After Action Report Improvement Plan Courthouse Coercion A Workplace Protection Exercise Series November 13, 2015 / December 9, 2015 Taylor County Emergency Management Department 1 Page
ADMINISTRATIVE HANDLING INSTRUCTIONS 1. The title of this document is The "Courthouse Coercion - A Workplace Protection Exercise Series" After Action Report. 2. The information gathered in this AAR/IP is classified as For Official Use Only (FOUO) and should be handled as sensitive information not to be disclosed. This document should be safeguarded, handled, transmitted, and stored in accordance with appropriate security directives. 3. At a minimum, the attached materials will be disseminated only on a need-to-know basis and when unattended, will be stored in a locked container or area offering sufficient protection against theft, compromise, inadvertent access, and unauthorized disclosure. 4. Points of Contact: County Emergency Management: Steve Spradley Taylor County Emergency Management Department (Office) 850-838-3575 (E-Mail) stephen.spradley@taylorcountygov.com Exercise Director: Chris Floyd Disaster Resistant Communities Group LLC (Office) 859-241-3565 (E-Mail) chrisfloyd@drc-group.com 2 Page
CONTENTS ADMINISTRATIVE HANDLING INSTRUCTIONS... 2 CONTENTS... 3 EXECUTIVE SUMMARY... 4 SECTION 1: EXERCISE OVERVIEW... 5 Exercise Details... 5 Participant Information... 5 SECTION 2: EXERCISE DESIGN SUMMARY... 7 Exercise Purpose and Design... 7 Exercise Objectives, Capabilities and Activities... 7 Scenario Summary... 7 SECTION 3: ANALYSIS OF CAPABILITIES... 9 SECTION 4: CONCLUSION... 16 APPENDIX A: IMPROVEMENT PLAN... 17 APPENDIX B: PARTICIPANT FEEDBACK (Strengths Areas for Improvement)... 19 APPENDIX C: ACRONYMS... 26 3 Page
EXECUTIVE SUMMARY Courthouse Coercion - A Workplace Protection Exercise Series was designed and facilitated to assess the current capabilities of courthouse employees to respond to and recover from threatening situations within the County Courthouse. The purpose of this report is to analyze exercise results, identify strengths to be maintained and built upon, identify potential areas for further improvement, and support development of corrective actions. Incorporated in Section 3: Analysis of Capabilities of this After Action Report is a comprehensive listing of each Core Capability with its associated Major Strengths, Primary Areas for Improvement and Improvement Recommendations 4 Page
Exercise Details SECTION 1: EXERCISE OVERVIEW Exercise Name: Type of Exercise: Courthouse Coercion - A Workplace Protection Exercise Series Tabletop, Drill and Functional Exercise Start Date: November 13, 2015 and December 9, 2015 Duration: Location: Sponsor: Three Hours Perry, Florida Taylor County Emergency Management Department Purpose: The purpose of the series of exercises was to assess the current capabilities of courthouse employees to respond to and recovery from threatening situations within the County Courthouse. Scenario Types: Tabletop Exercise: Belligerent Tax Payer, Civil Disobedience, Suspicious Package and Hostage Taking Drill / Functional Exercise: Active Shooter Participant Information Participant Agency / Organization / Office Florida Court System - Second Judicial Circuit Florida Court System - Third Judicial Circuit Florida Department of Health in Taylor County Taylor County Administration Taylor County Clerk of the Courts Office Taylor County Emergency Management Department Taylor County Property Appraiser's Office Taylor County Sheriff's Office Taylor County Supervisor of Elections Office 5 Page
Number of Participants 80 Taylor County Tax Collector's Office 6 Page
SECTION 2: EXERCISE DESIGN SUMMARY Exercise Purpose and Design The purpose of the exercise was to assess the current capabilities of courthouse employees to respond to and recover from threatening situations within the County Courthouse. Exercise Objectives, Capabilities and Activities Capabilities-based planning allows for the exercise planning team to develop exercise objectives and observe exercise outcomes through a framework of specific action items that were derived from the list of Core Capabilities. The capabilities listed below form the foundation for the organization of all objectives and observations in this exercise. Additionally, each capability is linked to several corresponding activities and tasks to provide additional detail. Based upon the identified exercise objectives below, the exercise planning team decided to demonstrate the following capabilities during this exercise: On-Scene Security Protective Measures Activity Core Capability # 1 Coordinate and Manage On-Site Security # 2 Initiate and Manage Protective Measures Operations # 3 Identify and Coordinate Consequence Management Operations Scenario Summary Tabletop Exercise The exercise consisted of the following four scenario vignettes. Vignette # 1 - Belligerent Tax Payer Vignette # 2 - Civil Disobedience Vignette # 3 - Suspicious Package Vignette # 4 - Hostage Taking Drill / Functional Exercise Tuesday November 8, 2016 at 3:21PM. 7 Page
