After-Action Review – Columbus Police Department AMBER Alert - Thomass

December 19, 2022

CONTENTS
Section 1: Executive Overview
Summary of the Incident/Detail
AAR Committee Members

Section 2: Incident/Detail Summary

Incident/Detail Description
AAR Committee Members

Section 3: Mission/Operational Objectives

Mission/Operational Objectives Review Summary

Section 4: Analysis of Mission/Operational Objectives

Mission/Operational Objectives Analysis

Section 5: Conclusion
Major Strengths
Primary Areas for Improvement
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

Section 1: Executive Summary:

At approximately 9:45p.m. on Monday, December 19, 2022, an unknown individual stole a
vehicle that was left unlocked and running in front of an establishment on High Street in
Columbus, Ohio. Two five-month-old, twin boys were in the vehicle at the time of the theft.
The Columbus Division of Police (CPD) was notified and began an investigation of the incident.
At 11:41p.m., a detective from CPD made initial contact via telephone with the OSHP Watch
Desk in regards to an AMBER Alert activation. After discussions that occurred during multiple
telephone calls between the investigator, the investigative supervisor, and the OSHP Watch
Desk Commander, it was determined the incident met the criteria for an AMBER Alert and an
alert would be issued statewide for the infants.
The OSHP Watch Desk Commander, along with dispatchers at the OSHP Columbus
Communications Center (Comm Center), began the AMBER Alert activation process at
12:25a.m. on December 20, 2022. All activation tasks were initiated and completed by
2:15a.m. At approximately 4:47a.m., detectives advised a suspect had been identified and all
alert applications were updated with the new information.
At approximately 5:30a.m. on December 20th, the OSHP Watch Desk was notified that one
infant was located safe at the Dayton International Airport. The suspect, vehicle and second
child had not been located. As new information was obtained from CPD, updates were made to
all applicable activation applications and disseminated to OSHP units.
On Tuesday evening, December 20th, alert information was provided to surrounding states for
statewide distribution, but each denied activating an AMBER Alert in their state due to a lack of
information that the suspect was traveling to or would be located within their state.
At approximately 3:00p.m. on Thursday, December 22nd, the suspect, Nalah Jackson, was taken
into custody near Indianapolis, Indiana. At approximately 6:54p.m. on the same date, the
second child was found safe in the stolen vehicle at a Papa John’s restaurant parking lot in
Indianapolis.

Section 1: Incident/Detail Overview

On Monday, December 19, 2022, at 11:41p.m., Detective Martin, the lead investigator for CPD,
called the OSHP Columbus Communication Center (Comm Center)/OSHP Watch Desk regarding
two missing 5-month-old boys, Kyair and Kason Thomass. The boys were left unattended in a
running vehicle at a Donato’s Pizza on E. 1st Avenue and N. High Street at approximately
9:45p.m. The boys’ mother walked into the restaurant and when she turned around, her black,
four door, 2010 Honda Accord was gone, along with her two sons. The vehicle had no known
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

