Ventura County Grand Jury

2019-2020

7 reports

Findings & Recommendations 31 findings
F01: Attackers often target small organizations and cities that have few resources to defend themselves. (Ref-02, Ref-03)
F02: Cities are aware of the threat of cyberattacks and, to a varying degree, take active measures to reduce the risk in accordance with the Cybersecurity Framework. (Ref-14)
F03: On March 13, 2020, the California Cyber Security Integration Center issued a cybersecurity advisory titled Teleworking Quick Reference Guide. The guide highlights some security concerns and best practices end-users and network administrators should consider when implementing a teleworking program. (App-01)
F04: Not all Cities are implementing the teleworking best practices recommended by the California Cyber Security Integration Center. (Ref-16) (App-01)
F05: City managers and IT personnel provide ongoing cyber safety training and encourage personnel to take advantage of that training. Cybersecurity Strategies for Cities in Ventura County 5 Collaboration within the County
F06: The Ventura County Executive Office created an informal network of City IT managers, thereby collectively elevating the level of the Cities’ IT performance.
F07: City managers and IT personnel meet with their counterparts from other Cities on a regular basis to collaborate regarding cyberattacks. City Web Addresses (URLs)
F08: The California Department of Technology and the National League of Cities recommend using .gov domain names and secure internet protocols. (App-01)
F09: Nine out of ten Cities use HTTPS (Hypertext Transfer Protocol Secure). Two out of ten Cities have .gov domain names. (App-03) Cybersecurity Resources
F10: Cybersecurity and Infrastructure Agency  The Department of Homeland Security (DHS) designated the Cybersecurity and Infrastructure Agency (CISA) to be the lead federal department to provide cybersecurity assistance to State, Local, Tribal and Territorial (SLTTs) government organizations. (App-02)  CISA provides SLTTs with a “one-stop shop” of free services for cyber risk assessments, cybersecurity evaluations, incident assistance coordination, cyber exercises/training and recommended best practices. (App-02)
F11: Only one City uses any of the free CISA resources. That City uses only one of the available resources.
Related Recommendations (2)
R03: The Grand Jury recommends Cities utilize free federal and federally aligned cybersecurity services as set forth in
R04: The Grand Jury recommends Cities’ IT staff subscribe to CISA updates online. (C-03)
F12: Among its many services, CISA operates the Protective Security Advisor (PSA) Program. PSAs are DHS-trained critical infrastructure protection and vulnerability mitigation subject matter experts. Upon request, these experts provide free cybersecurity advice and assistance to SLTTs. (App-02)
F13: Nine of the 10 Cities maintain their cyber infrastructure through the use of internal staff and/or hiring vendors, in each case without taking advantage of CISA assistance.
Related Recommendations (2)
R03: The Grand Jury recommends Cities utilize free federal and federally aligned cybersecurity services as set forth in
R04: The Grand Jury recommends Cities’ IT staff subscribe to CISA updates online. (C-03)
F14: By using just one free CISA service, the remaining City saved at least $1,000 per month over five years. That City was not aware of the other available free CISA services. Cybersecurity Strategies for Cities in Ventura County
Related Recommendations (1)
R05: The Grand Jury recommends Cities take advantage of discounted services and cooperative purchasing programs whenever possible. (C-03)
F15: The DHS designated the nonprofit member driven Multi-State Information Sharing & Analysis Center (MS-ISAC) as its partner for sharing cybersecurity information with the SLTT governments. (App-02)
F16: MISAC also provides some fee-based cybersecurity services. (App-02)
F17: While all IT managers for the Cities are members of MISAC, less than half are members of MS-ISAC. Furthermore, only three Cities’ IT personnel attended the MISAC 2019 Annual Conference. (Ref-17)
Related Recommendations (1)
R3: Multi-State Information Sharing & Analysis Center (MS-ISAC) membership. Joining MS-ISAC is free to municipal government IT operations. GovLaunch A national free, private platform for any verified employees of local government https://govlaunch.com/ to share details of their projects or initiatives. It is a website where local governments can find out what technology their peers are turning to and how they’re using it. Cybersecurity Strategies for Cities in Ventura County 25 Cybersecurity Resources Source Service FedVTE FedVTE is a free, online, on-demand cybersecurity training system managed niccs.us-cert.gov/training/federal- by DHS that is available to SLTT virtual-training-environment-fedvte government personnel. It contains more than 800 hours of training on topics such as ethical hacking, surveillance, risk management and malware analysis. Resource benefits include:  Diverse courses – The program offers more than 300 demonstrations and 3,000 related materials, including online lectures and hands-on virtual labs. • Certification offerings – Offerings include Network +, Security +, Certified Information Systems Security Professional (CISSP), Windows Operating System Security and Certified Ethical Hacker. • Experienced instructors – All courses are taught by experienced cybersecurity subject matter experts. CIS CyberMarket CIS's collaborative purchasing program that serves SLTT organizations, not-for- https://www.cisecurity.org/services/cis- profit entities, and public health and cybermarket/ education institutions to improve cybersecurity through cost-effective group procurement. The objective of the CIS CyberMarket is to combine the purchasing power of governmental and nonprofit sectors to help participants improve their cybersecurity environment at a lower cost than they would have been able to attain on their own. Cybersecurity Strategies for Cities in Ventura County Cybersecurity Resources Source Service General Services Administration Allows SLTTs to purchase IT and security products and services offered Cooperative Purchasing Program through GSA’s negotiated contracts. The https://www.gsa.gov/technology/techno advantage for eligible users of the GSA logy-products-services/it-security Cooperative Purchasing Program is that vendor services and products can be https://www.gsa.gov/buying- procured at the lowest possible price selling/purchasing-programs/gsa- with the assurance that contractors are schedules/schedule-buyers/state-and- qualified to sell to the federal local-governments/cooperative- government. purchasing FedRAMP Moderate A U.S. government program that establishes a standardized approach for https://www.fedramp.gov/ validating that cloud services are https://cdt.ca.gov/wp- secure. FedRAMP offers independent, content/uploads/2019/01/2018-Annual- third-party validation of a cloud Report_FINAL_accessible.pdf, p. 12 provider’s security posture and a standardized approach to security https://cdt.ca.gov/wp- assessments, authorization and content/uploads/2019/09/TA_18-05.pdf continuous monitoring for cloud products and services. It is administered by the states. Available to all California cities and counties. This single state contract provides cloud services to government customers at discounted prices of up to 9.5%, with additional volume discounts available for select providers. Service providers include Amazon, Microsoft and IBM. California’s Cybersecurity Task Force While not currently providing direct cybersecurity support to California’s https://www.caloes.ca.gov/cal-oes- cities, this task force may be a future divisions/cybersecurity-task-force/task- resource. force-subcommittees Cybersecurity Strategies for Cities in Ventura County 27 Cybersecurity Resources Source Service The National Science Foundation Administers the Federal SFS program which is an effective recruiting tool for https://www.sfs.opm.gov/ SLTTs. Upon graduation, scholarship recipients are required to work as cybersecurity professionals for a period equal to the length of their scholarship. The CyberCorps scholarship assists in funding the typical costs incurred by full-time students while attending a participating institution, including tuition and education and related fees. The scholarships are funded through grants awarded by the National Science Foundation in partnership with DHS and the Federal Office of Personnel Management (OPM). City hiring Managers and Human Resources Consultants interested in recruiting from the SFS program can gain access to this candidate pool by contacting the program office at sfs@opm.gov. Cybersecurity Strategies for Cities in Ventura County This page intentionally left blank Cybersecurity Strategies for Cities in Ventura County 29
