Author: Sandy

The 2019 NZ Budget Leak: what actually happened

Published by Sandy on June 3, 2019

EDIT: This piece has gone much bigger than expected. I’m blown away. I was editing during the day to add clarifications onto the end, but I’ve gone back and worked them into the body of the text.

The Treasury data breach has been a shitshow. I don’t think I’ve ever seen a bigger disconnect between the experts and the pundits, and I don’t say that lightly. I’m not a security guy, for what it’s worth: I’m a writer at a tech firm, but I’m fascinated by security and over the last few days I’ve been talking to people who actually know their stuff. Almost unanimously they’re calling this a breach. Almost unanimously, the pundits are off shouting that it’s “not a hack!”.

Right from the start, I’m setting a rule: we’re not going to talk about “hacking”. It means totally different things to the IT sector (anything from coding at all to randomly kludged spaghetti code that really shouldn’t work) and the public (a man in a trenchcoat saying “I’m in!”), and most InfoSec types shy away from it anyway. I’m not going to bore you with the whole hacking vs cracking debate, but we’re going to call this thing what it is: a data breach.

So what happened?*¹ This is a web server:

Its job is to display web content. Every time you go online, you’re accessing content from web servers. Simple enough? This is a staging server:

It serves as a testing environment. Content intended for the public but not yet released goes on the staging server to make sure it runs smoothly for when the time comes to make it public. Some staging server content never goes live: it either didn’t work as expected or it wasn’t meant to be there, or something changed and it got pulled.

Treasury cloned their web server, put it in the staging server, then added the budget to it for testing. The problem is, they also cloned the index configuration: the instructions that the search used to store search data for later use. Both web and staging server stored their search information in the same place and SOLR—the program running the search function—wasn’t properly instructed to avoid the staging server. That gave the web server access to the search information about documents on the staging server via the search bar, though not the staging documents themselves.

To illustrate, here’s the Spinoff today:

See how you get the title and the first few lines? Using the exploit on the Treasury’s site, somebody pulled snippets of the budget like that from the staging server. Critically, to do this, you would need to know the title of the section. You search for a specific heading in the web server, and it comes up with the title and the first 4-5 lines. It was, all things considered, a pretty small hole:

It required the attacker to know the content was on the staging server
It required the attacker to know the specific wording on the staging server
Even then, it only gave them snippets

So what happened? Well, a leak. The actual leak. The budget didn’t leak: the budget’s search index leaked. That’s essentially a table of contents. The budget ToC being out in the open covered points 1 and 2 above: the fact the budget was ready to go public (thus, probably on the staging server) and a list of searchable titles and subtitles.

“Leak” is a strong word, too: it used the same headings as the 2018 budget. I’m still a little fuzzy on whether the actual index leaked (as in, got sent to the wrong place/got left out somewhere irresponsible/got made public too early) or whether somebody just heard it was the same as last year’s via the Thorndon grapevine and started punching in queries.

What about #3? Well, that’s why there were 2000 searches. They pulled 2000 snippets and put the budget together like a jigsaw. It’s not “just a search”: it’s using a leaked search index to perform 2000 searches, to take advantage of an exploit that pulled small pieces of content from a staging server, then stitching that content together in post. It’s not something Johnny Q Public could do by accident. It’s not an “open door” at all. That’s also why National got some details wrong: they didn’t have a complete picture. They had a very good outline, though. All the titles and subtitles, and the first few lines after each.

It’s all a bit rubbish but—to quote InfoSec luminary Adam Boileau—”it’s not rubbish if it works“.

Metaphors about the door being unlocked do us no favours, unless we really want pundits to be better-equipped to twist the actual events. Whether or not it’s a “hack” doesn’t really matter: it’s an intentional attempt to gain access to private data. It utilised an exploit to pull content that wasn’t meant to be public. It’s a breach. More than that, there are established protocols for what happens if somebody finds an exploit in government software. These rules were written by the National Party in 2014, and National failed to follow them. Their failure to follow protocol merits investigation: they let the particular use of an exploit go undetected for their own political gain. Even if the content was delivered to them anonymously by a no-good samaritan, they bear at least partial responsibility for this because they went public instead of reporting it.

Where did the Treasury fuck up?

They should’ve considered their SOLR configuration when they cloned their data to the staging server.
They probably shouldn’t have cloned their web server to begin with—making a staging server from scratch with the same dependencies might have been a pain in the ass (I’m honestly not sure: I don’t know what their dependencies look like) but it would’ve been a lot safer.
They could’ve been jazzier about this year’s subtitles.

Where did the National Party fuck up?

They identified an exploit but—instead of following CERT protocol—they used it for their own personal gain.

I’m not gonna lie, it’s bad. Somebody dropped the ball, and somebody else put a knife into it.

