1
00:00:00,000 --> 00:00:00,980
Hi, everyone.

2
00:00:00,980 --> 00:00:04,280
Welcome to the biohacking village at DEF CON.

3
00:00:04,320 --> 00:00:06,020
This is our sixth year.

4
00:00:06,020 --> 00:00:07,100
I am Nina Ali.

5
00:00:07,100 --> 00:00:08,420
I am the executive director.

6
00:00:08,420 --> 00:00:11,400
This is my fifth year of running the village.

7
00:00:11,400 --> 00:00:12,800
Thank you for coming.

8
00:00:13,000 --> 00:00:18,180
I want to let you know that this year has been quite an adventure.

9
00:00:18,340 --> 00:00:28,320
It's been very similar to one of those choose your adventure books where it's just so many options and you're working through everything trying to make it all work.

10
00:00:29,100 --> 00:00:34,740
I decided last year that I was going to do the keynote, but I knew that I didn't want to do it myself.

11
00:00:34,960 --> 00:00:46,540
So what I have done is accumulated folks that I know, folks that I trust, and people that have very strong expertise in their field.

12
00:00:46,560 --> 00:00:48,140
And I talked to them.

13
00:00:48,380 --> 00:00:52,560
And I want you to know that I did not prep them for these interviews.

14
00:00:52,560 --> 00:00:54,680
I did not give them questions beforehand.

15
00:00:54,680 --> 00:00:59,500
Everything you see is raw emotion, raw gut reactions.

16
00:00:59,740 --> 00:01:14,580
And I think the information is really important, especially right now and for the future of where we are going to go with healthcare and how we can secure it and make patient safety a priority.

17
00:01:14,580 --> 00:01:15,780
Thanks for watching.

18
00:01:15,780 --> 00:01:19,360
Hey, how are you?

19
00:01:19,500 --> 00:01:21,120
I'm getting you.

20
00:01:21,200 --> 00:01:22,560
I'm okay.

21
00:01:22,560 --> 00:01:40,180
So I brought you here because I want the biohacking community to see the people that I talk to, see who I engage with, see where my brain thoughts lie and who I talk to at three in the morning, Eastern Time, when my brain isn't stopping.

22
00:01:40,180 --> 00:01:44,160
So quick origin story on you is...

23
00:01:44,160 --> 00:01:46,020
I met you three years ago.

24
00:01:46,040 --> 00:01:48,840
Jason Street gave us the introduction of Black Hat.

25
00:01:48,840 --> 00:01:50,880
And yes, I do remember everything.

26
00:01:51,680 --> 00:01:52,720
Good brain.

27
00:01:53,320 --> 00:02:00,260
And then my talk got accepted home to own my own pacemaker at Biohack Village.

28
00:02:01,300 --> 00:02:05,300
We kind of just fell into a friendship, I think.

29
00:02:05,300 --> 00:02:08,920
It was just instantaneous, like I knew my whole life.

30
00:02:09,120 --> 00:02:12,280
I remember, like with my first talk, we shared tequila.

31
00:02:12,300 --> 00:02:14,020
I really needed it.

32
00:02:14,680 --> 00:02:23,040
And now, three years later, we're still kicking ass, taking names and planning big things.

33
00:02:23,040 --> 00:02:24,900
We became instant friends.

34
00:02:24,940 --> 00:02:28,820
And we have continuous dialogues at 3 a.m.

35
00:02:28,820 --> 00:02:35,120
Eastern, depending on times here, between like 8 and 9 a.m.

36
00:02:35,120 --> 00:02:36,020
your time.

37
00:02:36,140 --> 00:02:38,360
What are you working on right now?

38
00:02:39,360 --> 00:02:43,160
Working on standardizing and defining shit.

39
00:02:43,160 --> 00:02:50,620
I'm slightly tired of us, you know, having this cookie-cutter approach to medical security and healthcare security.

40
00:02:50,620 --> 00:02:56,300
Because let's face it, you know, this is not a Windows 10 machine or the standard endpoint we're dealing with.

41
00:02:56,300 --> 00:02:58,240
Each one has a different way.

42
00:02:58,480 --> 00:03:04,260
So why are we making it harder on ourselves by not defining and standardizing?

43
00:03:04,440 --> 00:03:08,880
So that's my pet project, is just to get the shit right, define it out.

44
00:03:09,120 --> 00:03:10,960
And let's understand what we're dealing with.

45
00:03:10,960 --> 00:03:12,640
Let's listen to the devices.

46
00:03:12,880 --> 00:03:14,700
Let's not do all the talking.

47
00:03:14,960 --> 00:03:16,380
Let the data speak.

48
00:03:17,740 --> 00:03:20,020
What's your call to action to the community?

49
00:03:20,560 --> 00:03:29,260
I think the biggest thing I've realized is as a community, we can't work together, can't listen to diverse objective stories.

50
00:03:29,260 --> 00:03:34,160
So just because someone disagrees with you, doesn't mean they're wrong or you're wrong.

51
00:03:34,160 --> 00:03:41,600
I think the community as a whole, we should approach this not just about finding problems, we should be finding the solutions.

52
00:03:41,640 --> 00:03:45,920
So we should be the builders, the breakers and the pioneers going forward.

53
00:03:45,920 --> 00:03:49,780
But it takes a village, but intended, right?

54
00:03:49,780 --> 00:03:51,100
Yeah, I did it.

55
00:03:51,100 --> 00:03:52,920
I did a mom joke.

56
00:03:53,100 --> 00:03:57,780
We need to do better.

57
00:03:57,780 --> 00:03:59,000
Shameless plug.

58
00:03:59,380 --> 00:04:04,620
Hey, don't always see someone that's five foot nothing.

59
00:04:05,760 --> 00:04:08,320
I have an opinion, I have a voice.

60
00:04:08,320 --> 00:04:11,360
It's not refined, it's not pretty, right?

61
00:04:11,360 --> 00:04:13,300
I'm going to call it as I see it.

62
00:04:13,300 --> 00:04:14,560
But don't always take offense.

63
00:04:14,560 --> 00:04:16,060
It comes from a good place.

64
00:04:16,700 --> 00:04:23,140
And if you want someone to do log analysis, it is what I eat for breakfast, lunch and supper.

65
00:04:23,260 --> 00:04:24,260
I love logs.

66
00:04:24,260 --> 00:04:25,440
I love data.

67
00:04:25,820 --> 00:04:31,720
Because I believe we can't wait for something to happen and ask where's the data, where's the evidence?

68
00:04:31,720 --> 00:04:33,860
I want to build this shit in now.

69
00:04:33,860 --> 00:04:38,900
Because come 10 years, I can turn around and say, hey, you claim you hacked this device?

70
00:04:39,020 --> 00:04:40,880
Well, motherfucker, you did not.

71
00:04:42,020 --> 00:04:43,900
Who do you want to collaborate with?

72
00:04:44,660 --> 00:04:45,540
Everyone.

73
00:04:46,060 --> 00:04:47,920
But I see it as a trifecta, right?

74
00:04:47,920 --> 00:04:49,160
It's this triangle.

75
00:04:49,160 --> 00:04:50,380
Engineering is awesome.

76
00:04:50,380 --> 00:05:05,640
And I'm geeking out on it because recently I got exposed to an MDM and I got to see the engineering pipeline, which led me to build parsers in Python I never thought I'd do because I was convinced the internet would blow up if I designed something.

77
00:05:06,020 --> 00:05:12,720
And I realized that we have a regulatory body, we have an MDM and we have researchers.

78
00:05:13,080 --> 00:05:22,040
And that's what's going to make the future better, these three elements working together to strengthen healthcare and medical security.

79
00:05:22,640 --> 00:05:29,620
But we shouldn't be imposing things that break healthcare or medical devices further.

80
00:05:29,620 --> 00:05:34,400
Because people like me, this one sitting here, I need this device.

81
00:05:34,540 --> 00:05:42,100
And if we make it so hard that manufacturers stop doing it, you know, people like me won't have a second chance.

82
00:05:42,600 --> 00:05:46,620
So I think you know me well enough that I'm going to throw random things at you.

83
00:05:46,880 --> 00:05:48,360
I can see your brain going.

84
00:05:48,360 --> 00:05:50,480
I've been expecting it to bring it on.

85
00:05:50,480 --> 00:05:52,120
What's your controversial opinion?

86
00:05:52,960 --> 00:06:04,040
My controversial opinion is this, that imposing S-bombs into healthcare and expecting them to take on the manufacturer role is going to lead to it breaking.

87
00:06:04,520 --> 00:06:12,600
And the reason being is the manufacturer has the responsibility, the ownership to maintain their ship, build them better and keep them safe.

88
00:06:13,100 --> 00:06:16,880
But here's the thing, we're expecting hospitals to do this.

89
00:06:17,040 --> 00:06:21,460
COVID-19 came in worldwide, globally, swept it, broke it.

90
00:06:21,460 --> 00:06:23,580
And this is something they built to do.

91
00:06:23,580 --> 00:06:27,760
They're supposed to deal with viruses and pandemics.

92
00:06:28,080 --> 00:06:39,500
So if we make cyber security of medical devices their responsibility, we're expecting them to thrive in something they're not built to do and they're not ready to do.

93
00:06:40,360 --> 00:06:45,180
So yes, S-bomb for manufacturers, hell yes, bring it on, they should be doing this shit.

94
00:06:45,180 --> 00:06:46,620
It's manufacturing.

95
00:06:46,880 --> 00:06:49,420
This is not a hospital function.

96
00:06:51,140 --> 00:07:05,780
As a biohacker that works in technology, how do you want to better integrate with regulatory folks, with political entities, with hospitals, etc.?

97
00:07:06,380 --> 00:07:10,700
I just want to be given the opportunity to be heard and I want to listen.