F18: Representatives from MS-ISAC provided information on available Federal cybersecurity resources at the 2019 MISAC conference. (Ref-18)
F19: More than 90 California cities hold memberships in MS-ISAC; two Cities in the County are members. (Ref-19)
Related Recommendations (1)
R3: Multi-State Information Sharing & Analysis Center (MS-ISAC) membership. Joining MS-ISAC is free to municipal government IT operations. GovLaunch A national free, private platform for any verified employees of local government https://govlaunch.com/ to share details of their projects or initiatives. It is a website where local governments can find out what technology their peers are turning to and how they’re using it. Cybersecurity Strategies for Cities in Ventura County 25 Cybersecurity Resources Source Service FedVTE FedVTE is a free, online, on-demand cybersecurity training system managed niccs.us-cert.gov/training/federal- by DHS that is available to SLTT virtual-training-environment-fedvte government personnel. It contains more than 800 hours of training on topics such as ethical hacking, surveillance, risk management and malware analysis. Resource benefits include:  Diverse courses – The program offers more than 300 demonstrations and 3,000 related materials, including online lectures and hands-on virtual labs. • Certification offerings – Offerings include Network +, Security +, Certified Information Systems Security Professional (CISSP), Windows Operating System Security and Certified Ethical Hacker. • Experienced instructors – All courses are taught by experienced cybersecurity subject matter experts. CIS CyberMarket CIS's collaborative purchasing program that serves SLTT organizations, not-for- https://www.cisecurity.org/services/cis- profit entities, and public health and cybermarket/ education institutions to improve cybersecurity through cost-effective group procurement. The objective of the CIS CyberMarket is to combine the purchasing power of governmental and nonprofit sectors to help participants improve their cybersecurity environment at a lower cost than they would have been able to attain on their own. Cybersecurity Strategies for Cities in Ventura County Cybersecurity Resources Source Service General Services Administration Allows SLTTs to purchase IT and security products and services offered Cooperative Purchasing Program through GSA’s negotiated contracts. The https://www.gsa.gov/technology/techno advantage for eligible users of the GSA logy-products-services/it-security Cooperative Purchasing Program is that vendor services and products can be https://www.gsa.gov/buying- procured at the lowest possible price selling/purchasing-programs/gsa- with the assurance that contractors are schedules/schedule-buyers/state-and- qualified to sell to the federal local-governments/cooperative- government. purchasing FedRAMP Moderate A U.S. government program that establishes a standardized approach for https://www.fedramp.gov/ validating that cloud services are https://cdt.ca.gov/wp- secure. FedRAMP offers independent, content/uploads/2019/01/2018-Annual- third-party validation of a cloud Report_FINAL_accessible.pdf, p. 12 provider’s security posture and a standardized approach to security https://cdt.ca.gov/wp- assessments, authorization and content/uploads/2019/09/TA_18-05.pdf continuous monitoring for cloud products and services. It is administered by the states. Available to all California cities and counties. This single state contract provides cloud services to government customers at discounted prices of up to 9.5%, with additional volume discounts available for select providers. Service providers include Amazon, Microsoft and IBM. California’s Cybersecurity Task Force While not currently providing direct cybersecurity support to California’s https://www.caloes.ca.gov/cal-oes- cities, this task force may be a future divisions/cybersecurity-task-force/task- resource. force-subcommittees Cybersecurity Strategies for Cities in Ventura County 27 Cybersecurity Resources Source Service The National Science Foundation Administers the Federal SFS program which is an effective recruiting tool for https://www.sfs.opm.gov/ SLTTs. Upon graduation, scholarship recipients are required to work as cybersecurity professionals for a period equal to the length of their scholarship. The CyberCorps scholarship assists in funding the typical costs incurred by full-time students while attending a participating institution, including tuition and education and related fees. The scholarships are funded through grants awarded by the National Science Foundation in partnership with DHS and the Federal Office of Personnel Management (OPM). City hiring Managers and Human Resources Consultants interested in recruiting from the SFS program can gain access to this candidate pool by contacting the program office at sfs@opm.gov. Cybersecurity Strategies for Cities in Ventura County This page intentionally left blank Cybersecurity Strategies for Cities in Ventura County 29
F20: Of those Cities that use servers, hybrid cloud and cloud platforms, few take advantage of the cost-saving FedRAMP Moderate program to contract with cloud providers. (App-02) Partnerships with Local Educational Institutions
F21: Some Cities partner with local educational institutions to develop internship opportunities and create a talent pool for cybersecurity or information technology. Those that do employ cybersecurity interns reported positive experiences and personnel cost savings.
Related Recommendations (1)
R06: The Grand Jury recommends Cities develop personnel cost-saving opportunities and create a cybersecurity talent pool by recruiting interns or graduating students using: (C-04)  The Scholarships for Service program described in Appendix 02  Local education institutions (high school, community college, private college and state university) Cybersecurity Strategies for Cities in Ventura County 9
F22: Three County higher educational institutions offer cybersecurity and internship programs:  California Lutheran University (Ref-20)  California State University Channel Islands (Ref-21, Ref-22)  Moorpark College (Ref-23) Information Technology Department Staffing
F23: Some Cities have difficulty recruiting and retaining IT staff. Salaries and benefits for City IT staff are not competitive with the private sector. Cybersecurity Liability Insurance
Related Recommendations (1)
R06: The Grand Jury recommends Cities develop personnel cost-saving opportunities and create a cybersecurity talent pool by recruiting interns or graduating students using: (C-04)  The Scholarships for Service program described in Appendix 02  Local education institutions (high school, community college, private college and state university) Cybersecurity Strategies for Cities in Ventura County 9
F24: All Cities have cybersecurity liability insurance through the California Joint Powers Insurance Authority or other insurers.
