start	end	text
0	3580	Welcome, DEF CON 28, the Do No Harm panel.
3580	6020	This is a healthcare security conversation.
6140	10020	And for the next 45 minutes, followed by a 45-minute Q&A,
10020	12120	you're going to hear from some of the world's top experts
12120	14500	on the healthcare cybersecurity space.
14540	15260	Welcome.
17080	18040	Thanks, Kwadi.
18120	19280	I'm Replicant.
19280	21480	We're going to get out of the way here in just a moment
21480	23480	and introduce you to our panelists,
23480	27100	but obviously a little bit different of a venue for us
27100	28320	than the last couple of years.
28320	30920	We hope that everyone is staying safe and healthy
30920	32480	and we're thinking of you and look forward
32480	35360	to when we can hang out together in person.
35740	37400	Without any further ado,
37400	40500	I'm going to let our panelists take it away and say hi.
42080	43140	Hi, everyone.
43140	44380	My name is Ash Luft.
44380	47680	I am a biochemist, a computer scientist,
47680	49300	and an electrical engineer.
49480	51720	I work as a medical...
51720	54700	I work at a medical device firm called Starfish in Canada,
54700	57140	and I'm a software engineer there
57140	60600	and an advocate for security and privacy.
62910	64820	I think that means that I'm next.
64820	67740	So I don't have a handle, unfortunately.
67740	69820	So I am Jessica Wilkerson.
69820	73060	I'm a cyber policy analyst with the Food and Drug Administration,
73060	77180	and I work on cybersecurity policy there for medical devices.
77420	79760	Some of you may know me from my previous time
79760	82220	with the United States Congress Energy and Commerce Committee
82220	85880	where I worked on cybersecurity policy for them.
85880	87480	Very nice to talk with everyone.
87480	88360	I'm looking forward to the panel.
88360	89260	Thank you.
93040	94820	Hi, this is Vi.
94820	95920	Everyone should know me.
95920	98600	The short, the sweet, the sassy, the spunky.
98840	102920	I'm leaving my company for the wild fields in Norway
102920	105120	where I'll be having a whole host of minions
105120	107520	to help me do medical device research.
107520	110640	Currently doing independent research for Medtronic,
110640	112180	aiding them to get more visualization
112180	114800	on their products and their security.
114880	117000	I'm an advocate for patient rights
117000	118820	as well as keeping things safe,
119960	122940	keeping it simple, keeping it stupid, as I say.
123620	126100	And that's me, short and sweet.
127860	129080	And that leaves me.
129080	130720	My name is Vidya Murthy.
130720	132480	I work for MedCrypt,
132680	135600	a startup in the space of bringing cybersecurity features
135600	137100	to medical devices.
137220	140200	I absolutely am passionate about the subject matter
140200	143920	and think that we're at an inflection point here
143920	145960	and there's going to be a big amount of change
145960	147480	as we go forward.
150130	152410	Well, on behalf of Claudia and myself,
152410	153750	we are just so incredibly grateful
153750	156450	to have an amazing panel this year.
156710	159290	And for those of us who are joining us for the first time,
159290	161050	and this is kind of one of the silver linings,
161050	162110	I think, about this format,
162110	163390	is that in past years,
163390	164970	we've had folks who wanted to kind of get in
164970	165710	on this conversation
165710	167690	that weren't able to due to space constraints.
167690	169230	So we're really thankful for the opportunity
169650	171510	to have anybody who wants to come in,
171510	174110	listen in and join with us to be able to do so.
174110	176190	So for those who may not be familiar,
176190	177210	what we're going to do is we're going to have
177290	178410	a little conversation here
179510	181870	between the four of these awesome panelists,
181870	183930	and we're going to stay out of it as much as possible,
183930	185450	but get their insights
185450	188130	and kind of what their thought processes are
188130	190150	and some of the things we've been seeing in the space lately.
190150	191550	And then part of this session
191550	194930	will be a live Q&A follow-up conversation afterwards.
195830	199010	So we don't really have a formal set of questions
199010	202170	like most of these kind of more rigid panels do,
202170	204130	but I do want to kind of start off
204130	205510	on a little bit of a brighter note.
205510	206430	I think some of the times
206430	209290	that we've had this event in past years,
209290	211810	we spend about 45 minutes talking.
211830	214810	The term dumpster fire comes up not infrequently.
214970	216950	And then at the end, we try and push a little optimism
216950	220870	because there really is a lot to be sort of hopeful about
220870	223130	in large part because of the types of things
223130	224790	that we're able to do at places like DEF CON.
224790	227790	But I want to kind of start off this time upfront
227790	229650	by asking each of our panelists,
229650	232250	what are some developments lately
232250	235530	that have helped make you feel particularly hopeful
235530	237110	or optimistic about where we're heading
237110	239350	in healthcare security before we get into some
239350	240950	of the challenges that still remain?
240950	243310	So kind of toss it back to our panel for us
243310	245470	to get a little dose of optimism.
246650	251090	Yeah, so I think looking at this year in particular,
251090	253990	we've seen more and more devices going home with patients.
253990	256610	We've seen hospitals go online in a way
256610	260670	that they've never planned to in 10 years from now, right?
260670	265250	And I think the notion that we can now build security
265250	268550	into this and need to, to let patients have confidence
268550	270410	in them operating from their homes,
270410	272990	is something that seems to be top of mind for folks
272990	274610	and actual common practice.
274610	278490	So it feels like a confluence of various factors
278490	281510	that are coming together at just the right moment.
281510	283850	So we have this push of devices leaving the hospital.
283850	286690	We have this push of device vendors
286690	289490	really getting into the narrative more than ever before.
289490	292230	And this collaboration like DEF CON brings together
292230	296550	with researchers and devices themselves.
296550	297970	And I just, I have a lot of hope
297970	300430	that this year has the momentum behind it
300430	302790	to really get this to stick and have the forces
302790	305450	that are really gonna make this last in the future.
309560	315520	Yeah, so I echo that, but I've also seen this big push,
315520	317120	I find it past three years,
317120	318880	where you could not even have a conversation
318880	320260	with a manufacturer, right?
320260	321580	It was a brick wall.
321580	323360	This year we're having conversations.
323360	325580	This year we invited to the table.
325840	328120	Hackers are no longer the criminals
328120	330720	that are lurking in the darkness.
330720	332080	We've brought things to light.
332080	334460	We're having difficult conversations,
334460	335840	but we're having them.
335840	338240	And I think that's a major push forward.
338240	340480	But except for that, we now having developers
340480	342980	and engineers think more security wise,
342980	346280	we've started to change the cultures of working in silos
346820	349120	to start working as a collective.
349320	351920	And one example that I've seen is the way
351920	354680	that the community is jumping with the 3D printing,
354680	359020	PPE, mask making, supporting medical people
359020	360360	where they can.
360360	361940	And I mean, even the CTI league
361940	364120	that's protecting hospitals around the globe
365420	367420	from cyber criminals.
367460	369760	I mean, that is just a collective pool of humanity
369760	371560	showing that if we work together,
371560	374940	we can change the world one button at a time.
375160	377120	What do you think, Jessica?
378060	380060	Oh, I like the prompt.
380940	383340	I mean, I think I started working on
383340	384900	healthcare cybersecurity issues,
384900	388500	I think right around 2015, 2016 timeframe.
388520	390540	And at that point, obviously I was working on them
390540	392620	for the United States Congress.
393680	396320	And it was just an entirely different conversation.
396320	398660	I mean, the things that we were talking about,
398660	400580	you know, like V had said about
401000	402780	let's bring in security researchers,
402780	404700	let's have them be part of the conversation.
404700	407660	They have valuable experience and things to contribute.
407800	409340	That was just such a non-starter.
409840	411060	And you had all these manufacturers
411060	413640	who absolutely were never going to do that.
413640	415540	That was completely unacceptable.
415540	417920	We are still, in some cases,
417920	419920	getting asked for help by the manufacturers
419920	423540	to essentially be like, can you make this problem go away?
424500	426580	And there were just other policy issues,
426580	429060	you know, that have come up over the years.
429280	431280	I work a lot on legacy device issues.
431280	434100	I work a lot on software transparency issues.
435120	438820	And they always started out as, this is never going to happen.
438820	440100	We're never going to be able to do this.
440100	442200	The industry will never accept this.
442460	446660	And in 2020, it's completely different.
446660	448260	I work on those issues every day.
448260	450540	They are starting to be operationalized.
450680	453440	Security researchers are a huge part of medical device
453440	455560	and healthcare cybersecurity overall.
456000	458120	And we've just really made so much progress.
458540	461120	And we've made the progress in such a way
461120	463000	that it has its own momentum now.
463000	464660	It's going to carry itself through.
464660	466800	And I just think that that really can't be overstated
466800	468060	how valuable that is.
470040	472620	Yeah, so I agree with what everyone said.
472640	477180	I would say that I think one of the biggest things
477180	479880	I've noticed in the last five, 10 years is the people.
480080	483520	So community and like the number of people sort of coming together.
483520	485320	There seems to be lots of different groups
485320	486980	and organizations popping up,
486980	490420	like even the last couple of years, advocacy groups,
490420	491860	people working together.
492140	493860	Yeah, medical device manufacturers.
493860	496460	I mean, even when I, you know, five years ago
497040	498600	started having these conversations
498600	501980	and asking questions about security and privacy,
501980	504260	it was harder to find other people
504260	507540	to even have a discussion with about these things.
