The Graveyard List

The radiator in Mrs. Kalniņa’s kitchen had been clinking for twenty-five years. Aija could set her watch by it, and every winter she could set her conscience by it as well. At half past five on a January morning in Riga, with the air outside trying its hardest to become ice, that radiator always gave one hopeful knock when the hot water reached it. If Aija heard it, Mrs. Kalniņa would have heat for the day. If she did not, Mrs. Kalniņa would not.

That was the job. Not the certificates, not the recording, not the thirty-two-step binder that the holding company sent down once a year for her to initial. The job was the knock.

Aija was the only controls engineer left for the district heating plant on the edge of Riga. Andris was facilities, and he was the only other person who ever answered the Thursday call. Between the two of them they kept the three boilers, the circulation pumps, and the primary heat exchanger running for a block of old Soviet apartment buildings that would cost more to disconnect than the holding company was prepared to admit.

The Thursday call was the trust retirement ceremony. Fifteen minutes, standing, coffee, the two of them plus a recording that compliance had required since the complaint of 2022, when a woman from the holding company had attended once, heard them retire a bootloader hash verbally, and filed a finding that the verbal retirement was undocumented. So now they recorded it. The recording was the documentation. Nothing about the process had improved, and everything about the process was now legal.

The graveyard spreadsheet was the only document in the building anyone actually followed. Dead things went into the gray column, live things stayed in the black, and Andris read rule four every week because it was the only sentence in the plant binder with an enforcement mechanism behind it.

“Rule four,” Andris said. “Any device or binary entered on this list may not connect to the plant network. No exceptions. No temporary permissions. It goes on the list, it comes off the network.”

The rule had been enforced once, in 2023, when Aija had plugged her own phone into the HMI’s service port to charge it, discovered that the plant’s own procedure covered any personal device interfacing with plant systems, and listed her own phone, by IMEI, and reported herself to Andris on the following Thursday’s recorded call. Andris had asked if she wanted it in the gray column or the black. She had said gray. It had stayed gray for six months, until the phone died in a puddle, at which point she retired it properly, ceremony and all.

So on that Thursday, after the ceremony of killing hashes was finished and the recording had dutifully saved itself, Aija sat down at her workstation to do the part of the job that did not involve reading aloud.

It refused to boot.

The loading bar got to the first handoff, froze for three seconds, and threw the only error it ever threw these days: Secure Boot violation. The old HMI was a machine from before the plant had anyone with Aija’s title. Its firmware loaded through a UEFI shim that had been signed in 2014, and at some point between Wednesday afternoon and Thursday morning, the deny list it fetched on startup had gained a new entry for that exact shim.

Aija stared at the black screen, then at the thermometer on the wall, then back at the black screen.

“Don’t do that,” Andris said from behind her, handing over a cup of black tea. He had heard the silence change.

“I was considering doing that,” Aija said.

“Do the other thing first.”

So Aija did the other thing. She rebooted into setup, disabled Secure Boot for that boot only, and brought the HMI up. The OS loaded. The I/O tree came alive. One by one, the three boilers reported ready. Thirty-seven seconds later, through the wall, she heard Mrs. Kalniņa’s radiator give its single, satisfied knock.

Green on the thermometers. Red on the audit form.

There was no getting around it. The vendor’s advisory had landed in her inbox at ten past eight: the 2014 shim and the controller revision in this HMI were now on the revocation list for a set of vulnerabilities they had found in that family. The fixed firmware would require the control board two generations newer, and the lead time for that board was forty weeks. Forty weeks was more than half of this heating season. The vendor helpfully suggested an interim mitigation plan, listed at the very bottom, which was to not be vulnerable. They did not list how.

Aija spent the rest of the morning pulling the advisory apart, because an advisory with a CVE string will tell you what was broken, and a good one will tell you just enough for somebody with access to a logic analyzer and too much stubbornness to know they should stop. By two o’clock she had it down to three facts, which she wrote on the back of a maintenance ticket and showed to nobody. The vulnerabilities were real. From the advisory text alone, and for six dollars of model time on a rented reasoning box, an outside party had reproduced two of them and chained them to root on an identical controller. That reproduction, along with a short README, was already public.

