WEBVTT 00:00.000 --> 00:03.580 Welcome, DEF CON 28, the Do No Harm panel. 00:03.580 --> 00:06.020 This is a healthcare security conversation. 00:06.140 --> 00:14.500 And for the next 45 minutes, followed by a 45-minute Q&A, you're going to hear from some of the world's top experts on the healthcare cybersecurity space. 00:14.540 --> 00:15.260 Welcome. 00:17.080 --> 00:18.040 Thanks, Kwadi. 00:18.120 --> 00:19.280 I'm Replicant. 00:19.280 --> 00:28.320 We're going to get out of the way here in just a moment and introduce you to our panelists, but obviously a little bit different of a venue for us than the last couple of years. 00:28.320 --> 00:35.360 We hope that everyone is staying safe and healthy and we're thinking of you and look forward to when we can hang out together in person. 00:35.740 --> 00:40.500 Without any further ado, I'm going to let our panelists take it away and say hi. 00:42.080 --> 00:43.140 Hi, everyone. 00:43.140 --> 00:44.380 My name is Ash Luft. 00:44.380 --> 00:49.300 I am a biochemist, a computer scientist, and an electrical engineer. 00:49.480 --> 00:51.720 I work as a medical... 00:51.720 --> 01:00.600 I work at a medical device firm called Starfish in Canada, and I'm a software engineer there and an advocate for security and privacy. 01:02.910 --> 01:04.820 I think that means that I'm next. 01:04.820 --> 01:07.740 So I don't have a handle, unfortunately. 01:07.740 --> 01:09.820 So I am Jessica Wilkerson. 01:09.820 --> 01:17.180 I'm a cyber policy analyst with the Food and Drug Administration, and I work on cybersecurity policy there for medical devices. 01:17.420 --> 01:25.880 Some of you may know me from my previous time with the United States Congress Energy and Commerce Committee where I worked on cybersecurity policy for them. 01:25.880 --> 01:27.480 Very nice to talk with everyone. 01:27.480 --> 01:28.360 I'm looking forward to the panel. 01:28.360 --> 01:29.260 Thank you. 01:33.040 --> 01:34.820 Hi, this is Vi. 01:34.820 --> 01:35.920 Everyone should know me. 01:35.920 --> 01:38.600 The short, the sweet, the sassy, the spunky. 01:38.840 --> 01:47.520 I'm leaving my company for the wild fields in Norway where I'll be having a whole host of minions to help me do medical device research. 01:47.520 --> 01:54.800 Currently doing independent research for Medtronic, aiding them to get more visualization on their products and their security. 01:54.880 --> 02:02.940 I'm an advocate for patient rights as well as keeping things safe, keeping it simple, keeping it stupid, as I say. 02:03.620 --> 02:06.100 And that's me, short and sweet. 02:07.860 --> 02:09.080 And that leaves me. 02:09.080 --> 02:10.720 My name is Vidya Murthy. 02:10.720 --> 02:17.100 I work for MedCrypt, a startup in the space of bringing cybersecurity features to medical devices. 02:17.220 --> 02:27.480 I absolutely am passionate about the subject matter and think that we're at an inflection point here and there's going to be a big amount of change as we go forward. 02:30.130 --> 02:36.450 Well, on behalf of Claudia and myself, we are just so incredibly grateful to have an amazing panel this year. 02:36.710 --> 02:47.690 And for those of us who are joining us for the first time, and this is kind of one of the silver linings, I think, about this format, is that in past years, we've had folks who wanted to kind of get in on this conversation that weren't able to due to space constraints. 02:47.690 --> 02:54.110 So we're really thankful for the opportunity to have anybody who wants to come in, listen in and join with us to be able to do so. 02:54.110 --> 03:10.150 So for those who may not be familiar, what we're going to do is we're going to have a little conversation here between the four of these awesome panelists, and we're going to stay out of it as much as possible, but get their insights and kind of what their thought processes are and some of the things we've been seeing in the space lately. 03:10.150 --> 03:14.930 And then part of this session will be a live Q&A follow-up conversation afterwards. 03:15.830 --> 03:25.510 So we don't really have a formal set of questions like most of these kind of more rigid panels do, but I do want to kind of start off on a little bit of a brighter note. 03:25.510 --> 03:31.810 I think some of the times that we've had this event in past years, we spend about 45 minutes talking. 03:31.830 --> 03:34.810 The term dumpster fire comes up not infrequently. 03:34.970 --> 03:44.790 And then at the end, we try and push a little optimism because there really is a lot to be sort of hopeful about in large part because of the types of things that we're able to do at places like DEF CON. 03:44.790 --> 04:00.950 But I want to kind of start off this time upfront by asking each of our panelists, what are some developments lately that have helped make you feel particularly hopeful or optimistic about where we're heading in healthcare security before we get into some of the challenges that still remain? 04:00.950 --> 04:05.470 So kind of toss it back to our panel for us to get a little dose of optimism. 04:06.650 --> 04:13.990 Yeah, so I think looking at this year in particular, we've seen more and more devices going home with patients. 04:13.990 --> 04:20.670 We've seen hospitals go online in a way that they've never planned to in 10 years from now, right? 04:20.670 --> 04:34.610 And I think the notion that we can now build security into this and need to, to let patients have confidence in them operating from their homes, is something that seems to be top of mind for folks and actual common practice. 04:34.610 --> 04:41.510 So it feels like a confluence of various factors that are coming together at just the right moment. 04:41.510 --> 04:43.850 So we have this push of devices leaving the hospital. 04:43.850 --> 04:49.490 We have this push of device vendors really getting into the narrative more than ever before. 04:49.490 --> 04:56.550 And this collaboration like DEF CON brings together with researchers and devices themselves. 04:56.550 --> 05:05.450 And I just, I have a lot of hope that this year has the momentum behind it to really get this to stick and have the forces that are really gonna make this last in the future. 05:09.560 --> 05:20.260 Yeah, so I echo that, but I've also seen this big push, I find it past three years, where you could not even have a conversation with a manufacturer, right? 05:20.260 --> 05:21.580 It was a brick wall. 05:21.580 --> 05:23.360 This year we're having conversations. 05:23.360 --> 05:25.580 This year we invited to the table. 05:25.840 --> 05:30.720 Hackers are no longer the criminals that are lurking in the darkness. 05:30.720 --> 05:32.080 We've brought things to light. 05:32.080 --> 05:35.840 We're having difficult conversations, but we're having them. 05:35.840 --> 05:38.240 And I think that's a major push forward. 05:38.240 --> 05:49.120 But except for that, we now having developers and engineers think more security wise, we've started to change the cultures of working in silos to start working as a collective. 05:49.320 --> 06:00.360 And one example that I've seen is the way that the community is jumping with the 3D printing, PPE, mask making, supporting medical people where they can. 06:00.360 --> 06:07.420 And I mean, even the CTI league that's protecting hospitals around the globe from cyber criminals. 06:07.460 --> 06:14.940 I mean, that is just a collective pool of humanity showing that if we work together, we can change the world one button at a time. 06:15.160 --> 06:17.120 What do you think, Jessica? 06:18.060 --> 06:20.060 Oh, I like the prompt. 06:20.940 --> 06:28.500 I mean, I think I started working on healthcare cybersecurity issues, I think right around 2015, 2016 timeframe. 06:28.520 --> 06:32.620 And at that point, obviously I was working on them for the United States Congress. 06:33.680 --> 06:36.320 And it was just an entirely different conversation. 06:36.320 --> 06:44.700 I mean, the things that we were talking about, you know, like V had said about let's bring in security researchers, let's have them be part of the conversation. 06:44.700 --> 06:47.660 They have valuable experience and things to contribute. 06:47.800 --> 06:49.340 That was just such a non-starter. 06:49.840 --> 06:53.640 And you had all these manufacturers who absolutely were never going to do that. 06:53.640 --> 06:55.540 That was completely unacceptable. 06:55.540 --> 07:03.540 We are still, in some cases, getting asked for help by the manufacturers to essentially be like, can you make this problem go away? 07:04.500 --> 07:09.060 And there were just other policy issues, you know, that have come up over the years. 07:09.280 --> 07:11.280 I work a lot on legacy device issues. 07:11.280 --> 07:14.100 I work a lot on software transparency issues. 07:15.120 --> 07:18.820 And they always started out as, this is never going to happen. 07:18.820 --> 07:20.100 We're never going to be able to do this. 07:20.100 --> 07:22.200 The industry will never accept this. 07:22.460 --> 07:26.660 And in 2020, it's completely different. 07:26.660 --> 07:28.260 I work on those issues every day. 07:28.260 --> 07:30.540 They are starting to be operationalized. 07:30.680 --> 07:35.560 Security researchers are a huge part of medical device and healthcare cybersecurity overall. 07:36.000 --> 07:38.120 And we've just really made so much progress. 07:38.540 --> 07:43.000 And we've made the progress in such a way that it has its own momentum now. 07:43.000 --> 07:44.660 It's going to carry itself through. 