Placer County Grand Jury 2021-2022 Final Report State of California June 2022 Placer County Grand Jury 2021-2022 Final

Conclusions 10

• CL1
  The grand jury found that:
• CL2
  The City of Colfax has an incomplete complaint process. The City of Colfax does not provide training on its complaint process to city
• CL3
  employees. The Colfax City Complaint Form is not easily accessible on the City of Colfax website
• CL4
  and it is not clear on what happens to the complaint once filed. The city manager stated that he lacked knowledge of the city’s citizen complaint Recomprmoceesnsd, aas thioe ndissc losed in his interview with the grand jury.
• CL5
  requirement for these monies to be used for any specific purpose. Grant revenues: Received primarily from the FAA and constitutes about 25 percent of the operating revenue. The grant revenue from the FAA is specified to be used for
• CL6
  airport infrastructure and maintenance projects. Airside revenue: Includes items such as jet fuel and transient use fees and makes up about 21 percent of the revenue for the airport. 119 Placer County Grand Jury 2021-2022 Final Report The chart below represents the operating expenditures for FY 2021: Source: FY 2021 Approved Budget The• t hree largest expenditures are:
• CL7
  Payroll and employee benefits Genoeral operating costs including day-to-day operations, such as: o Annoyance reduction programs o Airport security and safety o Airshow o Equipment rental o Office lease
• CL8
  Grounds maintenance/landscaping Depreciation: buildings and equipment 120 Placer County Grand Jury 2021-2022 Final Report In FY 2021 the board allocated 11 percent of the budget for community outreach/partnerships. The board of directors recognizes that property taxes received by the airport should benefit all residents not just pilots. Examples include multi-year commitments, such as the Tahoe Area Rapid Transit Free Fare Project, Lizzando Housing Project, Free Night Rider Service, and Highway 267 Year-Round Service. The board allocates these non-aviation related expenditures as recognition that not all taxpayers utilize the airport. During the annual budget process, citizens are allowed to make suggestions about how the funds should be distributed. As noted earlier in this report, expenditures made using funds received from FAA grants are specified to be used for airport infrastructure and maintenance. These grant fund expenditures are not delineated as such in the actual airport expenditures, which could cNoonifsues eA tbhaet peumbelinc t( See Appendix 2). The board of directors acknowledges that the noise created by arriving and departing aircraft is a concern to the community. As such, the board strives to be both an outstanding general aviation airport and a good neighbor. To help alleviate noise, the control tower implements low impact procedures and moves aircraft away from neighborhoods. The current airport board has fielded many complaints concerning airport noise. One idea currently under consideration is the addition of a third runway, angled away from residential areas. Although some pilots have requested an increase in the number of hangers, the addition of hangars is not a priority to this board. According to persons interviewed, increasing the number of hangers would increase the number of planes uFtuileizl icnogs tth ein acirrepaorste, sre asunldti npgo isni taiv hei gehfefer cletv oenl o tfh neo bisued. get The airport staff is very sensitive to the market fluctuation of fuel costs. The board contracted with an external consultant to understand all the variables that should be included in jet fuel prices that they charge users. Airport management regularly adjusts pCroicnesc aluccsoirodnin g to market rates. As a result of the grand jury’s investigation, the jury determin ed the budgeting process of the TTAD was well managed and transparent. Effective management controls are in place t o receive citizen comments and respond to citizen concerns. 121 Placer County Grand Jury 2021-2022 Final Report
• CL9
  The Placer County Grand Jury received and investigated a complaint regarding inappropriate conduct by a City of Colfax elected official. In the course of its investigation the grand jury determined the City of Colfax has an ineffective citizen complaint process. This conclusion stems from written and oral evidence gathered in the course of the jury’s investigation. The complaint process in question is based on a form available on the city’s website, but which is difficult to locate. Also, while the form is accessible online, it required the complainant to print and send the form to the city rather than submitting it online. The complaint process itself is incomplete, with little guidance provided to the complainant and no process resolution or conclusion. While this complaint process may technically and legally comply with relevant city and state codes, it does not promote civic transparency for tFhien Cditiyn gofs C olfax. F1: The grand jury found that: F2: The