1
00:00:00,000 --> 00:00:03,580
Welcome, DEF CON 28, the Do No Harm panel.

2
00:00:03,580 --> 00:00:06,020
This is a healthcare security conversation.

3
00:00:06,140 --> 00:00:14,500
And for the next 45 minutes, followed by a 45-minute Q&A, you're going to hear from some of the world's top experts on the healthcare cybersecurity space.

4
00:00:14,540 --> 00:00:15,260
Welcome.

5
00:00:17,080 --> 00:00:18,040
Thanks, Kwadi.

6
00:00:18,120 --> 00:00:19,280
I'm Replicant.

7
00:00:19,280 --> 00:00:28,320
We're going to get out of the way here in just a moment and introduce you to our panelists, but obviously a little bit different of a venue for us than the last couple of years.

8
00:00:28,320 --> 00:00:35,360
We hope that everyone is staying safe and healthy and we're thinking of you and look forward to when we can hang out together in person.

9
00:00:35,740 --> 00:00:40,500
Without any further ado, I'm going to let our panelists take it away and say hi.

10
00:00:42,080 --> 00:00:43,140
Hi, everyone.

11
00:00:43,140 --> 00:00:44,380
My name is Ash Luft.

12
00:00:44,380 --> 00:00:49,300
I am a biochemist, a computer scientist, and an electrical engineer.

13
00:00:49,480 --> 00:00:51,720
I work as a medical...

14
00:00:51,720 --> 00:01:00,600
I work at a medical device firm called Starfish in Canada, and I'm a software engineer there and an advocate for security and privacy.

15
00:01:02,910 --> 00:01:04,820
I think that means that I'm next.

16
00:01:04,820 --> 00:01:07,740
So I don't have a handle, unfortunately.

17
00:01:07,740 --> 00:01:09,820
So I am Jessica Wilkerson.

18
00:01:09,820 --> 00:01:17,180
I'm a cyber policy analyst with the Food and Drug Administration, and I work on cybersecurity policy there for medical devices.

19
00:01:17,420 --> 00:01:25,880
Some of you may know me from my previous time with the United States Congress Energy and Commerce Committee where I worked on cybersecurity policy for them.

20
00:01:25,880 --> 00:01:27,480
Very nice to talk with everyone.

21
00:01:27,480 --> 00:01:28,360
I'm looking forward to the panel.

22
00:01:28,360 --> 00:01:29,260
Thank you.

23
00:01:33,040 --> 00:01:34,820
Hi, this is Vi.

24
00:01:34,820 --> 00:01:35,920
Everyone should know me.

25
00:01:35,920 --> 00:01:38,600
The short, the sweet, the sassy, the spunky.

26
00:01:38,840 --> 00:01:47,520
I'm leaving my company for the wild fields in Norway where I'll be having a whole host of minions to help me do medical device research.

27
00:01:47,520 --> 00:01:54,800
Currently doing independent research for Medtronic, aiding them to get more visualization on their products and their security.

28
00:01:54,880 --> 00:02:02,940
I'm an advocate for patient rights as well as keeping things safe, keeping it simple, keeping it stupid, as I say.

29
00:02:03,620 --> 00:02:06,100
And that's me, short and sweet.

30
00:02:07,860 --> 00:02:09,080
And that leaves me.

31
00:02:09,080 --> 00:02:10,720
My name is Vidya Murthy.

32
00:02:10,720 --> 00:02:17,100
I work for MedCrypt, a startup in the space of bringing cybersecurity features to medical devices.

33
00:02:17,220 --> 00:02:27,480
I absolutely am passionate about the subject matter and think that we're at an inflection point here and there's going to be a big amount of change as we go forward.

34
00:02:30,130 --> 00:02:36,450
Well, on behalf of Claudia and myself, we are just so incredibly grateful to have an amazing panel this year.

35
00:02:36,710 --> 00:02:47,690
And for those of us who are joining us for the first time, and this is kind of one of the silver linings, I think, about this format, is that in past years, we've had folks who wanted to kind of get in on this conversation that weren't able to due to space constraints.

36
00:02:47,690 --> 00:02:54,110
So we're really thankful for the opportunity to have anybody who wants to come in, listen in and join with us to be able to do so.

37
00:02:54,110 --> 00:03:10,150
So for those who may not be familiar, what we're going to do is we're going to have a little conversation here between the four of these awesome panelists, and we're going to stay out of it as much as possible, but get their insights and kind of what their thought processes are and some of the things we've been seeing in the space lately.

38
00:03:10,150 --> 00:03:14,930
And then part of this session will be a live Q&A follow-up conversation afterwards.

39
00:03:15,830 --> 00:03:25,510
So we don't really have a formal set of questions like most of these kind of more rigid panels do, but I do want to kind of start off on a little bit of a brighter note.

40
00:03:25,510 --> 00:03:31,810
I think some of the times that we've had this event in past years, we spend about 45 minutes talking.

41
00:03:31,830 --> 00:03:34,810
The term dumpster fire comes up not infrequently.

42
00:03:34,970 --> 00:03:44,790
And then at the end, we try and push a little optimism because there really is a lot to be sort of hopeful about in large part because of the types of things that we're able to do at places like DEF CON.

43
00:03:44,790 --> 00:04:00,950
But I want to kind of start off this time upfront by asking each of our panelists, what are some developments lately that have helped make you feel particularly hopeful or optimistic about where we're heading in healthcare security before we get into some of the challenges that still remain?

44
00:04:00,950 --> 00:04:05,470
So kind of toss it back to our panel for us to get a little dose of optimism.

45
00:04:06,650 --> 00:04:13,990
Yeah, so I think looking at this year in particular, we've seen more and more devices going home with patients.

46
00:04:13,990 --> 00:04:20,670
We've seen hospitals go online in a way that they've never planned to in 10 years from now, right?

47
00:04:20,670 --> 00:04:34,610
And I think the notion that we can now build security into this and need to, to let patients have confidence in them operating from their homes, is something that seems to be top of mind for folks and actual common practice.

48
00:04:34,610 --> 00:04:41,510
So it feels like a confluence of various factors that are coming together at just the right moment.

49
00:04:41,510 --> 00:04:43,850
So we have this push of devices leaving the hospital.

50
00:04:43,850 --> 00:04:49,490
We have this push of device vendors really getting into the narrative more than ever before.

51
00:04:49,490 --> 00:04:56,550
And this collaboration like DEF CON brings together with researchers and devices themselves.

52
00:04:56,550 --> 00:05:05,450
And I just, I have a lot of hope that this year has the momentum behind it to really get this to stick and have the forces that are really gonna make this last in the future.

53
00:05:09,560 --> 00:05:20,260
Yeah, so I echo that, but I've also seen this big push, I find it past three years, where you could not even have a conversation with a manufacturer, right?

54
00:05:20,260 --> 00:05:21,580
It was a brick wall.

55
00:05:21,580 --> 00:05:23,360
This year we're having conversations.

56
00:05:23,360 --> 00:05:25,580
This year we invited to the table.

57
00:05:25,840 --> 00:05:30,720
Hackers are no longer the criminals that are lurking in the darkness.

58
00:05:30,720 --> 00:05:32,080
We've brought things to light.

59
00:05:32,080 --> 00:05:35,840
We're having difficult conversations, but we're having them.

60
00:05:35,840 --> 00:05:38,240
And I think that's a major push forward.

61
00:05:38,240 --> 00:05:49,120
But except for that, we now having developers and engineers think more security wise, we've started to change the cultures of working in silos to start working as a collective.

62
00:05:49,320 --> 00:06:00,360
And one example that I've seen is the way that the community is jumping with the 3D printing, PPE, mask making, supporting medical people where they can.

63
00:06:00,360 --> 00:06:07,420
And I mean, even the CTI league that's protecting hospitals around the globe from cyber criminals.

64
00:06:07,460 --> 00:06:14,940
I mean, that is just a collective pool of humanity showing that if we work together, we can change the world one button at a time.

65
00:06:15,160 --> 00:06:17,120
What do you think, Jessica?

66
00:06:18,060 --> 00:06:20,060
Oh, I like the prompt.

67
00:06:20,940 --> 00:06:28,500
I mean, I think I started working on healthcare cybersecurity issues, I think right around 2015, 2016 timeframe.

68
00:06:28,520 --> 00:06:32,620
And at that point, obviously I was working on them for the United States Congress.

69
00:06:33,680 --> 00:06:36,320
And it was just an entirely different conversation.

70
00:06:36,320 --> 00:06:44,700
I mean, the things that we were talking about, you know, like V had said about let's bring in security researchers, let's have them be part of the conversation.

71
00:06:44,700 --> 00:06:47,660
They have valuable experience and things to contribute.

72
00:06:47,800 --> 00:06:49,340
That was just such a non-starter.

73
00:06:49,840 --> 00:06:53,640
And you had all these manufacturers who absolutely were never going to do that.

74
00:06:53,640 --> 00:06:55,540
That was completely unacceptable.

75
00:06:55,540 --> 00:07:03,540
We are still, in some cases, getting asked for help by the manufacturers to essentially be like, can you make this problem go away?

76
00:07:04,500 --> 00:07:09,060
And there were just other policy issues, you know, that have come up over the years.

77
00:07:09,280 --> 00:07:11,280
I work a lot on legacy device issues.

78
00:07:11,280 --> 00:07:14,100
I work a lot on software transparency issues.

79
00:07:15,120 --> 00:07:18,820
And they always started out as, this is never going to happen.

80
00:07:18,820 --> 00:07:20,100
We're never going to be able to do this.

81
00:07:20,100 --> 00:07:22,200
The industry will never accept this.

82
00:07:22,460 --> 00:07:26,660
And in 2020, it's completely different.

83
00:07:26,660 --> 00:07:28,260
I work on those issues every day.

84
00:07:28,260 --> 00:07:30,540
They are starting to be operationalized.

85
00:07:30,680 --> 00:07:35,560
Security researchers are a huge part of medical device and healthcare cybersecurity overall.

86
00:07:36,000 --> 00:07:38,120
And we've just really made so much progress.

