Camille Broadway
An internal city report to follow up on a theft from Gainesville Regional Utilities’ Deerhaven Generating Station found that the utility was in the process of updating security and tracking procedures to minimize the risk of a repeated incident.
According to the report, the utility discovered in July 2021 that an employee had stolen equipment—including electronic devices—over a period of approximately 15 months. The employee was arrested and much of the stolen property was recovered from the employee’s home.
The employee, who was not named in the audit report, sold some of the stolen equipment online. The replacement value of the recovered items was estimated at $59,000.
David Warm, GRU’s communication director, said via email that the employee, who worked to maintain the electronic control systems for the power plant, was fired following the arrest.
Most of what was stolen from Deerhaven was electronic components for the control systems for the plant, Warm said. Most of those were returned to GRU after the raid on the employee’s home.
The internal control report, which was presented to the Audit Committee on Wednesday, examined GRU’s management of backup/replace equipment and tools at the Deerhaven plant. City audit staff did a walkthrough to the plant in December 2021 and again in May.
During the time period of the thefts—May 2020 to July 2021—the utility added equipment to the official inventory when it was put into service at the plant. However, large amounts of equipment not yet in use were stored in the Deerhaven administration building and the plant warehouses, but not formally tracked.
By not tracking items, GRU was at risk for theft but also at risk for overstocking some parts or experiencing a disruption of services because of a shortage of parts, according to the internal control report.
Virginia “Ginger” Bigbie, the city’s auditor, told the Audit Committee that most of the issues that the utility had addressed most of the identified issues with the equipment storage and tracking.
She said the audit department had delayed public reporting of the results until the “controls were sufficiently secure” so that other people couldn’t take advantage of the identified issues.
“Before everyone knew this was a vulnerability, you want to make sure that you fix the vulnerability first,” Bigbie said.
According to the report and Bigbie’s presentation, GRU has taken the following steps at Deerhaven:
- Electronic equipment has moved from the administration building to a cooled section of the warehouse with controlled access.
- Deerhaven management has made “substantial progress” to add backup equipment and replacement parts to a tracking system.
- Physical security controls were improved to decrease unauthorized access to buildings, warehouses and stored materials. Additional cyber-security risks are being assessed during a separate city audit.
The audit department recommended that the Deerhaven management continue to do periodic spot checks of equipment and higher-value tools to see that they match what is in the tracking system.