** Exclusively on SXM Talks, articles by Ralph Cantave **
PHILIPSBURG – Following the publication of parts one and two, the Minister of VROMI Egbert Doran paraded NV GEBE along with the acting Temporary Manager, Sharine Daniel, to inquire workers whether they were content with the operations of the company. Doran flat out asked people to share sentiments about Daniel while she was in their presence; an act of intimidation and poor corporate governance. An independent review or survey of employee satisfaction would provide the Minister with an ideal and unfiltered perspective on the company due to the internal audit department being compromised by the actions of Daniel. This compromise began with her CV which contained false reports on her work experience and background during her hiring process.
Nevertheless, such a decision by Doran also perpetuates the culture of vindictiveness and silencing that marred St. Maarten’s history. Doran also acted contrary to his response during the Council of Ministers’ press briefing on Wednesday, June 15, 2022, when asked to comment on the suspension of the executive secretary. He stated, “that is an operational matter.” The Minister added that he’d be placing himself in “an awkward position” to get directly involved in personnel matters such as “firing or hiring.” The Minister added that he’ll send a letter to the supervisory board and included that he’d be “acting unethical” if it’s further addressed in public.
The unwillingness to uphold corporate governance at NV GEBE was further displayed considering the politically shaped supervisory board and the land deal between Doran and Daniel. The Minister was also questioned during the question hour held in Parliament that was requested by Party for Progress leader MP Melissa Gumbs. When asked about the accountability and disciplinary measures regarding the cyberattack, he stated that the supervisory board will be consulted to determine whether disciplinary measures would be applied.
The misconception about Management & Finances
To date, no meeting was convened with all of the NV GEBE managers to rightly assess and report the impact the hack has on their respective departments. Many managers were left out of the decision-making process during the period of the cyberattack, until this moment. Fortunately, several dedicated employees saw the need to become occupied during the inactiveness of management, who were more fixated on resolving the cyberattack problem, rather than dealing with all sectors of the company that were also affected. This inactiveness was witnessed throughout the company for more than a month.
Nevertheless, the deterioration of sound management continues to be displayed. During the question hour, Doran stated that no in-depth audit was done on the IT department. Audit plans for IT were submitted but there was no follow-through. He mentioned that the internal audit department did not have the required expertise in-house, however, it’s common practice to outsource or consult IT professionals if such an audit falls outside the department’s competence. NV GEBE applied the same standard by hiring IT specialist Roy Richardson to assist with recovering the lost data and revamping the company’s IT infrastructure. Although this reasoning was provided to Parliament, the audit department also conducted an audit on the distribution and Power Plant operations while there is no expertise in the department. No third party was contacted for this audit which begs to question the integrity and quality of the audit. Important to note is that other local organizations and companies were also met with the Black byte ransomware yet none were compromised like NV GEBE.
During the same question hour, Doran stated that NV GEBE has an excess of NAf. 50 Million in its accounts. While this fact was shared, it omitted the fact that NV GEBE has not been paying one of its most crucial creditors, Sol. Sol is the only fuel supplier on the island. NV GEBE pays roughly USD 2 million a month to Sol and the outstanding roughly stands between USD 9 and USD 10 million (ANG 16.2 – ANG 18, if the 1.80 conversion rate is applied) according to sources. Notably, ANG 50 Million can last the company four to five months if no further revenue is received, according to sources. The personnel cost for the company is roughly ANG 2 million and the cost of sales which includes chemicals, lubricants, and fuel, ranges from ANG 5 – 10 million. GEBE was down for almost three months, thus the financial strain is already in place and if the public trust in the company is not improved then how long can NV GEBE maintain expenses if a significant amount of revenue is not collected? Still to be considered is the amount paid to sub-contractors and maintenance.
The increase in the fuel clause since March 2022 pinpoints the burden the company passes on to clients. This is a primary indicator of the effect of the Black byte ransomware, which is still under investigation. It is unclear whether NV GEBE has also settled all balances with the engine company Wartsila, however, the gross reduction of receivables may have dealt another blow to relations with that crucial stakeholder for the company.