Her machine was no longer just an old machine that had lost its signature. It was an old machine that was broken in a way that was now documented and copyable.

Aija did not tell the whole plant. There was nobody else to tell. She told Andris, because he was the only other person who would understand the words “plant network” and “boilers” in the same breath, and because he would not waste any of those breaths on swearing.

“Forty weeks for a board,” Andris said, after a long silence. “We can keep the heat on for forty weeks without it, if nobody forces us to turn it off.”

“If we boot with Secure Boot off and that advisory spreads to the sort of person who runs scans for a hobby, we do not get to choose who forces us to turn it off.”

“Correct.”

Neither of them said Mrs. Kalniņa’s name.

The holding company’s auditor was supposed to arrive the following Wednesday. He arrived on Friday, at four in the afternoon, with a laptop bag over one shoulder, a paper file under his arm, and the particular hurry of a man who thinks he is being efficient. Aija knew that hurry. It meant he had read the ticket before getting on the train from Riga, and he already knew he was going to find something.

He introduced himself as Jānis, asked for access to the compliance binder, and within five minutes he had found the red mark: booted with Secure Boot off. He was, by all accounts, not a bad man. He was a correct man. Aija could tell, because he did not look smug about it.

“I am going to need to open an exception on form seven,” Jānis said, placing the page in front of her. “I cannot close this audit without one. The plant cannot continue to run this configuration.”

“Form seven does not have an approved exception for that control board at this revision,” Aija said. “The vendor’s only approved path is the board replacement in week forty.”

“That is not a path for this winter.”

“No, sir. It is not.”

They sat in the warm control room for a moment, the only sound the quiet cycling of a pump and the occasional tick of metal expanding in the pipes.

Aija reached under her desk, pulled the black ledger binder over to her side of the table, and opened it to the graveyard spreadsheet. She turned it so Jānis could see the gray column, the black column, and the one line of text that was printed on a yellow sticker and taped to the inside cover.

“Rule four,” she said. “Any device or binary entered on this list may not connect to the plant network. No exceptions. No temporary permissions. It goes on the list, it comes off the network.”

Jānis stopped writing. “That is your internal procedure.”

“It is the only procedure in this building that has teeth,” Aija said. “We record the call for it every Thursday. Andris and I have read hashes aloud and retired them for years to satisfy the recording. It covers any device. It does not exclude auditor laptops.”

“I am here to audit this plant.”

“And if I enter the serial number of your laptop into this spreadsheet and sign it, per procedure, then your laptop may not connect to the plant network. You can stand here in this warm control room and complete your notes on paper, or you can stand here in a cold control room with no network connection at all. The boilers will stay running either way, because they do not need your laptop to run.”

Andris, who had been leaning against the doorframe drinking his tea, gave the smallest, most traitorous snort.

Jānis closed his pen. He did not argue. He did not reach for his phone. For a full minute he looked at the black column, then at the gray column, then out the small, double-glazed window where the streetlamps were just starting to catch the frost.

“I would like to see the serial number,” he said.

Aija read it off the back of the machine while Andris wrote it down, in block capitals, in the black column. She initialed next to it. Andris initialed next to it.

“Retired from the network,” Andris said.

“Retired from the network,” Aija said.

Jānis sat down on the spare chair, took a blank sheet from the back of his paper file, and began writing his notes by hand. The laptop stayed closed on the desk in front of him. It would never talk to the plant network again.

At a quarter to four in the morning, Aija was still in the control room. There was no reason for her to be, and every reason for her to be. She was signing the boiler log for the day, which was a form that nobody from the holding company ever read, but which she had never once missed signing.

She heard the door open. Mrs. Kalniņa had seen the control room light from her window across the yard; she came in with two paper cups of tea, steam curling between her gloved hands, placed one next to Aija without a word, sat down beside her, and waited.

Through the wall, the radiator gave its knock.

Mrs. Kalniņa smiled, very small, and blew across her tea. “I thought you might be up.”

Aija leaned back in her chair for one second, just long enough to feel the building stay warm around her. Then she dated the next line of the boiler log.