East Palo Alto City Council
May 17, 2022

East Palo Alto City Council May 17, 2022 Agenda Page 1 of 5

EAST PALO ALTO CITY COUNCIL

REGULAR MEETING AGENDA
May 17, 2022, 6:30 p.m.

EPA Government Center
2415 University Ave, First Floor
East Palo Alto, CA 94303
NOTICE
This City Council meeting will be conducted in accordance with City of East Palo Alto Resolution adopted in accordance with Assembly Bill 361. All members of the City Council will participate in the meeting by video conference, with no physical meeting location available to the public.

Community members may provide comments by emailing [email protected] or using the “RAISE HAND” feature when the Mayor or City Clerk call for public comment. Emailed comments should include the specific agenda item on which you are commenting.

Please click this URL to join
https://us06web.zoom.us/j/88115468975
Or join by phone:

Dial (for higher quality, dial a number based on your current location):

US: +1 669 900 6833 or
+1 346 248 7799 or
+1 253 215 8782 or
+1 312 626 6799 or
+1 929 205 6099 or
+1 301 715 8592
Webinar ID: 881 1546 8975
International numbers available: https://zoom.us/u/aMWYF4KT East Palo Alto City Council May 17, 2022 Agenda Page 2 of 5

1. CALL TO ORDER AND ROLL CALL

2. APPROVAL OF THE AGENDA
(Government Code Section 54957.7(a))

3. APPROVAL OF CONSENT CALENDAR

1. Award Annual Street Resurfacing Project 2022 to G. Bortolotto & Co, Inc.

Recommendation: Adopt a Resolution authorizing the City Manager to: (1) Execute a construction contract with G. Bortolotto & Co, Inc. in the amount of $3,191,567.97 in a form approved by the City Attorney; (2) Establish a construction contingency in the amount of $319,157.00 (10% of construction contract) and execute future change orders in an amount not-to-exceed the appropriated construction contingency, and; (3) Establish a total construction budget in an amount not-to-exceed $3,510,724.97.

2. Revisions to Master Consultant Agreements for Processing Development Applications
Recommendation: Adopt a resolution authorizing the Interim City Manager to:

Amend the Master Consultant Agreements (MCAs) for professional services with the recommended consultants by extending the contract term by two-years with an option to extend for up to two (2) additional six-month extensions. a) Amend the Master Consultant Agreement for building plan review and inspection services for pre-entitlement services to clarify the contract limit of $750,000 as per Resolution No. 5166; and
b) Amend the Consultant Agreement with West Coast Code Consultants for postentitlement building services by extending the contract term by two-years with an option to extend for up to two (2) additional six-month extensions.

3. TDM Program Administration Contract
Recommendation: Adopt a Resolution authorizing the City Manager to execute a consultant contract for Transportation Demand Management program administration with Cities21, in the amount of $121,300 for a term of three years and one six-month extension.

4. Grant Agreement with HEART for the Local Housing Trust Fund Program Recommendation: Adopt a Resolution authorizing the City Manager to execute a Grant Agreement with Housing Endowment and Regional Trust of San Mateo County (“HEART”) to provide match funds in the amount of $1,700,000, so that HEART may draw Local Housing Trust Fund Program Funds granted by the Department of Housing and Community Development and provide $3,230,000 to the 965 Weeks Affordable Housing Project in the form of a deferred, 55-year low-interest loan.

5. TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Avenue at Michigan Avenue
Recommendation: Adopt a resolution approving the request to the Metropolitan Transportation Commission by the City of East Palo Alto for an allocation of Transportation Development Act Article 3 Pedestrian and Bicycle Project funding for fiscal year 2022- 2023.

6. Installation of a multi-way stop sign at the western leg of Bell Street and Cooley Avenue
Recommendation: Adopt a resolution authorizing the installation of a multi-way (threeway) stop sign at the Bell Street and Cooley Avenue intersection at the western leg.

East Palo Alto City Council May 17, 2022 Agenda Page 3 of 5

7. AB 361 Findings to Continue Virtual Public Meetings for the City Council and City Advisory Bodies
Recommendation: Adopt a resolution making the AB 361 findings necessary to continue virtual public meetings for the City Council and City Advisory Bodies for the month of June 2022.

8. Grand Jury Report: “Ransomware: It is not enough to think you are protected” Recommendation: Staff recommends that the City Council authorize the Mayor to sign the City’s response to the San Mateo County 2019-20 civil grand jury report:
“Ransomware: It is not enough to think that you are protected.”

9. University Circle Phase II Development Agreement
Recommendation: Waive the second reading and adopt an ordinance approving the Development Agreement for University Circle II.

10. Minutes of the 1/8/2022 - 3/22/2022 Meetings
Recommendation: Adopt the minutes.

11. Letter of Support for SB 893
Recommendation: By motion, authorize the Mayor to sign the attached letter, on behalf of City Council, to support Senator Josh Becker, Assembly Member Kevin Mullin, and Assembly Member Marc Berman’s Senate Bill 893 – Financial Assistance for Community College Students in Need.

4. CLOSED SESSION – NONE

5. PUBLIC COMMENT
Members of the public wishing to address the City Council on items not listed on the agenda may do so under this item. Each speaker is limited to two minutes. The Mayor has the discretion to adjust speaking times. In accordance with State Law, no action or discussion may take place on any item not appearing on the posted agenda. The Council may respond to statements made or questions asked or may request Staff to report back at a future meeting concerning the matter.

The exceptions under which the City Council may discuss and/or take action on items not appearing on the agenda are contained in Government Code Section 54954.2(b)(1)(2)(3).

6. INFORMATIONAL REPORTS

1. Creation of a Military Equipment Use Ordinance and Use Policy Recommendation: Interim Police Chief Jeff Liu will give a brief presentation.

7. SPECIAL PRESENTATIONS

1. Special Presentation from Downtown Streets Team.

8. PUBLIC HEARINGS -NONE

9. POLICY AND ACTION

1. Pass-Through of San Francisco Public Utility Commission Wholesale Water Rate Increases
Recommendation: Adopt a Resolution authorizing the pass-through increase of $0.78, to be effective July 1, 2022, to the water usage charges in the rate schedule adopted by Resolution 5154 and directing staff to issue a notice of the change to all water service customers within the City of East Palo Alto water system no less than 30-days prior to increase.

East Palo Alto City Council May 17, 2022 Agenda Page 4 of 5

2. Issues Concerning the Light Tree Affordable Housing Project and the East Palo Alto Sanitary District
Recommendation:

1. Accept the report on the issues concerning the Light Tree Affordable Housing Project and the East Palo Alto Sanitary District;

2. Not accept the counter proposal proffered by the East Palo Alto Sanitary District regarding the Light Tree Affordable Housing Project; and

3. Authorize the Mayor to communicate the City’s position to the East Palo Alto Sanitary District.

3. Willow Village Draft Environmental Impact Report (Facebook/Meta Expansion) Recommendation:
• Receive the staff report regarding the Willow Village Draft Environmental Impact Report (DEIR);
• Provide staff with direction regarding any proposed amendments or modifications to the attached DEIR comment letter (Attachment 1); and • Direct the Interim City Manager to send the attached DEIR comment letter to the City of Menlo Park to serve as the City’s official comments on the Willow Village DEIR.

4. Ravenswood Business District Specific Plan – Community Benefits and Associated Policies/Programs
Recommendation:

Provide direction and feedback on:
• Recommended priorities for community benefits from new development in the RBD / 4 Corners Specific Plan area.
• Proposed policies and mechanisms comprising a framework to achieve community benefits desired by the community.

5. Proposed Strategy for Final Disbursement of Remaining Measure C Funding Recommendation:

1. Accept the staff report and provide direction regarding the proposed approach for completing disbursement of the remaining Measure C funds; and

2. Appropriate a maximum of $15,000 in Measure C funding to support the Senior Center’s reopening efforts.

6. Initial City Reopening Plan
Recommendation:

1. Accept the staff report and provide direction regarding the City’s initial approach to reopening as a stage of recovery from the COVID-19 Pandemic; and

2. Direct staff to return to the City Council in June 2022 with a detailed re-opening strategy.

7. COVID-19 Vaccination Program Regular Update
Recommendation: Discuss the COVID-19 vaccination program update and provide direction to staff.

10. COUNCIL REPORTS

11. ADJOURNMENT
East Palo Alto City Council May 17, 2022 Agenda Page 5 of 5 This AGENDA is posted in accordance with Government Code Section 54954.2(a) This Notice of Availability of Public Records: All public records relating to an open session item which are not exempt from disclosure pursuant to the Public Records Act, that are distributed to the majority of the City Council will be available for public inspection at the City Clerk’s Office, 2415 University Avenue, East Palo Alto, CA at the same time that the public records are distributed or made available to the City Council. Such documents may also be available on the East Palo Alto website www.cityofepa.org subject to staff’s ability to post the documents prior to the meeting. Information may be obtained by calling (650) 853-3100.

The City Council meeting packet may be reviewed by the public in the Library or the City Clerk's Office. Any writings or documents pertaining to an open session item provided to a majority of the City Council less than 72 hours prior to the meeting, shall be made available for public inspection at the front counter at the City Clerk's Office, 2ND Floor, City Hall, 2415 University Avenue, East Palo Alto, California 94303 during normal business hours.

Information distributed to the Council at the Council meeting becomes part of the public record. A copy of written material, pictures, etc. should be provided for this purpose.

East Palo Alto City Council Chambers is ADA compliant. Requests for disability related modifications or accommodations, aids or services may be made by a person with a disability to the City Clerk's office at (650) 853-3127 no less than 72 hours prior to the meeting as required by Section 202 of the Americans with Disabilities Act of 1990 and the federal rules and regulations adopted in implementation thereof.

DECLARATION OF POSTING
This Notice is posted in accordance with Government Code §54954.2(a) or §54956. Members of the public can view electronic agendas and staff reports by accessing the City website. Under penalty of perjury, this Agenda was posted to the public at least 72 hours prior to the meeting.

POSTED: May 12, 2022
ATTEST:

James Colin
Acting City Clerk
Future Meetings:

Meeting Date Time
Budget Meeting May 19, 2022 6:00 p.m.

Joint Study Session Between the
City Council of the City of East
Palo Alto and the Ravenswood
City School District Board of
Directors
May 23, 2022 6:00 p.m.

Budget Meeting May 26, 2022 6:00 p.m.

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Patrick Heisinger, Interim City Manager
BY: Adrian Biggs, Associate Engineer
Humza Javed, City Engineer
SUBJECT: Award Annual Street Resurfacing Project 2022 to G. Bortolotto & Co, Inc.

Recommendation
Adopt a Resolution authorizing the City Manager to: (1) Execute a construction contract with G. Bortolotto & Co, Inc. in the amount of $3,191,567.97 in a form approved by the City Attorney; (2) Establish a construction contingency in the amount of $319,157.00 (10% of construction contract) and execute future change orders in an amount not-to-exceed the appropriated construction contingency, and; (3) Establish a total construction budget in an amount not-to-exceed $3,510,724.97.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 1: Enhance Public Safety and Emergency Preparedness Priority No. 2: Enhance Economic Vitality
Priority No. 4: Improve Public Facilities and Infrastructure Priority No. 6: Create a Healthy and Safe Community
Background
The streets to be rehabilitated in 2022 were identified as needing rehabilitation in the Pavement Management Program Budget report prepared as part of MTC’s Technical Assistance Program P-TAP in 2021. The list was further analyzed and refined by Public Works staff.

This project will consist of rehabilitation and preventive maintenance of City streets including pothole/base repairs, slurry seals, and pavement overlays. Rehabilitation and maintenance on public streets is coordinated with other City projects, utility company excavations and private development projects on a cycle that sustains a high Pavement Condition Index (PCI) for all City streets.

3.1 Packet Pg. 6
In addition to pavement rehabilitation, the project will include sidewalk construction and improved striping configurations for the bicycle facilities on Pulgas Avenue, Clarke Avenue, West Bayshore Road, East Bayshore Road, Newell Road, Woodland Avenue, and Bay Road.

The new striping improvements will include, but are not limited to, re-configuration of bicycle lane transitions at intersections, buffered bicycle lanes, green thermoplastic bicycle facilities, and improved pavement markings for Class 2 and 3 bicycle facilities. Every crosswalk that is re-surfaced in the project areas will be re-striped to improve pedestrian safety. Moreover, the project will include curb ramp improvements in accordance with Americans with Disability Act (ADA) regulations and short-term improvements as approved in the City’s Mobility Study such as speed humps and bulb-outs.

The Public Works and Transportation Commission approved the Plans, Specifications and Estimates (PS&E) on February 16, 2022; The City Council approved the PS&E package on April 5, 2022.

Project documents are located on the Annual Street Resurfacing web page on the City website at the following link: https://www.cityofepa.org/publicworks/project/annual-street-resurfacing Analysis
The project was advertised on April 4, 2022 for solicitation of construction bids. On April 28, 2022, sealed bids were received, publicly opened via Zoom, and read aloud by the Public Works Engineers. There were a total of two (2) contractors who submitted bids for the Project with the following bid results:

No. Company Name Total Base Bid
Amount
Alternate Bid
Amount
Total Bid
Amount
1 G. Bortolotto &
Company, Inc. $2,740,767.97 $450,800.00 $3,191,567.97
2 O’Grady Paving Inc. $2,975,812.20 $413,400.00 $3,389,212.20 The bid analysis is included as Attachment 2 to this report. The project is within the Engineer’s Estimate of $3.5 million.

G. Bortolotto & Company, Inc. submitted the lowest Base bid in the amount of $2,740,767.97 and alternate bid (for sidewalk bulbouts) in the amount of $450,800.00, for a total Bid of $3,191,567.97. City staff performed a bid analysis, verified qualifications, license and checked references for the lowest bidder.

Contingent upon completing all insurance and bonding requirements of the Contract Specifications, staff recommends that the City Council authorize the City Manager to execute a construction contract with G. Bortolotto & Company. Inc., the lowest responsible bidder, establishing a construction contract in an amount not-to-exceed $3,191,567.97, and appropriating an additional $319,157.00 (10%) for construction contingency.

Upon execution of contract documents, the project will begin construction this summer and is anticipated to be fully completed within six months.

3.1 Packet Pg. 7
Fiscal Impact
The project will be paid per Table 1 below.

Fund Cost
Measure A $635,724.77
Measure M $600,000.00
Gas Tax Funding $1,100,000.00
Measure W $400,000.00
AHSC $775,000.00
Total $3,510,724.77
Public Notice
The public was provided notice of this agenda item by posting the City Council agenda on the City’s official bulletin board outside City Hall and making the agenda and report available at the City’s website and at the San Mateo Co. Library located at 2415 University Avenue, East Palo Alto.

Environmental
The action being considered by the City Council is exempt from the California Environmental Quality Act (CEQA) because it is not a “project” pursuant to 15378(b)(4) because it is a fiscal activity which does not involve any commitment to any specific project which may result in a potentially significant impact on the environment.

Attachments

1. Resolution

2. Bid Results - ST-07-22

3.1 Packet Pg. 8
1 of 2
RESOLUTION NO. XX – 2022

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO
AUTHORIZING THE CITY MANAGER TO EXECUTE A CONSTRUCTION CONTRACT WITH G.

BORTOLOTTO & COMPANY, INC. IN THE AMOUNT OF $3,191,567.97, ESTABLISH A CONSTRUCTION CONTINGENCY IN THE AMOUNT OF $319,157.00, AND EXECUTE FUTURE

CHANGE ORDERS IN AN AMOUNT NOT-TO-EXCEED THE APPROPRIATED CONSTRUCTION CONTINGENCY; ESTABLISH A TOTAL CONSTRUCTION BUDGET IN AN AMOUNT NOT-TOEXCEED $3,510,724.97; AND EXECUTE ANY AGREEMENTS NECESSARY FOR PROJECT

IMPLEMENTATION
WHEREAS, the streets to be rehabilitated in 2022 were identified as needing rehabilitation in the Pavement Management Program Budget report prepared as part of MTC’s Technical Assistance Program P-TAP in 2021; and
WHEREAS, the Public Works and Transportation Commission approved the Plans, Specifications and Estimates (PS&E) on February 16, 2022; and WHEREAS, the City Council approved the PS&E package on April 5, 2022; and WHEREAS, the project was advertised on April 4, 2022 for solicitation of construction bids; and WHEREAS, on April 28, 2022, sealed bids were received, publicly opened via Zoom, and read aloud by Public Works Engineers. and. Two contractors submitted bids for the project; and WHEREAS, G. Bortolotto & Company, Inc. submitted the lowest bid in the total amount of $3,191,567.97. City staff performed a bid analysis, verified qualifications, license, and checked references.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to:

1. Execute a construction contract with G. Bortolotto & Company, Inc. in the amount of $3,191,567.97 in a form approved by the City Attorney; and

2. Establish a construction contingency in the amount of $319,157.00 (10% of construction contract) and execute future change orders in an amount not-to-exceed the appropriated construction contingency; and

3. Establish a total construction budget in an amount not-to-exceed $3,510,724.97.

4. Execute any agreements necessary for project implementation

3.1.a
Packet Pg. 9
Attachment: Resolution (2243 : Award 2022 Street Resurfacing Project) 2 of 2
PASSED AND ADOPTED this 17th day of May 2022, by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

Ruben Abrica, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, Acting City Clerk Valerie J. Armento, Interim City Attorney

3.1.a
Packet Pg. 10
Attachment: Resolution (2243 : Award 2022 Street Resurfacing Project)

BID SCHEDULE
ANNUAL STREETS RESURFACING PROJECT 2022 CITY CONTRACT NO. : CIP-ST-07-22

CITY OF EAST PALO ALTO, CALIFORNIA

1. BASE BID SCHEDULE
ITEM NO. ITEM DESCRIPTION QUANTITY UNIT OF MEASURE UNIT PRICE ($) TOTAL AMOUNT ($) UNIT PRICE ($) TOTAL AMOUNT ($) UNIT PRICE ($) TOTAL AMOUNT ($) 1 Mobilization 1 LS $70,000.00 $70,000.00 $80,000.00 $80,000.00 $139,332.48 $139,332.48 2 Traffic Control 1 LS $220,000.00 $220,000.00 $100,000.00 $100,000.00 $278,664.97 $278,664.97 3 Construction Staking and Surveying 1 LS $9,000.00 $9,000.00 $30,000.00 $30,000.00 $10,000.00 $10,000.00 4 Stormwater Pollution Prevention and Dust Control 1 LS $5,000.00 $5,000.00 $5,000.00 $5,000.00 $5,000.00 $5,000.00 5 Construction Signage 2 EA $2,000.00 $4,000.00 $2,500.00 $5,000.00 $1,500.00 $3,000.00 6 PCC: Curb & Gutter 100 LF $200.00 $20,000.00 $175.00 $17,500.00 $135.00 $13,500.00 7 PCC: Curb Only 886 LF $83.00 $73,538.00 $85.00 $75,310.00 $115.00 $101,890.00 8 PCC: Curb Ramp 50 EA $7,100.00 $355,000.00 $7,500.00 $375,000.00 $5,500.00 $275,000.00 9 PCC: Sidewalk 5,117 SF $20.50 $104,898.50 $22.00 $112,574.00 $22.00 $112,574.00 10 PCC: Driveway 2,975 SF $32.00 $95,200.00 $34.00 $101,150.00 $25.00 $74,375.00 11 Asphalt Concrete Grinding - 1 Inch Wedge Grind (6' wide) 5,350 LF $5.00 $26,750.00 $2.50 $13,375.00 $1.00 $5,350.00 12 Asphalt Concrete Grinding - 2 Inch Full Grind 33,687 SY $4.86 $163,718.82 $6.30 $212,228.10 $5.50 $185,278.50 13 HMA Concrete Paving (2 inch thickness) 6,538 TON $118.63 $775,602.94 $152.00 $993,776.00 $150.00 $980,700.00 14 Type II Slurry Seal 86,951 SY $2.81 $244,332.31 $3.00 $260,853.00 $3.50 $304,328.50 15 Base Repair (4 inch digouts) 18,000 SF $5.00 $90,000.00 $8.90 $160,200.00 $7.50 $135,000.00 16 Thermoplastic: Symbols and Legends 6,649 SF $11.50 $76,463.50 $8.50 $56,516.50 $5.00 $33,245.00 17 Thermoplastic: 12 inch 1,918 LF $11.00 $21,098.00 $7.00 $13,426.00 $5.00 $9,590.00 18 Raise to Grade: Stormwater Manhole 20 EA $800.00 $16,000.00 $1,200.00 $24,000.00 $1,350.00 $27,000.00 19 Raise to Grade: Sanitary Sewer Manhole 20 EA $800.00 $16,000.00 $1,200.00 $24,000.00 $1,350.00 $27,000.00 20 Raise to Grade: Communication Vault 1 EA $1,500.00 $1,500.00 $2,500.00 $2,500.00 $2,500.00 $2,500.00 21 Raise to Grade: Water Valve Covers 10 EA $600.00 $6,000.00 $800.00 $8,000.00 $900.00 $9,000.00 22 Raise to Grade: PG&E Gas Cover 2 EA $600.00 $1,200.00 $800.00 $1,600.00 $1,000.00 $2,000.00 23 Contruct Speed Hump 8 EA $4,000.00 $32,000.00 $10,000.00 $80,000.00 $6,500.00 $52,000.00 24 Remove and Replace: Traffic Loops 1 EA $1,500.00 $1,500.00 $1,000.00 $1,000.00 $6,500.00 $6,500.00 25 Thermoplastic: 6 inch 34,639 LF $1.60 $55,422.40 $1.40 $48,494.60 $0.90 $31,175.10 26 Thermoplastic: 6 Inch Double Yellow 14,680 LF $3.10 $45,508.00 $2.75 $40,370.00 $1.75 $25,690.00 27 Thermoplastic: Sharrows 317 EA $206.00 $65,302.00 $140.00 $44,380.00 $800.00 $253,600.00 28 Thermoplastic: Class II Lane Symbols (20 ft of Green Lane) 33 EA $1,250.00 $41,250.00 $550.00 $18,150.00 $1,750.00 $57,750.00 29 Sign Poles 45 EA $400.00 $18,000.00 $275.00 $12,375.00 $325.00 $14,625.00 30 Share the Road Sign 56 EA $325.00 $18,200.00 $150.00 $8,400.00 $120.00 $6,720.00 31 In-Road Pedestrain Crossing Sign (R1-6) 4 EA $700.00 $2,800.00 $300.00 $1,200.00 $240.00 $960.00 32 Pedestrian Crossing Sign (W11-2) 2 EA $700.00 $1,400.00 $300.00 $600.00 $120.00 $240.00 33 No Parking Signs (R28 (CA)) 4 EA $600.00 $2,400.00 $150.00 $600.00 $120.00 $480.00 34 Thermoplastic: Green Lane 1,040 SF $12.00 $12,480.00 $15.00 $15,600.00 $11.00 $11,440.00 35 Thermoplastic: Yellow Crosswalk 9 EA $2,300.00 $20,700.00 $1,500.00 $13,500.00 $1,425.00 $12,825.00 36 Thermoplastic: Yellow Symbols and Legends 1,680 SF $11.50 $19,320.00 $8.00 $13,440.00 $6.00 $10,080.00 37 Thermoplastic: Symbols and Legends 448 SF $12.00 $5,376.00 $8.00 $3,584.00 $6.00 $2,688.00 38 Thermoplastic: Yellow 12 inch 180 LF $14.00 $2,520.00 $6.00 $1,080.00 $6.00 $1,080.00 39 Thermoplastic: 6 inch dashed 515 LF $2.50 $1,287.50 $2.00 $1,030.00 $0.90 $463.50

3. TOTAL BASE BID (BASIS OF AWARD)
$2,740,767.97 $2,975,812.20 $3,222,645.05

4. ALTERNATIVE BID SCHEDULE:

ITEM NO. ITEM DESCRIPTION QUANTITY UNIT OF MEASURE UNIT PRICE ($) TOTAL AMOUNT ($) UNIT PRICE ($) TOTAL AMOUNT ($) UNIT PRICE ($) TOTAL AMOUNT ($) 40 Construction Staking and Surveying (Bulbouts) 1 LS $28,000.00 $28,000.00 $5,000.00 $5,000.00 $10,000.00 $10,000.00 41 PCC: Curb & Gutter 720 LF $200.00 $144,000.00 $175.00 $126,000.00 $135.00 $97,200.00 42 PCC: Sidewalk 3,600 SF $33.00 $118,800.00 $34.00 $122,400.00 $22.00 $79,200.00 43 PCC: Curb Ramp 20 EA $8,000.00 $160,000.00 $8,000.00 $160,000.00 $5,500.00 $110,000.00 $450,800.00 $413,400.00 $296,400.00

5. TOTAL BID AMOUNT:
$3,191,567.97 $3,389,212.20 $3,519,045.05
ATTACHMENT 2 - BID RESULTS AND ANALYSIS
Engineer's Estimate
Engineer's Estimate
G. Bortolotto & Company, Inc.

G. Bortolotto & Company, Inc. Granite Construction Company Engineer's Estimate Granite Construction Company
O'Grady Paving, Inc.

Granite Construction Company Engineer's Estimate
Total (Base and Alternate)
Total Base Bid
G. Bortolotto & Company, Inc.

G. Bortolotto & Company, Inc.

Total Alternative Bid Schedule:

3.1.b
Packet Pg. 11
Attachment: Bid Results - ST-07-22 (2243 : Award 2022 Street Resurfacing Project)

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Patrick Heisinger, Interim City Manager
BY: Jessica Caballero, Management Analyst II
Amy Chen, Community & Economic Development Director
SUBJECT: Revisions to Master Consultant Agreements for Processing Development Applications
Recommendation
Adopt a resolution authorizing the Interim City Manager to:
a) Amend the Master Consultant Agreements (MCAs) for professional services with the recommended consultants by extending the contract term by two-years with an option to extend for up to two (2) additional six-month extensions; b) Amend the Master Consultant Agreement for building plan review and inspection services for pre-entitlement services to clarify the contract limit of $750,000 as per Resolution No. 5166; and
c) Amend the Consultant Agreement with West Coast Code Consultants for postentitlement building services by extending the contract term by two-years with an option to extend for up to two (2) additional six-month extensions.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 2: Enhance Economic Vitality
Priority No. 3: Increase Organizational Effectiveness and Efficiency Priority No. 6: Create a Healthy and Safe Community

3.2 Packet Pg. 12
Background
In 2019, the City of East Palo Alto Community and Economic Development (CEDD) and Public Works (PW) experienced a significant increase in development application review activity, and to address these demands both departments are to comply with critical State mandates by entering into developer-reimbursement professional service agreements.

On April 2, 2019, the City Council directed staff to issue a Request for Qualifications (RFQ) for consulting services to support the City with processing development applications. On April 5, 2019, staff released an RFQ to the City's preapproved lists of firms for the following services:
designated contract planner; environmental review analysis; housing needs assessment; fiscal impact analysis; design review; engineering review analysis; transportation consultant. A total of fifteen (15) firms responded and members of the CEDD and PW evaluated each proposal based on a scoring system outlined in the RFQ and identified top scoring respondents in each service category.

Prior to 2019, City Council awarded contracts to David J. Powers and EMC Planning to prepare planning documents for complex development projects listed in that staff report. The process of securing those CEQA consultants took months because of the complexity of projects.

As a result, on July 2, 2019, the City Council adopted Resolution No. 5142 (See Attachment 2) authorizing the City Manager to execute up to $5,950,000 in Master Consulting Contracts and seek reimbursement from project applicants for such contract consulting services through Developer Reimbursement Agreements (DRA) and/or Master Fee Reimbursement Agreements (MFRA) to aid in developing an on-call bench of consultants. Additionally, City Council also directed staff to issue a separate RFQ to identity up to two consultants to help with the City building plan review services and inspection services. On September 17, 2019, City Council authorized the City Manager to establish a contract limit of $750,000 for building plan review and inspection services for pre-entitlement services with 4Leaf and West Coast Code Consultants (See Attachment 3 – Resolution No. 5166).

On December 17, 2019, the City entered into a consultant agreement with West Coast Code Consultants, Inc (WC3) and CSG Consultants, Inc. for post-entitlement services with a total contact limit for building-related professional services not to exceed $1,000,000 and a term of expiration of June 30, 2022 with up to two (2) six-month extensions, at the discretion of the City Manager (See Attachment 4 – Resolution No. 5202).

Subsequently, on June 2, 2020, the City Council directed staff to hire a designed contract planner to assist with larger development projects in the Ravenswood Business District (RBD).

