  CARE Court Petition: https://www.courts.ca.gov/documents/care100.pdf  https://www.countyofglenn.net/government/departments/health-human- services/behavioral-health/glenn-county-care-court  www.chhs.ca.gov  https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220SB1338  https://www.gov.ca.gov/2022/09/14/governor-newsom-signs-care-court-into-law- providing-a-new-path-forward-for-californians-struggling-with-serious-mental-illness/  https://www.scscourt.org/self_help/probate/conservatorship/conservatorship_lps.shtml  National Alliance on Mental Illness – California: https://namica.org/care/  LPS (Mental Health) Conservatorship: https://www.scscourt.org/self_help/probate/conservatorship/conservatorship_lps.shtml “There are only two different types of companies in the world: those that have been breached and know it and those that have been breached and don’t know it.” -Ted Schlein Glenn County Government Agencies Cyber Security and Disaster Preparedness: Lessons Learned Photo: Cybersecurity by Nick Youngson Glenn County Cyber Security and Disaster Preparedness: Lessons Learned Summary The Civil Grand Jury also created a cyber security questionnaire focusing on program In spring of 2021, the Glenn County Office of specifics and protocols. The Civil Grand Jury Education fell victim to an elaborate cyber- also conducted interviews with cybersecurity attack, locking out most of the district’s experts and program managers on what a schools from its network. Students and staff program should look like and what protections alike had their personal data stolen and held for should be in place. ransom. The incident made news headlines and was not an isolated incident. Schools and government entities across the country have Glossary been hit in a similar manner with backups blocked and data lost or purposely corrupted GCOE: Glenn County Office of Education beyond use, even if a ransom is paid. More CLETS: California Law Enforcement Tele- frightening is the fact that this data can be communications System stored for years and then used when it is least suspected. GCCGJ: Glenn County Civil Grand Jury Background MITC: Matson & Isom Technology Con- sulting Considering recent events and the amount of people affected by the 2021 breach, the 2023- GSRMA: Golden State Risk Management 24 Glenn County Civil Grand Jury looked at Authority Glenn County’s major players to see how they RBAC: Role-Based Access Control is an are prepared for a cyber-attack like those approach to restricting system access to plaguing the country. Our inquiry included: authorized users, and to implementing manda-  County of Glenn tory access control  Glenn County Office of Education Information Technology (IT): The develop- (due to its size and profile) ment, implementation, and maintenance of computer hardware and software systems to  City of Orland organize and communicate information elec-  City of Willows tronically. Cloud: Internet based computing in which Methodology large groups of remote servers are networked Our investigation included research for sharing of data-processed tasks, centralized about cyber security itself. We looked at state, data storage, and online access to computer federal, and local regulations regarding services. requirements for cybersecurity at the county Phishing: Using fraudulent Emails and copies level. We also reviewed past civil grand jury of legitimate websites to extract financial data reports from other counties along with their from computer users for the purposes of findings and recommendations. identity theft. Malware: Software intended to damage a  Ransomware Incident Response computer, mobile device, computer system,  Cyber Security Recommendations computer network, or take control of its operation.  Cyber Security Resources Distributed Denial of Service (DDoS): Using this information along with past civil Attacks using multiple devices to flood a target grand jury reports, the GCCGJ sent out a system, network, or website with a high volume questionnaire with a ten working-day response of traffic thereby blocking normal traffic. time asking for program specifics and the state of their cyber security programs. From the Discussion surveys that were returned, we discovered that Cyber security is something that should not be not all agencies use the same techniques or taken lightly. According to Forbes.com, over companies for cyber security. 300 million people fell victim to cyberattacks Other than training, there is no set standard on last year totaling almost $4.5 million in what an organization's cyber program should damages. That’s a 72% increase over the pre- look like. Glenn County organizations only use vious high which was recorded in 2021. The what is recommended by GSRMA but are left most common vector in these cases was via to find their own IT services as needed. email, which was the case for GCOE in 2021. Cyberattacks are not just limited to phishing County of Glenn email scams. There are a broad array of The County of Glenn has written IT policies vectors, including malware, distributed denial for itself and its departments. These policies of service, and personal data breaches. In are strictly enforced and can be found in the some instances, the attackers can lay dormant Electronics System Policy, Chapter 10, of the for weeks or months scanning and infecting County’s administration manual. This section systems without the knowledge of the user. Cyber-attacks can include pulling information while simultaneously blocking backups and corrupting files, ultimately locking the system and issuing a ransom demand for an encryption key to retrieve data. In many cases, even if the ransom is paid, the data is too corrupted to be used, and the organization must start from scratch. The start of the Civil Grand Jury’s inquiry began with research into cybersecurity