07:44.660 --> 07:48.060 And I just think that that really can't be overstated how valuable that is. 07:50.040 --> 07:52.620 Yeah, so I agree with what everyone said. 07:52.640 --> 07:59.880 I would say that I think one of the biggest things I've noticed in the last five, 10 years is the people. 08:00.080 --> 08:03.520 So community and like the number of people sort of coming together. 08:03.520 --> 08:11.860 There seems to be lots of different groups and organizations popping up, like even the last couple of years, advocacy groups, people working together. 08:12.140 --> 08:13.860 Yeah, medical device manufacturers. 08:13.860 --> 08:27.540 I mean, even when I, you know, five years ago started having these conversations and asking questions about security and privacy, it was harder to find other people to even have a discussion with about these things. 08:27.540 --> 08:38.860 And now it just seems like there's this momentum that's really building and the number of people are just getting who are engaged and want to make a difference and want to be a part of the conversation is growing. 08:38.860 --> 08:49.860 And I see that as a huge positive thing because realistically, like the more people that we have participating in the conversation, the more action that we're going to be able to take sooner and faster. 08:51.620 --> 09:02.900 Yeah, I think one of the big things also is we've seen physicians coming to the table and wanting to learn more about the devices they have and work with, right? 09:02.900 --> 09:06.420 It's not just the security people driving it or policy driving. 09:06.420 --> 09:13.020 And I think the healthcare industry has come back into a bang and saying, how can we make this better for our patients? 09:13.220 --> 09:18.340 Because in the end, I think every physician wants to make it safer for their patients. 09:19.020 --> 09:26.000 And that's a big thing for me that I've seen this year is the physicians coming to the table saying, well, how can we learn more? 09:26.480 --> 09:33.360 How do we translate this to our patients in a way that they understand? 09:36.020 --> 09:37.960 Yeah, yeah, I think that... 09:38.520 --> 09:40.940 I love conference calls. 09:40.940 --> 09:45.240 I was going to say, you know, I'd really... 09:45.240 --> 10:02.000 I'd echo that because I think, you know, even going beyond patients and things, one of the things that my boss is really quite insistent on, and you probably all know Suzanne Schwartz one way or another, is the shared responsibility of the healthcare sector, 10:02.000 --> 10:05.100 where, you know, even we are the Food and Drug Administration. 10:05.100 --> 10:06.340 We can only do so much. 10:06.340 --> 10:09.000 We have jurisdiction over the medical device. 10:09.000 --> 10:10.920 We don't have jurisdiction over hospital networks. 10:10.920 --> 10:19.740 We don't have jurisdiction over other parts of it that, you know, sometimes that are certainly implicated in cybersecurity concerns. 10:19.820 --> 10:33.360 And so, you know, there's traditionally been a very fraught relationship between, for example, medical device manufacturers and healthcare delivery organizations, so hospitals and others. 10:33.500 --> 10:43.200 And what I've started to see and have personally experienced over the last couple of years is a greater and greater breakdown of the barriers between those two groups. 10:43.200 --> 10:50.320 So with some of the partnership groups that exist, I spend a lot of time working with the Healthcare Sector Coordinating Council. 10:50.320 --> 10:59.480 For example, you have hospital CISOs who are on the phone every day with global product security officers at medical device companies, and they're just having conversations. 10:59.480 --> 11:03.580 I mean, sometimes they're just shooting the shit, and sometimes they're actually talking about work stuff. 11:03.580 --> 11:10.580 Those relationships being there and being already established are just so meaningful. 11:10.580 --> 11:16.640 It allows the progress in the sector to be made so much faster and problems to be addressed so much quicker. 11:16.780 --> 11:25.580 And so I would echo what V said about, you know, we're having almost new entrants into the conversation that's letting the conversation really take off. 11:26.780 --> 11:28.260 I just want to say... 11:28.260 --> 11:29.120 Sorry. 11:29.600 --> 11:30.900 Go ahead, Christian. 11:30.900 --> 11:46.020 I just want to say these are all fantastic insights, and I love to hear the optimism around how the conversation's changed, because every year when we have this event, we undoubtedly have to talk about an event that's happened during the year, you know, 11:46.020 --> 11:53.420 whether or not it's WannaCry, or whether or not it's a security researcher that's been shunned or threatened by a device manufacturer. 11:53.420 --> 11:59.560 And for, I think I can say this is the first year where I have not been publicly aware of such an event. 11:59.560 --> 12:09.060 And so I think that's really proof to what everyone's saying here is at least part of the interaction with hackers has changed. 12:09.060 --> 12:13.220 Now, whether or not that'll stick or whether or not this is just an off year, I think we'll have to see. 12:13.220 --> 12:24.760 But when we have strong partners in this space, you know, hackers coming together with health organizations and device manufacturers welcoming their collaboration, everyone wins. 12:24.760 --> 12:28.400 And that's really what makes patients safer at the end of the day. 12:28.540 --> 12:36.500 I wanted to just also say, though, a lot of what was discussed is optimism around this is a great year. 12:36.540 --> 12:38.400 It's also a horrible year. 12:38.400 --> 12:41.600 COVID, like 2020 is one I would love to forget. 12:41.600 --> 12:45.440 There are so many things about this year that have absolutely sucked. 12:45.860 --> 12:51.940 One of the things that's been voiced to me by a variety of people is, you know, how is COVID going to impact this? 12:51.940 --> 13:00.420 You know, how is COVID going to impact hackers, security researchers, security professionals, and the momentum that we have made? 13:00.720 --> 13:16.900 Because there's legitimate concern, I feel, that, you know, a lot of security work, a lot of securing these types of spaces costs money, and how a lot of that money is being sucked from what would be security budgets into responding to COVID. 13:16.960 --> 13:22.060 And as a consequence, do people here think we're going to see a regression? 13:22.060 --> 13:23.600 You know, we've made 10 steps forward. 13:23.600 --> 13:29.460 Are we going to go five steps back because COVID really stopped it, stopped the momentum? 13:29.460 --> 13:31.180 Love to hear your guys' thoughts. 13:32.660 --> 13:35.040 So I'll start. 13:35.040 --> 13:36.160 Sorry, Vidya. 13:36.920 --> 13:39.940 I think it's broken the perimeter, right? 13:39.940 --> 13:44.820 It's forced us to pull up our socks, right? 13:44.820 --> 13:48.900 The healthcare perimeter is now no longer within your hospital. 13:48.900 --> 13:52.640 You have patients at varied areas and everything is different. 13:53.070 --> 13:58.380 But I don't necessarily think taking 10 steps back is a bad thing, right? 13:58.380 --> 14:05.180 This year has given us time to assess, time to view the healthcare scene, the medical device scene. 14:05.180 --> 14:15.120 And if anything, force us to slow down and observe and just take note of what's happening, right? 14:15.120 --> 14:24.400 I see hospitals crumbling up underneath a pandemic, which is something that their function is to care for patients. 14:24.440 --> 14:35.760 And we see that even the biggest hospitals are struggling and that perhaps we just need to take a step back and rebuild. 14:36.400 --> 14:42.540 Maybe 2021 could be the year that we build things better instead of trying to slap a Band-Aid on. 14:42.540 --> 14:45.000 We do things right and we do things better. 14:46.560 --> 14:48.400 From the ground up. 14:49.740 --> 14:53.420 Yeah, I love that notion of taking the time to rebuild. 14:53.420 --> 15:03.500 I mean, we've seen where healthcare facilities have already been compromised before they saw their first patient as part of trying to meet the need for COVID. 15:03.780 --> 15:14.140 One of the things I worry about is, in some sense, I think there's this urgency from a clinical perspective to get devices out to patients and kind of solve some of the medical problems. 15:14.400 --> 15:25.920 Has that resulted in these devices having security measures that were intentionally not so robustly built in from the beginning just so they could get out and treat these patients? 15:25.920 --> 15:27.060 And what do you do now, right? 15:27.060 --> 15:28.760 Can you walk that back? 15:28.760 --> 15:30.720 Can you say, hey, give all those devices back to us? 15:30.720 --> 15:32.660 We don't want to necessarily see it. 15:32.660 --> 15:43.560 So I think your point of needing to build from the beginning is absolutely heard, but I wonder if you're realistically able to call pause on the care that's already out there. 15:44.420 --> 15:45.420 I don't know. 15:45.420 --> 15:48.740 I mean, I always refer to it as the legacy problem, right? 15:48.760 --> 15:51.820 Literally, it's a sea of devices out there. 15:51.820 --> 15:57.540 And I mean, if you look at the number of devices out there every year, it just increases exponentially. 