On November 5, 2020, the City entered into a consultant agreement with Good City Company with a total contract limit for project management services not to exceed $500,000 and a term expiration of July 20, 2023 with up to two (2) six-month extensions, at the discretion of the City Manager. In that same Council action, staff also was directed to execute a contract with Raimi and Associates for the purposes of analyzing a potential update to the RBD Specific Plan. This Raimi and Associates contract includes initial analysis as well as an environmental analysis component for the Specific Plan, where Raimi will subcontract work with Strategic Economics, Schaaf + Wheeler, Hexagon Consulting, and David J Powers. The contract with Raimi and Associates also may act as a pass-through agreement if the Council were to direct staff to move forward with the Specific Plan update and developers were to contribute to the cost of

3.2 Packet Pg. 13
the Raimi contract. The action recommended in this staff report does not impact either Good City Company or Raimi and Associates RBD Specific Plan efforts, and if there need to be contract amendments, City staff will bring them back separately.

Good City Company is noted in Attachment 7 to provide a consolidated list of MCAs. Raimi and Associates and the RBD Specific Plan efforts are intentionally not included as their contract is not directly related to a project at this time.

On May 18, 2021, Staff provided City Council with an update on the current Master Consultant Agreements (MCAs) noted in Resolution 5142; and received approval to amend the budget capacity of respective MCA’s to accommodate an influx of development applications (See Attachment 5 – Resolution No. 64-2021).

The purpose of this staff report is to provide City Council a status update on the current Master Consultant Agreements (MCA) noted in Resolution 5142; and to request approval to amend the Master Consultant Agreements (MCAs) for professional services with the recommended consultants by extending the contract terms of the MCA’s in order to continue working on existing projects. At this time staff is not requesting to extend the term of the Good City Company’s MCA but may reapproach this specific MCA in the future. Staff also requests approval to amend the Consultant Agreement with West Coast Code Consultants for postentitlement building services as noted in Resolution No. 5202 by extending the contract term.

Analysis
Status Update of Current Master Consultant Agreements
The City Manager entered into Master Consultant Agreements (MCA) with the list of contractors selected by City Council to provide services on an as needed basis (see Attachment 7 for a full list of MCAs). Upon receipt of a planning application, staff determines which MCAs must be utilized to process each application. Complex planning applications require multiple consultant services and, therefore, multiple Request for Proposals (RFP) processes and enters into a Developer Reimbursement Agreements (DRAs).

Staff facilitates the work of consultants to ensure the resultant product meets the City’s needs, the costs associated with these consultant contracts are wholly funded by the developers. For this reason, the General Fund is not impacted by the implementation of MCAs.

Contract Term Extensions for Master Consultant Agreements As the City approaches the three-year milestone since authorizing the City Manager to execute MCAs (2019), most MCAs are due to expire June 30, 2022. More projects are continuing to be processed and new development applications are still coming in.

Staff recommends the City Council authorize the City Manager to extend the contract terms of the MCAs by two-years with an option to extend for up to two (2) additional six-month extensions as noted above.

3.2 Packet Pg. 14
The MCA for building plan review services and inspection services inadvertently references a not to exceed budget capacity of Six Hundred and Fifty Thousand Dollars $650,000. Staff recommends the City Council authorize the City Manager to amend the MCA to clarify the not to exceed contract limit of $750,000 as required by Resolution No. 5166.

Contract Term Extension for Consultant Agreement (Building Plans Review) The consultant agreement with WC3 for post-entitlement building plans review, building inspection, and other building division support services expires June 30, 2022. Staff recommends the City Council authorize the City Manager to extend the contract by two-years with an option to extend for up to two (2) additional six-month extensions as noted above. Due to the continued increase in development review activity, the Building Services Division continues to require consultant support to address current development project application demand and comply with critical State mandates.

Next Steps
Staff will prepare MCA contract term extensions with the recommended consultants in nine (9) service categories. Currently the MCA’s for all but one consultant noted in Attachment 7 expire June 30, 2022 (Good City Company expires July 20, 2023). Staff also will prepare an amendment to the MCA for building plan review and inspection services for pre-entitlement services to clarify the contract limit of $750,000 as per Resolution No. 5166. Staff will prepare a contract term extension for building plan review, inspection & support services for postentitlement services. Currently, staff is asking only to extend the contract terms to accommodate continued work.

Fiscal Impact
There is no fiscal impact to the General Fund. This recommendation is only to extend the contract term of the respective MCAs to continue work on existing projects and to clarify the correct contract limit of $750,000 for building plan review and inspection services for preentitlement services, per Resolution No. 5166.

Public Notice
The public was provided notice of this agenda item by posting the City Council agenda on the City’s official bulletin board outside City Hall and making the agenda and report available at the City’s website and at the San Mateo County Library located at 2415 University Avenue, East Palo Alto.

Environmental
The action being considered does not constitute a “Project” within the meaning of the California Environmental Quality Act (CEQA), pursuant to CEQA Guideline section 15378 (b)(5), in that it is a government administrative activity that will not result in direct or indirect changes in the environment.

Attachments

1. Resolution

3.2 Packet Pg. 15

2. Resolution #5142

3. Resolution #5166

4. Resolution #5202

5. Resolution #64-2021

6. First Approval of MCAs - Staff Report Dated July 2, 2019

7. Consolidated List of Agreements with Expiration Dates

3.2 Packet Pg. 16
RESOLUTION NO. ___

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EAST PALO

ALTO AUTHORIZING THE CITY MANAGER TO EXTEND THE TERMS OF

MULTIPLE AGREEMENTS TO SUPPORT THE CITY WITH CONTINUED

PROCESSING OF DEVELOPMENT APPLICATIONS
WHEREAS, the City of East Palo Alto Community and Economic Development (CEDD) and Public Works (PW) Departments are and will be experiencing a significant increase in development review activity over the next 2-3 years, exceeding the current CEDD and PW staffing capacity; and WHEREAS, the two Departments expressed urgent need to address current development project application demand and comply with critical State mandates by entering into developer-reimbursed professional services agreements; and WHEREAS, in April 2019, the City Council directed staff to issue a Request for Qualifications (RFQ) for consulting services to support the City of East Palo Alto with processing development applications and staff released an RFQ to the City's preapproved lists of firms for designated contract planner; environmental review analysis; housing needs assessment; fiscal impact analysis; design review; engineering review analysis; and transportation consultant services; and
WHEREAS, on July 2, 2019, the City Council adopted Resolution No. 5142 authorizing the City Manager to execute up to $5,950,000 in Master Consulting Contracts and seek reimbursement from project applicants for such contract consulting services through Developer Reimbursement and/or Master Fee Reimbursement Agreements; and
WHEREAS, on September 17, 2019, the City Council adopted Resolution No. 5166 authorizing the City Manager to execute Master Consultant Agreements to support the City with processing of building plan review and inspection services; and WHEREAS, on May 8, 2021, the City Council adopted Resolution No. 64-2021 authorizing the City Manager to execute amendments in Master Consulting Contracts with a total of $9,275,000 for professional services with the recommended consultants and delegated the authority to the City Manager to utilize Developer Reimbursement Agreement, and Master Fee Reimbursement Agreements until June 30, 2024, and WHEREAS, City staff determined some of the Master Consulting Contracts need to be extended in order to address increases in development review activity over an additional 2 years, exceeding the current CEDD and PW staffing capacity;

3.2.a
Packet Pg. 17
Attachment: Resolution (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL
OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to:

1. Amend the Master Consultant Agreements (MCAs) for professional services as set forth in Exhibit A by extending the contract term by two-years with an option to extend for up to two (2) additional six-month extensions;

2. Amend the Master Consultant Agreement for building plan review and inspection services for pre-entitlement services to clarify the contract limit of $750,000 as per Resolution No. 5166; and

3. Amend the Consultant Agreement with West Coast Code Consultants (WC3) for post-entitlement building services by extending the contract term by two-years with an option to extend for up to two (2) additional six-month extensions.

3.2.a
Packet Pg. 18
Attachment: Resolution (2256 : Revisions to Master Consultant Agreements for Processing Development Applications) PASSED AND ADOPTED this 17th day of May 2022 by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

SIGNED:

Ruben Abrica, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, Acting City Clerk Valerie Armento, Interim City Attorney

3.2.a
Packet Pg. 19
Attachment: Resolution (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

EXHIBIT A

3.2.a
Packet Pg. 20
Attachment: Resolution (2256 : Revisions to Master Consultant Agreements for Processing Development Applications) RESOLUTION NO. 5142

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE CITY MANAGER TO EXECUTE MULTIPLE MASTER

CONSULTANT CONTRACTS TO SUPPORT THE CITY WITH PROCESSING OF

DEVELOPMENT APPLICATIONS
WHEREAS, the City of East Palo Alto Community and Economic Development (CEDD) and Public Works (PW) Departments are and will be experiencing a significant increase in development review activity over the next 2-3 years, exceeding the current CEDD and PW staffing capacity; and WHEREAS, the City of East Palo Alto CEDD and PW Departments have expressed urgent need to address current development project application demand and comply with critical State mandates by entering into developer-reimbursed professional services agreements; and
WHEREAS, on April 2, 2019, the City Council directed staff to issue a Request for Qualifications (RFQ) for conSUlting services to support the City of East Palo Alto with processing development applications; and
WHEREAS, on April 5, 2019, staff released an RFQ to the City's preapproved lists of firms for the following services: designated contract planner; environmental review analysis; housing needs assessment; fiscal impact analysis; design review; engineering review analysis; transportation consultant; and
WHEREAS, a total of fifteen (15) finns responded to the City's RFQ, in most cases responding to multiple service areas, resulting in a total of 36 submitted proposals; and
WHEREAS, members of the CEDD and PW Departments evaluated each proposal based on the scoring system outlined in the RFQ and identified top scoring respondents in each service category; and
WHEREAS, staff seeks to improve the City's process of reviewing development applications by utilizing Master Consultant Contracts, Developer Reimbursement Agreements, and Master Fee Reimbursement Agreements; and WHEREAS, City staff identified that two consultants to assist with building plan review services will also be required over the next 2-3 years to improve processing of development applications.

3.2.b
Packet Pg. 21
Attachment: Resolution #5142 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to:

1. Execute a total of $5,950,000 in Master Consulting Contracts for professional services with the recommended consultants by service category and contract limits listed in Exhibit A to this Resolution and waive the formal bid procedures pursuant to East Palo Alto Municipal Code section 2.84.070(D) for said contracts;

2. Delegate authority to the City Manager until June 30, 2022, to utilize Developer Reimbursement Agreements, and Master Fee Reimbursement Agreements, in a form approved by the City Attorney, to establish terms of reimbursement for professional services and other allowable costs incurred related to development applications; and

3. To issue a Request for Qualifications (RFQ) to identify up to two consultants to help the City with building plan review services.

PASSED AND ADOPTED this 2nd day of July 2019 by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

MOODY, ROMERO, WALLACE-JONES
NONE

ABRICA, GAUTHIER
NONE

3.2.b
Packet Pg. 22
Attachment: Resolution #5142 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

EXHIBIT A

RECOMMENDED CONSULTANT AWARD BY

SERVICE CATEGORY AND CONTRACT LIMIT
Service Category Highest Scoring Respondents Recommended Total Category Award
Designated Contract Rincon Consultants, Inc. $750,000 Planner Michael Baker International Environmental Review Powers
Analysis EMC Planning Group $2,500,000
'iI KimleyHorn
Housing Needs BAE Urban Economics $400,000 Assessment Hatch Fiscal Impact Analysis Keyser Marsten $400,000 BAE Urban Economics Design Review Raimi and Associates $300,000 Michael Baker International Engineering Review CSG $750,000 Analysis KimleyHorn
TranspOliation Hexagon TranspOliation Consultants, Inc. $750,000 Consultant '" TJKM TranspOliation Consultants General Consultant Raimi and Associations $100,000 Services TOTAL $5,950,000

3.2.b
Packet Pg. 23
Attachment: Resolution #5142 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications) RESOLUTION NO. 5166

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE CITY MANAGER TO EXECUTE MASTER CONSULTANT CONTRACTS WITH 4LEAF AND WC3 TO SUPPORT THE CITY WITH

PROCESSING OF DEVELOPMENT APPLICATIONS
WHEREAS, the City of East Palo Alto Community and Economic Development Department ( CEDD) will be experiencing a significant increase in development review activity in the coming years, exceeding the current CEDD and Public Works (PW) staffing capacity; and
WHEREAS, the CEDD and PW Departments have expressed the urgent need to address current development project application demand and comply with critical State mandates by entering into developer -reimbursed professional services agreements; and WHEREAS, on July 2, 2019, the City Council adopted Resolution No. 5142 authorizing the City Manager to execute up to $ 5, 950,000 in Master Consulting Contracts and seek reimbursement from project applicants for such contract consulting services through Developer Reimbursement and/or Master Fee Reimbursement Agreements; and WHEREAS the City Council, via Resolution No. 5142 also authorized the City Manager to issue a Request for Qualifications (RFQ) to qualify up to two (2) consultant Finns for building plan review and inspection services, with a deadline for submissions set at 12: 00 P.M. on August 2, 2019; and
WHEREAS, a panel of City staff evaluated the Statements of Qualifications received from four (4) consulting firms and deemed two (2) firms most qualified through the evaluation process; and

3.2.c
Packet Pg. 24
Attachment: Resolution #5166 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to:

1. Establish a contract limit of $750,000 for building plan review and inspection services and waive the forriial bid procedures pursuant to East Palo Alto Municipal Code section 2. 84.070(D) for said contracts;

2. Execute Master Consulting Contracts for building plan review and inspection services with 4Leaf and WC3, and

3. Utilize Developer Reimbursement Agreements, and master Fee Reimbursement Agreements, in a form approved by the City Attorney, to establish terms of reimbursement for building plan review and inspection services until June 30, 2022.

PASSED AND ADOPTED this 17th day of September 2019 by the following vote:

AYES: GAUTHIER, WALLACE-JONES, ABRICA, ROMERO, MOODY
NOES: NONE
ABSENT: NONE
ABSTAIN: NONE
James Colin, Interim City Clerk
APPRO
Rafael E.

AS TO FORM:
varado, fir., City Attorney

3.2.c
Packet Pg. 25
Attachment: Resolution #5166 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

3.2.d
Packet Pg. 26
Attachment: Resolution #5202 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

3.2.d
Packet Pg. 27
Attachment: Resolution #5202 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications) RESOLUTION NO. 64 — 2021

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE CITY MANAGER TO EXECUTE AMENDMENTS TO MULTIPLE MASTER

CONSULTANT CONTRACTS TO SUPPORT THE CITY WITH PROCESSING OF DEVELOPMENT

APPLICATIONS
WHEREAS, the City of East Palo Alto Community and Economic Development (" CEDD") and Public Works (" PW") Departments are and will be experiencing a significant increase in development review activity over the next 2. 3 years, exceeding the current CEDD and PW staffing capacity; and WHEREAS, the CEDD and PW Departments have expressed urgent need to address cu rrent development project application demand and comply with critical state mandates by entering into developer -reimbursed professional services agreements; and WHEREAS, on April 2, 2019, the City Council directed staff to issue a Request for Qualifications RFQ") for consulting services to support the City of East Palo Alto (" City") with processing development applications; and
WHEREAS, on April 5, 2019, staff released an RFQ to the City's preapproved lists of firms for the following services: designated contract planner; environmental review analysis; housing needs assessment; fiscal impact analysis; design review; engineering review analysis; transportation
consultant; and
WHEREAS, a total of fifteen firms responded to the City's RFQ, in most cases responding to multiple service areas, resulting in a total of thirty-six submitted proposals; and WHEREAS, members of the CEDD and PW Departments evaluated each proposal based on the scoring system outlined in the RFQ and identified top scoring respondents in each service category; and
WHEREAS, staff seeks to improve the City's process of reviewing development applications by utilizing Master Consultant Contracts, Developer Reimbursement Agreements, and Master Fee Reimbursement Agreements; and
WHEREAS, staff identified consultants to assist with building plan review services also will be required over the next 2- 3 years to improve processing of development applications.

WHEREAS, the City Council Resolution No. 5142 authorized the City Manager to issue a RFQ to qualify up to two consultant firms for building plan review and inspection services; and WHEREAS, on July 2, 2019, the City Council adopted Resolution No. 5142 authorizing the City Manager to execute up to $ 5, 950,000 in Master Consulting Contracts and seek reimbursement from project applicants for such contract consulting services through Developer Reimbursement and/or Master Fee Reimbursement Agreements; and

3.2.e
Packet Pg. 28
Attachment: Resolution #64-2021 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications) WHEREAS, City staff identified that some of the Master Consulting Contracts need to be further extended in order to address increases in development review activity over an additional two years, exceeding the current CEDD and PW staffing capacity.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to:

1. Execute amendments in Master Consulting Contracts with a total of $9,275,000 for professional services, in a form to be approved by the City Attorney, with the recommended consultants by service category and contract limits listed in Exhibit A to this Resolution and waive the formal bid procedures pursuant to East Palo Alto Municipal Code section 2. 84.070( D) for such contracts; and

2. Delegate authority to the City Manager until June 30, 2024, to utilize Developer Reimbursement Agreements, and Master Fee Reimbursement Agreements, in a form approved by the City Attorney, to establish terms of reimbursement for professional services and other allowable costs incurred related to development applications.

PASSED AND ADOPTED this 18t" day of May 2021 by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

ATTEST:

Abrica, Gauthier, Lopez, Wallace -Jones, and Romero
Carlos Romero, Mayor
APPROVED AS TO FORM:

Walfred olorzano, ity Clerk Rafael E.
2of3
o, Jr. City Attorney

3.2.e
Packet Pg. 29
Attachment: Resolution #64-2021 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications) Exhibit A
Service Category Consultant Firms
Current Amendme New
Total nt Total
Rincon Consultants
Designated Co
Michael Baker 750,000 750,000
Planner
International
Environmental I•
David J. Powers
2, 500,000
EMC Planning Group
1, 250,000 3, 750,000
Analysis
Kimley Horn
Housing Needs BAE Urban Economics
400,000 4007000
ssessment Hatch Associates
Keyser Marston
Fiscal Impact
Associates 4007000 400,000
nalysis
BAE Urban Economics
Raimi and Associates
Design Review Michael Baker 300, 000 150,000 450,000
International
Engineering Review CSG Consultants
750,000 375,000 1, 125,000
Analysis Kimley Horn
Transportation Hexagon Transportation
7507000 7507000
Consultant TJKM Transportation
General Consultant
Raimi and Associations 100, 000 50,000 150,000
Services
TOTAL 5, 950,000 19825,000 79775,000
3of3

3.2.e
Packet Pg. 30
Attachment: Resolution #64-2021 (2256 : Revisions to Master Consultant Agreements for Processing Development Applications)

CITY OF EAST PALO ALTO

OFFICE OF THE CITY MANAGER
2415 UNIVERSITY AVENUE
EAST PALO ALTO, CA 94303
Policy & Action
Item: #14B
City Council Agenda Report
Date: July 2, 2019
To: Honorable Mayor and Members of the City Council
Via: Jaime M. Fontes, City Manager
From: Sean Charpentier, Assistant City Manager
Patrick Heisinger, Community Development Director
Subject: Proposed Process Improvements and Approval of $5.95 Million in Pass Through Master Consultant Contracts to Support the City with Processing Development Applications
(Note: Continued from June 18, 2019 City Council meeting. No changes made to staff report).

Recommendation

1. Accept the Report on proposed process improvements to the City’s review of development applications.

2. Adopt a Resolution authorizing the City Manager to:
a. Execute a total of $5,950,000 in Master Consulting Contracts for professional services with the recommended consultants by service category and contract limits listed in Exhibit A to this Resolution and waive the formal bid procedures pursuant to East Palo Alto Municipal Code section 2.84.070(D) for said contracts; b. Delegate authority to the City Manager, until June 30, 2022, to utilize Developer Reimbursement Agreements, and Master Fee Reimbursement Agreements, in a form approved by the City Attorney, to establish terms of reimbursement for professional services and other allowable costs incurred related to development applications; and
c. To issue a Request for Qualifications (RFQ) to identify up to two consultants to help the City with building plan review services.

Alignment with City Council Strategic Plan
M
203

3.2.f
Packet Pg. 31
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing This recommendation is primarily aligned with:
x Priority #3: Increase Organizational Effectiveness and Efficiency x East Palo Alto Affordable Housing Strategy
Background
The City’s Community and Economic Development (CEDD) and Public Works (PW) Departments will be experiencing a significant increase in development review activity over the next 2-3 years, exceeding the current CEDD and PW staffing capacity. To prepare planning and environmental documents necessary to review and prepare development applications, the City requires outside planning firms. Current and anticipated development proposals are described in Attachment 1, the Planning Workplan.

The City is currently processing 6 EIRs and two Negative Declarations. The City used the traditional RFP and contract award to select planning consultants for this work.

On October 4, 2016 the City Council authorized City staff to release an RFP for technical services for four projects, as well as to update the Community Development Department list of approved vendors. On January 17, 2017, the City awarded $954,282 in contracts for three EIRs (Sobrato Phase II, Bay Road 2020, The Primary School) and two negative declarations (EPA Arts Center and the Oxford Day Academy). Including preparation time for the RFP, the City required approximately 5 months to recruit CEQA and planning consultants. Also on January 17, 2017, the City Council adopted Resolution No. 4814, which established a qualified list of consultants. The City has been utilizing this qualified list of consultants for preparation of planning applications.

In September 2018, the City Council authorized City staff to issue an RFQ to the qualified list of planning consultants for the following projects:

TABLE 1
Anticipated Projects Requiring Environmental Review
Project Project Description
1 965 Weeks 150-unit affordable housing project
2 Four Corners Hotel 160 Unit Hotel project
3 University Circle Phase II 180,000 square foot office 4 Schembri Lane 8-12 unit affordable housing project
5 Affordable Housing Project #5 Conceptual housing project 6 Affordable Housing Project #6 Conceptual housing project 7 Office Project 100,000 sq. ft. Job Train/Ravenswood Clinic 204

3.2.f
Packet Pg. 32
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing On February 19, 2019, the City Council held a discussion regarding the expected growth in new and future development review activity. To allow the City to respond to the impending expansion in development activity without impactful project delays, staff introduced two potential complementary strategies: 1) implementation of staff efficiencies in development review processing by entering into Master Consultant Contracts (MCC) for professional services; and 2) consideration of supplemental staffing through Developer Reimbursement Agreements (DRA) with developers.

On April 2, 2019, the City Council awarded $944,768 to David J. Powers and $484,818 to EMC Planning to prepare planning documents for the projects listed in Table 1. This recruitment required approximately 6 months. The City time to secure planning and CEQA consultants has taken months because these are complicated projects, the Planning Dept. has experienced over 50% vacancies, and the Planning Dept was focused on the Development Code.

Also, on April 2, 2019 Council directed staff to issue an RFQ to identify consultants to assist with processing planning applications for the following projects:
x Proposed Office project at Jones Mortuary location (EIR) x Sandhill Euclid proposal for 600+ apartments’ (EIR)
x Sycamore Master/Site Plan
x Future projects, to be determined
This was a comprehensive RFQ that was intended to identify all consultants necessary for the City to process the significant increase in development applications for the next 2-3 years. The RFQ was sent only to firms that were on the qualified list approved by the City Council in January 2017.

The City’s RFQ sought the following services:
x Designated Contract Planner
x Environmental Review Analysis
x Housing Needs Assessment
x Fiscal Impact Analysis
x Design Review Services
x Engineering Review Analysis
x Transportation Consultants
x Arborist Services1

1 The City only received one proposal for Arborist services and therefore will be issuing a subsequent RFQ to identify consultant(s) for this service.
205

3.2.f
Packet Pg. 33
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing While adding consultant services is an important tool for staff, it is also critical that the City adopt solutions for improving processes and maximizing staff capacity whenever appropriate.

During past discussions, the City Council appeared generally supportive of staff’s recommendations for creating an effective response to the current level of development interest. Staff committed to returning to City Council with a more in-depth discussion of processes and procedures that will ensure the City receives all allowable and applicable reimbursements for development activity, and also processes applications in a timely and efficient manner. The purpose of this memorandum is to provide information regarding staff’s proposed approach and seek City Council approval of consultant contracts for processing development applications in each service category.

Analysis
A total of fifteen (15) firms responded to the City’s RFQ. Since respondents were allowed to apply in more than one service category, the City received and reviewed 34 separate proposals. Attachment 2 details the Respondents’ Scores by Service Category.

Improving the Contracting Process for New Planning Applications To maximize efficiency of the City’s development review process, thus improving the City’s capacity and effectiveness in processing development applications and ensuring full cost recovery, staff recommends that the City Council delegate authority to the City Manager to: 1) execute Master Consultant Contracts (MCCs) in seven technical areas, as well as general consultant services; and 2) execute Developer Reimbursement Agreements (DRAs) to process more complex projects.

Master Consultant Contracts
A Master Consultant Contract (MCC) is an agreement between the City and a list of contractors selected by City Council to provide consultant services on an as needed basis.

Upon receipt of a planning application, staff would determine which MCCs must be utilized to process each application. This approach differs from the City’s Purchasing Ordinance (East Palo Alto Municipal Code, Chapter 2.84) which requires formal or informal bids for professional services for each specific scope of work, using a mechanism such as a Request for Proposals (RFP), for each technical service needed to process the application. Complex planning applications may require multiple consultant services and, therefore, multiple RFP processes. Each consultancy for a single development project must also be brought to City Council for review and approval in succession, adding significant time and duplication to the process. 206

3.2.f
Packet Pg. 34
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing By delegating authority to the City Manager to execute MCCs with consultants for technical expertise, development applications will then be processed in a more efficient manner. Staff will be able to access MCCs not only for the currently known projects, but also for projects that emerge in the near future, without delays associated with limited capacity and repeated City Council actions. Therefore, the City Manager recommends that the Council waive the bid procedures based upon these special circumstances.

While staff facilitates the work of consultants to ensure that the resultant product meets the City’s needs, the costs associated with these consultant contracts are wholly funded by the developer. For this reason, the General Fund is not impacted by the implementation of MCCs.

Establishing Maximum Contracting Authority
Over the next 2-3 years, staff estimates that contracting authority will be needed in several key service categories to process the expected volume of development applications. Staff seeks contracting authority in amounts greater than the sum of currently known projects in order to anticipate development applications that may be received within the next 2-3 years. Draft estimated costs associated with the technical services (by category) that each currently known development project is likely to require are provided in Attachment 3.

Staff recommends that the City Council authorize the City Manager to enter into contract with selected firms in the following service categories and at the following contract limits, as detailed in Table 2, below:

TABLE 2
Service Category Total Contract Category Limit No. of Firms Contract Planning $750,000 2
Environmental Review $2,500,000 3
Housing Needs Assessment $400,000 2
Fiscal Impact Analysis $400,000 2
Design Review $300,000 2
Engineering Review Analysis $750,000 2
Transportation Consultant $750,000 2
General Consultant Services $100,000 1
The results of the RFQ and staff’s recommendations regarding selection of specific firms within each service category is subject to City Council review and approval. Staff has the experience and expertise to effectively utilize consultants to help process development applications. Since the start of 2018, staff has managed multiple contracts for environmental work totaling approximately $2.7M and contracts for designated planning 207

3.2.f
Packet Pg. 35
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing services totaling $646,000.

The proposed contract amounts for each service category being requested would provide ample resources for staff to process the current pipeline of projects as well as other developments for which a Planning Application has yet to be submitted to the City.

The City has predevelopment applications from the developers for the proposed Office Project at the Jones Mortuary and Woodland Park’s proposal for 600 apartments. Staff also anticipate a predevelopment application from Harvest Properties, which is proposing a commercial project on the former Catalytica and Torres properties. Staff will use this new process for these three projects, and then additional planning projects as the applications are submitted.

Developer Reimbursement Agreements
For a development project of large scale, it is appropriate and prudent to request the developer to provide funding upfront to a) ensure that sufficient staff and consulting resources are in place to do work related to the development without detracting from other priorities, and b) to enable departments to anticipate and plan their work and staffing.

A Developer Reimbursement Agreement (DRA) would be a pass-through arrangement in which a developer consents to pay the City the full cost for a dedicated project planner and other consultant services necessary to complete the review and processing of that developer’s planning application. In addition, the DRA would require the developer to pay an administrative fee of up to 10% of the sum of all project-related consulting costs.

The administrative fee will compensate for the City’s overhead costs in staff time to review, process, and seek Planning Commission and/or City Council approval of a project. An example DRA is provided in Attachment 4.

Major projects that require City Council action, an Environmental Impact Report (EIR), other contract services, and a major investment of staff resources, typically demand the use of a contract planner and other consultants. For these projects, staff recommends the City and developer enter into a DRA, which would then allow the City to initiate all necessary reviews simultaneously using MCCs and dramatically reduce the duration of the entitlement process and impact to staff. The approach of using DRAs ensures full cost recovery of staff time dedicated to processing development applications.

Less complex projects may not utilize the DRA process, but staff would still access MCCs for any technical analysis that is required, and the majority of the planning work would be handled in-house by the City’s Planning staff. For these projects, the 208

3.2.f
Packet Pg. 36
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing application would be subject to the City’s customary Master Fee Reimbursement Agreement (MFRA)2
. However, there may be instances in which a developer and the City mutually agree to enter into a DRA for any project, including those of smaller size and lesser complexity, because the approach would be advantageous to the City in managing workload. An example of an MFRA is provided in Attachment 5.