98
00:07:10,700 --> 00:07:14,680
I want to listen what they need to have done, what help they need.

99
00:07:14,880 --> 00:07:17,380
This is not a me against them.

100
00:07:17,380 --> 00:07:20,700
This is saying, let's put our brains together.

101
00:07:21,220 --> 00:07:24,060
One collective brain is not enough.

102
00:07:24,120 --> 00:07:26,120
We need this diverse group.

103
00:07:26,120 --> 00:07:29,260
And this is why us talking is so awesome.

104
00:07:29,260 --> 00:07:37,380
Because I never knew that patient record was as important as it is until we had the discussion and we had an argument.

105
00:07:38,620 --> 00:07:41,120
We had that, we disagreed.

106
00:07:41,120 --> 00:07:47,040
But the fact is, you showed the data, you brought the data and you changed my mind.

107
00:07:47,660 --> 00:07:50,300
And the thing is, we shouldn't be scared to be wrong.

108
00:07:50,880 --> 00:07:54,900
We should be acknowledging that, hey, this is not going to work.

109
00:07:54,900 --> 00:07:56,680
Or hey, we made a mistake.

110
00:07:56,680 --> 00:08:03,700
Because it takes a stronger entity to do that than trying to hide it.

111
00:08:03,700 --> 00:08:07,260
And that counts for MDM, hackers, anyone.

112
00:08:07,340 --> 00:08:10,040
I have big enough balls to tell you if I was wrong.

113
00:08:10,360 --> 00:08:12,120
Because that's the person that I am.

114
00:08:12,120 --> 00:08:13,400
I own my shit.

115
00:08:15,560 --> 00:08:17,040
How do you want to leave this?

116
00:08:17,040 --> 00:08:19,020
What's your message after this?

117
00:08:19,460 --> 00:08:24,380
That together, we can change the world of healthcare and medical device security.

118
00:08:24,400 --> 00:08:29,900
Because we're dealing with a legacy of devices, an ocean full of them.

119
00:08:29,940 --> 00:08:33,920
600,000 new implanted devices a year.

120
00:08:33,940 --> 00:08:36,440
They last 10 years at a minimum.

121
00:08:37,040 --> 00:08:37,760
Right?

122
00:08:37,760 --> 00:08:41,620
That is a legacy that I don't want to see increase yearly.

123
00:08:41,680 --> 00:08:43,700
The time for change is now.

124
00:08:44,240 --> 00:08:46,400
Not yesterday, not tomorrow.

125
00:08:46,400 --> 00:08:47,260
Now.

126
00:08:47,260 --> 00:08:51,680
Because otherwise, we face legacy that's going to come back and bite us in the ass.

127
00:08:51,680 --> 00:08:55,940
And patients like me won't have access to these devices.

128
00:08:56,080 --> 00:09:05,800
Because their first and foremost function is to keep us alive and give us clinical and healthcare-related support.

129
00:09:06,140 --> 00:09:08,380
They're not there to be secure.

130
00:09:08,380 --> 00:09:17,120
I mean, for fuck's sakes, if I have to tell the doctor, hold on, you need my username and password, or you need my cryptographic keys, I'll be dead.

131
00:09:17,120 --> 00:09:18,680
I saw that.

132
00:09:19,280 --> 00:09:22,080
It's in a split second.

133
00:09:22,180 --> 00:09:24,020
So let's get this shit right.

134
00:09:24,020 --> 00:09:27,900
Let's do it now before legacy comes back and bites us in the ass.

135
00:09:28,100 --> 00:09:34,540
What's your controversial opinion on recording as well, seeing as you're fucking throwing us all under the bus?

136
00:09:34,540 --> 00:09:35,860
What's your controversy?

137
00:09:35,860 --> 00:09:36,980
Well played.

138
00:09:38,380 --> 00:09:40,520
My controversial opinion.

139
00:09:41,160 --> 00:09:45,520
Electronic medical records are not looked at by anyone, and it's exhausting.

140
00:09:45,800 --> 00:09:47,820
You and I had this conversation.

141
00:09:48,660 --> 00:09:52,740
Everybody looks at medical devices because they're tangible.

142
00:09:52,740 --> 00:09:58,680
They're something you can hold on to and you can pick up off of eBay and, you know, find a thing.

143
00:09:58,760 --> 00:10:05,940
But electronic medical records are hoarded so intensely, and they're not in a lot of legislature.

144
00:10:05,940 --> 00:10:07,060
They're not really defined.

145
00:10:07,060 --> 00:10:08,900
They are not medical devices.

146
00:10:08,900 --> 00:10:16,860
And because they're not medical devices, we don't necessarily, we, the group, don't necessarily treat them well.

147
00:10:16,980 --> 00:10:19,980
But when you look at it, I can have a medical device that does one thing.

148
00:10:19,980 --> 00:10:22,200
It holds one source of information, right?

149
00:10:22,200 --> 00:10:29,100
Like your heart pacemaker holds your heart information, where the electronic medical record holds all of the information.

150
00:10:29,100 --> 00:10:36,120
So when you look for that wealth of data, and I'm going to find this one thing that's very specific, or I can find all of it.

151
00:10:36,340 --> 00:10:38,380
And that's what I've done.

152
00:10:38,380 --> 00:10:46,460
Again, I did it for so long that when people say, like, this is the most important thing, I'm like, yeah, but you're getting that information how?

153
00:10:46,460 --> 00:10:53,960
There's so many links into this one small piece, and just no regard to it.

154
00:10:54,400 --> 00:10:58,360
Yeah, but I think the problem is because we're not defining the ship, right?

155
00:10:58,360 --> 00:11:00,540
Because that is like the ultimate goldmine.

156
00:11:00,540 --> 00:11:08,520
It's not necessarily a device, but it's a container that holds everything, right?

157
00:11:08,580 --> 00:11:11,720
If those are the keys to the kingdom, it's the ultimate...

158
00:11:11,720 --> 00:11:12,440
Exactly.

159
00:11:12,740 --> 00:11:14,260
How does that even happen?

160
00:11:14,260 --> 00:11:21,880
You can have the one thing, you can have the pacemaker, but you need all of the other things to make an educated device.

161
00:11:23,040 --> 00:11:24,260
Educated to system.

162
00:11:24,260 --> 00:11:26,260
There's educated decision.

163
00:11:26,360 --> 00:11:34,320
There's decision support built into this thing that will say, you're going to give this person a defibrillator of some sort.

164
00:11:34,320 --> 00:11:40,120
Oh, BTW, did you know that this person, you can't give them this one because of whatever reason this is.

165
00:11:41,800 --> 00:11:43,600
It's a support system.

166
00:11:43,600 --> 00:11:45,180
It's a container.

167
00:11:45,180 --> 00:11:46,200
It does all the things.

168
00:11:46,200 --> 00:11:47,160
Now you've got me riled up.

169
00:11:47,160 --> 00:11:48,000
Thank you.

170
00:11:49,200 --> 00:11:50,820
It's a treasure trove.

171
00:11:50,820 --> 00:11:51,940
That's what it is.

172
00:11:51,940 --> 00:11:53,560
I've done talks about this.

173
00:11:53,560 --> 00:11:56,800
I can own your pacemaker and like, oh, I got a thing.

174
00:11:57,480 --> 00:11:59,140
It's worth how much?

175
00:11:59,140 --> 00:11:59,840
50?

176
00:11:59,960 --> 00:12:00,840
500?

177
00:12:01,160 --> 00:12:06,080
I can own a hospital because that's essentially what you're doing once you get the EMR.

178
00:12:06,240 --> 00:12:14,440
Because you get into the EMR, you get into everything else because it's all the APIs, because whatever is going on and it's just gone.

179
00:12:15,000 --> 00:12:17,380
And that is mind-blowing to me.

180
00:12:17,540 --> 00:12:21,400
But I mean, the purpose of cybercrime, right, is about money.

181
00:12:21,400 --> 00:12:25,040
So what can I sell and what can I keep on selling?

182
00:12:25,040 --> 00:12:27,960
And how can I get, you know, have persistence?

183
00:12:28,260 --> 00:12:28,680
Exactly.

184
00:12:28,680 --> 00:12:34,400
I mean, it's the product that, you know, forever paying because everyone's going to want to have that.

185
00:12:35,060 --> 00:12:37,280
Because now I'm upset about life.

186
00:12:38,420 --> 00:12:40,040
They're not even connected.

187
00:12:40,260 --> 00:12:46,340
So like New York does not connect to DC, which doesn't connect to Seattle, which doesn't connect to anything.

188
00:12:46,340 --> 00:12:54,560
So me as a human, I now have to regurgitate my whole life history of all the things that are right and wrong with me, because you don't know.

189
00:12:54,560 --> 00:12:56,700
I can make all of the things up.

190
00:12:57,020 --> 00:12:59,100
I can negate so much information.

191
00:12:59,740 --> 00:13:07,760
Did you know that 18% of healthcare workers indicated that for the right price, they would sell their data?

192
00:13:07,900 --> 00:13:08,620
Yeah.

193
00:13:08,640 --> 00:13:10,140
Insider threat, right?

194
00:13:10,140 --> 00:13:12,120
We just over, we overlook it.

195
00:13:12,200 --> 00:13:15,760
And there's a print mechanism on these things.

196
00:13:15,760 --> 00:13:17,100
You just boop.

197
00:13:18,100 --> 00:13:18,880
You're good.

198
00:13:18,880 --> 00:13:21,620
How do you feel about zero trust, Nina?

199
00:13:21,620 --> 00:13:23,420
Tell us how you really feel.

200
00:13:29,860 --> 00:13:32,240
We currently work on least privilege, right?

