The Weekly Trust Retirement Call

Ilze Vītola had been the only controls engineer at the Aspazijas iela district-heating plant since 2019, when Peturs retired and they never replaced him, and in all that time she had said the sentence “I just want the boilers to keep starting” out loud more times than she could count. Saying it out loud had never once changed anything. She kept saying it because it was the only true sentence available.

Every Monday at ten she and Janis from building services held the trust retirement call.

The procedure was Peturs’s. Nobody remembered where he got it. It was a one-page memo on yellowed paper taped inside the door of the server cabinet, and it said, in Peturs’s small square hand, that any binary resident on the plant network was to be reviewed weekly, and that any binary found to have reached end of life was to be entered in the graveyard register and retired from service. It did not say who. It said signed.

The register was a spreadsheet on the file share called graveyard.xls. Four columns: date, hash, reason, signed.

“Item one,” Janis would say. He had the printout. He always had the printout. Janis was building services, which meant he signed things, and in eleven years the weekly list had become the one document in the building anyone actually followed, because it was the only one with a ritual attached.

“Item one. Plant HMI control chain. Shim bootloader, signed, vendor certificate authority, issued fourteenth of March, twenty fourteen. Status?” he would ask.

“Still in service,” Ilze would say.

“Reason for non-retirement?”

“Vendor has not shipped a replacement.”

“Signed?”

“Signed.”

He wrote the date in the column that already had a date in it. Nothing came off the list. That was the point of the list, or rather it was what had happened to the list, which is a different thing. Peturs had intended a cemetery. It had become a census.

They got through item one most weeks before anything went wrong.

What went wrong in January arrived as an email from the holding company’s compliance office, with the subject line ACTION REQUIRED: dbx revocation list synchronization, and an attachment that explained, in the flat promotional register of enterprise security communication, that a signed bootloader shim circulating since 2014 had been found to contain a vulnerability allowing an attacker to bypass signature checks, and that the relevant hash had been added to the UEFI revocation list, and that all managed endpoints were expected to synchronize within thirty days.

The Aspazijas iela HMI was a managed endpoint. This was new. Last quarter, a compliance initiative at the holding company had enrolled every Windows and Windows-adjacent machine into the corporate endpoint ring, and the HMI ran a Windows IoT image underneath, and so a checkbox ticked in an office in Frankfurt had taught a boiler control workstation in Riga to fetch updates it had been specifically built, over eleven years, not to fetch.

Revocation only protects machines that fetch the update. Hers fetched hers on a Tuesday.

On Wednesday morning the HMI would not boot. It sat on the vendor’s splash screen with a small white box that said, in the vendor’s own typeface, pki verification failed, and did not move.

Ilze stood in the control room and watched the supply temperature fall. Not fast. District heating does not fall fast. It falls like a decision that has already been made. Seventy-eight. Seventy-six. The screen was black and the pumps were running because the pumps were old enough to be dumb, and dumb was working, and dumb would keep working for a while, and while was a word with a number attached to it, and she did not care for the number.

She got the spare USB keyboard from the drawer where the spare USB keyboard had been since 2016, because the KVM was also eleven years old and had its own opinions, and she plugged it into the back of the HMI and held F2 until the BIOS came up, which it did, because the BIOS had been signed before any of this and had not been revoked, and she went to the Secure Boot line and changed Enabled to Disabled and saved and exited.

The HMI booted. The vendor splash screen, the login, the trend charts filling in again from the last known value. Seventy-four and climbing.

Red on the audit form. Green on the thermometers.

She called the vendor. The vendor was not villains. The man who answered had a name badge and a script and a genuine sympathy, and he explained that the fixed firmware for the shim issue required the newer control board, because the key material was provisioned at manufacture and the older board’s keystore could not carry the new chain, and the newer board was on a lead time of forty weeks, and also the support contract had a clause about the configuration baseline, and he was sorry, he really was, because he could see from the serial number that this unit had been in service since 2014 and he had a soft spot for machines like that, and could she hold.

“Weekly, apparently,” Ilze said.

She put in the exception request. The exception request went to the change board, which met on video, on the second Monday, with four people who had never been to Riga.

There were slides. There were always slides. The slides had a risk matrix on them with colored squares, and someone had put a red square where her HMI’s configuration baseline intersected with the corporate security control set, and the red square had a number under it, and the number was not a temperature.

The exception form was three pages. Page three had a line at the bottom that read: Exception approved by (name, title, signature). Under it, in small print: Area under the accepting party’s risk ownership.

“Can you sign page three?” asked the woman who ran the board, whose name was Kaspars or possibly the other one, Ilze had written it down and then lost the piece of paper.

“No,” said Ilze.

A pause of the particular quality that video calls produce, where four people all stop breathing at slightly different times.

“May I ask why?”

“Because I don’t know what it says.”

“It says you accept the risk.”

“It says I accept the risk and it doesn’t say what the risk is, and if the risk turns out to be something, then in six months somebody will find my signature on a page and I will have accepted it, and the person who will be standing next to the boiler when something is accepted will not be any of you.” She could hear herself. She sounded like someone reading a list. “I have a procedure for exceptions. The procedure says a device that is not in the register does not touch the network, and a device that has touched the network outside the register goes in the graveyard. Those are my exceptions. That is the whole procedure.”

“That procedure is for retired equipment.”

“It is for equipment. Nothing in it says retired.”

The man who did her job in a different plant, on a different call, spoke into the gap. He said that in his experience, signing an exception was the standard path, and that refusing it would look like non-cooperation at the next audit. He was trying to be kind. He had the cadence of a man who has been kind in a meeting before and found it works.