15:57.540 --> 16:00.120 I mean, the maths blows my head. 16:00.120 --> 16:04.280 I sat in it the other day knowing, well, how do we solve this? 16:05.020 --> 16:09.700 And I think one of the solutions is to do things going better forward, right? 16:09.700 --> 16:16.640 Is not to introduce new devices with the same flaws and the same vulnerabilities and adding to our problem. 16:16.680 --> 16:22.960 Because those devices, if you take an ICD, for example, can last an excess of a decade. 16:23.040 --> 16:32.860 If that's 600,000 devices implanted a year, lasting 10 years, it is an ocean that you're trying to boil. 16:33.540 --> 16:38.980 You can't necessarily say to someone, hey, I need to catheterize your device because it's got a flaw in. 16:38.980 --> 16:42.620 My device has got a flaw in that I'm fully aware of. 16:43.140 --> 16:44.840 But what are the options? 16:45.060 --> 16:50.240 I have to go for 10 years with this device until it's made better. 16:50.460 --> 16:56.320 But these devices were not built with a security as a functional requirement. 16:56.740 --> 16:58.520 It's a clinical requirement. 16:58.520 --> 17:06.580 And I think if we start shifting and start building and designing with security in mind, we can start addressing the problem forward. 17:06.580 --> 17:14.580 In terms of the legacy problem, I actually don't know how to boil that ocean, to be honest with you. 17:16.940 --> 17:19.560 Yeah, I like what everyone is saying. 17:19.560 --> 17:27.260 I like the idea of being able to rebuild and taking a step back to think about how we want to solve some of these problems. 17:27.260 --> 17:30.060 I think that in practice, it's really hard. 17:30.060 --> 17:47.320 Again, with the clinical, looking at the clinical perspective, like right now, we're working on trying to create a massive number of respirators and ventilators in a short period of time and make them safe and make them functional. 17:49.940 --> 17:55.180 If it costs more and it takes more time to add the security, it's hard to make the argument. 17:56.620 --> 17:57.940 What's more important? 17:57.940 --> 18:18.880 If people are dying and it's literally minutes, hours makes a difference between life or death and you can get one more ventilator into a room, if it took an extra two day, even day to add security, let's just say for the sake of this problem, is that worth it? 18:18.880 --> 18:23.520 Whose lives should we sacrifice to add the security? 18:23.520 --> 18:26.180 And like, it's tough. 18:26.180 --> 18:31.760 I don't know how we can sort of push for that and where to draw the line in practice. 18:32.080 --> 18:33.760 It's a bad thing. 18:34.920 --> 18:35.960 Sorry, Jessica. 18:36.400 --> 18:44.080 No, no, I was just going to say, you know, I think the way that we've certainly experienced it at FDA is we're doing things in parallel. 18:44.140 --> 18:56.380 So I have been very blessed in my time at FDA not to have been fully pulled into the COVID response, but I'm still 100% on cybersecurity. 18:56.380 --> 19:10.320 And essentially what that's allowed us to do is while, you know, a significant portion of the agency is all in on COVID and figuring out what they need to do and doing some of the things exactly what you all are saying, getting devices to patients who need them. 19:10.440 --> 19:16.020 We also still have a very dedicated team at FDA looking at cybersecurity. 19:16.560 --> 19:24.500 And another thing that I was really lucky when I came into FDA, I think everybody, you know, elementary school feels like a bajillion years ago. 19:24.500 --> 19:30.720 But, you know, like you'd like walked into elementary school and there's that one person there who's just like, you're like, we're going to be best friends. 19:30.720 --> 19:32.820 We're going to do great things together. 19:33.100 --> 19:38.040 For those of you who have not met Matt Hazlett, he probably is like sick of me talking about him. 19:38.040 --> 19:40.280 But anyway, Matt Hazlett is great. 19:40.280 --> 19:48.420 And he is the essentially the one of the leads at FDA for doing cybersecurity reviews of devices as they come in. 19:48.420 --> 20:03.380 And so at the same time that all of this is going on with COVID, what Matt and his team within the device review office at FDA have really started doing is they're getting tighter and tighter and tighter and tighter at looking at exactly what you all are saying. 20:03.380 --> 20:09.080 We're learning so many lessons from deployed devices about vulnerabilities that are showing up. 20:09.080 --> 20:16.720 We're learning so much about what manufacturers maybe aren't doing on the front end that are causing problems on the back end. 20:16.720 --> 20:31.820 And what Matt and his team have really been able to do is they're taking all of those things, they're taking the vulnerabilities that are showing up in post-market, they're taking the missing pieces of the process, the gaps in the process in the development of medical devices, 20:31.820 --> 20:42.880 and they're putting that into the pre-market review process where they're essentially saying, okay, we are learning every day how to get better at reviewing devices and they're implementing it. 20:42.880 --> 21:06.440 So I think while we're certainly seeing issues or there's just this very valid urgency about getting devices out where they need to be, we also still have this very robust mechanism at FDA in particular for making sure that anything that we're learning, 21:06.440 --> 21:11.560 anything that's coming up with regard to cybersecurity is actually making it back into our process. 21:15.590 --> 21:19.890 Yeah, which the one thing I would say, I think that the financial, which was the original question, right? 21:19.890 --> 21:23.210 What's the financial drain going to have an impact on these devices? 21:23.210 --> 21:25.730 I think that's exactly, there's almost a compliment there, right? 21:25.730 --> 21:41.970 If we can get the financial decisions to be informed by what the pre-market is telling us in terms of meeting certain security requirements and really having that be key criteria and decisions and not just, no offense to the clinicians, the clinician really likes this one brand and that's what they're going with. 21:41.970 --> 21:47.370 Having it be part of that core decision, I think absolutely will drive that change. 21:48.730 --> 21:55.710 My only decision about whether or not I use a device is how many 5G microchips I can inject into a patient. 21:56.010 --> 21:57.930 Wait, does it have to say AI in it? 21:58.550 --> 22:00.990 No, that's the blockchain version. 22:01.090 --> 22:02.150 That's 4G. 22:02.210 --> 22:03.490 This is being recorded, man. 22:03.490 --> 22:05.450 That is going to be clipped. 22:05.450 --> 22:07.170 That is going to be taken out of context. 22:07.170 --> 22:10.390 It's going to be viral on Twitter in the next couple of days. 22:10.810 --> 22:14.610 And we're going to hear about how doctors are part of the 5G conspiracy. 22:14.610 --> 22:17.510 So, strong work on that one. 22:18.010 --> 22:20.430 Yeah, well done. 22:20.670 --> 22:22.550 What I did want to ask, right? 22:22.550 --> 22:28.210 So I'm going to turn it, I want to ask Christian and Jeff a question, seeing as we're being grilled here. 22:28.690 --> 22:31.110 You as clinicians, right? 22:31.430 --> 22:35.230 When you are making a decision for your patient, right? 22:35.230 --> 22:39.190 You know, security versus clinical functionality. 22:39.430 --> 22:41.010 How do you do that balancing act? 22:41.010 --> 22:46.290 Because you guys are unfortunate as physicians to have your feet on both walls. 22:46.370 --> 22:49.170 So from your perspective, how do you balance it out? 22:49.170 --> 22:52.450 How do you work it out in your mind? 22:52.450 --> 22:57.470 Because for us, it is security first and foremost and patient care. 22:57.470 --> 23:00.010 But we almost move from a security perspective. 23:00.010 --> 23:01.330 I've been a patient. 23:01.330 --> 23:02.850 I've seen that side. 23:02.850 --> 23:08.290 But I'm quite keen to hear from your side what your perspective on it is. 23:09.250 --> 23:11.430 Yeah, that's a great question. 23:11.470 --> 23:21.830 And I think that COVID is really starkly forcing us to understand and choose between some of these seemingly opposite goals. 23:21.830 --> 23:28.010 In medicine, we frequently have to weigh multiple different pros cons for any particular treatment or situation. 23:28.010 --> 23:33.450 A patient may need anesthesia for a procedure, but they're also very tenuous from a cardiovascular standpoint. 23:33.450 --> 23:36.970 So what's more dangerous, not getting the procedure or putting them under anesthesia? 23:36.970 --> 23:41.950 And so oftentimes you have to say, well, we need to take both into account simultaneously. 23:42.110 --> 23:48.750 And the points that we've made about the necessity and the urgency of the situation are absolutely correct. 23:48.750 --> 23:55.630 When we're in the ICU or in the OR, dealing with these patients, security is not at the forefront of our mind. 23:55.630 --> 24:00.590 What technology do we need to achieve the physiologic goals we have for that particular patient? 24:00.610 --> 24:11.830 When we go home and we talk to people like you, and we're able to put it on our hacker and security researcher hat, obviously we start to be able to understand and conceptualize the consequences of some of the downstream effects. 