201
00:13:34,120 --> 00:13:36,800
Least privilege is still an indication of trust.

202
00:13:37,040 --> 00:13:39,420
It's trust, but verify in a way.

203
00:13:40,100 --> 00:13:41,300
Not in healthcare.

204
00:13:41,300 --> 00:13:42,600
We shouldn't have that.

205
00:13:42,640 --> 00:13:46,400
There's, this is, this is sanctified information.

206
00:13:46,400 --> 00:13:48,840
This is literally you in data form.

207
00:13:48,840 --> 00:13:49,960
And we're just like, here, it's fine.

208
00:13:49,960 --> 00:13:50,700
Go get it.

209
00:13:50,700 --> 00:13:51,340
We're cool.

210
00:13:51,340 --> 00:13:52,280
We trust you.

211
00:13:52,280 --> 00:13:55,180
You trust me because I work here, but you don't know who I am as a person.

212
00:13:55,180 --> 00:13:57,120
You know that I have a certain skill set.

213
00:13:57,960 --> 00:14:01,100
But zero trust needs to be better incorporated.

214
00:14:01,620 --> 00:14:11,820
It needs to be incorporated better in technology and industry generally, but healthcare needs it more because of the sensitivity and the specificity of the information.

215
00:14:12,120 --> 00:14:19,180
You, you roll somebody up on their labs and they're off by whatever number this is.

216
00:14:19,180 --> 00:14:20,440
You can overdose them.

217
00:14:20,440 --> 00:14:22,020
You cannot do a thing.

218
00:14:22,020 --> 00:14:23,240
You can treat them.

219
00:14:23,300 --> 00:14:25,320
You can give them the wrong blood.

220
00:14:25,600 --> 00:14:27,480
You, there's so many different options.

221
00:14:27,480 --> 00:14:31,080
You need to know that everything is, is in their place.

222
00:14:31,100 --> 00:14:34,420
You need to know that you can get into things and you can't get into things.

223
00:14:34,420 --> 00:14:37,360
And this is, this is why the hierarchy is as such.

224
00:14:37,400 --> 00:14:39,340
And we're not doing that.

225
00:14:39,340 --> 00:14:52,760
And medical is so, it's very flawed, but it's also one of the last technologies to go live with any sort of tech and any sort of security because we've had that cloak of, you know, we're cool.

226
00:14:52,760 --> 00:14:55,840
We're good because we are the doctors and we know the things.

227
00:14:56,280 --> 00:15:02,360
And if I tell you that this is wrong and this is the medication you need, you're going to trust me because you don't have that information.

228
00:15:02,480 --> 00:15:04,840
And you're going to trust me because I'm giving you that information.

229
00:15:05,160 --> 00:15:06,800
It's the same thing.

230
00:15:07,000 --> 00:15:16,980
And we did that Hippocratic, I Am The Calvary did that Hippocratic Oath of medical device manufacturers should have taken that Hippocratic Oath.

231
00:15:16,980 --> 00:15:18,960
If you read down the article, I go further.

232
00:15:18,960 --> 00:15:23,200
I said, the hospitals need to also take that Hippocratic Oath because that is your information.

233
00:15:23,300 --> 00:15:26,600
That is them holding you in digital format.

234
00:15:26,780 --> 00:15:28,180
What is the difference?

235
00:15:28,760 --> 00:15:29,720
There is none.

236
00:15:29,720 --> 00:15:31,360
There is absolutely none.

237
00:15:33,260 --> 00:15:34,420
You're sly.

238
00:15:35,160 --> 00:15:36,820
You knew this was going to happen.

239
00:15:36,820 --> 00:15:43,980
I didn't think this was going to, I thought this was going to be like, oh my God, I should, I should turn this, you asshole.

240
00:15:43,980 --> 00:15:46,780
I should be like, this is everybody grilling me about shit.

241
00:15:47,740 --> 00:15:51,060
It's us having a conversation and this is how this goes.

242
00:15:51,780 --> 00:15:56,820
But I like the fact that, you know, we verify but never trust.

243
00:15:57,440 --> 00:15:59,900
I like that about zero trust.

244
00:15:59,900 --> 00:16:02,300
Because for long we've done trust but verify.

245
00:16:02,400 --> 00:16:12,300
But I mean, do you think, I'm going to throw this out, that an APT is above attaching a medical device or implanting it into a COVID operative and sending them into a hospital?

246
00:16:12,300 --> 00:16:13,320
Absolutely not.

247
00:16:13,320 --> 00:16:14,900
Absolutely not.

248
00:16:15,460 --> 00:16:19,040
So yeah, we shouldn't be trusting bring your own medical device.

249
00:16:19,040 --> 00:16:20,460
It should not be a thing.

250
00:16:20,460 --> 00:16:22,040
I always love our chats.

251
00:16:22,040 --> 00:16:23,400
I just want to say that.

252
00:16:24,260 --> 00:16:27,700
So Yusef Enriquez, two sentences about you.

253
00:16:27,700 --> 00:16:29,080
What's your origin story?

254
00:16:29,560 --> 00:16:37,160
Okay, origin story, prior FDA, worked in medical devices and medical countermeasure for the FDA.

255
00:16:37,160 --> 00:16:43,020
And currently working with Chemical Bio Threat Reduction Agency.

256
00:16:43,520 --> 00:16:50,080
Okay, so all those things that you just said, what's the most interesting thing that you're working on right now?

257
00:16:50,180 --> 00:16:55,960
Most interesting I'm working on is using quantum dots to test for COVID antibodies.

258
00:16:55,960 --> 00:17:02,680
Just started working with the Aberdeen folks at the ChemBio center up there in Aberdeen.

259
00:17:03,360 --> 00:17:12,120
Hopefully we could start using quantum dots to test for other infectious disease and maybe explosives.

260
00:17:12,120 --> 00:17:18,400
Okay, if you were going to rip the guts out of healthcare, what would that entail?

261
00:17:19,320 --> 00:17:21,140
The data set?

262
00:17:22,100 --> 00:17:23,300
Expand.

263
00:17:24,320 --> 00:17:29,240
I think over the last 50 years, it's been 95% European white males.

264
00:17:29,240 --> 00:17:36,840
So I don't understand the term precision medicine, given the fact that we've been doing race-based therapy for the last 60 years.

265
00:17:37,600 --> 00:17:39,900
Okay, how are you going to do that?

266
00:17:40,300 --> 00:17:41,640
How are you going to rip this up?

267
00:17:41,640 --> 00:17:43,080
How are you going to change the paradigm?

268
00:17:43,480 --> 00:17:45,440
Well, I thought about calling Dr.

269
00:17:45,440 --> 00:17:52,740
Collins at NIH and tell him to stop funding all white male scientists, but that might be a little bit above his pay grade.

270
00:17:52,900 --> 00:18:01,180
But I truly believe that we're going to have to start building data sets from the ground up, scratch what's already there, because I think it's complete bullshit.

271
00:18:01,680 --> 00:18:11,340
So is your call to action that all white male clinical studies be ended and then bring other folks in?

272
00:18:11,340 --> 00:18:19,520
Because traditionally, there's been historic issues with people of color not being particularly keen on signing the paper of a clinical trial.

273
00:18:19,520 --> 00:18:26,280
So what is the best way to get those folks involved?

274
00:18:26,320 --> 00:18:32,240
Well, the first thing is take the bias out of the folks that's reviewing the clinical trial R01s.

275
00:18:32,240 --> 00:18:33,620
Okay, so how are you going to take the bias out?

276
00:18:33,620 --> 00:18:34,960
Because that's ingrained, no?

277
00:18:35,420 --> 00:18:37,380
Yeah, Dr.

278
00:18:37,380 --> 00:18:46,240
Collins is going to have to do a better job of hiring more African Americans, minorities, and women at the NIH, because it starts there.

279
00:18:46,240 --> 00:18:56,720
I mean, the socioeconomic bias that's already implanted, once they look at the application, anything that refers to lack diversity or diversity gets thrown in the trash.

280
00:18:59,360 --> 00:19:01,640
Is that going to solve the problem in its entirety?

281
00:19:02,800 --> 00:19:06,540
That'll begin some of the solving the problem.

282
00:19:06,540 --> 00:19:10,460
And then I think, you know, what you'll start to see is that trust will come back.

283
00:19:11,220 --> 00:19:13,680
Minorities will trust other minorities to do study.

284
00:19:13,680 --> 00:19:19,720
I raised clinical trial enrollment at the Bronx VA just because I was African American.

285
00:19:19,720 --> 00:19:29,180
I was able to increase trials because they saw one African American guy in the entire psychiatry department at the Bronx VA their entire time.

286
00:19:29,180 --> 00:19:41,900
They had veterans there that had been going to that VA for 30 years that they've never seen an African American or minority scientist asking them for their blood or asking them to do a sign up for a trial.

287
00:19:43,960 --> 00:19:49,800
So, from conversations with you, you have a lot of opinions about the EUAs.

288
00:19:50,080 --> 00:19:51,660
So, what's an EUA?

289
00:19:52,220 --> 00:19:54,700
What's your controversial opinion?

290
00:19:55,800 --> 00:19:57,760
I think I'm getting a little concerned.

291
00:19:57,760 --> 00:19:59,960
I think we're over about 25.

292
00:19:59,960 --> 00:20:02,860
I feel like from our conversations, you're a little more than a little concerned.

293
00:20:02,860 --> 00:20:06,280
Yeah, let's ratchet it up a little bit.

294
00:20:06,280 --> 00:20:15,940
I think we're in the red as far as these EUAs being approved because the confidence interval that's required is 95%.

295
00:20:15,940 --> 00:20:22,520
We now have EUAs, which is emergency use authorization for COVID testing, as low as 65%.