City of Colfax has an incomplete complaint process. The City of Colfax does not provide training on its complaint process to city F3: employees. The Colfax City Complaint Form is not easily accessible on the City of Colfax website F4: and it is not clear on what happens to the complaint once filed. The city manager stated that he lacked knowledge of the city’s citizen complaint Recomprmoceesnsd, aas thioe ndissc losed in his interview with the grand jury. R1: The grand jury recommends that: By October 1, 2022, the city manager and other City of Colfax officials shall review R2: and publish documented policies and processes on managing citizens’ complaints. By October 1, 2022, the city shall provide training to management staff and city officials on the citizen complaint process and their responsibilities on how to handle R3: complaints. By October 1, 2022, the City of Colfax shall make the complaint form and instructions easily accessible and available in a drop-down menu on the city’s main R4: web page. By November 1, 2022 the Colfax City management will communicate the new complaint process and inform Colfax citizens about the process and how to file a R5: complaint. By November 1, 2022 all complaints shall follow a written complaint process utilizing the confidential complaint form. 19 Placer County Grand Jury 2021-2022 Final Report Request for Response Pursuant to Penal Code § 933.05, the Placer County Grand Jury requests a response from t he following governing bodies: Recommendations Response Requiring Response Due Date Wes Heathcock R1, R2, R3, R4, R5 October 1, 2022 City Manager City of Colfax P.O. Box 702 CTorlifnaixt,y C BAu 9r5r7u1ss3 R1 September 1, 2022 Mayor City of Colfax P.O. Box 702 CCoolfpaxie, CsA S 9e57n1t3 T o: Alfred Cabral, Esq. City Attorney City of Colfax P.O. Box 702 Colfax, CA 95713 20 Appendix A 21 Appendix B: Confidential Complaint Form Process 22 23 24 Cybersecurity Is Placer County Prepared for Cyber Threats? 25 26 Placer County Grand Jury 2021-2022 Final Report Cybersecurity Is Placer County Prepared for Cyber Threats? Summary Government entities and private businesses face the daily risk of cyber attacks. In the Sacramento region, both the Lodi School District and Sierra College experienced system shutdowns in 2021 due to unauthorized access with resulting sabotage. The Placer County Grand Jury investigated the exposure that Placer County information systems might be facing. The grand jury found that the Placer County Information Technology (PCIT) department has an excellent program to protect their information systems. The effort is well staffed and well managed. The grand jury did identify some improvements that should bGel oevsasluaartyed for adoption. SaaS (Software as a Service) – allows users to connect to and use cloud-based apps over the Internet. Common examples are email, calendaring, and office tools (such as Microsoft 2 COlfofiuced 3s6to5r)a. g e – a model of computer data storage in which the digital data is stored in logical pools, said to be on "the cloud." The physical storage spans multiple servers (sometimes in multiple locations), and the physical environment is typically owned and managed by a hosting company. These cloud storage providers are responsible for keeping the data available and accessible, and the physical environment secured, protected, and 3 rPuhninshining.g – a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious software on the victim's infrastructure 4, 5 lRikaen rsaonmsowmawreare. – a type of malicious software that infects a computer and restricts users’ access to it until a ransom is paid to unlock it. Ransomware variants have been observed for several years and often attempt to extort money from victims by displaying an on- screen alert. Typically, these alerts state that the user’s systems have been locked or that 6 Ethnet eursperr’iss feil(eNs ehtawveo rbke)en encrypted. – the IT infrastructure that midsize and large organizations use to provide connectivity among users, devices, and applications. The goal is to support the 2 Azure, “What is SaaS? Software as a service”, accessed on April 22, 2022, https://azure.microsoft.com/en- us/overview/what-is-saas/ 3 Wikipedia, “Cloud storage”, accessed on April 22, 2022, https://en.wikipedia.org/wiki/Cloud_storage 4 Phishing.org, “What is Phishing?”, accessed on April 22, 2022, https://www.phishing.org/what-is-phishing 5 Wikipedia, “Phishing”, accessed on April 22, 2022, https://en.wikipedia.org/wiki/Phishing 6 UC Berkeley, “Frequently Asked Questions – Ransomware”, accessed on April 22, 2022, https://security.berkeley.edu/faq/ransomware/ 27 Placer County Grand Jury 2021-2022 Final Report organizations' objectives by consistently delivering connected digital services reliably and 7 sHeaccukrely to workers, partners, customers, and, increasingly, also things. – an act or instance of gaining or attempting to gain illegal access to a computer or 8 computer system. A hardware or software change not approved by the manufacturer