87
00:07:38,540 --> 00:07:43,000
And we've made the progress in such a way that it has its own momentum now.

88
00:07:43,000 --> 00:07:44,660
It's going to carry itself through.

89
00:07:44,660 --> 00:07:48,060
And I just think that that really can't be overstated how valuable that is.

90
00:07:50,040 --> 00:07:52,620
Yeah, so I agree with what everyone said.

91
00:07:52,640 --> 00:07:59,880
I would say that I think one of the biggest things I've noticed in the last five, 10 years is the people.

92
00:08:00,080 --> 00:08:03,520
So community and like the number of people sort of coming together.

93
00:08:03,520 --> 00:08:11,860
There seems to be lots of different groups and organizations popping up, like even the last couple of years, advocacy groups, people working together.

94
00:08:12,140 --> 00:08:13,860
Yeah, medical device manufacturers.

95
00:08:13,860 --> 00:08:27,540
I mean, even when I, you know, five years ago started having these conversations and asking questions about security and privacy, it was harder to find other people to even have a discussion with about these things.

96
00:08:27,540 --> 00:08:38,860
And now it just seems like there's this momentum that's really building and the number of people are just getting who are engaged and want to make a difference and want to be a part of the conversation is growing.

97
00:08:38,860 --> 00:08:49,860
And I see that as a huge positive thing because realistically, like the more people that we have participating in the conversation, the more action that we're going to be able to take sooner and faster.

98
00:08:51,620 --> 00:09:02,900
Yeah, I think one of the big things also is we've seen physicians coming to the table and wanting to learn more about the devices they have and work with, right?

99
00:09:02,900 --> 00:09:06,420
It's not just the security people driving it or policy driving.

100
00:09:06,420 --> 00:09:13,020
And I think the healthcare industry has come back into a bang and saying, how can we make this better for our patients?

101
00:09:13,220 --> 00:09:18,340
Because in the end, I think every physician wants to make it safer for their patients.

102
00:09:19,020 --> 00:09:26,000
And that's a big thing for me that I've seen this year is the physicians coming to the table saying, well, how can we learn more?

103
00:09:26,480 --> 00:09:33,360
How do we translate this to our patients in a way that they understand?

104
00:09:36,020 --> 00:09:37,960
Yeah, yeah, I think that...

105
00:09:38,520 --> 00:09:40,940
I love conference calls.

106
00:09:40,940 --> 00:09:45,240
I was going to say, you know, I'd really...

107
00:09:45,240 --> 00:10:02,000
I'd echo that because I think, you know, even going beyond patients and things, one of the things that my boss is really quite insistent on, and you probably all know Suzanne Schwartz one way or another, is the shared responsibility of the healthcare sector,

108
00:10:02,000 --> 00:10:05,100
where, you know, even we are the Food and Drug Administration.

109
00:10:05,100 --> 00:10:06,340
We can only do so much.

110
00:10:06,340 --> 00:10:09,000
We have jurisdiction over the medical device.

111
00:10:09,000 --> 00:10:10,920
We don't have jurisdiction over hospital networks.

112
00:10:10,920 --> 00:10:19,740
We don't have jurisdiction over other parts of it that, you know, sometimes that are certainly implicated in cybersecurity concerns.

113
00:10:19,820 --> 00:10:33,360
And so, you know, there's traditionally been a very fraught relationship between, for example, medical device manufacturers and healthcare delivery organizations, so hospitals and others.

114
00:10:33,500 --> 00:10:43,200
And what I've started to see and have personally experienced over the last couple of years is a greater and greater breakdown of the barriers between those two groups.

115
00:10:43,200 --> 00:10:50,320
So with some of the partnership groups that exist, I spend a lot of time working with the Healthcare Sector Coordinating Council.

116
00:10:50,320 --> 00:10:59,480
For example, you have hospital CISOs who are on the phone every day with global product security officers at medical device companies, and they're just having conversations.

117
00:10:59,480 --> 00:11:03,580
I mean, sometimes they're just shooting the shit, and sometimes they're actually talking about work stuff.

118
00:11:03,580 --> 00:11:10,580
Those relationships being there and being already established are just so meaningful.

119
00:11:10,580 --> 00:11:16,640
It allows the progress in the sector to be made so much faster and problems to be addressed so much quicker.

120
00:11:16,780 --> 00:11:25,580
And so I would echo what V said about, you know, we're having almost new entrants into the conversation that's letting the conversation really take off.

121
00:11:26,780 --> 00:11:28,260
I just want to say...

122
00:11:28,260 --> 00:11:29,120
Sorry.

123
00:11:29,600 --> 00:11:30,900
Go ahead, Christian.

124
00:11:30,900 --> 00:11:46,020
I just want to say these are all fantastic insights, and I love to hear the optimism around how the conversation's changed, because every year when we have this event, we undoubtedly have to talk about an event that's happened during the year, you know,

125
00:11:46,020 --> 00:11:53,420
whether or not it's WannaCry, or whether or not it's a security researcher that's been shunned or threatened by a device manufacturer.

126
00:11:53,420 --> 00:11:59,560
And for, I think I can say this is the first year where I have not been publicly aware of such an event.

127
00:11:59,560 --> 00:12:09,060
And so I think that's really proof to what everyone's saying here is at least part of the interaction with hackers has changed.

128
00:12:09,060 --> 00:12:13,220
Now, whether or not that'll stick or whether or not this is just an off year, I think we'll have to see.

129
00:12:13,220 --> 00:12:24,760
But when we have strong partners in this space, you know, hackers coming together with health organizations and device manufacturers welcoming their collaboration, everyone wins.

130
00:12:24,760 --> 00:12:28,400
And that's really what makes patients safer at the end of the day.

131
00:12:28,540 --> 00:12:36,500
I wanted to just also say, though, a lot of what was discussed is optimism around this is a great year.

132
00:12:36,540 --> 00:12:38,400
It's also a horrible year.

133
00:12:38,400 --> 00:12:41,600
COVID, like 2020 is one I would love to forget.

134
00:12:41,600 --> 00:12:45,440
There are so many things about this year that have absolutely sucked.

135
00:12:45,860 --> 00:12:51,940
One of the things that's been voiced to me by a variety of people is, you know, how is COVID going to impact this?

136
00:12:51,940 --> 00:13:00,420
You know, how is COVID going to impact hackers, security researchers, security professionals, and the momentum that we have made?

137
00:13:00,720 --> 00:13:16,900
Because there's legitimate concern, I feel, that, you know, a lot of security work, a lot of securing these types of spaces costs money, and how a lot of that money is being sucked from what would be security budgets into responding to COVID.

138
00:13:16,960 --> 00:13:22,060
And as a consequence, do people here think we're going to see a regression?

139
00:13:22,060 --> 00:13:23,600
You know, we've made 10 steps forward.

140
00:13:23,600 --> 00:13:29,460
Are we going to go five steps back because COVID really stopped it, stopped the momentum?

141
00:13:29,460 --> 00:13:31,180
Love to hear your guys' thoughts.

142
00:13:32,660 --> 00:13:35,040
So I'll start.

143
00:13:35,040 --> 00:13:36,160
Sorry, Vidya.

144
00:13:36,920 --> 00:13:39,940
I think it's broken the perimeter, right?

145
00:13:39,940 --> 00:13:44,820
It's forced us to pull up our socks, right?

146
00:13:44,820 --> 00:13:48,900
The healthcare perimeter is now no longer within your hospital.

147
00:13:48,900 --> 00:13:52,640
You have patients at varied areas and everything is different.

148
00:13:53,070 --> 00:13:58,380
But I don't necessarily think taking 10 steps back is a bad thing, right?

149
00:13:58,380 --> 00:14:05,180
This year has given us time to assess, time to view the healthcare scene, the medical device scene.

150
00:14:05,180 --> 00:14:15,120
And if anything, force us to slow down and observe and just take note of what's happening, right?

151
00:14:15,120 --> 00:14:24,400
I see hospitals crumbling up underneath a pandemic, which is something that their function is to care for patients.

152
00:14:24,440 --> 00:14:35,760
And we see that even the biggest hospitals are struggling and that perhaps we just need to take a step back and rebuild.

153
00:14:36,400 --> 00:14:42,540
Maybe 2021 could be the year that we build things better instead of trying to slap a Band-Aid on.

154
00:14:42,540 --> 00:14:45,000
We do things right and we do things better.

155
00:14:46,560 --> 00:14:48,400
From the ground up.

156
00:14:49,740 --> 00:14:53,420
Yeah, I love that notion of taking the time to rebuild.

157
00:14:53,420 --> 00:15:03,500
I mean, we've seen where healthcare facilities have already been compromised before they saw their first patient as part of trying to meet the need for COVID.

158
00:15:03,780 --> 00:15:14,140
One of the things I worry about is, in some sense, I think there's this urgency from a clinical perspective to get devices out to patients and kind of solve some of the medical problems.

159
00:15:14,400 --> 00:15:25,920
Has that resulted in these devices having security measures that were intentionally not so robustly built in from the beginning just so they could get out and treat these patients?

160
00:15:25,920 --> 00:15:27,060
And what do you do now, right?

161
00:15:27,060 --> 00:15:28,760
Can you walk that back?

162
00:15:28,760 --> 00:15:30,720
Can you say, hey, give all those devices back to us?

163
00:15:30,720 --> 00:15:32,660
We don't want to necessarily see it.

164
00:15:32,660 --> 00:15:43,560
So I think your point of needing to build from the beginning is absolutely heard, but I wonder if you're realistically able to call pause on the care that's already out there.

165
00:15:44,420 --> 00:15:45,420
I don't know.

166
00:15:45,420 --> 00:15:48,740
I mean, I always refer to it as the legacy problem, right?

167
00:15:48,760 --> 00:15:51,820
Literally, it's a sea of devices out there.

168
00:15:51,820 --> 00:15:57,540
And I mean, if you look at the number of devices out there every year, it just increases exponentially.

169
00:15:57,540 --> 00:16:00,120
I mean, the maths blows my head.