296
00:20:23,680 --> 00:20:26,980
So, I mean, you don't have to be a mathematician to see.

297
00:20:27,220 --> 00:20:29,680
That's a D on your report card.

298
00:20:29,880 --> 00:20:32,180
It's not even at a C level yet.

299
00:20:32,180 --> 00:20:34,640
And so, these are tests that's being administered.

300
00:20:34,640 --> 00:20:43,680
And given the report, thinking that individuals are not, doesn't have COVID when there's almost a 40% chance that they do.

301
00:20:44,700 --> 00:20:46,480
So, what's the workaround for it?

302
00:20:46,480 --> 00:20:47,800
So, they get their 65.

303
00:20:47,800 --> 00:20:48,380
They get their D.

304
00:20:48,380 --> 00:20:49,740
Do they get extra credit?

305
00:20:49,740 --> 00:20:50,360
Do they?

306
00:20:50,360 --> 00:20:51,220
Is it?

307
00:20:51,760 --> 00:20:53,000
What's the workflow?

308
00:20:53,100 --> 00:20:57,280
I mean, honestly, I think they all should be taken off if they're not above 80%.

309
00:20:57,280 --> 00:20:58,580
I think we're about three months...

310
00:20:58,580 --> 00:20:59,780
Then who does that leave?

311
00:20:59,780 --> 00:21:01,460
We're in a crisis right now.

312
00:21:01,460 --> 00:21:09,160
Again, that's where I think America has kind of took their eye off the ball the last century or so.

313
00:21:09,160 --> 00:21:11,240
We outsourced everything to China.

314
00:21:11,240 --> 00:21:14,520
That's the reason why we have slowness in testing now.

315
00:21:14,520 --> 00:21:16,320
We don't have enough swabs.

316
00:21:16,320 --> 00:21:20,020
We can't manufacture a stick with a piece of cotton on it.

317
00:21:20,020 --> 00:21:28,140
And so, now what we've done is we've rushed out and have all these device companies make these EUAs that are charging $100.

318
00:21:28,540 --> 00:21:33,500
You take almost three to four days to get a result back.

319
00:21:33,840 --> 00:21:37,580
And oops, it might be 65% accurate.

320
00:21:37,640 --> 00:21:39,360
So, you're fucked either way.

321
00:21:40,540 --> 00:21:42,300
So, what's your shameless plug?

322
00:21:43,380 --> 00:21:47,600
I mean, again, I think understandably there's only three that's met the 95%.

323
00:21:47,600 --> 00:21:50,120
I think they should go ahead and ramp up.

324
00:21:50,120 --> 00:21:53,560
The rest should be scratched unless they have significant data.

325
00:21:53,560 --> 00:21:55,120
How are they going to ramp up?

326
00:21:55,120 --> 00:21:58,000
The production line is not here.

327
00:21:58,000 --> 00:22:00,240
The supply chain is not here.

328
00:22:00,260 --> 00:22:01,300
Get out.

329
00:22:01,320 --> 00:22:01,920
We're America.

330
00:22:01,920 --> 00:22:05,340
That's not a viable answer when the whole world is in crisis.

331
00:22:05,380 --> 00:22:08,040
Well, we're not responsible for the whole world.

332
00:22:08,080 --> 00:22:09,900
We're responsible for America.

333
00:22:10,400 --> 00:22:15,960
And therefore, I think, you know, what has happened is America is focused on bullshit.

334
00:22:16,420 --> 00:22:20,980
And, you know, now we can't even supply our own medical supplies.

335
00:22:20,980 --> 00:22:29,080
We can't supply our own API for pharmaceutical because we've outsourced 93% in China and the drug manufacturing is in India.

336
00:22:29,260 --> 00:22:32,140
So, somebody's going to have to take a hit on the chin for it.

337
00:22:32,140 --> 00:22:34,780
But it needs to start being American-made products.

338
00:22:34,780 --> 00:22:43,040
So, if it's American-made products, this also indicates that there's other things in the supply chain in that just workload in its entirety that need to be changed.

339
00:22:43,040 --> 00:22:50,720
If we have sent so many things off to China, they have different environmental protection laws, which means we would have to change them here.

340
00:22:50,720 --> 00:22:54,620
So, this whole system needs to be recalibrated.

341
00:22:54,620 --> 00:22:55,700
How long does that take?

342
00:22:55,700 --> 00:22:56,720
What's the effort?

343
00:22:56,720 --> 00:22:57,640
What's the funding?

344
00:22:57,640 --> 00:22:58,900
Who needs to get involved?

345
00:22:59,320 --> 00:23:00,880
I don't think it needs to be calibrated.

346
00:23:00,880 --> 00:23:02,380
I think it needs to be detonated.

347
00:23:02,380 --> 00:23:06,800
It needs to be start from scratch because it's just not it.

348
00:23:06,800 --> 00:23:08,080
So, that's right.

349
00:23:08,080 --> 00:23:08,920
We have the problem.

350
00:23:08,920 --> 00:23:10,100
So, you're bringing this up.

351
00:23:10,100 --> 00:23:11,220
So, what's the solution?

352
00:23:11,740 --> 00:23:14,780
Solution is, I mean, again, we got to get back to manufacturing.

353
00:23:15,340 --> 00:23:17,020
That's the solution.

354
00:23:17,020 --> 00:23:24,680
I mean, we've spent more money on Pokemon Go's and other bullshit and we've not been able to shore up our supply chain.

355
00:23:24,680 --> 00:23:27,600
Right now, if we shut the borders down, we are dead.

356
00:23:27,600 --> 00:23:29,280
We don't produce enough insulin.

357
00:23:29,280 --> 00:23:33,660
We don't produce anything that is of necessity to us.

358
00:23:33,660 --> 00:23:36,780
However, we've spent so much money on other shit.

359
00:23:36,780 --> 00:23:39,000
I just don't see how we can sustain.

360
00:23:39,000 --> 00:23:42,800
We are not able to sustain ourselves right now if we closed all our borders.

361
00:23:43,220 --> 00:23:49,580
So, Lilly makes insulin in Puerto Rico and that pushes over here.

362
00:23:49,580 --> 00:23:51,260
But we're still not addressing what I just said.

363
00:23:51,260 --> 00:23:52,560
So, you can detonate.

364
00:23:52,560 --> 00:23:53,660
That's fine.

365
00:23:53,840 --> 00:23:59,540
But you are still not creating a chain of you've destroyed this.

366
00:23:59,540 --> 00:24:00,460
What now?

367
00:24:01,100 --> 00:24:02,720
I mean, again, we have to...

368
00:24:02,720 --> 00:24:03,860
How do we rebuild that trust?

369
00:24:03,860 --> 00:24:09,560
How do we rebuild the facilities and get the stuff to make this cotton swab?

370
00:24:09,560 --> 00:24:15,100
How do we get from a four-day waiting period to a four-hour, a 24-hour turnaround?

371
00:24:15,160 --> 00:24:16,500
Yeah, we got to shift the money.

372
00:24:16,500 --> 00:24:19,000
I mean, the money is being shifted to big corporations.

373
00:24:19,000 --> 00:24:20,720
We have to shift the mindset though first, right?

374
00:24:20,720 --> 00:24:23,080
I don't necessarily think the money is the...

375
00:24:23,080 --> 00:24:24,420
money is always the problem.

376
00:24:24,420 --> 00:24:26,040
Cash flows everything around me, correct.

377
00:24:26,040 --> 00:24:37,400
But you have to change the mindset of those manufacturers, of the people that are in that chain to make the difference before the funding is even considered.

378
00:24:38,460 --> 00:24:43,120
Yeah, but again, going back to the individuals that's running those companies.

379
00:24:43,120 --> 00:24:44,920
They're not diverse.

380
00:24:44,920 --> 00:24:46,200
There's no inclusion.

381
00:24:46,200 --> 00:24:55,220
And so, they get to make these decisions that are not relevant to the diverse population that they say their medical devices to serve.

382
00:24:55,240 --> 00:24:56,580
No, we're talking about COVID.

383
00:24:56,580 --> 00:24:58,220
We're still talking about the manufacturing.

384
00:24:58,400 --> 00:24:59,640
Yeah, that's what we're talking about.

385
00:24:59,640 --> 00:25:05,440
The manufacturing, I mean, again, name an African-American that runs a large pharmaceutical company.

386
00:25:05,820 --> 00:25:08,600
I'm not well-versed in the pharmaceutical companies, to be honest.

387
00:25:08,600 --> 00:25:09,580
I'm better with the device.

388
00:25:09,580 --> 00:25:13,800
Name an African-American that owns a medical device company, a large.

389
00:25:13,900 --> 00:25:14,580
Valid.

390
00:25:14,580 --> 00:25:15,740
No, completely valid.

391
00:25:15,740 --> 00:25:26,280
Again, when you talk about the mindset, you have individuals that's running this particular industry that pretty much only have their interest in their group, right?

392
00:25:26,280 --> 00:25:28,760
And so, that's where you see with the pharma.

393
00:25:28,760 --> 00:25:32,680
Nobody thought that it was alarming that it's 95% European white males.

394
00:25:33,280 --> 00:25:34,520
I think everybody did.

395
00:25:34,980 --> 00:25:37,480
I don't know, but the ones that do go... Oh, no, absolutely.

396
00:25:37,480 --> 00:25:38,540
Yes, not everybody.

397
00:25:38,540 --> 00:25:39,420
Not everybody.

398
00:25:39,420 --> 00:25:40,140
Not everybody.

399
00:25:40,140 --> 00:25:42,460
People that weren't involved and were like, why can't I have that med?

400
00:25:42,460 --> 00:25:43,680
I saw it on TV.

401
00:25:43,780 --> 00:25:44,660
There you go.