During the press briefing, Doran stated that NV GEBE has to “run their numbers” to determine how it can provide relief to clients however, Daniel already informed the population that payments will be due by September. Considering insurance payments, school fees, uniforms, books, and other mandatory bills persons pay at this time of year, it is doubtful that NV GEBE will recoup a considerable amount of revenue during the summer and still be able to provide relief.
Behind Time
NV GEBE currently uses the SAP software for their company operations and the software extends into finances, human resources, procurement and other enterprise support. But the version used in NV GEBE is outdated and SAP no longer provides support for it. This was noted many years ago therefore the previous management board led by Jerome Chittick budgeted to secure the cloud base platform called S/4 HANA. This would’ve replaced the outdated version of SAP. The software was part of the cyber security implementation plan thwarted by Daniel via conflicting information sent to the former supervisory board led by Bienvenido Richardson. Had this system been implemented NV GEBE would’ve been capable of reopening within two weeks according to sources.
Maintaining the old system continued to allow Merrill ‘Jimmy’ Temmer as IT manager, to maintain his position as a gatekeeper of the SAP system. The upgrade would’ve disallowed the possibility for data to be manipulated, leaked and weakened the chance of being hacked. The upgrade would’ve also led to an integration of the HR department which would prevent the ability to delete files and other critical data. During that period, SAP had their company representatives on the island to explain why the current system was susceptible to failure however the board disregarded the facts and obeyed Daniel’s memo led to the termination of the plan to upgrade.
Presently, consumer data, as well as administrative data, have to be painstakingly re-uploaded, manually into the SAP digital system. In one department, data in excess of 1600+ documents dating back since March 2021, has to be re-uploaded according to sources. Employees have been working late hours trying to restore the system. Yet to date, the company has not done an assessment of any kind to determine the exact impact the hack has on the financial and operational part of the company. Nonetheless, the hack meant that parts, equipment and necessary resources were all the more difficult to locate. Purchase orders were also set back and with the ongoing supply chain rupture around the world, this can lead to challenges a few months from now. The main challenge is the 2022 Atlantic Hurricane season and ongoing projects which are expected to go online, such as the Fourteen (the twin high rise buildings) in Mullet Bay. Several engines at the Power Plant are old and a new engine has been budgeted in a few years past, but lack of investment in this regard as well as renewable energy may lead to increase load-shedding.
Hence, at the moment NV GEBE cannot afford major engine breakdowns, faulty parts or any maintenance hiccup. The outcome of such a scenario may cause unnecessary and lengthy power outages. The hack also impacted data regarding the distribution network. It is pivotal for workers to locate assets, particularly those that are underground and sources confirmed that some of this data is still unattainable. The resuscitation of NV GEBE is contingent upon sound management and a substantial financial injection. The ANG 50 million would have to cover any incidentals if no revenue is collected by NV GEBE.
The limited revenues, debts to Sol, excessive spending, weakened management and poor good governance practices will have to be reversed in order to prevent island-wide blackouts and socioeconomic upheaval. NV GEBE is the island’s only utility company whose viability is a matter of national security.
By Ralph Cantave
It is not difficult to overcome any crisis or to manage measures to stabilize the company’s processes.
There is only need for one thing: a decision to get the right people on board. People with no previous history in the company, people with no grabbing money possibilities. And authorization to fire anyone without repercussions.
Any director who sits there is bad, guilty, and should be sacked immediately. Further criminal investigations should be opened against them. Set them in jail, so they cannot harm the regeneration process of the company.
In some countries bad managers are shot dead. That’s a culture we don’t share, though we hear talking in the streets about many of the GEBE managers like this. There are better ways. But if a company is not led well, and/or only stealing criminals act as if they have any management skills, the situation only gets worse.
Some very light thought about talking about the amount of 50 millions. Yes, and now all ransomware criminals know it too.
After years of bad IT policy and management, nothing has changed. Still the most unprofessional people are involved, hired or as employees. Nobody knows exactly how the business processes work or have to work, as stupid managers killed making schemes and descriptions. So prioritizing restore operations and data reconstruction is not done in the right way.
GEBE is still the cash cow for politicians and criminal so-called managers. A complete reconstruction of the company, its organizational structure, processes, procedures, IT systems, internal control, auditting, and much more is absolutely necessary.
Everything that isn’t done of this advice will once make GEBE pay the price, and unfortunately, the people of our island.