- Districts are only required to provide R2 - Due to evolving threats and past incidents, all cybersecurity training once a year to districts should provide basic IT refresher staff. training throughout the year to remind staff of the importance of cybersecurity in their daily operations by December 2024

- Not all city departments utilize the R3 - If possible, consolidate all departments under same network backups and third-party the same umbrella for continuity and security firms. efficiency by June 2025. Conclusion Required Responses Overall, all the county’s main agencies are Pursuant to Penal Code section 933.05, the prepared as much as they can be amidst today’s governing bodies of the following agencies are IT environment. required to respond: Threats are continually changing. GCOE has  City of Willows learned from its experience in the last couple  City of Orland of years; that experience has influenced the rest of the county’s agencies. The responses we  County of Glenn received showed agencies being proactive in trying to stay ahead of the game. Invited Responses The 2023-24 Glenn County Civil Grand Jury Pursuant to Penal Code section 933.05, the gives a special thank you to Golden State Risk agencies are invited to respond: Management Authority for their support to Glenn County, and particularly for their  Glenn County Office of Education consultation in this investigation. Thank you to all the organizations and departments that responded to our requests. Cyber and Disaster Preparedness Survey GLENN COUNTY GRAND JURY SURVEY ON CYBER SECURITY AND DISASTER PREPAREDNESS The 2023-2024 Glenn County Civil Grand Jury is requesting that you answer the following questions: Agency Name: Contact: Phone#: E-mail address: 1) Overview a) What is the scope of your IS division responsibilities? i) Are all your city’s departments subject to your ISD oversight and policies? ii) Are there any significant data systems that exist within county government that do not fall within your direct authority and responsibility? c) Organization Chart Add attachment (Chart) d) Network diagram Add attachment (diagram) 2) IS Security a) Data confidentiality i) How is a user’s level of access to information determined? ii) How is the sensitivity of data determined? iii) Do all city departments follow uniform standards? iv) How are new employees trained with regards to data confidentiality and security? Is there follow-up training? v) Do you allow personnel access from their personal computers? b) Data Security (Malware, Hacking, Corruption, etc.)) Cyber and Disaster Preparedness Survey ( ) i)Network (1) Wired (2) Wireless ii)Servers iii) Clients/workstations (1) To what extent is critical or confidential data being stored on local workstations? (2) Are there controls on portable and mobile devices (laptops, thumb drives, etc.) to protect confidentiality? c) Disaster Preparedness (availability) i) Preparation—do you have the following? (1) Off-site backups ii) Recovery (1) Has it been tested? iii) Business continuity (1) Do you have a documented plan? (a)How is it distributed? (2) What is your estimated time to recover essential services? iv) Have there been any system failures to date? (1) What was your time to full recovery? (2) What lessons were learned? Survey completed by: Title: Date: References  California schools seek to fend off cyberattacks (recordnet.com)  https://www.forbes.com/advisor/education/it-and-tech/cybersecurity-statistics/  https://www.ias.edu/security/priority-and-severity-levels  https://oag.ca.gov/sites/default/files/clets-ppp%2012-2019.pdf  https://www.nist.gov/  https://www.nist.gov/cybersecurity  https://www.nist.gov/cyberframework  https://www.nist.gov/cyberframework/perspectives  https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final  https://csrc.nist.gov/pubs/sp/800/171/r3/fpd  2021-2022 San Joaquin County Civil Grand Jury Report https://www.sjcourts.org/divisions/civil-grand-jury/api/grabReport.php?_id=358  CISA, Ransomware Incident Response Training  GSRMA, Cyber Security Recommendation Manual.  GSRMA, Cyber risk self-assessment survey  GSRMA, Protecting against cyber attacks Additional Articles Providing Recent Examples of Interest  2/29/24 A hacking group called "LockBit": https://www.msn.com/en-us/money/markets/this-notorious-russian-hacking-group-is- threatening-to-release-trump-court-documents/ar- BB1j7sli?ocid=hpmsn&cvid=fdb319aa7a7e4874a2937035c017f74b&ei=15  3/30/24 Data leak @ AT&T: https://www.msn.com/en-us/money/companies/at-t-says-leaked-data-set-impacts-about- 73-million-current-former-account-holders/ar- BB1kNxXb?ocid=hpmsn&cvid=504031349c834010a9e62a40b689655c&ei=73  4/12/24 Corporate Security Protection Shortfalls: https://www.msn.com/en-us/news/technology/organizations-keep-making-data- protection-mistakes-what-this-means-for-you/ar-BB1i1Sig?ocid=hpmsn  Importance of Data Backup & Other Ways to Protect Yourself: [4min video on the importance of data backup] https://www.msn.com/en-us/video/news/what-should-you-do-if-your-data-is- breached/vi-BB1kU8y0?ocid=hpmsn&cvid=24dc2226a873496789f4805946a7e1d5&ei=211 “Early childhood education is