As the bitter divorce case of Tom and Sara Thomas continues to move through the court system both Tom and Sara are in the courtroom attending yet another hearing regarding the custody battle over their two young children. Members of both Tom and Sara s families are sitting in the courtroom gallery and standing in the hall just outside the courtroom. Tom s brother, John Thomas, was arrested for assault several weeks ago after he became extremely agitated and threatened several employees of the Clerk of the Courts Office when he was refused access to the divorce case records that had been temporarily sealed due to the child custody proceedings. Today s custody hearing has proceeded without any of the outbursts that have occurred during previous hearings and the Judge even comments that Tom and Sara appear to be ready for the custody battle and the divorce to be finalized. Originally there were two bailiffs assigned to the courtroom for this hearing however with the hearing proceeding in a calm and orderly fashion one of the bailiffs has gone downstairs to finalize his vacation plans with his supervisor. Unknown to anyone in the courthouse several of Tom s family members are able to sneak a handgun into the courthouse by passing the weapon through an opening in the courthouse lobby exit door as a large group of individuals were being screened at the security checkpoint at the other end of the lobby. Another of Tom s brothers, Robert, walked into the courtroom immediately shooting the bailiff and a number of Sara s family members who were sitting in the courtroom. Robert then abducted Sara and forcefully dragged her through the courtroom, down the hallway and into the stairwell. All along Robert is making threats to Sara s life and stating that he is not going to let her destroy his brother s life. 8 Page
SECTION 3: ANALYSIS OF CAPABILITIES On-Scene Security Protective Measures Tabletop Exercise Performance Adequate Core Capability Activity # 1: Coordinate and Manage On-Site Security Associated Critical Tasks Task # 1.1: Initiate and maintain inter-office / inter-agency coordination of On-Site Security. Adequate Evaluator # 1 Recommendations There was good discussion within each group. Coordination was adequate given the fast breaking events of the day. Communications between individuals and agencies within the facility proved to be a challenge. The facility does not have an effective method of notifying occupants of emergency situations. Continue discussion based exercises and seek funding to provide a shelter in place or intercom system. Task # 1.2: All Employees have a thorough working knowledge of current courthouse security and workforce protection procedures and guidelines. Adequate Evaluator # 1 The facility has a plan and competent Taylor County Sheriff s Office staff managing security. They were able to adapt to stresses on the system. They did not always have the same approach between the different groups; however, they were able to think on their feet and develop workable solutions to challenges. It was apparent that some facility staff are not fully aware of the procedures or their role in maintaining security. Recommendations Continue to review and test the courthouse procedures. Assure that all facility staff are aware of their role in assuring 9 Page
the facility remains secure. Performance Adequate Core Capability Activity # 2: Initiate and Manage Protective Measures Operations Associated Critical Tasks Task # 2.1: Implement surge capacity plans to increase on-site security and workforce protection when a threatening situation is observed. Adequate Evaluator # 1 Facility staff reached out to the appropriate agencies to beef up support. Recommendations None Task # 2.2: Initiate and maintain an Incident Management System to include liaisons from each of the offices and agencies housed within the courthouse. Needs Improvement Recommendations Evaluator # 1 ICS was not discussed. It was clear that all agencies were looking to Law Enforcement as the lead agency; however, discussion of command and command structures were not discussed. Continue ICS training to assure that the benefits of ICS are known and supported by all agencies. Performance Core Capability Adequate Activity # 3: Identify and Coordinate Consequence Management Operations Associated Critical Tasks Task # 3.1: Based on the threatening situation identify and prioritize the response and recovery activities that are associated with the situation. Adequate Evaluator # 1 10 Page
Recommendations Agencies were able to recognize threats and develop an adequate response. Coordination between agencies was very good. Continue to develop and improve plans so response activities are second nature. Task # 3.2: Develop an Incident Action Plan (IAP) that focuses on Consequence Management. Needs Improvement Evaluator # 1 This was not developed; however, given the type of play and time permitted, it is may be a high expectation to see this. Participants did think through response activities and did establish expectations during discussion. Recommendations ICS training would help this process. Drill / Functional Exercise Performance Adequate Core Capability Activity # 1: Coordinate and Manage On-Site Security Associated Critical Tasks Task # 1.1: Initiate and maintain inter-office / inter-agency coordination of On-Site Security. Adequate Evaluator # 1 Recommendations The group demonstrated a great ability to work together as a team to identify problems and solutions. Continue to work on notification procedures for lockdown to include a viable notifications tool. Continue to work together to develop plans / process for each individual office and develop a training and testing schedule. Strong Evaluator # 2 Good interaction and participation among all of the courthouse 11 Page