24:11.830 --> 24:15.390 So it is a complete balancing act 100% of the time. 24:15.390 --> 24:19.770 Anybody who tells you they have a perfect formula for that answer is lying to you. 24:19.770 --> 24:30.270 The thing that's been somewhat reassuring to me is we have had conversations with people that we work with in our hospitals and elsewhere, where they understand that you kind of have to shoot for both. 24:30.350 --> 24:39.750 And in some of our institutions, I've had people say from the disaster and emergency management side of things, hey, we're gaming out the COVID response and going on that right now. 24:39.750 --> 24:47.370 But we want to fold a security information infrastructure exercise into that as well. 24:47.370 --> 25:10.250 Understanding that some of these events, whether it's UCSF and the ransomware issue, or some of the hospitals in the Czech Republic who have been hit during this period, the underlying assumption that people are now realizing is that you need a stable infrastructure and good devices to be able to treat patients and have the best outcomes in a crisis situation like this. 25:10.250 --> 25:15.030 So deficiencies on the security side only hinder your ability to achieve your main mission. 25:15.030 --> 25:18.770 And so it's less of then a shunting of resources from one to the other. 25:18.770 --> 25:22.350 And then how can we maximally benefit both of those aspects? 25:22.550 --> 25:26.570 Which is never perfect, but it's a better way of thinking about it than a trade-off. 25:27.610 --> 25:29.270 Yeah, I just completely echo that. 25:29.270 --> 25:39.770 Like one of my nightmare scenarios is treating a hospital full of COVID patients where the ICUs are overflowing and then getting hit with ransomware, for example. 25:39.770 --> 25:58.990 So what little bandwidth we have left to handle the surge, to treat the patients as best we can, goes out the window when the digital tools we use, whether or not it's the electronic health record or connected medical devices or all of the above, would be impacted by an attack. 25:58.990 --> 26:04.730 And so it's not just maybe a little bit of impact to patient care. 26:04.730 --> 26:06.770 It's going to be huge. 26:06.770 --> 26:14.610 And one of the things we all like to talk about, and I think we all know in this space, is just how dependent doctors are on connected medical technology. 26:14.610 --> 26:20.950 Doctors, nurses, technicians, modern healthcare is exceptionally connected, hyper-connected, if you will. 26:21.130 --> 26:30.330 And a lot of doctors, you've heard us say this many times, Jeff and myself included, we haven't worked on paper charts. 26:30.870 --> 26:38.650 We've never had light boxes where we pull up a CT scan that's printed on something and put it up against a wall to read it. 26:38.650 --> 26:43.250 We've always accessed those through workstations and PAC system software. 26:43.350 --> 26:57.910 So you take what we're trained on, this digital infrastructure, this connected, vulnerable infrastructure, and you add a pandemic on top of it, and then you take away the tools that we're used to using, undoubtedly patients would suffer. 26:57.910 --> 27:00.650 So that one-two punch is definitely something very concerning. 27:00.650 --> 27:17.370 To the heart of your question, which is how do we as clinicians make that trade-off or decision about, here's a more secure device, but it has less clinical utility or functionality compared to this more secure device, etc. 27:17.370 --> 27:18.630 So how do we make that trade-off? 27:18.630 --> 27:27.210 Honestly, looking straight into the camera, it's really hard to even have any bearing on that decision. 27:27.210 --> 27:32.270 So a lot of the devices that we use every day in clinical practice, we don't choose. 27:32.590 --> 27:41.030 We show up to the hospital and there are monitors that are there because they made that purchasing decision five, ten years ago. 27:41.030 --> 27:51.970 When you train to become a doctor, you may train for four or five years on a particular set of medical devices that you're going to implant, a particular brand. 27:51.970 --> 27:54.070 You become familiar with that. 27:54.070 --> 27:56.170 And so what do you do when you get out of practice? 27:56.170 --> 27:58.230 You use the exact same one. 27:58.270 --> 28:13.070 And so, believe it or not, there's much less time to reflect and much less ability than most people believe for us to pick which devices we use in clinical practice and to make that decision. 28:13.110 --> 28:17.990 With that being said, we're trying to educate other doctors on this. 28:17.990 --> 28:21.670 And when we do, like Jeff mentioned, they care. 28:21.670 --> 28:23.370 They want their patients to be safer. 28:23.370 --> 28:25.210 They want to use secure medical devices. 28:25.210 --> 28:29.170 They don't want their patient's health information or even their health to be at risk. 28:29.170 --> 28:32.910 So we have sympathetic ears from the clinicians. 28:32.930 --> 28:37.010 We just lack the ability to make it easy for them. 28:37.010 --> 28:48.330 What you don't want is your doctor to have to go to, you know, 14 years to train to be a doctor and then go and have to take another year or two of cybersecurity coursework or whatever to become competent. 28:48.330 --> 28:58.190 You really have to make it easy for them to make the right decision and convince them that they should tell other people in their hospital and other doctors that it's important. 28:59.110 --> 29:07.550 I think to that point, that's maybe a misperception that the expectation is that everyone in this supply chain has to become a cybersecurity expert. 29:07.550 --> 29:21.790 I think maybe that's a fatal flaw in how we think about solving this is if we need to sufficiently educate individuals by having them... you're not a medical device practitioner but hey, I can teach you all about cybersecurity here. 29:22.110 --> 29:27.650 It's really hard to think that you can sufficiently educate folks that this isn't their core competency on. 29:27.650 --> 29:31.390 Not to say they can't have some level of understanding what the impact is. 29:31.390 --> 29:37.570 And I think making it tangible for their work stream or function or whatever the case may be is the perfect way to do that. 29:37.570 --> 29:48.670 But I would love to hear kind of the thought around how we think about leveraging those who are experts and not necessarily trying to solve it ourselves and going at it alone. 29:48.670 --> 29:57.510 Because I think that's probably a fatal flaw and has caused some of the historical challenge that you're talking about when you inherit a hospital full of devices that you didn't pick. 29:58.490 --> 30:12.490 And surely as well, like Jeff was saying, normally physicians are used to sort of having to balance different pros and cons and different requirements to make the best medical choice for each patient. 30:13.070 --> 30:18.730 But I think historically, maybe they weren't even aware that this is one of the things they need to consider. 30:18.730 --> 30:27.630 So even just how can we raise awareness and just in the consciousness that, oh, that's something that I need to consider even if I'm not an expert. 30:27.630 --> 30:34.170 Maybe I can have an expert on hand or I can read a rating for a device and make a decision somehow that way. 30:34.310 --> 30:38.330 You know, what kind of solutions are there moving forward in that direction? 30:39.890 --> 30:49.810 So I've actually spent some time working a lot with the cardiologists and their technicians in South Africa trying to just have the discussion. 30:49.810 --> 30:55.610 And I had a phone call from my cardiologist saying, we've had a recall of devices. 30:55.850 --> 31:01.170 I need to explant a device, but I don't know how to explain it to my patient. 31:01.170 --> 31:06.330 I don't even sufficiently understand the engineering tool on the document. 31:06.330 --> 31:07.870 Can you translate? 31:08.070 --> 31:19.830 So I think the big thing is we are using our language, our linguistics, instead of making it familiar to the medical practitioners. 31:19.830 --> 31:24.310 And I think there should be that portion in the hospital that does that translation. 31:24.730 --> 31:33.150 Because I can tell you that was a very difficult conversation having with a 65-year-old lady that doesn't understand technology. 31:33.250 --> 31:40.650 I mean, the doctor didn't even sufficiently understand why he had to explant the device that was just being recalled. 31:42.290 --> 31:47.210 And that's the unfortunate thing is they are expected to make these decisions. 31:47.210 --> 31:50.430 And as he says, he has a patient coming in. 31:50.430 --> 31:52.790 His blood pressure is high. 31:52.790 --> 31:55.590 He needs to adjust the ICD and the pacemaker. 31:55.690 --> 32:01.310 What he doesn't tell him is that his wife cooked a high-sodium meal which affected his blood pressure. 32:01.310 --> 32:04.230 And a week later, he comes back because he's having issues. 32:05.930 --> 32:08.290 Therapy has changed significantly. 32:08.290 --> 32:14.350 So those are the challenges they deal with having to solve the clinical puzzles. 32:14.430 --> 32:24.730 And I think adding the technical stuff on top of it especially using terminology they don't understand is where we've been going wrong. 32:25.070 --> 32:28.970 We should be finding ways to translate it better for them. 32:29.670 --> 32:40.050 I think that's a failure overall of how we've designed not only medical devices, but how we do cybersecurity overall. 32:40.050 --> 32:44.810 So many times if somebody gets hacked or whatever, it's their fault. 