the key to the betterment of society.” -Maria Montessori First 5 Glenn County How does it serve our community? First 5 Glenn County: How does it serve our community? Summary was lacking in many areas of service to our community and among its own operations. First 5 Glenn County (First 5) is currently facing multiple challenges that are hindering its Methodology ability to effectively serve our community. The organization is grappling with a lack of The investigation into First 5 Glenn County’s comprehensive programs that address early operations involved a multifaceted approach childhood development, and recent resigna- using both online research and interviews. tions of staff and commission board members It began with an examination of the have led to a loss of institutional knowledge. organization’s website, reviewing available Significant debt accrual, concerns of prior information about its programs, financial nepotism, and the appointment of a new Board reports, and governance structure. The lack of of Commissioners, are also among the hurdles transparency was noted, with nonfunctional First 5 is facing. hyperlinks to meeting agendas and minutes, These issues require immediate attention and apparent improper use of “closed session” strategic solutions to ensure that the procedures, and missing financial audits and organization can fulfill its mission of reports. supporting the well-being and development of To further validate the concerns, interviews children aged 0 – 5 and their families in Glenn were conducted with the goal of gathering County. firsthand insights into First 5’s operational challenges, including accusations of nepotism Background and debt accrual. By combining the findings First 5 Glenn County operates under the from the website analysis and the interviews, endorsement of the California Children and the concerns calling for an investigation were Families Act of 1998, also known as confirmed. Proposition 10, which allocates funds from a tobacco tax for early childhood development Discussion programs. First 5 aims to provide compre- The Glenn County Civil Grand Jury began hensive services and support to improve the inquiring and investigating First 5 Glenn lives of children of age 0 – 5 and their families, County in late fall of 2023 and have since to ensure they have a healthy start in life and uncovered several significant issues affecting are well-prepared for success in school and the program. Staffing issues were a prominent beyond. topic, with reports of multiple resignations. The organization collaborates with various Unlike most other programs, which are community partners to deliver programs and understaffed, First 5 seems to have been initiatives that focus on early education, health overstaffed for some time. and wellness, parental support, and community There were accusations of nepotism within the engagement. organization’s previous staff, suggesting that As the civil grand jury inquired about First 5, it individuals with close personal relationships was discovered that the Glenn County branch may have received preferential treatment in services rendered, hiring, and promotion community. It is still unclear as to how the processes. approximate $100,000 debt accrued, and we strongly believe this should be investigated It’s well known that COVID-19 had many further by more formal sources. effects on businesses and county programs. However, four years post-pandemic, First 5 What the Civil Grand Jury has found leads us Glenn County only offers the bare minimum – to believe there was a lack of supervision from diaper and wipes distribution. This indicates a the former Board of Commissioners. A gap in need for more comprehensive and impactful governance and oversight contributed to the initiatives to support early childhood develop- challenges First 5 Glen County is now facing. ment. The appearance of a lack of transparency with Debt accrual is another area of concern, First 5 respect to this organization is created by non- Glenn County has accumulated a significant working hyperlinks on their Web site and the amount of debt over time. The amount of debt limited access to important public information. raises questions about the organization's Missing fiscal and employee audits and reports financial management practices and its ability demonstrate the lack of accountability in First to allocate resources effectively to deliver its 5’s financial reporting and program evaluation. program and services. These discussions shed light on various critical As previously mentioned, it has only been areas that require attention, improvement, and providing a very minimal service to the in some areas, further investigation. Findings and Recommendations The Civil Grand Jury finds… The Civil Grand Jury recommends…

- First 5 has been overstaffed (above the R4 - The number of staff should be balanced with 1.5 employees recommended for a the budget allotted and the work force that is county the size of Glenn). necessary for the limited programs currently offered.

- There is little to no community R5 - Collaborate with community stakeholders, engagement and relevant partnerships. including healthcare providers, educational institutions, and social service agencies that can help leverage resources and share expertise.

- Program and employee evaluations are R6 - Prioritize ongoing program and employee limited or outdated. evaluations to assess the effectiveness and impact of its initiatives. Update as needed.