170
00:16:00,120 --> 00:16:04,280
I sat in it the other day knowing, well, how do we solve this?

171
00:16:05,020 --> 00:16:09,700
And I think one of the solutions is to do things going better forward, right?

172
00:16:09,700 --> 00:16:16,640
Is not to introduce new devices with the same flaws and the same vulnerabilities and adding to our problem.

173
00:16:16,680 --> 00:16:22,960
Because those devices, if you take an ICD, for example, can last an excess of a decade.

174
00:16:23,040 --> 00:16:32,860
If that's 600,000 devices implanted a year, lasting 10 years, it is an ocean that you're trying to boil.

175
00:16:33,540 --> 00:16:38,980
You can't necessarily say to someone, hey, I need to catheterize your device because it's got a flaw in.

176
00:16:38,980 --> 00:16:42,620
My device has got a flaw in that I'm fully aware of.

177
00:16:43,140 --> 00:16:44,840
But what are the options?

178
00:16:45,060 --> 00:16:50,240
I have to go for 10 years with this device until it's made better.

179
00:16:50,460 --> 00:16:56,320
But these devices were not built with a security as a functional requirement.

180
00:16:56,740 --> 00:16:58,520
It's a clinical requirement.

181
00:16:58,520 --> 00:17:06,580
And I think if we start shifting and start building and designing with security in mind, we can start addressing the problem forward.

182
00:17:06,580 --> 00:17:14,580
In terms of the legacy problem, I actually don't know how to boil that ocean, to be honest with you.

183
00:17:16,940 --> 00:17:19,560
Yeah, I like what everyone is saying.

184
00:17:19,560 --> 00:17:27,260
I like the idea of being able to rebuild and taking a step back to think about how we want to solve some of these problems.

185
00:17:27,260 --> 00:17:30,060
I think that in practice, it's really hard.

186
00:17:30,060 --> 00:17:47,320
Again, with the clinical, looking at the clinical perspective, like right now, we're working on trying to create a massive number of respirators and ventilators in a short period of time and make them safe and make them functional.

187
00:17:49,940 --> 00:17:55,180
If it costs more and it takes more time to add the security, it's hard to make the argument.

188
00:17:56,620 --> 00:17:57,940
What's more important?

189
00:17:57,940 --> 00:18:18,880
If people are dying and it's literally minutes, hours makes a difference between life or death and you can get one more ventilator into a room, if it took an extra two day, even day to add security, let's just say for the sake of this problem, is that worth it?

190
00:18:18,880 --> 00:18:23,520
Whose lives should we sacrifice to add the security?

191
00:18:23,520 --> 00:18:26,180
And like, it's tough.

192
00:18:26,180 --> 00:18:31,760
I don't know how we can sort of push for that and where to draw the line in practice.

193
00:18:32,080 --> 00:18:33,760
It's a bad thing.

194
00:18:34,920 --> 00:18:35,960
Sorry, Jessica.

195
00:18:36,400 --> 00:18:44,080
No, no, I was just going to say, you know, I think the way that we've certainly experienced it at FDA is we're doing things in parallel.

196
00:18:44,140 --> 00:18:56,380
So I have been very blessed in my time at FDA not to have been fully pulled into the COVID response, but I'm still 100% on cybersecurity.

197
00:18:56,380 --> 00:19:10,320
And essentially what that's allowed us to do is while, you know, a significant portion of the agency is all in on COVID and figuring out what they need to do and doing some of the things exactly what you all are saying, getting devices to patients who need them.

198
00:19:10,440 --> 00:19:16,020
We also still have a very dedicated team at FDA looking at cybersecurity.

199
00:19:16,560 --> 00:19:24,500
And another thing that I was really lucky when I came into FDA, I think everybody, you know, elementary school feels like a bajillion years ago.

200
00:19:24,500 --> 00:19:30,720
But, you know, like you'd like walked into elementary school and there's that one person there who's just like, you're like, we're going to be best friends.

201
00:19:30,720 --> 00:19:32,820
We're going to do great things together.

202
00:19:33,100 --> 00:19:38,040
For those of you who have not met Matt Hazlett, he probably is like sick of me talking about him.

203
00:19:38,040 --> 00:19:40,280
But anyway, Matt Hazlett is great.

204
00:19:40,280 --> 00:19:48,420
And he is the essentially the one of the leads at FDA for doing cybersecurity reviews of devices as they come in.

205
00:19:48,420 --> 00:20:03,380
And so at the same time that all of this is going on with COVID, what Matt and his team within the device review office at FDA have really started doing is they're getting tighter and tighter and tighter and tighter at looking at exactly what you all are saying.

206
00:20:03,380 --> 00:20:09,080
We're learning so many lessons from deployed devices about vulnerabilities that are showing up.

207
00:20:09,080 --> 00:20:16,720
We're learning so much about what manufacturers maybe aren't doing on the front end that are causing problems on the back end.

208
00:20:16,720 --> 00:20:31,820
And what Matt and his team have really been able to do is they're taking all of those things, they're taking the vulnerabilities that are showing up in post-market, they're taking the missing pieces of the process, the gaps in the process in the development of medical devices,

209
00:20:31,820 --> 00:20:42,880
and they're putting that into the pre-market review process where they're essentially saying, okay, we are learning every day how to get better at reviewing devices and they're implementing it.

210
00:20:42,880 --> 00:21:06,440
So I think while we're certainly seeing issues or there's just this very valid urgency about getting devices out where they need to be, we also still have this very robust mechanism at FDA in particular for making sure that anything that we're learning,

211
00:21:06,440 --> 00:21:11,560
anything that's coming up with regard to cybersecurity is actually making it back into our process.

212
00:21:15,590 --> 00:21:19,890
Yeah, which the one thing I would say, I think that the financial, which was the original question, right?

213
00:21:19,890 --> 00:21:23,210
What's the financial drain going to have an impact on these devices?

214
00:21:23,210 --> 00:21:25,730
I think that's exactly, there's almost a compliment there, right?

215
00:21:25,730 --> 00:21:41,970
If we can get the financial decisions to be informed by what the pre-market is telling us in terms of meeting certain security requirements and really having that be key criteria and decisions and not just, no offense to the clinicians, the clinician really likes this one brand and that's what they're going with.

216
00:21:41,970 --> 00:21:47,370
Having it be part of that core decision, I think absolutely will drive that change.

217
00:21:48,730 --> 00:21:55,710
My only decision about whether or not I use a device is how many 5G microchips I can inject into a patient.

218
00:21:56,010 --> 00:21:57,930
Wait, does it have to say AI in it?

219
00:21:58,550 --> 00:22:00,990
No, that's the blockchain version.

220
00:22:01,090 --> 00:22:02,150
That's 4G.

221
00:22:02,210 --> 00:22:03,490
This is being recorded, man.

222
00:22:03,490 --> 00:22:05,450
That is going to be clipped.

223
00:22:05,450 --> 00:22:07,170
That is going to be taken out of context.

224
00:22:07,170 --> 00:22:10,390
It's going to be viral on Twitter in the next couple of days.

225
00:22:10,810 --> 00:22:14,610
And we're going to hear about how doctors are part of the 5G conspiracy.

226
00:22:14,610 --> 00:22:17,510
So, strong work on that one.

227
00:22:18,010 --> 00:22:20,430
Yeah, well done.

228
00:22:20,670 --> 00:22:22,550
What I did want to ask, right?

229
00:22:22,550 --> 00:22:28,210
So I'm going to turn it, I want to ask Christian and Jeff a question, seeing as we're being grilled here.

230
00:22:28,690 --> 00:22:31,110
You as clinicians, right?

231
00:22:31,430 --> 00:22:35,230
When you are making a decision for your patient, right?

232
00:22:35,230 --> 00:22:39,190
You know, security versus clinical functionality.

233
00:22:39,430 --> 00:22:41,010
How do you do that balancing act?

234
00:22:41,010 --> 00:22:46,290
Because you guys are unfortunate as physicians to have your feet on both walls.

235
00:22:46,370 --> 00:22:49,170
So from your perspective, how do you balance it out?

236
00:22:49,170 --> 00:22:52,450
How do you work it out in your mind?

237
00:22:52,450 --> 00:22:57,470
Because for us, it is security first and foremost and patient care.

238
00:22:57,470 --> 00:23:00,010
But we almost move from a security perspective.

239
00:23:00,010 --> 00:23:01,330
I've been a patient.

240
00:23:01,330 --> 00:23:02,850
I've seen that side.

241
00:23:02,850 --> 00:23:08,290
But I'm quite keen to hear from your side what your perspective on it is.

242
00:23:09,250 --> 00:23:11,430
Yeah, that's a great question.

243
00:23:11,470 --> 00:23:21,830
And I think that COVID is really starkly forcing us to understand and choose between some of these seemingly opposite goals.

244
00:23:21,830 --> 00:23:28,010
In medicine, we frequently have to weigh multiple different pros cons for any particular treatment or situation.

245
00:23:28,010 --> 00:23:33,450
A patient may need anesthesia for a procedure, but they're also very tenuous from a cardiovascular standpoint.

246
00:23:33,450 --> 00:23:36,970
So what's more dangerous, not getting the procedure or putting them under anesthesia?

247
00:23:36,970 --> 00:23:41,950
And so oftentimes you have to say, well, we need to take both into account simultaneously.

248
00:23:42,110 --> 00:23:48,750
And the points that we've made about the necessity and the urgency of the situation are absolutely correct.

249
00:23:48,750 --> 00:23:55,630
When we're in the ICU or in the OR, dealing with these patients, security is not at the forefront of our mind.

250
00:23:55,630 --> 00:24:00,590
What technology do we need to achieve the physiologic goals we have for that particular patient?

251
00:24:00,610 --> 00:24:11,830
When we go home and we talk to people like you, and we're able to put it on our hacker and security researcher hat, obviously we start to be able to understand and conceptualize the consequences of some of the downstream effects.

252
00:24:11,830 --> 00:24:15,390
So it is a complete balancing act 100% of the time.