507540	510480	And now it just seems like there's this momentum
510480	512520	that's really building and the number of people
512520	516320	are just getting who are engaged and want to make a difference
516320	518860	and want to be a part of the conversation is growing.
518860	520800	And I see that as a huge positive thing
520800	522660	because realistically, like the more people
522660	525920	that we have participating in the conversation,
525920	529860	the more action that we're going to be able to take sooner and faster.
531620	534600	Yeah, I think one of the big things also
534600	537280	is we've seen physicians coming to the table
537760	539980	and wanting to learn more about the devices
539980	542900	they have and work with, right?
542900	546420	It's not just the security people driving it or policy driving.
546420	549120	And I think the healthcare industry has come back into a bang
549120	553020	and saying, how can we make this better for our patients?
553220	554900	Because in the end, I think every physician
554900	558340	wants to make it safer for their patients.
559020	561640	And that's a big thing for me that I've seen this year
561640	564240	is the physicians coming to the table saying,
564240	566000	well, how can we learn more?
566480	573360	How do we translate this to our patients in a way that they understand?
576020	577960	Yeah, yeah, I think that...
578520	580940	I love conference calls.
580940	585240	I was going to say, you know, I'd really...
585240	586940	I'd echo that because I think, you know,
586940	589980	even going beyond patients and things,
589980	594720	one of the things that my boss is really quite insistent on,
594720	598260	and you probably all know Suzanne Schwartz one way or another,
598260	602000	is the shared responsibility of the healthcare sector,
602000	605100	where, you know, even we are the Food and Drug Administration.
605100	606340	We can only do so much.
606340	609000	We have jurisdiction over the medical device.
609000	610920	We don't have jurisdiction over hospital networks.
610920	615680	We don't have jurisdiction over other parts of it that, you know,
615680	619740	sometimes that are certainly implicated in cybersecurity concerns.
619820	627240	And so, you know, there's traditionally been a very fraught relationship between,
627240	631000	for example, medical device manufacturers and healthcare delivery organizations,
631000	633360	so hospitals and others.
633500	637080	And what I've started to see and have personally experienced
637080	640780	over the last couple of years is a greater and greater breakdown
640780	643200	of the barriers between those two groups.
643200	646760	So with some of the partnership groups that exist,
646760	650320	I spend a lot of time working with the Healthcare Sector Coordinating Council.
650320	654020	For example, you have hospital CISOs who are on the phone every day
654020	657080	with global product security officers at medical device companies,
657080	659480	and they're just having conversations.
659480	660900	I mean, sometimes they're just shooting the shit,
660900	663580	and sometimes they're actually talking about work stuff.
663580	668280	Those relationships being there and being already established
669080	670580	are just so meaningful.
670580	674400	It allows the progress in the sector to be made so much faster
674400	676640	and problems to be addressed so much quicker.
676780	679340	And so I would echo what V said about, you know,
679340	682340	we're having almost new entrants into the conversation
682920	685580	that's letting the conversation really take off.
686780	688260	I just want to say...
688260	690900	Sorry. Go ahead, Christian.
690900	693300	I just want to say these are all fantastic insights,
693300	697880	and I love to hear the optimism around how the conversation's changed,
697880	700540	because every year when we have this event,
700540	705780	we undoubtedly have to talk about an event that's happened during the year,
705780	707320	you know, whether or not it's WannaCry,
707320	709740	or whether or not it's a security researcher
709740	713420	that's been shunned or threatened by a device manufacturer.
713420	715820	And for, I think I can say this is the first year
715820	719560	where I have not been publicly aware of such an event.
719560	723140	And so I think that's really proof to what everyone's saying here
723140	729060	is at least part of the interaction with hackers has changed.
729060	731980	Now, whether or not that'll stick or whether or not this is just an off year,
731980	733220	I think we'll have to see.
733220	736160	But when we have strong partners in this space,
736160	738440	you know, hackers coming together with health organizations
738440	743560	and device manufacturers welcoming their collaboration,
743560	744760	everyone wins.
744760	748400	And that's really what makes patients safer at the end of the day.
748540	750700	I wanted to just also say, though,
750920	756500	a lot of what was discussed is optimism around this is a great year.
756540	758400	It's also a horrible year.
758400	761600	COVID, like 2020 is one I would love to forget.
761600	765440	There are so many things about this year that have absolutely sucked.
765860	769480	One of the things that's been voiced to me by a variety of people is,
769480	771940	you know, how is COVID going to impact this?
771940	774440	You know, how is COVID going to impact hackers,
774440	777180	security researchers, security professionals,
777180	780420	and the momentum that we have made?
780720	783400	Because there's legitimate concern, I feel,
783400	787000	that, you know, a lot of security work,
787060	790280	a lot of securing these types of spaces costs money,
790280	792920	and how a lot of that money is being sucked
792920	796900	from what would be security budgets into responding to COVID.
796960	802060	And as a consequence, do people here think we're going to see a regression?
802060	803600	You know, we've made 10 steps forward.
803600	808620	Are we going to go five steps back because COVID really stopped it,
808620	809460	stopped the momentum?
809460	811180	Love to hear your guys' thoughts.
812660	815040	So I'll start.
815040	816160	Sorry, Vidya.
816920	819940	I think it's broken the perimeter, right?
819940	824820	It's forced us to pull up our socks, right?
824820	828900	The healthcare perimeter is now no longer within your hospital.
828900	832640	You have patients at varied areas and everything is different.
833070	838380	But I don't necessarily think taking 10 steps back is a bad thing, right?
838380	843740	This year has given us time to assess, time to view the healthcare scene,
843740	845180	the medical device scene.
845180	849440	And if anything, force us to slow down and observe
851180	855120	and just take note of what's happening, right?
855120	858680	I see hospitals crumbling up underneath a pandemic,
858680	864400	which is something that their function is to care for patients.
864440	869520	And we see that even the biggest hospitals are struggling
870460	875760	and that perhaps we just need to take a step back and rebuild.
876400	879680	Maybe 2021 could be the year that we build things better
879680	882540	instead of trying to slap a Band-Aid on.
882540	885000	We do things right and we do things better.
886560	888400	From the ground up.
889740	893420	Yeah, I love that notion of taking the time to rebuild.
893420	898620	I mean, we've seen where healthcare facilities have already been compromised
898620	903500	before they saw their first patient as part of trying to meet the need for COVID.
903780	906800	One of the things I worry about is, in some sense,
906800	910700	I think there's this urgency from a clinical perspective to get devices out to patients
910700	914140	and kind of solve some of the medical problems.
914400	919340	Has that resulted in these devices having security measures
919340	923320	that were intentionally not so robustly built in from the beginning
923320	925920	just so they could get out and treat these patients?
925920	928760	And what do you do now, right? Can you walk that back?
928760	930720	Can you say, hey, give all those devices back to us?
930720	932660	We don't want to necessarily see it.
932660	937640	So I think your point of needing to build from the beginning is absolutely heard,
937640	943560	but I wonder if you're realistically able to call pause on the care that's already out there.
944420	948740	I don't know. I mean, I always refer to it as the legacy problem, right?
948760	951820	Literally, it's a sea of devices out there.
951820	955520	And I mean, if you look at the number of devices out there every year,
955520	960120	it just increases exponentially. I mean, the maths blows my head.
960120	964280	I sat in it the other day knowing, well, how do we solve this?
965020	969700	And I think one of the solutions is to do things going better forward, right?
969700	976640	Is not to introduce new devices with the same flaws and the same vulnerabilities and adding to our problem.
976680	982960	Because those devices, if you take an ICD, for example, can last an excess of a decade.
983040	992860	If that's 600,000 devices implanted a year, lasting 10 years, it is an ocean that you're trying to boil.
993540	998980	You can't necessarily say to someone, hey, I need to catheterize your device because it's got a flaw in.
998980	1002620	My device has got a flaw in that I'm fully aware of.
1003140	1010240	But what are the options? I have to go for 10 years with this device until it's made better.
1010460	1016320	But these devices were not built with a security as a functional requirement.
1016740	1018520	It's a clinical requirement.
1018520	1026580	And I think if we start shifting and start building and designing with security in mind, we can start addressing the problem forward.
1026580	1034580	In terms of the legacy problem, I actually don't know how to boil that ocean, to be honest with you.
1036940	1039560	Yeah, I like what everyone is saying.
1039560	1047260	I like the idea of being able to rebuild and taking a step back to think about how we want to solve some of these problems.
1047260	1050060	I think that in practice, it's really hard.
1050060	1067320	Again, with the clinical, looking at the clinical perspective, like right now, we're working on trying to create a massive number of respirators and ventilators in a short period of time and make them safe and make them functional.
1069940	1075180	If it costs more and it takes more time to add the security, it's hard to make the argument.
1076620	1077940	What's more important?
1077940	1087060	If people are dying and it's literally minutes, hours makes a difference between life or death and you can get one more ventilator into a room,
1087060	1098880	if it took an extra two day, even day to add security, let's just say for the sake of this problem, is that worth it?
1098880	1103520	Whose lives should we sacrifice to add the security?
1103520	1106180	And like, it's tough.
1106180	1111760	I don't know how we can sort of push for that and where to draw the line in practice.
1112080	1113760	It's a bad thing.
1114920	1115960	Sorry, Jessica.
1116400	1124080	No, no, I was just going to say, you know, I think the way that we've certainly experienced it at FDA is we're doing things in parallel.