tenant agencies, both at the tabletop last month and the functional exercise. Individual constitutionals participated and trained their respective staff. Notification alert issues were identified and noted, but once the respective agencies received the threat notice they efficiently and effectively locked down and included the public visitors in their office as well! Overall there were good marks on responding to the emergency. Recommendations Utilize the benefits and interactions of the tabletop exercise and the drill / functional exercise to continue the good work and progress. Task # 1.2: All Employees have a thorough working knowledge of current courthouse security and workforce protection procedures and guidelines. Adequate Evaluator # 1 The group demonstrated a good working knowledge of the current security procedures. Recommendations Continue to improve the courthouse security plan and procedures to include the protection of the visiting public. Adequate Evaluator # 2 Recommendations The tabletop exercise and obvious discussion from the same, left me with the impression that the participants felt confident during emergency actions and seriously thought about the activity as well as the law enforcement response. The vault door did not open until the "all clear" communication came from verified responding personnel. Regular training, testing and exercising various portions of the plan. Individual training of all new employees within a short period of hire and annual refresher training. Performance Core Capability Adequate Activity # 2: Initiate and Manage Protective Measures Operations 12 Page
Associated Critical Tasks Task # 2.1: Implement surge capacity plans to increase on-site security and workforce protection when a threatening situation is observed. Adequate Evaluator # 1 The process for requesting additional resources was discussed by Incident Command. Recommendations None Strong Evaluator # 2 Recommendations Once the threat notice was communicated, the respective agencies quickly followed the existing security plan in place. Identify ways to improve dissemination of the alert. Some of the agencies utilized their internal phone system paging feature to broadcast an alert lock down, as well follow up all clear alerts to the basement. Task # 2.2: Initiate and maintain an Incident Management System to include liaisons from each of the offices and agencies housed within the courthouse. Adequate Evaluator #1 Recommendations Needs Improvement Recommendations ICS was utilized. It was well understood by the first responder agencies at Command. It was not well utilized by non-responder agencies. Continue efforts to familiarize non-response agencies on the benefits and use of the ICS structure. Evaluator # 2 There was little liaising between the ICS and the tenant agencies and between the tenant agencies with their respective tasks. Force the liaisons to interact with interjects tailored to their operational needs. Performance Core Capability 13 Page
Needs Improvement Activity # 3: Identify and Coordinate Consequence Management Operations Associated Critical Tasks Task # 3.1: Based on the threatening situation identify and prioritize the response and recovery activities that are associated with the situation. Adequate Evaluator # 1 The group utilized a well thought out process for recovery. They put together a well-designed recovery plan. Good coordination was demonstrated among the varying agencies. Recommendations None Needs Improvement Recommendations Evaluator # 2 Although the recovery and response activities identified and prioritized issues for the Supervisor of Elections during a national election time frame, there was little if any real interaction between the ICS and tenant agencies of the courthouse. For example, the interaction was mostly between the county and non-court offices rather than the court offices of the Public Defender, State s Attorney Clerk of the Courts Office and the Judge s Office. The courthouse could be theoretically re-opened before the court operations could fully resume due to the blood and gore clean up in the courtroom. The ICS discussed the same, but never broached with the court. Why? Do you really want to open the Taylor Courthouse without the court being totally operational? Provide ICS training to managers of all agencies housed in the courthouse. Develop Continuity of Operations Plans (COOP) for each agency housed in the courthouse. Task # 3.2: Develop an Incident Action Plan (IAP) that focuses on Consequence Management. Needs Evaluator # 1 14 Page