32:44.810 --> 32:56.350 Setting aside corporations who get DDoSed or whatever and claim to have been a victim of a sophisticated cyber attack, there are times when people get hit by something and it really wasn't their fault. 32:56.350 --> 33:00.150 There were so many different things that have been expected to know. 33:00.570 --> 33:05.830 And I think something a professor once said to me stuck with me. 33:05.830 --> 33:09.210 We were talking about this whole thing about people are just so dumb about cyber. 33:09.210 --> 33:10.830 Why can't they just be better? 33:10.850 --> 33:16.670 He's like, yeah, and all those people who are driving Ford Pintas, what the hell were they thinking letting their cars blow up? 33:18.190 --> 33:27.770 And I think that that's kind of the way that was sort of a lightbulb moment for me of being like, oh, we have to design devices that don't blow up in people's faces. 33:28.110 --> 33:34.330 We have to make it as easy as humanly possible to do something securely. 33:34.330 --> 33:37.490 Doing something securely needs to be the easiest thing. 33:37.490 --> 33:43.770 And if doing something securely is the most difficult thing, that's not the fault of the user who then didn't do the secure thing. 33:43.770 --> 33:47.490 That is the fault of the designer who made the device poorly. 33:47.670 --> 33:56.610 And so I think we've gotten away with, frankly, in a lot of cases , being really lazy and offloading the responsibility onto other people. 33:56.610 --> 34:09.630 And I think what we have to do, especially within the healthcare sector, is all parts of it we have to sort of reclaim the responsibility that has been ours all along and actually really do what we need to do. 34:10.570 --> 34:18.010 Yeah, I mean, the responsibility, I'm very big, the responsibility to build these things better is the manufacturers. 34:18.170 --> 34:18.790 Right? 34:18.790 --> 34:23.070 They're the ones that have the control over the firmware and the hardware. 34:23.070 --> 34:30.790 We shouldn't be pointing the finger at the hospital saying, hey, your device your network got hacked because you have vulnerable devices. 34:30.910 --> 34:33.770 Well, those should have been built better. 34:34.930 --> 34:35.490 Right ? 34:35.650 --> 34:39.690 Because now we're leading, we're in the industry now where we're putting Band-Aids on. 34:39.690 --> 34:39.930 Right? 34:39.930 --> 34:41.390 The vulnerability is disclosed. 34:41.390 --> 34:45.150 Now we have to run and we're always on the back foot fixing stuff. 34:45.250 --> 34:51.330 But the manufacturers should be stepping up and should be doing a better job at this. 34:51.490 --> 34:52.950 I completely agree. 34:54.510 --> 34:55.850 I completely agree. 34:55.850 --> 35:03.370 There's a lot that the device manufacturers can do, should do, and I think some of them have been doing. 35:03.630 --> 35:06.130 But there's also a key important thing. 35:06.130 --> 35:08.950 They can't control it once it's deployed. 35:08.990 --> 35:26.850 So if they're deploying a somewhat secure medical device on an unsecured network, or if they're turning off security controls for sake of ease of integrating into their clinical environment , or if they're not patching critical systems around these medical devices, 35:26.850 --> 35:42.890 there's some shared responsibility there, and I think that's really important, is that we need to be having not only a strong conversation with device manufacturers, they do the right thing from the start, but we need to be able to be giving hospitals the appropriate resources, 35:42.890 --> 35:47.470 education, and holding them accountable when there's something egregious. 35:47.470 --> 35:54.670 Now, I don't think they should be asked to solve the issues of insecure medical devices because they just can't. 35:54.670 --> 36:07.010 But we've seen time and time again some pretty horrible security practices by healthcare institutions that have nothing to do with medical device manufacturers, but yet still could have patient safety implications. 36:07.010 --> 36:18.350 Things like all the denial of service attacks we see, the ransomware attacks, the theft, I mean, it's not just critical healthcare infrastructure like hospitals, we've been seeing attacks on research. 36:18.350 --> 36:33.490 So I'm sure people have seen in the news, and I think Jeff mentioned, ransomware attacks on critical medical research infrastructure, state-sponsored attacks on COVID research and vaccine trials data. 36:33.490 --> 36:36.690 So we have to have a shared responsibility. 36:36.690 --> 36:37.970 This is a whole ecosystem . 36:37.970 --> 36:42.150 It's really trying to figure out what's the best bang for our buck . 36:42.150 --> 36:55.470 And I feel like a lot of the conversations focus around medical devices because it's a much easier thing to tackle than trying to go to a rural access hospital in South Dakota and fixing their broken network. 36:55.470 --> 37:06.050 And then being able to monitor that and continually say, how are you going to secure every hospital and clinic and doctor's office in the entire United States? 37:06.050 --> 37:08.730 That's a much harder problem. 37:08.850 --> 37:11.750 But I... 37:11.750 --> 37:13.630 Can I go? 37:14.710 --> 37:15.810 Oh, that's it. 37:15.810 --> 37:17.230 I'd like to... 37:17.910 --> 37:19.030 Sorry. 37:19.350 --> 37:23.510 I just wanted to say, right, it's not just a United States problem, right? 37:23.510 --> 37:25.910 It's a global problem. 37:26.050 --> 37:32.170 You know, hate to be the one to point it, but this is a big problem everywhere. 37:32.170 --> 37:35.090 And I know everyone on here is from the US. 37:35.090 --> 37:37.110 I'm the only oddball after this. 37:37.110 --> 37:38.270 I'm from Canada. 37:39.650 --> 37:41.870 I don't feel so alone. 37:41.970 --> 37:46.710 But the thing is just every hospital is different, right? 37:46.990 --> 37:50.590 There's no cookie cutter way of looking at the problem. 37:50.770 --> 37:53.010 Every hospital network is different. 37:53.010 --> 37:57.270 And I think sometimes what we forget is the patient record systems. 37:57.270 --> 37:59.970 Like, I never used to consider it. 37:59.970 --> 38:05.390 But then I sat back and thought from the cyber criminal perspective, it is the ultimate identity thing. 38:05.390 --> 38:08.350 It's the thing that you can keep selling constantly. 38:08.390 --> 38:11.450 And it's often the thing that's least protected. 38:11.570 --> 38:17.070 Because we're focusing so much on medical devices, we've forgotten what a treasure trove that holds. 38:17.330 --> 38:19.430 And I mean, that's moving to the cloud. 38:20.210 --> 38:29.410 So, you know, Microsoft is one of the big proponents that's moving everything now to the cloud in terms of patient records and clinical systems. 38:29.770 --> 38:43.290 So I'd be interested to see how the smaller hospitals are actually going to be able to cope with having to do you know, perimeterless defenses, you know, zero trust networks, or even cloud solutions. 38:43.770 --> 38:48.410 Because I think the big hospitals like Mayo might be fine. 38:48.430 --> 38:55.830 But you have the smaller rural hospitals that I don't even know if they have IT or security on the premises. 38:55.930 --> 38:59.890 Or whether they're paying someone, a third party, to do the solution for them. 39:01.390 --> 39:02.990 Yeah, I'd like... 39:02.990 --> 39:03.670 Go ahead. 39:03.670 --> 39:04.410 You go first. 39:04.410 --> 39:04.950 Okay. 39:04.950 --> 39:08.690 I wanted to go back to the topic of responsibility. 39:09.530 --> 39:12.570 And I would have to echo with Christian. 39:12.570 --> 39:13.430 I think the... 39:13.430 --> 39:15.610 I think it is a shared responsibility. 39:15.670 --> 39:19.530 Obviously, I think that, you know, I work for a medical device manufacturer. 39:19.530 --> 39:22.070 I'm a software... an embedded software engineer. 39:22.390 --> 39:23.990 I think about these things. 39:23.990 --> 39:31.390 I want to make sure that I'm doing my part to build really secure and awesome, safe products for end users. 39:31.390 --> 39:32.810 I care a lot about that. 39:33.490 --> 39:38.730 But I think it's easy to blame manufacturers, and it's often more complicated. 39:38.730 --> 39:40.190 Again, it's this balancing act. 39:40.190 --> 39:44.410 So, I work for a medical device manufacturer that's a consulting firm. 39:44.410 --> 39:46.730 So we don't have any of our own in -house products. 39:46.730 --> 39:57.210 We have people who come to us, and we have clients, and you know, some of them are business people, and some of them are other medical device manufacturers that subcontract to us. 39:57.210 --> 40:04.210 But we have a lot of people who are just doctors , and clinicians, and other people who are really passionate about saving lives. 40:04.210 --> 40:06.670 And they come to us, and they're like, we have this idea. 40:07.370 --> 40:09.150 We see this gap. 40:09.450 --> 40:11.570 We desperately want to help our patients. 40:11.610 --> 40:13.090 Please help us build this. 40:13.090 --> 40:14.990 We have this tiny, tiny budget. 40:15.010 --> 40:21.530 We only have this amount of time to do it in because we got this little budget from these people, but they say we have to get it done by this time. 40:21.530 --> 40:33.170 And we were working really, really hard to try to meet all these deadlines and actually make this little device that, you know, if we can give it to those doctors, it might save lives. 