1124140	1136380	So I have been very blessed in my time at FDA not to have been fully pulled into the COVID response, but I'm still 100% on cybersecurity.
1136380	1150320	And essentially what that's allowed us to do is while, you know, a significant portion of the agency is all in on COVID and figuring out what they need to do and doing some of the things exactly what you all are saying, getting devices to patients who need them.
1150440	1156020	We also still have a very dedicated team at FDA looking at cybersecurity.
1156560	1164500	And another thing that I was really lucky when I came into FDA, I think everybody, you know, elementary school feels like a bajillion years ago.
1164500	1170720	But, you know, like you'd like walked into elementary school and there's that one person there who's just like, you're like, we're going to be best friends.
1170720	1172820	We're going to do great things together.
1173100	1178040	For those of you who have not met Matt Hazlett, he probably is like sick of me talking about him.
1178040	1180280	But anyway, Matt Hazlett is great.
1180280	1188420	And he is the essentially the one of the leads at FDA for doing cybersecurity reviews of devices as they come in.
1188420	1203380	And so at the same time that all of this is going on with COVID, what Matt and his team within the device review office at FDA have really started doing is they're getting tighter and tighter and tighter and tighter at looking at exactly what you all are saying.
1203380	1209080	We're learning so many lessons from deployed devices about vulnerabilities that are showing up.
1209080	1216720	We're learning so much about what manufacturers maybe aren't doing on the front end that are causing problems on the back end.
1216720	1221220	And what Matt and his team have really been able to do is they're taking all of those things,
1221220	1223700	they're taking the vulnerabilities that are showing up in post-market,
1223700	1231820	they're taking the missing pieces of the process, the gaps in the process in the development of medical devices,
1231820	1235560	and they're putting that into the pre-market review process where they're essentially saying,
1235560	1242880	okay, we are learning every day how to get better at reviewing devices and they're implementing it.
1242880	1257380	So I think while we're certainly seeing issues or there's just this very valid urgency about getting devices out where they need to be,
1257940	1266440	we also still have this very robust mechanism at FDA in particular for making sure that anything that we're learning,
1266440	1271560	anything that's coming up with regard to cybersecurity is actually making it back into our process.
1275590	1279890	Yeah, which the one thing I would say, I think that the financial, which was the original question, right?
1279890	1283210	What's the financial drain going to have an impact on these devices?
1283210	1285730	I think that's exactly, there's almost a compliment there, right?
1285730	1293590	If we can get the financial decisions to be informed by what the pre-market is telling us in terms of meeting certain security requirements
1293590	1298770	and really having that be key criteria and decisions and not just, no offense to the clinicians,
1298770	1301970	the clinician really likes this one brand and that's what they're going with.
1301970	1307370	Having it be part of that core decision, I think absolutely will drive that change.
1308730	1315710	My only decision about whether or not I use a device is how many 5G microchips I can inject into a patient.
1316010	1317930	Wait, does it have to say AI in it?
1318550	1322150	No, that's the blockchain version. That's 4G.
1322210	1327170	This is being recorded, man. That is going to be clipped. That is going to be taken out of context.
1327170	1330390	It's going to be viral on Twitter in the next couple of days.
1330810	1334610	And we're going to hear about how doctors are part of the 5G conspiracy.
1334610	1337510	So, strong work on that one.
1338010	1340430	Yeah, well done.
1340670	1342550	What I did want to ask, right?
1342550	1348210	So I'm going to turn it, I want to ask Christian and Jeff a question, seeing as we're being grilled here.
1348690	1351110	You as clinicians, right?
1351430	1355230	When you are making a decision for your patient, right?
1355230	1359190	You know, security versus clinical functionality.
1359430	1361010	How do you do that balancing act?
1361010	1366290	Because you guys are unfortunate as physicians to have your feet on both walls.
1366370	1369170	So from your perspective, how do you balance it out?
1369170	1372450	How do you work it out in your mind?
1372450	1377470	Because for us, it is security first and foremost and patient care.
1377470	1380010	But we almost move from a security perspective.
1380010	1382850	I've been a patient. I've seen that side.
1382850	1388290	But I'm quite keen to hear from your side what your perspective on it is.
1389250	1391430	Yeah, that's a great question.
1391470	1401830	And I think that COVID is really starkly forcing us to understand and choose between some of these seemingly opposite goals.
1401830	1408010	In medicine, we frequently have to weigh multiple different pros cons for any particular treatment or situation.
1408010	1413450	A patient may need anesthesia for a procedure, but they're also very tenuous from a cardiovascular standpoint.
1413450	1416970	So what's more dangerous, not getting the procedure or putting them under anesthesia?
1416970	1421950	And so oftentimes you have to say, well, we need to take both into account simultaneously.
1422110	1428750	And the points that we've made about the necessity and the urgency of the situation are absolutely correct.
1428750	1435630	When we're in the ICU or in the OR, dealing with these patients, security is not at the forefront of our mind.
1435630	1440590	What technology do we need to achieve the physiologic goals we have for that particular patient?
1440610	1445170	When we go home and we talk to people like you, and we're able to put it on our hacker and security researcher hat,
1445170	1451830	obviously we start to be able to understand and conceptualize the consequences of some of the downstream effects.
1451830	1455390	So it is a complete balancing act 100% of the time.
1455390	1459770	Anybody who tells you they have a perfect formula for that answer is lying to you.
1459770	1465230	The thing that's been somewhat reassuring to me is we have had conversations with people that we work with
1465230	1470270	in our hospitals and elsewhere, where they understand that you kind of have to shoot for both.
1470350	1476790	And in some of our institutions, I've had people say from the disaster and emergency management side of things,
1476790	1479750	hey, we're gaming out the COVID response and going on that right now.
1479750	1487370	But we want to fold a security information infrastructure exercise into that as well.
1487370	1493530	Understanding that some of these events, whether it's UCSF and the ransomware issue,
1493530	1498410	or some of the hospitals in the Czech Republic who have been hit during this period,
1498410	1502990	the underlying assumption that people are now realizing is that you need a stable infrastructure
1502990	1510250	and good devices to be able to treat patients and have the best outcomes in a crisis situation like this.
1510250	1515030	So deficiencies on the security side only hinder your ability to achieve your main mission.
1515030	1518770	And so it's less of then a shunting of resources from one to the other.
1518770	1522350	And then how can we maximally benefit both of those aspects?
1522550	1526570	Which is never perfect, but it's a better way of thinking about it than a trade-off.
1527610	1529270	Yeah, I just completely echo that.
1529270	1534470	Like one of my nightmare scenarios is treating a hospital full of COVID patients
1534470	1539770	where the ICUs are overflowing and then getting hit with ransomware, for example.
1539770	1547970	So what little bandwidth we have left to handle the surge, to treat the patients as best we can,
1547970	1553530	goes out the window when the digital tools we use, whether or not it's the electronic health record
1553530	1558990	or connected medical devices or all of the above, would be impacted by an attack.
1558990	1564730	And so it's not just maybe a little bit of impact to patient care.
1564730	1566770	It's going to be huge.
1566770	1569970	And one of the things we all like to talk about, and I think we all know in this space,
1569970	1574610	is just how dependent doctors are on connected medical technology.
1574610	1580950	Doctors, nurses, technicians, modern healthcare is exceptionally connected, hyper-connected, if you will.
1581130	1587670	And a lot of doctors, you've heard us say this many times, Jeff and myself included,
1587670	1590330	we haven't worked on paper charts.
1590870	1597050	We've never had light boxes where we pull up a CT scan that's printed on something
1597050	1598650	and put it up against a wall to read it.
1598650	1603250	We've always accessed those through workstations and PAC system software.
1603350	1609570	So you take what we're trained on, this digital infrastructure, this connected, vulnerable infrastructure,
1609570	1616050	and you add a pandemic on top of it, and then you take away the tools that we're used to using,
1616050	1617910	undoubtedly patients would suffer.
1617910	1620650	So that one-two punch is definitely something very concerning.
1620650	1626350	To the heart of your question, which is how do we as clinicians make that trade-off
1626350	1633030	or decision about, here's a more secure device, but it has less clinical utility or functionality
1633030	1637370	compared to this more secure device, etc.
1637370	1638630	So how do we make that trade-off?
1638630	1647210	Honestly, looking straight into the camera, it's really hard to even have any bearing on that decision.
1647210	1652270	So a lot of the devices that we use every day in clinical practice, we don't choose.
1652590	1656630	We show up to the hospital and there are monitors that are there
1656630	1661030	because they made that purchasing decision five, ten years ago.
1661030	1666290	When you train to become a doctor, you may train for four or five years
1666290	1671970	on a particular set of medical devices that you're going to implant, a particular brand.
1671970	1674070	You become familiar with that.
1674070	1676170	And so what do you do when you get out of practice?
1676170	1678230	You use the exact same one.
1678270	1684250	And so, believe it or not, there's much less time to reflect
1684250	1688270	and much less ability than most people believe for us to pick
1688270	1693070	which devices we use in clinical practice and to make that decision.
1693110	1697990	With that being said, we're trying to educate other doctors on this.
1697990	1701670	And when we do, like Jeff mentioned, they care.
1701670	1703370	They want their patients to be safer.
1703370	1705210	They want to use secure medical devices.
1705210	1707470	They don't want their patient's health information
1707470	1709170	or even their health to be at risk.
1709170	1712910	So we have sympathetic ears from the clinicians.
1712930	1717010	We just lack the ability to make it easy for them.