Still, I do not believe Simon Bridges has committed a crime, nor has he committed Breach of Confidence. He has violated his CERT obligations, which at worst means he’ll get a strongly-worded nonbinding letter from MBIE telling him not to do it again. He did a bad thing, but not all bad things result in him being removed from Parliament in a paddy wagon. To quote one of my anonymous sources: “he’s an asshole, not a criminal.”

It’s still ridiculous that pundits are calling for heads to roll. At the end of the day, it wasn’t a big deal. Grant Robertson shrugged and moved on. The Treasury were right: what harm could somebody actually do by using that exploit? Release a half-complete version of the document a day early?

By the by, it’s not dodgy or extreme that anybody called it a ‘hack’. If there’s a problem with the word, it’s not that it doesn’t mean this, it’s that it does mean this because it’s a vague word that means wildly different things to different people. Not all hacking is a man in a trenchcoat typing into a green/black Linux CLI then saying “I’m in!”—It’s not rubbish if it works. Makhlouf and Robertson could’ve maybe been more precise with their language but that’s not a crime either.

And then, of course, the pundits got to it. Either the Treasury were little angels who did no wrong, or they were cringing fools who dropped a box of printed budgets off at the top Lambton Quay. What we actually have here is a pattern pretty typical of data breaches: a small screwup like improper SOLR config let an attacker access to data they shouldn’t have had. I’m sure somebody is going to shout at me that it wasn’t a small mistake, but unless they can explain how to correctly configure Apache SOLR in a Drupal installation so it doesn’t allow partial read access to cloned data in a staging server then they can fuck right off with their piety and condescension. It’s a screwup for sure, but the people talking about “open doors” need to pull their heads in.

What’s really happening is that the pundits smell blood in the water, and they don’t care what actually happened—they just want an excuse to sink their teeth in.

Same old NZPol, I guess.

If you like what you’re reading, stick around and check out some of my fiction, or follow me @understatesmen on Twitter.

*¹ most of this is coming through various DMs and actually talking to people. I am willing to admit I might’ve muddied the details, though I’ve done my best and at the very least—talking to actual experts and having a tech background—I’m doing a better job than the lukewarm tech reckons of blokes who struggle to operate a washing machine.

Credit for assistance to Sana Oshika, and the others who preferred to go unnamed.

FLASHBACK FRIDAY: 9 WAYS TO KNOW YOU’VE BEEN GHOSTED

Published by Sandy on May 9, 2019

I wake up at 3am with Karl Marx looming over me. “There is a spectre haunting this bedroom,” he says, “the spectre of—”

I wave him away: I know the punchline. A communist! he’ll say and he’ll grin and spread his translucent hands wide, dadlike and expectant. He’s corny, but at least he’s not the other guy.

***

The Spirit of the Age is following me around at work. I have bags under my eyes; my performance is suffering, and my boss has noticed. The Spirit suggests I yeet my boss into the fucking sun. I click on the wrong spreadsheet tab and bite back a fuck—Susan across the table is a swear-narc.

Susan owns two investment properties in the Wairarapa. They are worth 500% of what she got them for in the 70s. Last night I caught myself eating a cold flour tortilla straight out of the bag. Susan’s investment properties gather dust.

The Spirit is flossing sadly, his hands moving side-to-side like the pendulum of a broken clock. I shoot him a smile. He half-returns it. I hope the kids are alright.

***

The three spirits of Christmas don’t have much to do this time of year. They sit in the corner of my lounge and play chess. Christmas Past keeps knocking over the board the instant anybody declares check. Christmas Present can’t do shit about it. Christmas Future is silent—you could cut yourself open on his bladelike cheeks. I looked into his eyes once: I expected a deep and endless void, but saw nothing, and heard only wind.

***

My phone buzzes at 6am and it’s the Ghost of My Youth with his daily bro did u make it y/n

I check my pulse, and text back “Y”.

It’s not quite a lie, and he’ll need it later.

***

We are looking for a junior marketing superstar to join our team! Does this sound like you?

Four years’ minimum experience
An appropriate postgraduate qualification
A flexible schedule

This is a 3-month contract.

***

A cute boy slides into my DMs. He loves my work. I wonder what his lips taste like, whether he’s just drank coffee, whether he will be bitter or sweet. I don’t respond, I close the app—I will disappoint him, and I don’t want to do that. The Ghost of Christmas Present peeks over my shoulder.

“Yeah mate,” he says, “that’s how it starts.”

***

Dear Sir or Madam, we regret to inform you that we will not be moving ahead with your application for [].

***

I take a cold flour tortilla out of the bag. There’s chicken in the freezer, but I forgot to defrost it; I have been forgetting to defrost it for months. I bite into the tortilla. It is dry. I try to put it back, but the bag is closed.

***

My phone buzzes at 6am: bro did u make it y/n

I do not text back.

Dear Ted,

Published by Sandy on May 9, 2018

Dear Ted, hello.

I find myself laid out before the horn of morning–

I last wrote from the grey and yet

my hands shake still. The dew

holds a memory of frost yet

I wander ever onwards.