Prioritization of Development Application Processing
Utilization of a DRA process does not alter the order in which a development application is reviewed nor when a project will be considered for approval. The City Council and City staff make these determinations as each project moves forward.

RFQ Results
Staff from the City’s CEDD and PW Departments reviewed and scored each proposal.

The top respondents, by service category, are outlined in Table 3, below:

TABLE 3
Service Category Highest Scoring Respondents Recommended Total Category Award
Designated Contract
Planner
x Rincon Consultants, Inc.
x Michael Baker International x $750,000
Environmental
Review Analysis
x Powers
x EMC Planning Group
x Kimley Horn
x $2,500,000
Housing Needs
Assessment
x BAE Urban Economics
x Hatch x $400,000
Fiscal Impact
Analysis
x Keyser Marsten
x BAE Urban Economics x $400,000
Design Review x Raimi and Associates
x Michael Baker International x $300,000
Engineering Review
Analysis
x CSG
x Kimley Horn x $750,000
Transportation
Consultant
x Hexagon Transportation Consultants, Inc.
x TJKM Transportation Consultants x $750,000
General Consultant
Services
x Raimi and Associates
x $100,000
TOTAL $5,950,000
2 With MFRA’s, in addition to the consultant services needed to process a specific development application, the City will also track and invoice the Developer for all City staff hours devoted to the project at the rate of $232 per hour. 209

3.2.f
Packet Pg. 37
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing For maximum flexibility, staff recommends that the contract amount with each firm be set at the maximum not-to-exceed value for the service category. The following example demonstrates how the maximum contract amount and service category contract limit would be implemented:
x Staff recommends that the City enter into contract with three firms for Environmental Review Analysis and establish the not-to-exceed value of each contract at $2.5 M. x If a development application requires Environmental Review Analysis, staff would be able to issue up to $2.5 M in pass-through agreement capacity to process the review through any of the approved consultants.
x Staff will monitor the expenditures from all three consultants to ensure the total sum of all contracted Environmental Review Analysis does not exceed $2.5 M. x Staff recommends a three year term for this authority.

Using this process will reduce the amount of time required to secure necessary consultant services to review planning applications. By contrast, issuing an RFP to the City’s approved qualified list, reviewing the proposals, and then securing City Council approval requires months, and must be repeated for each service associated with a single application. This proposed process will reduce the amount of transactional time so that the City and community may begin the important review of each project.

General Consulting Services
In addition to the specific service categories described above, staff recommends that a general consulting services contract also be issued to provide support as needed. Raimi and Associates has been selected in the Design Services category, and staff recommends a supplementary award for general consulting services in an amount not-to-exceed $100,000. The City utilized Raimi and Associates to assist with the passage of Vista 2035 – East Palo Alto General Plan. Raimi and Associates possesses deep knowledge of the City, the General Plan, the complexities of the Westside. The costs of the Raimi and Associates agreement would also be funded by developers.

Building Plan Review Assistance
When staff issued the RFQ for consulting services, the service category of Building Plan Review was not included. At this time, staff seeks City Council approval to issue an RFQ to identify two consultants who may provide building plan review services to help process current and future planning applications. The results of the RFQ and staff’s recommendations regarding selection of specific firms will be subject to City Council review and approval.
210

3.2.f
Packet Pg. 38
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing Follow-up
Staff will provide the City Council with periodic updates on all development activity as part of the Semi-Annual Community and Economic Development Department Activity Report. Staff recommend delegating the authority to the City Manager until June 30, 2022 to account for the three years in which the staff anticipates the most projects coming in.

Fiscal Impact
There is no net fiscal impact. The City will enter into reimbursement agreements for all CEQA related professional services and other allowable costs incurred in relation to private development applications. Such activity is often referred as “Pass Through” development revenues and expenditures. It is anticipated this activity will be accounted in a Development Services Enterprise Fund beginning in FY 2019-20.

Public Notice
The public was provided notice of this agenda item by posting the City Council agenda on the City’s official bulletin board outside City Hall and making the agenda and report available at the City’s website and at the San Mateo County Library located at 2415 University Avenue, East Palo Alto.

Environmental
The items discussed in this memorandum are not considered a project under the provisions of the California Environmental Quality Act (CEQA) Attachments:

1. Planning Workplan

2. Respondents’ Scores by Service Category

3. Anticipated Consultant Services and Cost by Project (Draft Estimates)

4. Example Developer Reimbursement Agreement (DRA)

5. Example Master Fee Reimbursement Agreement (MFRA)

6. Resolution
Exhibit A – Recommended Consultant Award by Service Category and Contract Limit
211

3.2.f
Packet Pg. 39
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing ATTACHMENT 1

PLANNING WORKPLAN

TASK FTE
Year 1
FTE
Year 2 CEQA STATUS PROJECT

MANAGER

1. Core Planning Activities
Planning Counter Support 1.5 1.5 NA City Staff
Mobility Study Support 0.1 0.1 NA City Staff
Engineering Dept Support 0.1 0.1 NA City Staff
Flood Prevention (CRS Program) & FEMA PPI 0.15 0.15 NA City Staff Second Unit Task Force/Garage Conversion Group 0.1 0.1 NA City Staff Review of Outside Agencies EIRs 0.1 0.1 NA City Staff
Support to Code Enforcement Division 0.25 0.25 NA City Staff 20 percent Contingency Staff Planning 0.2 0.2 NA City Staff Subtotal 2.5 2.5

2. Priority or Significant Projects
EPACenter Arts-DB-MND 0.05 0.05 Existing DJP City Staff Sobrato Phase II, 220,000 Office Project-EIR 0.5 0.1 Existing DJP Contract Planner-Ami Primary School 511 student school-EIR 0.25 0.1 Existing DJP City Staff Romic 1.4 million square feet office-EIR 0.45 0.45 Existing DJP Contract Planner-Ami Light Tree Apartments 185 Apartment Units 0.05 0.05 Existing EMC City Staff 2331 University Mixed Use Project 30, 000sf 0.1 0.1 City Staff 1st Tier Smaller Permits Impacted by Water Moratorium
(30+ units) 0.3 0 In House City Staff
Mobile Home Park Conversion 0.15 0.15 NA City Staff
Subtotal 1.85 1

3. Anticipated Projects Requiring Environmental Review
965 Weeks (150 affordable Units) 0.15 0.15 Awarded 4/2/19 EMC City Staff Four Corners Hotel 160 unit new hotel-EIR 0.25 0.35 Awarded 4/2/19 DJP City Staff University Circle Office Tower 180,000 sf 0.25 0.35 Awarded 4/2/19 DJP Contract Planner-Art Schembri 8-12 units, 2 other affordable housing projects 0.1 0.1 Awarded 4/2/19 EMC City Staff Affordable Housing Project #5 0.15 0.15 Awarded 4/2/19 EMC TBD Affordable Housing Project #6 0.15 0.15 Awarded 4/2/19 EMC TBD 100,000 Office Project in RBD for JobTrain/Ravenswood
Clinic-EIR 0.25 0.25 Awarded 4/2/19 DJP Contract Planner-Ami Subtotal 1.3 1.5

4. New and Future Projects
Woodland Park Sand Hill Properties Master Plan Project
600 new residential units at 2031 Euclid-EIR 0.25 0.25 Proposed MCC 6/18/19 Contract Planner-TBD Jones Mortuary – EIR 0.25 0.25 Proposed MCC 6/18/19 Contract Planner-TBD Sycamore Properties Master Plan Project (Undetermined) 0.25 0.25 Proposed MCC 6/18/19 Contract Planner-TBD Subtotal 0.75 0.75
Total FTES 6.4 5.75
Authorized FTES 4 4
Surplus/(Deficit) -2.4 -1.75
Existing Contract Planners (Art and Ami) 0.8 0.8
Surplus/(Deficit) -1.6 -0.95
212

3.2.f
Packet Pg. 40
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing ATTACHMENT 2
RESPONDENTS’ SCORES BY SERVICE CATEGORY
Service Category Respondents Score
Designated Contract Planner
Rincon Consultants, Inc. 91
Michael Baker International (MBI) 90
EMC Planning Group 88
M-Group 86.7
CSG 86.3
Raimi 85.7
Kimley Horn 82
Environmental Review
Analysis
Powers 92.3
EMC Planning Group 88.7
Kimley Horn 87.7
Rincon Consultants, Inc. 86.7
M-Group 86.3
Michael Baker International (MBI) 84.3
Housing Needs Assessment
BAE Urban Economics 91
Hatch 87.7
Michael Baker International (MBI) 82.7
Fiscal Impact Analysis
Keyser Marston 93.7
BAE Urban Economics 90.3
Hatch 89.7
Strategic Economics 86
Kimley Horn 67.3
Michael Baker International (MBI) 67.3
Design Review
Raimi 91.3
Michael Baker International (MBI) 87.3
CSG 86
EMC Planning Group 85.7
Engineering Review
Analysis
CSG 93.3
Kimley Horn 84.7
Michael Baker International (MBI) 82.3
Transportation Consultant
Hexagon Transportation Consultants, inc. 93.3
TJKM Transportation Consultants 87.7
Michael Baker International (MBI) 87
Kimley Horn 85
213

3.2.f
Packet Pg. 41
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing ATTACHMENT 3
Anticipated Consultant Services and Cost by Project (Draft Estimates) 214

3.2.f
Packet Pg. 42
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing ATTACHMENT 4

DRAFT FORM OF A DEVELOPER REIMBURSEMENT AGREEMENT
(Subject to City Council approval for
assignment of a contract planner and outside consultant services) THIS DEVELOPER REIMBURSEMENT AGREEMENT (“Agreement”), dated _____________, ____, between the CITY OF EAST PALO ALTO, a municipal corporation (“City”), and [______________________________________________________________________] (“Developer”), is made with reference to the following facts:

A. The Developer has submitted a planning application for [_________________________] (“Project”] and, as such, the Developer desires to enter into this Agreement with City.

B. The Developer desires to obtain the services of an outside Contract Planner to provide dedicated project management services to facilitate and reduce delays in processing the Developer’s Project.

C. The Developer also acknowledges that in order to process the Developer’s Project, the City needs to obtain other outside consultant services, including planning, environmental, engineering, transportation, economic and/or legal services.

D. The Developer agrees to enter into this Agreement to reimburse the City for costs associated with a contract planner, consultant services and staff costs that are not covered in the City’s Master Fee Schedule.

NOW, THEREFORE, the parties agree as follows:

1. Establishment of Reserve Account. Upon the execution of this Agreement, Developer shall deposit with City the sum of [minimum 25 percent deposit] to be held by City as a Reserve Account and disbursed from time to time in accordance with the terms of this Agreement. City shall keep separate records of the Reserve Account, showing all deposits made by Developer and all disbursements from the account made by City, and such records shall be available to Developer for inspection at any time during City’s regular business hours. However, City shall not be required to segregate the Reserve Account into a separate fund and no interest shall accrue thereon.

2. Reimbursement Obligations. City shall draw upon the Reserve Account to pay all actual costs, fees, and expenses incurred by City in connection with processing Developer's Project, including but not limited to:
a. Contract Planner Services. Developer shall reimburse City for all actual costs, fees, and expenses for any work or services performed or provided by an outside contract planner (on a time and materials basis at an agreed upon 215

3.2.f
Packet Pg. 43
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing hourly rate) relating to processing Developer’s Project. While the City has sole and exclusive right to select a contract planner, the City will consult with Developer prior to selection.
b. Contract Services. Developer shall reimburse City for all actual costs, fees, and expenses for any other outside contract work or services including engineering, planning, environmental and legal services related to processing Developer’s Project. Contract services may also include, but are not limited to, fiscal impact analysis, housing impact assessment, design review, and additional transportation services.

3. Estimate. Exhibit A provides an estimate of anticipated staff and contract services, including the estimated cost for a contract planner. This estimate is not definitive and, as the Project evolves, City will confer with Developer regarding additional or revised services, as needed. Notwithstanding any other provision of this Agreement, the City shall have the sole and exclusive right to select, hire, or terminate any consultant.

4. Administrative Fee. In lieu of collecting any applicable administrative processing fees in the City’s Master Fee Schedule, Developer shall reimburse City an administrative fee equal to ten (10) percent of the total estimate shown in Exhibit A to cover City staff cost to administer and manage the outside consultants and contracts that are required for the Project. The administrative fee shall cover inter-departmental costs including, but are not limited to, the Community and Economic Development, Public Works and Finance Departments, City Attorney’s Office, and City Manager’s Office.

5. Reports to Developer and Reinstatement of Reserve Account. City shall provide a quarterly report to Developer showing the amount and purpose of each draw from the Reserve Account. If, at any time, the Reserve Account balance is reduced below the sum of Twenty Five Thousand Dollars ($25,000), City shall give written notice of such fact to Developer and Developer shall, within twenty (25) days after receipt of such notice, deposit with City such additional amounts as may be necessary to restore the balance of the Reserve Account to [amount established with each contract based on Exhibit A]. In the event of any failure or refusal by Developer to deposit such additional amounts, the City may impose a late charge in the amount of [flat fee or a percentage of the initial deposit]. Furthermore, City shall be entitled to suspend all further activities pursuant to section 10 below until such time as the parties have settled any dispute.

6. Termination of Agreement. Upon completion of Project approvals, withdrawal of the application by the Developer, or termination of the Agreement, any balance remaining in the Reserve Account after payment in full of all costs and expenses owed to the City under the terms of this Agreement, shall be refunded to Developer within 45 days.

7. Notices. Any notices required or permitted to be given hereunder shall be in writing and shall be delivered via email to the email addresses listed below and either personally 216

3.2.f
Packet Pg. 44
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing delivered or sent by certified mail, return receipt requested, to the other party at the following addresses:

To Developer: To City:

8. Entire Agreement. This Agreement constitutes the entire agreement between the parties with regard to the payment of costs associated with processing of permit applications and supersedes and cancels any prior agreement or understandings, whether written or oral. This Agreement can only be modified by a written amendment hereto executed by both parties.

9. Authorization. The person signing this Agreement for Developer hereby represents and warrants that he/she is fully authorized to sign this Agreement on behalf of the Developer.

10. Suspension or Cessation. City may, in its sole discretion, suspend or cease processing the Developer’s Project and shall have no obligation to incur any additional fees, costs, or expenses if: (i) Developer fails to timely replenish the Reserve Account in accordance with this Agreement, (ii) Developer otherwise breaches the terms of this Agreement, or (iii) the City terminates this Agreement.

11. Indemnity. Developer agrees, to the fullest extent authorized by law, to defend, hold harmless, and indemnify City and its elected and appointed officials, officers, employees, and agents from and against all claims, liability, costs, expenses, loss, or damages of any nature, including reasonable attorneys’ fees, arising out of or in any way connected to Developer’s failure to perform its obligations under this Agreement, excluding the willful misconduct or gross negligence of City.

IN WITNESS WHEREOF, the parties have executed this Agreement the day and year first above written.

THE CITY OF EAST PALO ALTO, [___________Developer__________] a municipal corporation
By: ______________________________ By: _____________________________ City Manager
ATTEST: APPROVED AS TO FORM:

By: _______________________________ By: _______________________________ City Clerk City Attorney
217

3.2.f
Packet Pg. 45
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing ATTACHMENT 5

DRAFT FORM OF A MASTER FEE REIMBURSEMENT AGREEMENT
(City Manager authorization for outside consultant services) THIS MASTER FEE REIMBURSEMENT AGREEMENT (“Agreement”), dated _____________, ____, between the CITY OF EAST PALO ALTO, a municipal corporation (“City”), and [______________________________________________________________________] (“Developer”), is made with reference to the following facts:

E. The Developer has submitted a planning application for [_________________________] (“Project”] and, as such, the Developer desires to enter into this Agreement with City.

F. The Developer acknowledges that in order to process the Developer’s Project, the City needs to obtain other outside consultant services, including planning, environmental, engineering, transportation, economic and/or legal services.

G. The Developer agrees to enter into this Agreement to reimburse the City for costs associated with consultant services that are not covered in the City’s Master Fee Schedule.

NOW, THEREFORE, the parties agree as follows:

12. Establishment of Reserve Account. Upon the execution of this Agreement, Developer shall deposit with City the sum of [minimum 25 percent deposit] to be held by City as a Reserve Account and disbursed from time to time in accordance with the terms of this Agreement. City shall keep separate records of the Reserve Account, showing all deposits made by Developer and all disbursements from the account made by City, and such records shall be available to Developer for inspection at any time during City’s regular business hours. However, City shall not be required to segregate the Reserve Account into a separate fund and no interest shall accrue thereon.

13. Reimbursement Obligations. City shall draw upon the Reserve Account to pay all actual costs, fees, and expenses incurred by City in connection with processing Developer’s Project, including but not limited to: Outside contract work or services including engineering, planning, environmental, and legal services related to processing Developer’s Project. Contract services may also include, but are not limited to, fiscal impact analysis, housing impact assessment, design review, and additional transportation services. Notwithstanding any other provisions of this Agreement, the City shall have the sole and exclusive right to select, hire, or terminate any consultant.

14. Reports to Developer and Reinstatement of Reserve Account. City shall provide a quarterly report to Developer showing the amount and purpose of each draw from the Reserve Account. If, at any time, the Reserve Account balance on this account is reduced below 218

3.2.f
Packet Pg. 46
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing the sum of Ten Thousand Dollars ($10,000) [or another amount set by City], City shall give written notice of such fact to Developer and Developer shall, within twenty five (25) days after receipt of such notice, deposit with City such additional amounts as may be necessary to restore the balance of the Reserve Account to [amount established with each contract]. In the event of any failure or refusal by Developer to deposit such additional amounts, the City may impose a late charge in the amount of [flat fee or a percentage of the initial deposit.] Furthermore, the City shall be entitled to suspend all further activities pursuant to section 8 below until such time as the parties have settled any dispute.

15. Termination of Agreement. Upon completion of Project approvals, withdrawal of the application by the Developer, or termination of the Agreement, any balance remaining in the Reserve Account after payment in full of all costs and expenses owed to the City under the terms of this Agreement, shall be refunded to Developer within 45 days.

16. Notices. Any notices required or permitted to be given hereunder shall be in writing and shall be delivered via email to the email addresses listed below and either personally delivered or sent by certified mail, return receipt requested, to the other party at the following addresses:

To Developer: To City:

17. Entire Agreement. This Agreement constitutes the entire agreement between the parties with regard to the payment of costs associated with processing of permit applications and supersedes and cancels any prior agreement or understandings, whether written or oral. This Agreement can only be modified by a written amendment hereto executed by both parties.

18. Authorization. The person signing this Agreement for Developer hereby represents and warrants that he/she is fully authorized to sign this Agreement on behalf of the Developer.

19. Suspension or Cessation. City may, in its sole discretion, suspend or cease processing the Developer’s Project and shall have no obligation to incur any additional fees, costs, or expenses if: (i) Developer fails to timely replenish the Reserve Account in accordance with this Agreement, (ii) Developer otherwise breaches the terms of this Agreement, or (iii) the City terminates this Agreement.

20. Indemnity. Developer agrees, to the fullest extent authorized by law, to defend, hold harmless, and indemnify City and its elected and appointed officials, officers, employees, and agents from and against all claims, liability, costs, expenses, loss, or damages of any nature, 219

3.2.f
Packet Pg. 47
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing including reasonable attorneys’ fees, arising out of or in any way connected to Developer’s failure to perform its obligations under this Agreement, excluding the willful misconduct or gross negligence of City.

IN WITNESS WHEREOF, the parties have executed this Agreement the day and year first above written.

THE CITY OF EAST PALO ALTO, [___________Developer__________] a municipal corporation
By: ______________________________ By: _____________________________ City Manager
APPROVED AS TO FORM:

By: _______________________________
City Attorney
220

3.2.f
Packet Pg. 48
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing RESOLUTION NO. ___

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EAST PALO

ALTO AUTHORIZING THE CITY MANAGER TO EXECUTE MULTIPLE

MASTER CONSULTANT CONTRACTS TO SUPPORT THE CITY WITH

PROCESSING OF DEVELOPMENT APPLICATIONS
WHEREAS, the City of East Palo Alto Community and Economic Development (CEDD) and Public Works (PW) Departments are and will be experiencing a significant increase in development review activity over the next 2-3 years, exceeding the current CEDD and PW staffing capacity; and WHEREAS, the City of East Palo Alto CEDD and PW Departments have expressed urgent need to address current development project application demand and comply with critical State mandates by entering into developer-reimbursed professional services agreements; and
WHEREAS, on April 2, 2019, the City Council directed staff to issue a Request for Qualifications (RFQ) for consulting services to support the City of East Palo Alto with processing development applications; and
WHEREAS, on April 5, 2019, staff released an RFQ to the City’s preapproved lists of firms for the following services: designated contract planner; environmental review analysis; housing needs assessment; fiscal impact analysis; design review; engineering review analysis; transportation consultant; and WHEREAS, a total of fifteen (15) firms responded to the City’s RFQ, in most cases responding to multiple service areas, resulting in a total of 36 submitted proposals; and
WHEREAS, members of the CEDD and PW Departments evaluated each proposal based on the scoring system outlined in the RFQ and identified top scoring respondents in each service category; and
WHEREAS, staff seeks to improve the City’s process of reviewing development applications by utilizing Master Consultant Contracts, Developer Reimbursement Agreements, and Master Fee Reimbursement Agreements; and WHEREAS, City staff identified that two consultants to assist with building plan review services will also be required over the next 2-3 years to improve processing of development applications.

ATTACHMENT 6
221

3.2.f
Packet Pg. 49
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to:

1. Execute a total of $5,950,000 in Master Consulting Contracts for professional services with the recommended consultants by service category and contract limits listed in Exhibit A to this Resolution and waive the formal bid procedures pursuant to East Palo Alto Municipal Code section 2.84.070(D) for said contracts;

2. Delegate authority to the City Manager until June 30, 2022, to utilize Developer Reimbursement Agreements, and Master Fee Reimbursement Agreements, in a form approved by the City Attorney, to establish terms of reimbursement for professional services and other allowable costs incurred related to development applications; and

3. To issue a Request for Qualifications (RFQ) to identify up to two consultants to help the City with building plan review services.

PASSED AND ADOPTED this 18th day of June 2019 by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

SIGNED:

Lisa Gauthier, Mayor
ATTEST: APPROVED AS TO FORM:

Maria Buell, City Clerk Rafael E. Alvarado, Jr. City Attorney 222

3.2.f
Packet Pg. 50
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing

EXHIBIT A

RECOMMENDED CONSULTANT AWARD BY

SERVICE CATEGORY AND CONTRACT LIMIT
Service Category Highest Scoring Respondents Recommended Total Category Award
Designated Contract
Planner
x Rincon Consultants, Inc.
x Michael Baker International x $750,000
Environmental Review
Analysis
x Powers
x EMC Planning Group
x Kimley Horn
x $2,500,000
Housing Needs
Assessment
x BAE Urban Economics
x Hatch x $400,000
Fiscal Impact Analysis x Keyser Marsten
x BAE Urban Economics x $400,000
Design Review x Raimi and Associates
x Michael Baker International x $300,000
Engineering Review
Analysis
x CSG
x Kimley Horn x $750,000
Transportation
Consultant
x Hexagon Transportation Consultants, Inc.
x TJKM Transportation Consultants x $750,000
General Consultant
Services
x Raimi and Associations x $100,000
TOTAL $5,950,000
223

3.2.f
Packet Pg. 51
Attachment: First Approval of MCAs - Staff Report Dated July 2, 2019 (2256 : Revisions to Master Consultant Agreements for Processing Service Category Consultant Firms Agreement Start
Date
Initial Expiration
Date
New Expiration
Date*
Rincon 7/2/2019 6/30/2022 6/30/2024
Michael Baker 7/2/2019 6/30/2022 6/30/2024
David J. Powers 7/2/2019 6/30/2022 6/30/2024
EMC Planning 7/2/2019 6/30/2022 6/30/2024
Kimley Horn 7/2/2019 6/30/2022 6/30/2024
BAE 7/2/2019 6/30/2022 6/30/2024
Hatch 7/2/2019 6/30/2022 6/30/2024
BAE 7/2/2019 6/30/2022 6/30/2024
KMA 7/2/2019 6/30/2022 6/30/2024
Raimi & Associates 7/2/2019 6/30/2022 6/30/2024
Michael Baker 7/2/2019 6/30/2022 6/30/2024
CSG 7/2/2019 6/30/2022 6/30/2024
Kimley Horn 7/2/2019 6/30/2022 6/30/2024
Hexagon 7/2/2019 6/30/2022 6/30/2024
TJKM 7/2/2019 6/30/2022 6/30/2024
General Consulting Raimi & Associates 7/2/2019 6/30/2022 6/30/2024 WC3 7/2/2019 6/30/2022 6/30/2024
4Leaf 7/2/2019 6/30/2022 6/30/2024
Contract Planning (Currently for Four RBD Projects, Two West Side Projects) Good City Company 7/21/2020 7/20/2023 - Building Plan Review, Inspection & Support Services (Post-Entitlement) WC3 12/17/2019 6/30/2022 6/30/2024 Consolidated List of Master Consultant Agreements (MCA's) Pre-Entitlement
Designated Contract Planning
Environmental Review
Housing Needs Assessment
Design Review
Fiscal Impact Analysis
Engineering Review Analysis
Building Plan Review & Inspection (Pre-Entitlement)
Transportation Consultant
*New Expiration Date reflects a two-year contract term extension for the majority of Master Consultant Agreements and the Consultant Agreement (Building Plans Review).

The New Expiration Date does not reflect the option to extend for up to two (2) additional six-month extensions.

Consultant Agreement for Post-Entitlement Services

3.2.g
Packet Pg. 52
Attachment: Consolidated List of Agreements with Expiration Dates (2256 : Revisions to Master Consultant Agreements for Processing

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Patrick Heisinger, Interim City Manager
BY: Elena Lee, Planning Manager
Humza Javed, City Engineer
SUBJECT: TDM Program Administration Contract
Recommendation
It is recommended that the City Council adopt a Resolution authorizing the City Manager to execute a consultant contract for Transportation Demand Management program administration with Cities21, in the amount of $121,300 for a term of three years and one six-month extension.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 2: Enhance Economic Vitality
Priority No. 3: Increase Organizational Effectiveness and Efficiency Priority No. 4: Improve Public Facilities and Infrastructure Priority No. 6: Create a Healthy and Safe Community
Background
In 2017, the City Council identified updating the City’s Transportation Demand Management (TDM) ordinance and creating a comprehensive citywide transportation and mobility plan as key priorities.

In October 2020, development of a TDM Program transitioned from the Public Works Department to the Community and Economic Development Department (CEDD). The Public Works Department continues to lead activities related to the Mobility Study. Where needed, CEDD staff work together with Public Works, especially upon implementation of the ordinance.

At the January 26, 2021 City Council study session, City Council provided guidance on the

3.3 Packet Pg. 53
potential TDM ordinance and accepted staff recommendation that the City pursue establishment of a Transportation Management Association (TMA) in East Palo Alto when revising the TDM ordinance.

On June 1, 20211, the City Council adopted a TDM ordinance2requiring specified projects to have approved TDM plans that incorporate measures to reduce vehicular trips. The new TDM requirement applies as of January 1, 2022 to new residential and nonresidential development, as well as existing nonresidential development with 100 or more employees.

The TDM program was established for the following purposes:

1. To improve mobility in the city, county and surrounding region by reducing up to 40 percent of vehicle trips;

2. To reduce vehicle emissions, energy use and ambient noise levels as a result of fewer vehicle trips, fewer vehicle miles travelled and reduced traffic congestion; and

3. To implement an effective but flexible program that can adapt when warranted by traffic conditions and demonstrated results of the TDM program.

At the meetings on the TDM ordinance, City Council directed staff to issue a Request for Qualifications (RFQ) to identify an organization to serve as the City’s preferred TMA administrator.

On March 11, 2022, City staff issued an RFQ with a goal to contract with an individual or firm that specializes in the administration and management of TDM Programs and assist the City in maximizing the benefits of TDM strategies. The TDM program coordinator is expected to help develop and implement an effective program that meets the specific needs of East Palo Alto, including both the City and the project applicants. The consultant also would assist the City in developing the appropriate fees for Council approval to help support program cost effectively and to refine the program guidelines.

City staff is engaged with the City/County Association of Governments of San Mateo County (C/CAG) which recommends exploring a partnership with Commute.org. Commute.org informed City staff that it does not have capacity and will not be responding to the RFQ.

Consistent with City Council direction, staff is also exploring TMA as another tool to address traffic concerns, including as part of the Ravenswood Business District Specific Plan Update (RBD). Selection as the City’s TDM program coordinator would not preclude the chosen consultant from submitting a proposal for any future TMA efforts. In addition, the selected TDM coordinator would need to meet all standard City contracting requirements.