registration but had distinct damage, such as a missing front bumper, tinted windows, torn
temporary Ohio registration tag on the rear bumper, and a white bumper sticker on the right
rear that stated "Westside City Toys".
Detective Martin inquired about an AMBER Alert but was concerned one could not be issued
because of the lack of vehicle information, no license plate and no confirmed suspect.
Detective Martin advised he developed a bulletin for a High-Risk Missing Child Alert and was
preparing to send via email to a large distribution group. The email, which contained the
missing children information and media release, was received by Lieutenant Zupanc, the OSHP
Watch Desk Commander, at 11:56p.m. Detective Martin referred Lieutenant Zupanc to his
supervisor, Sergeant Fishburn, for further alert discussion and clarification.
At 12:16a.m. on December 20th, Sergeant Fishburn called Lieutenant Zupanc and discussed the
AMBER Alert activation with him. As a result of the discussion, it was determined the incident
met the AMBER Alert criteria and an alert would be activated statewide. Sergeant Fishburn
provided the initial information and was going to have his agency initiate the appropriate
AMBER Alert (AA) code entry in LEADS. A person of interest was discussed during the call, but
since the individual was not a confirmed suspect, it was determined that only the children and
vehicle would be listed.
At 12:25a.m., Lieutenant Zupanc notified the OSHP Comm Center that the AMBER Alert process
shall commence. Based on the preliminary information contained in the email, the Comm
Center immediately sent a statewide Mobile Computer Terminal (MCT) message to all OSHP
MCT’s. The OSHP Comm Center began the AMBER Alert Activation at 12:31a.m. by activating
the Lumen Line, which is the toll-free line for the public to report tips and leads. At 12:33a.m.,
Lieutenant Zupanc contacted the Ohio Bureau of Criminal Investigation (BCI) regarding issuance
of the AMBER Alert and advised that CPD did not need a Child Abduction Response Team
(CART) activated at this time, as CPD had the resources for the investigation.
At 12:37a.m., the Emergency Alert System (EAS) script, which is distributed to television and
radio media outlets via the FEMA Integrated Public Alert and Warning System (IPAWS), was
sent to the OSHP Comm Center for review. At 12:54a.m., the National Center for Missing and
Exploited Children (NCMEC) was contacted for the Wireless Emergency Alert (WEA) activation.
At 12:56a.m., the OSHP Comm Center contacted the CPD Records Department regarding the
appropriate LEADS AMBER Alert (AA) code entry not being made and they advised they did not
have any information regarding an abducted child report. At 1:06a.m., CPD sent out an
administrative BOLO message through LEADS to all Ohio LEADS terminals for the missing
children, but the AMBER Alert entry in LEADS had still not been completed. Due to the
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

different messaging, Lieutenant Zupanc then contacted Staff Lieutenant Wickman, his direct
supervisor, at 1:08a.m. for direction. She confirmed the activation should be completed. At
that same time, Sergeant Fishburn contacted the Watch Desk and stated to continue with the
AMBER Alert activation even though the appropriate LEADS code had not been entered and
organizational messaging did not reference an AMBER Alert.
At 1:10a.m., the information was entered into OHLEG by the OSHP Comm Center. At 1:16a.m.,
the ODOT sign boards were activated. At 1:23a.m., ODNR was notified and confirmed they
received the MCT and all terminal LEADS message. At 1:38a.m., the WEA message was
activated by the NCMEC and confirmed as sent by the OSHP Watch Desk Commander. At
1:43a.m., the OSP Criminal Intelligence Unit entered the alert information into the Safer Ohio
Repository. At 1:58a.m., the EAS message was sent via IPAWS by the OSHP Comm Center. The
e-notification to the specified AMBER Alert Group was completed at 2:05a.m. and subsequent
email sent at 2:11a.m. At 2:15a.m., the radio broadcast to all OSHP Posts and listening
departments was distributed on Ohio LEERN.
The specific and detailed timeline of events for the OSHP Watch Desk and OSHP Columbus
Communication Center are attached in Appendix A and Appendix B.
The Columbus Police Department provided additional information regarding a person of
interest at 4:47a.m. and all systems were updated with that information.
Regarding the actual AMBER Alert (AA) code entry into LEADS, Lieutenant Zupanc had difficulty
getting back with the detectives and left several messages throughout the activation process.
At 4:04a.m., Detective Martin contacted Lieutenant Zupanc to obtain a fax number and stated
he was sending over his report so the OSHP Comm Center could make the AMBER Alert LEADS
entry on behalf of CPD. At 4:52a.m., the OSP Comm Center made a missing persons entry into
LEADS and at 5:01a.m., CPD made the appropriate AMBER Alert (AA) code entry into LEADS.
The OSHP Columbus Comm Center also forwarded CPD’s LEADS AMBER Alert entry to all Ohio
LEADS terminals at 5:01a.m.
At 5:43a.m., Detective Martin advised Lieutenant Zupanc that one child was recovered at the
Dayton International Airport. The vehicle reportedly was involved in a hit-skip crash in Huber
Heights on Interstate 70 and now had damage down the left side with purple paint transfer.
VICTIMS: Kyair Thomass, 5 months old, black male, brown hair, brown eyes. Last seen with
a brown outfit on.
Kason Thomass, 5 months old, black male, red hair, brown eyes. Last seen with a
brown outfit on.
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

PERSON OF
INTEREST: Nalah Jackson, 24-year-old, black female, brown hair, brown eyes, 5’ 7”, 130 lbs,
last seen wearing a dark colored hoodie.