F25: In addition to recommending cyber liability insurance for cities, the MISAC Security committee encourages MISAC members require their IT vendors have cyber liability insurance. (Ref-24) Cybersecurity Strategies for Cities in Ventura County 7 City Budgets for Information Technology Services
F26: In reviews of budget documents, the Grand Jury found that five Cities have Information Services/Technology Departments line items in their adopted budgets. No City has a publicly viewable budget line item specifically for cybersecurity. (App-03)
Related Recommendations (1)
R08: The Grand Jury recommends Cities clearly identify expenses for their Information Services (Technology) Departments in their approved budgets. (C-06)
F27: Two of the Cities anticipate spending over $5 million on information services in the upcoming budget year. (App-03) Cyber Incident Response and Disaster Recovery Plans
F28: In 2018, a major provider of cybersecurity policies conducted a survey of public and private-sector respondents. In that survey 91% of respondents were confident their companies had implemented best practices to avoid a cyber event. Yet, 55% admitted not completing a cyber-risk assessment, 62% had not developed a business continuity plan and 63% had not completed a cyber-risk assessment on vendors who have access to their data. (Ref-25)
Related Recommendations (1)
R09: The Grand Jury recommends Cities develop and test cyber incident response, recovery and business continuity plans. (C-07)
F29: Not all Cities have comprehensive cyber incident response, recovery and business continuity plans. Vendor Management
Related Recommendations (2)
R07: The Grand Jury recommends Cities maintain good vendor management by: (C-03, C-05)  Obtaining CISA assistance to conduct risk management assessments on all third-party vendors that have access to any confidential data or that interact with City networks and systems  Requiring all vendors provide cybersecurity documentation. As part of their ongoing third-party due diligence, Cities should evaluate vendors for compliance and risk on an annual basis  Requiring IT vendors obtain cybersecurity insurance.
R09: The Grand Jury recommends Cities develop and test cyber incident response, recovery and business continuity plans. (C-07)
F30: Business and Intellectual Property Attorney Lisa M. Thompson advised in August 2019 that cities should defend against cybersecurity threats by conducting risk management assessments on all third-party vendors that have access to confidential data and interact with municipal networks and systems. In addition, she stated that cities should require all vendors provide security documentation. (Ref-26)
F31: Most Cities do not manage the cyber risk of third-party vendors. Conclusions C-01. While the Grand Jury recognizes each City is taking steps to implement cybersecurity and to defend against cyberattacks, it concludes there is no perfect solution to cybersecurity or defense against cyberattacks. (FA-01, FA-02, FA-03, FA-04, FA-05, FA-06, FA-07) C-02. The Grand Jury concluded eight Cities are currently using suboptimal web addresses for their websites. (FA-08, FA-09) C-03. The Grand Jury concluded generally Cities are not utilizing free federal and discounted federally aligned resources available to Cities to bolster their cybersecurity defenses. (FA-10, FA-11, FA-12, FA-13, FA-14,
Related Recommendations (1)
R07: The Grand Jury recommends Cities maintain good vendor management by: (C-03, C-05)  Obtaining CISA assistance to conduct risk management assessments on all third-party vendors that have access to any confidential data or that interact with City networks and systems  Requiring all vendors provide cybersecurity documentation. As part of their ongoing third-party due diligence, Cities should evaluate vendors for compliance and risk on an annual basis  Requiring IT vendors obtain cybersecurity insurance.
Additional Recommendations 1

Not linked to specific findings.

R11: The Grand Jury recommends Cities develop a written plan for implementation of R-01 through R-10 prior to December 31, 2020. Responses Responses Required From: City Council, City of Camarillo (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Fillmore (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Moorpark (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Ojai (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Oxnard (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Port Hueneme (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Santa Paula (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) 10 Cybersecurity Strategies for Cities in Ventura County City Council, City of Simi Valley (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Thousand Oaks (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) City Council, City of Ventura (C-01, C-02, C-03, C-04, C-05, C-06, C-07, C-08) (R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10, R-11) References Ref-01. Shi, Flemming. Threat Spotlight: Government Ransomware Attacks. Barracuda blog, August 28, 2019 https://blog.barracuda.com/2019/08/28/threat-spotlight-government- ransomware-attacks/ Accessed April 7, 2020 Ref-02. McGalliard, Tad. How Local Governments Can Prevent Cyberattacks. New York Times, March 30, 2018 https://www.nytimes.com/2018/03/30/opinion/local-government- cyberattack.html Accessed April 7, 2020 Ref-03. Nelson, Sarah. Report: Local Gov Cyberattacks Reach Critical Level. Government Technology, December 18, 2019 https://www.govtech.com/security/Report-Local-Gov-Cyberattacks- Reach-Critical-Level.html Accessed April 7, 2020 Ref-04. Kim, Allen. In the last 10 months, 140 local governments, police stations and hospitals have been held hostage by ransomware attacks. CNN, October 8, 2019 https://www.cnn.com/2019/10/08/business/ransomware-attacks- trnd/index.html Accessed April 7, 2020 Ref-05. Patterson, Dan. Four U.S. cities attacked by ransomware this month. CBS News, December 17, 2019 https://www.cbsnews.com/news/ransomware-attack-pensacola- florida-4-u-s-cities-attacked-by-ransomware-this-month-2019-12-17/ Accessed April 15, 2020 Ref-06. Ng, Alfred. Ransomware froze more cities in 2019. Next year is a toss- up. CNET, December 5, 2019 https://www.cnet.com/news/ransomware-devastated-cities-in-2019- officials-hope-to-stop-a-repeat-in-2020/ Accessed April 15, 2020 Cybersecurity Strategies for Cities in Ventura County 11 Ref-07. Freed, Benjamin. Ransomware Attacks Map chronicles a growing threat. Statescoop, October 22, 2019 https://statescoop.com/ransomware-attacks-map-state-local- government/ Accessed April 15, 2020 Ref-08. Whitnall, Becca. City’s online payment system falls victim to hackers. Thousand Oaks Acorn, November 8, 2018 https://www.toacorn.com/articles/citys-online-payment-system-falls- victim-to-hackers/ Accessed April 15, 2020 Ref-09. CISA. Security Tip (ST08-001) Using Caution with USB Drives. November 15, 2019 https://www.us-cert.gov/ncas/tips/ST08-001 Accessed April 15, 2020 Ref-10. Lohrmann, Dan. 2019: The