2.1

Dear Ted,

I have been diving again. I chased

a strange gossamer worm

to the bottom of the world.

It taught me nothing.

It made me afraid.

2.1.1

Dear Ted,

Do not worry. I have said it before

but I mean it this time. There is a cliff

with a giant below. His eyes are open

but mine are too; I know his name.

Dear Ted,

I became lost somewhere in the whirl of it–

a thousand channels blaring and the men

in my mind cannot handle the traffic.

I am laid out upon the tarmac as the sun rises

and the sky is bruised by fire.

3.1

Dear Ted, hello

Dear Ted, I am fine. Thank you.

I have left the grey and the sky

spreads open before me in shades

of pink and gold. My fingertips

are frostbit; my core is filled with fire.

Canto III

Published by Sandy on May 9, 2018

I wish my dad had drank himself to death. Instead, whenever he got mad, he’d grip his thumb inside his palm and his breathing would get weird and tight. After years of barely-suppressed anger, patches of his cheeks and nose went the purple-red of good beetroot – a whisky shine without the whisky. The coronary was the least surprising thing that ever happened to him: he’d been alone, sitting in his chair, watching the TV blare something about immigrant hordes. With nobody else to shout at – not me, not mum, not even old Ms Potts from next-door, who stayed far away from the fence – all his anger went inwards and popped his fucking heart.

He insisted throughout his entire life that alcohol was the devil’s brew. He didn’t drink, or swear, or jerk off. I know good folks like that too, but dad wasn’t good folks. Dad shouted his way through life, and he shouted his way through two marriages, and he shouted his way to an early grave.

There’s this thing called learned helplessness. You put a puppy in a box that it can’t escape. It tries and tries to break out, but the box is just too big. The puppy turns into a dog and now it’s much bigger than the box but it still can’t leave: it knows it can’t, so it doesn’t try. I tried to stop dad from shouting when I was a kid. It always ended up with me on the floor, and him towering over me and shouting. One time, he’d been watching the rugby and trying to eat mashed potatoes. Some went down the wrong pipe and I tried to hit him on the back, like I’d seen on TV. He spanked me with his belt so badly that I couldn’t sit down properly for days. I was twenty-five when he died.

I got him a copy of The Divine Comedy for his birthday once. Passive-aggressive, I know. I didn’t think he would read it. He did. He told me loved he Inferno. He told me about Mr Wilkins from the bowls club, who was a fat fuck; about young Ms Perkins who worked the desk, and how she was probably a whore; about the widowed Ms Potts from next-door who was a treasonous bitch and wouldn’t meet his eye at housie. Inferno had ‘em all, he told me. Each one slotted into their own hole where they’d be tortured until the Almighty had time to sort ‘em out. A circle for cowards and a circle for killers and a circle for little brown babies born to the wrong religion.

Dad never touched a drop but I know deep in my heart that if he had, it woulda fucking killed him. He would’ve taken to the bottle like a drowning man clinging to a raft. I never met a man more in-need of a drink, and less inclined to take one. I wanted him to drink so he’d just stop holding it in. Maybe he’d have killed me and then mum and then himself, and maybe he’d have collapsed inwards and left a pile of clothes and skin on the kitchen’s vinyl floor. Either way, we’d have been rid of him.

Dad got so mad that he just fucking died. I came home to find him, bug-eyed and purple, clutching at his chest with one hand and reaching out to me with the other. He was still twitching. He might’ve been dead but it was hard to tell. I couldn’t bring myself to touch him. learned helplessness, innit? I sat and watched him die, or maybe I just sat. The man on the TV shouted about the Deep State and dad didn’t shout at all; he didn’t even make a sound.

I’d get up to call for help, then get close to him, then spin around and sit back down and chew another fingernail until it bled. I watched him until rigor mortis kicked in – his shoulders squared and his knees stiffened, and for the longest minute of my life I swore he was coming back from the dead to beat me until I couldn’t sit down. His empty eyes rolled and his purple skin was black and glossy. He was a giant again, a monster with a bulbous wagging tongue, and I was a kid staring him down. The change in position forced him up out of his chair and he staggered, then fell. I swear, as he fell, I heard him cussing me out. He couldn’t have, but the sound made it to my ears anyway.

He loved Inferno, but I’m still not sure he read it. The fifth circle is for the wrathful, and the seventh is for the violent; cowards don’t even get through the gate. They’re non impegnato, uncommitted, unable to act or leave. Dad died, and I did nothing. There’s no place in hell for me, but there’s two for him so I think it shakes out.

Maybe he’s suffering somewhere. That makes two of us.

Shaq is About to Eat Five Gyros

Published by Sandy on May 9, 2018

NB: this piece was written for the I Don’t Even Own a Television podcast’s short story competition, where the prompt was ‘Shaq is about to eat five gyros’. It was soundly and fairly beaten by the actual winner, but I’m still very proud of it, and to this day I’m sad I never got to hear Chris Collision read it. It is immensely silly, and for some reason remains one of my most popular stories.