1717010	1720350	What you don't want is your doctor to have to go to, you know,
1720350	1722250	14 years to train to be a doctor
1722250	1726450	and then go and have to take another year or two of cybersecurity coursework
1726450	1728330	or whatever to become competent.
1728330	1731270	You really have to make it easy for them to make the right decision
1731270	1735650	and convince them that they should tell other people
1735650	1738190	in their hospital and other doctors that it's important.
1739110	1742230	I think to that point, that's maybe a misperception
1742230	1745450	that the expectation is that everyone in this supply chain
1745450	1747550	has to become a cybersecurity expert.
1747550	1750550	I think maybe that's a fatal flaw in how we think about solving this
1750550	1754170	is if we need to sufficiently educate individuals
1755570	1759370	by having them... you're not a medical device practitioner
1759370	1761790	but hey, I can teach you all about cybersecurity here.
1762110	1766030	It's really hard to think that you can sufficiently educate folks
1766030	1767650	that this isn't their core competency on.
1767650	1771390	Not to say they can't have some level of understanding what the impact is.
1771390	1774770	And I think making it tangible for their work stream or function
1774770	1777570	or whatever the case may be is the perfect way to do that.
1777570	1781810	But I would love to hear kind of the thought around
1781810	1785610	how we think about leveraging those who are experts
1785610	1787410	and not necessarily trying to solve it ourselves
1787410	1788670	and going at it alone.
1788670	1790530	Because I think that's probably a fatal flaw
1790530	1793350	and has caused some of the historical challenge
1793350	1795250	that you're talking about when you inherit a hospital
1795250	1797510	full of devices that you didn't pick.
1798490	1802830	And surely as well, like Jeff was saying,
1803570	1806270	normally physicians are used to sort of having to balance
1806950	1808930	different pros and cons and different requirements
1808930	1812490	to make the best medical choice for each patient.
1813070	1816130	But I think historically, maybe they weren't even aware
1816130	1818730	that this is one of the things they need to consider.
1818730	1822050	So even just how can we raise awareness
1822690	1824750	and just in the consciousness that,
1824750	1826510	oh, that's something that I need to consider
1826510	1827630	even if I'm not an expert.
1827630	1829550	Maybe I can have an expert on hand
1829550	1832190	or I can read a rating for a device
1832190	1834170	and make a decision somehow that way.
1834310	1835670	You know, what kind of solutions are there
1836670	1838330	moving forward in that direction?
1839890	1841930	So I've actually spent some time
1842410	1844290	working a lot with the cardiologists
1844290	1846610	and their technicians in South Africa
1846610	1849810	trying to just have the discussion.
1849810	1852650	And I had a phone call from my cardiologist
1852650	1855610	saying, we've had a recall of devices.
1855850	1858290	I need to explant a device,
1858290	1861170	but I don't know how to explain it to my patient.
1861170	1863330	I don't even sufficiently understand
1863330	1866330	the engineering tool on the document.
1866330	1867870	Can you translate?
1868070	1870590	So I think the big thing is we are using
1870590	1873230	our language, our linguistics,
1873870	1875870	instead of making it familiar
1876670	1879830	to the medical practitioners.
1879830	1881570	And I think there should be that portion
1881570	1884310	in the hospital that does that translation.
1884730	1886310	Because I can tell you
1886310	1888310	that was a very difficult conversation
1888310	1890490	having with a 65-year-old lady
1890490	1893150	that doesn't understand technology.
1893250	1894690	I mean, the doctor didn't even
1894690	1898190	sufficiently understand why he had to explant
1898190	1900650	the device that was just being recalled.
1902290	1904250	And that's the unfortunate thing
1904250	1907210	is they are expected to make these decisions.
1907210	1910430	And as he says, he has a patient coming in.
1910430	1912790	His blood pressure is high.
1912790	1915590	He needs to adjust the ICD and the pacemaker.
1915690	1916950	What he doesn't tell him
1916950	1919210	is that his wife cooked a high-sodium meal
1919210	1921310	which affected his blood pressure.
1921310	1922730	And a week later, he comes back
1922730	1924230	because he's having issues.
1925930	1928290	Therapy has changed significantly.
1928290	1929930	So those are the challenges
1929930	1932390	they deal with having to solve
1932390	1934350	the clinical puzzles.
1934430	1935350	And I think adding
1935350	1938350	the technical stuff on top of it
1938350	1940530	especially using terminology
1940530	1941710	they don't understand
1942270	1944730	is where we've been going wrong.
1945070	1946410	We should be finding ways
1946410	1948970	to translate it better for them.
1949670	1952470	I think that's a failure
1952470	1954270	overall of how
1954270	1956750	we've designed not only
1956750	1958770	medical devices, but how we do cybersecurity
1958770	1961250	overall. So many times
1961250	1962790	if somebody gets hacked
1962790	1964810	or whatever, it's their fault.
1964810	1966690	Setting aside corporations who get
1967330	1968190	DDoSed or whatever
1968190	1970650	and claim to have been a victim of a sophisticated
1970650	1972890	cyber attack, there are times
1972890	1974370	when people get hit by something
1974370	1976350	and it really wasn't their fault.
1976350	1977610	There were so many different things
1977610	1980150	that have been expected to know.
1980570	1982090	And I think something
1982790	1984070	a professor once said to me
1984930	1986190	stuck with me. We were talking
1986190	1988410	about this whole thing about people are just so dumb
1988410	1990830	about cyber. Why can't they just be better?
1990850	1992010	He's like, yeah, and all those people
1992010	1993990	who are driving Ford Pintas, what the hell
1993990	1996670	were they thinking letting their cars blow up?
1998190	2000390	And I think that that's kind of the way
2000390	2002090	that was sort of a lightbulb moment for me
2002090	2004410	of being like, oh, we have
2004410	2006250	to design devices that don't blow
2006250	2007770	up in people's faces.
2008110	2010070	We have to make it as easy
2010070	2011110	as humanly possible
2011110	2013150	to do
2013150	2015210	something securely. Doing something
2015210	2017490	securely needs to be the easiest thing.
2017490	2019310	And if doing something securely is the most
2019310	2021490	difficult thing, that's not the fault
2021490	2023390	of the user who then didn't do the
2023390	2025330	secure thing. That is the fault of the designer
2025850	2027730	who made the device poorly.
2027730	2029370	And so I think we've
2029370	2031430	gotten away with, frankly, in a lot of
2031430	2033470	cases, being really lazy
2033470	2035370	and offloading the responsibility
2035370	2037310	onto other people. And I think
2037310	2039130	what we have to do, especially
2039130	2041310	within the healthcare sector, is all parts of it
2041310	2043430	we have to sort of reclaim
2043430	2045430	the responsibility that has been ours
2045430	2047250	all along and actually
2047250	2049630	really do what we need to do.
2050570	2051210	Yeah, I mean,
2051210	2053110	the responsibility, I'm very big,
2053110	2055110	the responsibility to build these things
2055110	2058010	better is the manufacturers.
2058170	2059290	Right? They're the
2059290	2061070	ones that have the control
2061070	2063070	over the firmware and the hardware.
2063070	2065170	We shouldn't be pointing the finger at the hospital
2065170	2067310	saying, hey, your device
2067310	2069430	your network got hacked because you have vulnerable
2069430	2071510	devices. Well,
2071510	2073770	those should have been built better.
2074930	2075490	Right?
2075650	2077450	Because now we're leading, we're in
2077450	2079690	the industry now where we're putting Band-Aids on.
2079690	2081390	Right? The vulnerability is disclosed.
2081390	2083490	Now we have to run and we're always on the back
2083490	2085150	foot fixing stuff.
2085250	2087590	But the manufacturers should be stepping up
2087590	2089430	and should be doing a better
2089430	2091330	job at this.
2091490	2092950	I completely agree.
2094510	2095390	I completely
2095390	2097550	agree. There's a lot that the device
2097550	2099650	manufacturers can
2099650	2101590	do, should do, and I think some
2101590	2103370	of them have been doing.
2103630	2105550	But there's also a key
2105550	2107490	important thing. They can't control it
2107490	2109530	once it's deployed. So if
2109530	2111670	they're deploying a
2112710	2113890	somewhat secure medical
2113890	2115690	device on an unsecured network, or
2115690	2117750	if they're turning off security controls
2117750	2120830	for sake of ease of
2120830	2122210	integrating into their clinical
2122210	2123490	environment, or if they're not
2123490	2125470	patching critical systems around these
2125470	2127490	medical devices, there's
2127490	2129550	some shared responsibility there, and I think
2129550	2131470	that's really important, is that
2131470	2133890	we need to be having not only a strong
2133890	2135510	conversation with device
2135510	2138070	manufacturers, they do the right thing from the start,
2138070	2139430	but we need to be able to be
2139430	2141590	giving hospitals the
2141590	2143590	appropriate resources, education, and
2143590	2144670	holding them accountable
2145350	2147470	when there's something egregious.