402
00:25:46,040 --> 00:25:48,180
So, what's your shameless plug for you?

403
00:25:48,180 --> 00:25:49,420
What's your shameless plug?

404
00:25:49,580 --> 00:25:58,240
I mean, again, like I said, I think for me is it needs to be understood that this is a systemic racial issue from the beginning.

405
00:25:58,480 --> 00:26:02,120
I don't know how to Band-Aid fix it.

406
00:26:02,120 --> 00:26:24,580
So, the plug would be to re-engineer the way science is being done, how the scientists are being hired at the agency, because until you have diversity and inclusion, you're going to end up with another 50 years of white, 95% European males in the drug trials trying to treat,

407
00:26:24,580 --> 00:26:29,320
which is not going to be the majority anymore in the next 10 years.

408
00:26:29,320 --> 00:26:30,820
So, what are we doing?

409
00:26:30,940 --> 00:26:35,400
Your shameless plug is about you, not fixing the system.

410
00:26:35,880 --> 00:26:37,240
Oh, my shameless plug.

411
00:26:37,240 --> 00:26:39,260
I mean, I don't have a shameless plug.

412
00:26:39,260 --> 00:26:53,520
I just want to do good science and individuals that, you know, I think what my big concern is, there's a lot of innovation going on that's not being acknowledged because of who's behind it.

413
00:26:53,520 --> 00:26:59,740
And I think what I've seen over my career is that we need to change that.

414
00:26:59,740 --> 00:27:03,240
Because again, I think all you're seeing is these Me Too products.

415
00:27:03,240 --> 00:27:06,360
There's no innovation being done at large companies.

416
00:27:06,360 --> 00:27:20,080
Money has been spent on R&D for absolutely nothing at all, because I haven't seen any value add to a lot of these products, given the fact that it's being done in a bubble by white males and white institutions.

417
00:27:20,680 --> 00:27:23,020
Okay, thank you.

418
00:27:23,300 --> 00:27:33,160
We met in Abu Dhabi on a plane and had extensive conversations about medicine, because happenchance, you are a physician.

419
00:27:33,360 --> 00:27:34,860
What's your origin story?

420
00:27:35,920 --> 00:27:42,680
So the work on what eventually became telehealth really began with a Facebook page.

421
00:27:43,100 --> 00:28:02,180
I, back in like 2008, thought that the residents could benefit from having a professional Facebook page, and that, you know, it's a good way to share information and can be used in a little different way than kind of just the sharing pictures and family and friends aspect of it.

422
00:28:02,180 --> 00:28:05,840
But the professional societies hadn't really come around to it.

423
00:28:05,840 --> 00:28:10,260
So really, my career changed with a slide from Queen Elizabeth.

424
00:28:10,980 --> 00:28:23,980
Because when I showed Queen Elizabeth's Facebook page, and that we were not, you know, adopting new technology, even at the speed of Queen Elizabeth, I really do think that that was persuasive.

425
00:28:24,040 --> 00:28:34,300
So I think, while I have been given a fair amount of credit for kind of ushering ACOG into social media, a lot of it was Queen Elizabeth's influence.

426
00:28:34,880 --> 00:28:48,860
And so the work on social media began really with a legislative interest to kind of share stories and new legislative items that were coming up and to kind of get get awareness in a way that was a little more fun and socially engaging.

427
00:28:49,360 --> 00:28:57,120
That pretty quickly transitioned from social media to anything that engaged with apps on your phone.

428
00:28:57,380 --> 00:29:04,600
And while they are very different, you know, it's different to have an app on your phone that say is a step counter from having a social media profile.

429
00:29:04,900 --> 00:29:11,100
There was enough of a connection through the mobile devices that social media and mobile media, you know, overlapped.

430
00:29:11,500 --> 00:29:22,060
And I was doing my health policy training at the University of Pennsylvania, where they very astutely had formed the Social Media and Health Innovation Lab.

431
00:29:22,060 --> 00:29:23,220
So I joined them.

432
00:29:23,220 --> 00:29:37,380
And that was really the professional intersection of studying the big data and the new types of metrics we get from things like Twitter, like tracking flu season by tweets and those kinds of studies.

433
00:29:37,720 --> 00:29:54,560
And from there, you know, it really has been just kind of a series of progressions where you go from tracking health information via Twitter to health information via a wearable device, which, you know, has at least a commonality of connecting through apps.

434
00:29:55,060 --> 00:30:12,540
And ultimately kind of landed where we are now, which is a version of telehealth that is very different from social media profiles, but it relies on things that, you know, engage through wearable devices, patient-generated data, app connections.

435
00:30:12,560 --> 00:30:17,220
And then like what we're doing here, which has become routine in COVID era, which is the virtual visits.

436
00:30:17,920 --> 00:30:20,300
And obviously it's exploding right now.

437
00:30:20,300 --> 00:30:28,840
So that's kind of a brief synopsis of how I went from talking about Queen Elizabeth's Facebook page to doing virtual visits around the clock.

438
00:30:29,060 --> 00:30:32,220
So you gave an acronym and I'm not sure if people know what it is.

439
00:30:32,220 --> 00:30:33,340
So what's ACOG?

440
00:30:33,340 --> 00:30:33,820
Yeah.

441
00:30:33,860 --> 00:30:38,040
ACOG is the American College of Obstetricians and Gynecologists.

442
00:30:38,240 --> 00:30:42,040
So I want to dive into that because that's the kind of physician you are, correct?

443
00:30:42,040 --> 00:30:43,880
You deliver babies, you take care of moms.

444
00:30:43,880 --> 00:30:44,240
Right.

445
00:30:44,240 --> 00:30:51,220
So I'm a board certified OBGYN and the chair of telehealth for the professional society, ACOG.

446
00:30:51,400 --> 00:30:52,020
Perfect.

447
00:30:52,380 --> 00:30:59,920
So I think a lot of people, when they think of going to the hospital now, because of COVID, they're going in for tests and they're going in because they have COVID.

448
00:30:59,920 --> 00:31:08,420
But the one surgical suite that stayed open the whole time, or at least generality, stayed open the whole time was yours.

449
00:31:08,440 --> 00:31:13,960
So can you talk about what happened, what changed during the COVID?

450
00:31:14,420 --> 00:31:16,860
Just get into that.

451
00:31:17,280 --> 00:31:25,180
As with everything, it has been a series of moving targets and adaptions and adapting to maybe an overreaction.

452
00:31:25,280 --> 00:31:34,320
So a lot of it has changed, but the overall essence of it was the obvious necessity for still having inpatient care.

453
00:31:34,340 --> 00:31:44,540
So the recommendation has always been to come and receive your maternal care in a hospital, whether it's a delivery or a triage evaluation, management of blood pressure.

454
00:31:44,700 --> 00:31:48,260
In other words, not recommending going outside the hospital.

455
00:31:49,060 --> 00:31:56,060
And to make that as safe as possible, there were a number of new protocols.

456
00:31:56,060 --> 00:31:58,360
Some just limited who could be in the hospital.

457
00:31:58,360 --> 00:32:06,480
So a lot of it was keeping it to be just the patient and maybe one support person, which would often be, say, a spouse or a family member.

458
00:32:06,480 --> 00:32:16,400
Whereas the intention before COVID would have been to have multiple support people, either multiple family members or a doula or someone like that.

459
00:32:16,400 --> 00:32:18,120
So that initially changed.

460
00:32:18,120 --> 00:32:28,400
And there were some, unfortunately, kind of rigid policies that did change the birth experience and definitely changed the postpartum experience.

461
00:32:28,660 --> 00:32:38,480
As we've gotten better at rapid testing and symptom screening and mask wearing and PPE, those have become a little more lenient.

462
00:32:38,520 --> 00:32:43,260
But there still is an emphasis on getting patients in and out of the hospital as quickly as possible.

463
00:32:43,260 --> 00:32:53,740
So going home on day one after a vaginal delivery or day two after a c-section would be accelerated in normal situations, but it has kind of become routine right now.

464
00:32:54,280 --> 00:33:02,460
And then there's the whole testing element, where if you test positive, there is a whole other kind of precautionary protocol that gets put into place.

465
00:33:02,460 --> 00:33:07,500
And it does mean wearing more masks than you're probably used to for the patient.

466
00:33:07,500 --> 00:33:09,920
Definitely means more PPE for the providers.

467
00:33:10,060 --> 00:33:22,440
So it looks like a much more kind of medicalized version of the delivery, which is the safest thing we have right now.

468
00:33:23,000 --> 00:33:28,160
So you talked about social media and the way that it's working into better patient care.

469
00:33:28,160 --> 00:33:34,100
Are you familiar that the FDA is working on something like that, that they're bringing in all of that?

470
00:33:34,100 --> 00:33:35,420
Can you speak to that a little bit?

471
00:33:36,080 --> 00:33:39,760
So yeah, I can speak.

472
00:33:39,760 --> 00:33:42,260
I'm not part of that personally.

473
00:33:42,280 --> 00:33:44,620
So is that a call to action that you want to express?

474
00:33:44,620 --> 00:33:46,600
I may be expressing that for you.

475
00:33:46,600 --> 00:33:54,840
Yeah, it's definitely a call to action in that we need these kind of bi-directional flow of information.

476
00:33:54,840 --> 00:34:02,620
We need patients who can more directly interact with decision makers and with people who are making the health policies.

477
00:34:03,080 --> 00:34:20,420
It's a little bit different, I think, than initially you're talking about, but one of the most effective waivers during this COVID era was the allowance of different devices so that everybody can access virtual health, even if they don't have, say, some of the infrastructure that's not available in all communities.

478
00:34:20,420 --> 00:34:23,760
And examples of that would be like Skype, FaceTime.