Year Ransomware Targeted State & Local Governments. Government Technology, December 23, 2019 https://www.govtech.com/blogs/lohrmann-on-cybersecurity/2019-the- year-ransomware-targeted-state--local-governments.html Accessed April 15, 2020 Ref-11. Ropek, Lucas. Pensacola Hires Deloitte to Investigate Extent of Cyberattack. Government Technology, December 19, 2019 https://www.govtech.com/security/Pensacola-Hires-Deloitte-to- Investigate-Extent-of-Cyberattack.html Accessed April 15, 2020 Ref-12. Ikeda, Scott. Ransomware Attacks Are Causing Cyber Insurance Rates to Go Through the Roof; Premiums up as Much as 25 Percent. CPO Magazine, February 10, 2020 https://www.cpomagazine.com/cyber-security/ransomware-attacks- are-causing-cyber-insurance-rates-to-go-through-the-roof-premiums- up-as-much-as-25-percent/ Accessed April 15, 2020 Ref-13. IBM. IBM Security Study: Taxpayers Oppose Local Governments Paying Hackers in Ransomware Attacks. September 5, 2019 https://newsroom.ibm.com/2019-09-05-IBM-Security-Study- Taxpayers-Oppose-Local-Governments-Paying-Hackers-in- Ransomware-Attacks Accessed April 15, 2020 12 Cybersecurity Strategies for Cities in Ventura County Ref-14. U.S. Department of Commerce, National Institute of Standards and Technology. Cybersecurity Framework, The Five Functions https://www.nist.gov/cyberframework/online-learning/five-functions Accessed April 17, 2020 Ref-15. California Public Records Act Government Code Section 6254.19 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sec tionNum=6254.19&lawCode=GOV Accessed April 17, 2020 Ref-16. California Cyber Security Integration Center. CYBERSECURITY ADVISORY Teleworking Quick Reference Guide. March 13, 2020 https://www.caloes.ca.gov/LawEnforcementSite/Documents/Cal- CSIC_Advisory_Teleworking%20Guidance.pdf Accessed April 17, 2020 Ref-17. Registration List. 2019 MISAC Annual Conference https://www.misac.org/events/RSVPlist.aspx?id=1243109 Accessed April 17, 2020 Ref-18. Vendors. 2019 MISAC Annual Conference https://www.misac.org/page/VendorConfInfo2019 Accessed April 17, 2020 Ref-19. CIS. MS-ISAC Local Governments https://www.cisecurity.org/partners-local-government/ Accessed April 17, 2020 Ref-20. California Lutheran University. Cal Lutheran starts cybersecurity program. September 20,2019 https://www.callutheran.edu/news/story.html?id=13865#story Accessed April 17, 2020 Ref-21. California State University Channel Islands. Computer Science Program - BS Information Technology https://compsci.csuci.edu/degrees/bsit.htm Accessed April 17, 2020 Ref-22. California State University Channel Islands. Computer Science Program - Internships https://compsci.csuci.edu/resources/internships.htm Accessed April 17, 2020 Ref-23. Moorpark College. Computer Science Curriculum https://www.moorparkcollege.edu/faculty-and-staff/curriculum- committee/course-outlines-of-record/computer-science-curriculum Accessed April 17, 2020 Cybersecurity Strategies for Cities in Ventura County 13 Ref-24. MISAC. MISAC’s New Security Committee Up and Running. July 6, 2018 https://www.misac.org/news/407088/MISACs-New-Security- Committee-Up-and-Running.htm Accessed April 17, 2020 Ref-25. Newcome, Tod. Cyber Insurance Evolves to Meet the Ransomware Threat. Government Technology, October/November 2019 https://www.govtech.com/security/Cyberinsurance-Evolves-to-Meet- the-Ransomware-Threat.html Accessed April 17, 2020 Ref-26. Thompson, Lisa. Cybersecurity Best Practices for Municipalities. New Hampshire Municipal Association, August 2019 https://www.nhmunicipal.org/town-city-article/cybersecurity-best- practices-municipalities Accessed April 7, 2020 14 Cybersecurity Strategies for Cities in Ventura County Glossary TERM DEFINITION Attacker Any individual or organization who attempts to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset. Big Data A field that treats ways to analyze, systematically extract information from or otherwise deal with data sets that are too large or complex to be dealt with by traditional data-processing application software. Bitcoin(s) A decentralized digital currency without a central bank or single administrator that can be sent from user to user on the peer-to-peer bitcoin network without the need for intermediaries. CIS Center for Internet Security CISA Cybersecurity and Infrastructure Security Agency Cities The 10 incorporated cities in the County County Ventura County Cyberattack Any type of offensive maneuver that targets computer information systems, infrastructures, computer networks, or personal computer devices. Cybersecurity The protection of computer systems and networks from the theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide. DHS Department of Homeland Security Encrypt The process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot. FedRAMP The Federal Risk and Authorization Management Program. A U.S. government-wide program that provides a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services. FedRAMP The California administered FedRAMP Moderate Cybersecurity Strategies for Cities in Ventura County 15 Grand Jury 2019-2020 Ventura County Grand Jury HTTPS Hypertext Transfer Protocol Secure IT The use of computers to store, retrieve, transmit and (Information manipulate data information. Typically used within the Technology) context of business operations as opposed to personal or entertainment technologies. All hardware, software and peripheral equipment operated by a limited group of users, as in “IT Department.” Malware Any software intentionally designed to cause damage to a computer, server, client, or computer network. By contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug. A wide variety of malware exists, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware. MISAC The Municipal Information Systems Association of California MS-ISAC Multi State Information Sharing and Analysis Center NIST National Institute for Standards and Technology (U.S. Department of Commerce) NSF National Science Foundation (administers SFS) Server A computer that provides data to other computers. SFS CyberCorps Scholarships for Service SLTT State, Local, Tribal and Territorial Governments; includes special districts (e.g. Libraries, airports, water districts, harbors, etc.) USB Drive A data storage device that includes flash memory with an integrated USB interface. It is typically removable and rewritable. URL Colloquially termed a “web address,” is a reference to a web resource that specifies its location on a computer network and a mechanism for retrieving it. A URL (Uniform Resource Locator) is a specific type of Uniform Resource Identifier (URI), although many people use the two terms interchangeably. Cybersecurity Strategies for Cities in Ventura County Appendices A Compilation of Best Practices from Authoritative Sources Cybersecurity Resources City Budgets Federal Government Cybersecurity Recommendations for SLTTs State of the Art Platforms and Tools Cybersecurity Strategies for Cities in Ventura County 17

Findings and recommendations not yet extracted.