This staff report seeks City Council approval to authorize the City Manager to execute a consultant contract with the selected consultant to serve as the City’s TDM program coordinator.
1 See June 1, 2021 staff report for information on the TDM ordinance adoption: http://eastpaloalto.iqm2.com/Citizens/Detail_LegiFile.aspx?Frame=&MeetingID=1400&MediaPosition= 6370.072&ID=1737&CssClass=.
2 See chapter 10.32 of the City’s Municipal
Code: https://library.municode.com/ca/east_palo_alto/codes/code_of_ordinances?nodeId=TIT10VETR_CH10.32T RDEMAPR.

3.3 Packet Pg. 54
Analysis
TDM consultants require both technical knowledge and general program administration skills in order to tailor the program to the needs of the specific jurisdiction and applicants. As of March 30, staff received a total of three bids. The following table summarizes the bid results:

No. Company Name Hourly Rate3
1 ALTRANS Transportation
Management Association, Inc.
• Administrator $113
• TDM Support Staff $75
2 CHS Consulting Group • Administrator $247.50
• Support Staff $126.61
3 Cities21 (Steve Raney) • Administrator (only) $100
Since this iteration of the TDM program is new to EPA, the consultants proposed both a program development startup phase and a program management phase. While all three bidders have extensive experience in TDM program administration in the Bay Area, Cities21 proposal represented the right balance of understanding the needs of the East Palo Alto TDM program and cost. Cities21 is proposing a data-driven, stakeholder focused, transparent and innovative TDM program. The consultant has significant local experience for over 17 years in TDM programs, working with both local municipalities and property owners/tenants. The proposal includes a strong public outreach component, including a robust public engagement and regular updates to the City. Cities21 also has the knowledge to coordinate the City’s TDM ordinance with the new C/CAG TDM policy to ensure full compliance and the most effective TDM plans. CHS Consulting Group had the most complete proposal but was also the highest cost. ALTRANS also had a sufficient proposal, but it did not include the level of detail. For Cities21, City staff performed a full bid review, verified qualifications, license, and checked references. All verifications are satisfactory.

A contract term of three years is proposed, with a one-time six-month extension to provide flexibility. The three years is proposed to enable the initial program set up and implementation, including developing program fees, as well as anticipating that the pending complex applications that will require TDM programs, such as University Circle Phase II. In addition to reviewing TDM programs for new development, the TDM program administrator will also work with large employers to implement TDM programs. Cities21 assumes a total of 1,213 hours over three years will be required, which also assumes that work will adjust depending on the number of active projects. It is expected that the City will initially fund the program development. However, after implementation, it is anticipated the program will be funded by fees paid by property owners. The proposal anticipates while work may fluctuate depending upon the number of TDM programs that need to be reviewed, the consultant will also continue to assess and refine the program, including the program guidelines.

Contingent upon completing all requirements of the contract specifications, staff recommends that the City Council authorize the City Manager to execute a contract for with Cities21 to provide the TDM Program Administration for a cost of up to $121,300 for a period up to three years, with two 6-month extensions built-in if more time is necessary.

Fiscal Impact
3 Staff is using hourly rate as a comparison because the total cost will depend on the number of projects that are approved by the City, which is unknown at this point.

3.3 Packet Pg. 55

The initial cost of forming and implementing the program will be supported by the General Fund. The intent is to fund the program through TDM review fees collected during the entitlement process and annual fees for compliance review afterwards. The monies collected would support the implementation of the TDM program, including staffing. If a TMA is formed, the organizations would be supported by membership dues paid for by the private property owners.

Public Notice
The public was provided notice of this agenda item by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Environmental

Pursuant to California Environmental Quality Act (CEQA) Guidelines section 15378(b)(5), the adoption of an ordinance of general policy does not constitute a “project” in that it is a governmental organizational or administrative activity that will not result in direct or indirect changes in the environment.

Attachments

1. Resolution

3.3 Packet Pg. 56
1 of 2
RESOLUTION NO. ______

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO
AUTHORIZING THE CITY MANAGER TO ENTER INTO A CONTRACT WITH CITIES21 TO PROVIDE

PROGRAM ADMINISTRATION SERVICES FOR THE TRANSPORTATION DEMAND MANAGEMENT (TDM) PROGRAM
WHEREAS, the City of East Palo Alto is experiencing a significant increase in development activity and associated traffic; and
WHEREAS, the City adopted a new TDM Ordinance on June 1, 2021; and WHEREAS, the Ordinance requires a 40% reduction based on weekday average daily trips to both non-residential and residential developments; and
WHEREAS, Section 10.32.050 of the East Palo Alto Municipal Code provides for TDM Program Guidelines (Guidelines) that contain requirements for implementation and administration of the Ordinance; and
WHEREAS, City staff is seeking professional assistance in the development and implementation of an effective TDM program; and
WHEREAS, staff has determined that Cities21 has the necessary experience and capacity to serve as the City’s TDM Program Administrator; and
WHEREAS, on March 31, 2022, the City of East Palo Alto (“City”) received sealed bids that were evaluated by City staff; and
WHEREAS, there were a total of three consultants who submitted bids for the project with Cities21 being the lowest bidder with a bid amount of $121,300; and WHEREAS, City staff performed a bid review, verified qualifications, and checked references for the bidder, and deemed the package satisfactory.

WHEREAS, pursuant to California Environmental Quality Act (CEQA) Guidelines section 15378(b)(5), the adoption of an ordinance of general policy does not constitute a “project” in that it is a governmental organizational or administrative activity that will not result in direct or indirect changes in the environment.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to execute a TDM program administrator consultant contract with Cities21, in a form approved by the City Attorney, in the amount of $121,300 for a term of three years with a possible one-time six-month extension.

3.3.a
Packet Pg. 57
Attachment: Resolution (2247 : TDM Program Adminstration Contract) 2 of 2
PASSED AND ADOPTED this 17th day of May 2022, by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

Ruben Abrica, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, Acting City Clerk Valerie J. Armento, Interim City Attorney

3.3.a
Packet Pg. 58
Attachment: Resolution (2247 : TDM Program Adminstration Contract)

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Patrick Heisinger, Interim City Manager
BY: Rachel Horst, Housing and Economic Development Manager SUBJECT: Grant Agreement with HEART for the Local Housing Trust Fund Program Recommendation
Adopt a Resolution authorizing the City Manager to execute a Grant Agreement with Housing Endowment and Regional Trust of San Mateo County (“HEART”) to provide match funds in the amount of $1,700,000, so that HEART may draw Local Housing Trust Fund Program Funds granted by the Department of Housing and Community Development and provide $3,230,000 to the 965 Weeks Affordable Housing Project in the form of a deferred, 55-year low-interest loan.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 2: Enhance Economic Vitality
Priority No. 6: Create a Healthy and Safe Community
Background
On July 30, 2020, by Resolution No. 105-2020, the City Council directed staff to partner with the Housing Endowment and Regional Trust of San Mateo County (“HEART”) to apply for the Local Housing Trust Fund (“LHTF”), an affordable housing loan program of the Department of Housing and Community Development (“HCD”), to benefit the 965 Weeks affordable housing project (“965 Weeks”), appropriating $1.7 million in required local match funds if awarded. A more detailed breakdown of LHTF and match funds is provided in the July 30, 2020 staff report.

Since the LHTF program requires a local funding match, HCD requires all applicants to show a legally binding commitment of these funds as part of an application for the LHTF. To assist with HEART’s application and show evidence of a City commitment, Resolution No. 105-2020 also authorizes the City Manager to submit a letter evidencing the $1.7M commitment (“Commitment Letter”) and, if the LHTF application is successful, to further negotiate and

3.4 Packet Pg. 59
revise the Commitment Letter with HEART based on LHTF requirements. The City’s Commitment Letter, dated July 30, 2020, is included as Exhibit A to the draft Grant Agreement in Attachment 2.

On March 10, 2021, HEART was awarded $5 million from the LHTF in support of three affordable housing projects in three jurisdictions: East Palo Alto, San Mateo, and Daly City.

The purpose of this staff report is to obtain City Council approval for the City Manager to execute a Grant Agreement with HEART (Attachment 2) to provide $1.7M in match funds as a grant to HEART, so that HEART may draw down funds from the LHTF and provide a loan in the amount of $3.23M to 965 Weeks.

Analysis
Grant Agreement with HEART
The Grant Agreement states HEART will provide a deferred, low-interest, 55-year loan (“Loan”) to the developer of 965 Weeks in the amount of $3.23M. This amount reflects the total of the City grant and LHTF amounts ($3.4M) minus 5% of the total, which HEART will retain as an administrative fee for the program.

As noted in the July 30, 2020 staff report, the $1.7M in City funds will be provided as a grant to HEART for the sole purpose of funding the Loan to 965 Weeks. HCD does not permit loans by member jurisdictions to Regional Housing Trust Funds (e.g., HEART) for the purposes of applying for LHTF. HEART will be named in the Deed of Trust as the sole beneficiary for the Loan amount, meaning that Loan repayments will be made to HEART.

To ensure a long-term benefit to East Palo Alto from the use of City funds, the Grant Agreement commits HEART to restricting 50% of program income from the City’s portion of the LHTF to be used on future affordable housing projects in East Palo Alto. The Grant Agreement further states that the loan terms and regulatory agreement associated with HEART funding for the Project will meet or exceed City requirements for funding affordable housing developments.

Next Steps
As noted above, the $1.7M is provided to HEART in the form of a grant. Funds are made available to an affordable housing project from the Regional Housing Trust Fund (HEART) shortly before the close of the construction loan. However, coordination between HEART, the City, and HCD can take months.

Making the commitment to HEART now ensures that the funds will be on deposit when 965 Weeks approaches this milestone, which is expected in Fall 2023 (assuming application for tax credits in February 2023). Pursuant to the Grant Agreement, HEART must first make a written request to the City to remit the $1.7M, and the City must disburse the funds within 10 days.

Fiscal Impact
As noted in the July 30, 2020 staff report and authorized by Resolution 105-2020, the $1.7M City commitment consists of $500,000 in Measure HH funds and $1.2 million in TOT Affordable Housing funds. These have been encumbered for FY 2022-23 in the Housing Division draft budget.

3.4 Packet Pg. 60
Public Notice
The public was provided notice of this agenda item by making the agenda and report available on the City’s website and on the City’s official bulletin board located outside City Hall at 2415 University Avenue, East Palo Alto.

Environmental
The action being considered does not constitute a “Project” within the meaning of the California Environmental Quality Act (CEQA), pursuant to CEQA Guideline section 15378 (b)(5), in that it is a government administrative activity that will not result in direct or indirect changes in the environment.

Attachments

1. Resolution

2. Grant Agreement with HEART

3.4 Packet Pg. 61
RESOLUTION NO. __________

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE CITY MANAGER TO EXECUTE A GRANT AGREEMENT WITH THE HOUSING

ENDOWMENT AND REGIONAL TRUST OF SAN MATEO COUNTY FOR THE LOCAL HOUSING TRUST FUND PROGRAM IN THE AMOUNT OF $1.7 MILLION TO BENEFIT THE 965 WEEKS

AFFORDABLE HOUSING PROJECT
WHEREAS, on July 30, 2020, by Resolution No. No. 105-2020, the City Council appropriated $1.7 million, consisting of $500,000 in Measure HH funds and $1,200,000 in TOT Affordable Housing funds, to provide a local match for the Local Housing Trust Fund Program (“Program”), an affordable housing loan program of the Department of Housing and Community Development (“HCD”) WHEREAS, Resolution No. 105-2020 also directed the City Manager to provide a letter of commitment (“Letter of Commitment”) to the Housing Endowment and Regional Trust of San Mateo County (“HEART”), the Program applicant, which served as a legally binding commitment of funds if HEART received a Program award; and
WHEREAS, if awarded, HEART committed to provide $3,230,000 to the 965 Weeks affordable housing project (“965 Weeks”) in the form of a loan, consisting of $1,700,000 from the City and $1,700,000 in match funds from the Program, minus an administrative fee of five percent; and WHEREAS, on March 10, 2021, HEART was awarded $5,000,000 from the LHTF in support of three affordable housing projects in three jurisdictions: East Palo Alto, San Mateo, and Daly City; and WHEREAS, a Grant Agreement between the City and HEART in the amount of $1,700,000 million is required to enable HEART to draw funds from the LHTF and provide a loan in the amount of $3,230,000 to 965 Weeks.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the City Manager to execute a Grant Agreement with HEART to provide matching funds in the amount of $1,700,000 so that HEART may draw Local Housing Trust Fund Program Funds granted by the Department of Housing and Community Development and provide $3,230,000 to the 965 Weeks Affordable Housing Project in the form of a deferred, 55-year, low-interest loan.

PASSED AND ADOPTED this 17th day of May 2022, by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

3.4.a
Packet Pg. 62
Attachment: Resolution (2260 : Local Housing Trust Fund) SIGNED:

Ruben Abrica, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, Acting City Clerk Valerie J. Armento, Interim City Attorney

3.4.a
Packet Pg. 63
Attachment: Resolution (2260 : Local Housing Trust Fund)

CITY OF EAST PALO ALTO

AGREEMENT TO PROVIDE FUNDS

TO THE HOUSING ENDOWMENT AND REGIONAL TRUST OF SAN MATEO COUNTY

FOR THE LOCAL HOUSING TRUST FUND PROGRAM
THIS AGREEMENT is made and entered into on this day of 2022, by and between the CITY OF EAST PALO ALTO, hereinafter referred to as City, and the HOUSING ENDOWMENT AND REGIONAL TRUST OF SAN MATEO COUNTY, hereinafter referred to as HEART. City and HEART are sometimes referred to herein as the “Parties.”
WHEREAS, the California Department of Housing and Community Development (“HCD”) is authorized under the Local Housing Trust Fund Program (“LHTF Program”) from the Veterans and Affordable Housing Bond Act of 2018 (Proposition 1) (as described in Health and Safety Code section 50842.2 et seq. (Chapter 365, Statutes of 2017 (SB 3)) to provide up to $57 million in matching grants (“Program Funds”); and
WHEREAS, HCD, through the LHTF Program, provides Program Funds on a dollar for dollar basis to eligible applicants for eligible activities; and WHEREAS, HCD issued a Notice of Funding Availability (“NOFA”) dated April 30, 2020 under the LHTF Program; and
WHEREAS, Program Funds awarded under this NOFA shall be used to provide construction loans and/or permanent financing loans to pay for construction or rehabilitation of Affordable rental housing projects, Emergency Shelters, Permanent Supportive Housing, Transitional Housing and Affordable homebuyer/homeowner projects. Program Funds may also be used to assist income-eligible first-time homebuyers to purchase homes, and to rehabilitate houses owned by income-eligible occupants, as well as to construct, convert, reconstruct, rehabilitate and/or repair Accessory Dwelling Units (“ADUs”) or Junior Accessory Dwelling Units (“JADUs”);
WHEREAS, because City desires to support the development of affordable housing for low-income residents in the City of East Palo Alto, City made a binding grant commitment to HEART in the amount One Million Seven Hundred Thousand Dollars ($1,700,000) as a local match for HEART’s application to the LHTF Program, contingent upon HEART receiving an LHTF grant, as evidenced in a Letter of Commitment (“LOC”) dated June 30, 2020, attached as Exhibit A; and WHEREAS, HEART, as an eligible Regional Housing Trust Fund, applied to the Program on July 31, 2021 to administer one or more eligible activities using Program Funds; and WHEREAS, on June 22, 2021 HEART and HCD entered into an agreement numbered 20- LHTFCOM-1594 (“HCD Agreement”) memorializing HCD’s agreement to award Five Million Dollars ($5,000,000) to HEART for eligible activities under the Program, including One Million Seven Hundred Thousand Dollars ($1,700,000) for an eligible project located in the City; and NOW, THEREFORE, to achieve these common goals in the community, the Parties agree as follows:

3.4.b
Packet Pg. 64
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund) 2 1. HEART: HEART is a Regional Housing Trust Fund, a nonprofit organization as described in Section 501(c)(3) of the Internal Revenue Code, and a Joint Powers Authority (“JPA”) formed and existing under the laws of the State of California, of which the City is a member. HEART is an eligible applicant under the LHTF Program and is willing to and capable of performing the terms and services described herein.

2. PURPOSE: City agrees to provide One Million Seven Hundred Thousand Dollars ($1,700,000) to HEART to act as a matching funds source for the LHTF Program. HEART has completed a first phase funding process for affordable multifamily rental housing projects and announced on its website that the development of 965 Weeks Street in the City of East Palo Alto (“Project”) is approved to submit a final application in the amount of Three Million Two Hundred Thirty Thousand Dollars ($3,230,000) (City grant amount plus LHTF matching amount minus 5% of total, which HEART shall retain as an administrative fee). Based on its review, HEART will provide funding to the Project in the form of a deferred, 55-year low-interest loan (“Loan”) secured by a Promissory Note and a Deed of Trust naming HEART as the sole beneficiary for the entire amount of the Loan. The Loan terms and regulatory agreement associated with HEART funding for the Project will meet or exceed City requirements for funding affordable housing developments. The Project is an eligible activity under the LHTF Program and HEART included the Project and funding in the amount of Three Million Two Hundred Thirty Thousand Dollars ($3,230,000) in its application. By including the Project in its application, HCD awarded points to HEART based on the Project and the amount of proposed funding. HEART is compelled to fund the Project in the proposed amount and failure to do so may result in forfeiting of LHTF Program Funds and other damages to HEART including its ability to apply for future LHTF funds.

3. TERM: This Agreement shall commence on _________, 2022 and shall terminate on June 30, 2025. The Parties may agree in writing to extend the Agreement Term.

4. FUNDING: The source of City funds (“City Funds”) is Measure HH and Transient Occupancy Tax (TOT) Affordable Housing Monies, which shall in no event exceed One Million Seven Hundred Thousand Dollars ($1,700,000). City Funds shall be used for the sole purpose of serving as matching funds for the LHTF Program and utilized for the Project as described in Section 2. City Funds shall be used for lawful purposes only.

Pursuant to the LOC, City Funds shall be placed on deposit by City and held until requested by HEART for the purpose of drawing the LHTF Program Funds granted by HCD for the Project. In the manner prescribed by City, HEART shall provide a written notice to remit City Funds. The request shall specify that the City Funds shall be used for the purposes specified herein and shall be accompanied by such supporting and substantiating documentation as City may reasonably request.

City shall provide funds to HEART within ten (10) days of written request by HEART. HEART shall maintain records related to expenditure of the funds for five (5) years.

City expressly warrants and represents that City Funds shall be made available to HEART in the amount of One Million Seven Hundred Thousand Dollars ($1,700,000,) pursuant to the LOC and this Agreement, and upon written ten (10) day notice as provided in this Section, and that City’s failure to make such funds available within ten (10) days written notice from HEART shall constitute a material breach of this Agreement and shall entitle HEART to any legal, contractual, and/or equitable remedies related thereto.

5. HEART’S FISCAL AND OTHER RESPONSIBILITIES: HEART shall:

3.4.b
Packet Pg. 65
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund) 3 A. Comply with the HCD Guidelines establishing the terms, conditions, and procedures for grants from the LHTF Program and for funds awarded under the LHTF Program. These Guidelines implement, interpret, and make specific Health and Safety Code (“HSC”) Sections 50842.1, 50842.2, 50843.5 and Section 54006(f), which govern the LHTF Program.

B. Establish and maintain a written system of accounts for budgeted funds that shall be in conformance with generally accepted principles of accounting. Such system of accounts shall be subject to review, approval and inspection by City.

C. Document all costs by maintaining complete and accurate records of all financial transactions, including, but not limited to, contracts, invoices, bank statements and/or other official documentation evidencing in proper detail the nature and propriety of all transactions.

D. Independent Audits: HEART must have an independent fiscal audit performed once a year, in conformance with the generally accepted standard accounting principles. Such audits must identify the total funds received and disbursed as well as funds granted and expended. The costs for such audits shall be at HEART’s expense, unless otherwise provided for in this Agreement. HEART’s Board of Directors must provide copies of the completed audits to City within thirty (30) days of their completion and acceptance by HEART’s Board of Directors.

E. All services and actions to be performed by HEART in connection with the Project shall be performed in accordance with all applicable Federal, State, County, and municipal laws, ordinances, and regulations.

6. RECORDS, REPORTS AND AUDITS OF HEART:

A. Establishment and Maintenance of Records: HEART shall maintain records, including but not limited to books, financial records, supporting documents, statistical records, personnel, property, and all other pertinent records sufficient to reflect properly: (1) all direct and indirect costs of whatever nature claimed to have been incurred and anticipated to be incurred to perform this Agreement; and (2) all other matters covered by this Agreement.

B. Preservation of Records: HEART shall reserve and make available its records:
1) Until the expiration of five (5) years from the date of the submission of the annual financial status report; or
2) For such longer period, if any, as is required by applicable law.

C. Program Report: At City’s request, HEART shall provide Program Reports to City detailing progress made toward the provision of services.

7. TERMINATION: Neither party may terminate this Agreement except for the other party’s uncured material breach of its duties and obligations hereunder. City expressly warrants and represents that City Funds shall be made available to HEART upon written notice as provided in Section4, and that City’s failure to make such funds available to HEART shall constitute a material breach of this Agreement and shall entitle HEART to any legal, contractual, and/or equitable remedies related thereto.

3.4.b
Packet Pg. 66
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund) 4 8. RELATIONSHIP OF PARTIES: Notwithstanding any publicity or other references to the City required to be made in connection with the Project, HEART understands and agrees that the Project performed under this Agreement is not performed by HEART as an independent contractor of City or as an employee of City, and that neither HEART nor its employees acquire any of the rights, privileges, powers, or advantages of City contractors or City employees. HEART acknowledges and agrees that it is not, and will not hold itself out as, an agent, partner, or co-venturer of City, and that this Agreement is not intended and does not create an agency, partnership, joint venture between the Parties to this Agreement.

9. INTEREST OF PUBLIC OFFICIALS: No members, officers, employees or agents of City, shall have any interest, direct or indirect, in this Agreement or a related subcontract.

10. INSPECTION OF PROGRAM: It is understood that periodic review of HEART's program may be necessary under procedures set forth in City's Performance Monitoring Procedures.

11. PROGRAM INCOME: HEART shall record program income as part of the financial transactions of the program. HEART agrees that program income shall only be used in performing services and activities specified in the HCD Agreement between HCD and HEART. For fifty percent (50%) of any program income, including interest and principal, HEART shall give funding priority to affordable housing projects located within City’s jurisdictional boundaries.

12. REVERSION OF ASSETS: HEART shall comply with any reversion of assets imposed by HCD as a condition of receiving LHTF Program Funds. To the extent allowed by HCD, any notes, deeds of trust, regulatory agreements or agreements in connection with the Project and secured by real property shall name City as successor in interest upon the dissolution of HEART. City as successor to HEART for the Project Loan shall comply with all HCD regulations, including repayment of LHTF Program Funds to HCD and enforcement of affordability covenants.

13. ASSIGNABILITY: HEART shall not assign this Agreement, and shall not transfer any interest in this Agreement, without City’s prior written consent.

14. MEDIATION: Should any dispute arise out of this Agreement, any party may request that it be submitted to mediation. The Parties shall meet in mediation within thirty (30) days of a request for mediation. The mediator shall be agreed to by the mediating Parties; in the absence of an agreement, the Parties shall each submit one name from mediators listed by either the American Arbitration Association, the State Mediation and Conciliation Service, or other agreed-upon service. The mediator shall be selected by a blind draw.

The cost of mediation shall be borne equally by the Parties. Neither party shall be deemed the prevailing party. No party shall be permitted to file a legal action without first meeting in mediation and making a good faith attempt to reach a mediated settlement. The mediation process, once commenced by a meeting with the mediator, shall last until agreement is reached by the Parties but not more than sixty (60) days, unless the maximum time is extended by the Parties.

15. HOLD HARMLESS: HEART agrees to hold harmless, defend, and indemnify City, its elected and appointed officials, employees, and agents from and against any and all claims, loss, liability, damage, and expense arising out of HEART’s performance or nonperformance of this Agreement, except where such claims, loss, liability, damage, and expense arose from negligence or willful misconduct attributable to City.

3.4.b
Packet Pg. 67
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund) 5 City agrees to hold harmless, defend, and indemnify HEART for any claims, loss, liability, damage, and expense arising out of any failure by City to make City Funds available to HEART as required by this Agreement.

16. INSURANCE: HEART shall procure and maintain for the duration of this Agreement the insurance as specified below:

A. Coverage shall be at least as broad as:
1) Commercial General Liability (CGL): Insurance Services Office (ISO) Form CG 00 01 12 07 covering CGL on an “occurrence” basis, including products-completed operations, personal & advertising injury, with limits no less than $2,000,000 per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this project/location or the general aggregate limit shall be twice the required occurrence limit.
2) Automobile Liability: ISO Form Number CA 00 01 covering any auto (Code 1), or if Organization has no owned autoes, hired (Code 8) and non-owned autos (Code 9), with limit no less than $1,000,000 per accident for bodily injury and property damage. 2) Workers’ Compensation: as required by the State of California, with Statutory Limits, and Employer’s Liability Insurance with limit of no less than $1,000,000 per accident for bodily injury or disease.

If HEART maintains higher limits than the minimums shown above, City requires and shall be entitled to coverage for the higher limits maintained by HEART.

17. NONDISCRIMINATION:

A. General: No person shall, on the grounds of race, color, national origin, religious affiliation or non-affiliation, marital status, medical condition, sex, age, disability status, sexual orientation or political affiliation, be excluded from participation in, be denied the benefits, or be subjected to discrimination or harassment under this Agreement.

18. MERGER CLAUSE; AMENDMENTS: This Agreement, including any Exhibits and/or Attachments to this Agreement, constitutes the sole Agreement of the Parties regarding the LTHF Program, and correctly states the rights, duties, and obligations of each party as of this document’s date. In the event that any term, condition, provision, requirement, or specification set forth in the body of this Agreement conflicts with or is inconsistent with any term, condition, provision, requirement, or specification in any Exhibit and/or Attachment to this Agreement, the provisions of the body of the Agreement shall prevail. Any prior agreement, promises, negotiations, or representations between the Parties concerning the Grant that are not expressly stated in this document are not binding. All subsequent modifications or amendments shall be in writing and signed by the Parties.

19. GOVERNING LAW AND VENUE: The validity of this Agreement and of its terms, the rights and duties of the Parties under this Agreement, the interpretation of this Agreement, the performance of this Agreement, and any other dispute of any nature arising out of this Agreement shall be governed by the laws of the State of California without regard to its choice of law or conflict of law rules. Any dispute arising out of this Agreement shall be brought in the San Mateo County Superior Court.

3.4.b
Packet Pg. 68
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund) 6 20. PROJECT REPRESENTATION: Any notice, request, demand, or other communication required or permitted under this Agreement shall be deemed to be properly given when both: (1) transmitted via email to the email address listed below; and (2) sent to the physical address listed below by either being deposited in the United States mail, postage prepaid, or deposited for overnight delivery, charges prepaid, with an established overnight courier that provides a tracking number showing confirmation of receipt.

CITY: Patrick Heisinger
Interim City Manager
City of East Palo Alto
2145 University Avenue
East Palo Alto, CA 94303
ORGANIZATION: Armando F. Sanchez
Executive Director
Housing Endowment and Regional Trust of San Mateo County 2905 S. El Camino Real
San Mateo, CA 94403

21. ELECTRONIC SIGNATURE: If both City and HEART wish to permit this Agreement and future documents relating to this Agreement to be digitally signed in accordance with California law, both boxes below must be checked. Any party that agrees to allow digital signature of this Agreement may revoke such agreement at any time in relation to all future documents by providing notice pursuant to this Agreement.

For City: ☐ If this box is checked by City, City consents to the use of electronic signatures in relation to this Agreement.

For HEART: ☐ If this box is checked by HEART, HEART consents to the use of electronic signatures in relation to this Agreement.