2147470	2149110	Now, I don't think they should be
2149450	2151350	asked to solve the issues
2151350	2153270	of insecure medical devices because
2153270	2155450	they just can't. But we've
2155450	2157490	seen time and time again some pretty
2157490	2159250	horrible security practices
2159250	2161370	by healthcare institutions that
2161370	2163810	have nothing to do with medical device manufacturers,
2163810	2165390	but yet still could have patient
2165390	2167450	safety implications. Things like
2167450	2169430	all the denial of service attacks we see,
2169430	2171150	the ransomware attacks,
2171150	2173110	the theft, I mean, it's not just critical
2173750	2175770	healthcare infrastructure like hospitals,
2175770	2177410	we've been seeing attacks on
2177410	2179510	research. So I'm sure people
2179510	2181670	have seen in the news, and I think Jeff mentioned,
2181670	2183470	ransomware attacks on critical
2183470	2185870	medical research infrastructure,
2185870	2187710	state-sponsored attacks on
2187710	2188650	COVID
2189670	2191470	research and vaccine
2191470	2193490	trials data.
2193490	2195690	So we have to have a
2195690	2197890	shared responsibility. This is a whole
2197890	2199710	ecosystem. It's really trying to figure out
2200650	2202070	what's the best bang for
2202070	2204230	our buck. And I feel like a lot of the
2204230	2206410	conversations focus around medical devices
2206510	2207450	because it's a much easier thing
2207450	2209450	to tackle than trying to go to
2210050	2211630	a rural access hospital
2211630	2213470	in South Dakota and
2213470	2215470	fixing their broken network.
2215470	2217330	And then being able to monitor that and
2217330	2219450	continually say, how are you going
2219450	2220970	to secure
2220970	2223290	every hospital and
2223290	2225310	clinic and doctor's office in the entire
2225310	2227470	United States? That's a much harder
2227470	2228730	problem.
2228850	2231750	But I...
2231750	2233630	Can I go?
2234710	2235810	Oh, that's it.
2235810	2237230	I'd like to...
2237910	2239030	Sorry.
2239350	2241650	I just wanted to say, right, it's not just
2241830	2243510	a United States problem, right?
2243510	2245910	It's a global problem.
2246050	2247730	You know, hate to be the one
2247730	2249830	to point it, but this is
2250210	2252170	a big problem everywhere.
2252170	2253570	And I know everyone
2253570	2255530	on here is from the US. I'm the only
2255530	2257110	oddball after this.
2257110	2258270	I'm from Canada.
2259650	2261870	I don't feel so alone.
2261970	2263890	But the thing is just
2263890	2265870	every hospital is different,
2265870	2267830	right? There's no
2267830	2270590	cookie cutter way of looking at the problem.
2270770	2272010	Every hospital network
2272010	2274030	is different. And I think sometimes
2274030	2275790	what we forget is the patient
2275790	2277890	record systems. Like,
2277890	2279970	I never used to consider it.
2279970	2281850	But then I sat back and thought from the
2281850	2283790	cyber criminal perspective, it is the
2283790	2285790	ultimate identity thing. It's the
2285790	2288350	thing that you can keep selling constantly.
2288390	2289790	And it's often the thing
2289790	2291730	that's least protected. Because
2291730	2293890	we're focusing so much on medical devices,
2293890	2295710	we've forgotten what a treasure trove
2295710	2297670	that holds. And I mean,
2297670	2299430	that's moving to the cloud.
2300210	2301610	So, you know, Microsoft
2301610	2303830	is one of the big proponents that's moving
2303830	2305710	everything now to the cloud in terms
2305710	2307650	of patient records and
2307650	2309410	clinical systems.
2309770	2311730	So I'd be interested to see how the smaller
2311730	2313650	hospitals are actually going to be able to
2313650	2315230	cope with having to do
2315230	2317510	you know, perimeterless
2317510	2319630	defenses, you know,
2319630	2321410	zero trust networks, or
2321410	2323290	even cloud solutions.
2323770	2325590	Because I think the big
2325590	2328410	hospitals like Mayo might be fine.
2328430	2329470	But you have the smaller
2329470	2331290	rural hospitals that
2331290	2333650	I don't even know if they have IT
2333650	2335830	or security on the premises.
2335930	2337690	Or whether they're paying someone, a third
2337690	2339890	party, to do the solution for them.
2341390	2342990	Yeah, I'd like...
2342990	2344950	Go ahead. You go first. Okay.
2344950	2347590	I wanted to go back to the topic of
2347590	2348690	responsibility.
2349530	2351610	And I would have to echo
2351610	2353430	with Christian. I think the...
2353430	2355610	I think it is a shared responsibility.
2355670	2357650	Obviously, I think that, you know,
2357650	2359530	I work for a medical device manufacturer.
2359530	2362070	I'm a software... an embedded software engineer.
2362390	2363990	I think about these things.
2363990	2365530	I want to make sure that I'm doing
2365530	2367230	my part to build really secure
2367230	2369430	and awesome, safe
2369930	2371650	products for end users. I care
2371770	2372810	a lot about that.
2373490	2375610	But I think it's easy to blame
2375610	2377730	manufacturers, and it's often
2377730	2379570	more complicated. Again, it's this balancing
2379570	2381650	act. So, I work for
2382110	2383970	a medical device manufacturer that's a
2383970	2385770	consulting firm. So we don't have any of our own
2385770	2387850	in-house products. We have people who
2387850	2389950	come to us, and we have clients, and
2389950	2392010	you know, some of them are
2392010	2394570	business people, and some of them are other
2394570	2395870	medical device manufacturers
2395870	2397610	that subcontract to us.
2397610	2399950	But we have a lot of people who are just
2399950	2401890	doctors, and clinicians, and other people
2401890	2403570	who are really passionate about saving
2403570	2405510	lives. And they come to us, and they're like,
2405510	2406670	we have this idea.
2407370	2409150	We see this gap.
2409450	2411570	We desperately want to help our patients.
2411610	2413610	Please help us build this. We have this
2413610	2415530	tiny, tiny budget. We only
2415530	2417210	have this amount of time to do it in because
2417210	2419450	we got this little budget from these people, but
2419450	2421530	they say we have to get it done by this time.
2421530	2423350	And we were
2423350	2425210	working really, really hard to try to meet
2425210	2427150	all these deadlines and actually make this
2427150	2429790	little device that, you know,
2429790	2431390	if we can give it to those doctors, it
2431390	2433170	might save lives.
2433450	2435410	And then for, you know, for us
2435410	2437710	to come in and try to say, like,
2437710	2439410	oh, we have to add all
2439410	2441410	of these security things, and, you know, maybe
2441410	2443370	it's going to affect the
2443370	2445530	budget. It's going to affect the timeline. And,
2445530	2447610	you know, again, I care about these things.
2447610	2449450	I'm in there. I'm advocating for this
2449450	2450690	stuff. But it's hard
2451590	2453370	to say, you know, if you only have this
2453370	2455830	much budget, and it's...
2455830	2457270	how do you choose? How do you tell
2457270	2459510	them, okay, you shouldn't...
2459510	2461450	we just aren't going to be able to make this and
2461450	2463490	implement this part of security, like,
2463490	2465250	where to draw the line. I think it's...
2465250	2467310	I think it's more complicated
2467310	2469590	and harder, like,
2469590	2470750	in practice.
2471070	2473430	And it's hard to just say, well,
2473430	2475310	the medical device manufacturer
2475310	2475830	should
2477490	2478890	just do it.
2479830	2481670	You know, how do you make that choice?
2483330	2485510	I actually want to add to that story.
2485510	2487490	So I started working with Medtronic.
2487490	2489610	And I'm a hard ass. Everyone knows
2489610	2491510	that I say a bunch of things
2491510	2493570	three years ago. Cool came out
2493570	2495430	because I was unhappy with how
2495430	2498010	our conversation went, because we had a
2498710	2500150	legal situation.
2500150	2501370	And I started
2501370	2503490	the first six months of my project
2504670	2505650	listening and
2505650	2507690	getting to know the developers and the
2508010	2509930	software, firmware engineers
2509930	2512110	and the hardware engineers.
2512110	2513530	And I sat back
2513530	2515190	and listened and realized that
2515190	2517110	these are real people that are wanting
2517110	2519230	to make a real difference. Really,
2519230	2520930	they are. And
2520930	2523190	one of the specific engineers, Rob
2523190	2525150	Maslow, had a big impact on my
2525150	2527150	life because he said to me,
2527150	2529110	he said, tell me what you want on your device. Tell
2529110	2531170	me all the security you want.
2531350	2533130	Get to the list to me and let's
2533130	2535030	discuss this. And he turned around
2535030	2537090	and said to me, well, so you're getting a new
2537090	2539110	device every three years, right?
2539250	2541150	And I said to him, well, no, there's no
2541150	2543290	fucking way that I'm doing that to myself.
2543290	2545110	And he's like, well, then you can't have
2545110	2547470	all of that. He says there's
2547470	2549370	trade-offs for everything.
2549470	2551330	So, specifically with
2551330	2553290	embedded implanted devices,
2553290	2555730	the more security you add,
2555730	2557310	the less lifetime
2557310	2558990	you'll have on your battery.
2559230	2561050	Because I can tell you the one thing that
2561050	2563290	is worth gold is
2563290	2564990	how long your device lasts
2564990	2567170	because it is a horrible thing
2567170	2569230	to cut out. And I don't know if you
2569230	2571190	guys know, but the more you cut it
2571190	2573330	out, the more scar tissue
2573330	2575330	forms, and the
2575330	2577690	worse it gets, right?
2577950	2579350	I've had my device
2579350	2581330	since 19. I wouldn't be
2581330	2583310	here without it. So, people building
2583310	2585350	these things, I would be dead.
2585350	2587550	I had two weeks left to live. That was
2587550	2589350	the serious situation.
2590210	2591270	So, I think
2591270	2593270	sometimes we want all the
2593270	2595190	security in the world, but we
2595190	2597290	don't realize there's trade-offs.