Findings & Recommendations 32 findings
F01: In 1990, the federal government indicted a farmer in Somis for extortion and slavery of more than 300 farmworkers from Mexico. This was reported as the first identified case of human trafficking in the County. (Ref-17) Human Trafficking in Ventura County 5
F02: In 2018, California accounted for 1,656 (15%) of the human trafficking cases reported to the National Human Trafficking Hotline, significantly more than any other state. (Ref-18)
F03: The US 101 corridor between Los Angeles and San Francisco through the County is both a transit route for trafficking and a destination due to its large population, proximity to Mexico, significant immigrant population and easy access to transportation. (Ref-17)
F04: According to the VCSO, victims are bought and sold in motels and hotels lining the US 101 corridor through advertising on the internet. (Ref-17)
F05: VCCAHT has documented cases of both sex trafficking and labor trafficking. Victims have been male and female, adults and children, citizens and undocumented people of many ethnicities. (Ref-01)
F06: A survey conducted by VCCAHT of nine government and nonprofit organizations and agencies identified 57 human trafficking victims from January 2014 to April 2016 in the County. (Ref-01)
F07: In January 2016, the City of Ventura Police Department conducted a “demand” operation by posting a fictitious online ad offering sex for sale. The ad received over 100 responses in just under eight hours. People responding to the ad were told the person for sale was a minor. Officers made four arrests. (Ref-19)
F08: In April 2016, a “demand” operation conducted by the Oxnard Police Department received responses from 109 potential purchasers, resulting in 14 arrests. (Ref-19)
F09: Between January 26, 2020 and February 1, 2020, over 70 federal, state and local law enforcement agencies and community organizations participated in “Operation Reclaim and Rebuild,” a crackdown on sex trafficking. This statewide operation resulted in 76 adult and 11 minor victims being recovered, 266 males arrested for the charge of solicitation and 27 suspected traffickers arrested. (Ref-20)
F10: In January 2020, VCSO, Interface and Forever Found participated in “Operation Reclaim and Rebuild” that resulted in four victims contacted and two other individuals arrested in the County. (Ref-12)
F11: Many victims of human trafficking do not self-identify as victims. (Ref-17) 6 Human Trafficking in Ventura County
F12: Victims, particularly international victims, frequently refuse to cooperate due to their common distrust of people they perceive to be in powerful positions and/or retaliation from their trafficker. (Ref-04, Ref-17)
F13: Human trafficking is significantly underreported. (Ref-21)
F14: The number of human trafficking victims receiving assistance in the County during the identified years was as follows: Year Number 2014-2015 6 2016 10 2017 21 2018 24 2019 12 Total 73 (Ref-17)
F15: Of these 73 human trafficking victims receiving assistance between 2014 and 2019, 69 were adults and four were youths; 47 were sex trafficking victims, five were labor trafficking victims and 21 were victims of sex/labor trafficking. (Ref-17)
F16: The VCSO and VCDA state that enforcement of human trafficking laws and ordinances is complicated and expensive. (Ref-12, Ref-22)
F17: In 2019, the County, through VCSO, applied for and received an $800,000 grant over three years from BJA to form the Task Force. (Ref- 17, Ref-23)
F18: The members of the Task Force include: Local Law Enforcement: All police departments in the County, VCSO, the Ventura County Probation Department and the California Highway Patrol Federal Law Enforcement: Federal Bureau of Investigation and Homeland Security Investigations Prosecution: VCDA, the California Attorney General and the United States Attorney’s Office Human Trafficking Victim Service Providers: Interface, VCCFS, Forever Found and VCCAHT Regulatory Agencies: Ventura County Agricultural Commissioner and the United States Department of Labor Human Trafficking in Ventura County 7 Other Key Partners: Assembly member Jacqui Irwin, MICOP and the Polaris Project (Ref-24)
F19: In its efforts to coordinate governmental agencies and nonprofit organizations in the County, the Task Force states it will take the following actions: Law Enforcement and Prosecution  Develop protocols for the investigation, arrest and prosecution of human traffickers and purchasers  In the second and third years of the grant, conduct short- and long-term investigations and other covert procedures using and refining protocols Victim Services  Develop victim-centered and trauma-informed protocols for human trafficking victims  Develop screening and victim service referrals and facilitate the use of victim service protocols  Create a plan for conducting proactive victim-centered investigations of labor and sex trafficking in collaboration with law enforcement Professional Training and Community Outreach  Develop a plan for professional training regarding human trafficking and protocols for raising public awareness and community outreach  Develop training videos and conduct training for investigators, patrol officers and those most likely to interact with human trafficking victims Data Collection  Develop protocols for data collection and analysis as well as data sharing and confidentiality Sustainability  Develop a plan to assess the Task Force’s performance  Develop a plan to address sustaining the Task Force’s operations, investigations and victim services after federal funding ends (Ref- 24) 8 Human Trafficking in Ventura County
F20: In coordination with the Task Force, Interface applied for and received a $900,000 grant over three years from BJA to provide victim services to the Task Force and provide training and community outreach across the County. (Ref-25)
F21: In conjunction with the Task Force, Interface states it will provide the following victim services, directly or indirectly:  Case management  Child care  Client intake, client orientation and life skills  Housing, clothing, food and basic necessities  Crisis intervention and 24-hour response  Assistance in obtaining or replacing necessary documents  Education, family support and reunification  Interpreter and translator services  Legal, medical, dental and mental health care services  System-based victim advocacy (Ref-26)
F22: Some massage parlors operate as illicit sex businesses. (Ref-27)
Related Recommendations (1)
R02: The Grand Jury recommends the Environmental Health Division of the Ventura County Resource Management Agency or other appropriate County agency designate at least one employee to coordinate the investigation(s) and enforcement of the ordinances regarding massage parlors. (C-05)
F23: Ordinances regarding massage parlors differ among the County and the cities within the County. (Ref-17)
Related Recommendations (1)
R01: The Grand Jury recommends the County and each of the cities within the County coordinate their respective ordinances regarding massage parlors through the efforts of the Task Force. (C-03, C-04)
F24: The Task Force is currently developing a model ordinance that is intended to help curb illicit massage parlors and proposes to have that or a similar ordinance adopted by the County and all the cities within the County. (Ref-12)
F25: California State University Channel Islands established the Center for Community Engagement (CCE) providing service-learning projects for students. These projects provide partnerships with nonprofit organizations and governmental agencies in the County, and may include translation, outreach activities, event organizing, advocacy, research and report writing, data analysis and computer work. (Ref-28)