Shaq stared at the menu, and wept. He wanted the gyro with fries. He wanted the gyro without fries. He wanted the chicken gyro, and the lamb gyro. Most of all, he wanted the dark pleasure of the Everything gyro, which contained chicken, lamb, and a superposition of both fries and no fries – it contained the sum of all human knowledge, and some knowledge beyond the reach of man.

Coach Basketball had forbidden the Everything gyro. He said that there were some things men were not meant to know. Shaq wanted that knowledge: to fill his own boundless curiosity, and also for basketball.

“I have a large belly,” said Shaq to the gyros man. “I can fit five gyros within it easily.”

He pointed to the menu with his titanic arm. “I would like those five specifically.”

The gyros man went pale. “Four gyros and the Everything gyro? You are surely mad, Shaquille O’Neal.”

With a boom like a timpani, Shaq slapped his gigantic stomach. “ᴅᴏ ɴᴏᴛ ᴅᴇꜰʏ ᴍᴇ, ɢʏʀᴏs ᴍᴀɴ,” he roared.

The gyros man wept a single tear. “You have convinced me, Shaq. You are ready for five gyros.”

He disappeared into the depths of his food truck. Shaq waited, and smiled.

Fire-gilding

Published by Sandy on May 9, 2018

Beyond the west of the world, where the sun cannot be seen, lies Crow Hearth – the city of ice and stone. A city out of time, lost beneath the snow and beyond the turn of the world. Men scurry through the lightless streets, holding their warm coats close until they can escape down into the rats’ nest of heated tunnels that make the bulk of the city.

Down now, down again. Through the tunnels. Follow the insistent ticking that lives somewhere behind the mind and pushes further onward. Don’t touch the men with blue-and-white carbuncles upon their skin, and pale light in their eyes – they are touched by the Heart and lost to the world.

Down now, down again. Tick tick tick. The world here hums. The walls move in and out and the ice groans. There is a shop filled with clocks. An old woman attends. She wears goggles cobbled together from wire, obsidian and red glass; it is not clear what she sees. She scurries around, moving clocks back and forth. Her time is not up yet.

Watch. She opens a door in the back and enters the room of bad clocks. It is deeper, and closer to the Heart. The walls are ice, and glow with sickening light. In years past, she hammered hooks directly into the ice and now upon them the bad clocks hang. They tick a second too early, or too late. They tick when they should tock. They are ugly.

To make a gold clock, she coats it in a layer of, among other things, liquid mercury, then lights it on fire. The mercury burns so fast it doesn’t even damage the wood, and leaves a more pure and beautiful gold coat than mere paint could ever hope for. The room of Bad Clocks smells of piss and mercury. The old woman smells of piss and mercury. The horrid syncopated ticking hides the lower, more regular and insistent thump thump thump of the Heart.

She was young once. She did not want to die. Every second ticked away was a second she could never get back. She charted each passing second as the ice walls closed in. She took meticulous notes of her time ticking down. Now, she lives alone, encased in ice, with the ticking of her clocks for company.

Below, the Heart beats. Above, the snow falls.

There is nothing here but the ticking of clocks, counting down to gods-know-what.

We Fight Monsters

Published by Sandy on May 9, 2018

Every day, Rose went out beyond the hawker stands –out beyond the torn-up fences and beat-up dock workers– to the place where the water was clear. Every day, she went to the ocean to weep. The siyokoy took her son when he was out swimming: the niños ate her little niño. She would cry, and scream, and strike the water with her fists. Then, she would return home and cry, and scream, and strike her remaining sons while they cowered in the corner. If you’d asked her, she couldn’t tell you why.

Patti saw, and didn’t know what to do. She watched and hid in trees, on rooftops, behind a jumble of TV aerials. She walked on her hands to keep a low profile, and kept her wings hidden in the small of her back. Her guts got dirty as they dragged along the ground. When Rose wept, Patti wept too. She couldn’t tell you why.

Patti wasn’t a siyokoy. She hadn’t even been nearby when little Alberto got dragged down and eaten up – she was off in Cebu, lurking around a maternity ward. The modern world was good for manananggal: they put all the pregnant women in one place. Patti could spread her feeding around, and not hurt a soul. Her neighbours knew what she was. One of them would hang crucifixes all over the damn place and the apartment hallway always reeked of burning sage, but they left her alone.

She didn’t swoop down on them in the dead of night; they didn’t hunt her through the jungles with spears. They told their friends about the monster next door but never said anything to her face; she smoked weed and listened to old punk records, and only fed when she needed to. She followed Rose out to the docks every day she could, and watched, and wept.