Improvement Recommendations Needs Improvement Recommendations They did not develop an IAP however, some of the discussions centered on many goals and objectives that could be found within a plan. Provide IAP training to the managers of the agencies and offices housed in the courthouse. Evaluator # 2 Emergency Action Planning (EAP) and COOP recovery planning seldom are discussed together, but this exercise identified the need for those discussions and preparations. I believe the participants eyes were opened during the exercise and these types of issues were partially identified. Continue planning and coordination meetings on a regular quarterly basis working through COOP issues and EAP issues that would enable the court operations to resume as quickly as possible, with testing and exercising on a regular basis. 15 Page
SECTION 4: CONCLUSION Exercises such as this one allow personnel to validate training and practice strategic and tactical prevention, protection, response and recovery capabilities in a risk-reduced environment. Exercises are the primary tool for assessing preparedness and identifying areas for improvement, while demonstrating community resolve to prepare for major incidents. Exercises aim to help entities within the community gain objective assessments of their capabilities so that gaps, deficiencies, and vulnerabilities are addressed prior to a real incident. Exercises are the most effective (and safer) means to: Assess and validate policies, plans, procedures, training, equipment, assumptions, and interagency agreements; Clarify roles and responsibilities; Improve interagency coordination and communications; Identify gaps in resources; Measure performance; and Identify opportunities for improvement. This exercise succeeded in addressing all of the above as it provided examples of good to excellent participant knowledge, teamwork, communication and use of plans and procedures while pointing out areas in need of improvement and clarification. Listed below is a summary of the level of performance the Core Capabilities and Tasks evaluated during the exercise. This summary outlines the areas in which exercise participants are strong as well as identifying areas that the departments should invest future planning, training and exercise funds on. On-Scene Security Protective Measures Activity Core Capability Performance # 1 Coordinate and Manage On-Site Security Adequate # 2 Initiate and Manage Protective Measures Operations Adequate # 3 Identify and Coordinate Consequence Management Operations Needs Improvement 16 Page
APPENDIX A: IMPROVEMENT PLAN This Improvement Plan has been developed specifically for Taylor County Emergency Management Department based on the results of Courthouse Coercion - A Workplace Protection Exercise Series conducted on November 13, 2015. These recommendations draw on both the After Action Report and the After Action Conference. Capability Observation Recommendation Responsible Agency Completion Date The facility does not have an effective method of notifying occupants of emergency situations. Work with a reputable vendor to identify the best type of emergency notification system to be installed in the courthouse. County Administration 2/1/2016 Coordinate and Manage On-Site Security Initiate and Manage Protective Measures Operations It is apparent that only a handful of courthouse employees have reviewed the courthouse security plan. Upon identifying an appropriate system seek function to purchase and have the system installed. Once the plan is finalized produce a simple video explaining the various components of the plan and what actions will need to be taken for various threatening situations. County Administration Emergency Management 6/1/2016 7/1/2016 Once the video is produced courthouse employees should be required to view the video on a bi-annual basis. Each Courthouse Office / Agency On-Going 17 Page
Identify and Coordinate Consequence Management Operations Coordinate and Manage On-Site Security While emergency response agencies fully understand the Incident Command System (ICS) the management of the offices and agencies housed in the courthouse do not have an understanding of ICS. Most of the offices and agencies housed in the courthouse did not take advantage of liaison with Incident Command to share important information and ask for assistance. Management from each of the offices and agencies housed in the courthouse should take the FEMA self-study Introduction to Incident Command System (Course # IS- 100.b). Each Courthouse Office / Agency 7/1/2016 Initiate and Manage Protective Measures Operations Offices and agencies housed in the courthouse either have a very basic Continuity of Operations Plan or none at all. Each office and agency housed in the courthouse need to develop a comprehensive COOP. Once COOPs are develop each offices and agency will need to train the staff members on the concept of operations contained in the COOP. Each Courthouse Office / Agency Each Courthouse Office / Agency 10/1/2016 2/1/2017 Once staff members are training each offices and agency will need to test their COOP via an exercise. Each Courthouse Office / Agency 4/1/2017 18 Page