Related Recommendations (1)
R03: The Grand Jury recommends the Task Force contact CCE to determine if there is a partnership arrangement that will benefit the efforts of the Task Force. (C-06)
F26: Twenty thousand indigenous Oaxacan people, the majority being Mixtecs from Southern Mexico, work primarily as agricultural laborers in the County. The Mixtec community is culturally and linguistically isolated. Many speak only their native Mixteco, which is not a written language. (Ref-29) Human Trafficking in Ventura County 9
Related Recommendations (1)
R04: The Grand Jury recommends, as part of the Task Force’s community outreach efforts, it include culturally appropriate outreach methods, including radio broadcasts, attendance at community meetings, cultural festivals and health fairs, as well as audio/visual media and illustrated pamphlets to reach the indigenous population in the County. (C-07)
F27: In the interviews with advocates for indigenous farm laborers in the County, all emphasized the need for more trilingual (Mixteco, Spanish and English) “trusted messengers” as part of the efforts to combat human trafficking in the County. (Ref-30)
Related Recommendations (1)
R04: The Grand Jury recommends, as part of the Task Force’s community outreach efforts, it include culturally appropriate outreach methods, including radio broadcasts, attendance at community meetings, cultural festivals and health fairs, as well as audio/visual media and illustrated pamphlets to reach the indigenous population in the County. (C-07)
F28: Many victims of sex trafficking in the County are from China and Taiwan. (Ref-27)
Related Recommendations (1)
R05: The Grand Jury recommends VCDA make available human trafficking posters in simplified Chinese as well as traditional Chinese. (C-08, C-09) Human Trafficking in Ventura County 11 Responses Responses Required From: City Council, City of Camarillo (C-03, C-04) (R-01) City Council, City of Fillmore (C-03, C-04) (R-01) City Council, City of Moorpark (C-03, C-04) (R-01) City Council, City of Ojai (C-03, C-04) (R-01) City Council, City of Oxnard (C-03, C-04) (R-01) City Council, City of Port Hueneme (C-03, C-04) (R-01) City Council, City of Santa Paula (C-03, C-04) (R-01) City Council, City of Simi Valley (C-03, C-04) (R-01) City Council, City of Thousand Oaks (C-03, C-04) (R-01) City Council, City of Ventura (C-03, C-04) (R-01) Ventura County Board of Supervisors (C-03, C-04) (R-01) Responses Requested From: Environmental Health Division of the Ventura County Resource Management Agency (C-05) (R-02) Ventura County Human Trafficking Task Force (C-06, C-07) (R-03, R-04) Ventura County District Attorney (C-08, C-09) (R-05)
F29: Individuals from China read “simplified Chinese,” while individuals from Taiwan read “traditional Chinese.” These two forms of written Chinese use different characters. (Ref-31)
Related Recommendations (1)
R05: The Grand Jury recommends VCDA make available human trafficking posters in simplified Chinese as well as traditional Chinese. (C-08, C-09) Human Trafficking in Ventura County 11 Responses Responses Required From: City Council, City of Camarillo (C-03, C-04) (R-01) City Council, City of Fillmore (C-03, C-04) (R-01) City Council, City of Moorpark (C-03, C-04) (R-01) City Council, City of Ojai (C-03, C-04) (R-01) City Council, City of Oxnard (C-03, C-04) (R-01) City Council, City of Port Hueneme (C-03, C-04) (R-01) City Council, City of Santa Paula (C-03, C-04) (R-01) City Council, City of Simi Valley (C-03, C-04) (R-01) City Council, City of Thousand Oaks (C-03, C-04) (R-01) City Council, City of Ventura (C-03, C-04) (R-01) Ventura County Board of Supervisors (C-03, C-04) (R-01) Responses Requested From: Environmental Health Division of the Ventura County Resource Management Agency (C-05) (R-02) Ventura County Human Trafficking Task Force (C-06, C-07) (R-03, R-04) Ventura County District Attorney (C-08, C-09) (R-05)
F30: California SB 1193 requires posters with human trafficking hotline numbers to be displayed in several categories of public places and businesses. (Ref-11)
F31: VCDA has human trafficking posters in English, Spanish and traditional Chinese available for download from its website. (Ref-32)
F32: The State of California Department of Justice, Attorney General’s Office, has human trafficking posters in simplified and traditional Chinese available for download from its website. (Ref-33) Conclusions C-01. The Grand Jury concluded that both human trafficking in sex and labor exists in the County. (FA-01, FA-02, FA-03, FA-04, FA-05,
Findings & Recommendations 5 findings
F01: Charter schools in the County utilize a variety of procedures to formulate their legally required reports to their authorizing district. Charter school authorizers reported that the following formats are utilized:  The California Charter School Annual Oversight Check List-FCMAT (Ref-14)  VCOE Charter School Reporting Timeline (App-01) Oversight of Ventura County Charter Schools 3
F02: Two charter school authorizers in the County reported during interviews the importance of having a representative from the district included on their respective charter school’s governing board.
F03: Six of the 12 County authorized charter schools do not have a representative from their authorizing districts or VCOE on their governing board. (Ref-15)
F04: Charter school authorizers reported during interviews that VCOE does not provide training to district school authorizers but will provide assistance when requested.
F05: A representative of VCOE stated that VCOE has provided training seminars and workshops to charter school staff. Conclusions C-01. The Grand Jury concluded that, while the authorizing districts in the County and VCOE are following state law in reporting fiscal and administrative information, there is a lack of consistency in report monitoring and oversight of charter schools. (FA-01) C-02. The Grand Jury concluded that, while VCOE is providing training opportunities to charter school staff, no training is being offered to the authorizing school districts. (FA-04, FA-05) C-03. The Grand Jury concluded that best practice guidelines for monitoring charter schools by authorizing school districts have been developed by FCMAT and VCOE. These guidelines have not been adopted by all County authorizing districts. (FA-01) C-04. The Grand Jury concluded that a benefit would accrue to each charter school’s operations by having an official representative of the authorizing district or VCOE on its governing board. (FA-02, FA-03) Recommendations R-01. The Grand Jury recommends that VCOE, in conjunction with charter schools and district authorizers, collaborate to review and enhance the current VCOE oversight checklist/timeline utilizing the FCMAT suggested guidelines for oversight. (C-01, C-03) R-02. The Grand Jury recommends that VCOE, in conjunction with charter schools and authorizing districts, develop a consistent, comprehensive and regularly scheduled oversight process for all County charter schools. (C-01, C-03) 4 Oversight of Ventura County Charter Schools R-03. The Grand Jury recommends that VCOE periodically conduct meetings to be attended by all charter school authorizers in the County. These meetings are to collaborate and provide training, review new education legislation, share best practices and highlight successes. (C-02) R-04. The Grand Jury recommends that each existing charter school’s governing board have at least one official representative from the authorizing district or VCOE. (C-04) R-05. The Grand Jury recommends that charter school