It was near the end of the dry season when it happened. Patti sat on Mr Nunes’ balcony smoking a cigarette and listened to Rose shouting at her boys. She leaned across and peered in the window, and one of the boys (Lucas, the tall one, with his shaggy mop of hair) peered back. He was backed in a corner, almost in a squat. Patti had seen a lot of human faces. She’d seen them scream, or go white, or (in more recent times) turn away muttering a prayer. She had never seen this– Lucas looked her dead in the eye, plaintive, and mouthed a single word.

help

While she stared, Mr Nunes ran up and hit her with a broom. She hadn’t even seen him coming. “Aswang!” he shouted “go away! Get out of here, Tik-Tok!”

She took flight while Mr Nunes shouted some bullshit about Our Mother Mary. She hung in the air for a moment, hissed at him, then gave him the finger and swooped off into the night.

***

Every day, Patti followed Rose down to the water. Every day, she remembered Lucas’ sad eyes and crept a little closer. As the dry season came to a close, Cadiz was going insane– after six months without rain, a sick pressure builds in the air that makes men wish for a flood. Patti felt it in her skin, and in the space between her eyes. Rains made it harder to fly, but also easier to move around undetected. She knew in another six months she’d be praying for the rains to stop. Funny how that worked. Patti had left her legs behind: lower profile, harder to be seen. She had a good view of Rose from the roof of the Port Authority office. A dock worker noticed her, made the sign of the cross, then went back to stacking boxes. She took a deep breath, and swooped down.

She wanted to scare Rose– to bite her and scratch her. She spread her wings wide, and bared her sharp teeth, and opened her mouth to roar. Rose turned, and saw. She did not scream, or go white. Her eyes were plaintive, and filled with tears. Patti lowered her hands, only a little. Her jaw hung open.

“Are you going to kill me?” said Rose.

It wasn’t fear: Patti knew fear. It was almost begging.

“No,” said Patti. She slumped, and let her guts touch the sand.

“So,” said Rose, “we’re monsters.”

She stared out to sea. The sun hung low over Cadiz, and painted the clouds in fire-orange and bruise-purple. They sat in silence. Patti took out a cigarette, then realised she’d left her lighter in her pants. Without speaking, Rose proffered a green plastic Bic lighter, and lit the cigarette.

Patti smoked it down to the filter, then held it between her thumb and forefinger and flicked it into the ocean. It floated, and sent ripples out into the water.

“We don’t have to be,” she said. “The world hurts. It hurts in big ways and it hurts in small ways, and it twists your spine until you find yourself hurting it back. That’s the trap. You’ll hurt your sons, and they’ll hurt their friends and their wives, and their wives will hurt their sons and it’ll keep on hurting until the clouds and the rapture takes us all.”

“You think it’s that easy?” said Rose. “Just stop hurting?”

“No,” said Patti. “It’s the hardest thing I ever did.”

Rose didn’t reply. They sat, and watched the sun set. Patti took out another cigarette. It was the last one in the pack.

“You never really quit,” she said. “You just go longer between relapses.”

“Cigarettes?” said Rose.

A pause hung in the air.

“Yeah, sure.”

“Maybe,” said Rose, “that gap gets big enough that you forget what tobacco tastes like.”

“That would be nice,” said Patti. Her voice broke, only a little. “Really nice.”

They sat, and watched another day turn to night. Patti smoked her last cigarette. She left embers in the sand, as the disappearing sun left streaks of fire in the sky.

keepongoin

Published by Sandy on May 9, 2018

Tremblay lay against gunwale, smoking a cheroot. The wind whipped up around the ship, and snatched away his smoke. A thousand miles of open ocean lay before him but hells, he loved a challenge. He didn’t have magic, or money, or even a crew; he had a boat, and a broken heart, and the wind behind him. Welta would’ve known what to do but he was–

–elsewhere. Elsewhere with his beautiful smile and his wonderful strong arms. Elsewhere with his mushy poems and his big eyes that teared up when he heard the wrong song. Tremblay ran a hand through his greying hair: was he really getting so old? When they’d met, they were the same age. As Tremblay’d got slower, and heavier, Welta had stayed the same. It was, well-

Magic.

Came the day it became obvious, they’d fought, then held each other and kissed and fought again. Came the day when Tremblay came home to find a poem on the bed:

An immortal man cannot love

a mortal without seeing time

writ in the reflection of his lover’s

eye. With all my heart, I wish

goodbye.

Amazing: ten thousand years alive and still a shithouse poet. The soul in the eyes? Boo. Tremblay took another long drag of his cheroot, then straightened the ship’s lines and maneuvered his way back around to the rudder. The taste of tobacco calmed him. He didn’t know how long his supply was gonna last but it was far from the most pressing concern. He’d run out of food days ago, though the ocean was seeing him through. Water was going to be a bigger problem but he’d choke on that one when he came to it.

The wind took his little boat skipping across the waves. The spray got in his eyes, but he was used to it by now. His hands were paved with salt: white lines wending their way through dark skin.

“You’re gonna die,” he said to himself. He laughed – yep, that was indeed the problem. The wind stole away his words and his laughter. Sooner or later he was gonna die and Welta wasn’t and it didn’t make either of them love any less. He’d be an old ghost with rattling bones, reading mushy love poems left on the bed at midnight. He’d be dead, and full of love.