APPENDIX B: PARTICIPANT FEEDBACK (Strengths Areas for Improvement) Strengths Tabletop Exercise We recognize situations and we see the need to create a plan. Subject experts are good to ask specific questions. Input from everyone went well. Because of new security downstairs, there is a central hub that was needed. All can react to the situation better. Now all are branches and security is the hub. Learned not to leave if we were contaminated. Discussed protocol of contaminated mail / boxes. Conversation between offices. That we can communicate and make a unified plans. The sit-in scenario: There are certain assumption we should be making among employees, not to report assumptions, but assume that the protesters may be carrying a deadly weapon. We should all be aware of our surroundings. Everyone worked well together to come up with the strategy that needed to be used. Everyone responded quickly to the situation. We handled the situations calmly and thought through our actions, rather that acting compulsively. The exercise presents different scenarios and allows you to think about what you would do in those situations. The exercise allows people to see what other people are thinking that may be a better reaction than the one you came up with. Let s everyone know that someone is thinking about this and that there is a right way to handle almost every situation. Worked as a team. We know that we will have good reaction time and have the ability to make logical decisions. We tested our panic button and verified that they were operational. We had a good discussion and our thoughts got better the more we discussed it as a 19 Page
group. It made us more aware of what could happen and made us think deeper and quicker. We have now discussed a strategic plan of action for these threatening situations. Each of us feel better that everyone is on the same page and we can work together. The Sheriff's Office responded in a timely manner to escort the irate customer out of our office due to the alarm installed in our office. Everyone evacuated extremely fast unable to perform the other tasks. Everything went well. Great cooperation between agencies. A number of items were identified for improvement. Department of Health expert able to provide information pertinent to Anthrax procedures. The exercise was very organized and seemed to work seamlessly. Questions and injects were very real and appropriate to possible issues that could arise within the courthouse. Group was very interactive and gave intelligent discussion and this was a learning opportunity for themselves and those at their table. The exercise injects fostered great communication and interest amongst the participants. Good critical thinking was achieved. The structure of the event. The talking amongst our group. Different thought patterns. Learned some valuable information in terms of what we need to do in certain situations. The interaction with other agencies that helped in tailoring event responses and protocols. The moderators were not invasive or domineering but true facilitators. Focus on biological / chemical and letter / package threats (mail, packages) was needed. Communication and discussion between the group members went very well. 20 Page
Discussion of plan of action to be taken if a suspicious package or package containing deadly or hazardous materials enters into the courthouse. Discussion that there is current communication tactics in force between the Sherriff s Office and the Clerk of the Courts Office for high security cases or particular persons that have a history of violence or rage that may be in the courthouse on a particular day for a court case. Strengths Drill / Functional Exercise Good and open interaction between courthouse members. Good subject matter experts to aid with facilitating the exercise. Exercise has clearly caused courthouse members to think about their response to and recovery from an event. The exercise injects were very realistic and probable. Learned the shortcomings of the courthouse response and recovery capabilities. Flow of the exercise injects. Everyone working together. Method for lockdown was well-known and implemented quickly. We had a plan for interruption of business. Good liaison relationship. Knowledge of panic button location and usage. Went to correct lockdown room. We had our safe places prepared. We had each customer go with us. We quickly executed our lockdown procedure. Exercise organization. Preparation / Planning. Makes you think about possible scenarios. Camera front desk. Identified path to take to lockdown shelter and alternate location / doors to lock. 21 Page