253
00:24:15,390 --> 00:24:19,770
Anybody who tells you they have a perfect formula for that answer is lying to you.

254
00:24:19,770 --> 00:24:30,270
The thing that's been somewhat reassuring to me is we have had conversations with people that we work with in our hospitals and elsewhere, where they understand that you kind of have to shoot for both.

255
00:24:30,350 --> 00:24:39,750
And in some of our institutions, I've had people say from the disaster and emergency management side of things, hey, we're gaming out the COVID response and going on that right now.

256
00:24:39,750 --> 00:24:47,370
But we want to fold a security information infrastructure exercise into that as well.

257
00:24:47,370 --> 00:25:10,250
Understanding that some of these events, whether it's UCSF and the ransomware issue, or some of the hospitals in the Czech Republic who have been hit during this period, the underlying assumption that people are now realizing is that you need a stable infrastructure and good devices to be able to treat patients and have the best outcomes in a crisis situation like this.

258
00:25:10,250 --> 00:25:15,030
So deficiencies on the security side only hinder your ability to achieve your main mission.

259
00:25:15,030 --> 00:25:18,770
And so it's less of then a shunting of resources from one to the other.

260
00:25:18,770 --> 00:25:22,350
And then how can we maximally benefit both of those aspects?

261
00:25:22,550 --> 00:25:26,570
Which is never perfect, but it's a better way of thinking about it than a trade-off.

262
00:25:27,610 --> 00:25:29,270
Yeah, I just completely echo that.

263
00:25:29,270 --> 00:25:39,770
Like one of my nightmare scenarios is treating a hospital full of COVID patients where the ICUs are overflowing and then getting hit with ransomware, for example.

264
00:25:39,770 --> 00:25:58,990
So what little bandwidth we have left to handle the surge, to treat the patients as best we can, goes out the window when the digital tools we use, whether or not it's the electronic health record or connected medical devices or all of the above, would be impacted by an attack.

265
00:25:58,990 --> 00:26:04,730
And so it's not just maybe a little bit of impact to patient care.

266
00:26:04,730 --> 00:26:06,770
It's going to be huge.

267
00:26:06,770 --> 00:26:14,610
And one of the things we all like to talk about, and I think we all know in this space, is just how dependent doctors are on connected medical technology.

268
00:26:14,610 --> 00:26:20,950
Doctors, nurses, technicians, modern healthcare is exceptionally connected, hyper-connected, if you will.

269
00:26:21,130 --> 00:26:30,330
And a lot of doctors, you've heard us say this many times, Jeff and myself included, we haven't worked on paper charts.

270
00:26:30,870 --> 00:26:38,650
We've never had light boxes where we pull up a CT scan that's printed on something and put it up against a wall to read it.

271
00:26:38,650 --> 00:26:43,250
We've always accessed those through workstations and PAC system software.

272
00:26:43,350 --> 00:26:57,910
So you take what we're trained on, this digital infrastructure, this connected, vulnerable infrastructure, and you add a pandemic on top of it, and then you take away the tools that we're used to using, undoubtedly patients would suffer.

273
00:26:57,910 --> 00:27:00,650
So that one-two punch is definitely something very concerning.

274
00:27:00,650 --> 00:27:17,370
To the heart of your question, which is how do we as clinicians make that trade-off or decision about, here's a more secure device, but it has less clinical utility or functionality compared to this more secure device, etc.

275
00:27:17,370 --> 00:27:18,630
So how do we make that trade-off?

276
00:27:18,630 --> 00:27:27,210
Honestly, looking straight into the camera, it's really hard to even have any bearing on that decision.

277
00:27:27,210 --> 00:27:32,270
So a lot of the devices that we use every day in clinical practice, we don't choose.

278
00:27:32,590 --> 00:27:41,030
We show up to the hospital and there are monitors that are there because they made that purchasing decision five, ten years ago.

279
00:27:41,030 --> 00:27:51,970
When you train to become a doctor, you may train for four or five years on a particular set of medical devices that you're going to implant, a particular brand.

280
00:27:51,970 --> 00:27:54,070
You become familiar with that.

281
00:27:54,070 --> 00:27:56,170
And so what do you do when you get out of practice?

282
00:27:56,170 --> 00:27:58,230
You use the exact same one.

283
00:27:58,270 --> 00:28:13,070
And so, believe it or not, there's much less time to reflect and much less ability than most people believe for us to pick which devices we use in clinical practice and to make that decision.

284
00:28:13,110 --> 00:28:17,990
With that being said, we're trying to educate other doctors on this.

285
00:28:17,990 --> 00:28:21,670
And when we do, like Jeff mentioned, they care.

286
00:28:21,670 --> 00:28:23,370
They want their patients to be safer.

287
00:28:23,370 --> 00:28:25,210
They want to use secure medical devices.

288
00:28:25,210 --> 00:28:29,170
They don't want their patient's health information or even their health to be at risk.

289
00:28:29,170 --> 00:28:32,910
So we have sympathetic ears from the clinicians.

290
00:28:32,930 --> 00:28:37,010
We just lack the ability to make it easy for them.

291
00:28:37,010 --> 00:28:48,330
What you don't want is your doctor to have to go to, you know, 14 years to train to be a doctor and then go and have to take another year or two of cybersecurity coursework or whatever to become competent.

292
00:28:48,330 --> 00:28:58,190
You really have to make it easy for them to make the right decision and convince them that they should tell other people in their hospital and other doctors that it's important.

293
00:28:59,110 --> 00:29:07,550
I think to that point, that's maybe a misperception that the expectation is that everyone in this supply chain has to become a cybersecurity expert.

294
00:29:07,550 --> 00:29:21,790
I think maybe that's a fatal flaw in how we think about solving this is if we need to sufficiently educate individuals by having them... you're not a medical device practitioner but hey, I can teach you all about cybersecurity here.

295
00:29:22,110 --> 00:29:27,650
It's really hard to think that you can sufficiently educate folks that this isn't their core competency on.

296
00:29:27,650 --> 00:29:31,390
Not to say they can't have some level of understanding what the impact is.

297
00:29:31,390 --> 00:29:37,570
And I think making it tangible for their work stream or function or whatever the case may be is the perfect way to do that.

298
00:29:37,570 --> 00:29:48,670
But I would love to hear kind of the thought around how we think about leveraging those who are experts and not necessarily trying to solve it ourselves and going at it alone.

299
00:29:48,670 --> 00:29:57,510
Because I think that's probably a fatal flaw and has caused some of the historical challenge that you're talking about when you inherit a hospital full of devices that you didn't pick.

300
00:29:58,490 --> 00:30:12,490
And surely as well, like Jeff was saying, normally physicians are used to sort of having to balance different pros and cons and different requirements to make the best medical choice for each patient.

301
00:30:13,070 --> 00:30:18,730
But I think historically, maybe they weren't even aware that this is one of the things they need to consider.

302
00:30:18,730 --> 00:30:27,630
So even just how can we raise awareness and just in the consciousness that, oh, that's something that I need to consider even if I'm not an expert.

303
00:30:27,630 --> 00:30:34,170
Maybe I can have an expert on hand or I can read a rating for a device and make a decision somehow that way.

304
00:30:34,310 --> 00:30:38,330
You know, what kind of solutions are there moving forward in that direction?

305
00:30:39,890 --> 00:30:49,810
So I've actually spent some time working a lot with the cardiologists and their technicians in South Africa trying to just have the discussion.

306
00:30:49,810 --> 00:30:55,610
And I had a phone call from my cardiologist saying, we've had a recall of devices.

307
00:30:55,850 --> 00:31:01,170
I need to explant a device, but I don't know how to explain it to my patient.

308
00:31:01,170 --> 00:31:06,330
I don't even sufficiently understand the engineering tool on the document.

309
00:31:06,330 --> 00:31:07,870
Can you translate?

310
00:31:08,070 --> 00:31:19,830
So I think the big thing is we are using our language, our linguistics, instead of making it familiar to the medical practitioners.

311
00:31:19,830 --> 00:31:24,310
And I think there should be that portion in the hospital that does that translation.

312
00:31:24,730 --> 00:31:33,150
Because I can tell you that was a very difficult conversation having with a 65-year-old lady that doesn't understand technology.

313
00:31:33,250 --> 00:31:40,650
I mean, the doctor didn't even sufficiently understand why he had to explant the device that was just being recalled.

314
00:31:42,290 --> 00:31:47,210
And that's the unfortunate thing is they are expected to make these decisions.

315
00:31:47,210 --> 00:31:50,430
And as he says, he has a patient coming in.

316
00:31:50,430 --> 00:31:52,790
His blood pressure is high.

317
00:31:52,790 --> 00:31:55,590
He needs to adjust the ICD and the pacemaker.

318
00:31:55,690 --> 00:32:01,310
What he doesn't tell him is that his wife cooked a high-sodium meal which affected his blood pressure.

319
00:32:01,310 --> 00:32:04,230
And a week later, he comes back because he's having issues.

320
00:32:05,930 --> 00:32:08,290
Therapy has changed significantly.

321
00:32:08,290 --> 00:32:14,350
So those are the challenges they deal with having to solve the clinical puzzles.

322
00:32:14,430 --> 00:32:24,730
And I think adding the technical stuff on top of it especially using terminology they don't understand is where we've been going wrong.

323
00:32:25,070 --> 00:32:28,970
We should be finding ways to translate it better for them.

324
00:32:29,670 --> 00:32:40,050
I think that's a failure overall of how we've designed not only medical devices, but how we do cybersecurity overall.

325
00:32:40,050 --> 00:32:44,810
So many times if somebody gets hacked or whatever, it's their fault.

326
00:32:44,810 --> 00:32:56,350
Setting aside corporations who get DDoSed or whatever and claim to have been a victim of a sophisticated cyber attack, there are times when people get hit by something and it really wasn't their fault.

327
00:32:56,350 --> 00:33:00,150
There were so many different things that have been expected to know.

328
00:33:00,570 --> 00:33:05,830
And I think something a professor once said to me stuck with me.