or developer that makes it do something it wasn't intended to do. For example, with software updates and modifications, users can make their Xbox gaming console more of a media center. Because the developer does not support these modifications, hacks void your 9 wWahrirtaenlitsyt ainngd prevent you from getting manufacturer support. – a cybersecurity strategy under which a user can only take actions on their computer that an administrator has explicitly allowed in advance. Instead of trying to keep one step ahead of cyber attackers to identify and block malicious code, IT staff instead compiles a list of approved applications that a computer or mobile device can access. In essence, the user has access to only a limited set of functionality, and what they can access 10 has been deemed safe by the administrator. Whitelisting only allows an approved list of applications, programs, websites, Internet Protocol (IP) addresses, email addresses, or IP 11 dDoamtaa tinhse,f tto r un in a protected computer or network. 12 Sabotage –The unauthorized taking or interception of computer-based information. – deliberate attack intended to disable or modify computers or networks for the purpose of disrupting operations or transactions, accessing or destroying files, or 13 oNtChSeRrwise compromising an organization. – The Nationwide Cybersecurity Review is a no-cost, anonymous, annual self- assessment designed to measure gaps and capabilities of state, local, tribal, and territorial governments’ cybersecurity programs. The NCSR data is tabulated by the Center for Internet Security, Inc. (CIS®), which is a community-driven nonprofit, responsible for the CIS Controls® and CIS Benchmarks™, globally recognized best practices for securing IT 14 systems and data. 7 Cisco, “What Is an Enterprise Network?”, accessed on April 22, 2022, https://www.cisco.com/c/en/us/solutions/enterprise-networks/what-is-an-enterprise-network.html 8 Merriam-Webster, “hack” (Entry 2.6.a), accessed on April 22, 2022, https://www.merriam- webster.com/dictionary/hack 9 ComputerHope, “Hack”, accessed April 22, 2022, https://www.computerhope.com/jargon/h/hack.htm 10 CSO, “Whitelist meaning and definition”, accessed on April 22, 2022, https://www.csoonline.com/article/3562429/whitelisting-explained-how-it-works-and-where-it-fits-in-a-security- program.html 11 Webopedia, “Whitelisting”, accessed on April 22, 2022, https://www.webopedia.com/definitions/whitelisting/ 12 Cybercrime.org.za, “Data Theft Definition”, accessed on April 22, 2022, https://cybercrime.org.za/data- theft/#:~:text=Data%20Theft%20Definition%20The%20unauthorized%20taking%20or%20interception,intent%20o f%20compromising%20privacy%20or%20obtaining%20confidential%20information. 13 Santa Barbara County Grand Jury, “CYBER-ATTACKS THREATEN SANTA BARBARA COUNTY”, accessed on April 22, 2022, http://www.sbcgj.org/2020/CyberSecurity.pdf 14 Center for Internet Security, “Nationwide Cybersecurity Review (NCSR)”, accessed on April 22, 2022, https://www.cisecurity.org/ms-isac/services/ncsr 28 Placer County Grand Jury 2021-2022 Final Report
• CL10
  The 2021-2022 Placer County Grand Jury is following the precedent set by the 2020-2021 Placer County Grand Jury by publishing this continuity report. This jury believes it is important to verify that respondents were compliant with Penal Code § 933.05 and concludes that this work is too important to not be a requirement of each grand jury going f Foriwndaridn. g s TF1h:e grand jury found: Placer County Grand Jury wrote its first continuity report in 2020-2021 and is F2: continuing that process this year, following up on noncompliant responses. Newcastle Fire Protection District does not have clickable links on its website to F3: their current agenda, making it noncompliant with the Brown Act. Midway Heights Water District, Penryn Fire District, and Placer Hills Fire District all have links to their agendas, but the agendas posted are not current. This is F4: noncompliant with the Brown Act. The Placer County Sheriff’s Office response to the grand jury’s report on continuity and accountability was noncompliant with Penal Code § 933.05. While the response indicated that the recommendation would be implemented in the future, no timeline F5: for implementation was provided. Heather Glen Community Services District, Talmont Resort Improvement District, and the City of Lincoln did not provide responses that were compliant with Penal Code § 933.05. The response provided by these entities did not indicate agreement F6: or disagreement with the pertinent findings. Auburn Recreation & Parks District did not provide a response that was compliant with Penal Code § 933.05. The response provided did not indicate agreement or disagreement with the pertinent findings, nor did it provide any response to the recommendation. 167 Placer County Grand Jury 2021-2022 Final Report

No Responses Found 1

Government entities assigned to respond to this report. No response documents have been linked in our database.