VEHICLE: 2010 black Honda Accord, 4-door, no front bumper, tinted windows, a torn
temporary Ohio registration tag on the rear bumper starting with M, and a white
bumper sticker on right rear that says "Westside City Toys".
As new information was obtained from CPD, updates were made to all applicable activation
applications and forwarded to all OSHP MCT’s.
On December 20th, at approximately 8:00p.m., Lieutenant Dillon, the OSHP Watch Desk
Commander on shift, and Staff Lieutenant Wickman, the OSHP Watch Desk Supervisor, began
contacting the AMBER Alert coordinators of surrounding states to inquire about an AMBER
Alert being activated in their respective states. Due to no known knowledge of the suspect,
vehicle or child being in any of their respective states, AMBER Alert activations for each state
were denied. The suspect, vehicle and victim information were provided to each state
coordinator for dissemination to law enforcement agencies within their respective state. On
December 21st, around 5:25pm, information was provided to the Illinois AMBER Alert
Coordinator/Illinois Fusion Center due to new information regarding possible relatives of the
suspect living in Chicago. On December 22nd, at approximately 09:25am, the AMBER Alert
information and CPD bulletin was posted to the Homeland Security Information Network (HSIN)
exchange platform by Ohio Homeland Security’s Terrorism Analysis Unit. HSIN Exchange
information is received by all state fusion centers within the United States. The Indiana Fusion
Center responded to the post and indicated they would forward the information to their
bulletin team for distribution and the Kentucky Fusion Center advised they would forward the
information to the Kentucky State Police.
On Thursday, December 22, 2022, at approximately 3:30p.m., the OSHP Watch Desk was
notified that the suspect, Nalah Jackson, was taken into custody near Indianapolis, Indiana. The
child and vehicle were not located at the time. Staff Lieutenant Wickman immediately began
communication with the Indiana AMBER Alert Coordinator in order to facilitate an AMBER Alert
activation within the State of Indiana. Alert information was provided and numerous
conversations occurred in an effort to activate the alert. The various discussions revolved
around the fact the suspect had been taken into custody and the Indiana criteria for an AMBER
Alert requires the suspect to be at-large. Likewise, Indiana expressed a desire to wait until the
suspect had been interviewed, a search warrant executed at a residence the suspect was
reportedly staying at, and receiving approval from their Legal Department. However, the child
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

was located prior to these prerequisites coming to fruition and an AMBER Alert being activated
by the State of Indiana. At 6:54p.m., Detective Martin notified Staff Lieutenant Wickman that
the child was located safe in the stolen vehicle parked at an Indianapolis Papa John’s restaurant
parking lot. After confirmation, the AMBER Alert deactivation process commenced and was
completed in twenty minutes.

AAR Committee Members

On January 3, 2023, the following individuals met to complete an After-Action Review of the
incident:
• Lieutenant Colonel Charles Linek – Assistant Superintendent
• Major Shawn Davis – Office of Finance and Logistics
• Major Nakia Hendrix – Office of Field Operations
• Captain Ron Raines – Commander, OSHP STACC/HUB/Watch Desk
• S/Lieutenant Kristin Wickman – Assistant Commander, OSHP Watch Desk
• Lieutenant Rudy Zupanc – Assistant Commander, OSHP Watch Desk
• Dispatcher Manager Matt Stegner – Statewide Dispatching
• Dispatcher Supervisor Jared Reagh – Columbus Communication Center
• Detective Josh Martin – Columbus Police Department

Section 3: Mission/Operational Objectives

To complete the Amber Alert activation process in a timely and effective manner in an effort to
aid the safe return of the abducted children.