- First 5 is missing last fiscal year's report R7 - Complete, submit, and post missing fiscal and audit. (2022 – 2023) year report and audit. Conclusion Required Responses First 5 Glenn County faces various challenges. Pursuant to Penal Code section 933.05, the The Civil Grand Jury commends the current governing bodies of the following agencies are Board of Commissioners for the work they are required to respond: doing in rebuilding this program for our  First 5 Glenn County, Board of community. Directors By implementing the recommended strategies,  Glenn County Board of Supervisors First 5 Glenn County can enhance its ability to fulfill its mission of improving the lives of children and families in Glenn County. References  First 5 California Parenting Website https://www.first5california.com/en-us/services/ “There is no harm in hoping for the best as long as you are prepared for the worst.” - Stephen King Glenn County Schools When disaster strikes, are Glenn County schools prepared? Glenn County Schools: When disaster strikes, are Glenn County schools prepared? Summary Methodology In November of 2017 a man armed with semi- Our investigation started by looking at Cali- automatic weapons went on an unprovoked fornia state laws governing school safety plans rampage in the Rancho Tehama reserve forty to compare that to Glenn County schools’ minutes north of Orland. He had murdered protocols. We acquired a past training video his wife the night before and hid her body on school CSSPs from the California Board of under the floorboards of their house. He then Education, and we downloaded the CSSP turned his weapon on his neighbors, shooting development matrix. From these sources, we them dead. His next target was the small developed a school safety survey that was sent community school filled with children down out to all the school districts in the county. the road. He stole a vehicle and drove toward The attached questionnaire was used to gauge the school. On his way, he came upon a what the school has for surveillance, visitor mother with her three children at a stop sign tracking, and CSSP specific questions. Once and unloaded his weapon into their vehicle, the surveys were returned, along with a CSSP injuring all four occupants. for each school, they were carefully reviewed, Meanwhile, down the road at the school, the and interviews were scheduled for any addi- school secretary, hearing the gunfire, ordered tional information and/or clarifications. the school to lock down. When the gunman arrived, all he found was an empty school yard Glossary and locked doors. He did fire into the classrooms and injured several of the occupants, including young students. If it hadn’t been for the quick action of the school staff, it could have been one of the worst tragedies to strike our local area. This raises the question: if it happened less than an hour away, could it happen here, and are we prepared for the worst-case scenario? The 2023-24 Glenn County Civil Grand Jury set out to investigate Glenn County Schools’ comprehensive school safety plans.  GCOE: Glenn County Office of Background Education The GCCGJ looked for past inspections of  CSSP: Comprehensive School Safety Glenn County schools’ safety plans and could Plan not find any in recent years. Using sister county civil grand jury investigations as guides,  GCCGJ: Glenn County Civil Grand GCCGJ set out to find how our local schools Jury are implementing, practicing and using their comprehensive school’s safety plans. Discussion1 The GCOE threat assessment office volun- teered their time in briefing the GCCGJ on the The CSSPs are required by Education code current state of safety in our schools. The 32280-32289.5 and are to be written and threat assessment office conducts site surveys adopted by the first of March every year. Each for all the schools in Glenn County, briefing school or small district must create their own them on their strengths and weaknesses and specific plan and submit the adopted plan to areas of improvement. All schools are recep- the county office of education by the first of tive and use these reports as a guide for their March. A public meeting must be held prior to individual locations. Some examples of adoption and the final CSSP submitted to improvements needed across Glenn County GCOE for approval. The plan must include, are as follows. but is not limited to, the following information: Low-Cost Options:  Assessment of current school crime  Give remote security camera access to  Child abuse reporting Law enforcement; enables law enforce-  Disaster procedures ment real time information on the situation  Earthquake plan  Large print room numbers across  Suspension/expulsion procedures campus classrooms and office doors for easy identification  Dangerous pupil notifications  Large print building numbers on the The California education code currently only roof of school buildings for easy requires that earthquake and fire drills be identification for air support. conducted on a regular basis. All other drills  Clutter removal are up to the local authorities and are not mandated. A survey conducted by the Cali- High-Cost Options: fornia Department of Education Equity office in 2021 concluded that 93% of California  Full Time school resource officers schools conducted at least one lock-down drill  100% campus coverage with no climb per year. fencing Our Glenn County survey came back better  Shatter-proof glass on windows and than the state average, with 100% of schools doors conducting one or more drills per year. According to that same report, most districts in  Single entry control points for school the state limit these drills due to the “mental campus’ stress it causes to children.” A bill is currently  Upgraded surveillance systems in the works at the state capitol to make this a  Auto-locking classroom doors law. For the safety and operational security of vulnerabilities a school may have will not be Glenn County schools, we will be generalizing directly referenced and possibly exploited. findings and recommendations so any Findings and Recommendations The Civil Grand Jury finds… The Civil Grand Jury recommends…