Would be would be would be. Would that Welta had the goddam courage to stay. Would that the sea weren’t so wide. Would that love made the wind go where you wanted.

He checked his compass, then adjusted the rudder to take him north. Last known heading, hah! Dead man’s heading. The hours tore by and in time he saw a treetop canopy, then a small island. Not on the maps, but what place worth being was? He took the boat in, around a small shoal, then jumped out and hauled it up on the sand. His pants got wet, but his pants were always wet: that’s what living in a tiny boat does to a man.

A boar peeked out at him from a nearby bush. He nodded at it. “You seen my husband?” he said. The boar went snrrreeeeeeekkkkt then ran away. Well, at least he wouldn’t go hungry. The canopy burst with brightly coloured birds, and the smell of sweet sap hung heavy on the air. It was paradisical, almost, though he knew he couldn’t stay. Water, then food, then onto the next island. Birds, and boar, and–

paper? He wandered over to a tree, and found a small sheet pinned to it. He recognised the handwriting immediately.

I knew you’d follow

though it breaks my heart.

it said. Right-o. Soppy motherfucker. A creek creeped its way out of the jungle. Tremblay took a sip, then spat it out: brackish, but with the promise of freshwater upstream. He followed it, ducking under vines and periodically frightening the wildlife. After about an hour, he found another piece.

I don’t want to watch you grow old.

it said. The creek kept going. A snake peered ruefully at Tremblay from a nearby branch. It was bright green, and very long, but it didn’t look like a strangler. Good thing too: he’d seen more than a few stranglers. This wasn’t his first strange island. It had been, all things considered, a very strange life. It should’ve ended a long time ago, with a bullet or a blade or a snakebite. It hadn’t. It had kept going, and time had started its implacable course on his face and his guts and everything in between. He tried the water again: better, but still not drinkable.

Tremblay kept going. The interior of the island was darker, and strange animals followed him. He kept his gun at his side, but they didn’t want to approach. In time (how long? A day, an hour?) he came to a lake. The water was cool, and fresh. He filled his belly, then he filled his canteens. Something fluttered from a nearby tree trunk: very high up, the bastard. Fine for young strong muscles, but Tremblay’s body didn’t work quite like it used to.

He took a stout vine, then wrapped it around the trunk. He braced his feet against it, then tensed his core and forced the vine upwards. Slowly, by fits and starts, with his arms screaming every inch of the damned way, he made it to the top. The menacing whisper of the jungle stopped. A cool breeze came down through a gap in the canopy, and for just one moment he felt alive again. Five words greeted him.

I love you. I’m gone.

He didn’t cry – he felt too good to cry: vital and strong and filled with goddam life. He slid down the trunk, and took a moment to collect himself. He let out a whoop, and the jungle didn’t respond.

“I’m going to die,” he said to himself. He smiled, then headed downstream for the shore.

What Ukto Saw

Published by Sandy on May 9, 2018

In Enji, the citizens fell through the world. On the eighth day of summer when the sun was high over the sand, their floors and streets swallowed them. Many died or disappeared, but some did not – they were stuck jutting from the earth, alive, with twisted limbs and bent backs. This is not interesting in-and-of-itself; in the world of Ataal, such things are commonplace. Enji is different, because Enji went on.

On the eighth day of summer, not all of Enji was inside Enji. Not all of a city’s work happens in the city: farmers in the fields, hunters in the desert, mystics sitting upon marble pillars. They did not fall through the earth and when they returned home, they found their loved ones crying out in pain. They sat with them, and stroked their hair; they spoke of the land-locked as if they were already dead. They gave palliative care and they did not weep. They held meetings about dealing with broken bones, and filthy clothes. They got very good at caring for the land-locked. They loved them, you see: they bathed and fed them, but they also hugged them, and sang to them, and told them stories about the changing world outside. They coated them in perfume made from sweet desert flowers.

In time, the society of Enji twisted to accommodate their new lives. Industries sprang up: a man could not could not care for his land-locked husband every hour of every day, but he could pay another man to do it for him. In time, that changed too: one man to feed, one man to bathe, one man to sing songs. Enji was rich in mineral wealth, and in time the city refilled on its own. New arrivals were briefed on the land-locked. Many took jobs looking after them, and when more folks showed up, the old-new-arrivals briefed them. The oasis of Enji rose higher: a city of jasmine, chrysanthemum and gold. Wealth flowed through the streets of Enji – the city of men-within-earth.

When one of the land-locked died, there was clear procedure. A priest would lay garlands of sweet-smelling flowers around the deceased, then call out to Ukto, the vulture goddess, to carry them away into the sky. No man in Enji would dare to hurt a vulture, for fear of angering Ukto, the cleaner of the dead. The temple of Ukto was the tallest in Enji: its golden minarets towered over the city of sand. If the family of the deceased were wealthy (and many in Enji were wealthy) they’d commission an artist to encase the body in beautiful enchanted glass so it could last forever.

