Denver’s lack of a citywide security strategy for government buildings has led to “confusion” between city agencies about whose jurisdiction it is to respond to incidents at facilities, according to a new report from Denver Auditor Timothy O'Brien's office.
"Without a documented citywide strategic plan, city agencies have adopted a fragmented approach to city facility safety and security with inconsistent communication between relevant city agencies,” the audit concluded.
The responsibility for security at public buildings is split between four departments and HSS Inc., a private company that provides armed and unarmed security services. The audit found that offices pointed fingers at each other for oversight of an emergency coordinator program, which trains employees to respond to drills and evacuations. The Risk Management Office said the Department of General Services was responsible. In reality, General Services maintains lists of emergency coordinators and schedules trainings, while Risk Management conducts the training.
Creating further confusion, city policy gives authority over employee security badges to the Director of Public Office Buildings, which has not been a city position since 2007.
The report is littered with examples of miscommunication between agencies that led to duplicated efforts and exclusion of relevant parties: the Denver Security Office conducted a vulnerability assessment at one site, only to learn at arrival that the Denver Police Department had already performed one. The Denver Sheriff Department was not consulted after an incident at a government building, even though they were supposed to be. The Security Office was about to purchase equipment, before learning that the city already had it in storage, not being used.
“Bad actors could sneak through the gaps in our security if we don’t get all agencies on the same page,” O’Brien said.
Furthermore, the Denver Fire Department, according to the report, fails to follow the city and International Fire Code's stipulations for training employees on evacuations, reviewing emergency procedure guides and tracking data.
Fire personnel maintained a list of city employees needing assistance in an emergency, which auditors discovered to contain information incompatible with template forms. Because it took the city multiple attempts to figure out where the list was located, auditors warned the Fire Department that it could create needless risk in attempting to rescue individuals without the information immediately available.
Despite the fire code’s requirement that facilities managers and maintenance workers should receive annual training on fire safety and evacuations, “Fire department personnel were unaware of the certification requirement for facility managers and confirmed the Denver Fire Department did not have such a program,” the report found. The department also kept no records about past drills, even though the International Fire Code requires it.
What Denver needs, the audit concluded, was a plan to delineate responsibilities and determine the authority of different roles within the city government to fulfill those obligations. Specifically, there should be a consistent method of assessing vulnerabilities. The current approach, auditors found, “appear[s] to be in reaction to specific incidents instead of prompted thorough a proactive approach for identifying and prioritizing risks.”
Auditors reviewed three assessments from 2019, two of which the city performed and the third came from a contractor. The contractor’s report differed from the city’s, in that it provided site-specific recommendations and cost estimates, with details that aligned with U.S. Department of Homeland Security guidance. One of those guidelines is to complete a security assessment when a facility opens and for each year thereafter. However, the audit found, Denver has only performed one assessment last year.
The audit provided multiple reasons that departments cited for not assessing vulnerabilities. The Department of General Services believed an assessment would tell them “what they already know.” Denver Human Services assessments were blocked by “mayoral or management concerns and to avoid putting up barriers, such as metal detectors, for citizens to access services.” A 2017 survey of that same office found nearly half of employees believed security to be “inadequate.” About half of all city employees that same year said in a survey that they had received insufficient safety training.
“Without adequate training, city employees may not know what to do in an emergency at a city facility and could jeopardize the personal safety and security of themselves and others,” the audit explained.
Finally, the report warned of the decentralized distribution of access badges, with security guards, the Badging Office and various agencies all issuing or retaining various types of badges. Department of Public Safety personnel have badges that are incompatible with readers in the rest of the city’s buildings, compromising their ability to respond to emergencies. Auditors also identified 102 employees who could change access permissions for badges, which they deemed a “large number” of workers giving many people “unnecessary permissions for their job function.”
While HSS Inc. appeared to be fulfilling the terms of its contract with the city, the training and staffing requirements were unclear, and requests to the company were often made verbally, instead of in writing.
In response to the findings, Brandon Gainey, the acting executive director for the Department of General Services, agreed to develop a citywide security strategy, but noted it would probably not happen before January 2021 because of the focus on COVID-19 response. He added that the city will revise old and unclear executive orders as needed, as well as clarify the expectations of the emergency coordinator program.
The Fire Department, Gainey said, is already creating training videos, and will work to certify facilities employees using the videos. However, he warned, the department’s work may be impeded by “potential funding barriers based on the city’s projected General Fund shortfall in 2020 and 2021.” Denver faces a deficit of at least $226 million due to the pandemic.
The department also agreed to keep track of emergency drill documentation, and Gainey said the city is executing a new contract with HSS, Inc. that should address the recommendations pertaining to security guards.
Councilman Paul Kashmann, who chairs the committee overseeing the Department of Public Safety, said that the auditors' conclusions gave him cause for concern.
"We have a responsibility to secure the buildings and the safety of the people who work in and visit those facilities," he said.
This story has been updated with comments from Paul Kashmann.