Section 4: Analysis of Mission/Operational Objectives

Since the beginning of 2020, there have been a total of 29 AMBER Alert Activations in Ohio.
• 2022: Eight (8) activations
• 2021: Fourteen (14) activations
• 2020: Seven (7) activations
Depending on the incident, these alerts were activated either statewide or regionally. The
Cuyahoga Emergency Communications System (CECOMS), which has the ability to activate
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

AMBER Alerts within the Central and East Lakeshore Region only, was responsible for six of
these activations. The remaining 23 activations were conducted statewide or regionally by the
OSHP Comm Center/Watch Desk.
Due to the infrequent nature of AMBER Alert activations, these incidents are considered high-
risk/low-frequency events that include a multi-step process relying on the mobilization of
several applications, websites and notification systems. The activation process relies on a
collaboration of partners and stakeholders from federal, state and local entities for secondary
and tertiary distributions. The success of the activation process, and resulting safe recovery of
the abducted child/children, is contingent on the timely sharing of accurate information.
An analysis of the mission and aforementioned operational objective of the AMBER Alert
activation occurring in a timely and effective manner was not without issue.
Even though it was determined that the situation met the criteria of an AMBER Alert and basic
information had been obtained to begin the activation process at 12:25a.m., the first step of
the activation process was not completed by CPD until 5:01a.m. The first step of entering the
appropriate AMBER Alert (AA) code into LEADS begins the activation process by notifying the
OSHP Comm Center, the FBI’s Child Abduction Unit, Ohio Bureau of Investigations (BCI), the
National Center for Missing and Exploited Children (NCMEC), and all law enforcement agencies
within the county of and adjacent counties. When notified, receiving entities make contact with
the OSHP Watch Desk Commander to gather incident information and carry out secondary
notifications and tasks. For example, upon receiving the appropriate LEADS entry, the NCMEC
automatically contacts the OSHP Watch Desk and determines if Wireless Emergency Alert
(WEA) activation (the notification received on cellular telephones) will be requested and if the
OSHP Watch Desk would like the NCMEC to activate secondary alerts, which includes a network
of private companies, federal agencies, non-profit organizations, and others who can distribute
AMBER Alert information by leveraging internet advertisement space, social media, email
notifications, and a variety of other technologies and notification systems. In addition to these
secondary distributions made by the NCMEC, when the investigating agency enters the AMBER
Alert code into LEADS and is received by the OSHP Comm Center, they forward it statewide to
all LEADS terminals.
The OSHP Comm Center has the ability to enter the appropriate AMBER Alert (AA) code into
LEADS for the investigating agency if they are unable to for any reason. In this current incident,
and when questioned during several conversations, CPD personnel indicated they would enter
this code into LEADS and the OSHP Comm Center did not have to do it for them.
Due to the appropriate AMBER Alert code not being entered into LEADS by the CPD the OSHP
Watch Desk Commander contacted the NCMEC and BCI individually to relay the AMBER Alert
information to them in an effort to move forward with the activation. In the case of the
NCMEC, the process of contacting the appropriate personnel to advise them they would be
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