329
00:33:05,830 --> 00:33:09,210
We were talking about this whole thing about people are just so dumb about cyber.

330
00:33:09,210 --> 00:33:10,830
Why can't they just be better?

331
00:33:10,850 --> 00:33:16,670
He's like, yeah, and all those people who are driving Ford Pintas, what the hell were they thinking letting their cars blow up?

332
00:33:18,190 --> 00:33:27,770
And I think that that's kind of the way that was sort of a lightbulb moment for me of being like, oh, we have to design devices that don't blow up in people's faces.

333
00:33:28,110 --> 00:33:34,330
We have to make it as easy as humanly possible to do something securely.

334
00:33:34,330 --> 00:33:37,490
Doing something securely needs to be the easiest thing.

335
00:33:37,490 --> 00:33:43,770
And if doing something securely is the most difficult thing, that's not the fault of the user who then didn't do the secure thing.

336
00:33:43,770 --> 00:33:47,490
That is the fault of the designer who made the device poorly.

337
00:33:47,670 --> 00:33:56,610
And so I think we've gotten away with, frankly, in a lot of cases , being really lazy and offloading the responsibility onto other people.

338
00:33:56,610 --> 00:34:09,630
And I think what we have to do, especially within the healthcare sector, is all parts of it we have to sort of reclaim the responsibility that has been ours all along and actually really do what we need to do.

339
00:34:10,570 --> 00:34:18,010
Yeah, I mean, the responsibility, I'm very big, the responsibility to build these things better is the manufacturers.

340
00:34:18,170 --> 00:34:18,790
Right?

341
00:34:18,790 --> 00:34:23,070
They're the ones that have the control over the firmware and the hardware.

342
00:34:23,070 --> 00:34:30,790
We shouldn't be pointing the finger at the hospital saying, hey, your device your network got hacked because you have vulnerable devices.

343
00:34:30,910 --> 00:34:33,770
Well, those should have been built better.

344
00:34:34,930 --> 00:34:35,490
Right ?

345
00:34:35,650 --> 00:34:39,690
Because now we're leading, we're in the industry now where we're putting Band-Aids on.

346
00:34:39,690 --> 00:34:39,930
Right?

347
00:34:39,930 --> 00:34:41,390
The vulnerability is disclosed.

348
00:34:41,390 --> 00:34:45,150
Now we have to run and we're always on the back foot fixing stuff.

349
00:34:45,250 --> 00:34:51,330
But the manufacturers should be stepping up and should be doing a better job at this.

350
00:34:51,490 --> 00:34:52,950
I completely agree.

351
00:34:54,510 --> 00:34:55,850
I completely agree.

352
00:34:55,850 --> 00:35:03,370
There's a lot that the device manufacturers can do, should do, and I think some of them have been doing.

353
00:35:03,630 --> 00:35:06,130
But there's also a key important thing.

354
00:35:06,130 --> 00:35:08,950
They can't control it once it's deployed.

355
00:35:08,990 --> 00:35:26,850
So if they're deploying a somewhat secure medical device on an unsecured network, or if they're turning off security controls for sake of ease of integrating into their clinical environment , or if they're not patching critical systems around these medical devices,

356
00:35:26,850 --> 00:35:42,890
there's some shared responsibility there, and I think that's really important, is that we need to be having not only a strong conversation with device manufacturers, they do the right thing from the start, but we need to be able to be giving hospitals the appropriate resources,

357
00:35:42,890 --> 00:35:47,470
education, and holding them accountable when there's something egregious.

358
00:35:47,470 --> 00:35:54,670
Now, I don't think they should be asked to solve the issues of insecure medical devices because they just can't.

359
00:35:54,670 --> 00:36:07,010
But we've seen time and time again some pretty horrible security practices by healthcare institutions that have nothing to do with medical device manufacturers, but yet still could have patient safety implications.

360
00:36:07,010 --> 00:36:18,350
Things like all the denial of service attacks we see, the ransomware attacks, the theft, I mean, it's not just critical healthcare infrastructure like hospitals, we've been seeing attacks on research.

361
00:36:18,350 --> 00:36:33,490
So I'm sure people have seen in the news, and I think Jeff mentioned, ransomware attacks on critical medical research infrastructure, state-sponsored attacks on COVID research and vaccine trials data.

362
00:36:33,490 --> 00:36:36,690
So we have to have a shared responsibility.

363
00:36:36,690 --> 00:36:37,970
This is a whole ecosystem .

364
00:36:37,970 --> 00:36:42,150
It's really trying to figure out what's the best bang for our buck .

365
00:36:42,150 --> 00:36:55,470
And I feel like a lot of the conversations focus around medical devices because it's a much easier thing to tackle than trying to go to a rural access hospital in South Dakota and fixing their broken network.

366
00:36:55,470 --> 00:37:06,050
And then being able to monitor that and continually say, how are you going to secure every hospital and clinic and doctor's office in the entire United States?

367
00:37:06,050 --> 00:37:08,730
That's a much harder problem.

368
00:37:08,850 --> 00:37:11,750
But I...

369
00:37:11,750 --> 00:37:13,630
Can I go?

370
00:37:14,710 --> 00:37:15,810
Oh, that's it.

371
00:37:15,810 --> 00:37:17,230
I'd like to...

372
00:37:17,910 --> 00:37:19,030
Sorry.

373
00:37:19,350 --> 00:37:23,510
I just wanted to say, right, it's not just a United States problem, right?

374
00:37:23,510 --> 00:37:25,910
It's a global problem.

375
00:37:26,050 --> 00:37:32,170
You know, hate to be the one to point it, but this is a big problem everywhere.

376
00:37:32,170 --> 00:37:35,090
And I know everyone on here is from the US.

377
00:37:35,090 --> 00:37:37,110
I'm the only oddball after this.

378
00:37:37,110 --> 00:37:38,270
I'm from Canada.

379
00:37:39,650 --> 00:37:41,870
I don't feel so alone.

380
00:37:41,970 --> 00:37:46,710
But the thing is just every hospital is different, right?

381
00:37:46,990 --> 00:37:50,590
There's no cookie cutter way of looking at the problem.

382
00:37:50,770 --> 00:37:53,010
Every hospital network is different.

383
00:37:53,010 --> 00:37:57,270
And I think sometimes what we forget is the patient record systems.

384
00:37:57,270 --> 00:37:59,970
Like, I never used to consider it.

385
00:37:59,970 --> 00:38:05,390
But then I sat back and thought from the cyber criminal perspective, it is the ultimate identity thing.

386
00:38:05,390 --> 00:38:08,350
It's the thing that you can keep selling constantly.

387
00:38:08,390 --> 00:38:11,450
And it's often the thing that's least protected.

388
00:38:11,570 --> 00:38:17,070
Because we're focusing so much on medical devices, we've forgotten what a treasure trove that holds.

389
00:38:17,330 --> 00:38:19,430
And I mean, that's moving to the cloud.

390
00:38:20,210 --> 00:38:29,410
So, you know, Microsoft is one of the big proponents that's moving everything now to the cloud in terms of patient records and clinical systems.

391
00:38:29,770 --> 00:38:43,290
So I'd be interested to see how the smaller hospitals are actually going to be able to cope with having to do you know, perimeterless defenses, you know, zero trust networks, or even cloud solutions.

392
00:38:43,770 --> 00:38:48,410
Because I think the big hospitals like Mayo might be fine.

393
00:38:48,430 --> 00:38:55,830
But you have the smaller rural hospitals that I don't even know if they have IT or security on the premises.

394
00:38:55,930 --> 00:38:59,890
Or whether they're paying someone, a third party, to do the solution for them.

395
00:39:01,390 --> 00:39:02,990
Yeah, I'd like...

396
00:39:02,990 --> 00:39:03,670
Go ahead.

397
00:39:03,670 --> 00:39:04,410
You go first.

398
00:39:04,410 --> 00:39:04,950
Okay.

399
00:39:04,950 --> 00:39:08,690
I wanted to go back to the topic of responsibility.

400
00:39:09,530 --> 00:39:12,570
And I would have to echo with Christian.

401
00:39:12,570 --> 00:39:13,430
I think the...

402
00:39:13,430 --> 00:39:15,610
I think it is a shared responsibility.

403
00:39:15,670 --> 00:39:19,530
Obviously, I think that, you know, I work for a medical device manufacturer.

404
00:39:19,530 --> 00:39:22,070
I'm a software... an embedded software engineer.

405
00:39:22,390 --> 00:39:23,990
I think about these things.

406
00:39:23,990 --> 00:39:31,390
I want to make sure that I'm doing my part to build really secure and awesome, safe products for end users.

407
00:39:31,390 --> 00:39:32,810
I care a lot about that.

408
00:39:33,490 --> 00:39:38,730
But I think it's easy to blame manufacturers, and it's often more complicated.

409
00:39:38,730 --> 00:39:40,190
Again, it's this balancing act.

410
00:39:40,190 --> 00:39:44,410
So, I work for a medical device manufacturer that's a consulting firm.

411
00:39:44,410 --> 00:39:46,730
So we don't have any of our own in -house products.

412
00:39:46,730 --> 00:39:57,210
We have people who come to us, and we have clients, and you know, some of them are business people, and some of them are other medical device manufacturers that subcontract to us.

413
00:39:57,210 --> 00:40:04,210
But we have a lot of people who are just doctors , and clinicians, and other people who are really passionate about saving lives.

414
00:40:04,210 --> 00:40:06,670
And they come to us, and they're like, we have this idea.

415
00:40:07,370 --> 00:40:09,150
We see this gap.

416
00:40:09,450 --> 00:40:11,570
We desperately want to help our patients.

417
00:40:11,610 --> 00:40:13,090
Please help us build this.

418
00:40:13,090 --> 00:40:14,990
We have this tiny, tiny budget.

419
00:40:15,010 --> 00:40:21,530
We only have this amount of time to do it in because we got this little budget from these people, but they say we have to get it done by this time.

420
00:40:21,530 --> 00:40:33,170
And we were working really, really hard to try to meet all these deadlines and actually make this little device that, you know, if we can give it to those doctors, it might save lives.