As the land-locked died off (of old age, or some other invisible malady that carried their kind away), the city of Enji became littered with prisms. At sunrise, sunset and the hour when the sun was most high, the glass sang – light refracted off the prisms in just the right way to have them ring out. A true citizen of Enji could set their watch by it. Clever men with mirrors would stand by the prisms and play music for travellers – the locals saw the practice as tacky but there were always strangers’ feet upon the streets of Enji. Enji: the city of men-under-glass.

In time, the last man who remembered the face of a land-locked –Ibu, a merchant who’d been on the road outside the city– died. When Ibu’s husband had gone to the earth, Ibu had cried and cried until his neighbour shouted at him. Ibu had cried with his husband Yaji, and expected him to die. Yaji died, but not for forty years. Ibu died ninety years later, at the ripe old age of two-hundred and six; Ibu died peacefully, in his sleep, and took with him the last memory of Yaji.

In time, the last man who remembered the purpose of the prisms –Ajata, who lived a thousand years unremarkably– died. His father told him stories about why the city sung at dawn and dusk. He told him the prisms once contained skeletons. Little Ajata had not believed it, but had rushed to his classmates to tell them anyway. They hadn’t believed him, and had forgotten all about Little Ajata’s strange lie. Big Ajata died because he said vile words at a vulture and it pecked his eyes out. He died in the mountains, with Enji stretched out below him. He took the memory of skeletons with him and so Enji was left only with prisms of coloured glass that sang at dawn and dusk; Enji was left with men with mirrors, who played songs on the prisms and who were beloved by all.

A university rose and bloomed. Archaeologists studied the glass and said “maybe it is to capture the sun” or “maybe it is to pay homage to Ukto, the goddess of the sky” and made careers of this speculation. They made sure the glass was well-kept. Tourists flocked to Enji, and took photographs, and even though the earth had long since ceased to spring forth gold, Enji remained a rich city – the envy of Ataal. Enji: the city of glass.

The world turned, and another nation (its name does not matter –I cannot remember it, therefore it does not matter–) attacked Enji and burnt the great city of prisms to the ground. They took its riches, and killed its people, and smashed its musical glass. They took their loot home. They drank wine and toasted the murder of a city.

In time, the last man who remembered Enji –a singer, a storyteller. His name does not matter– died. The sand covered up his bones, as the sand covered up Enji.

In time, the sun above Ataal got so hot that it cooked men inside their homes. Oceans evaporated, and silence came to rule Ataal. The deserts around Enji got so hot, they turned to glass. If a man had walked across the desert –though there were no men left on Ataal– he might’ve seen a ruined city under glass. When the sun was at its highest, it struck the glass and the glass sang out.

It sang for nobody save Ukto and the endless open sky.

When the earth opened up, Enji went on. When the skeletons rotted away and their memory was lost, Enji went on. When war came to Enji and smashed its glass, Enji went on – silent beneath the sand, not even a memory. It is not a lie to say: even in death, Enji went on. Enji: the city under glass.

Playing Horseshoes

Published by Sandy on May 9, 2018

The Big Book of Animal Anatomy said that horseshoe crabs had blue blood. It was one of the only books in the house, along with a boring old beat-up copy of New Zealand Bike Trails and a scary book called The Fairer Sex that Henry wasn’t allowed to read, which had a lady with a gun on the cover.

Mum and dad took the train south to Wellington every morning, and didn’t get home until after bedtime. There was a school for kids in Paekakariki, but not any proper jobs for adults – there was a cafe and a church, and a lot of houses, and the beach: that was pretty much it. Henry walked to school, then after school he read The Big Book of Animal Anatomy or walked around on the beach and found stuff for his collection. His collection had: 15 bones from various small fish; a weird gold coin with a funny symbol on it, that dad said was maybe a British Pound from the old days (though he wasn’t sure); 4 cool paua shells and, pride of place; 1 skull of Phocarctos hookeri or the common New Zealand Sea Lion.

The day he found a horseshoe crab was a big day. He was pretty sure just from the look of it (the Book had a lot of pictures) but the blue blood really gave it away. It was missing a big chunk of its belly, and its little blue eggs were spilled all over the sand. Horseshoe crabs never came this far south: the waters were too cold. It must’ve got lost somewhere.

It was a big day because it was a cool thing for his collection (1 Carcinoscorpius rotundicauda, or Mangrove Horseshoe Crab) but also because that’s the day he met Sophie. She was half a year older than Henry: almost 10. She had dark brown hair, and green eyes. She had a necklace with a seagull skull on it that she made herself. She knew lots of cool things about animals; she said the horseshoe crab probably got killed somewhere else, then floated on the East Australian Ocean Current from Indonesia all the way down to little old NZ. She also had a big cool driftwood stick that made her look like a magical ocean witch.