Ilze thought about it like a weather report for a country she did not live in. “It will look like cooperation with the only procedure we have,” she said.

They tabled it. Tabled was the word on the minutes. Her plant ran through January on an unsigned exception: a Secure Boot line set to Disabled and a compliance ticket marked Pending, and the boilers started every morning, and the thermometers stayed green, and she signed the log.

The advisory dropped on a Thursday. Three CVEs, in her exact controller, in the firmware revision her HMI was running. She read them standing up, at the terminal, with her coat still on.

Two days later an outside team published their reproduction. Public firmware. Public datasheet, with the register maps that had always been in it. An advisory with enough detail to reconstruct the rest. Twenty-eight minutes, six dollars of model time, from the advisory text alone, and then a thread, and in the thread a repository, and in the repository a README with a license file, which she thought was the single most courteous thing about the whole affair.

Her machine was the one still running it. Her machine, with Secure Boot off, was now the machine that an exploit chain assumed. The chain had been written for machines like hers. Everything about it was correct.

The auditor arrived on the Friday, because his train was early. He was younger than she had expected and older than the job suggested, which is to say he had the face of someone who has been right about things in rooms where being right was not welcome. He had a laptop and a printed form and he had read the site orientation, which was more than the last three visitors had done.

“My name is Toms,” he said. “I’m here for the pre-audit readiness review. I have the NIS2 control checklist.” He put the form on the desk. It had boxes. It had a box for her, and a box for him, and a box near the bottom that read: Compensating controls accepted (line for exceptions). Nobody at the holding company had ever read that line. She was certain of it, on seven years of watching it not happen.

“Before we start,” he said, “I’d like to attach to the engineering VLAN for about ten minutes. I want to pull the signed audit log off the HMI and demonstrate the advisory chain against your exact build, so we have it on record as reproduced or not. Is that all right?”

He asked permission. It was courteous of him.

Ilze looked at the procedure. Properly this time, at the thing she had written and read a hundred times, and there it was, clause four, in her own hand: An unregistered device may not connect to the plant network. And clause seven, which Peturs had written and which she had never had cause to use: A device that has connected to the plant network outside the register shall be entered in the register before it is disconnected.

Both clauses. Both signed. She had initialed them herself in 2021, during the month she did the whole procedure binder with a pen that ran dry halfway through and had to be finished in pencil, which was, she would later think, the correct instrument for it.

She got a blank graveyard line.

“Make and model?” she said.

“ThinkPad T14. Gen four.” He turned it over, read off the base. He was helpful about it. “Serial number, PF three X K nine two Q.”

She wrote the date. She wrote the hash, which she took with a tool on the jump box in about forty seconds, because the hash of a whole disk was not what the register had ever meant and everyone knew it. She wrote the reason: unregistered device connected to engineering VLAN, clause seven. And in the last column she wrote Ilze Vītola.

She turned the monitor so he could see it.

Toms looked at the row. He looked at it for a while. He was not stupid, and he was not lying, and he did exactly the thing she had been waiting eight years for somebody in his job to do, which was to read the procedure before the form.

“Clause seven,” he said.

“Clause seven.”

“And this is the only register in the building.”

“It is the only procedure anyone follows in this building. The others are for the audit.” She stopped. She heard it. She let it stand, because it was true, and because she was filling in a form.

“So my laptop is now retired equipment.”

“Your laptop is on the graveyard list. Per procedure.”

Toms stood there holding a machine that had been, until about a minute ago, an auditor’s laptop, and was now a device that, under clause four, may not touch the plant network, and under clause seven, had to be entered before it left, and it was entered, and she had signed it, and the entry had a hash in it, and the hash was correct because she had checked it.

He did not argue. He sat down and did the rest of the readiness review with his laptop closed on his knees, and he was good at it. He found two real gaps, both of which she had flagged in 2023 and again in 2024, and he wrote them up as findings with owners and dates, and he gave her a copy, and on the box that read Compensating controls accepted, he wrote N/A and initialed it, and under it, in the space for comments, he wrote the words per site procedure, clause seven, and initialed that too.

Monday, the fourth Monday, ten o’clock.

“Item one,” Janis said. He had the printout. The graveyard now had a Friday row on it that neither of them had expected, and he had already decided, silently, the way he decided everything, that it stayed exactly where it was.

“Plant HMI control chain. Shim bootloader, signed, issued fourteenth of March, twenty fourteen. Status?”

“Still in service.”

“Reason for non-retirement?”

“Vendor has not shipped a replacement.”

“Signed?”

“Signed.”

He wrote it down. Then he turned the page, and read the next row in the same flat voice he had used for eleven years: “Device. ThinkPad T14, Gen four. Serial PF three X K nine two Q. Reason: unregistered connection, clause seven. Signed.”

He wrote the date in the column that already had a date in it.

At four in the morning she did her rounds, because she did her rounds at four in the morning, because that was when the load turned over and you could hear a pump that was thinking about stopping. The control room was warm. The trend line for supply temperature ran green across the screen in a steady band, seventy-eight to eighty-one, the band it had been in since the second week of January, through the deny list and the CVEs and the change board and the man with the form. The HMI was still booted with Secure Boot off, and the compliance ticket was still marked Pending, and the quarterly review was in eleven days, and she knew exactly what the review would say, because she had read the clause, and she signed the boiler log for the fourth, fifth time that week, and the number was holding.