421
00:40:33,450 --> 00:40:43,830
And then for, you know, for us to come in and try to say, like, oh, we have to add all of these security things, and, you know, maybe it's going to affect the budget.

422
00:40:43,830 --> 00:40:45,070
It's going to affect the timeline.

423
00:40:45,070 --> 00:40:47,610
And, you know, again, I care about these things.

424
00:40:47,610 --> 00:40:48,390
I'm in there.

425
00:40:48,390 --> 00:40:49,850
I'm advocating for this stuff.

426
00:40:49,850 --> 00:40:55,830
But it's hard to say, you know, if you only have this much budget, and it's...

427
00:40:55,830 --> 00:40:56,790
how do you choose?

428
00:40:56,790 --> 00:40:59,510
How do you tell them, okay, you shouldn't...

429
00:40:59,510 --> 00:41:04,510
we just aren't going to be able to make this and implement this part of security, like, where to draw the line.

430
00:41:04,510 --> 00:41:05,250
I think it's...

431
00:41:05,250 --> 00:41:10,750
I think it's more complicated and harder, like, in practice.

432
00:41:11,070 --> 00:41:18,890
And it's hard to just say, well, the medical device manufacturer should just do it.

433
00:41:19,830 --> 00:41:21,670
You know, how do you make that choice?

434
00:41:23,330 --> 00:41:25,510
I actually want to add to that story.

435
00:41:25,510 --> 00:41:27,490
So I started working with Medtronic.

436
00:41:27,490 --> 00:41:28,930
And I'm a hard ass.

437
00:41:28,930 --> 00:41:32,790
Everyone knows that I say a bunch of things three years ago.

438
00:41:32,790 --> 00:41:39,730
Cool came out because I was unhappy with how our conversation went, because we had a legal situation.

439
00:41:39,730 --> 00:41:51,190
And I started the first six months of my project listening and getting to know the developers and the software , firmware engineers and the hardware engineers.

440
00:41:51,510 --> 00:41:58,670
And I sat back and listened and realized that these are real people that are wanting to make a real difference.

441
00:41:58,670 --> 00:42:00,010
Really, they are.

442
00:42:00,650 --> 00:42:08,970
And one of the specific engineers, Rob Maslow, had a big impact on my life because he said to me, he said, tell me what you want on your device.

443
00:42:08,970 --> 00:42:11,170
Tell me all the security you want.

444
00:42:11,350 --> 00:42:14,250
Get to the list to me and let's discuss this.

445
00:42:14,350 --> 00:42:19,110
And he turned around and said to me, well, so you're getting a new device every three years, right?

446
00:42:19,250 --> 00:42:23,290
And I said to him, well, no, there's no fucking way that I'm doing that to myself.

447
00:42:23,290 --> 00:42:26,450
And he's like, well, then you can't have all of that.

448
00:42:26,450 --> 00:42:29,370
He says there's trade-offs for everything.

449
00:42:29,470 --> 00:42:38,990
So, specifically with embedded implanted devices, the more security you add, the less lifetime you'll have on your battery.

450
00:42:39,230 --> 00:42:48,250
Because I can tell you the one thing that is worth gold is how long your device lasts because it is a horrible thing to cut out.

451
00:42:48,250 --> 00:42:57,690
And I don't know if you guys know, but the more you cut it out, the more scar tissue forms, and the worse it gets, right?

452
00:42:57,950 --> 00:43:00,410
I've had my device since 19.

453
00:43:00,410 --> 00:43:02,090
I wouldn't be here without it.

454
00:43:02,090 --> 00:43:05,350
So, people building these things, I would be dead.

455
00:43:05,350 --> 00:43:06,750
I had two weeks left to live.

456
00:43:06,750 --> 00:43:09,350
That was the serious situation.

457
00:43:10,210 --> 00:43:17,290
So, I think sometimes we want all the security in the world, but we don't realize there's trade-offs.

458
00:43:17,890 --> 00:43:21,050
These devices are there to save lives.

459
00:43:21,050 --> 00:43:29,910
And if we try and push security too much, there's a whole lot of set of devices that will never come to market and they will never save lives.

460
00:43:29,910 --> 00:43:42,950
And that's one big lesson that I had to learn and I had to have humble pie and I had to swallow my words and realize that you know, there's people behind this wanting to make a difference with technology and science.

461
00:43:42,950 --> 00:43:47,270
And without that device, I wouldn't be here.

462
00:43:47,790 --> 00:43:49,710
I wouldn't have my kids.

463
00:43:50,650 --> 00:43:53,230
So, technology does save lives in ways.

464
00:43:53,310 --> 00:43:57,810
We must just find the perfect balance to balance everything out.

465
00:43:58,270 --> 00:44:13,230
And your perspective Vee, and folks like you, like Marie Mo, who have these incredible security backgrounds, but also our patients is so incredibly valuable to be able to consider these types of trade-offs in like a human person, right?

466
00:44:13,230 --> 00:44:14,810
In like a very real way.

467
00:44:14,810 --> 00:44:24,470
And one of the things that Christian and I are working on is how do we understand the role of the patient as a stakeholder in these types of conversations?

468
00:44:26,010 --> 00:44:34,170
And is there a utility in having those types of conversations with this 60 -year-old man who needs to get his pacemaker revised ?

469
00:44:34,170 --> 00:44:41,870
Or is there a trade -off between the potential risk of a vulnerability being exploited and then putting him through that process of having it revised?

470
00:44:41,870 --> 00:44:54,690
And I think it highlights one of the things that Christian and I are so interested in is just developing a data and a science around this to be able to say in other types of medical therapies, we have very clear risks.

471
00:44:54,690 --> 00:45:04,310
You know, if I give you a blood transfusion, there's about a 1 in 1 .5 to 2 million chance that you might have an infection that's serious as a result of that or heart or lung issues.

472
00:45:04,330 --> 00:45:18,690
We really don't have the ability to have conversations with patients and say, this is the clear-cut risk because thankfully we haven't seen many incidents of issues and that doesn't mean that there's an absence of risk, but it makes it harder for us to have discussions with patients and say,

473
00:45:18,690 --> 00:45:24,610
really, this is the type of math that you have to weigh as a patient with your own values and preferences and things like that.

474
00:45:24,610 --> 00:45:36,290
And we've kind of done some work on touching on this idea of a cybersecurity informed consent to say, we talk about risks, you know, medical risks of surgeries and medications and things like that that they may be on.

475
00:45:36,290 --> 00:45:43,390
Should we start thinking about cybersecurity as a potential risk that should be included in this conversation a clinician has with a patient?

476
00:45:44,650 --> 00:45:54,010
And Jessica, I know the FDA is also really interested in this and you've had a lot of really cool outreach types of events to be able to talk to people like V.

477
00:45:54,010 --> 00:46:06,190
And I think it's that challenge of moving beyond people who are security literate to people who may not have heard about these issues whatsoever for as much as we talk about them and to be able to kind of have that enter the conversation so that they can,

478
00:46:06,190 --> 00:46:11,350
without having a background in cybersecurity, weigh that as part of their clinical process.

479
00:46:12,370 --> 00:46:16,110
Yeah, I mean, I think that there's a couple things that I would bring up on this.

480
00:46:16,110 --> 00:46:30,230
I mean, like, I think one, you know, you had mentioned that FDA has been doing a lot of this and I think V, you were actually at the October 2019 meeting that we had the patient engagement advisory council meeting, the peak meeting.

481
00:46:30,730 --> 00:46:37,410
And so FDA is very much trying to make sure that the patient perspective is heard.

482
00:46:38,230 --> 00:46:41,850
And it's not just yearly meetings and things like that.

483
00:46:41,850 --> 00:46:44,150
As many of you know, Suzanne Schwartz is very approachable.

484
00:46:44,150 --> 00:46:49,270
You can pretty much get her email and email her and she'll find time to talk to you.

485
00:46:50,770 --> 00:47:07,850
So that is a really critical part of this because, not that all of you are going around reading government white papers and things, but a couple of years ago, the FDA put out this medical device safety action plan and sort of setting aside the flowery language that all government documents,

486
00:47:07,850 --> 00:47:10,850
I think, were like decreed that they must use.

487
00:47:11,250 --> 00:47:21,650
Essentially what it says is look, it's exactly this issue of balancing the idea that patient safety is a two-fold concern.

488
00:47:21,650 --> 00:47:21,830
Right?

489
00:47:21,870 --> 00:47:25,950
There's the concern that we all typically think about on cybersecurity.

490
00:47:25,950 --> 00:47:32,170
Is this device safe and effective enough to justify its use with the patient?

491
00:47:32,470 --> 00:47:41,390
There's also the flip side of that, though, of what Ash was talking about and what V was talking about in that what happens if the patient can't get the device?

492
00:47:41,390 --> 00:47:45,150
That is another... that's got to be a thing that gets considered, too.

493
00:47:45,310 --> 00:47:47,450
And so, you know, FDA...

494
00:47:47,450 --> 00:47:54,570
when we talk about cybersecurity, when we usually do it, we're very explicitly talking about, do you have security controls?

495
00:47:54,570 --> 00:47:58,810
Do you have sufficient whatever to make sure that the device is cybersecure?

496
00:47:58,810 --> 00:48:11,690
But a less talked about part of the work, but that is equally important, is this idea that we recognize that sometimes devices need to get to patients because of the benefit that they're going to be able to provide.

497
00:48:11,690 --> 00:48:14,070
And maybe we don't have as much information.

498
00:48:14,070 --> 00:48:19,710
Maybe we don't have as much assurance of the things that we would like to.

499
00:48:19,710 --> 00:48:21,790
But, you know, this is the Breakthrough Device Program.

500
00:48:21,790 --> 00:48:29,670
This is some of these other investigational devices that come up and that FDA has specific categories for and authorities for things that you can do this.

501
00:48:29,670 --> 00:48:42,370
And it's exactly this recognition that the other folks on the panel are pointing out, which is that, in some cases, not having access to a device can be as big of a risk as having access to a device that isn't secure enough.