2597890	2599470	These devices are
2599470	2601470	there to save lives. And if we
2601470	2603510	try and push security too much, there's
2603710	2605250	a whole lot of set of devices
2605250	2607190	that will never come to market
2607830	2609910	and they will never save lives.
2609910	2611470	And that's one big lesson that
2611470	2613690	I had to learn and I had to have humble pie
2613690	2615330	and I had to swallow
2615330	2617250	my words and realize that
2617250	2619330	you know, there's people
2619330	2621410	behind this wanting to make a difference with
2621410	2623350	technology and science. And without
2623350	2625510	that device,
2625510	2627270	I wouldn't be here.
2627790	2629710	I wouldn't have my kids.
2630650	2631450	So, technology
2631450	2633230	does save lives in ways.
2633310	2635110	We must just find the perfect balance
2635790	2637810	to balance everything out.
2638270	2639270	And your perspective
2639270	2641530	Vee, and
2641530	2643310	folks like you, like
2643310	2645490	Marie Mo, who have these incredible
2645490	2647510	security backgrounds, but also our patients
2647510	2649190	is so incredibly valuable
2649190	2651330	to be able to consider these types
2651330	2653230	of trade-offs in like a human person, right?
2653230	2655390	In like a very real way. And one of the things
2655390	2657130	that Christian and I are working on is
2657130	2658810	how do we understand
2660250	2661410	the role of the
2661410	2663330	patient as a stakeholder in these types
2663330	2664470	of conversations?
2666010	2667710	And is there a
2667710	2669730	utility in
2669730	2671490	having those types of conversations with this
2671490	2673870	60-year-old man who needs to get his pacemaker
2673870	2675950	revised? Or is there
2675950	2677890	a trade-off between the potential risk
2677890	2680270	of a vulnerability being exploited and then
2680270	2681870	putting him through that process of having
2681870	2683310	it revised? And I think it highlights
2683310	2685490	one of the things that Christian and I are so
2685950	2687490	interested in is just developing
2687690	2690070	a data and a
2690070	2692150	science around this to be able to say
2692150	2693530	in other types of medical therapies,
2693530	2695510	we have very clear risks. You know, if I give you a
2695510	2697490	blood transfusion, there's about a 1 in
2697490	2699650	1.5 to 2 million chance that you might have an
2700110	2701670	infection that's serious as a result
2701670	2703530	of that or heart or
2703530	2705610	lung issues. We really don't have the ability
2705610	2707570	to have conversations with patients and say,
2707570	2710350	this is the clear-cut risk because
2710350	2711350	thankfully we haven't seen
2711350	2712870	many incidents of issues
2713470	2715410	and that doesn't mean that there's an absence of
2715410	2717370	risk, but it makes it harder for us to have
2717370	2719390	discussions with patients and say, really, this is the
2719390	2721390	type of math that you have to weigh as
2721550	2723290	a patient with your own values and preferences
2723290	2725450	and things like that. And we've kind of done some
2725450	2727450	work on touching on this idea of a cybersecurity
2727450	2729330	informed consent to
2729330	2731670	say, we talk about risks,
2731670	2733310	you know, medical risks of surgeries
2733310	2735390	and medications and things like that
2735390	2737230	that they may be on. Should we start thinking about
2737230	2739290	cybersecurity as a potential risk that should be
2739290	2741090	included in this conversation
2741630	2743390	a clinician has with a patient?
2744650	2745070	And Jessica,
2745070	2747270	I know the FDA is also really interested in
2747270	2748870	this and you've had a lot of really cool outreach
2751070	2751510	types
2751510	2753230	of events to be able to talk to people
2753230	2755310	like V. And I think it's that challenge of
2755310	2757470	moving beyond people who are security literate
2757470	2759250	to people who may not have heard about these
2759250	2761230	issues whatsoever for as much as we talk about
2761230	2763430	them and to be able to kind of have that
2763430	2765250	enter the conversation so that they
2765250	2767130	can, without having a background
2767130	2768550	in cybersecurity, weigh that
2769190	2771350	as part of their clinical process.
2772370	2773150	Yeah, I mean,
2773150	2774970	I think that there's a couple things that I would
2774970	2776970	bring up on this. I mean, like, I think
2778090	2778970	one, you know, you
2778970	2781210	had mentioned that FDA has been doing a lot of
2781210	2783050	this and I think V, you were actually at
2783050	2784610	the October 2019
2785070	2786910	meeting that we had the patient
2786910	2788910	engagement advisory council
2788910	2791090	meeting, the peak meeting. And
2791090	2793030	so FDA is very much
2794130	2795050	trying to make sure
2795050	2797410	that the patient perspective is heard.
2798230	2798970	And it's not
2798970	2801030	just yearly meetings and things
2801030	2802950	like that. As many of you know, Suzanne
2802950	2804970	Schwartz is very approachable. You can pretty much get
2804970	2806890	her email and email her and she'll
2806890	2809270	find time to talk to you.
2810770	2811010	So
2811010	2812870	that is a really critical part of this
2812870	2815010	because, not that
2815010	2816530	all of you are going around reading
2817250	2819070	government white papers and things,
2819070	2820870	but a couple of years ago, the FDA
2820870	2823030	put out this medical device safety action plan
2823030	2824830	and sort of setting aside
2824830	2827170	the flowery language that all government
2827170	2829210	documents, I think, were like decreed
2829210	2830850	that they must use.
2831250	2833310	Essentially what it says is
2833310	2835310	look, it's exactly
2835310	2837010	this issue of balancing
2837010	2838530	the idea that
2838530	2841650	patient safety is a two-fold concern.
2841650	2842950	Right? There's the concern
2842950	2845010	that we all typically think about on
2845010	2846750	cybersecurity. Is this device
2847910	2849130	safe and effective
2849130	2851130	enough to justify its use
2851130	2852990	with the patient? There's also
2852990	2854610	the flip side of that, though, of what
2854610	2856990	Ash was talking about and what V was talking
2856990	2857850	about in that
2858810	2861390	what happens if the patient can't get the device?
2861390	2863030	That is another... that's got to be
2863210	2865150	a thing that gets considered, too.
2865310	2867450	And so, you know, FDA...
2867450	2869090	when we talk about cybersecurity,
2869090	2871210	when we usually do it, we're very explicitly
2871210	2873170	talking about, do you
2873170	2874990	have security controls? Do you
2874990	2877050	have sufficient whatever to make sure
2877050	2878810	that the device is cybersecure?
2878810	2880770	But a less talked about part of
2880770	2882990	the work, but that is equally important,
2882990	2885030	is this idea that we recognize
2885030	2887050	that sometimes devices
2887050	2888410	need to get to patients
2888950	2890810	because of the benefit that they're going
2890810	2892890	to be able to provide. And maybe we don't have
2892890	2894810	as much information. Maybe we don't have
2894810	2896750	as much assurance of
2898030	2898850	the things that
2898850	2900570	we would like to. But, you know, this is the
2900570	2902630	Breakthrough Device Program. This is some of these other
2902630	2904790	investigational devices that come
2904790	2906650	up and that FDA has specific
2906650	2908490	categories for and authorities for
2908490	2910670	things that you can do this. And it's exactly
2910670	2912730	this recognition that
2912730	2915190	the other folks on the panel are pointing out,
2915190	2916650	which is that, in some cases,
2916650	2918670	not having access to a device can
2918670	2920910	be as big of a risk as having access to a
2920910	2923670	device that isn't secure enough. And so,
2923670	2925090	you know, I think that it is just an important
2925090	2927070	point to highlight and, you know, that
2927070	2928890	we as an agency keep in mind, but
2928890	2930730	that this community,
2930730	2932670	in addition, also keeps in mind
2932670	2934970	as we have these kinds of conversations.
2937570	2938630	All right, I want to
2938630	2940630	change this. Oh, can I...
2940630	2942110	I'm going to change the subject real quick
2942110	2944250	because I heard a rumor
2945030	2946570	there are thousands
2946570	2948370	of hackers watching
2948370	2950470	this stream right now. There are
2950470	2952290	literally thousands of hackers
2952290	2954730	from across the globe watching,
2954730	2955930	you know,
2956870	2957350	very
2958730	2960590	interested in what we're talking about. And I'm
2960590	2962470	sure they're thinking to themselves, wow, there
2962470	2964410	are a lot of issues here I might not have been
2964410	2966330	aware of anymore and they want to get involved.
2966330	2968390	So, hackers out there wanting to get
2968390	2970190	involved in this space, you know, how
2971010	2972630	does... we've heard some examples,
2972630	2974550	you know, there's been a
2974550	2976670	group of hackers that have tried to defend
2976670	2978470	hospitals against attackers
2978930	2980570	during COVID. There are
2980570	2982410	hackers printing protective
2983230	2984530	equipment for doctors on the
2984530	2986970	front line, etc., nurses.
2986970	2988410	But, like, what's the next generation
2988410	2990990	of this, right? Like, when the pandemic's done,
2990990	2992250	how do hackers play a role in
2992250	2994290	this space? Continuing
2994290	2996510	doing research, is it bug bounties?
2996510	2998910	You know, should a hospital have a bug bounty?
2998910	3000270	Should a device manufacturer have
3000390	3002170	a bug bounty? How does HIPAA
3002170	3004310	play into that? You know,
3004310	3006630	the protection of patient information.
3006850	3007950	How do we really
3007950	3010950	kind of bring hackers more into this space?