479
00:34:23,900 --> 00:34:37,700
Most communities now, whatever the resource setting is, do have access to cell phones and enough, either Bluetooth or internet, that they could do a FaceTime visit or a Skype visit.

480
00:34:39,060 --> 00:34:46,820
So, what kind of interactions have you had with the security researcher community?

481
00:34:46,880 --> 00:34:49,180
And are you getting into that realm?

482
00:34:49,180 --> 00:34:50,520
Are you in that realm?

483
00:34:52,240 --> 00:34:53,640
We're wading in.

484
00:34:53,640 --> 00:34:55,600
We're probably about knee-deep right now.

485
00:34:55,600 --> 00:35:00,680
So, there's definitely an adult swim deep into this that we have not gone into.

486
00:35:00,680 --> 00:35:04,740
But even in the shallow waters, it's been very enlightening.

487
00:35:04,740 --> 00:35:18,480
Because what we want to see happen with this telehealth revolution is the best kind of transition from optimizing the benefits without falling prey to the pitfalls.

488
00:35:18,480 --> 00:35:24,320
And we know with any new technology that those pitfalls are there, often unintended.

489
00:35:24,360 --> 00:35:31,580
So, kind of a classic example would be any scientific discovery that, at an extreme, became very dangerous.

490
00:35:31,760 --> 00:35:34,800
Nuclear fission comes to mind.

491
00:35:35,080 --> 00:35:50,260
And when it comes to Facebook and social media, I think the extreme of that in the negative is pretty obvious right now, with all of the misinformation and all the ways that social media can negatively influence public perception of pseudoscience or influence elections.

492
00:35:50,600 --> 00:35:58,940
And what we want to do is harness the power of these things, because social media has also enabled Black Lives Matter and the Me Too movement.

493
00:35:58,940 --> 00:36:02,800
We want to maximize the good and minimize the bad.

494
00:36:03,000 --> 00:36:15,140
And we're learning right now what are the, you know, to switch analogies for a second, in vehicle safety, you know, what are the anti-lock brakes and seatbelts and air traffic control of telehealth?

495
00:36:15,140 --> 00:36:26,360
And, for example, in the kind of entry-level interaction I've had with the cybersecurity community, we don't have much training on the physician side.

496
00:36:26,380 --> 00:36:42,800
So, you know, when a doctor is talking about a device that might be beneficial to a patient, say like a remote blood pressure device, they probably, you know, genuinely just don't have a lot of training or information about the nuts and bolts of how that works and how safe the data is.

497
00:36:42,840 --> 00:36:48,940
They know to ask about it, they know to be concerned about it, but they don't have like the deeper level understanding.

498
00:36:49,660 --> 00:36:59,700
That's just one example of how, you know, data privacy is totally intimately intertwined with this, and doctors do have questions about it.

499
00:36:59,760 --> 00:37:01,800
So, I have two things for you.

500
00:37:01,940 --> 00:37:08,720
This year at the Biohacking Village, Andrea Downing is talking about disinformation on social media, and you should also have a conversation with Dr.

501
00:37:08,720 --> 00:37:11,240
Christian DeMeth and listen to his panel on Do No Harm.

502
00:37:11,240 --> 00:37:12,860
I can send you those links after.

503
00:37:12,940 --> 00:37:25,020
And the last thing I want from you is how can we as a community, the hacker community, cybersecurity community, help you in whatever next step it takes to get mid-thigh into that water?

504
00:37:25,020 --> 00:37:27,940
Yeah, well, exactly what you just proposed.

505
00:37:27,940 --> 00:37:32,500
I think we need a lot of these cross-disciplinary conferences.

506
00:37:32,500 --> 00:37:40,460
I think we need to be going to each other's lectures and learning each other's worlds a little bit first, and then finding out all the intersections.

507
00:37:40,900 --> 00:37:49,760
I do think ultimately, there's going to be a role for a lot of these conversations to take place outside the patient encounter.

508
00:37:50,460 --> 00:38:01,140
It's already such a short time we have to talk to patients about the things that we're trained in extensively, the immediate health of the patient right in front of us.

509
00:38:01,140 --> 00:38:14,980
To then dive into really complex topics about cybersecurity and patient-generated data and where that data sits and how protected it is, not only is it maybe beyond the scope of our time limits, it might be on the scope of our expertise.

510
00:38:15,600 --> 00:38:32,880
So I think finding a way that we can get patients the answers to those questions and get a well-informed citizenry of doctors to feel comfortable enough that they can confidently recommend the devices without having to get into all the deep weeds or deep end of the pool about exactly how it works.

511
00:38:32,900 --> 00:38:38,360
Finding the trusted sources to say, I don't know exactly how it works, but these guys do and we trust them.

512
00:38:38,360 --> 00:38:42,240
And so here's your kind of safety measures.

513
00:38:42,240 --> 00:38:43,620
Yet another plug.

514
00:38:43,620 --> 00:38:52,460
Meg Dewar is working on a cybersecurity informed consent project that would help patients and help you folks get that information to them.

515
00:38:52,460 --> 00:38:53,900
So this is the last question.

516
00:38:53,900 --> 00:38:57,100
What is your shameless plug for this conversation?

517
00:38:57,460 --> 00:39:06,740
My shameless plug is to have a post-COVID world that looks a lot like the current waivers and adaptations.

518
00:39:06,940 --> 00:39:12,260
So it doesn't mean that we have to continue all visits via Skype or FaceTime, for example.

519
00:39:12,920 --> 00:39:17,160
Even among the adopters, most have moved away from that already.

520
00:39:17,160 --> 00:39:18,700
They use things that are HIPAA compliant.

521
00:39:19,020 --> 00:39:20,500
It's a nice backup to have.

522
00:39:20,780 --> 00:39:22,920
But that's not the waiver that we're looking for.

523
00:39:22,920 --> 00:39:25,720
But we do need a lot of these other waivers to continue.

524
00:39:25,720 --> 00:39:31,080
We need doctors to see patients without, for example, a prior existing patient-doctor relationship.

525
00:39:31,080 --> 00:39:33,560
We can establish that for the first time virtually.

526
00:39:33,740 --> 00:39:37,180
We really need the cross-state lines flexibility.

527
00:39:37,740 --> 00:39:52,580
In fact, a totally shameless plug would be to have something akin to a national medical license, where if you're licensed in one state, you can practice anywhere, the same way that you can prescribe anywhere in the United States with a DEA number, or you can drive anywhere in the United States with a driver's license.

528
00:39:53,220 --> 00:39:56,040
We need payers to continue to fund this.

529
00:39:56,040 --> 00:40:00,560
They've been doing an admirable job adapting to the current climate.

530
00:40:00,560 --> 00:40:01,820
We need that to continue.

531
00:40:01,820 --> 00:40:14,540
And we need the people using it right now to be open to still some reining in of all the new technology.

532
00:40:14,540 --> 00:40:25,240
In other words, we know that things like virtual visits and online care are still prone to overuse and fraud and all the things that in-person care is prone to.

533
00:40:25,240 --> 00:40:36,200
So while I'm calling for many of the waivers to stay in place and not be reenacted, we will need some new things that come in and we need to be open to those so we can continue to use it safely.

534
00:40:36,440 --> 00:40:37,800
Thank you so much.

535
00:40:38,160 --> 00:40:39,740
Thank you.

536
00:40:39,740 --> 00:40:40,800
Hey girl, hey.

537
00:40:40,800 --> 00:40:43,880
Hey girl, hey, hey, hey.

538
00:40:43,980 --> 00:40:45,500
This is Najla Lindsay.

539
00:40:45,500 --> 00:40:47,880
She is on the board with us.

540
00:40:47,880 --> 00:40:52,860
She helps us do the things and accomplish all the things that you're about to experience.

541
00:40:53,620 --> 00:40:55,220
I have a question.

542
00:40:55,880 --> 00:40:57,780
I may have some answers, Nina.

543
00:40:57,780 --> 00:40:59,700
I may have some answers for you.

544
00:40:59,880 --> 00:41:01,040
Are you ready?

545
00:41:01,380 --> 00:41:02,620
I'm gonna get into it.

546
00:41:02,620 --> 00:41:05,020
So what's your origin story?

547
00:41:05,020 --> 00:41:06,520
Two, three sentences.

548
00:41:07,780 --> 00:41:21,060
Forensic scientist lover, wine lover, and I am here to share forensic science and information security is hand in hand.

549
00:41:21,060 --> 00:41:22,600
That's just, that's the bottom line.

550
00:41:22,600 --> 00:41:30,760
They are lifetime lovers and part-time friends right now and I need them to be full-time friends as well as the lifetime lovers.

551
00:41:30,760 --> 00:41:33,040
So that's it in a nutshell.

552
00:41:33,120 --> 00:41:38,920
I was going to ask about your shameless plug, but you clearly already got this because that was the title of your talk for last year.

553
00:41:38,920 --> 00:41:41,500
So hashtag go to YouTube.

554
00:41:41,680 --> 00:41:42,840
It's all in there.

555
00:41:46,380 --> 00:41:48,500
You're up and coming as a researcher.

556
00:41:48,500 --> 00:41:50,040
You're doing all the things.

557
00:41:50,320 --> 00:41:54,400
What do you need from our community to help you get to that next level?

558
00:41:54,400 --> 00:42:00,620
Because if anybody follows you on the Twitters, you just, it's all the time every day doing the things.

559
00:42:00,620 --> 00:42:02,220
How can we help you?

560
00:42:02,740 --> 00:42:03,560
How can we help?

561
00:42:03,560 --> 00:42:04,880
How can you help me?

562
00:42:05,860 --> 00:42:15,140
You know, share, you know, the resources that I share, share things that I'm doing with the community and reach out to me.

563
00:42:15,400 --> 00:42:17,360
I'm always open to have a discussion.