40:33.450 --> 40:43.830 And then for, you know, for us to come in and try to say, like, oh, we have to add all of these security things, and, you know, maybe it's going to affect the budget. 40:43.830 --> 40:45.070 It's going to affect the timeline. 40:45.070 --> 40:47.610 And, you know, again, I care about these things. 40:47.610 --> 40:48.390 I'm in there. 40:48.390 --> 40:49.850 I'm advocating for this stuff. 40:49.850 --> 40:55.830 But it's hard to say, you know, if you only have this much budget, and it's... 40:55.830 --> 40:56.790 how do you choose? 40:56.790 --> 40:59.510 How do you tell them, okay, you shouldn't... 40:59.510 --> 41:04.510 we just aren't going to be able to make this and implement this part of security, like, where to draw the line. 41:04.510 --> 41:05.250 I think it's... 41:05.250 --> 41:10.750 I think it's more complicated and harder, like, in practice. 41:11.070 --> 41:18.890 And it's hard to just say, well, the medical device manufacturer should just do it. 41:19.830 --> 41:21.670 You know, how do you make that choice? 41:23.330 --> 41:25.510 I actually want to add to that story. 41:25.510 --> 41:27.490 So I started working with Medtronic. 41:27.490 --> 41:28.930 And I'm a hard ass. 41:28.930 --> 41:32.790 Everyone knows that I say a bunch of things three years ago. 41:32.790 --> 41:39.730 Cool came out because I was unhappy with how our conversation went, because we had a legal situation. 41:39.730 --> 41:51.190 And I started the first six months of my project listening and getting to know the developers and the software , firmware engineers and the hardware engineers. 41:51.510 --> 41:58.670 And I sat back and listened and realized that these are real people that are wanting to make a real difference. 41:58.670 --> 42:00.010 Really, they are. 42:00.650 --> 42:08.970 And one of the specific engineers, Rob Maslow, had a big impact on my life because he said to me, he said, tell me what you want on your device. 42:08.970 --> 42:11.170 Tell me all the security you want. 42:11.350 --> 42:14.250 Get to the list to me and let's discuss this. 42:14.350 --> 42:19.110 And he turned around and said to me, well, so you're getting a new device every three years, right? 42:19.250 --> 42:23.290 And I said to him, well, no, there's no fucking way that I'm doing that to myself. 42:23.290 --> 42:26.450 And he's like, well, then you can't have all of that. 42:26.450 --> 42:29.370 He says there's trade-offs for everything. 42:29.470 --> 42:38.990 So, specifically with embedded implanted devices, the more security you add, the less lifetime you'll have on your battery. 42:39.230 --> 42:48.250 Because I can tell you the one thing that is worth gold is how long your device lasts because it is a horrible thing to cut out. 42:48.250 --> 42:57.690 And I don't know if you guys know, but the more you cut it out, the more scar tissue forms, and the worse it gets, right? 42:57.950 --> 43:00.410 I've had my device since 19. 43:00.410 --> 43:02.090 I wouldn't be here without it. 43:02.090 --> 43:05.350 So, people building these things, I would be dead. 43:05.350 --> 43:06.750 I had two weeks left to live. 43:06.750 --> 43:09.350 That was the serious situation. 43:10.210 --> 43:17.290 So, I think sometimes we want all the security in the world, but we don't realize there's trade-offs. 43:17.890 --> 43:21.050 These devices are there to save lives. 43:21.050 --> 43:29.910 And if we try and push security too much, there's a whole lot of set of devices that will never come to market and they will never save lives. 43:29.910 --> 43:42.950 And that's one big lesson that I had to learn and I had to have humble pie and I had to swallow my words and realize that you know, there's people behind this wanting to make a difference with technology and science. 43:42.950 --> 43:47.270 And without that device, I wouldn't be here. 43:47.790 --> 43:49.710 I wouldn't have my kids. 43:50.650 --> 43:53.230 So, technology does save lives in ways. 43:53.310 --> 43:57.810 We must just find the perfect balance to balance everything out. 43:58.270 --> 44:13.230 And your perspective Vee, and folks like you, like Marie Mo, who have these incredible security backgrounds, but also our patients is so incredibly valuable to be able to consider these types of trade-offs in like a human person, right? 44:13.230 --> 44:14.810 In like a very real way. 44:14.810 --> 44:24.470 And one of the things that Christian and I are working on is how do we understand the role of the patient as a stakeholder in these types of conversations? 44:26.010 --> 44:34.170 And is there a utility in having those types of conversations with this 60 -year-old man who needs to get his pacemaker revised ? 44:34.170 --> 44:41.870 Or is there a trade -off between the potential risk of a vulnerability being exploited and then putting him through that process of having it revised? 44:41.870 --> 44:54.690 And I think it highlights one of the things that Christian and I are so interested in is just developing a data and a science around this to be able to say in other types of medical therapies, we have very clear risks. 44:54.690 --> 45:04.310 You know, if I give you a blood transfusion, there's about a 1 in 1 .5 to 2 million chance that you might have an infection that's serious as a result of that or heart or lung issues. 45:04.330 --> 45:18.690 We really don't have the ability to have conversations with patients and say, this is the clear-cut risk because thankfully we haven't seen many incidents of issues and that doesn't mean that there's an absence of risk, but it makes it harder for us to have discussions with patients and say, 45:18.690 --> 45:24.610 really, this is the type of math that you have to weigh as a patient with your own values and preferences and things like that. 45:24.610 --> 45:36.290 And we've kind of done some work on touching on this idea of a cybersecurity informed consent to say, we talk about risks, you know, medical risks of surgeries and medications and things like that that they may be on. 45:36.290 --> 45:43.390 Should we start thinking about cybersecurity as a potential risk that should be included in this conversation a clinician has with a patient? 45:44.650 --> 45:54.010 And Jessica, I know the FDA is also really interested in this and you've had a lot of really cool outreach types of events to be able to talk to people like V. 45:54.010 --> 46:06.190 And I think it's that challenge of moving beyond people who are security literate to people who may not have heard about these issues whatsoever for as much as we talk about them and to be able to kind of have that enter the conversation so that they can, 46:06.190 --> 46:11.350 without having a background in cybersecurity, weigh that as part of their clinical process. 46:12.370 --> 46:16.110 Yeah, I mean, I think that there's a couple things that I would bring up on this. 46:16.110 --> 46:30.230 I mean, like, I think one, you know, you had mentioned that FDA has been doing a lot of this and I think V, you were actually at the October 2019 meeting that we had the patient engagement advisory council meeting, the peak meeting. 46:30.730 --> 46:37.410 And so FDA is very much trying to make sure that the patient perspective is heard. 46:38.230 --> 46:41.850 And it's not just yearly meetings and things like that. 46:41.850 --> 46:44.150 As many of you know, Suzanne Schwartz is very approachable. 46:44.150 --> 46:49.270 You can pretty much get her email and email her and she'll find time to talk to you. 46:50.770 --> 47:07.850 So that is a really critical part of this because, not that all of you are going around reading government white papers and things, but a couple of years ago, the FDA put out this medical device safety action plan and sort of setting aside the flowery language that all government documents, 47:07.850 --> 47:10.850 I think, were like decreed that they must use. 47:11.250 --> 47:21.650 Essentially what it says is look, it's exactly this issue of balancing the idea that patient safety is a two-fold concern. 47:21.650 --> 47:21.830 Right? 47:21.870 --> 47:25.950 There's the concern that we all typically think about on cybersecurity. 47:25.950 --> 47:32.170 Is this device safe and effective enough to justify its use with the patient? 47:32.470 --> 47:41.390 There's also the flip side of that, though, of what Ash was talking about and what V was talking about in that what happens if the patient can't get the device? 47:41.390 --> 47:45.150 That is another... that's got to be a thing that gets considered, too. 47:45.310 --> 47:47.450 And so, you know, FDA... 47:47.450 --> 47:54.570 when we talk about cybersecurity, when we usually do it, we're very explicitly talking about, do you have security controls? 47:54.570 --> 47:58.810 Do you have sufficient whatever to make sure that the device is cybersecure? 47:58.810 --> 48:11.690 But a less talked about part of the work, but that is equally important, is this idea that we recognize that sometimes devices need to get to patients because of the benefit that they're going to be able to provide. 48:11.690 --> 48:14.070 And maybe we don't have as much information. 48:14.070 --> 48:19.710 Maybe we don't have as much assurance of the things that we would like to. 48:19.710 --> 48:21.790 But, you know, this is the Breakthrough Device Program. 48:21.790 --> 48:29.670 This is some of these other investigational devices that come up and that FDA has specific categories for and authorities for things that you can do this. 48:29.670 --> 48:42.370 And it's exactly this recognition that the other folks on the panel are pointing out, which is that, in some cases, not having access to a device can be as big of a risk as having access to a device that isn't secure enough. 