3016330	3018510	Okay, I'm going to jump in, yeah.
3019550	3020690	I have a
3020690	3022590	dream and I have a dream with a friend of mine,
3022590	3024330	you know. We want
3024330	3026330	to establish a
3027290	3028750	laboratory setup with
3028750	3030550	devices, right? That
3030550	3032570	people can actually do research on,
3032570	3034450	that we can put on networks, that
3034450	3036450	we can scan
3036450	3038510	for vulnerabilities, that we can
3038510	3040810	reverse engineer, that we can work with
3040810	3043510	manufacturers to make better.
3043510	3044530	I always see
3044530	3046990	people wanting to break things,
3046990	3048470	right? We want to
3048470	3050710	find flaws, we want to find problems,
3050710	3052190	but often we don't want to find the
3052190	3054030	solution to the problem, because that's the
3054030	3055330	harder part.
3056050	3058150	So I want to say that if you
3058150	3061450	find a device that's vulnerable,
3062190	3064070	first remember they are human lives
3064070	3066170	at stake, okay? This is not
3066170	3068150	an ego thing. Try and find
3068150	3070850	the solution to the problem that you found.
3071110	3072190	Write it up as
3072190	3074110	you would any scientific paper.
3074110	3076130	I know it's hard work, I know it's not glorious
3076130	3078090	and it's not sexy,
3078090	3079970	but when you hand that over to the
3079970	3081150	manufacturer,
3081730	3084130	they have all the data.
3084130	3085850	And the more data they have, the
3085850	3088110	faster that they can verify the claim,
3088110	3090430	they can start acting accordingly.
3091110	3091950	Right? It's not
3091950	3093990	going to be easy. Not all MDMs are going to
3093990	3095830	want to be friendly, but
3095830	3097790	it is changing. But the biggest
3097790	3099870	thing is the more thorough your research
3099870	3102010	is, the less dispute
3102010	3103810	there can be, and the more we can
3103810	3105890	find a way to fixing it.
3105890	3107850	But it's not all about just bug
3107850	3109490	bounties, because I think that
3109490	3111850	for me creates a negative thing of
3111850	3114050	we're just finding the problems.
3114290	3115710	We should be finding problems
3115710	3117670	and then solving them.
3117870	3119870	That's the hacker mindset.
3120210	3121930	It's not just about pointing
3121930	3124390	fingers and saying, this is a problem.
3124450	3126450	We should be working at the solution.
3126450	3127910	We should be finding new ways
3127910	3129810	of doing things. So I
3129810	3131990	want to see a lab filled with medical
3131990	3133930	devices that hackers can pull apart
3133930	3135930	and we can build solutions.
3135930	3137730	But not only hackers, you need
3137730	3140050	people like Ash, right?
3140530	3141890	Because, I mean, we're
3141890	3143870	good at the other side of it, but
3143870	3146150	I can't build these devices.
3146150	3148070	I wouldn't even know where to start.
3148270	3150350	So I think it needs to be a multidisciplinary
3150350	3151630	approach.
3152550	3153770	And even people like the
3153770	3155830	FDA, you know, should be
3155830	3157750	involved in it from a policy
3157750	3159250	perspective. And
3159890	3161650	you know, everyone should just be working
3161650	3163370	together. We should be building the bridges
3163370	3164850	towards having synergy
3165170	3167210	and having a space where we can
3167210	3168990	explore this. And I think Biohack is
3168990	3171290	awesome for that, because they already do a lot
3171290	3172250	of that.
3174720	3176520	Sorry, I'm going to excuse my cat,
3176520	3178860	who just really desperately jumped into my lap.
3178860	3181260	I was trying to prevent it and failed.
3181720	3182400	He just
3182400	3184320	scaled the side of the chair.
3184660	3186740	Welcome addition to the panel.
3188320	3188800	So
3188800	3190440	I love the notion of
3190440	3192500	being part of the solution, and I
3192500	3194600	think to your point, it does require
3194600	3196620	multiple voices. You hit on a point
3196620	3198260	that I think is really important, right?
3198260	3200540	You, as someone who does
3200680	3202680	a lot of security research, is not
3202680	3204560	totally in the space of how do
3204560	3206640	I build a medical device? I think we similarly
3206640	3208660	need to not have the expectation of the people
3208660	3210400	building medical devices to
3210400	3212260	know how to solve some of these cybersecurity
3212260	3214260	issues. So I think having
3214260	3216640	the willingness to partner and really
3216640	3218640	helping them not make
3218640	3220520	cybersecurity their number
3220520	3222540	two core capability,
3222540	3224080	and instead offering them solutions,
3224080	3226400	is absolutely critical and the way to make
3226400	3228460	things actually stick.
3228840	3230220	So should we have solution
3230220	3231560	bounties then?
3232400	3233280	Yes!
3233600	3235820	You should trademark that.
3237220	3238100	But I just
3238100	3240440	want to bring up just a scenario.
3240440	3242140	So it's not just for medical devices.
3242140	3244220	You have a medical device bug bounty,
3244220	3246380	for example. If that's a good or a bad thing,
3246380	3248360	we could talk hours on that.
3248360	3250340	But you don't have the issue of patient health
3250340	3252220	information. And so hospitals
3252220	3253300	can't offer
3254660	3256440	hackers to come in and poke
3256440	3258420	around the periphery of their networks or to
3258420	3260260	give them that type of
3260260	3262480	experience because of a couple things. One,
3262480	3264420	their live networks are taking care of patients
3264420	3266320	we would hate for something bad
3266320	3268320	to happen. But then two, there's
3268320	3270340	so much protected health information floating
3270340	3272400	around a hospital's network. And if
3272900	3274100	a security researcher or hacker
3274100	3276580	in good faith
3276580	3278780	trying to do right finds something
3278780	3280620	and it happens to be commingled
3280620	3282580	with patient health information, then the
3282580	3284560	hospital is required to report that as
3285040	3286220	a HIPAA breach, right?
3286220	3288600	So there are some, perhaps
3288600	3290420	some would call barriers, perhaps
3290420	3292660	some would call safeguards. But what I think
3292660	3294020	it's done is it's made
3294580	3295320	not just
3296240	3298800	the delivery of healthcare itself
3298800	3300540	particularly difficult
3300540	3302620	to engage with from
3302620	3304740	the hacker perspective. And I
3304740	3306680	think maybe we don't have to figure out
3306680	3308740	that solution. Maybe that's one of the solution bounties
3308740	3310940	we should offer. How can hackers get more involved?
3310940	3313020	Give us your ideas. But particularly
3313020	3314800	at hospitals where we've talked
3314800	3316860	about they don't have a lot
3316860	3318680	of in-house security expertise, if
3318680	3320840	anything, but yet they're still
3321940	3322720	asked to do
3322720	3324080	all of that work.
3324280	3326540	How can the community come together and help them out?
3326540	3329140	Because that could be a lot of good right there.
3329320	3330640	One very easy answer
3330640	3332560	to that is just working in healthcare, right?
3332560	3334400	So I would encourage anybody who's thinking about
3334520	3336580	a career change, if you're
3336580	3338420	looking for an area where you can make an
3338420	3340020	incredible impact and
3340360	3341500	have a lot of really challenging
3342340	3344100	problems to solve,
3344100	3346440	consider working for a hospital or a
3346440	3348520	healthcare delivery organization or being adjacent
3348520	3350380	to that in some way.
3350380	3352600	We know that some of these
3352600	3354460	hospitals we talked about in certain areas are
3354460	3356280	critically underserved and may not even have a
3356280	3358440	full-time IT security professional.
3358440	3360260	So one way to get involved is just
3360260	3362280	to join that
3362280	3363920	effort as an actual
3365040	3366240	employee of a healthcare
3366240	3367440	organization.
3368600	3370460	I've got some specific suggestions
3370460	3372360	I think, and it's funny that you bring up
3372360	3374440	HIPAA and other things like that,
3374440	3376540	because I think one of the
3376540	3378200	best ways that
3378200	3380260	folks like these could get involved,
3380260	3382160	whatever,
3382160	3384320	there are actually specific programs
3384320	3385920	that are being offered now within
3385920	3387900	the federal government
3389000	3390300	that puts you
3390300	3391920	in policymakers' offices
3391920	3394000	and lets you be the cybersecurity expert
3394000	3395800	in the room for those people.
3396800	3398020	There's the Tech
3398020	3400100	Congress Fellowship. Some of you
3400100	3402120	may have heard of it. Some of you may have met
3402120	3404000	some of the fellows. Chris
3404000	3406140	Segoian, who's probably
3406540	3408100	a well-known name for some
3408100	3410200	of you all, was a Tech Congress fellow.
3410200	3412120	He now works permanently for a senator
3412120	3414660	and is that senator's tech person.
3414880	3416180	But there's been
3416180	3417920	dozens of others. They've
3417920	3420080	got great folks. It's a great program.
3420080	3421980	Places you with either a House
3421980	3423600	office or a Senate office.
3425160	3426020	And so that's one of the most
3426020	3427660	direct ways that you can actually influence
3428240	3429920	policymaking in this sense, is actually
3429920	3432380	go be in the room when the policy is being made.
3432540	3434220	So I would highly recommend that.
3434420	3435840	I don't know when the application process
3435840	3437360	opens for next year's class, but
3437360	3440020	Travis Moore is your man, so go find Travis.
3440520	3441680	The other thing I would mention
3441680	3443820	is I Am the Cavalry.