He let her take the horseshoe crab, even though he really wanted it. The way he saw it, he lost a crab, but he made a friend. The next day, he went back out to the beach and found Sophie again. She was staring out to sea and turning a gold coin over between her fingers. She smiled when she saw him coming.

“That’s British,” said Henry. “They used to have British money here.”

She shook her head. “Yeah nah,” she said, “this is from the magical city beneath the sea. My dad told me about it: if you swim out past Kapiti, there’s no land for ten thousand thousand kilometers, until you get to Ar-gen-tina. Somewhere in that ocean, there’s Atlantis, which is stuck beneath the sea ‘cos God got mad at it.”

“Nah,” said Henry, “Atlantis is in the Atlantic. It’s right there in the name.”

“Nah nah,” she said. She banged her staff in the sand. “There’s thousands of boats going through the Atlantic every day. Thousands and thousands, but there’s basically nothing between here and Cape Town – that’s why nobody has ever found Atlantis, ‘cos it’s in an ocean that nobody ever travels on.”

Henry nodded: it checked out. “Atlantis sounds cool,” he said. “It sounds way better than Wellington, and way way better than Paekak. This town sucks.”

Sophie was real smart, and also real pretty. Henry went to hang out with her every day after that. They walked up and down the beach, and found all sorts of cool stuff. They talked about their dads: her dad sounded way nicer than his. They didn’t find any more horseshoe crabs, but one time they found weird tracks in the sand that Sophie said a horseshoe crab had left – an alive one! Maybe it was looking for its friend. That was kind of sad: it must’ve been very lonely, being a horseshoe crab.

***

Mum and dad made snapper fillets for dinner again. Henry hated snapper fillets. He didn’t like eating fish at all: it smelled bad, and it tasted the same way it smelled. Fish were cool to read about, but eating them felt wrong. They’d been alive once, in the great big endless ocean. They could go anywhere. Now, they were meat that you ate with lemon and a side of mashed potatoes. Henry didn’t eat his snapper, so dad got mad and sent him to bed early.

He was sitting and reading the Big Book, when he heard dad shout. At first he thought dad was just mad at mum again but then he heard glass breaking and got scared: dad liked to shout and swear, but he never broke things.

Henry didn’t want to go out of his bedroom, but he also knew that it was important to be brave. Maybe somebody had fallen down. He opened the door just a crack, and peeked out. The smell of blood was so thick in the air that he gagged. He ran back inside his room and slammed the door, then dived underneath the bed. The springs and rods of the bedframe dug into him and almost made him cry out, but fear kept him quiet.

He curled up, and shivered, and didn’t cry.

Somebody knocked on the bedroom door.

“Henry?” they said. Their voice was strange: it went click-clack and sounded like it came from deep inside their throat. It was thick and wet and sounded like the tide retreating.

A moment passed, and a new voice came through the door: one he recognised.

“Henry?” said Sophie. “They’re gone now. We can go.”

“The monsters?” said Henry.

“Yeah Henry,” said Sophie, “the monsters are gone.”

He crept out from under the bed, and opened the door. Sophie stared back at him. There was blood all over her: on her shirt, on her jeans, on her face. Henry didn’t know what to do, then he saw it: behind her, chittering and burbling, looming up with spiderlike legs and its mouth oozing blue blood. He screamed, grabbed her, pulled her through the door, then slammed his whole weight against it. She stood in the middle of his bedroom, and smiled at him.

Then, she began to grow. The skin around her mouth peeled back, and her pretty green eyes bulged and split. Her legs melted together, and three pairs of spiderlike arms uncoiled from her chest. Henry heard her spine snapping and reforming as she twisted into her new form. It didn’t look like it belonged upright: she swished her tail back and forth like she couldn’t stay balanced.

“I’m sorry my dad scared you,” she said, in that voice like the sea rushing between rocks. “We came to take you away, to the city. Like you said you wanted.”

She wrapped her arms around him and he didn’t know whether she was hugging him or hurting him. One of them cut him, just a little, and he felt a strange rush. She was cold, and damp. She smelled like the ocean, and like dead things. Henry began to cry. He cried in her arms for longer than he knew, then she let him go and he went and unlocked the door.

“Hello Mr Sophie’s Dad,” he said. The beast did not respond. It pointed, with its strange bonelike arms, out to the sea beyond Kapiti, then it fell from its upright position: it scuttled across the floor, a medallion of cold chitin like a knifelike tail. Henry sobbed. Sophie brushed by him. Her tail flicked up and tapped gently against his back. Her voice came muffled from somewhere beneath her shell.

“C’mon Henry,” she said, “it’ll be cool. You don’t need to be alone.”

He couldn’t see his parents’ bodies, but the reek of their blood made his head spin. The two gigantic horseshoe crabs scrambled out the door and across the sand. Henry stared at them. His throat hurt from crying. The water called to him. It was beautiful, but he couldn’t say why.

He took a deep breath, and followed them into the ocean.