564
00:42:17,360 --> 00:42:19,300
I'm always open to learn something new.

565
00:42:19,360 --> 00:42:38,660
I don't know everything and I think that the community is full of experts and people that know so much that there needs to be a bridge to, you know, career transitioners like myself and, you know, recent graduates and, you know, the people that have been in the industry for years.

566
00:42:38,660 --> 00:42:50,720
So I'm always willing to have a conversation, talk to you, share my resources, and, you know, just be genuine and in your reach as well.

567
00:42:51,140 --> 00:42:54,100
Because it's no sense in being fake with me.

568
00:42:54,100 --> 00:42:55,340
I'm not fake with anybody.

569
00:42:55,340 --> 00:43:01,000
Just be genuine in your reach and reach out to me, talk to me, and teach me something new.

570
00:43:01,560 --> 00:43:02,880
Learn something new every day.

571
00:43:04,520 --> 00:43:07,500
You talked about your forensic science work.

572
00:43:07,500 --> 00:43:17,080
How do you see the overlap of DFIR, science, security, technology, healthcare?

573
00:43:17,580 --> 00:43:20,480
It's all intertwined.

574
00:43:20,600 --> 00:43:32,500
And I like to tell people that, you know, a lot of people that are currently studying digital forensics, they don't know that that's actually a branch and a discipline in forensic science.

575
00:43:32,760 --> 00:43:47,220
And once people learn and actually take into their work that this is from a scientific discipline, what you do in digital forensics can go to court.

576
00:43:47,220 --> 00:43:53,380
Like, you can testify based on what evidence you have processed, what evidence you have found, what story you're telling.

577
00:43:53,380 --> 00:43:55,700
And that could be a make or break for someone.

578
00:43:55,700 --> 00:44:03,540
You can wind up putting someone in jail or you can wind up freeing someone and exonerating them from a crime that they've probably been in jail for for years.

579
00:44:03,600 --> 00:44:10,440
And so I always like to remind people that they are together, whether you like it or not.

580
00:44:10,440 --> 00:44:15,160
And I think that people forget that you have to take the scientific approach to a lot of things.

581
00:44:15,200 --> 00:44:19,100
That scientific method, we didn't learn that just to learn it.

582
00:44:19,100 --> 00:44:21,860
We learned it because it actually applies.

583
00:44:21,860 --> 00:44:28,860
You have a hypothesis and you have to test it out, not just once, not twice, various times and with various people.

584
00:44:28,860 --> 00:44:35,400
Because what I get when I do it will be a different result and can be a different result from what you get.

585
00:44:35,400 --> 00:44:38,600
And it doesn't hurt to share the information.

586
00:44:38,600 --> 00:44:41,900
You're not going to lose anything by sharing what you learn.

587
00:44:42,080 --> 00:44:57,600
And I think that it will forever be intertwined as digital forensics gets more popular because that's also taking the turn and being the talk of the town of cybersecurity, information security.

588
00:44:57,600 --> 00:45:05,120
I think it's important that people remember or know, just even learn that this is a part of forensic science.

589
00:45:05,120 --> 00:45:07,160
This is a science discipline.

590
00:45:07,260 --> 00:45:13,420
And the more you think methodically about it, the better you will be as a practitioner in the field.

591
00:45:13,420 --> 00:45:16,980
And that's either as a researcher or if you're working full-time as well.

592
00:45:18,580 --> 00:45:26,100
So not a lot of people consider digital forensics in healthcare because there are no laws surrounding it.

593
00:45:26,100 --> 00:45:30,920
If something goes wrong, you re-image it, you keep moving, you keep going.

594
00:45:30,920 --> 00:45:33,960
How do you see the transition happening?

595
00:45:33,960 --> 00:45:34,840
Is it happening?

596
00:45:34,840 --> 00:45:36,000
Is it going to happen?

597
00:45:36,000 --> 00:45:37,160
What do you see the future?

598
00:45:37,460 --> 00:45:48,800
So with healthcare, I find that they're always at least five to 10 years behind on making the transition to updated technology, just in general.

599
00:45:48,800 --> 00:45:59,480
Just switching to have Windows 10 on all of their computer systems in the hospital can sometimes take much longer than private organizations or government organizations.

600
00:45:59,480 --> 00:46:04,220
And so I think that the healthcare industry is still catching up.

601
00:46:04,480 --> 00:46:18,800
Healthcare, a lot of people didn't think about, oh, I have to worry about securing this device and making sure someone don't try and trip it and increase, you know, let's say you take insulin, you have an insulin pump, and increase my insulin pump or,

602
00:46:18,800 --> 00:46:26,520
you know, mess with the anesthesiologist who is very important during surgery because one wrong dose can kill somebody.

603
00:46:26,520 --> 00:46:39,460
So your hospital go down and your anesthesiology equipment is on a network and somebody decides to play with it, you're just completely out of luck.

604
00:46:39,460 --> 00:46:55,060
So I think that as more people are aware of, you know, the biohacking village, as more people are aware of, you know, healthcare and medical device security and how important that it is to think about security at the beginning and not the after effect,

605
00:46:55,060 --> 00:47:00,200
I think that people will start to realize, oh crap, we actually have to take care of this.

606
00:47:00,200 --> 00:47:10,800
And I think if manufacturers, there's a couple manufacturers that I know that they started implementing on their websites where you can learn about stuff that has issues.

607
00:47:10,920 --> 00:47:20,160
And so they want to make sure that the community is aware so that, you know, they're doing, they have their methods to build in and make sure that everything works better.

608
00:47:20,160 --> 00:47:30,160
I think the more that people actually have conversations because as much as big and as much as cybersecurity is, they don't talk to each other.

609
00:47:30,160 --> 00:47:33,600
Like people within the industry and the organizations don't talk to each other.

610
00:47:33,600 --> 00:47:36,000
It's like a hush hush thing.

611
00:47:36,080 --> 00:47:39,940
And I just feel like this is actually the same thing in forensic science too.

612
00:47:39,940 --> 00:47:52,820
But I think that the more that you talk, the better we can come together and the better we can build these, you know, these instruments and these medical devices, because that's the only way we're going to make healthcare better for everyone.

613
00:47:52,820 --> 00:47:56,740
It's not about, oh, you get access to healthcare and you don't.

614
00:47:57,040 --> 00:48:07,940
You have to think security at the forefront and not at the, at the, at the end of it, because it actually costs you more when you think about it at the end versus with it in mind as you're doing it.

615
00:48:08,300 --> 00:48:11,080
So it's all intertwined, all of it.

616
00:48:11,820 --> 00:48:18,500
So in recent history, you were part of, share the mic, in cybersecurity.

617
00:48:18,760 --> 00:48:19,980
Oh yeah.

618
00:48:21,600 --> 00:48:25,160
So what was, what was that like?

619
00:48:25,160 --> 00:48:26,700
What were the outcomes?

620
00:48:27,860 --> 00:48:33,760
Um, that was like one of the best things that I've ever been a part of.

621
00:48:33,840 --> 00:48:42,380
Um, and, you know, I, when I got paired with Rachel Toback of WISP, you know, I had known of Rachel.

622
00:48:42,380 --> 00:48:50,440
I hadn't really talked to her as much, but I had known of Rachel because I wind up being able to receive a WISP scholarship last year for DEFCON.

623
00:48:50,440 --> 00:48:52,760
So that was very helpful in me attending DEFCON.

624
00:48:52,760 --> 00:48:56,820
And on top of that, we just clicked instantly.

625
00:48:56,820 --> 00:48:58,700
I learned so much about her.

626
00:48:58,760 --> 00:49:00,960
Um, and we put a plan together.

627
00:49:00,960 --> 00:49:03,800
We put a plan because, because you're, you're on Twitter.

628
00:49:03,940 --> 00:49:05,880
You're not necessarily doing videos.

629
00:49:05,880 --> 00:49:08,140
It's a tweet and you put together some tweets.

630
00:49:08,140 --> 00:49:09,320
We put together some tweets.

631
00:49:09,320 --> 00:49:14,840
We put together an action plan and just talked about, you know, what it is that I'm trying to do, what it is that you're looking for.

632
00:49:14,880 --> 00:49:19,860
Um, you know, certifications that you're doing and all of the like.

633
00:49:19,860 --> 00:49:23,980
And so we put it together Thursday night, everything was set.

634
00:49:24,300 --> 00:49:26,640
And then Friday, everything, I was at work.

635
00:49:26,860 --> 00:49:30,100
I still work in my forensic science industry.

636
00:49:30,100 --> 00:49:35,800
So I was at work when all of this was going on, but I knew what the tweets were because we talked through them and we worked through them.

637
00:49:36,220 --> 00:49:41,520
And I wanted, you know, funding for my certifications.

638
00:49:41,800 --> 00:49:43,680
And I wanted to attend the SANS class.

639
00:49:43,680 --> 00:49:53,380
And we know, you know, SANS has been, um, looked at as like one of the main industry certifications to achieve and attend that class.

640
00:49:53,380 --> 00:49:59,060
And so I was fortunate to be able to receive a full scholarship to attend one of their classes.

641
00:49:59,060 --> 00:50:05,320
I was able to get all of my certification, um, certification costs covered.

642
00:50:05,320 --> 00:50:14,020
And then they wind up covering all of the black cybersecurity professionals, um, certifications and trainings.

643
00:50:14,220 --> 00:50:29,080
And to, to still, you know, make that, you know, hey, I'm going to still get all of these people, um, make that the forefront and say, hey, I'm, I want these people to progress.

644
00:50:29,080 --> 00:50:30,920
I want these people to win.

645
00:50:30,920 --> 00:50:32,740
Um, I think that that was amazing.

646
00:50:32,740 --> 00:50:33,600
It felt amazing.