48:42.410 --> 48:54.970 And so, you know, I think that it is just an important point to highlight and, you know, that we as an agency keep in mind, but that this community, in addition, also keeps in mind as we have these kinds of conversations. 48:57.570 --> 48:59.350 All right, I want to change this. 48:59.350 --> 49:00.630 Oh, can I... 49:00.630 --> 49:10.070 I'm going to change the subject real quick because I heard a rumor there are thousands of hackers watching this stream right now. 49:10.070 --> 49:20.310 There are literally thousands of hackers from across the globe watching, you know, very interested in what we're talking about. 49:20.310 --> 49:26.330 And I'm sure they're thinking to themselves, wow, there are a lot of issues here I might not have been aware of anymore and they want to get involved. 49:26.330 --> 49:39.730 So, hackers out there wanting to get involved in this space, you know, how does... we've heard some examples, you know, there's been a group of hackers that have tried to defend hospitals against attackers during COVID. 49:39.870 --> 49:46.050 There are hackers printing protective equipment for doctors on the front line, etc., nurses. 49:46.530 --> 49:48.850 But , like, what's the next generation of this, right? 49:48.850 --> 49:53.330 Like, when the pandemic's done, how do hackers play a role in this space? 49:53.810 --> 49:56.510 Continuing doing research, is it bug bounties? 49:56.510 --> 49:58.910 You know, should a hospital have a bug bounty? 49:58.910 --> 50:01.390 Should a device manufacturer have a bug bounty? 50:01.450 --> 50:03.330 How does HIPAA play into that? 50:03.330 --> 50:06.630 You know, the protection of patient information. 50:06.850 --> 50:10.950 How do we really kind of bring hackers more into this space? 50:16.330 --> 50:18.510 Okay, I'm going to jump in, yeah. 50:19.550 --> 50:23.310 I have a dream and I have a dream with a friend of mine, you know. 50:23.670 --> 50:29.730 We want to establish a laboratory setup with devices , right? 50:29.990 --> 50:42.190 That people can actually do research on, that we can put on networks, that we can scan for vulnerabilities, that we can reverse engineer, that we can work with manufacturers to make better. 50:42.950 --> 50:47.150 I always see people wanting to break things, right ? 50:47.150 --> 50:55.330 We want to find flaws, we want to find problems, but often we don't want to find the solution to the problem, because that's the harder part. 50:56.050 --> 51:05.590 So I want to say that if you find a device that's vulnerable, first remember they are human lives at stake, okay? 51:05.590 --> 51:07.570 This is not an ego thing. 51:07.570 --> 51:10.850 Try and find the solution to the problem that you found. 51:11.110 --> 51:14.110 Write it up as you would any scientific paper. 51:14.110 --> 51:24.130 I know it's hard work, I know it's not glorious and it's not sexy, but when you hand that over to the manufacturer, they have all the data. 51:24.130 --> 51:30.430 And the more data they have, the faster that they can verify the claim, they can start acting accordingly. 51:31.110 --> 51:31.610 Right? 51:31.610 --> 51:32.730 It's not going to be easy. 51:32.730 --> 51:37.230 Not all MDMs are going to want to be friendly, but it is changing. 51:37.230 --> 51:45.890 But the biggest thing is the more thorough your research is, the less dispute there can be, and the more we can find a way to fixing it. 51:45.890 --> 51:54.050 But it's not all about just bug bounties, because I think that for me creates a negative thing of we're just finding the problems. 51:54.290 --> 51:57.670 We should be finding problems and then solving them. 51:57.870 --> 51:59.870 That's the hacker mindset. 52:00.210 --> 52:04.390 It's not just about pointing fingers and saying, this is a problem. 52:04.450 --> 52:06.450 We should be working at the solution. 52:06.450 --> 52:09.290 We should be finding new ways of doing things. 52:09.390 --> 52:15.930 So I want to see a lab filled with medical devices that hackers can pull apart and we can build solutions. 52:15.930 --> 52:20.050 But not only hackers, you need people like Ash, right? 52:20.530 --> 52:26.150 Because, I mean, we're good at the other side of it, but I can't build these devices. 52:26.150 --> 52:28.070 I wouldn't even know where to start. 52:28.270 --> 52:31.630 So I think it needs to be a multidisciplinary approach. 52:32.550 --> 52:38.930 And even people like the FDA, you know, should be involved in it from a policy perspective. 52:39.130 --> 52:42.170 And you know, everyone should just be working together. 52:42.170 --> 52:47.890 We should be building the bridges towards having synergy and having a space where we can explore this. 52:47.890 --> 52:52.250 And I think Biohack is awesome for that, because they already do a lot of that. 52:54.720 --> 52:58.860 Sorry, I'm going to excuse my cat, who just really desperately jumped into my lap. 52:58.860 --> 53:01.260 I was trying to prevent it and failed. 53:01.720 --> 53:04.320 He just scaled the side of the chair. 53:04.660 --> 53:06.740 Welcome addition to the panel. 53:08.320 --> 53:15.880 So I love the notion of being part of the solution, and I think to your point, it does require multiple voices. 53:15.880 --> 53:18.260 You hit on a point that I think is really important, right? 53:18.260 --> 53:25.920 You, as someone who does a lot of security research, is not totally in the space of how do I build a medical device? 53:25.920 --> 53:33.240 I think we similarly need to not have the expectation of the people building medical devices to know how to solve some of these cybersecurity issues. 53:33.240 --> 53:48.460 So I think having the willingness to partner and really helping them not make cybersecurity their number two core capability, and instead offering them solutions, is absolutely critical and the way to make things actually stick. 53:48.840 --> 53:51.560 So should we have solution bounties then? 53:52.400 --> 53:53.280 Yes! 53:53.600 --> 53:55.820 You should trademark that. 53:57.220 --> 54:00.440 But I just want to bring up just a scenario. 54:00.440 --> 54:02.140 So it's not just for medical devices. 54:02.140 --> 54:04.860 You have a medical device bug bounty, for example. 54:04.860 --> 54:08.360 If that's a good or a bad thing, we could talk hours on that. 54:08.360 --> 54:11.120 But you don't have the issue of patient health information. 54:11.120 --> 54:22.180 And so hospitals can't offer hackers to come in and poke around the periphery of their networks or to give them that type of experience because of a couple things. 54:22.180 --> 54:27.060 One, their live networks are taking care of patients we would hate for something bad to happen. 54:27.060 --> 54:31.900 But then two, there's so much protected health information floating around a hospital's network. 54:31.900 --> 54:46.220 And if a security researcher or hacker in good faith trying to do right finds something and it happens to be commingled with patient health information, then the hospital is required to report that as a HIPAA breach, right? 54:46.220 --> 54:52.180 So there are some, perhaps some would call barriers, perhaps some would call safeguards. 54:52.180 --> 55:04.180 But what I think it's done is it's made not just the delivery of healthcare itself particularly difficult to engage with from the hacker perspective. 55:04.180 --> 55:07.380 And I think maybe we don't have to figure out that solution. 55:07.380 --> 55:09.400 Maybe that's one of the solution bounties we should offer. 55:09.400 --> 55:10.940 How can hackers get more involved? 55:10.940 --> 55:12.180 Give us your ideas. 55:12.420 --> 55:24.080 But particularly at hospitals where we've talked about they don't have a lot of in-house security expertise, if anything, but yet they're still asked to do all of that work. 55:24.280 --> 55:26.540 How can the community come together and help them out? 55:26.540 --> 55:29.140 Because that could be a lot of good right there. 55:29.320 --> 55:32.560 One very easy answer to that is just working in healthcare, right? 55:32.560 --> 55:49.760 So I would encourage anybody who's thinking about a career change, if you're looking for an area where you can make an incredible impact and have a lot of really challenging problems to solve, consider working for a hospital or a healthcare delivery organization or being adjacent to that in some way. 55:49.940 --> 55:58.320 We know that some of these hospitals we talked about in certain areas are critically underserved and may not even have a full -time IT security professional. 55:58.320 --> 56:07.440 So one way to get involved is just to join that effort as an actual employee of a healthcare organization. 56:08.600 --> 56:35.800 I've got some specific suggestions I think, and it's funny that you bring up HIPAA and other things like that, because I think one of the best ways that folks like these could get involved, whatever, there are actually specific programs that are being offered now within the federal government that puts you in policymakers' offices and lets you be the cybersecurity expert in the room for those people. 56:36.800 --> 56:39.680 There's the Tech Congress Fellowship. 56:39.720 --> 56:40.740 Some of you may have heard of it. 56:40.740 --> 56:43.400 Some of you may have met some of the fellows. 