Identified method and content of essential communications that can be made from lockdown and afterwards. Our internal call system easily advised all employees immediately of the lockdown and all clear. All employees followed directions from appropriate law enforcement agencies for clearance and we quickly implemented the plan for the hours immediately following lockdown. All locked down within four minutes. Verification of all clear. Accountability. We began lockdown on time. We had a plan ahead of time as to what we were to do. We got the all clear from Investigator and did it on time. Areas for Improvement Tabletop Exercise Ability to communicate and not having enough manpower to deal with the situations. All departments need to have a security plan and be the worker bees. Security will handle the threat and constitutional offices should handle their staff. Hope that we will be able to coordinate. Need additional security personnel. We cannot all control that. Too many access points in the courthouse. Anyone can be let in. Locating and notifying the Sheriff s Office of lockdown areas. Procedure for allowing protests, providing security, designated areas, permits, make a policy and have the employees know the policy. System of notifying employees and visitors in the courthouse of potential threat / fire / lockdown / evacuation. We realized there should be more emergency alert buttons placed strategically throughout our office so that each employee can easily access help in the event of an emergency. We, as a courthouse, should have a lockdown / emergency plans and every employee should be made aware of it. For, example CODE RED, BLUE, GREEN, etc. 22 Page
We forgot to silence our phones. Interdepartmental communication would have to be very effective for a lot of it to work. So that can always be refined. We have learned that we need to establish a plan for handling emergency situations. The security personnel's response time to the panic button. The building needs a public announcement speaker that accesses the entire building to alert all offices of a threat. We need to become more familiar with the overall safety plan for the courthouse. We need to have quarterly training to keep in practice and stay aware of situations that can happen and how to react. We need to come up with a quick way to notify all employees of danger. Needed more employee help. Communication in the courthouse needs improvement. Entering courthouse procedures. Permits / site needed for demonstration. Public and internal notification techniques and procedures need to be improved. Need a policy and procedure of peaceful demonstrations. Need to move beyond and think about how to handle the media in these events. Making sure all staff is on the same page. Knowing what to do in all situations. Handling mail and packages. Making sure panic button is functional. Focus on after event circumstances. Need improvement on an overall courthouse security breach announcement system for all offices and what the responsibility and plan of action is for each office depending upon the situation. All offices need to locate their lockdown area and make sure it is a secure area and then notify the Sherriff s Office of where that is area is located so they will know in case of a lockdown of the courthouse. 23 Page
Sherriff s office needs to have keys to all courthouse offices. Areas for Improvement Drill / Functional Exercise Notification of all offices and agencies in the courthouse would be difficult with current technical shortage. Need to identify a key phrase to initiate a lockdown and to issue an all clear. Need for written security operational procedures for the Sheriff s Office. A courthouse wide intercom system is needed. All agencies housed within the courthouse need to have a COOP and fully understand how to use the COOP to maintain operations. Everyone needs to have a basic understanding of ICS. Better courthouse notification. Possibly a courthouse wide intercom. We need an office protocol on where to meet after event. Plan for relocation and transfer of information. We need a plan in place for supplies needed while in lockdown. We came out without verification of officer. Need to review out plan and add more details. Notification system. Additional courthouse security. Need ability to lock jury room door from access via Circuit Judge s office. Need to improve knowledge of voicemail and transfer of e-mails remotely. Need to improve / install alerts / intercom for an immediate and clear indication of need to lockdown and / or evacuate. Need trigger lock on doors. Did not receive notice of lockdown. All clear sign was not the safe word we needed. Didn't lock glass doors or turn lights off (no key in office). 24 Page
We need an intercom system that can reach all employees immediately. We need more phone numbers for referral services for employees. Need plan for relocating office. All employees could not be notified of the all clear. We did not have a secured plan for an extended emergency event. We need a shelter in place bag in each safe zone (medical bag, bottled water, etc.). Keys to various offices need to be available. Need an alert system. Secondary alarm panel needed. Modification of doors. Every occupant needs to designate liaison officer to report to ICS. 25 Page
APPENDIX C: ACRONYMS Acronym Meaning COMM CONOPS EOC ESF IAP IC ICS IMT JIC LOFR MOA MOU NIMS OPS PIO SitRep SOG SOP UC Communications Concept of Operations Emergency Operations Center Emergency Support Function Incident Action Plan Incident Command Incident Command System Incident Management Team Joint Information Center Liaison Officer Memorandum of Agreement Memorandum of Understanding National Incident Management System Operations Public Information Officer Situation Report Standard Operating Guideline Standard Operating Procedure Unified Command 26 Page