authorizing entities within the County require future charter school petitions for authorization to include an agreement that the charter school will have a representative from the authorizing school district and/or VCOE on its governing board. (C-04) Responses Responses Required From: Ventura County Office of Education (C-01, C-02, C-03, C-04) (R-01, R-02, R-03, R-04, R-05) Oxnard Union High School District (C-01, C-02, C-03, C-04) (R-01, R-02, R-04, R-05) Mesa Union School District (C-01, C-02, C-03, C-04) (R-01, R-02, R-04, R-05) Moorpark Unified School District (C-01, C-02, C-03, C-04) (R-01, R-02, R-04, R-05) Ojai Unified School District (C-01, C-02, C-03, C-04) (R-01, R-02, R-04, R-05) Pleasant Valley School District (C-01, C-02, C-03, C-04) (R-01, R-02, R-04, R-05) Responses Requested From: Meadows Arts and Technology Elementary School (MATES) (C-04) (R-01, R-04, R-05) River Oaks Academy (C-04) (R-01, R-04, R-05) Ventura Charter School of Arts and Global Education (C-04) (R-01, R-04, R-05) Vista Real Charter High School (C-04) (R-01, R-04, R-05) Golden Valley Charter School (C-04) (R-01, R-04, R-05) Ivy Tech Charter School (C-04) (R-01, R-04, R-05) Valley Oak Charter School (C-04) (R-01, R-04, R-05) Oversight of Ventura County Charter Schools 5 Architecture, Construction and Engineering (ACE) Charter High School (C-04) (R-01, R-04, R-05) Camarillo Academy of Progressive Education (CAPE) (C-04) (R-01, R-04, R-05) University Preparation Charter School at CSU at Channel Islands (C-04) (R-01, R-04, R-05) PEAK Prep Pleasant Valley (C-04) (R-01, R-04, R-05) Bridges Charter School (C-04) (R-01, R-04, R-05) References Ref-01. Charter School Act of 1992 https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCo de=EDC&division=4.&title=2.&part=26.8.&chapter=1.&article= Accessed April 1, 2020 Ref-02. Ventura County Office of Education. Charter Schools>Charter Schools in Ventura County https://www.vcoe.org/Charter-Schools/Charter-Schools-in-Ventura- County Accessed April 1, 2020 Ref-03. Zinshteyn, Mikhail. Understanding California Charter Schools: A Quick Guide. EdSource, July 20, 2017 https://edsource.org/2017/10-things-to-know-about-charter- schools/583984 Accessed April 1, 2020 Ref-04. California Department of Education. Charter Schools CalEdFacts- CalEdFacts-CalEdFacts. April 12, 2019 https://www.cde.ca.gov/sp/ch/cefcharterschools.asp Accessed April 1, 2020 Ref-05. Legislative Analyst’s Office. Overview of Charter Schools in California. March 12, 2019 https://lao.ca.gov/handouts/education/2019/Charter-School-Overview- 031219.pdf Accessed April 1, 2020 Ref-06. Lambert, Diana. California Charter Schools Facing New Oversight Under Fast Track Legislation. EdSource, February 21, 2019 https://edsource.org/2019/california-charter-schools-facing-new- oversight-under-fast-track-legislation/608963 Accessed April 1, 2020 6 Oversight of Ventura County Charter Schools Ref-07. LA Times Investigates California Charter School Oversight. NPR Morning Edition, April 5, 2019 https://www.npr.org/2019/04/05/710169500/la-times-investigates- california-charter-school-oversight Accessed April 1, 2020 Ref-08. Cano, Ricardo. How a tiny California District sparked calls for a charter crackdown. CALmatters.org, April 8, 2019 https://calmatters.org/education/2019/04/charter-schools-california- far-flung-loophole-acton-newhall/ Accessed April 1, 2020 Ref-09. California Teachers Association. Assemblymembers O’Donnell, Mc Carty, Smith, Bonta, Joined by Educators, Administrators, School Boards, and Labor Partners, Intro Bills to Fix Broken Laws Governing Charter Schools, Hurting Students. February 25, 2019 https://www.cta.org/About-CTA/News-Room/Press- Releases/2019/02/02252019.aspx Accessed April 1, 2020 Ref-10. Fensterwald, John. Proposed Legislation Would Substantially Curb Growth of California Charter Schools. EdSource, February 26, 2019 https://edsource.org/2019/proposed-legislation-would-substantially- curb-growth-of-california-charter-schools/609087 Accessed April 1, 2020 Ref-11. Cano, Ricardo. With New CA Charter School Rules Official, Here’s the Latest on Incoming K-12 Laws. North Coast Journal of Politics, People & Art, October 4, 2019 https://www.northcoastjournal.com/NewsBlog/archives/2019/10/04/wit h-new-ca-charter-school-rules-official-heres-the-latest-on-incoming-k- 12-laws Accessed April 1, 2020 Ref-12. California AB 1505 https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=2019 20200AB1505 Accessed April 1, 2020 Ref-13. California AB 1507 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201 920200AB1507Accessed April 1, 2020 Oversight of Ventura County Charter Schools 7 Ref-14. Charter School Annual Oversight Checklist. Fiscal Crisis & Management Assistance Team, California School Information Services, March 2016 https://www.fcmat.org/PublicationsReports/Charter-School-Annual- Oversight-Checklist-revised-final-3-17-2016.pdf Accessed April 1, 2020 Ref-15. Ventura County Charter Schools http://www.matescharter.org/ http://www.riveroakscharter.com/ https://www.venturacharterschool.org/ http://vrchs.org/governing-board/ http://www.goldenvcs.org/ http://valleyoakcharter.org/index.html http://www.ivytechcharterschool.org/ https://www.acecharterhigh.org/ http://www.camarillocharter.org/ https://universitycharterschools.csuci.edu/Page/7 https://peak.virtualpreparatoryacademy.com/ https://www.bridgescharter.org/ Accessed April 1, 2020 Attachments Att-01. VCOE Charter School Reporting Timeline 8 Oversight of Ventura County Charter Schools Glossary TERM DEFINITION Authorizing A district that approves applications to open new district charter schools, monitors existing charter schools and decides to renew or close charter schools. Charter school Ventura County charter school Charter schools VCOE and authorizing districts authorizers County Ventura County FCMAT Fiscal Crisis Management Assistance Attachment 01 VCOE Charter School Reporting Timeline 10 Oversight of Ventura County Charter Schools Oversight of Ventura County Charter Schools 11 This page intentionally blank 12 Oversight of Ventura County Charter Schools
Findings & Recommendations 8 findings
F01: Required Charter Schools must comply with the requirements of AB 329 and AB 1227. (Ref-01, Ref-02, Ref-03) Charter School Implementation of 3
F02: Five of the Required Charter Schools have implemented policies and procedures in keeping with AB 329. At the time of the survey, the governing boards of two of the schools were in the process of developing and approving a set of policies and procedures.
F03: Nine of the Required Charter Schools have a curriculum that meets the requirements of AB 329, but only three are introducing information concerning human trafficking as required by AB 1227.
F04: Three Required Charter Schools give notice to parents that no academic penalty will be imposed and that an alternative curriculum will be provided to a student whose parent/guardian opts their child out of the curriculum on sexual health and human trafficking.
F05: One of the Required Charter Schools provided information to the parents/guardians that their child could be excused from participation in part of the curriculum on sexual health and human trafficking, while participating in the rest of the curriculum.
F06: All Required Charter Schools provide the sexual health and human trafficking curriculum opt out notification to parents/guardians and the opportunity to review the curriculum prior to child participation.
F07: Two of the Required Charter Schools providing the sexual health and human trafficking curriculum opt out notification to parents/guardians, also provide an easily signed and returned form for a child to be excused.