502
00:48:42,410 --> 00:48:54,970
And so, you know, I think that it is just an important point to highlight and, you know, that we as an agency keep in mind, but that this community, in addition, also keeps in mind as we have these kinds of conversations.

503
00:48:57,570 --> 00:48:59,350
All right, I want to change this.

504
00:48:59,350 --> 00:49:00,630
Oh, can I...

505
00:49:00,630 --> 00:49:10,070
I'm going to change the subject real quick because I heard a rumor there are thousands of hackers watching this stream right now.

506
00:49:10,070 --> 00:49:20,310
There are literally thousands of hackers from across the globe watching, you know, very interested in what we're talking about.

507
00:49:20,310 --> 00:49:26,330
And I'm sure they're thinking to themselves, wow, there are a lot of issues here I might not have been aware of anymore and they want to get involved.

508
00:49:26,330 --> 00:49:39,730
So, hackers out there wanting to get involved in this space, you know, how does... we've heard some examples, you know, there's been a group of hackers that have tried to defend hospitals against attackers during COVID.

509
00:49:39,870 --> 00:49:46,050
There are hackers printing protective equipment for doctors on the front line, etc., nurses.

510
00:49:46,530 --> 00:49:48,850
But , like, what's the next generation of this, right?

511
00:49:48,850 --> 00:49:53,330
Like, when the pandemic's done, how do hackers play a role in this space?

512
00:49:53,810 --> 00:49:56,510
Continuing doing research, is it bug bounties?

513
00:49:56,510 --> 00:49:58,910
You know, should a hospital have a bug bounty?

514
00:49:58,910 --> 00:50:01,390
Should a device manufacturer have a bug bounty?

515
00:50:01,450 --> 00:50:03,330
How does HIPAA play into that?

516
00:50:03,330 --> 00:50:06,630
You know, the protection of patient information.

517
00:50:06,850 --> 00:50:10,950
How do we really kind of bring hackers more into this space?

518
00:50:16,330 --> 00:50:18,510
Okay, I'm going to jump in, yeah.

519
00:50:19,550 --> 00:50:23,310
I have a dream and I have a dream with a friend of mine, you know.

520
00:50:23,670 --> 00:50:29,730
We want to establish a laboratory setup with devices , right?

521
00:50:29,990 --> 00:50:42,190
That people can actually do research on, that we can put on networks, that we can scan for vulnerabilities, that we can reverse engineer, that we can work with manufacturers to make better.

522
00:50:42,950 --> 00:50:47,150
I always see people wanting to break things, right ?

523
00:50:47,150 --> 00:50:55,330
We want to find flaws, we want to find problems, but often we don't want to find the solution to the problem, because that's the harder part.

524
00:50:56,050 --> 00:51:05,590
So I want to say that if you find a device that's vulnerable, first remember they are human lives at stake, okay?

525
00:51:05,590 --> 00:51:07,570
This is not an ego thing.

526
00:51:07,570 --> 00:51:10,850
Try and find the solution to the problem that you found.

527
00:51:11,110 --> 00:51:14,110
Write it up as you would any scientific paper.

528
00:51:14,110 --> 00:51:24,130
I know it's hard work, I know it's not glorious and it's not sexy, but when you hand that over to the manufacturer, they have all the data.

529
00:51:24,130 --> 00:51:30,430
And the more data they have, the faster that they can verify the claim, they can start acting accordingly.

530
00:51:31,110 --> 00:51:31,610
Right?

531
00:51:31,610 --> 00:51:32,730
It's not going to be easy.

532
00:51:32,730 --> 00:51:37,230
Not all MDMs are going to want to be friendly, but it is changing.

533
00:51:37,230 --> 00:51:45,890
But the biggest thing is the more thorough your research is, the less dispute there can be, and the more we can find a way to fixing it.

534
00:51:45,890 --> 00:51:54,050
But it's not all about just bug bounties, because I think that for me creates a negative thing of we're just finding the problems.

535
00:51:54,290 --> 00:51:57,670
We should be finding problems and then solving them.

536
00:51:57,870 --> 00:51:59,870
That's the hacker mindset.

537
00:52:00,210 --> 00:52:04,390
It's not just about pointing fingers and saying, this is a problem.

538
00:52:04,450 --> 00:52:06,450
We should be working at the solution.

539
00:52:06,450 --> 00:52:09,290
We should be finding new ways of doing things.

540
00:52:09,390 --> 00:52:15,930
So I want to see a lab filled with medical devices that hackers can pull apart and we can build solutions.

541
00:52:15,930 --> 00:52:20,050
But not only hackers, you need people like Ash, right?

542
00:52:20,530 --> 00:52:26,150
Because, I mean, we're good at the other side of it, but I can't build these devices.

543
00:52:26,150 --> 00:52:28,070
I wouldn't even know where to start.

544
00:52:28,270 --> 00:52:31,630
So I think it needs to be a multidisciplinary approach.

545
00:52:32,550 --> 00:52:38,930
And even people like the FDA, you know, should be involved in it from a policy perspective.

546
00:52:39,130 --> 00:52:42,170
And you know, everyone should just be working together.

547
00:52:42,170 --> 00:52:47,890
We should be building the bridges towards having synergy and having a space where we can explore this.

548
00:52:47,890 --> 00:52:52,250
And I think Biohack is awesome for that, because they already do a lot of that.

549
00:52:54,720 --> 00:52:58,860
Sorry, I'm going to excuse my cat, who just really desperately jumped into my lap.

550
00:52:58,860 --> 00:53:01,260
I was trying to prevent it and failed.

551
00:53:01,720 --> 00:53:04,320
He just scaled the side of the chair.

552
00:53:04,660 --> 00:53:06,740
Welcome addition to the panel.

553
00:53:08,320 --> 00:53:15,880
So I love the notion of being part of the solution, and I think to your point, it does require multiple voices.

554
00:53:15,880 --> 00:53:18,260
You hit on a point that I think is really important, right?

555
00:53:18,260 --> 00:53:25,920
You, as someone who does a lot of security research, is not totally in the space of how do I build a medical device?

556
00:53:25,920 --> 00:53:33,240
I think we similarly need to not have the expectation of the people building medical devices to know how to solve some of these cybersecurity issues.

557
00:53:33,240 --> 00:53:48,460
So I think having the willingness to partner and really helping them not make cybersecurity their number two core capability, and instead offering them solutions, is absolutely critical and the way to make things actually stick.

558
00:53:48,840 --> 00:53:51,560
So should we have solution bounties then?

559
00:53:52,400 --> 00:53:53,280
Yes!

560
00:53:53,600 --> 00:53:55,820
You should trademark that.

561
00:53:57,220 --> 00:54:00,440
But I just want to bring up just a scenario.

562
00:54:00,440 --> 00:54:02,140
So it's not just for medical devices.

563
00:54:02,140 --> 00:54:04,860
You have a medical device bug bounty, for example.

564
00:54:04,860 --> 00:54:08,360
If that's a good or a bad thing, we could talk hours on that.

565
00:54:08,360 --> 00:54:11,120
But you don't have the issue of patient health information.

566
00:54:11,120 --> 00:54:22,180
And so hospitals can't offer hackers to come in and poke around the periphery of their networks or to give them that type of experience because of a couple things.

567
00:54:22,180 --> 00:54:27,060
One, their live networks are taking care of patients we would hate for something bad to happen.

568
00:54:27,060 --> 00:54:31,900
But then two, there's so much protected health information floating around a hospital's network.

569
00:54:31,900 --> 00:54:46,220
And if a security researcher or hacker in good faith trying to do right finds something and it happens to be commingled with patient health information, then the hospital is required to report that as a HIPAA breach, right?

570
00:54:46,220 --> 00:54:52,180
So there are some, perhaps some would call barriers, perhaps some would call safeguards.

571
00:54:52,180 --> 00:55:04,180
But what I think it's done is it's made not just the delivery of healthcare itself particularly difficult to engage with from the hacker perspective.

572
00:55:04,180 --> 00:55:07,380
And I think maybe we don't have to figure out that solution.

573
00:55:07,380 --> 00:55:09,400
Maybe that's one of the solution bounties we should offer.

574
00:55:09,400 --> 00:55:10,940
How can hackers get more involved?

575
00:55:10,940 --> 00:55:12,180
Give us your ideas.

576
00:55:12,420 --> 00:55:24,080
But particularly at hospitals where we've talked about they don't have a lot of in-house security expertise, if anything, but yet they're still asked to do all of that work.

577
00:55:24,280 --> 00:55:26,540
How can the community come together and help them out?

578
00:55:26,540 --> 00:55:29,140
Because that could be a lot of good right there.

579
00:55:29,320 --> 00:55:32,560
One very easy answer to that is just working in healthcare, right?

580
00:55:32,560 --> 00:55:49,760
So I would encourage anybody who's thinking about a career change, if you're looking for an area where you can make an incredible impact and have a lot of really challenging problems to solve, consider working for a hospital or a healthcare delivery organization or being adjacent to that in some way.

581
00:55:49,940 --> 00:55:58,320
We know that some of these hospitals we talked about in certain areas are critically underserved and may not even have a full -time IT security professional.

582
00:55:58,320 --> 00:56:07,440
So one way to get involved is just to join that effort as an actual employee of a healthcare organization.

583
00:56:08,600 --> 00:56:35,800
I've got some specific suggestions I think, and it's funny that you bring up HIPAA and other things like that, because I think one of the best ways that folks like these could get involved, whatever, there are actually specific programs that are being offered now within the federal government that puts you in policymakers' offices and lets you be the cybersecurity expert in the room for those people.

584
00:56:36,800 --> 00:56:39,680
There's the Tech Congress Fellowship.

585
00:56:39,720 --> 00:56:40,740
Some of you may have heard of it.

586
00:56:40,740 --> 00:56:43,400
Some of you may have met some of the fellows.

587
00:56:43,760 --> 00:56:50,200
Chris Segoian, who's probably a well-known name for some of you all, was a Tech Congress fellow.

588
00:56:50,200 --> 00:56:54,660
He now works permanently for a senator and is that senator's tech person.