3443820	3445580	When I Am the Cavalry
3445580	3447600	was first started, it
3447600	3449500	was kind of this weird, kooky thing
3449500	3451580	for the Hill, for the
3451580	3453720	United States Congress, who's very used to dealing with
3453720	3455840	very buttoned up
3456400	3457400	everyone's suit and tie
3459180	3459980	professional trade
3459980	3461560	associations and things like that when they were
3461560	3463480	trying to get information on whatever
3463480	3465280	they needed to get information on.
3465320	3466940	And I Am the Cavalry sort of just kind of like
3466940	3468740	came up to the Hill and was just like,
3468740	3472300	Hi! We're a bunch of cybersecurity experts. We'd like to talk to you about this.
3472300	3474240	But the thing is,
3474240	3476060	they're one of the most effective advocacy groups
3476060	3478240	in national policy
3478240	3480320	making right now, because
3480320	3482300	they were just so...
3483540	3484300	everyone could
3484300	3486160	tell in a city where sometimes
3486160	3487900	people's motivations are a little bit
3488980	3489940	shrouded,
3489940	3492200	that they just wanted to be there. They were there
3492200	3494140	with good faith. They really just wanted
3494140	3496280	to do the right thing, and they were going to answer
3496280	3498340	whatever questions needed answering without
3499200	3500160	bias.
3500160	3502080	And so I know
3502080	3504060	SEA works a ton with
3504060	3505600	I Am the Cavalry. I know
3506620	3508080	that Hill works a ton
3508080	3510060	with I Am the Cavalry. And so
3510060	3512000	if you want
3512000	3513900	to get involved and have an opportunity to meet
3513900	3515860	with the movers and shakers of the
3515860	3517980	country of cybersecurity policy,
3517980	3519840	I Am the Cavalry is another really
3519840	3521360	great place to do that.
3525240	3526640	I just would like to
3527160	3528680	perhaps add that from my
3528680	3530720	other perspective, if
3530720	3532960	you want to get a hold of working
3532960	3534200	in a hospital or
3534740	3536720	getting your hands just on some medical
3536720	3539080	equipment or just having a conversation
3539080	3540500	with the manufacturers.
3541020	3543140	Three years ago, I spoke at Biohack
3543140	3544640	Village. This was my first
3544640	3546220	DEF CON. This was my first
3547020	3548800	ever meeting another group
3548800	3550500	of hackers like myself.
3551580	3552820	And that's how I
3552820	3555120	was set on the path to do research.
3555120	3556780	That was how I got access
3556780	3558960	to devices. I no longer had to smuggle
3558960	3560960	them through customs at an airport
3561440	3562940	because I bought them on eBay
3562940	3565060	or, you know, because you
3565060	3567340	can't buy them in South Africa, right?
3567460	3569560	So I would buy them in the UK.
3569560	3570900	I could have visited a friend and
3570900	3572940	I put them in my luggage and smuggled
3572940	3574940	them back home so that I could work
3574940	3576800	on them, right? Or
3577200	3578840	even, you know, when they exploded
3578840	3580900	my first device, I said, hey, give me,
3580900	3582920	give me, give me. I want to have that on my doctor's
3582920	3584960	wire, like sentimental reasons, of
3584960	3586840	course. But
3586840	3588700	that's how I got my hands on. But
3588700	3590720	here I walked into a place in Vegas
3590720	3592900	that had devices, that had a lab,
3592900	3594820	that had everything that, you know,
3594820	3596960	makes a young hacker's heart, you know,
3596960	3598700	do jumps. So
3598700	3600860	if that tickles your fancy, then
3600860	3603360	that's somewhere that you should go visit,
3603360	3604860	right? You should go try your
3604860	3606680	hand at it. You should go
3606680	3609120	play with those devices, speak to the manufacturers
3609120	3611340	and go see how they implement it.
3612100	3613060	And I mean,
3613060	3614700	even if you're a patient, nothing
3614700	3616740	precludes you from giving advice
3616740	3618760	at a hospital. I mean, I've
3618760	3620760	given advice from my ICU bed.
3620760	3622440	There's a reason I'm not allowed a laptop
3622440	3624580	in anymore, right? Except
3624580	3627080	for that the doctor wants me to waste more.
3627080	3628800	Apparently, that's the reason. But
3628800	3631160	I mean, give advice.
3631240	3632580	Reach out. Get
3632580	3634300	involved. And if
3634300	3636500	someone doesn't want to listen to you the first time,
3636500	3639020	keep on trying, because it's a patient's game.
3639020	3640980	Right? It's not going to happen overnight.
3641500	3642700	I've learned. I've
3643440	3644900	dealt with many parties
3644900	3647000	and it's not going to happen fast
3647000	3649420	because it's a big industry.
3650200	3651100	Just get involved.
3651100	3652420	Get your hands dirty.
3652680	3654900	Because that's how we change the world.
3655100	3656800	Every new researcher that comes in
3656800	3659360	the fold is a new mind that thinks differently.
3660120	3661060	And that's, I think,
3661060	3663620	how we change things one step at a time.
3664900	3667060	I love that, because I think the
3667060	3668780	idiosyncratic notion that
3668780	3670800	it takes a specific individual or
3670800	3673080	an elite person or someone who's an expert
3673080	3674740	to make a change
3674740	3676440	is absolutely a misconception.
3676780	3678800	The notion of just getting
3678800	3680960	involved, there's no inner circle here.
3680960	3682960	I think every person in this community
3682960	3684800	is more than willing to share their
3684800	3686500	network, share their expertise, and share
3686500	3688780	whatever corner of this problem that
3688780	3691200	they have. It's a really hard problem.
3691260	3692860	And we need all the talent that we
3692860	3694660	can muster up right now to
3694660	3696440	really make a change. And I think if we
3696440	3699020	look at the diversity of roles,
3699020	3701260	functions, experience, thought process,
3701260	3703300	background, education, everything,
3703300	3704900	any under-representation
3704900	3707060	of that population is indicative
3707060	3708680	of missing a potential
3708680	3710920	attack factor. And we really have to
3710920	3713140	account for that and try to bring in as many folks
3713140	3714100	as we can.
3714960	3717440	Yeah, I think this is a call to arms, right?
3717440	3719100	This is a how many hackers can
3719100	3720840	we round up in one go?
3720840	3723660	Not just even hackers, right?
3723700	3725100	You know, everyone
3725100	3727080	from physicians, from patients,
3727080	3728740	from builders
3728740	3730520	and policy makers. I think
3730520	3732680	if we start breaking down the
3732680	3734700	silos, which we've been
3734700	3736660	functioning in, and
3736660	3738680	independently working and start
3738680	3741000	this collective movement,
3741000	3743280	that's how we change the world.
3744440	3745120	It's
3745120	3746800	not a one-person thing.
3746800	3748840	It's never going to be one person
3748840	3750260	that's going to come up with the magic
3750880	3752620	solution or the
3752620	3754320	silver bullet, right?
3754320	3756340	It takes more than
3756340	3758240	one village, as I
3758240	3760540	always say, to solve the problem.
3761300	3762580	And I think it's time
3762580	3763660	in 2020
3764580	3766060	that we as a society
3766060	3768340	pull together instead of apart.
3769200	3770160	Because we've seen
3770160	3772640	what a virus can do,
3772640	3774680	right? It's locked us in our houses.
3774680	3776240	So I think it's time we take our
3776240	3778320	power back and we start moving the world
3778320	3780600	into a positive future.
3781000	3782180	Because I can tell you
3782180	3783940	from a patient perspective, not having
3783940	3786240	access to being able to go into a cardiologist
3786240	3788740	office because we're afraid of COVID,
3788740	3790200	because currently it's more dangerous
3790200	3792040	going into a hospital.
3792780	3794360	A denial of patient
3794360	3796260	care is a
3796260	3798080	non-acceptable,
3798080	3800220	non-negotiable. I'm not going
3800220	3802240	to stand for it. And I think we should
3802240	3804420	be kicking down the doors and saying,
3804420	3806260	you know, now's the time.
3806260	3811200	Not yesterday, now.
3811200	3811740	I love it.
3811740	3813920	Are there any better sentiments to go out on
3813920	3815160	than that?
3816100	3816840	I think
3817900	3819240	it's easy to be cynical
3819240	3821580	about all this. And it's easy to say we're having the same
3821580	3823560	conversations year after year and the problems
3823560	3825380	are still there. But I mean,
3825380	3827760	in 2015, the Biohacking Village didn't
3827760	3829260	exist. And the idea of people
3829260	3831800	from device manufacturers bringing stuff
3831800	3833560	for hackers to poke
3833560	3835920	and prod at would be laughed out of the room.
3835920	3837640	So for people who
3837640	3839520	don't believe that we can do awesome
3839520	3841360	things when we work together and hang out at places
3841360	3843260	like DEF CON,
3843260	3845300	we have evidence to the contrary.
3845740	3847480	I think that's about
3847480	3849540	an hour. And I'm looking forward
3849540	3851360	to seeing you guys in a little bit
3851360	3852920	for a Q&A.
3854700	3855880	Take care, everyone.
3855880	3857460	Thank you, DEF CON, for having us.
3857460	3859160	A shout out to Nikita,
3859160	3861900	especially, for taking another shot at us.
3861900	3863400	We're going to go ahead and open it up to
3863400	3865160	Q&A here in 5,
3865160	3867620	4, 3, 2,
3867620	3868400	1.