F08: One of the Required Charter Schools gave notice that surveys of sexual behaviors by students may be taken and the opportunity for parents/guardians to excuse their child from participation in the survey by written submittal. Conclusions C-01. The Grand Jury concluded that none of the Required Charter Schools fully implemented the requirements of AB 329 and AB 1227. (FA-01,
Findings & Recommendations 32 findings
F01: Each county in the State is obligated to provide medical services to its citizens who cannot financially provide for their own medical care, or are incompetent to do so, and whose family, or a State or private hospital, is not doing so (Safety Net Population). (Ref-07)
F02: The Board has established an enterprise fund, known as the Ventura County Medical Center, to provide health care services.(Ref-08)
F03: The County delivers medical services to the Safety Net Population through the Medical Center which is composed of two hospitals and 28 clinics. The majority of the Medical Center’s patients are participants in Medi-Cal. (Ref-09)
F04: The State enterprise fund authorization statute defines an enterprise fund as a fund which accounts for services furnished to the general public and is financed primarily by charges for such services. Each board of supervisors is required to make available such amounts as are necessary to establish each enterprise fund and to maintain the fund’s financial viability. (Ref-10)
F05: The General Fund is used to account for all revenues and expenditures necessary to carry out basic governmental activities of the County that are not accounted for through other funds. (Ref-11, Ref-12) Financial Relationship Between the Medical Center 3 2019–2020 Ventura County Grand Jury Final Report
F06: The County is required to account for the Medical Center as an enterprise fund, separate from the General Fund. (Ref-13)
F07: Reciprocal interfund activity represents assets transferred between a county’s general fund and its enterprise funds with a requirement for repayment. Nonreciprocal interfund activity represents assets transferred between a county’s general fund and its enterprise funds without a requirement for repayment. (Ref-14)
F08: The CAFR does not characterize these interfund transfers as either reciprocal or nonreciprocal. (Ref-15)
F09: Periodically the General Fund provided, as required, interfund transfers to the Medical Center to meet its cash requirements. (Ref-01)
F10: The Board has not assessed interest on these interfund transfers, nor has there been any repayment schedule established. (Ref-01, Ref-02, Ref-03)
Related Recommendations (1)
R02: The Grand Jury recommends the Board not refer to the General Fund transfers to the Medical Center as “loans” rather than “advances.” (C-03, C-04, C-05)
F11: The Board, the Medical Center and the relevant County agencies have referred to these unreturned interfund transfers to the Medical Center as “loans.” (Ref-01, Ref-02, Ref-03)
Related Recommendations (1)
R02: The Grand Jury recommends the Board not refer to the General Fund transfers to the Medical Center as “loans” rather than “advances.” (C-03, C-04, C-05)
F12: The definition of “loan” in the Merriam Webster, Cambridge and Investopedia online dictionaries all provide that, as to money, it is something that is furnished to be returned with interest. (Ref-16, Ref-17, Ref-18)
Related Recommendations (1)
R02: The Grand Jury recommends the Board not refer to the General Fund transfers to the Medical Center as “loans” rather than “advances.” (C-03, C-04, C-05)
F13: The CAFR states that “[t]he General Fund extends long-term advances, when needed, for cash flow purposes, to funds outside the General Fund that receive funding on a reimbursement basis. Repayment is expected when available cash is in excess of that needed for operations.” (emphasis added) (Ref-19)
Related Recommendations (1)
R02: The Grand Jury recommends the Board not refer to the General Fund transfers to the Medical Center as “loans” rather than “advances.” (C-03, C-04, C-05)
F14: When the Medical Center had cash in excess of that needed for operations, the Medical Center has returned funds to the General Fund.(Ref-19) (Att-03)
F15: At Board meetings the outstanding balance of the funds provided by the General Fund to the Medical Center have been the subject of exchanges among Board members. (Ref-01, Ref-02, Ref-03)
F16: During the public comment session of a Board meeting, a speaker asked why unrepaid advances do not bear interest and why there is no repayment schedule. In raising that issue they asserted that “… no lending agency in the world would offer loans with those terms [no interest and no required repayment].” (Ref-01) 4 Financial Relationship Between the Medical Center 2019-2020 Ventura County Grand Jury Final Report
F17: On July 31, 2019 the Ventura County Star published an article reporting these discussions at the Board meeting and referred to the above quote. (Ref-04) Consistency In Financial Projections
F18: The Ventura County Health Care Agency (VCHCA) operates the Medical Center.(Ref-20)
F19: At the August 7, 2019 meeting of the Medical Center Oversight Committee, VCHCA reported it now estimated a $6 million profit. Earlier it had estimated a $19.2 million loss for the fiscal year ending June 30, 2019.
F20: After the above meeting, the Auditor-Controller’s Office said this projection included payments due from the State from prior years which have nothing to do with (financial) operations this last fiscal year. “I would venture to guess if you took out these one-time dollars, the hospital broke even or still had an operating loss.”
F21: On August 10, 2019 an article in the Ventura County Star published the above statements of both VCHCA and the Auditor-Controller’s Office. (Ref-21) There were no prior discussions between the Medical Center or VCHCA and the Auditor-Controller’s Office with respect to the financial projections referenced above.
F22: Board policies exist which require the review by or with the Auditor- Controller’s Office with respect to certain matters, including but not limited to: 1. Requests for an item to be placed on the Board agenda that has a fiscal impact (Ref-22) 2. Rates and fees to be charged for services by an enterprise fund in the budget process (Ref-23) 3. Revenue projections that will not meet budgeted sums (Ref-23)
F23: No written policy exists requiring an enterprise fund representative to involve the Auditor-Controller’s Office before making public statements as to the financial performance of that fund. Financial Relationship Between the Medical Center 5 2019–2020 Ventura County Grand Jury Final Report Efforts of the Medical Center to Collect Medi-Cal Incentive Program Funds
Related Recommendations (1)
R03: The Grand Jury recommends the Board adopt a written policy/procedure requiring an enterprise fund, such as the Medical Center, to consult with the Auditor-Controller’s Office before public disclosure of any projected financial information. (C-06) Responses Responses Required From: Ventura County Auditor-Controller (C-01, C-02, C-03, C-04, C-05, C-06) (R-01,
F24: Approximately 75% of the patients treated by the Medical Center are Medi-Cal patients.
F25: Medi-Cal does not fully compensate the Medical Center for the direct cost of services provided. (Ref-24)
F26: The Medical Center receives additional payments through various Medi-Cal incentive programs. While some of these Medi-Cal incentive programs make payments on a formula basis, others make payments from a pool of funds where a particular hospital’s entitlement is based on its comparative performance with respect to other participating public hospitals. (Ref-24)
F27: The Medical Center has submitted extensive paperwork in connection with its efforts to obtain payment under these Medi-Cal incentive programs.
F28: The final amount to be received by the Medical Center under those programs cannot be calculated or paid until all audits of public hospitals in the State have been completed and all appeals have been resolved.
F29: As of January 31, 2020 the sum calculated by the Medical Center to be paid to it by the State under the Medi-Cal incentive programs was $215 million. Some of these funds are due from as early as the end of the 2008 fiscal year. (Att-02)
F30: VCHCA has made numerous attempts to expedite payment from the State of the amounts to be paid to the Medical Center, including a meeting in Sacramento in an attempt to obtain a payment of at least $50 million. VCHCA received a letter from the California Department of Health Care Services that it expects some of the funds from these programs would be received by the end of fiscal year 2020. (Att-01)
F31: From June 30, 2014 to June 30, 2019, the amount of the advances from the General Fund to the Medical Center increased from $18.6 million to $125.5 million. At January 31, 2020, the outstanding balance was $117 million. (Ref-19, Ref-25) (Att-03)
F32: The Medical Center is a member of CAPH, comprised of the 26 California public hospitals and five University of California medical research hospitals. All are experiencing the same inability to obtain full payments due them from the State under these Medi-Cal incentive programs. Financial Relationship Between the Medical Center 2019-2020 Ventura County Grand Jury Final Report Conclusions C-01. The Grand Jury concluded the State’s lengthy process to make full payment of the amounts owed to the Medical Center under the Medi-Cal incentive programs has been the underlying factor in creating the need for advances from the General Fund. (FA-01, FA-02, FA-03, FA-04,

Findings and recommendations not yet extracted.