589
00:56:54,880 --> 00:56:57,600
But there's been dozens of others.

590
00:56:57,600 --> 00:56:59,240
They've got great folks.

591
00:56:59,240 --> 00:57:00,080
It's a great program.

592
00:57:00,080 --> 00:57:03,600
Places you with either a House office or a Senate office.

593
00:57:05,160 --> 00:57:12,380
And so that's one of the most direct ways that you can actually influence policymaking in this sense, is actually go be in the room when the policy is being made.

594
00:57:12,540 --> 00:57:14,220
So I would highly recommend that.

595
00:57:14,420 --> 00:57:20,020
I don't know when the application process opens for next year's class, but Travis Moore is your man, so go find Travis.

596
00:57:20,520 --> 00:57:23,820
The other thing I would mention is I Am the Cavalry.

597
00:57:23,820 --> 00:57:45,280
When I Am the Cavalry was first started, it was kind of this weird, kooky thing for the Hill, for the United States Congress, who's very used to dealing with very buttoned up everyone's suit and tie professional trade associations and things like that when they were trying to get information on whatever they needed to get information on.

598
00:57:45,320 --> 00:57:49,300
And I Am the Cavalry sort of just kind of like came up to the Hill and was just like, Hi!

599
00:57:49,300 --> 00:57:50,760
We're a bunch of cybersecurity experts.

600
00:57:50,760 --> 00:57:52,300
We'd like to talk to you about this.

601
00:57:52,300 --> 00:58:02,300
But the thing is, they're one of the most effective advocacy groups in national policy making right now, because they were just so...

602
00:58:03,540 --> 00:58:11,620
everyone could tell in a city where sometimes people's motivations are a little bit shrouded, that they just wanted to be there.

603
00:58:11,620 --> 00:58:13,400
They were there with good faith.

604
00:58:13,400 --> 00:58:20,160
They really just wanted to do the right thing, and they were going to answer whatever questions needed answering without bias.

605
00:58:20,160 --> 00:58:25,040
And so I know SEA works a ton with I Am the Cavalry.

606
00:58:25,040 --> 00:58:29,520
I know that Hill works a ton with I Am the Cavalry.

607
00:58:29,560 --> 00:58:41,360
And so if you want to get involved and have an opportunity to meet with the movers and shakers of the country of cybersecurity policy, I Am the Cavalry is another really great place to do that.

608
00:58:45,240 --> 00:59:00,500
I just would like to perhaps add that from my other perspective, if you want to get a hold of working in a hospital or getting your hands just on some medical equipment or just having a conversation with the manufacturers.

609
00:59:01,020 --> 00:59:03,800
Three years ago, I spoke at Biohack Village.

610
00:59:03,800 --> 00:59:05,220
This was my first DEF CON.

611
00:59:05,220 --> 00:59:10,500
This was my first ever meeting another group of hackers like myself.

612
00:59:11,580 --> 00:59:15,120
And that's how I was set on the path to do research.

613
00:59:15,120 --> 00:59:17,500
That was how I got access to devices.

614
00:59:17,500 --> 00:59:27,340
I no longer had to smuggle them through customs at an airport because I bought them on eBay or, you know, because you can't buy them in South Africa, right?

615
00:59:27,460 --> 00:59:29,560
So I would buy them in the UK.

616
00:59:29,560 --> 00:59:36,420
I could have visited a friend and I put them in my luggage and smuggled them back home so that I could work on them, right?

617
00:59:36,420 --> 00:59:41,600
Or even, you know, when they exploded my first device, I said, hey, give me, give me, give me.

618
00:59:41,600 --> 00:59:45,680
I want to have that on my doctor's wire, like sentimental reasons, of course.

619
00:59:46,720 --> 00:59:48,540
But that's how I got my hands on.

620
00:59:48,540 --> 00:59:57,940
But here I walked into a place in Vegas that had devices, that had a lab, that had everything that, you know, makes a young hacker's heart, you know, do jumps.

621
00:59:58,260 --> 01:00:03,900
So if that tickles your fancy, then that's somewhere that you should go visit, right?

622
01:00:03,900 --> 01:00:06,060
You should go try your hand at it.

623
01:00:06,060 --> 01:00:11,340
You should go play with those devices, speak to the manufacturers and go see how they implement it.

624
01:00:12,100 --> 01:00:17,980
And I mean, even if you're a patient, nothing precludes you from giving advice at a hospital.

625
01:00:18,280 --> 01:00:20,760
I mean, I've given advice from my ICU bed.

626
01:00:20,760 --> 01:00:24,260
There's a reason I'm not allowed a laptop in anymore, right?

627
01:00:24,260 --> 01:00:27,080
Except for that the doctor wants me to waste more.

628
01:00:27,080 --> 01:00:28,720
Apparently, that's the reason.

629
01:00:28,720 --> 01:00:31,160
But I mean, give advice.

630
01:00:31,240 --> 01:00:32,400
Reach out.

631
01:00:32,400 --> 01:00:33,560
Get involved.

632
01:00:34,020 --> 01:00:39,020
And if someone doesn't want to listen to you the first time, keep on trying, because it's a patient's game.

633
01:00:39,020 --> 01:00:39,300
Right?

634
01:00:39,300 --> 01:00:40,980
It's not going to happen overnight.

635
01:00:41,500 --> 01:00:42,320
I've learned.

636
01:00:42,320 --> 01:00:49,420
I've dealt with many parties and it's not going to happen fast because it's a big industry.

637
01:00:50,200 --> 01:00:51,100
Just get involved.

638
01:00:51,100 --> 01:00:52,420
Get your hands dirty.

639
01:00:52,680 --> 01:00:54,900
Because that's how we change the world.

640
01:00:55,100 --> 01:00:59,360
Every new researcher that comes in the fold is a new mind that thinks differently.

641
01:01:00,120 --> 01:01:03,620
And that's, I think, how we change things one step at a time.

642
01:01:04,900 --> 01:01:16,440
I love that, because I think the idiosyncratic notion that it takes a specific individual or an elite person or someone who's an expert to make a change is absolutely a misconception.

643
01:01:16,780 --> 01:01:20,960
The notion of just getting involved, there's no inner circle here.

644
01:01:20,960 --> 01:01:29,280
I think every person in this community is more than willing to share their network, share their expertise, and share whatever corner of this problem that they have.

645
01:01:29,280 --> 01:01:31,200
It's a really hard problem.

646
01:01:31,260 --> 01:01:35,740
And we need all the talent that we can muster up right now to really make a change.

647
01:01:35,740 --> 01:01:49,880
And I think if we look at the diversity of roles, functions, experience, thought process, background, education, everything, any under-representation of that population is indicative of missing a potential attack factor.

648
01:01:49,880 --> 01:01:54,100
And we really have to account for that and try to bring in as many folks as we can.

649
01:01:54,960 --> 01:01:57,440
Yeah, I think this is a call to arms, right?

650
01:01:57,440 --> 01:02:00,840
This is a how many hackers can we round up in one go?

651
01:02:00,840 --> 01:02:03,660
Not just even hackers, right?

652
01:02:03,700 --> 01:02:10,120
You know, everyone from physicians, from patients, from builders and policy makers.

653
01:02:10,120 --> 01:02:23,280
I think if we start breaking down the silos, which we've been functioning in, and independently working and start this collective movement, that's how we change the world.

654
01:02:24,440 --> 01:02:26,800
It's not a one-person thing.

655
01:02:26,800 --> 01:02:34,320
It's never going to be one person that's going to come up with the magic solution or the silver bullet, right?

656
01:02:34,320 --> 01:02:40,540
It takes more than one village, as I always say, to solve the problem.

657
01:02:41,300 --> 01:02:48,340
And I think it's time in 2020 that we as a society pull together instead of apart.

658
01:02:49,200 --> 01:02:52,920
Because we've seen what a virus can do, right?

659
01:02:52,920 --> 01:02:54,680
It's locked us in our houses.

660
01:02:54,680 --> 01:03:00,600
So I think it's time we take our power back and we start moving the world into a positive future.

661
01:03:01,000 --> 01:03:12,040
Because I can tell you from a patient perspective, not having access to being able to go into a cardiologist office because we're afraid of COVID, because currently it's more dangerous going into a hospital.

662
01:03:12,780 --> 01:03:19,500
A denial of patient care is a non -acceptable, non -negotiable.

663
01:03:19,540 --> 01:03:21,420
I'm not going to stand for it.

664
01:03:21,420 --> 01:03:25,840
And I think we should be kicking down the doors and saying, you know, now's the time.

665
01:03:25,840 --> 01:03:28,100
Not yesterday, now.

666
01:03:30,680 --> 01:03:31,740
I love it.

667
01:03:31,740 --> 01:03:35,160
Are there any better sentiments to go out on than that?

668
01:03:36,100 --> 01:03:40,360
I think it's easy to be cynical about all this.

669
01:03:40,360 --> 01:03:44,300
And it's easy to say we're having the same conversations year after year and the problems are still there.

670
01:03:44,300 --> 01:03:48,220
But I mean, in 2015, the Biohacking Village didn't exist.

671
01:03:48,220 --> 01:03:55,920
And the idea of people from device manufacturers bringing stuff for hackers to poke and prod at would be laughed out of the room.

672
01:03:55,920 --> 01:04:05,300
So for people who don't believe that we can do awesome things when we work together and hang out at places like DEF CON, we have evidence to the contrary.

673
01:04:05,740 --> 01:04:08,380
I think that's about an hour.

674
01:04:08,620 --> 01:04:12,920
And I'm looking forward to seeing you guys in a little bit for a Q&A.

675
01:04:14,700 --> 01:04:15,880
Take care, everyone.

676
01:04:15,880 --> 01:04:17,460
Thank you, DEF CON, for having us.

677
01:04:17,460 --> 01:04:21,900
A shout out to Nikita, especially, for taking another shot at us.

678
01:04:21,900 --> 01:04:28,400
We're going to go ahead and open it up to Q&A here in 5, 4, 3, 2, 1.