56:43.760 --> 56:50.200 Chris Segoian, who's probably a well-known name for some of you all, was a Tech Congress fellow. 56:50.200 --> 56:54.660 He now works permanently for a senator and is that senator's tech person. 56:54.880 --> 56:57.600 But there's been dozens of others. 56:57.600 --> 56:59.240 They've got great folks. 56:59.240 --> 57:00.080 It's a great program. 57:00.080 --> 57:03.600 Places you with either a House office or a Senate office. 57:05.160 --> 57:12.380 And so that's one of the most direct ways that you can actually influence policymaking in this sense, is actually go be in the room when the policy is being made. 57:12.540 --> 57:14.220 So I would highly recommend that. 57:14.420 --> 57:20.020 I don't know when the application process opens for next year's class, but Travis Moore is your man, so go find Travis. 57:20.520 --> 57:23.820 The other thing I would mention is I Am the Cavalry. 57:23.820 --> 57:45.280 When I Am the Cavalry was first started, it was kind of this weird, kooky thing for the Hill, for the United States Congress, who's very used to dealing with very buttoned up everyone's suit and tie professional trade associations and things like that when they were trying to get information on whatever they needed to get information on. 57:45.320 --> 57:49.300 And I Am the Cavalry sort of just kind of like came up to the Hill and was just like, Hi! 57:49.300 --> 57:50.760 We're a bunch of cybersecurity experts. 57:50.760 --> 57:52.300 We'd like to talk to you about this. 57:52.300 --> 58:02.300 But the thing is, they're one of the most effective advocacy groups in national policy making right now, because they were just so... 58:03.540 --> 58:11.620 everyone could tell in a city where sometimes people's motivations are a little bit shrouded, that they just wanted to be there. 58:11.620 --> 58:13.400 They were there with good faith. 58:13.400 --> 58:20.160 They really just wanted to do the right thing, and they were going to answer whatever questions needed answering without bias. 58:20.160 --> 58:25.040 And so I know SEA works a ton with I Am the Cavalry. 58:25.040 --> 58:29.520 I know that Hill works a ton with I Am the Cavalry. 58:29.560 --> 58:41.360 And so if you want to get involved and have an opportunity to meet with the movers and shakers of the country of cybersecurity policy, I Am the Cavalry is another really great place to do that. 58:45.240 --> 59:00.500 I just would like to perhaps add that from my other perspective, if you want to get a hold of working in a hospital or getting your hands just on some medical equipment or just having a conversation with the manufacturers. 59:01.020 --> 59:03.800 Three years ago, I spoke at Biohack Village. 59:03.800 --> 59:05.220 This was my first DEF CON. 59:05.220 --> 59:10.500 This was my first ever meeting another group of hackers like myself. 59:11.580 --> 59:15.120 And that's how I was set on the path to do research. 59:15.120 --> 59:17.500 That was how I got access to devices. 59:17.500 --> 59:27.340 I no longer had to smuggle them through customs at an airport because I bought them on eBay or, you know, because you can't buy them in South Africa, right? 59:27.460 --> 59:29.560 So I would buy them in the UK. 59:29.560 --> 59:36.420 I could have visited a friend and I put them in my luggage and smuggled them back home so that I could work on them, right? 59:36.420 --> 59:41.600 Or even, you know, when they exploded my first device, I said, hey, give me, give me, give me. 59:41.600 --> 59:45.680 I want to have that on my doctor's wire, like sentimental reasons, of course. 59:46.720 --> 59:48.540 But that's how I got my hands on. 59:48.540 --> 59:57.940 But here I walked into a place in Vegas that had devices, that had a lab, that had everything that, you know, makes a young hacker's heart, you know, do jumps. 59:58.260 --> 01:00:03.900 So if that tickles your fancy, then that's somewhere that you should go visit, right? 01:00:03.900 --> 01:00:06.060 You should go try your hand at it. 01:00:06.060 --> 01:00:11.340 You should go play with those devices, speak to the manufacturers and go see how they implement it. 01:00:12.100 --> 01:00:17.980 And I mean, even if you're a patient, nothing precludes you from giving advice at a hospital. 01:00:18.280 --> 01:00:20.760 I mean, I've given advice from my ICU bed. 01:00:20.760 --> 01:00:24.260 There's a reason I'm not allowed a laptop in anymore, right? 01:00:24.260 --> 01:00:27.080 Except for that the doctor wants me to waste more. 01:00:27.080 --> 01:00:28.720 Apparently, that's the reason. 01:00:28.720 --> 01:00:31.160 But I mean, give advice. 01:00:31.240 --> 01:00:32.400 Reach out. 01:00:32.400 --> 01:00:33.560 Get involved. 01:00:34.020 --> 01:00:39.020 And if someone doesn't want to listen to you the first time, keep on trying, because it's a patient's game. 01:00:39.020 --> 01:00:39.300 Right? 01:00:39.300 --> 01:00:40.980 It's not going to happen overnight. 01:00:41.500 --> 01:00:42.320 I've learned. 01:00:42.320 --> 01:00:49.420 I've dealt with many parties and it's not going to happen fast because it's a big industry. 01:00:50.200 --> 01:00:51.100 Just get involved. 01:00:51.100 --> 01:00:52.420 Get your hands dirty. 01:00:52.680 --> 01:00:54.900 Because that's how we change the world. 01:00:55.100 --> 01:00:59.360 Every new researcher that comes in the fold is a new mind that thinks differently. 01:01:00.120 --> 01:01:03.620 And that's, I think, how we change things one step at a time. 01:01:04.900 --> 01:01:16.440 I love that, because I think the idiosyncratic notion that it takes a specific individual or an elite person or someone who's an expert to make a change is absolutely a misconception. 01:01:16.780 --> 01:01:20.960 The notion of just getting involved, there's no inner circle here. 01:01:20.960 --> 01:01:29.280 I think every person in this community is more than willing to share their network, share their expertise, and share whatever corner of this problem that they have. 01:01:29.280 --> 01:01:31.200 It's a really hard problem. 01:01:31.260 --> 01:01:35.740 And we need all the talent that we can muster up right now to really make a change. 01:01:35.740 --> 01:01:49.880 And I think if we look at the diversity of roles, functions, experience, thought process, background, education, everything, any under-representation of that population is indicative of missing a potential attack factor. 01:01:49.880 --> 01:01:54.100 And we really have to account for that and try to bring in as many folks as we can. 01:01:54.960 --> 01:01:57.440 Yeah, I think this is a call to arms, right? 01:01:57.440 --> 01:02:00.840 This is a how many hackers can we round up in one go? 01:02:00.840 --> 01:02:03.660 Not just even hackers, right? 01:02:03.700 --> 01:02:10.120 You know, everyone from physicians, from patients, from builders and policy makers. 01:02:10.120 --> 01:02:23.280 I think if we start breaking down the silos, which we've been functioning in, and independently working and start this collective movement, that's how we change the world. 01:02:24.440 --> 01:02:26.800 It's not a one-person thing. 01:02:26.800 --> 01:02:34.320 It's never going to be one person that's going to come up with the magic solution or the silver bullet, right? 01:02:34.320 --> 01:02:40.540 It takes more than one village, as I always say, to solve the problem. 01:02:41.300 --> 01:02:48.340 And I think it's time in 2020 that we as a society pull together instead of apart. 01:02:49.200 --> 01:02:52.920 Because we've seen what a virus can do, right? 01:02:52.920 --> 01:02:54.680 It's locked us in our houses. 01:02:54.680 --> 01:03:00.600 So I think it's time we take our power back and we start moving the world into a positive future. 01:03:01.000 --> 01:03:12.040 Because I can tell you from a patient perspective, not having access to being able to go into a cardiologist office because we're afraid of COVID, because currently it's more dangerous going into a hospital. 01:03:12.780 --> 01:03:19.500 A denial of patient care is a non -acceptable, non -negotiable. 01:03:19.540 --> 01:03:21.420 I'm not going to stand for it. 01:03:21.420 --> 01:03:25.840 And I think we should be kicking down the doors and saying, you know, now's the time. 01:03:25.840 --> 01:03:28.100 Not yesterday, now. 01:03:30.680 --> 01:03:31.740 I love it. 01:03:31.740 --> 01:03:35.160 Are there any better sentiments to go out on than that? 01:03:36.100 --> 01:03:40.360 I think it's easy to be cynical about all this. 01:03:40.360 --> 01:03:44.300 And it's easy to say we're having the same conversations year after year and the problems are still there. 01:03:44.300 --> 01:03:48.220 But I mean, in 2015, the Biohacking Village didn't exist. 01:03:48.220 --> 01:03:55.920 And the idea of people from device manufacturers bringing stuff for hackers to poke and prod at would be laughed out of the room. 01:03:55.920 --> 01:04:05.300 So for people who don't believe that we can do awesome things when we work together and hang out at places like DEF CON, we have evidence to the contrary. 01:04:05.740 --> 01:04:08.380 I think that's about an hour. 01:04:08.620 --> 01:04:12.920 And I'm looking forward to seeing you guys in a little bit for a Q&A. 01:04:14.700 --> 01:04:15.880 Take care, everyone. 01:04:15.880 --> 01:04:17.460 Thank you, DEF CON, for having us. 01:04:17.460 --> 01:04:21.900 A shout out to Nikita, especially, for taking another shot at us. 01:04:21.900 --> 01:04:28.400 We're going to go ahead and open it up to Q&A here in 5, 4, 3, 2, 1.