3.4.b
Packet Pg. 69
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund) This Agreement has been duly executed by the following parties:

HOUSING ENDOWMENT AND REGIONAL CITY OF EAST PALO ALTO, a municipal TRUST OF SAN MATEO COUNTY, a joint corporation
powers agency
By: __________________________________ By: _________________________________ Armando F. Sanchez, Executive Director Patrick Heisinger, Interim City Manager Date: _________________________________ Date: ________________________________

3.4.b
Packet Pg. 70
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund)

3.4.b
Packet Pg. 71
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund)

3.4.b
Packet Pg. 72
Attachment: Grant Agreement with HEART (2260 : Local Housing Trust Fund)

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Patrick Heisinger, Interim City Manager
BY: Batool Zaro, Assistant Civil Engineer
Humza Javed, City Engineer
SUBJECT: TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Avenue at Michigan Avenue
Recommendation
Adopt a resolution approving the request to the Metropolitan Transportation Commission by the City of East Palo Alto for an allocation of Transportation Development Act Article 3 Pedestrian and Bicycle Project funding for fiscal year 2022- 2023.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 4: Improve Public Facilities and Infrastructure Priority No. 6: Create a Healthy and Safe Community
Background
In 2021 the City/County Association of Governments of San Mateo County (C/CAG) released a call for projects for the Transportation Development Act (TDA) Article 3 Program. The program is intended to fund eligible pedestrian and bicycle projects using TDA Article 3 funds, which are derived from Local Transportation funds and the State Transit Assistance fund. The program will be funding the top seven Bicycle and Pedestrian project proposals for Fiscal Year 2022- 2023 for $2,250,000,
The City of East Palo Alto with the assistance of its on-call Traffic consultants, TJKM, submitted an application for improvements at University Avenue at Michigan Avenue in November 2021. The project includes pedestrian safety improvements at this intersection which currently is unsafe and does not meet the Americans with Disability Act (ADA) compliance. Specifically, the project would include ADA compliant bulbouts, median improvement, curb ramps, Rapid Rectangular Flashing beacons (RRFB), striping, and

3.5 Packet Pg. 73
signage.

Analysis
Upon review of the grant applications, C/CAG invited applicants to present their specific projects to their Board. The City of East Palo City presented its project and it was well received.

On April 14, 2022, the C/CAG Board adopted a resolution approving the project application for $360,000 of funding with a $40,000 match requirement. Once the City Council passes a Resolution requesting funding allocation, C/CAG will be submitting the funding allocation request to the Metropolitan Transportation Commission (MTC).

Fiscal Impact
There is a $40,000 city match requirement. The city match can be reimbursed through Measure W local tax. Staff will return to the City Council to appropriate funding, if MTC selects the City’s proposal.

Public Notice
The public was provided notice of this agenda item by posting the City Council agenda on the City’s official bulletin board outside City Hall and making the agenda and report available at the City’s website and at the San Mateo Co. Library located at 2415 University Avenue, East Palo Alto.

Environmental
The action being considered does not constitute a “Project” within the meaning of the California Environmental Quality Act (CEQA), pursuant to CEQA Guideline section 15378 (b)(5), in that it is a government administrative activity that will not result in direct or indirect changes in the environment.

Attachments

1. TDA Article 3 - Attachment A

2. TDA Article 3 - Attachment B

3. Resolution

3.5 Packet Pg. 74
April 2022 TDA Article 3 Model Resolution Page 1
Resolution No. XX
Attachment A
Re: Request to the Metropolitan Transportation Commission for the Allocation of Fiscal Year 2022- 2023 Transportation Development Act Article 3 Pedestrian/Bicycle Project Funding Findings

1. That the City of East Palo Alto is not legally impeded from submitting a request to the Metropolitan Transportation Commission for the allocation of Transportation Development Act (TDA) Article 3 funds, nor is the City of East Palo Alto legally impeded from undertaking the project(s) described in “Attachment B” of this resolution.

2. That the City of East Palo Alto has committed adequate staffing resources to complete the project(s) described in Attachment B.

3. A review of the project(s) described in Attachment B has resulted in the consideration of all pertinent matters, including those related to environmental and right-of-way permits and clearances, attendant to the successful completion of the project(s).

4. Issues attendant to securing environmental and right-of-way permits and clearances for the projects described in Attachment B have been reviewed and will be concluded in a manner and on a schedule that will not jeopardize the deadline for the use of the TDA funds being requested.

5. That the project(s) described in Attachment B comply with the requirements of the California Environmental Quality Act (CEQA, Public Resources Code Sections 21000 et seq.).

6. That as portrayed in the budgetary description(s) of the project(s) in Attachment B, the sources of funding other than TDA are assured and adequate for completion of the project(s).

7. That the project(s) described in Attachment B are for capital construction and/or final design and engineering or quick build project; and/or for the maintenance of a Class I bikeway which is closed to motorized traffic and/or Class IV separated bikeway; and/or for the purposes of restriping Class II bicycle lanes; and/or for the development or support of a bicycle safety education program; and/or for the development of a comprehensive bicycle and/or pedestrian facilities plan, and an allocation of TDA Article 3 funding for such a plan has not been received by the City of East Palo Alto within the prior five fiscal years.

8. That the project(s) described in Attachment B which are bicycle projects have been included in a detailed bicycle circulation element included in an adopted general plan, or included in an adopted comprehensive bikeway plan (such as outlined in Section 2377 of the California Bikeways Act, Streets and Highways Code section 2370 et seq.) or responds to an immediate community need, such as a quick-build project.

9. That any project described in Attachment B bicycle project meets the mandatory minimum safety design criteria published in the California Highway Design Manual or is in a National Association of City and Transportation Officials (NACTO) guidance or similar best practices document.

10. That the project(s) described in Attachment B will be completed in the allocated time (fiscal year of allocation plus two additional fiscal years).

11. That the City of East Palo Alto agrees to maintain, or provide for the maintenance of, the project(s) and facilities described in Attachment B, for the benefit of and use by the public.

3.5.a
Packet Pg. 75
Attachment: TDA Article 3 - Attachment A (2227 : TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Ave at TDA Article 3 Claim Applications Appendix A Page
1 3.5.a
Packet Pg. 76
Attachment: TDA Article 3 - Attachment A (2227 : TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Ave at April 2022 TDA Article 3 Model Resolution Page 1
Resolution No. XX
Attachment B
page 1 of 2
TDA Article 3 Project Application Form
Fiscal Year of this Claim: 2022-2023 Applicant: The City of East Palo Alto Contact person: Humza Javed
Mailing Address: 1960 Tate Street East Palo Alto, Ca 94303 E-Mail Address: [email protected] Telephone: (650) 853-3130 Secondary Contact (in event primary not available): Batool Zaro E-Mail Address: [email protected] Telephone: (650) 853-3166 Project Title (Short Description): University Ave & Michigan Ave Intersection Improvements Amount of claim: $360,000
Description of Overall Project:

Project Scope Proposed for Funding: (Project level environmental, preliminary planning, and ROW are ineligible uses of TDA funds.) Project Budget and Schedule
Project Eligibility: YES?/NO?
A. Has the project been approved by the claimant's governing body? (If "NO," provide the approximate date approval is anticipated).

No
May 17th 2022
B. Has this project previously received TDA Article 3 funding? If "YES," provide an explanation on a separate page. No C. For "bikeways," does the project meet Caltrans minimum safety design criteria pursuant to Chapter 1000 of the California Highway Design Manual? (Available on the internet via: http://www.dot.ca.gov).

N/A
D. Has the project been reviewed by the Bicycle and Pedestrian Advisory Committee? (If "NO," provide an explanation). The project has been
reviewed by
the City’s
Public Works
and
Transportatio
n Commission
Project
Phase
TDA 3 Other Funds Total Cost
Estimated Completion
(month/year)
Bike/Ped
Plan
-
ENV -

PA&ED -
PS&E -
ROW -
CON 360,000 40,000 400,000 Mar-23
Total Cost 360,000 40,000 400,000
The University Avenue and Michigan Avenue intersection is located in the center of the University Avenue Corridor between US 101 and SR 84, with an ADT of up to 25,400 vehicles during the weekday. This T-intersection serves pedestrians accessing north and south East Palo Alto. The improvements include installation of bulbouts, curb ramps, median refuge, striping on all three legs, and RRFBs.

ADA bulbouts, median improvements, Rectangular Rapid Flashing Beacons (RRFB), striping, signs.

3.5.b
Packet Pg. 77
Attachment: TDA Article 3 - Attachment B (2227 : TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Ave at April 2021 TDA Article 3 Model Resolution Page 2
which is the
equivalent to
a BPAC
E. Has the public availability of the environmental compliance documentation for the project (pursuant to CEQA) been evidenced by the dated stamping of the document by the county clerk or county recorder? (required only for projects that include construction).

N/A
F. Will the project be completed before the allocation expires? Enter the anticipated completion date of project (month and year)
Yes
March 2023
G. Have provisions been made by the claimant to maintain the project or facility, or has the claimant arranged for such maintenance by another agency? (If an agency other than the Claimant is to maintain the facility provide its name:
)
Yes

3.5.b
Packet Pg. 78
Attachment: TDA Article 3 - Attachment B (2227 : TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Ave at TDA Article 3 Claim Applications Appendix A Page
1 3.5.b
Packet Pg. 79
Attachment: TDA Article 3 - Attachment B (2227 : TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Ave at Resolution No. XX-2021 1
RESOLUTION NO. XX – 2022

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO

REQUEST TO THE METROPOLITAN TRANSPORTATION COMMISSION FOR THE ALLOCATION OF FISCAL YEAR 2022-2023 TRANSPORTATION DEVELOPMENT ACT ARTICLE 3

PEDESTRIAN/BICYCLE PROJECT FUNDING
WHEREAS, Article 3 of the Transportation Development Act (TDA), Public Utilities Code (PUC) Section 99200 et seq., authorizes the submission of claims to a regional transportation planning agency for the funding of projects exclusively for the benefit and/or use of pedestrians and bicyclists; and WHEREAS, the Metropolitan Transportation Commission (MTC), as the regional transportation planning agency for the San Francisco Bay region, has adopted MTC Resolution No. 4108, Revised, entitled “Transportation Development Act, Article 3, Pedestrian/Bicycle Projects,” which delineates procedures and criteria for submission of requests for the allocation of “TDA Article 3” funding; and WHEREAS, MTC Resolution No. 4108, Revised requires that requests for the allocation of TDA Article 3 funding be submitted as part of a single, countywide coordinated claim from each county in the San Francisco Bay region; and
WHEREAS, the City of East Palo Alto desires to submit a request to MTC for the allocation of TDA Article 3 funds to support the projects described in Attachment B to this resolution, which are for the exclusive benefit and/or use of pedestrians and/or bicyclists.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY:

1. Declares it is eligible to request an allocation of TDA Article 3 funds pursuant to Section 99234 of the Public Utilities Code; and

2. That there is no pending or threatened litigation that might adversely affect the project or projects described in Attachment B to this resolution, or that might impair the ability of the City of East Palo Alto to carry out the project; and

3. That the City of East Palo Alto attests to the accuracy of and approves the statements in Attachment A to this resolution; and

4. That a certified copy of this resolution and its attachments, and any accompanying supporting materials shall be forwarded to the City/County Association of Governments of San Mateo County which functions as the County’s congestion management agency for submission to MTC as part of the countywide coordinated TDA Article 3 claim.

3.5.c
Packet Pg. 80
Attachment: Resolution (2227 : TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Ave at Michigan Ave) Resolution No. XX-2021 2
PASSED AND ADOPTED this 17th day of May 2022, by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

Rubin Abrica, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, Acting City Clerk Valerie J. Armento, Interim City Attorney

3.5.c
Packet Pg. 81
Attachment: Resolution (2227 : TDA Article 3 Bicycle and Pedestrian Program for Improvements at University Ave at Michigan Ave)

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Patrick Heisinger, Interim City Manager
BY: Batool Zaro, Assistant Civil Engineer
Humza Javed, City Engineer
SUBJECT: Installation of a multi-way stop sign at the western leg of Bell Street and Cooley Avenue
Recommendation
Adopt a resolution authorizing the installation of a multi-way (three-way) stop sign at the Bell Street and Cooley Avenue intersection at the western leg.

Background
Based on a request received from a resident regarding limited visibility and safety, the City of East Palo Alto’s Engineering Division performed a multi-way stop sign analysis for the Bell Street and Cooley Avenue intersection. This analysis is used to verify if a multi-way stop sign installation is warranted and recommended based on standard guidelines. Current conditions consist of two three-way intersections. Cooley Avenue runs in the north/south direction and Bell Street runs in the east/west direction. The east and west legs of Bell Street were analyzed separately as two different intersections. See Image 1 for the location map.

3.6 Packet Pg. 82
Image 1: Location Map, City of East Palo Alto
Analysis
The City of East Palo Alto follows state guidelines outlined in the California Manual on Uniform Traffic Control Devices (MUTCD) when determining if traffic control devices should be installed, such as a multi-way stop sign. The manual outlines minimum guidelines regarding traffic volumes, collisions, and visibility. The use of multi-way stop signs should be considered if engineering judgment indicates that a stop is required because of one or more of the following conditions:

Condition 1:

As an interim
measure where
traffic control signals
are justified.
and/or Condition 2:

Reported crashes – five or
more in a 12-month period
that are susceptible to
correction by a multi-way stop
installation.

Results:

Satisfied.

Seven (7) collisions reported
in a three-year period.
and/or Condition 3:

Minimum traffic
and pedestrian
volumes,
speeds, and
delay as outlined
in the analysis.

West Leg
Results:

Satisfied.

East Leg
Results:

Not Satisfied.

N

3.6 Packet Pg. 83
The California MUTCD outlines if one or more of the conditions are met a multi-way stop sign is warranted, and since the collision and volume requirement have been satisfied on the west leg, a multi-way stop sign is warranted. The volume requirements for the east leg were not satisfied; see Attachment 1 for the full multi-way stop sign report for additional details.

Staff performed field visits as part of the analysis to check visibility at both intersections. Based on field observation, staff found that when looking south from the west leg it is challenging to see oncoming vehicles due to the slight angle of the intersection and due to the fact that the southern curb is not red curbed like the northern curb. Drivers must encroach far past the stop bar to see oncoming vehicles. Installing a multi-way stop sign at the western leg would also potentially help provide sufficient gaps for vehicles making turning movements from the eastern leg.

Based on MUTCD warrant requirements, staff recommends the installation of a multi-way stop sign for the three-way intersection at the western leg. The Public Works and Transportation Commission reviewed this item at the April 20th, 2022, meeting and recommended the City Council approve Staff’s recommendation.

Attachments

1. Multi-Way Stop Sign Analysis at Bell & Cooley

2. Resolution

3.6 Packet Pg. 84
1 Date: 4/11/2022
Subject: Bell Street and Cooley Avenue Multi-Way Stop Sign Warrant Analysis To Whom It May Concern:

The City of East Palo Alto’s Engineering Division performed a multi-way stop sign analysis for the Bell Street and Cooley Avenue intersection. The attached report discusses the full analysis and based on the report, staff recommends a multi-way (three-way) stop sign at this time.

The analysis was completed in response to a resident’s request to verify if a multi-way stop sign installation is warranted. The residents written request may be found in Appendix E. The guidelines outlined in the California Manual of Uniform Traffic Control Devices (California MUTCD) were used for the analysis. Currently there are two three-way intersection that are stop controlled on Bell Street. In overall consideration of existing conditions, a multi-way stop sign is recommended.

Please let me know if you have additional questions about the analysis or the recommendations.

Sincerely,
Batool Zaro
Assistant Civil Engineer
[email protected]
City of East Palo Alto
Attach: Multi-Way Stop Control Warrant Analysis Report

CITY OF EAST PALO ALTO

PUBLIC WORKS DEPARTMENT

ENGINEERING DIVISION
1960 Tate Street, East Palo Alto, CA 94303 (650) 853-3189

3.6.a
Packet Pg. 85
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 2 MULTI-WAY STOP CONTROL WARRANT ANALYSIS REPORT

BELL STREET AND COOLEY AVENUE

IN THE CITY OF EAST PALO ALTO

INTRODUCTION
There was a safety concern brought up regarding the visibility issues at the Bell Street and Cooley Avenue intersection and a multi-way (three-way) stop sign has been requested. This analysis is to verify if a three-way stop sign installation is warranted and recommended based on standard guidelines.

Current conditions consist of two three-way intersections. Cooley Avenue runs in the north/south direction and Bell Street runs in the east/west direction. The east and west legs of Bell Street will be analyzed separately as two different intersections. The location is demonstrated in Image 1 below. Bell Street is stop controlled and Cooley Avenue is uncontrolled. The intersection is within the City of East Palo Alto’s jurisdiction.

Image 1: Location Map, City of East Palo Alto
N

3.6.a
Packet Pg. 86
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 3 BACKGROUND
Bell Street and Cooley Avenue are neighborhood streets. Cooley Avenue is the “major” street in this intersection and is considered a connector- neighborhood street because it typically serves more destinations and helps distribute local traffic to neighborhood streets. The speed limit on all streets is 25 mph. At the intersection Cooley Avenue is approximately 38 feet wide, and the 2-lane roadway is separated by centerline striping. Parking is permitted on both sides of the street. The north and south direction side consist of curb, sidewalk, and gutter.

See Image 2 and Image 3 for photo images of Cooley Avenue.

Image 2: Cooley Avenue Looking North Image 3: Cooley Avenue Looking South Bell Street (the eastern direction of the intersection) is a neighborhood street that’s approximately 36 feet wide, and the 2-lane roadway provides one lane in each direction that is separated by centerline striping with parking allowed on both sides of the street. The roadway has curb, gutter, parkway, and sidewalk.

There is a STOP sign, a white ‘STOP’ pavement marking, and a white limit line at the intersection.

See Image 4 for a photo image of the Bell Street east leg.

3.6.a
Packet Pg. 87
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 4 Image 4: Cooley Street Facing Bell Street (east leg)
Bell Street (the western direction of the intersection) is a neighborhood street that’s approximately 40 feet wide, and the 2-lane roadway provides one lane in each direction that is separated by centerline striping with parking allowed on both sides of the street. The roadway has curb, gutter, parkway, and sidewalk.

There is a STOP sign, a white ‘STOP’ pavement marking, and a white limit line at the intersection.

See Image 5 for a photo image of the Bell Street west leg.

Image 5: Cooley Street Facing Bell Street (west leg)

3.6.a
Packet Pg. 88
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 5 WARRANT GUIDELINES
The City of East Palo Alto follows State guidelines outlined in the California Manual on Uniform Traffic Control Devices (MUTCD) when determining if traffic control devices should be installed. The guidelines outlined in the California MUTCD were used for this analysis. The manual outlines minimum guidelines regarding traffic volumes, collisions, speed, visibility, and other criteria in order to warrant traffic control devices like the installation of a multi-way (3-way) stop sign in this case.

The California MUTCD application guideline criteria for a multi-way stop is described below:

1. As an interim measure where traffic control signals are justified. “Where the traffic control signals are justified, the multi-way STOP is an interim measure that can be installed quickly to control traffic while arrangements are being made for the installation the traffic control signal”.

2. Reported crashes – five or more in a 12-month period that are susceptible to correction by a multiway stop installation.

3. Minimum traffic and pedestrian volumes, speeds, and delay as outlined in Section 2B.07.

4. Where a combination of the above criteria are all satisfied to 80 percent.

When any one, or a combination of these criteria is met, then a multi-way stop application should be considered. A multi-way stop sign is usually not recommended when the criteria are not met. The California MUTCD guidelines described above are included in Appendix A.

MULTI-WAY STOP ANALYSIS
The California MUTCD outlines the guidelines describing the minimum collisions and traffic volumes necessary to warrant a multi-way stop sign. Engineering judgment must also be considered along with these guidelines. One important thing to note is that a stop sign will not stop the speeding issue; however, it might help guide vehicles to safely make their turns. Additional guidance criteria found in the manual include the following important statements: “YIELD or STOP signs should not be used for speed control… In most cases, the street carrying the lowest volume of traffic should be controlled…” Collision History
The guidelines in the California MUTCD outline that a minimum of (5) reported crashes occurring in a 12-month period that are susceptible to correction by a multi-way stop installation must occur in order to satisfy this warrant. The crashes include right-turn and left-turn collisions, as well as right-angle collisions and pedestrian-vehicle collisions.

The collision history was gathered by the City’s Engineering Division from the City of East Palo Alto’s Police Department (PD). A comprehensive 3-year traffic collision history summary report was prepared for this intersection and reviewed for collisions susceptible to correction by the installation of a multi-way stop. Table 1 demonstrates a 3-year summary of collisions at this intersection.

3.6.a
Packet Pg. 89
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 6 TABLE 1
3-YEAR ACCIDENT HISTORY

PD COLLISION HISTORY SUMARY
2018 2019 2020
Intersection Date Type of
Collision
Date Type of Collision Date Type of Collision
Bell Street
and Cooley
Avenue
6/9/2018 rear end 2/11/2019 broadside 04/21/2020 broadside 3/12/2019 side swipe
6/30/2019 head on
9/01/2019 broadside
11/02/2019 side swipe
Notes: Information above is derived per the 3-year intersection traffic collision database report gathered from the East Palo Alto’s Police Department (PD).

As shown in Table 1 above, there have been seven (7) reported collisions at or near this intersection over the three (3) year timeframe. Since the collision warrant requires a minimum of five (5) reported crashes susceptible to correction by a multi-way stop, to occur within a 12-month period, the collision warrant is satisfied. It is important to note that since most of the police reports do not specify whether the accident occurred at the eastern/western leg, it is assumed to be the number of accidents for both. No accidents occurred at this intersection in 2021 or January-March of 2022. The EPA PD collision report is included in Appendix B.

Traffic Volumes
The City of East Palo Alto collected Average Daily Traffic (ADT) vehicular approach counts using a platform called Streetlight Data. The results are demonstrated in Table 2. The traffic volume data collected for this intersection is included in Appendix C

3.6.a
Packet Pg. 90
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 7 TABLE 2

VEHICLE COUNTS

COOLEY AVENUE & BELL STREET

EAST LEG

WEST LEG

3.6.a
Packet Pg. 91
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 8 Cooley Avenue is considered the “major” street at this three-way intersection. Bell Street is considered “minor” streets since drivers are required to stop at Cooley Avenue and look both ways before making a left or right turn. It is anticipated that the minor streets receive less traffic volume than the major street.

A part of the California MUTCD guideline criteria calls for a reduction in the required minimum volumes when the critical approach speed (or 85th-percentile speed) on the major street exceeds 40 MPH. If this is the case, the minimum vehicular volumes to be met for a multiway stop sign installation are reduced to 70%. As mentioned, the speed limits on all streets are 25 MPH. Using the Streetlight Data platform, it was confirmed that the 85th-percentile speed is not greater than the 40 MPH limit required to reduce traffic volumes.

Table 3 below shows the California MUTCD minimum traffic volume criteria for a multi-way stop sign with the highest 8-hour traffic counts data for this intersection. Both Part 1 and Part 2 need to be satisfied in order to fulfil the traffic volume warrant.

TABLE 3

CA MUTCD MULTI-WAY STOP CRITERIA
Part 1:

The vehicular volume
entering the
intersection from the
major street approaches
(total of both
approaches) averages at
least 300 vehicles per
hour for any (8) hours
of an average day
East/West Leg
Results: Satisfied
Total average vehicles
= approximately 705
vehicles
and Part 2:

The combined vehicular,
pedestrian, and bicycle volume
entering the intersection from the
minor street approaches (total of
both approaches) averages at least
200 units per hour for the same (8)
hours, with an average delay to
minor-street vehicular traffic of at
least 30 seconds per vehicle during
the highest hour.

East Leg Results:

Not Satisfied
= 53
(311 vehicles +94 pedestrians +19
bicyclists)/8 hours
West Leg Results:

Satisfied
= 230
(1,437 vehicles+306 pedestrians
+94 bicyclists)/8 hours
but Part 3:

If the 85th -percentile
approach speed of the
major street traffic
exceeds 65 km/h or
exceeds 40 mph, the
minimum vehicular
volume warrants are (70)
percent of the above
values.

East Leg Results:

Not Satisfied
As shown above, the average hourly intersection traffic for the highest 8-hour period did not satisfy Part 2 for the eastern leg; however, both conditions were satisfied for the western leg. Therefore, the minimum traffic volume warrant is not satisfied for the eastern leg but is satisfied for the western leg.

3.6.a
Packet Pg. 92
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 9 Visibility
On-site field visits were made to determine if there are restricted sight distances due to the geometry of the intersection and other potential obstructions. The driver sight distances were measured from the sidestreet approaches since they are required to stop before proceeding to makes a left or right turn onto Cooley Avenue. The minimum stopping sight distances are derived from the stopping sight guidelines in the California MUTCD (reference Appendix D). For a 25-mph street, a minimum stopping sight distance of 155 feet is required. The stopping sight distance was measured on the field from a “typical” vehicle stopped location at Bell Street looking for traffic approaching on Cooley Avenue. An orange cone was placed to mark the distances and photos were taken.

When looking north and south from Bell Street east leg the driver’s line of sight is obstructed by parked vehicles; however, a clear line of sight is available when the drivers encroach past the stop bar. Based on field observation, staff found that vehicles can safely encroach past the stop bar in order to make their turns. The images on the left demonstrate the drives visibility behind the stop bar and the image on the right demonstrate when drivers pass the stop bar. See Image 6 and 7 for the east leg of Bell Street.

When looking north from Bell Street west leg the driver’s line of sight is obstructed by parked vehicles, and vehicles must encroach further out then the eastern leg in order to get a clear line of sight. Based on field observation, staff found that when looking south it is slightly more challenging to see oncoming vehicles due to the slight angle of the intersection and due to the fact that the southern curb is not red curbed like the northern curb. The images on the left demonstrate the drives visibility behind the stop bar and the image on the right demonstrate when drivers pass the stop bar. See image 8 and 9 for the west leg of Bell Street.

Image 6: Bell Street East Leg Facing Cooley Avenue (Looking North)

3.6.a
Packet Pg. 93
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 10 Image 7: Bell Street East Leg Facing Cooley Avenue (Looking South) Image 8: Bell Street West Leg Facing Cooley Avenue (Looking North)

3.6.a
Packet Pg. 94
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 11 Image 9: Bell Street West Leg Facing Cooley Avenue (Looking South)

MULTIWAY STOP ANALYSIS SUMMARY
After reviewing the California MUTCD four main guidelines described in this report, the western leg of the intersection does meet the minimum warrant requirements.

The guidelines are: 1. As an interim measure where traffic control signals are justified; 2. Reported crashes – five or more in a 12-month period that are susceptible to correction by a multi-way stop installation; 3. Minimum traffic and pedestrian volumes, speeds, and delay as outlined in Section 2B.07;

4. Where a combination of the above criteria are all satisfied to 80 percent.

In summary, based on the collision history gathered, seven (7) accidents occurred at this intersection in the three-year period. The minimum guideline calls for at least five (5) accidents within a 12-month period. The reported accidents warrant a multi-way stop. Condition 2 is satisfied because more than (5) crashes occurred at this intersection during a 12-month period.

The average minimum hourly volumes were satisfied for the west leg of Bell Street as demonstrated in Table 3; therefore, condition (3) is satisfied.

The California MUTCD criteria is met for this location.

Although a multi-way stop sign was requested for the eastern leg, it was found that the eastern leg did not meet MUTCD warrant requirements, but the western leg did. Installing a multi-way stop sign at the western leg would help provide sufficient gaps for vehicles making turning movements from the eastern leg.

3.6.a
Packet Pg. 95
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 12 RECCOMENDATION
A multi-way stop sign is recommended for the three-way intersection, at the western leg, based on MUTCD warrant requirements.

MULTIWAY STOP ANALYSIS SUMMARY
After overall analysis, a multi-way (three-way) stop sign installation is not recommended at this time for Bell Street eastern leg; however, it is warranted at the western leg of the intersection. There are no other recommendations at this time.

3.6.a
Packet Pg. 96
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 13 APPENDIX A

MULTIWAY STOP APPLICATIONS
GUIDELINES: CALIFORNIA MUTCD

3.6.a
Packet Pg. 97
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 14 3.6.a
Packet Pg. 98
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 15 3.6.a
Packet Pg. 99
Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 16 3.6.a
Packet Pg. 100 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 17 APPENDIX B

POLICE DEPARTMENT COLLISION HISTORY REPORT

3.6.a
Packet Pg. 101 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and

CITY OF EAST PALO ALTO ALBERT PARDINI

POLICE DEPARTMENT CHIEF OF POLICE
141 Demeter Street (650) 853-3125 Phone
East Palo Alto, CA 94303 [email protected]
_________________________________________________________________ Vehicle Accidents at the intersection of Bell Street and Cooley Avenue January 1, 2018 – January 14, 2021
There was a total of seven (7) vehicle accidents at the intersection of Bell Street and Cooley Avenue from January 1, 2018 through December 31, 2020 (three years). This information is limited in that it only covers the accidents that were either reported to or discovered by the police. These numbers are not all inclusive as they do not include accidents that were not reported to the police department, reports made to the Department of Motor Vehicles, and reports made to insurance companies. It is possible that some vehicle accident reports that were made online and/or that were not reported or entered into our record keeping system as of date are also excluded. For more complete statistics please reference the Statewide Integrated Telecommunications System. 1 For further details on the accidents, please refer to the attached excel spreadsheet. 1 Statewide Integrated Telecommunications System (SWITERS) is maintained by the California Highway Patrol and information can be accessed online. http://www.chp.ca.gov Numbers are subject to change as accidents may have been reported after the date the data was pulled on 01-14-2021.