receiving a request to activate the WEA was completed in three separate phone calls over a 22-
minute period, which contributed to delay in activating the WEA and secondary distributions.
Likewise, the OSHP Watch Desk Commander was required to designate time and efforts to
these notifications rather than carrying out other activation responsibilities.
Even though the OSHP Watch Desk Commander and the CPD supervisor had agreed that an
AMBER Alert activation was applicable and the activation process should commence by
12:25a.m., the OSHP Watch Desk received an administrative LEADS BOLO rather than an
AMBER Alert LEADS message from CPD at 1:06a.m. Information distributed by CPD, such as the
High-Risk Missing Children bulletin received at 11:56p.m. and the administrative LEADS BOLO
message received at 1:06a.m., one would tend to believe the appropriate alert requested was a
Missing and Endangered Child Alert, which is activated by BCI rather than the OSHP Watch
Desk. In addition, the OSHP Comm Center contacted CPD’s Records section who advised they
had not entered an AMBER Alert (AA) code into LEADS because they only had an investigative
report for Missing/Endangered Children and not information for an AMBER Alert. At 1:08a.m.,
Sergeant Fishburn contacted the OSHP Watch Desk to clarify that the incident should result in
an AMBER Alert rather than a Missing and Endangered Child Alert, contrary to their
organizational messaging.
During the after-action review, the lead detective responsible for investigating the abduction of
the children and one of the two officers within CPD that the OSHP Watch Desk was in contact
with during the incident, acknowledged the organizational lack of continuity in messaging and
the information received from their records section.
The OSHP Watch Desk Timeline of Events (Appendix A) provides a detailed time/date reference
of communications and actions conducted throughout the entirety of the event.
Another issue that delayed the WEA portion of the activation is associated with a reliance on
the NCMEC to activate the WEA messaging due to Ohio Emergency Management Agency
(OEMA) equipment issues with the FEMA Integrated Public Alert and Warning System (IPAWS)
that have been ongoing since early in 2022. Prior to 2022, the WEA and EAS messaging were
both distributed/activated simultaneously by the OSHP Comm Center using IPAWS, which is
maintained by the OEMA. The NCMEC was only utilized as a backup for WEA message
distribution if the IPAWS application was non-functional. In early 2022, it was discovered that
FEMA had transitioned to a cloud-based server that was not capable of handling the file size
from the OEMA vendor’s interface. As a result, both EAS and WEA could not be sent at the by
the IPAWS system. The determination was made to continue utilizing IPAWS to activate EAS
messaging locally and rely on the NCMEC to distribute the WEA message to cellular telephones.
Utilizing the NCMEC for WEA message distribution typically requires specific forms to be
completed and sent to the NCMEC. This form ensures the WEA message does not exceed the
90-character limit. However, when contact was made in reference to the WEA activation,
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

personnel at the NCMEC advised the OSHP Watch Desk Commander to send them the WEA
message in an email for distribution. The subsequent WEA message sent to the NCMEC was
over the 90-character limit, which required the NCMEC to contact the OSHP Watch Desk
Commander, seek permission to revise the message, revise the message on their specific form,
and send it back to the OSHP Watch Desk Commander for approval prior to being disseminated.
In this situation, not having the ability to activate the WEA simultaneously with EAS through the
IPAWS system created additional delays (approximately 20 minutes).
It should be noted that the aforementioned issue with the FEMA cloud-based server file size
issue has reportedly been resolved and tested by the OEMA as of December 20, 2022. As of
this date, the FEMA IPAWS equipment maintained by the OEMA is fully functional and will be
utilized by the OSHP Watch Desk/Comm Center to distribute EAS and WEA simultaneously. The
NCMEC will still be utilized as a backup for WEA messaging distribution in case of future IPAWS
equipment/software issues.

Section 4: Conclusion
Major Strengths
• Once final confirmation and clarity from CPD was received at 1:10a.m., the remaining
steps in the activation process were conducted expeditiously with the exception of the
aforementioned issues with the WEA message being appropriately scripted by the OSHP
Watch Desk and distributed by the NCMEC. In addition, all websites, ODOT sign boards,
OHLEG, and other notification systems to the public and law enforcement agencies were
updated as new information was received and in a timely manner after the initial
AMBER Alert activation process was complete. This continued throughout the incident
and until both children were located.

• The CPD Detective indicated the customer service, professionalism and responsiveness
of the OSHP Watch Desk Commanders and their supervisor was that of a high degree
and appreciated. OSHP personnel were reported instrumental in providing clarity and
responsive to texts, telephone calls and emails from CPD.

• The OSHP Comm Center dispatchers played an integral part by professionally receiving
and making calls to/from the different entities involved within CPD in an effort to assist
in the information sharing process in advancement of the AMBER Alert activation
process. Dispatchers also fielded calls from the public, media and several calls from the
victims’ family members. Call recordings indicate the dispatchers exhibited the utmost
 After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

professionalism when answering questions from distraught family members (See

Appendix B).