3.6.a
Packet Pg. 102 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and Case # Date Time Location Cause Locale
18-1885 06/09/2018 2059 BELL ST/COOLEY AV driver error street 19-0488 02/11/2019 1808 BELL ST/COOLEY AV driver error street 19-0835 03/12/2019 740 BELL ST/COOLEY AV driver error intersection 19-2170 06/30/2019 1836 2195 COOLEY AV driver error street 19-2944 09/01/2019 1204 BELL ST/COOLEY AV driver error intersection 19-3605 11/02/2019 1700 BELL ST/COOLEY AV driver error street 20-1135 04/21/2020 1236 BELL ST/COOLEY AV driver error intersection

3.6.a
Packet Pg. 103 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and Weather Road Type Road Condition Traffic Signal Speed Limit Light Conditions Severity dark city street clear not applicable 25 street lights no injuries clear city street clear light 25 dark minor injuries
clear city street clear stop sign 25 day no injuries
clear city street clear not applicable 25 day no injuries clear city street clear stop sign 25 day minor injuries dark city street clear not applicable 25 street lights fatal injuries clear city street clear stop sign 25 day no injuries

3.6.a
Packet Pg. 104 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and Minor Injuries Major Injuries Fatal Injuries DUI Involved Collision Type Collision Direction Caused By Juve? 0 0 0 no vehicle - vehicle rear end no
1 0 0 no vehicle - bicycle broadside no
0 0 0 no vehicle - vehicle side swipe no
0 0 0 no vehicle - object head on no
2 0 0 no vehicle - vehicle broadside no
0 0 0 no vehicle - vehicle side swipe no
2 0 0 no vehicle - vehicle broadside no

3.6.a
Packet Pg. 105 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and Primary Collision
Factor
Special Conditions Hit & Run Misd. Hit & Run Felony Mile Post Occurred On At Intersection 22107 cvc NONE no no BELL ST
21650.1 cvc yes no COOLEY AV DONOHOE ST
22107 CVC yes no BELL ST COOLEY AV
22107 VC no no COOLEY AV
22450 (A) CVC no no BELL ST COOLEY AV
22107 CVC yes no BELL ST
yes no BELL ST COOLEY AV

3.6.a
Packet Pg. 106 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and Other Location
COOLEY

BELL ST

COOLEY AV

3.6.a
Packet Pg. 107 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 18 APPENDIX C

TRAFFIC VOLUMES

COUNT DATA

3.6.a
Packet Pg. 108 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and

VEHICLE COUNTS

COOLEY AVENUE & BELL STREET

EAST LEG

WEST LEG

3.6.a
Packet Pg. 109 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 19 APPENDIX D

CALIFORNIA MUTCD STOPPING SIGHT GUILDELINES

3.6.a
Packet Pg. 110 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 20 3.6.a
Packet Pg. 111 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and 21 APPENDIX E

MULTI-WAY STOP SIGN ANALYSIS REQUEST

3.6.a
Packet Pg. 112 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and CAUTION: This e-mail originated from outside of the organization. Do not click links or open attachments unless you validate the sender and know the content is safe.

CAUTION: This e-mail originated from outside of the organization. Do not click links or open attachments unless you validate the sender and know the content is safe.

Good Morning Theodore,
Thank you for reaching out regarding your concern. In order to install a multi-way stop sign we would need to perform a multi-way stop analysis following State guidelines. Once we finish the analysis we take the item to the Public Works and Transportation Commission and then they review the analysis.

There are technically two Bell Street & Cooley Avenue intersections, so I just want to verify if you are requesting the northern or southern intersection to be reviewed? On Friday I took a look at both and visibility is a bit impaired due to parked vehicles.

Let me know if you have any additional questions.

Best,
Batool Zaro, EIT
Assistant Civil Engineer
City of East Palo Alto
Engineering Division
1960 Tate Street
East Palo Alto, CA 94303
Cell: (650) 388-8921
Email: [email protected]
From: Theodore Aronson <[email protected]>
Sent: Thursday, August 19, 2021 10:06 AM
To: Engineering <[email protected]>
Subject: Stop Sign Request: Bell St & Cooley Ave
Good Morning,
I would like to request a 3 way stop be installed at the intersection of Bell Street & Cooley Avenue in East Palo Alto, CA. Currently the intersection is rather dangerous as it is difficult to see oncoming cars due to parked cars on the street. I would be happy to talk to someone further about this and the process for requesting the stop sign installation. My phone number is . Thank you!
Sincerely,
Ted Aronson

3.6.a
Packet Pg. 113 Attachment: Multi-Way Stop Sign Analysis at Bell & Cooley (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and Resolution No. XX-2021 1
RESOLUTION NO. XX – 2021

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE INSTALLATION OF A MULTI-WAY STOP SIGN AT THE WESTERN LEG OF

THE BELL STREET AND COOLEY AVENUE INTERSECTION
WHEREAS, staff received a request from a resident regarding safety concerns at the intersection of Bell Street and Cooley Avenue; and
WHEREAS, upon receiving the request, city staff performed a multi-way stop sign warrant analysis at the intersection of Bell Street and Cooley Avenue; and WHEREAS, based on staff’s analysis and state guidelines, the western leg of the intersection of Bell Street and Cooley Avenue meets the criteria for a multi-way (three-way) stop sign; and WHEREAS, the Public Works and Transportation Commission, at its April 20, 2022 meeting, recommended a multi-way stop sign at the Bell Street and Cooley Avenue intersection at the western leg.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY authorizes the installation of a multi-way stop sign at the western leg of the Bell Street and Cooley Avenue intersection.

PASSED AND ADOPTED this 17th day of May 2022, by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

Rubin Abrica, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, Acting City Clerk Valerie J. Armento, Interim City Attorney

3.6.b
Packet Pg. 114 Attachment: Resolution (2223 : Installation of a multi-way stop sign at the western leg of Bell Street and Cooley Avenue)

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Valerie J. Armento, Interim City Attorney
BY: Patricia Del Castillo, Legal Assistant
SUBJECT: AB 361 Findings to Continue Virtual Public Meetings for the City Council and City Advisory Bodies
Recommendation
Adopt a resolution making the AB 361 findings necessary to continue virtual public meetings for the City Council and City Advisory Bodies for the month of June 2022.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 3: Increase Organizational Effectiveness and Efficiency Priority No. 6: Create a Healthy and Safe Community
Background
The California Brown Act has long-established requirements for local agencies to use teleconferencing to conduct meetings. It provides that if the local agency elects to use teleconferencing to conduct a public meeting, then it must identify each teleconference location in the public notice and agenda, and post agendas at all teleconference locations. All teleconference locations must be publicly accessible and there must be an opportunity for public comment at each teleconference location. Additionally, a quorum of the members of the legislative body must participate from locations physically within the jurisdictional boundaries of the agency.

In March 2020, Governor Newsom issued Executive Order N-29-20 authorizing exemptions to these Brown Act teleconferencing requirements. These requirements were suspended during the COVID-19 pandemic to promote social distancing and to facilitate remote work and meetings. Executive Order N-08-21 extended the previous order until September 30, 2021.

On September 16, 2021, the Governor signed AB 361 into law to allow the continued use of virtual public meetings during a declared state of emergency when certain conditions are met.

AB 361 took effect immediately as an urgency statute.

3.7 Packet Pg. 115
Analysis
AB 361 exempts local agencies from complying with the following teleconferencing requirements of the Brown Act:
· Ensuring that each teleconference location is physically accessible to the public; · Maintaining quorum with members physically within the jurisdiction; and · Providing an opportunity for public comment at each teleconference location.

The AB 361 exemptions only apply during a declared state of emergency - as defined under the California Emergency Services Act - and one of the following circumstances must apply:

1. State or local officials have imposed or recommended measures to promote social distancing.

2. The legislative body is meeting to determine whether, as a result of the emergency, meeting in person would present imminent risks to the health or safety of attendees.

3. The legislative body has determined that, as a result of the emergency, meeting in person presents imminent risks to the health or safety of attendees.

Under AB 361, when a local agency elects to hold a virtual meeting because the applicable criteria are met, an alternate set of requirements apply:
· No Action During Disruptions - Where there is a disruption in the public broadcast of the call-in or internet-based meeting service, the local agency must cease and take no further action on agenda items until public access is restored. · Public Comment Rights - A local agency is prohibited from requiring public comments to be submitted in advance of the meeting and cannot close the comment period or opportunity to register online until the timed public comment period has elapsed.

Lastly, at least every 30 days during the proclaimed state of emergency, the local agency acting under the teleconference exemptions must make findings about whether the circumstances explained above still apply. Therefore, to continue holding virtual meetings, the City Council must find that it reconsidered the circumstances of the state of emergency and that one of the following circumstances exist: “(i) the emergency continues to directly impact the ability of members to safely meet in person,” or “(ii) state or local officials continue to impose or recommend measures to propose social distancing.” Today’s action would allow the City Council and City advisory bodies to continue meeting virtually during the month of June 2022. The teleconferencing exemptions authorized by AB 361 will sunset on January 1, 2024.

Fiscal Impact
None
Public Notice
The public was provided notice of this agenda item by posting the City Council agenda on the City’s official bulletin board outside City Hall and making the agenda and report available at the City’s website and at the San Mateo County Library located at 2415 University Avenue, East Palo Alto.

3.7 Packet Pg. 116
Attachments

1. Resolution

3.7 Packet Pg. 117
Resolution No. XX-2022 1 of 2
RESOLUTION NO. XX-2022

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO
ADOPTING THE AB 361 FINDINGS NECESSARY TO CONTINUE VIRTUAL

PUBLIC MEETINGS FOR THE CITY COUNCIL AND CITY ADVISORY BODIES DURING THE COVID-19 STATE OF EMERGENCY
WHEREAS, on January 31, 2020, the United States Department of Public Health and Human Services Secretary declared a public health emergency for the novel disease named “coronavirus disease 2019” or “COVID-19" by the World Health Organization and the Centers for Disease Control and Prevention ("CDC”) reiterates that COVID-19 is a serious public health threat based on current information; and
WHEREAS, on March 3, 2020, the San Mateo County Health Officer declared a local health emergency throughout San Mateo County and the County Manager, serving as the County Director of Emergency Services, proclaimed a local emergency throughout San Mateo County related to the novel coronavirus and on March 10, 2020, the San Mateo County Board of Supervisors ratified and extended the declaration and proclamation and this state of emergency remains in effect; and WHEREAS, on March 4, 2020, the Governor of California declared a State of Emergency due to the outbreak and spread of COVID-19, and the State of Emergency is still in effect; and WHEREAS, on March 17, 2020, the East Palo Alto City Council (“City Council”) proclaimed a local emergency due to COVID-19 and the local emergency is still in effect; and WHEREAS, in March 2020, the Governor’s Executive Order N-29-20 suspended Brown Act requirements related to teleconferencing during the COVID-19 pandemic provided that notice, accessibility, and other requirements were met, and the public was allowed to observe and address the legislative body at the meeting, and subsequently adopted Executive Order N-08-21 extending the previous order until September 30, 2021 and on September 16, 2021, the Governor signed into law AB 361 to allow the continued use of virtual public meetings during a declared state of emergency without conforming to the Brown Act teleconferencing rules during a declared state of emergency if certain findings were made; and
WHEREAS, since March 2020, the City Council and the City’s boards, commissions, and committees (“City Advisory Bodies”) have conducted their meetings virtually, as authorized by the Executive Order and since October 2021, the City Council has adopted resolutions, on a monthly basis, making the required AB 361 findings to continue virtual public meetings for the City Council and City advisory bodies; and
WHEREAS, throughout the world over 6 million people have succumbed to the coronavirus, which has morphed into several variants of concern, including Delta and Omicron; and

3.7.a
Packet Pg. 118 Attachment: Resolution (2253 : AB 361 Authority for Virtual Public Meetings) Resolution No. XX-2022 2 of 2
WHEREAS, in the past month the number of cases has risen above the number during last winter’s surge and the County of San Mateo is in the U.S. Centers for Disease Control and Prevention’s yellow tier and the fact that many people, particularly young children are unvaccinated and concerns remain regarding the return to regular in-person operations; and WHEREAS, given the heightened risks of these variants of COVID-19 in the community, holding indoor meetings with all members of the City Council, staff, and the public in attendance would pose an unnecessary and immediate health and safety risk to the attendees.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY:

1. Adopts the recitals set forth herein as findings of fact;

2. Incorporates by this reference prior City Council resolutions making the AB 361 findings necessary to continue virtual public meetings for the City Council and City Advisory Bodies during the COVID-19 State of Emergency;

3. Determines that, after having reconsidered the circumstances of the state of emergency, finds that the emergency continues to directly impact the ability of members to safely meet in person; and

4. Suspends the Brown Act teleconferencing rules in accordance with AB 361, and based on the findings and determinations herein, thereby authorizing the use of virtual meetings of the City Council and City Advisory Bodies, during the month of June 2022.

PASSED AND ADOPTED this 17th day of May 2022, by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

Ruben Abrica, Mayor
ATTEST: APPROVED AS TO FORM:

City Clerk Valerie J. Armento, Interim City Attorney

3.7.a
Packet Pg. 119 Attachment: Resolution (2253 : AB 361 Authority for Virtual Public Meetings)

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: May 17, 2022
TO: Honorable Mayor and Members of the City Council
VIA: Patrick Heisinger, Interim City Manager
BY: Patrick Heisinger, Interim City Manager
SUBJECT: Grand Jury Report: “Ransomware: It is not enough to think you are protected” Recommendation
Staff recommends that the City Council authorize the Mayor to sign the City’s response to the San Mateo County 2019-20 civil grand jury report: “Ransomware: It is not enough to think that you are protected.”
Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 1: Enhance Public Safety and Emergency Preparedness Priority No. 4: Improve Public Facilities and Infrastructure Background
The San Mateo County civil grand jury is an independent investigative body composed of 19 citizens who conduct fact-finding efforts and issue written reports containing specific recommendations to improve local government operations.

The 2019-20 San Mateo County civil grand jury selected the following issue for exploration:
“City and county government computer systems are at risk of Ransomware attacks. Are adequate measures being taken by local government agencies to mitigate the risks and provide recovery options?” The civil grand jury’s work resulted in the report “Ransomware: It is not enough to think that you are protected,” which is provided in Attachment 1.

On May 2, 2022, the Interim City Manager received a letter from the San Mateo civil grand jury stating that the City of East Palo Alto never responded to the grand jury’s earlier request and urging the City to do so, as soon as is reasonably possible.

Analysis

3.8 Packet Pg. 120
Please see Attachment 2, which shall serve as the City’s official response to the San Mateo County civil grand jury report.

Fiscal Impact
There are no fiscal impacts associated with this report.

Public Notice
The public was provided notice by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Environmental
The action being considered does not constitute a “Project” within the meaning of the California Environmental Quality Act (CEQA), pursuant to CEQA Guideline section 15378 (b)(5), in that it is a government administrative activity that will not result in direct or indirect changes in the environment.

Attachments

1. Grand Jury Report

2. City Response Letter

3.8 Packet Pg. 121
2019-2020 San Mateo County Civil Grand Jury 1
Ransomware:

It Is Not Enough To Think You Are Protected
Issue | Summary | Glossary | Background | Discussion | Findings Recommendations | Methodology | Bibliography | Appendixes | Responses ISSUE
City and county government computer systems are at risk of Ransomware attacks. Are adequate measures being taken by local government agencies to mitigate the risks and provide recovery options?

SUMMARY
Ransomware has already hit many governmental Information Technology (IT) systems in San Mateo County. In December 2019 the Grand Jury sent an online survey to all 68 public entities in San Mateo County,1 received 37 survey responses (a 54% response rate), and interviewed several responders including one IT Manager (who had refused to respond to the survey for fear of being successfully attacked once again), for a total of 38 responses via survey and interview.

More than 25% (10 of 38) of the public entities responding to the Grand Jury reported that they have been a victim of one or more Ransomware attacks. More concerning is the certainty that there will be more attempts to violate the integrity of our local governments’ electronic infrastructure.

This report is intended to present “best practices” in developing a Cybersecurity strategy, then implementing and testing that plan. It addresses actions that can be taken (and have been taken, in some cases) in order to guard against Ransomware attacks, recover from an attack and the additional measures that can be taken to reduce the possibility of an attack. However, it is not an exposé with details of potential system weaknesses, in light of the need for Cybersecurity strategies and practices to be highly confidential. As such, this report walks the line between providing an informed discussion of potential concerns without providing a road map of how to breach public government IT systems.

The single largest exposure every organization has to cyber-thieves is phishing, the illegal practice of sending legitimate-looking emails to an organization’s employees. These emails may contain malware or links that, when clicked, infect the computer with a virus that can spread to the entire information systems network.

Although many email software programs include some level of protection against Ransomware attacks, such protections require customization and activation, and it is not clear that local public

1 See Appendix F: Public Entities in San Mateo County (Cities, County, School Districts, Special Districts)

3.8.a
Packet Pg. 122 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 2
entity IT departments are undertaking these necessary customization and activation steps. In addition, training for new employees and recurring training for existing employees is critical to dramatically reducing the probability of a Ransomware infection. In some agencies, it appears that only limited training is provided for new employees with little or no recurring training provided for current employees.2
Ransomware and other malware attacks are a test to an organization’s backup and restoration procedures.
3 The Grand Jury found that none of the survey responders has actually performed a full restore as a test of their backup process. However, without adequate testing, backups do not provide sufficient protection.

Rigorous preparation for an attack is essential if fast and full recovery is desired and the payment of a ransom is to be avoided. There are several significant steps that local public entities should take to improve their defenses, their ability to detect incursions, and their responses to Ransomware attacks. These steps include:
 Using firewalls to protect internal environments from breaches;  Using malware detection software to monitor incoming emails and network activity;  Ensuring that users are educated and tested to learn what to watch for and avoid, especially in emails;
 Developing and fully testing a thorough backup and restore strategy to enable a complete recovery from an attack;
 Putting in place internal controls such as subnets, which require departmental authorization to access other department’s data or programs.

In addition, cloud hosting should be considered for email and certain applications to reduce the success of Malware and Ransomware attacks on information systems infrastructure.

While all attacks are malicious in terms of time and potential data loss, in the case of Ransomware (or worse, Ransomware 2.0 that also infects backup data) the financial cost of paying the ransom in order to remove the infection and restore a data system can be significant.

Alternatively, if the decision is to not pay the ransom but to attempt to recover from the infection manually, the direct and indirect costs could be considerably more.

This report is directed to the governing bodies of government entities in San Mateo County urging them to have their IT staff confidentially and urgently assess their respective Ransomware protection strategies and training and then move with all deliberate speed to address any shortcomings in their Cybersecurity programs.

GLOSSARY

CLOUD COMPUTING
Cloud computing is the delivery of on-demand computing services -- from applications to storage and processing power -- typically over the internet and on a pay-as-you-go basis. Rather

2 Grand Jury interviews
3 Epicor Corporation, Protecting Yourself From Ransomware, January 2020

3.8.a
Packet Pg. 123 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 3
than owning their own computing infrastructure or data centers, companies can rent access to anything from applications to storage from a cloud service provider.4 Some examples of this are Yahoo Mail, services like Google Docs, and customer relationship management software.5

CYBERSECURITY
Cybersecurity refers to the body of technologies, processes, and practices designed to protect networks, devices, programs, and data from attack, damage, or unauthorized access.6 Cybersecurity is a combination of secure systems (hardware and software) built into technology as well as human intervention, monitoring, training, awareness, and recovery.

ENCRYPTION
The process of locking out the contents of a file and the renaming of the file such that it cannot be opened and used in the intended application (e.g. Microsoft Excel). Typically, a 128 Bit (or larger) encryption key (a long series of letters and numbers) is used first to encrypt then later to un-encrypt a file.

MALWARE
Short for “malicious software,” this software is designed specifically to damage or disrupt computer systems. Not all malware is Ransomware because some malware has no related attempt to extort money.

PHISHING
The illegal practice of sending email claiming to be from reputable companies to induce individuals to reveal personal information or click on website links or open attachments that then install malware.

RANSOMWARE
Ransomware can be simply described as an infection on a host machine that prevents access to data until a ransom is paid. The most common method of infection is to encrypt files making them totally unreadable by a user. The infection is usually delivered by a Trojan Horse (a term referring to the misleading of users of its true intent) installed when a user clicks on a malicious link or attachment in an email.

RANSOMWARE 2.0
This newer version of Ransomware no longer is just malware that encrypts data and asks for ransom, the attacker also threatens to release the data onto the internet and demands money in order not to do so. This newer Ransomware works in such a way that even backup copies of most important files will not be able to save an infected organization.7 By planting the malware but delaying its activation, Ransomware 2.0 can infect backups thus defeating their value.

4 https://www.zdnet.com/article/what-is-cloud-computing-everything-you-need-to-know-from-public-and-privatecloud-to-software-as-a/ 5 Pearson Education, Ubuntu Unleashed 2015 Edition: Covering 14.10 and 15.04, page 655 6 https://digitalguardian.com/blog/what-cyber-security
7 https://www.itproportal.com/news/welcome-to-the-era-of-ransomware-20/

3.8.a
Packet Pg. 124 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 4

BACKGROUND
Ransomware is a real and serious threat to every entity: government organizations, corporations, and individuals. The more dependence an organization has on the software and data in its network(s), the more important the concern should be. Loss of access to mission-critical data, systems, and software can severely impact an organization in both the short and long term.

According to an October 2019 report by the National League of Cities, since 2013, Ransomware attacks have been reported by at least 170 county, city or state government entities across the United States.
8 The actual number is likely to be much higher because it represents only those attacks that have been reported. Many infections go unreported when ransoms are paid, 9 when
organizations are seeking to avoid embarrassment, or when the attacks were simply undetected or untraceable.10 This has been true even in San Mateo County where local public governing entities have had Ransomware attacks that were not publicly reported. 11 Not only do such data breaches embarrass and slow organizational productivity, they can be very expensive. For example, the MIT Technical Review (2019) asserts: “Ransomware may have cost the U.S. more than $7.5 billion in 2019… the victims were 113 governments and agencies, 764 health-care providers, and up to 1,233 individual schools affected by Ransomware attacks…most local governments do a poor job of practicing Cybersecurity.”12 The cost to the city of Atlanta to recover from its Ransomware breach was estimated at $17 million.13 Similarly, a recent Baltimore Ransomware breach is estimated to have cost over $18 million.14 In 2020, the UC San Francisco School of Medicine paid $1.14 million in ransom to recover its own data. 15 These are
large cities and entities and although the ransom amounts they paid may not represent the expenses a San Mateo County public organization could incur, they provide examples of the severity of the potential threat and the enormous costs.

Specifically, the costs of a Ransomware attack could include some or all of the following:16  Direct Costs:
o Paying the ransom to obtain an encryption key and hoping that it works;

8 National League of Cities report, Protecting Our Data: What Cities Should Know About Cybersecurity. Forward by Clarence Anthony, CEO and Executive Director.
9 https://healthitsecurity.com/news/as-ransomware-attacks-increase-dhs-alerts-to-Cybersecurity-insights 10 Sheehan, Patrick, Ohio Emergency Management Agency, Cascading Effects of Cyber Security on Ohio, September 19, 2012
11 Grand Jury survey responses
12 MIT Technology Review, Ransomware may have cost the US more than $7.5 billion in 2019, January 2, 2020 13 The Atlanta Journal- Constitution, Stephen Deere. Confidential Report: Atlanta’s cyber attack could cost taxpayers $17 million. August 2018.
14 Baltimore Sun, Ian Duncan, Baltimore estimated cost of ransomware attack at $18.2 million as government begins to restore email accounts. May 29, 2019.
15 San Jose Mercury News, David Wu, “UCSF pays $1.14 million ransom to recover data”, July 4, 2020 16 https://www.sentinelone.com/blog/what-is-the-true-cost-of-a-ransomware-attack-6-factors-to-consider/

3.8.a
Packet Pg. 125 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 5
o Expenditures for outside IT professionals and new systems providers to plan and implement improved breach security based on new Ransomware strategies; o Paying for enrollments in credit reporting bureaus to stop or correct identity thefts (from the release of previously confidential or secure personal information) for client/customers.
o Replacing hardware and/or software.
 Indirect Costs:
o Operations efforts to restore systems and data;
o Organizational downtime as well as employee overtime; o Reputation loss including negative public relations and loss of confidence by the organizations’ constituents;
o Liabilities for legal costs, including defense of lawsuits for breach of private and confidential information and poor handling of personal data.

According to the Coveware Report,
17 the median ransom payment in the first quarter of 2020 was $44,021. This was an increase of roughly 10% over the last quarter of 2019. Public sector entities represented 12% of attacks, about half of which were school systems. The average days of downtime was 15 representing an alarming number of days of inability to service constituents.
18 This underlines an urgent need to understand and evaluate current local governments’ Cybersecurity strategies.

The discussion that follows is intended to encourage local public agencies and their IT staff to confidentially evaluate their respective Cybersecurity plans, software and prevention strategies.

Since data and systems security are essential to the operation of every public entity in the County, the discussion will not present a specific road map for potential Ransomware-prevention actions but rather establish a “best practice model” that will enhance understanding of the elements essential for an adequate protection plan.

DISCUSSION
In December 2019, the Grand Jury developed an online survey that was sent to all 68 public entities in San Mateo County.
19 Responses were received from 37 of the entities (a 54% response rate). Additionally, follow-up interviews were conducted with three local public IT Managers, one of whom had refused to complete the online survey for fear of disclosing confidential information that could lead to a successful malware or Ransomware attack. These interviewees were questioned regarding the adequacy of Cybersecurity planning and execution.

Following a general analysis of local government practices, this report concludes with a review of Cybersecurity best practices which local agencies should consider adopting.

Two Ransomware Attacks Derailed: Best Practices in Action

17 https://www.coveware.com/blog/q1-2020-ransomware-marketplace-report 18 https://www.msspalert.com/Cybersecurity-research/average-ransomware-payment-rises-again-research/ 19 Appendix F

3.8.a
Packet Pg. 126 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 6
In order to better understand how to successfully defeat a Ransomware attack, the Grand Jury interviewed an IT Manager of a private enterprise that was attacked twice by Ransomware and was able to fully restore the environment and re-establish workflow within just a few hours.

Given the usual secrecy involved in most malware incursions, the following description of this IT manager’s actual experience is instructive since it offers an example of “best practices” that can guide others anticipating or facing a Ransomware threat. 20 This organization suffered two serious breaches less than two months apart and successfully recovered both times. In the first breach, within 45 minutes of a user clicking on an email attachment, the Crypto virus had spread to 12 of the organization’s 23 servers. The IT Manager was alerted to the problem both by the user whose PC was locked with the Ransomware demand on his screen and an auto alert from the network scanning software that reported unusual activity.

The IT Manager’s first action was to rapidly shut down the entire server network. This of course stopped the spread of the virus, but also prevented users from performing their jobs. Fortunately, their backup strategy implementation worked well as they were able to fully recover within hours.

The major components of the protection strategy employed included:
 Separating the network into discrete departments or segments (creating subnets) which restricted individuals’ access to only servers containing their department’s software and network storage. This limited the spreading of the virus across various departments within the organization. The analogy is a modern ship with rooms and decks that can be completely closed off from each other in the event of a fire or explosion.  Taking snapshots (copies) of their Storage Area Network (SAN) twice a day.  Completing full nightly backups of their SQL databases and incremental backups of the databases at five-minute intervals.
 Performing server backups with a commercial external backup appliance and/or service.

See Appendix D for examples of companies in this market.21  Regularly testing the restore process to ensure the successful recovery of critical server hardware. Without testing, there is no assurance that the Cybersecurity plan will work.

Moreover, even if it works once, that is no assurance it will work again, without periodic re-testing.
 Conducting weekly backups of critical personnel’s full PC hard drives.  Use the “3-2-1 strategy”
22: do three backups into two different media including one offsite.

Having all of these Cybersecurity plan components was a good start but it took much more to affect a recovery. First a commercial Virus Removal Software Tool was used which did not work (in this case). Therefore, the IT team used the snapshot copies to replace corrupted data on

20 Grand Jury Interview
21 These services include onsite and offsite backup and recovery services which are usually located outside the immediate locale.
22 Management Wire, The 3-2-1 Backup Rule and Effective Cybersecurity Strategy, January 7, 2020.

3.8.a
Packet Pg. 127 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 7
infected server units followed by the application of the incremental backups of the database to complete the restore.

This detailed example represents a well thought out and highly prepared plan, executed with precision. The first breach resulted in 4½ hours of downtime as 12 servers were infected. The second breach resulted in 6 ½ hours of downtime to recover 19 affected servers. The IT team was able to recover the servers and their data both times, become fully operational within hours, and the organization did not pay any ransom demands.

Grand Jury Cybersecurity Survey and Follow-up Interviews Survey question:23 “Has your Organization had a Ransomware attack? Specifically, has there been an instance or multiple instances when an attack has locked up a computer or computers and presented a demand for ransom to unlock the infection?” Nine survey responders and one non-survey responder interviewee, a total of 10 of 38 (37 responders to the online survey and one non-survey responder) affirmed an attack had occurred or had possibly occurred in their organization, a 26% “hit” rate. The circumstances of their attacks were reviewed.
24 The non-survey interviewee was the IT manager from a public entity in the County who was unwilling to complete the survey because they did not want to reveal that their organization had been subject to “one or more” Ransomware attacks. Nor were they willing to disclose how successful the Ransomware attack(s) were for fear that they would open themselves up to more attacks.

Survey Question:
25 “Is your Information Systems Budget adequate to secure your network properly from malicious attack?”
Thirty-two of the 37 survey respondents, or 86%, answered Yes to this question. This high percentage of “Yes” responses either indicates a high level of confidence in their defense setup, a reluctance to complain about their IT budget, or as two of our follow-up interviewees revealed26, a lack of understanding of the complexity of a well-written, well-executed Cybersecurity Plan.27 Suggesting the latter, The National League of Cities conducted a similar survey of 165 city governments nationwide and asked the same question, (“Is your budget adequate enough to secure your network properly?”): 67% replied “No”. 28
Investigation Results Regarding Backup/Restore/Maintenance The Grand Jury survey and follow-up interviews revealed that, while many local agencies have backup plans,
29 only a portion of those same agencies had successfully recovered lost files from

23 Appendix A – Question #1
24 Grand Jury Interview
25 Appendix A – Question #2
26 Grand Jury Interviews
27 Federal Communications Commission, Cyber Security Planning Guide, October 2012. 28 National League of Cities report, Protecting Our Data: What Cities Should Know About Cybersecurity, page 8 29 Appendix A – Question #3

3.8.a
Packet Pg. 128 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 8
backups and none of the survey responders had ever done a full restore of a server. 30 When an
attack occurs with inadequate backup processes in place, there is no way to recover. Moreover, a proactive and well-thought-out business continuity plan is something that all system and data administrators must embrace.

What is a good backup strategy? Certain applications provide the ability within the applications themselves to set up different types of backups and schedule them to be performed automatically. A good example of this is SQL.
31 Using a SQL-based approach, both nightly full
database backups can be scheduled as well as intermittent transaction log backups (which capture activity during small time increments), so that a recovery could be completed with virtually no loss of data. These backups should then be stored according to the 3-2-1 backup rule32 whereby three copies or versions are taken, stored on two different media, one of which is offsite. Operating systems and third-party vendors offer a multitude of backup solutions for servers. Snapshots or image backups33 provide the most complete backup and the fastest restore option.
34 Raj Samani, Chief Technology Officer for Europe at Intel Security captures the importance of a complete backup strategy, “Most Ransomware attacks can be avoided through good cyber hygiene and effective, regular data backups that are continually tested to ensure they can be restored if needed.”
35 As this discussion shows, the technology to prevent and if necessary, correct, the impact of a malware attack is available. Local government agencies must be pro-active and vigilant in using such to protect their data and their businesses.

Investigation Results Regarding Employee Training
Education is the best defense. “Preventing infection is far easier than correcting the situation as most of the infections are acquired either from a socially engineered email (one that appears reputable or from a familiar source), or from visiting an infected website, so controlling risk on your side is the easiest method.”
36 Answers to Survey Question #5 provide strong evidence for the need for the governing boards to review with their IT managers their defenses against cyberthreats: “Do you provide training to employees regarding malware?” 12 responded with a non-qualified “Yes”. Nine responded “No” (24%) and 16 responded with a qualified “Yes” (42%) and described their training as

30 Appendix A – Question #4
31 Structured Query Language (SQL) is a programming language 32 Management Wire, The 3-2-1 Backup Rule and Effective Cybersecurity Strategy, January 7, 2020. 33 Image backup consists of block by block storing of the contents of a hard drive 34 https:\\www.ltnow.com/file-backup-vs-image-backup-which-is-best/ 35 Zerto, Raj Samani, Ransomware – Mitigating the Threat of Cyber Attacks, 2019 36 Epicor, Protecting Yourself from Ransomware, January 2020

3.8.a
Packet Pg. 129 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 9
needing improvements.
37 As one survey responder commented, “The answer is yes, but a lot more needs to be done.”
Cybersecurity training is a well-established industry – providing a focused set of classes and materials designed to reduce users’ clicks on harmful links and attachments. Security training, awareness, and assessment should be a routine part of the Cybersecurity strategy in government.

Deploying such a program covers the education, training and testing of employees to recognize, delete and report attempted attacks. Studies show these programs reduce but do not eliminate user error.

Government Technology magazine captured it best in their cover story entitled “In the quest to guard against cyberthreats, can we solve the people problem? The Weakest Link.”38 The article concluded that even with the best training programs and defenses, the human element may never be completely overcome.39 This is precisely why recurring training and user testing is encouraged by best practices.

Handling Incoming Emails – Phishing Defenses
In a worldwide survey of Managed IT Service Providers (MSP’s) in 2019, “67% of Ransomware attacks originated from a phishing or spam email…the easiest method of delivery and man does it pay off.”40 The greatest threats take advantage of users “within” the network, i.e., users who click on malicious links or open email attachments that contain viruses or make other mistakes that allow hackers to gain access to the entity’s system or network. Trend Micro estimates that the vast majority of all attacks occur when a user clicks on something they should not.41 There are different ways to help the user community recognize and protect against a phishing attack. Most network environments utilize spam filters to automatically filter incoming messages. Spam filters are used to detect unsolicited, unwanted, and virus-infested email and stop it from getting into email inboxes.42 “Additionally, malware detection software can also be highly successful in reducing the risk of Ransomware but the anti-malware definitions (a database of known infectious code) need to be constantly updated…which takes effort and time but represents the single most effective defensive strategy.”43 Message rules can be used to flag external emails and thereby decrease the probability that a user clicks on bad content. An administrator can set up message rules on a users’ client or the email server. An example of a message rule might be if the sending organization includes @smithco.com in the sender’s address, the message is automatically moved the incoming message into a personal folder called “Smith Company.” A better example would be a rule that

37 Grand Jury Survey responses
38 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 39 Ibid
40 VadeSecure – Predictive Email Defense, Ransomware Attacks: Why Email is still the #1 Delivery Method”, January 16, 2020
41 https://blog.trendmicro.com/online-phishing-how-to-stay-out-of-the-hackers-nets/ 42 https://www.mailchannels.com/what-is-spam-filtering/ 43 Epicor, Protecting Yourself from Ransomware”, January 2020

3.8.a
Packet Pg. 130 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 10
flags all external emails (not from the host’s domain) and warns about the threats of clicking on attachments or weblinks. An example of this visual potential threat message rule is displayed in Appendix C.

Message rules can be very powerful to alert users of potential threats or to be careful about what they might click on and endanger their system. Some of the vendors listed in Appendix B also can “report” a suspected phishing attempt to an IT administrator. The Grand Jury’s review revealed that some of the Information Technology Services departments for local public entities have installed message rules on their email servers to notify users of external emails.44 This is a “best practice” which all local governmental agencies should consider.

Phishing emails are easy to create, as they do not take a high level of skill to provide the illusion of legitimacy by mimicking web-site brands or using logos from Google images. They can also easily spoof (fake) an email address to look like a trusted source.45 It can often be very difficult to catch these risky emails, as the spoofed emails are cleverly disguised. A YouTube video created by Cisco Systems illustrates the sophisticated approach a phishing email may take – “Anatomy of an Attack”.46 It shows an attacker constructing a realistic identity deception email and can be viewed at https://www.youtube.com/watch?v=4gR562GW7TI After you watch this video please note, had an email filter caught this message and flagged it as external and warned about clicking on links, the deception may have been caught.

What Does Excellent Cyber Defense Look Like?
Survey Question47: “What defenses do you currently employ to block malware? Please be specific. (Firewall brand/model, Software filters/spam blocker, etc.)” Five survey responders did not divulge the infrastructure of their environment. 17 responders provided abbreviated details indicating they do have Cybersecurity protections in place. The remaining 15 responses were explicit about their organizations’ hardware and software defense strategies. Below is a survey response that illustrates a well-protected environment using some of the best practices of Cybersecurity:
“At the first layer, we use a PAN 220 Firewall with all subscriptions enabled, (URL Filtering, Antivirus/Vulnerability, Wildfire, etc.), block all international countries both in and outbound.

Once traffic is passed for email, it passes through a Barracuda spam filter, filtering and scanning phishing and virus emails, checks with External Reputation servers for known virus and spamming servers, then passes to an on-premise exchange server. The exchange servers have another layer installed, Symantec Antivirus, giving a third layer of scanning. All servers and workstations have the latest version of the antivirus installed controlled by a centralized server.

Window patches are applied on a monthly basis to all servers and workstations, and servers are retired once Microsoft ends support for an operating system.” 48

44 Grand Jury interviews
45 Ibid
46 Cisco Systems, Ransomware - Anatomy of an Attack, https://www.youtube.com/watch?v=4gR562GW7TI 47 Appendix A - Question #6
48 Grand Jury Survey response

3.8.a
Packet Pg. 131 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 11
The survey respondent’s best practices:
 Filtering incoming email for viruses, malware, and phishing attempts;  Utilizing protection software from multiple vendors;
 Utilizing multiple layers of defense;
 Keeping systems up-to date.

Breaches and attacks that manage to extract data (Ransomware 2.0) expose additional risks to sensitive information. Security professionals point out additional options for securing organizational data:49
 Use Subnets50 to section out servers with separate security permissions and limited access;
 Disable and block unused services, protocols and ports;  Perform Backup & Recovery (focus on full testing of recovery);  Strengthen the password policy (long, complex, with expiration dates);  Employ 2-factor authentication (password then keycode) for external user access.51  Install Anti-malware / Antivirus software on all machines and keep current (update at least monthly);
 Update at least monthly, patches for operating systems, firewalls, spam filters, malware, and other key applications;
 Perform monitoring and auditing of failed logins, password changes, resource usage, and services stopping.

Local public entities can get assistance from The Federal Communications Commission’s (FCC) Cyber Security Planning Guide that includes a customized Cyber Security Planning Tool to craft and execute a customizable Cybersecurity plan.52 As their introduction explains, “data security is crucial … customer and client information, payment information, personal files, bank account details … all of this information is often impossible to replace if lost and dangerous in the hands of criminals… losing (your data) to hackers or malware infection can have far graver consequences.”
53 Public entities should take advantage of this Guide in reviewing the current status of their own data system security.

When answering questions of respondents via email it was found that some already use cloud hosting for email.
54 During the interviews it was further uncovered that a school IT manager is considering additional cloud hosting of one or more of their applications. Cloud providers are able to provide layers of protection for a customer’s network and software, as well as creating a segregation between their network and their customers. A cloud provider will patch and

49 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 50 https://searchnetworking.techtarget.com/tutorial/Protocols-Lesson-6-IP-subnetting-The-basic-concepts 51 The County’s Office of the Assessor-County Clerk-Recorder and Elections has already instituted 2-factor authentication. 2018-2019 Grand Jury Report – Security of Election Announcements. 52 Federal Communications Commission, Cyber Security Planning Guide https://transition.fcc.gov/cyber/cyberplanner.pdf and FCC Cyber Security Planner (customizable) https://www.fcc.gov/cyberplanner
53 Ibid, page PDS-1
54 eMails received from public domain accounts

3.8.a
Packet Pg. 132 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 12
maintain current software versions, leverage security and malware and have a dedicated security team (24x7x365) that is responsible for staying on top of the security risks.55 Conclusions
Grand Jury survey results and in-depth interviews determined that some local government agencies have Cybersecurity strategies in place. For them, this report is asking those IT departments to re-challenge the sufficiency of their employee training, the regular (full) testing of their defense strategies and the adequacy/age of their Cybersecurity strategy including consideration of cloud hosting. For the rest, this is a good time to complete a review and see what additional measures can be taken to beef up their IT security using the information provided in this report as a guide. The biggest trap is believing that a malware attack, or in the worst case a Ransomware attack, is unlikely to happen to organizations and that the Cybersecurity strategies already in place are sufficient to successfully recover.

As learned from the best practices example of the IT manager who thwarted two attacks successfully, a comprehensive Cybersecurity plan includes user prevention steps, spam and malware software, back-ups and full recovery testing. These suggestions as well as those from the professional literature on Cybersecurity include the following list of best practices:
 Anti-Malware definitions need to be constantly updated to retain their effectiveness.  Software updates need to be kept current.
 To identify external emails, message rules can be used to flag external emails and thereby decrease the probability that a user clicks on bad content.  To thwart phishing attempts, footers can be added to incoming emails to warn about opening attachments and clicking on links (see Appendix C).  Security training, awareness and assessment need to be routine along with testing all employees to recognize, delete and report attempted attacks (See Appendix B).  Establishing a thorough and comprehensive backup process for all Servers using the 3-2- 1 rule and establishing a separate backup process for key users’ critical folders (e.g., administration, accounting, human resources) to be able to restore/recover from a secure onsite and/or offsite backup.
 Snapshots and/or image backups provide the most complete backup and the fastest recovery option.
 Consider cloud-hosting of email and other applications to provide added security, backup & restore capabilities and filtering benefits to close the largest and easiest route for Ransomware to penetrate entity systems.

FINDINGS
F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

55 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018

3.8.a
Packet Pg. 133 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 13
F3. The direct and indirect costs of Ransomware can be significant.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

RECOMMENDATIONS
The Grand Jury recommends that each governing body undertake its own confidential effort to protect against Ransomware attacks. Specifically:

R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of

3.8.a
Packet Pg. 134 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 14
Homeland Security56 and/or a cyber hygiene assessment from the County Controller’s Office.57
R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

METHODOLOGY
Documents
 Attack incident reports were requested from IT Departments who experienced attack(s).

No incident reports were received.

Site Tours
 No site tours were performed as a part of this report.

Interviews
Reports issued by the Civil Grand Jury do not identify individuals interviewed. Penal Code Section 929 requires that reports of the Grand Jury not contain the name of any person or facts leading to the identity of any person who provides information to the Civil Grand Jury.
 Three Information Systems Managers of three different public entity IT organizations.  Two non-public professional IT Managers. Both of these Managers’ IT infrastructure environments had been infected with Ransomware attacks. One paid the ransom and the other did not.
 A professional Ransomware expert who often consults with companies who have been attacked or desire assistance preventing attacks. He also teaches classes on preparing for and preventing Ransomware attacks.
 Numerous security industry professionals at the RSA Conference held at Moscone Center in San Francisco between February 24th and 28th 2020.

BIBLIOGRAPHY
Anslinger, Joe. “File Backup vs. Image Backup – Which is Best?” Lieberman Technology. June 11, 2013. https://www.ltnow.com/file-backup-vs-image-backup-which-is-best/ Cisco Systems. Ransomware - Anatomy of an Attack.
https://www.youtube.com/watch?v=4gR562GW7TI

56 https://www.us-cert.gov/resources/assessments
57 2018-2019 San Mateo Grand Jury Report – Security of Election Announcements

3.8.a
Packet Pg. 135 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 15
Coveware, “Ransomware Payments Increase In Evolving Distribution of Enterprise Ransomware Variants.” April 29, 2020. https://www.coveware.com/blog/q1-2020-ransomwaremarketplace-report Davis, Jessica. “As Ransomware Attacks Increase, DHS Alerts to Cybersecurity Insights.” Health IT Security, September 9, 2019. https://healthitsecurity.com/news/as-ransomwareattacks-increase-dhs-alerts-to-cybersecurity-insights Deere, Stephen. “Confidential Report: Atlanta’s Cyber Attack Could Cost Taxpayers $17 Million.” The Atlanta Journal- Constitution. August 2018.

Department of Homeland Security (DHS): Cybersecurity and Infrastructure Security Agency (CISA). “Assessments: Cyber Resilience Review (CRR)” https://www.uscert.gov/resources/assessments Duncan, Ian. “Baltimore Estimated Cost of Ransomware Attack at $18.2 Million as Government Begins to Restore Email Accounts.” Baltimore Sun, May 29, 2019.

Epicor Corporation. Protecting Yourself From Ransomware. January 2020.

Fadilpasic, Sead. “Welcome to the era of Ransomware 2.0” ITProPortal. February 12, 2020. https://www.itproportal.com/news/welcome-to-the-era-of-ransomware-20/ Federal Communications Commission. Cyber Security Planning Guide. https://www.fcc.gov/cyber/cyberplanner.pdf
Gutman, Yotam. “What is the True Cost of a Ransomware Attack.” SentinelOne. January 8, 2020. https://www.sentinelone.com/blog/what-is-the-true-cost-of-a-ransomware-attack-6-factorsto-consider/ Iloh, Raphael. ”The 3-2-1 Backup Rule and Effective Cybersecurity Strategy.” Management Wire. January 7, 2020. https://www.managementwire.com/the-3-2-1-backup-rule-and-effectivecybersecurity-strategy/ Jendre, Adrien.” Ransomware Attacks: Why Email Is Still the #1 Delivery Method.” Vade Security. January 16, 2020. https://www.vadesecure.com/en/ransomware-attacks-why-email-isstill-the-1-delivery-method/ Kass, DH. “Average Ransomware Payment Rises Again: Research.” MSSP Alert. April 30, 2020. https://www.msspalert.com/cybersecurity-research/average-ransomware-payment-risesagain-research/ Kraft Technology Group. “When Was The Last Time You Tested Your Business Backups?” https://www.kraftgrp.com/when-was-the-last-time-you-tested-your-business-backups/

3.8.a
Packet Pg. 136 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 16
MailChannels. “What is Spam Filtering?” https://www.mailchannels.com/what-is-spamfiltering/ MIT Technology Review, “Ransomware May Have Cost the US More Than $7.5Billion in 2019.” January 2, 2020. https://www.technologyreview.com/2020/01/02/131035/ransomwaremay-have-cost-the-us-more-than-75-billion-in-2019/ National League of Cities Report. “Protecting Our Data: What Cities Should Know About Cybersecurity.” Forward by Clarence Anthony, CEO and Executive Director.

Pearson Education. Ubuntu Unleashed. 2015 Edition. Page 655.

Ranger, Steve. “What is cloud computing? Everything you need to know about the cloud explained.” ZD Net, December 13, 2018. https://www.zdnet.com/article/what-is-cloudcomputing-everything-you-need-to-know-from-public-and-private-cloud-to-software-as-a/ Samani, Raj. “Ransomware – Mitigating the Threat of Cyber Security Attacks.” Zerto. 2019. https://www.zerto.com/wp-content/uploads/2019/09/ransomware-mitigating-the-threat-of-cybersecurity-attacks.pdf San Mateo Grand Jury Report. Security of Election Announcements. 2018-2019.

Search Networking, “Protocols, Lesson 6: IP subnetting - The basic concepts.” October 2004. https://searchnetworking.techtarget.com/tutorial/Protocols-Lesson-6-IP-subnetting-The-basicconcepts Sheehan, Patrick. “Cascading Effects of Cyber Security on Ohio.” Ohio Emergency Management Agency. September 19, 2012.

Stone, Adam. The Weakest Link. Government Technology Magazine, October/November 2018.

Trend Micro. “Online Phishing: How To Stay Out Of The Hackers’ Nets” November 20, 2019. https://blog.trendmicro.com/online-phishing-how-to-stay-out-of-the-hackers-nets/ Wu, David. “UCSF pays $1.14 Million Ransom to Recover Data.” San Jose Mercury News. July 4, 2020.

3.8.a
Packet Pg. 137 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 17
APPENDIX A – SURVEY QUESTIONS

1. Has your Organization had a Ransomware attack? Specifically, has there been an instance or multiple instances when an attack has locked up a computer or computers and presented a demand for ransom to unlock the infection?
If you answered Yes or Possibly to Question 1, please provide a detailed description of the attack. What actions were taken once the attack was realized?

2. Is your Information Systems Budget adequate to secure your network properly from malicious attack?

3. Please provide an explanation of your Systems Backup processes? How often are backups run, where do you store the Backups?

4. Have you ever had to Restore from Backups? Please describe in detail why you did the Restore and describe the process used.

5. Do you provide training to employees regarding Malware?

6. What defenses do you currently employ to block malware? Please be specific. (Firewall brand/model, Software filters/spam blocker, etc.)
APPENDIX B – EMPLOYEE TRAINING OPTIONS
Phishing is the primary method of entry in cyber-attacks worldwide. Over the past few years, some security industry companies have come up with excellent testing, training, monitoring, measuring and reporting solution to help with employee training. The primary goal of an employee training program is to change user’s behavior when viewing emails that might contain threats.

The typical components of these solutions include:
 Customized phishing attacks designed to test employees in spotting attack attempts  Provide users a simple to use reporting tool to flag suspected attacks  An incidence response platform for controlling the spread of an attack  Reporting dashboards tracking user click-throughs
 Employee training programs
Here are some website links for the companies offering training solutions. www.knowbe4.com
www.lucysecurity.com
www.metacompliance.com
www.mediapro.com
www.cofense.com
www.elevatesecurity.com
www.securitymentor.com

3.8.a
Packet Pg. 138 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 18
www.habitu8.io
APPENDIX C – EMAIL MESSAGE RULE - EXTERNAL
APPENDIX D – BACKUP & RECOVERY APPLIANCES & SERVICES
There are a large number of companies that provide Backup and Recovery solutions. Solutions Review has prepared a buyer’s guide for the leading vendors. Click on the following link or copy and paste this URL into a browser to get your own copy of this guide. https://solutionsreview.com/backup-disaster-recovery/get-a-free-backup-and-disaster-recoverybuyers-guide/ Specifically, some of the vendors in this report do not provide appliances, only virtual server support. Here is a partial list of appliance and solution vendors:
www.unitrends.com
www.barracuda.com
www.carbonite.com
www.commvault.com
www.dellemc.com
www.axcient.com
www.cohesity.com
www.datto.com
www.infrascale.com
APPENDIX E – PHISHING DEFENSE VENDORS
Some companies that provide solutions that improve email defenses are:
https://www.opswat.com/products/metadefender/email-gateway-security https://www.agari.com/products/phishing-defense/
https://www.inky.com/anti-phishing-software
https://www.mimecast.com/products/email-security-with-targeted-threat-protection/

3.8.a
Packet Pg. 139 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019
-2020 San Mateo County Civil Grand Jury 19
APPENDIX F: PUBLIC ENTITIES IN SAN MATEO COUNTY(68)
City/Town Governments (20)
Town of Atherton
City of Belmont
City of Brisbane
City of Burlingame
City of Colma
City of Daly City
City of East Palo Alto
City of Foster City
City of Half Moon Bay
City of Hillsborough
City of Menlo Park
City of Millbrae
City of Pacifica
Town of Portola Valley
City of Redwood City
City of San Bruno
City of San Carlos
City of San Mateo
City of South San Francisco
Town of Woodside
County Government (1)
County of San Mateo, Information Services Department
School Districts (25)
Bayshore Elementary School District
Belmont Redwood Shores School District
Brisbane School District
Burlingame School District
Cabrillo Unified School District
Hillsborough City School District
Jefferson Elementary School District
Jefferson Union High School District
La Honda Pescadero School District
Las Lomitas Elementary School District
Menlo Park City School District
Millbrae School District
Pacifica School District
Portola Valley School District
Ravenswood City School District
Redwood City School District
San Bruno Park School District
San Carlos School District

3.8.a
Packet Pg. 140 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 2019-2020 San Mateo County Civil Grand Jury 20
San Mateo Foster City School District
San Mateo Union High School District
Sequoia Union High School District
San Mateo County Community College School District
San Mateo County Office of Education
South San Francsico Unified School District
Woodside School District
Independent Special Districts (22)
Bayshore Sanitary District
Broadmoor Police Protection District
Coastside County Water District
Coastside Fire Protection District
Colma Fire Protection District
East Palo Alto Sanitary District
Granada Community Services District
Highlands Recreation District
Ladera Recreation District
Menlo Park Fire Protection District
Mid Peninsula Regional Open Space District
Mid-Peninsula Water District
Montara Water and Sanitary District
North Coast County Water District
Peninsula Health Care District
San Mateo County Harbor District
San Mateo County Mosquito and Vector Control District
San Mateo County Resource Conservation District
Sequoia Healthcare
West Bay Sanitary District
Westborough Water District
Woodside Fire Protection District
Not Included: County-governed special districts and subsidiary special districts governed by their respective city councils.

Issued: October 7, 2020

3.8.a
Packet Pg. 141 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) 155 Bovet Road, Suite 650, ⚫ San Mateo, CA 94402 ⚫ ph 650 349 3000 ⚫ fx 650 349 8395 ⚫ www.bawsca.org 17624043.3
June 23, 2021
The Hon. Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063-1655
Subject: Bay Area Water Supply & Conservation Agency Response to Grand Jury Report Entitled “Ransomware: It Is Not Enough To Think You Are Protected”
Dear Honorable Chou:

The Bay Area Water Supply & Conservation Agency (Agency) received the 2019-2020 Grand Jury report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” In response, the Agency’s Board of Directors requested an internal IT report regarding the Agency's cybersecurity practices, which it received at the May 20, 2021 regular Board meeting. In addition, this letter responds to all of the findings and recommendations in the Grand Jury report.

Responses to Findings:

1. Ransomware is a real and growing threat to public entities, including those in San Mateo County.

The Agency agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

The Agency does not have first-hand knowledge to agree or disagree with this statistic. The Agency nonetheless accepts the Grand Jury's finding.

3. The direct and indirect costs of Ransomware can be significant.

The Agency agrees with this Finding.

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The Agency agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The Agency agrees with this Finding.

6. The identification of the phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The Agency agrees with this Finding.

3.8.a
Packet Pg. 142 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) Hon. Danny Y. Chou
June 23, 2021

17624043.3

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost information.

The Agency agrees with this Finding.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The Agency agrees with this Finding.

Responses to Recommendations:

1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:
a. System Security (Firewalls, Anti-malware/ Antivirus software, use of subnets, strong password policies, updating/patching regularly)
b. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)
c. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
The recommendation has been implemented.

2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

The recommendation has been implemented. The Agency's Board of Directors received a confidential report on May 20, 2021.

3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller's Office.

Based on the internal report, the Agency has not decided to request further guidance at this time. However, the Agency accepts this recommendation and will request outside guidance if appropriate based on future circumstances.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC's Cybersecurity Planning Guide and consider customizing it using FCC's Create Custom Cybersecurity Planning Guide tool.

The Agency will implement this recommendation and will consult the FCC Cybersecurity Planning Guide in future updates to its Cybersecurity Plan.

3.8.a
Packet Pg. 143 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) Hon. Danny Y. Chou
June 23, 2021

17624043.3
The Agency appreciates the effort that the Grand Jury put into the important cybersecurity issue and the opportunity to respond to the Grand Jury report. Please let us know if the Agency can provide additional information.

Very truly yours,
Nicole Sandkulla
CEO/General Manager
cc: BAWSCA Board of Directors

3.8.a
Packet Pg. 144 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) December 16, 2020
Via Email ([email protected])
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.”
Dear Judge Chou:

The Bayshore Elementary School District (the “District”) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District’s Board approved these responses, on Tuesday, December 15, 2020.

Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

The District lacks information to fully agree or disagree with this Finding given that it did not conduct the research related to this Report. The District, however, accepts the Grand Jury’s Finding for the purposes of this Response.

3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Engage. Educate. Empower.

Mrs. Maya Baker, Principal
The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2
nd Floor
Redwood City, CA 94063-1655

3.8.a
Packet Pg. 145 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) The District agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

The District lacks information to fully agree or disagree with this Finding given that it did not conduct the research related to this Report. The District, however, accepts the Grand Jury’s Finding for the purposes of this Response.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:
a. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)
b. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?) c. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) The District implemented this Recommendation on December 9, 2020 by directing the District’s IT Department to prepare a confidential report [A1]which addresses the three concerns specifically identified above.

3.8.a
Packet Pg. 146 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

The District intends to implement this Recommendation, provided that the District may require an extension of time (not to exceed six months) beyond June 30, 2021 depending on the scope, complexity, and feasibility of any recommended actions and/or enhancements.

3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Of ice.

The District will implement [A2] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The District will implement [A3] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
Audra Pittman, Ph.D.

Superintendent
Bayshore Elementary School District

3.8.a
Packet Pg. 147 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 148 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 149 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 150 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) November 9, 2020
Via Email ([email protected])
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.”
Dear Judge Chou:

The Belmont-Redwood Shores School District (the “District”) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District’s Board approved these responses, on November 9, 2020.

Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

The District lacks information to fully agree or disagree with this Finding given that it did not conduct the research related to this Report. The District, however, accepts the Grand Jury’s Finding for the purposes of this Response.

3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2
nd Floor
Redwood City, CA 94063-1655

3.8.a
Packet Pg. 151 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The District agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost information.

The District lacks information to fully agree or disagree with this Finding given that it did not conduct the research related to this Report. The District, however, accepts the Grand Jury’s Finding for the purposes of this Response.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)

3.8.a
Packet Pg. 152 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) The District implemented this Recommendation on October 23, 2020 by directing the District’s IT Department to prepare a confidential report [A1] which addresses the three concerns specifically identified above.