Primary Areas for Improvement

Even though the after-action review determined inconsistent messaging from the Columbus
Police Department was a factor in the delayed decision to aggressively proceed with all aspects
the AMBER Alert activation, the primary areas for improvement identified as being within the
span of control of OSHP are detailed below:
• Upon initially being notified by the OSHP Watch Desk of the impending AMBER Alert
activation at 12:25a.m., the OSHP Comm Center distributed a Mobile Computer
Terminal (MCT) message to all OSHP units within the Columbus District. However, a
radio broadcast on Ohio LEERN was not conducted until 2:15a.m. to all OSHP Posts and
external law enforcement agencies. In the future, protocols will include the appropriate
radio broadcasts at the onset of the AMBER Alert activation in conjunction with the
initial MCT message.

• Upon determining the incident meets the criteria for an AMBER Alert and determining
the investigating agency will be entering the appropriate Amber Alert (AA) code into
LEADS, the OSHP Watch Desk Commander will ensure the investigating agency is
advised of the importance of this code being entered into LEADS as soon as possible. If
the agency indicates there will be any delay in entering this code, the OSHP Comm
Center will automatically enter it on their behalf.

• As previously mentioned, the NCMEC was utilized as the backup to the FEMA IPAWS
system due to the system not being able to distribute the WEA message. The FEMA
IPAWS equipment issues have reportedly been resolved and tested by the Ohio EMA. In
future activations, use of the FEMA IPAWS system will ensure messages are entered and
distributed directly by the OSHP Comm Center rather than a third party. The NCMEC
will only be utilized for secondary distributions, which they manage and maintain, as
well as for back-up if the IPAWS system is not working properly.

• As has been a past practice, the OSHP Comm Center will continue to conduct and
document monthly training with each dispatcher on distributing WEA and EAS messages
through the FEMA IPAWS system.

• As mentioned, the NCMEC was utilized as a backup in this activation due to the FEMA
IPAWS equipment not functioning correctly. Even though the NCMEC personnel
instructed the OSHP Watch Desk Commander to email the WEA script rather than
After-Action Review – Columbus Police Department AMBER Alert - Thomass
December 19, 2022

utilizing the appropriate WEA form, this direction resulted in the original message sent
to the NCMEC being over the 90-character maximum. This oversight resulted in back-
and-forth communication between the OSHP Watch Desk Commander and the NCMEC
to correct the issue with the script, causing a delay in the WEA message distribution. In
the future, OSHP Watch Desk Commanders will receive additional instruction and
training pertaining to utilizing the NCMEC as a backup to the WEA message distribution.
This regular training, as part of their roll call, will include specific application of the
proper NCMEC forms, as specified in the activation procedure.

• Being a high-risk/low-frequency incident, OSHP Watch Desk Commanders and

dispatchers began receiving annual training in February of 2022. This annual training
will continue, with the 2023 training being scheduled for February. This training will be
in addition to the regular IPAWS training for dispatchers and the NCMEC WEA activation
forms when the NCMEC is utilized as a backup to the IPAWS system.

• The Ohio AMBER Alert Advisory Committee provides AMBER Alert training to law
enforcement officers and dispatchers throughout Ohio when requested. This training
details the different types of alerts activated by BCI and OSHP, the required criteria for
each type of alert, provides insight into the activation processes and the type of
investigatory information needed for an activation. Rather than providing training when
requested, it will be recommended to proactively provide this training through
marketed and pre-established/scheduled courses at regional locations.

• In the past, OSHP Watch Desk Commanders have been required to contact their
supervisor when there is uncertainty if an incident meets the criteria for an AMBER Alert
activation. In the future, protocol will be amended to reflect that OSHP Watch Desk
Commanders will call their supervisor when they receive a telephone call or LEADS
message from an agency requesting an AMBER Alert activation. This will provide
immediate clarity on whether an AMBER Alert is applicable and provide direction that
may be needed due to a lack in clarity on messaging being received.