2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

The District intends to implement this Recommendation, provided that the District may require an extension of time (not to exceed six months) beyond June 30, 2021 depending on the scope, complexity, and feasibility of any recommended actions and/or enhancements.

3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.

The District will implement [A2] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The District will implement [A3] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
Dan Deguara
Superintendent

3.8.a
Packet Pg. 153 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 154 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 155 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 156 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 157 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 158 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 159 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 160 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 161 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 162 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 163 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 164 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 165
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 166
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 167
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 168 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 169 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 170 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 171
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 172
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 173
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

EMILY BEACH, MAYOR
ANN O’BRIEN KEIGHRAN, VICE MAYOR

RICARDO ORTIZ

MICHAEL BROWNRIGG

DONNA COLSON
TEL: (650) 558-7200
FAX: (650) 566-9282
www.burlingame.org
The City of Burlingame
CITY HALL -- 501 PRIMROSE ROAD
BURLINGAME, CALIFORNIA 94010-3997
December 7, 2020
Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 2nd Floor
Redwood City, CA 94063-1655
Subject: City of Burlingame’s response to 2019-2020 Civil Grand Jury Report entitled "Cybersecurity – It Is Not Enough To Think you Are Protected”
Dear Judge Chou:

After reviewing the 2019-2020 Grand Jury report entitled “Cybersecurity – It Is Not Enough To Think you Are Protected,” the following are the City of Burlingame’s responses to the Grand Jury’s findings:

F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The City of Burlingame agrees with this finding.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The City of Burlingame agrees with this finding, although no effort was made to substantiate the actual statistic.

F3. The direct and indirect costs of Ransomware can be significant.

Response: The City of Burlingame agrees with this finding.

F4. Cybersecurity reviews and assessments, and an updated well-executed Cybersecurity plan, are critical components of IT security strategy.

Response: The City of Burlingame agrees with this finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The City of Burlingame agrees with this finding.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F

3.8.a
Packet Pg. 174 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) The Honorable Danny Y. Chou
December 7, 2020

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org  F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The City of Burlingame agrees with this finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Response: The City of Burlingame agrees with this finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The City of Burlingame agrees with this finding.

The following are the City of Burlingame’s responses to the Grand Jury’s recommendations:

R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

Response: The City of Burlingame requested a written response to this recommendation from its IT management team, in lieu of a separate report addressing these concerns, so that management could develop a response to the final three recommendations of the report.

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)
The City of Burlingame utilizes several strategies to protect against nefarious acts including but not limited to:
 Industry recognized leaders’ dedicated firewall appliances at all electronic entry points into the City. On each firewall, all ports are blocked by default. Only known needed ports are opened, thus limiting the type of traffic coming into the City network infrastructure.
 All servers and desktops run an industry leader endpoint protection software, which is automatically updated.

It provides key protections including: endpoint detection and response (EDR), which detects and investigates suspicious activity with AI-driven analysis; anti-ransomware from sources including browsers, multi-media, MS Office applications, and email; behavioral analysis (acting on many files in a short period) issuing warnings, stopping errant processes, and notifying IT of such activity; malicious macros and other forms of code detections and protections; and exploit prevention techniques, which detect and stop common and known key vulnerabilities including zero-day attacks. The software communicates with the manufacturer’s cloud site, which continuously updates the local software with the latest protections.  VLANs, or virtual segmented networks, are used strategically throughout the organization to limit end-point access to servers and networks in which access is needed.  Password policies are considered very strong and include required changing periodically, as well as not allowing the re-use of recent passwords. Required changing has been suspended during the pandemic due to having to VPN into the City’s network, adding a layer of complexity as well as the reality of passwords expiring for users who don’t VPN in and only access cloud services such as email, with no user friendly method of notifying users or them having an easy, intuitive way to change their password.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F

3.8.a
Packet Pg. 175 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) The Honorable Danny Y. Chou
December 7, 2020

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org   All servers are patched as appropriate, generally after a short while once a patch has been released and tested by others as bug free.
 Two Factor Authentication is being researched and expected to be implemented City wide once the best solution for the City is determined.

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?) More than 12.5 TB of user data is backed up in multiple ways. Most importantly, a shadow copy is created twice daily on the server to allow for easy rollback of deleted or changed files. In addition, files are backed up to an onpremise dedicated appliance. The appliance replicates itself to the manufacturer’s cloud on a daily basis. In the event the on-premise device becomes infected with mal-ware, including ransomware, the device can be wiped clean and the data restored from the cloud’s backup. If the backup device itself fails, within three business days a new appliance will be shipped, which is pre-loaded with the City’s backed-up data. Data can also be recovered directly from the manufacturer’s cloud storage. Daily backups are preserved for 12 days, weekly backups are preserved for five weeks, monthly backups are saved for 12 months, and yearly revisions are kept for no less than two years. The process is continuously being tested in normal operations via requests from users asking IT to restore data from one of the previous day’s backups.

All databases in the City’s robust database infrastructure are included in all backup processes. As new databases are brought online, the using department is involved in determining the requirements of the backup. For example, is recovery to the previous night adequate, or is there a legitimate requirement to be able to restore the database to within the last hour, such as the City’s utility billing database in which hundreds of transactions occur daily? All database servers run a process (agent) that is part of the backup appliance solution. In addition, some databases also use the native database engine to back up a database, which is also included in the overall backup process.

The City runs in a robust, industry-best virtual environment. This not only allows the City to realize cost savings by having many virtual servers running on fewer physical servers, it also allows the City to maintain hot-standby servers in the Police Department data center.

It is the opinion of the City’s IT Manager that the testing of a system-wide recovery is not practical as it is a mix of different functions, services, and protections. In his opinion, it would be near, if not impossible, for any single incident, short of a major catastrophe such as an earthquake or fire in the City Hall data center, to bring down the entire infrastructure. Different functions/components are generally tested during the normal course of business as functions fail, servers are patched, or requested data is restored.

All network devices have their configurations backed up nightly in the event of an equipment failure or breach.

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) The City utilizes both cloud and an on-premise dedicated SPAM prevention appliance and software in which all email is first run though before being delivered to recipients. The appliance continuously communicates with the manufacturer’s secure site to update its protections to the latest known threats. In addition, the appliance wraps all links within an email with a path which, when clicked, first goes through the manufacturer’s secure cloud services to confirm (to the extent possible) that the link is legitimate and not a known hacking site.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F

3.8.a
Packet Pg. 176 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) The Honorable Danny Y. Chou
December 7, 2020

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org  The City pre-pends the subject of certain emails with [suspect] when an email contains one of many known-to-betrouble phrases such as “gift cards.” Every external email pre-pends the body of the email with a warning that the email is from an external source and to use caution when responding or clicking on any links contained within.

With more staff working remotely, IT staff has increased its frequency of cautionary e-mails warning all users of common phishing schemes and malicious links. Staff intends to work with the HR Department on implementing a segment on cybersecurity within its new employee orientation program.

Additional City Security Strategies
As cloud services become more a part of the City’s infrastructure, City IT strives to connect cloud services to its internal Active Directory security model. This allows IT staff to disable users in a single, secure place, which in turn disables them on the connected cloud services.

City IT is investigating the implementation of multi-factor authentication. This effort has been ramped up given the current pandemic environment in which the majority of the workforce is located outside of a City facility. Whereas in the past security was focused on blocking external parties from the City’s network, the pandemic has turned that strategy into one which secures endpoints theoretically located anywhere in the world. Multi-factor authentication is one of the predominant methods of securing access from outside the City’s firewalls.

The City carries cyber security insurance in the event of a data breach, which provides the City with resources to assist in the cost of recovery, including notifications to those whose personal information was likely breached. The insurance carrier also has resources available to assist the City in implementing best practices to deter cybersecurity attacks.

R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

Response: The recommendation will not be implemented, as the City believes an analysis and discussion of its cybersecurity practices are continually underway. An in-depth written report at a particular point of time would not be useful to Council or management, as its efficacy would be recognized only by the technical staff that produced the report. In the wrong hands, such a report could be used to circumvent the cybersecurity protocols the City has in place and/or is considering. In addition, management does not believe a comprehensive cybersecurity report is the best use of the City’s IT resources. The pandemic has necessitated a largely technology-driven response, and IT staff is occupied with enabling users to safely access the IT resources needed to provide continued services to the public as efficiently as possible.

If the City Council or management request additional detail or have specific concerns regarding these protocols, these will be immediately addressed. The summaries developed in response to R1 are meant to convey that the City’s IT staff are aware of the risks mentioned in the Grand Jury’s report, as evidenced by the measures currently established to prevent cyberattacks and be able to recover promptly should they occur. Staff continuously examines best practices in cybersecurity, evaluating various tools available to protect access to data, software, and hardware systems, and their suitability for the City’s use.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller's Office.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F

3.8.a
Packet Pg. 177 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) The Honorable Danny Y. Chou
December 7, 2020

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org  Response: This recommendation will not be implemented because it is not warranted at this time. Although the City IT personnel recognize the value of a cybersecurity review from the U.S. Department of Homeland Security (DHS), staff feels the security measures currently in place represent affordable, usable, and practical best practices in cybersecurity.

As noted in response to R1, City staff is very much aware of the heightened risks of cyberattacks, and has implemented protocols to guard against them and facilitate recovery in the event they do occur. Through research, trade journals and websites, and participation in a state-wide coalition of municipal IT leadership, staff continuously monitors, maintains, and upgrades to the latest cybersecurity measures, software and hardware, and best practices. If at some point in the future IT resources become available, staff will reach out to DHS and/or the County Controller’s Office for their respective assessments.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC's Cybersecurity Planning Guide and consider customizing it using FCC's Create Custom Cybersecurity Planning Guide tool (see footnote 52).

Response: This recommendation will not be implemented because it is not warranted at this time. The FCC’s Cybersecurity Planning Guide was reviewed and compared to solutions currently implemented in the City. In most cases, the recommendations were already enabled, or are planned to be in the near future. Recommended solutions within the Planning Guide not currently in place nor planned have been evaluated and deemed to be less suitable for use by the City, generally due to one or more of the following: IT assessment of the solution cost versus the risk it mitigates; alternative, yet equivalent, solutions already in place; and/or usability/complexity issues for City staff users.

The Burlingame City Council approved this response letter at its public meeting on December 7, 2020.

Sincerely,
Emily Beach
Mayor
DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F

3.8.a
Packet Pg. 178 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 179 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 180 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 181 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) City of Foster City • 610 Foster City Boulevard, Foster City, CA 94404 P: (650) 286-3200 • F: (650) 577-0983 • E: [email protected]

OFFICE OF THE CITY COUNCIL
City of Foster City
January 5, 2021
Hon. Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
Dear Judge Chou:

The City Council for the City of Foster City has had an opportunity to review the 2020 Grand Jury report entitled “Ransomware: It is Not Enough to Think You Are Protected.” After reviewing the report and allowing for public comment at its regular meeting on January 4, 2021, the City Council offers the following responses:

Responses to Findings
Finding F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The respondent agrees with the finding.

Finding F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The respondent agrees with the finding.

Finding F3. The direct and indirect costs of Ransomware can be significant.

Response: The respondent agrees with the finding.

Finding F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Response: The respondent agrees with the finding.

3.8.a
Packet Pg. 182 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) City of Foster City • 610 Foster City Boulevard, Foster City, CA 94404 P: (650) 286-3200 • F: (650) 577-0983 • E: [email protected] Finding F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The respondent agrees with the finding.

Finding F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The respondent agrees with the finding.

Finding F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Response: The respondent agrees with the finding.

Finding F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The respondent agrees with the finding.

Response to Recommendations
R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) Response: The recommendation has been implemented.

R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

Response: The recommendation will be implemented within the requested timeframe.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.

Response: The recommendation will be implemented.

3.8.a
Packet Pg. 183 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) City of Foster City • 610 Foster City Boulevard, Foster City, CA 94404 P: (650) 286-3200 • F: (650) 577-0983 • E: [email protected] R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

Response: The recommendation will be implemented.

This response was approved by the Foster City City Council, via Minute Order, at its regular meeting on January 4, 2021.

Respectfully submitted,
Sanjay Gehani
Mayor, City of Foster City
cc: [email protected]

3.8.a
Packet Pg. 184 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

MINUTE ORDER
No. 1722

OFFICE OF THE CITY CLERK

FOSTER CITY, CALIFORNIA
Date: January 5, 2021
Attention: City Council/EMID Board
Peter Pirnejad, City/District Manager
Dante Hall, Assistant City Manager
Jean Savaree, City Attorney
City Council/EMID Board of Directors Meeting Date: January 4, 2021 Subject: Response to the San Mateo County Grand Jury Report “Ransomware: It Is Not Enough to Think You Are Protected”

Motion by Councilmember Froomin, seconded by Councilmember Hindi, and carried unanimously by roll call vote, 5-0-0, IT WAS ORDERED to approve a letter to the Honorable Danny Y. Chou, Judge of the Superior Court, in response to the San Mateo County Civil Grand Jury Report, dated October 7, 2020, entitled “Ransomware: It Is Not Enough to Think You Are Protected.”

CITY CLERK/DISTRICT SECRETARY
DocuSign Envelope ID: DAA86091-E99E-4EE3-8B12-9286DA043C3E

3.8.a
Packet Pg. 185 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

CITY OF HALF MOON BAY
501 Main Street
Half Moon Bay, CA 94019
December 1, 2020
Honorable Danny Y. Chou
Judge of the Superior Court
C/O Jenarda Dubois
Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
Subject: October 7, 2020 Grand Jury Report: “Ransomware: It Is Not Enough To Think You Are Protected”
Dear Honorable Judge Chou:

The City Council of the City of Half Moon Bay, at its December 1, 2020 meeting, reviewed and approved the following responses to the San Mateo County Civil Grand Jury 2019-2020 Report entitled “Ransomware: It Is Not Enough To Think You Are Protected” Findings
The report includes eight (8) findings covering a wide range of technology issues. The City of Half Moon Bay (City) agrees with each of the eight (8) findings (F1 through F8).

Recommendations
R1: Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have the backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up a message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
Response: The recommendation has been completed. The City requested information from the IT department which provided information on the above recommendations. The City then confirmed, verified, and improved security in all three categories. The City has now met or exceeded the recommendations.

3.8.a
Packet Pg. 186 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

CITY OF HALF MOON BAY
501 Main Street
Half Moon Bay, CA 94019
R2: These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

Response: The recommendation has already been completed as part of an annual security review.

R3: Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.

Response: The recommendation will not be implemented at this time, but we may choose to do so in the future. The City already has a 3rd party auditor that reviews security periodically.

R4: Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide Tool.

Response: The recommendation has not yet been implemented. The City will implement this recommendation within the next 6 months.

Thank you for your consideration of the foregoing.

Sincerely,
Adam Eisen
Mayor

3.8.a
Packet Pg. 187 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

CITY COUNCIL AGENDA

REGULAR MEETING

CITY OF HALF MOON BAY
TUESDAY, DECEMBER 1, 2020
REMOTE PARTICIPATION (SEE NEXT PAGE) Adam Eisen, Mayor
Robert Brownstone, Vice Mayor
Deborah Penrose, Councilmember
Harvey Rarback, Councilmember
Debbie Ruddock, Councilmember
7:00 PM
This agenda contains a brief description of each item to be considered. Those wishing to address the City Council on any matter not listed on the Agenda, but within the jurisdiction of the City Council to resolve, may come forward to the podium during the Public Forum portion of the Agenda and will have a maximum of three minutes to discuss their item.

Those wishing to speak on a Public Hearing matter will be called forward at the appropriate time during the Public Hearing consideration.

Please Note: Anyone wishing to present materials to the City Council, please submit seven copies to the City Clerk.

Copies of written documentation relating to each item of business on the Agenda are on file in the Office of the City Clerk at City Hall and the Half Moon Bay Library where they are available for public inspection. If requested, the agenda shall be available in appropriate alternative formats to persons with a disability, as required by Section 202 of the Americans with Disabilities Act of 1990 (42 U.S.C. Sec. 12132.) Information may be obtained by calling 650-726- 8271.

In compliance with the Americans with Disabilities Act, special assistance for participation in this meeting can be obtained by contacting the City Clerk’s Office at 650-726-8271. A 48-hour notification will enable the City to make reasonable accommodations to ensure accessibility to this meeting (28 CFR 35.102-35.104 ADA Title II). http://hmbcity.com/

3.8.a
Packet Pg. 188 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

SPECIAL REMOTE PROTOCOLS
In accordance with Governor Newsom’s Executive Order No-29-20, this will be a teleconference meeting without a physical location to help stop the spread of COVID-19. This meeting will be conducted entirely by remote participation, in compliance with the Governor's Executive Order N-29-20 allowing for deviation of teleconference rules required by the Ralph M. Brown Act.

This meeting will be conducted via Zoom Webinar. Members of the public are welcome to login into the webinar as Attendees. During any public comment portions, attendees may use the “raise your hand” feature and will be called upon and unmuted when it is their turn to speak. Written comments ([email protected]) submitted by 5:00 p.m. on meeting day will be added to the online agenda packet and emailed to the City Council. The meeting will also be streamed on Channel 27, on pacificcoast.tv, on Facebook in English at www.facebook.com/cityofhalfmoonbay and in Spanish at www.facebook.com/halfmoonbayrecreation. Please click to join the webinar: https://zoom.us/j/93627876187 or join by phone at 669-900-9128, using Webinar ID 936-2787-6187.

CALL TO ORDER / ROLL CALL

PUBLIC FORUM

PROCLAMATIONS AND PRESENTATIONS

COUNTY OF SAN MATEO - CONTACT TRACING PRESENTATION

MAYOR'S ANNOUNCEMENTS OF COMMUNITY ACTIVITIES AND COMMUNITY SERVICE

REPORT OUT FROM RECENT CLOSED SESSION MEETINGS

CITY MANAGER UPDATES TO COUNCIL
COVID-19 UPDATE

POPLAR PILOT PARKING PROJECT UPDATE

1. CONSENT CALENDAR

1.A WAIVE READING OF RESOLUTIONS AND ORDINANCES

1.B SAN MATEO COUNTY MOSQUITO AND VECTOR CONTROL DISTRICT BOARD OF

TRUSTEES APPOINTMENT
Staff Recommendation: By motion, reappoint Kati Martin as the City of Half Moon Bay’s representative to the San Mateo County Mosquito Abatement District Board of Trustees for a four-year term commencing on January 4, 2021.

STAFF REPORT

3.8.a
Packet Pg. 189 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

1.C APPROVE CITY’S RESPONSE TO THE OCTOBER 7, 2020 GRAND JURY REPORT ENTITLED “RANSOMWARE: IT IS NOT ENOUGH TO THINK YOU ARE PROTECTED” Staff Recommendation: By motion, authorize the Mayor to sign and submit a letter of response to the October 7, 2020 Grand Jury Report titled “Ransomware: It Is Not Enough To think You Are Protected” no later than January 5, 2020.

STAFF REPORT
ATTACHMENT 1
ATTACHMENT 2

1.D AB1600 REPORT ON DEVELOPMENT IMPACT FEES FOR FISCAL YEAR ENDED JUNE 30, 2020
Staff Recommendation: Accept the AB 1600 Report on Development Impact Fees for fiscal year ended June 30, 2020.

STAFF REPORT

1.E AGREEMENT WITH STEPFORD, INC. FOR INFORMATION TECHNOLOGY SERVICES Staff Recommendation: Adopt a resolution authorizing the City Manager to execute a revision to the three-year contract agreement with Stepford, Inc. for fiscal years 2019 through 2022. The revisions will cover the remaining two years of the agreement beginning July 1, 2020 and ending June 30, 2022 for the continuation of information technology services at a cost of $180,180 per year.

STAFF REPORT

RESOLUTION

1.F 2021 RESIDENTIAL DWELLING UNIT ALLOCATION PURSUANT TO HALF MOON BAY MUNICIPAL CODE CHAPTER 17.06 (MEASURE D)
Staff Recommendation: Adopt a resolution setting the 2021 Residential Dwelling Unit Allocation and Administration System pursuant to Half Moon Bay Municipal Code Chapter

17.06 for 66 residential dwelling units, 44 units for Downtown and 22 units outside of Downtown.

STAFF REPORT

RESOLUTION
ATTACHMENT 2

3.8.a
Packet Pg. 190 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

1.G FIRST AMENDMENT TO THE HALF MOON BAY HISTORY ASSOCIATION LEASE AGREEMENT FOR 503 JOHNSTON STREET
Staff Recommendation: Adopt a resolution authorizing the City Manager to execute a First Amendment to the Lease Agreement with the Half Moon Bay History Association by granting a one-year extension to begin construction of a new museum on the history property located at 503 Johnston Street.

STAFF REPORT

RESOLUTION
ATTACHMENT 2
ATTACHMENT 3
ATTACHMENT 4

2. ORDINANCES AND PUBLIC HEARINGS

3. RESOLUTIONS AND STAFF REPORTS

3.A PROPOSED ACQUISITION OF THE COASTSIDE INN BY THE COUNTY OF SAN MATEO FOR

USE AS AN EMERGENCY HOMELESS SHELTER
Staff Recommendation: Receive a report on the County’s proposed acquisition of the Coastside Inn, located at 230 Cabrillo Highway S, in Half Moon Bay, for use as emergency shelter for homeless residents on the Coastside during the COVID-19 pandemic, and future uses to be determined.

STAFF REPORT
ATTACHMENT 1

3.B UPDATE ON LOCAL RECOVERY EFFORTS FROM COVID-19 AND DEVELOPMENT OF

RECOMMENDATIONS TOWARD A MORE RESILIENT, VIBRANT, AND DIVERSIFIED

COASTSIDE ECONOMY
Staff Recommendation: Receive an update on efforts to assist local businesses and the Coastside community in recovery from COVID-19 and in developing recommendations toward a more resilient, vibrant, and diversified Coastside economy.

STAFF REPORT

3.8.a
Packet Pg. 191 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.C 880 STONE PINE ROAD ACQUISITION
Staff Recommendation: Adopt a resolution, in relation to the acquisition of 880 Stone Pine Road from the Peninsula Open Space Trust, for use as the City’s corporation yard, authorizing:

1. An additional deposit of $25,000 to POST, if the City chooses to exercise an extension of the escrow period;

2. The use of no more than $2,180,000 in Operating Reserves to close escrow on the acquisition;

3. Receipt of iBank financing proceeds for reimbursement of expenses related to the acquisition and potential improvements to the property; and

4. Authorizing the City Manager to take any required actions to complete the transaction, including accepting any non-substantive changes to the terms and conditions of the acquisition and financing.

STAFF REPORT

RESOLUTION

COMMISSION / COMMITTEE UPDATES

FOR FUTURE DISCUSSION / POSSIBLE AGENDA ITEMS

CITY COUNCIL REPORTS

ADJOURNMENT

3.8.a
Packet Pg. 192 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) City Council
City of Menlo Park 701 Laurel St., Menlo Park, CA 94025 tel 650-330-6600 www.menlopark.org December 8, 2020
via electronic mail
[email protected]
Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 8
th Floor
Redwood City, CA 94063-1655
RE: Civil Grand Jury Report: ““Ransomware: It is not enough to think that you are protected””
Dear Judge Chou:

The City Council of the City of Menlo Park (City) voted at its public meeting on December 8, 2020 to authorize this response to San Mateo County’s civil grand jury 2019-20 report ““Ransomware: It is not enough to think that you are protected”” released on October 7, 2020.

Responses to Findings
F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

City response: City of Menlo Park agrees that cybersecurity threats, including ransomware, are a growing threat to public agencies.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

City response: City of Menlo Park agrees with the finding that local governments are increasingly the target of cybersecurity threats.

F3. The direct and indirect costs of Ransomware can be significant.

City response: City of Menlo Park agrees that the direct and indirect costs of cybersecurity threats are significant.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

DocuSign Envelope ID: 7348ACE7-C70B-43BD-A11A-E88BC232048B

3.8.a
Packet Pg. 193 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) City response: City of Menlo Park agrees with the finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

City response: City of Menlo Park agrees with the finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

City response: City of Menlo Park agrees with the finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

City response: City of Menlo Park agrees with the finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

City response: City of Menlo Park agrees with the finding.

RECOMMENDATIONS
The Grand Jury recommends that each governing body undertake its own confidential effort to protect against Ransomware attacks. Specifically:

R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
City response. Implemented.

DocuSign Envelope ID: 7348ACE7-C70B-43BD-A11A-E88BC232048B

3.8.a
Packet Pg. 194 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

City response: Will be implemented by June 30, 2021.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S.

Department of Homeland Security56 and/or a cyber hygiene assessment from the County Controller’s Office.

City response: Further analysis required pending results from R1.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool.

City response: Further analysis required pending results from R1.

Sincerely,
Cecilia Taylor
Mayor
DocuSign Envelope ID: 7348ACE7-C70B-43BD-A11A-E88BC232048B

3.8.a
Packet Pg. 195 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 196 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 197 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 198 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

CITY OF PACIFICA
170 Santa Maria Avenue • Pacifica, California 94044-2506 www.cityofpacifica.org
MAYOR
Deirdre Martin

MAYOR PRO TEM
Sue Beckmeyer

COUNCIL
Sue Vaterlaus
Mary Bier
Mike O’Neill
Scenic Pacifica
Incorporated Nov. 22, 1957
December 14, 2020
Honorable Judge Chou:

Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
Subject: Re: City of Pacifica’s response to the Grand Jury Report: “Ransomware: It Is Not Enough To Think You Are Protected”
Honorable Judge Chou:

Thank you for the opportunity to review and comment on the above referenced Grand Jury Report filed on October 7, 2020. Pursuant to Penal Code section 933 (c), the City of Pacifica’s response to both the Findings and Recommendations are provided below. The Pacifica City Council, including the Mayor, reviewed and approved the responses at a public meeting on December 14, 2020.

Response to Grand Jury Findings:

F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response to F1. The City agrees with the finding.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response to F2. The City agrees with the finding.

F3. The direct and indirect costs of Ransomware can be significant.

Response to F3. The City agrees with the finding.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

3.8.a
Packet Pg. 199 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) Honorable Judge Chou: 2
Response to F4. The City agrees with the finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response to F5. The City agrees with the finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response to F6. The City agrees with the finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost information.

Response to F7. The City agrees with the finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response to F8. The City agrees with the finding.

Response to Grand Jury Recommendations:

R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how is it being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) Response to R1. The recommendation has been implemented. The City Manager has requested the City’s IT division prepare a report addressing the concerns in the Grand Jury report.

R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

3.8.a
Packet Pg. 200 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) Honorable Judge Chou: 3
Response to R2. The recommendation has not yet been implemented. The City’s IT Division is in the process of implementing the recommendation and is preparing this report, which is expected to be completed and provided to the governing body by April 2021 or earlier.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.

Response to R3. The recommendation has not yet been implemented, as the internal report has not been completed. The City’s IT Division will request guidance by means of a Cybersecurity review from the appropriate agency listed, based on the results of the internal report when complete.

R4. Given the results of their internal reports, government entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool.

Response to R4. The recommendation has not yet been implemented. Once the internal report is completed the City’s IT Division will evaluate utilizing the FCC’s Cybersecurity Planning Guide to assist in updating its Cybersecurity Plan.

Sincerely,

KEVIN WOODHOUSE
City Manager
cc: Pacifica City Council

3.8.a
Packet Pg. 201 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 202 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 203 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 204 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 205 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 206 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 207
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 208
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 209
Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 210 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 211 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 212 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 213 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 214 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 215 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 216 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 217 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”)

3.8.a
Packet Pg. 218 Attachment: Grand Jury Report (2246 : Grand Jury Report: “Ransomware: It is not enough to think you are protected”) County of San Mateo
Inter-Departmental Correspondence
Department: COUNTY MANAGER
File #: 20-962 Board Meeting Date: 12/8/2020
Special Notice / Hearing: None__
Vote Required: Majority
To: Honorable Board of Supervisors
From: Michael P. Callagy, County Manager
Subject: Board of Supervisors’ Response to the 2019-2020 Civil Grand Jury Report “Ransomware: It is Not Enough to Think You Are Protected” RECOMMENDATION:

Approve the Board of Supervisors’ response to the 2019-2020 Civil Grand Jury Report, “Ransomware: It is Not Enough to Think You Are Protected” BACKGROUND:

On October 7, 2020, the 2019-2020 San Mateo County Civil Grand Jury issued a report titled “Ransomware: It is Not Enough to Think You Are Protected.” The Board of Supervisors is required to submit comments on the findings and recommendations pertaining to the matters over which it has some decision-making authority within 90 days. The Board’s response to the report is due to the Honorable Danny Y. Chou no later than January 5, 2021.

DISCUSSION:

The Grand Jury made 8 findings and 4 recommendations in its report. The Board responses follow each finding and the 4 recommendations that the Grand Jury requested that the Board respond to within 90 days.

FINDINGS
Finding 1:

Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The respondent agrees with the finding.

Finding 2:

Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The respondent agrees with the finding.