647
00:50:33,600 --> 00:50:37,700
And I was elated, um, all day at work.

648
00:50:37,740 --> 00:50:41,340
I was on my, I was just so elated at work.

649
00:50:41,340 --> 00:50:43,080
They couldn't even tell me, they was like, are you okay?

650
00:50:43,080 --> 00:50:47,040
I'm like, I'm not sure, but I'm here and I'm going to get my work done.

651
00:50:47,040 --> 00:50:48,980
But it was so amazing.

652
00:50:49,260 --> 00:51:04,020
Um, and then later on in the day, Rachel and I actually went live on Periscope and we had a discussion about, you know, you know, being black in the industry, um, and what it is that people can do to help black cybersecurity professionals.

653
00:51:04,120 --> 00:51:17,580
And so, um, that whole day was just full of adrenaline and full of, you know, happiness and gratitude, um, and people using their platform to promote other people's voices that don't typically have a voice.

654
00:51:17,580 --> 00:51:18,860
So I loved it.

655
00:51:18,860 --> 00:51:24,060
Um, and Rachel and I are still building our relationship in the background and learning about each other and things like that.

656
00:51:24,060 --> 00:51:27,020
And I think all of the participants are also doing that.

657
00:51:27,020 --> 00:51:28,720
So it was, it was amazing.

658
00:51:28,720 --> 00:51:34,380
I hope that it continues to grow into something much larger, um, going forward.

659
00:51:34,980 --> 00:51:38,600
How can the biohacking village participate or do better with it?

660
00:51:39,780 --> 00:51:46,780
Um, you, as a biohacking village, I think that you have to make a conscious effort.

661
00:51:46,780 --> 00:51:54,100
And then to some people, it may look like you're being biased because you may focus on underrepresented minorities or things like that.

662
00:51:54,100 --> 00:51:59,160
And I think a good way, because normally the biohacking village just does an event during DEF CON, right?

663
00:51:59,340 --> 00:52:10,280
Um, I think that, you know, during the year, you know, after, you know, a couple of months later down the line, do, do... Are you secret dropping?

664
00:52:10,280 --> 00:52:11,920
You got to cut this out.

665
00:52:12,340 --> 00:52:14,560
No, I'm just telling you what I think.

666
00:52:16,440 --> 00:52:19,300
I'm just telling you things that I think that would be helpful.

667
00:52:19,300 --> 00:52:29,160
You know, maybe start a partnership or a mentor program with, um, you know, some people, get people involved in, in it and promote it, you know, consistently.

668
00:52:29,420 --> 00:52:34,680
Um, you know, especially during, uh, Cybersecurity Awareness Month, everybody participates in it, right?

669
00:52:34,680 --> 00:52:35,720
Like last year I did that.

670
00:52:35,720 --> 00:52:40,160
I was dropping random tips of the day, like, and doing that.

671
00:52:40,160 --> 00:52:51,620
I think that the more that people learn that the biohacking village is out there, the more that people will want to participate and know about, you know, healthcare and medical device security.

672
00:52:51,620 --> 00:53:00,980
I think that is, you know, keep, you know, tweeting and sharing, you know, information and reaching out and being personable.

673
00:53:00,980 --> 00:53:07,200
I think that's all going to do a world of good as we continue to grow, because I'm not going anywhere.

674
00:53:07,200 --> 00:53:09,000
Nina, you're stuck with me, just so you know.

675
00:53:09,000 --> 00:53:10,460
I was never letting you go.

676
00:53:10,520 --> 00:53:12,080
Okay, just so we're clear here.

677
00:53:12,080 --> 00:53:13,560
I was never an option.

678
00:53:17,700 --> 00:53:20,160
So what's your controversial opinion?

679
00:53:20,880 --> 00:53:32,130
Whew, um, wow, you tripped me up here.

680
00:53:32,370 --> 00:53:34,270
Good one, actually.

681
00:53:34,350 --> 00:53:53,190
Um, my controversial opinion is that I, I see, I see people being performative on making sure that Black people get heard in the industry.

682
00:53:53,830 --> 00:53:57,910
But it means nothing, because you're not actually doing anything.

683
00:53:57,910 --> 00:54:00,970
And I can see right through you pretending to do anything.

684
00:54:00,990 --> 00:54:16,890
And I think that, you know, even with share the mic and cyber, it's, I feel like it'll be a moment in time for some people, and for a lot of people, because you have the same type of people at the top of the industry.

685
00:54:17,110 --> 00:54:19,570
And they have a lot of say.

686
00:54:19,570 --> 00:54:24,150
And it, and the industry follows a lot of what those top people say.

687
00:54:24,150 --> 00:54:34,450
So I think sometimes, you know, doing all of this and making sure that, you know, people get heard.

688
00:54:36,590 --> 00:54:40,250
Let's check back around wintertime and see what's been happening.

689
00:54:40,250 --> 00:54:45,910
Because I know, or I feel, that stuff's not going to look the same.

690
00:54:47,290 --> 00:54:49,870
So, controversial opinion.

691
00:54:49,870 --> 00:54:51,150
What's your call to arms?

692
00:54:51,890 --> 00:54:56,070
My call to arms is don't talk about it, be about it.

693
00:54:56,510 --> 00:55:01,030
Go make for the next, listen, we're in Rona.

694
00:55:03,050 --> 00:55:04,070
It's Rona.

695
00:55:04,070 --> 00:55:06,270
You're like, it's coronavirus.

696
00:55:06,710 --> 00:55:11,210
Most states, most countries are locked down.

697
00:55:12,250 --> 00:55:18,930
Reach out to somebody in the industry, not a white person.

698
00:55:20,910 --> 00:55:25,730
Not, no, no, no, not a white person, not a white male, not a white female.

699
00:55:26,230 --> 00:55:34,450
Somebody that does not look like you, that you've never actually talked to either, because you can tend to have a bias against the people that you've already known.

700
00:55:34,650 --> 00:55:36,790
And you just choose that because that's your comfort zone.

701
00:55:36,790 --> 00:55:39,110
No, no, no, no, no, we want you out of your comfort zone.

702
00:55:39,250 --> 00:55:47,590
We want you to be held accountable for your thoughts, your feelings, and your words, and your actions.

703
00:55:47,790 --> 00:56:02,150
Reach out to somebody, a black person, a Latino person, an Asian person, somebody not related to you in any way, fashion form that you've never talked to, and get to know them genuinely.

704
00:56:02,150 --> 00:56:06,030
Don't expect anything in return, nothing.

705
00:56:06,030 --> 00:56:11,510
I mean, not an ounce of nothing.

706
00:56:12,790 --> 00:56:24,490
See what happens to yourself as you choose to develop a relationship with someone with no transactional expectations.

707
00:56:24,650 --> 00:56:28,370
See what happens to yourself, not for them, for you.

708
00:56:28,370 --> 00:56:35,870
Because I can guarantee you, when you start to do stuff without expecting anything in return, you feel good.

709
00:56:35,870 --> 00:56:44,050
And you realize that the stuff, and the values, and the beliefs that you have now, they can change.

710
00:56:44,050 --> 00:56:47,070
They don't have to be there for the rest of your life.

711
00:56:47,070 --> 00:56:51,170
And your life's not going to end because you've changed a value or belief.

712
00:56:51,170 --> 00:56:52,290
It's not going to end.

713
00:56:52,290 --> 00:56:53,890
It's only going to get better.

714
00:56:54,130 --> 00:56:58,550
And if it don't get better, I'm sorry, you're not growing.

715
00:56:58,550 --> 00:57:00,090
And you're going to be stuck.

716
00:57:00,650 --> 00:57:04,630
So choose somebody you've never talked to.

717
00:57:04,630 --> 00:57:05,290
Go on LinkedIn.

718
00:57:05,290 --> 00:57:11,190
LinkedIn is the place of people just, I feel like they just Google and just reach out to people.

719
00:57:11,370 --> 00:57:12,430
Go on LinkedIn.

720
00:57:12,610 --> 00:57:13,650
Check Twitter.

721
00:57:14,290 --> 00:57:15,690
Check hashtags.

722
00:57:15,950 --> 00:57:16,970
Go on there.

723
00:57:16,970 --> 00:57:18,370
Go talk to someone.

724
00:57:18,430 --> 00:57:20,070
Build a genuine relationship.

725
00:57:20,130 --> 00:57:21,510
Find out about them.

726
00:57:21,510 --> 00:57:24,370
Reach out and take it from here.

727
00:57:24,970 --> 00:57:26,830
Commit to it for the next six months.

728
00:57:27,470 --> 00:57:28,110
I'll make it easy.

729
00:57:28,110 --> 00:57:29,290
I won't even say a year.

730
00:57:29,290 --> 00:57:30,630
For the next six months.

731
00:57:30,630 --> 00:57:31,470
Into the new year.

732
00:57:31,470 --> 00:57:32,090
Actually, it's five.

733
00:57:32,090 --> 00:57:34,350
Let's make it into January 2020.

734
00:57:35,110 --> 00:57:36,470
And see what happens.

735
00:57:37,650 --> 00:57:40,350
And reach out to me on Twitter and tell me what happened when you did this.

736
00:57:40,350 --> 00:57:41,550
Because I would like to know.

737
00:57:41,570 --> 00:57:42,510
I love that.

738
00:57:43,510 --> 00:57:44,410
That's it.

739
00:57:44,690 --> 00:57:48,050
I love the passion you bring to pretty much every single conversation.

740
00:57:51,010 --> 00:57:52,550
Let's do it.

741
00:57:53,130 --> 00:57:54,590
Thank you.

742
00:57:54,590 --> 00:57:56,130
You are very welcome.

743
00:57:56,150 --> 00:58:02,550
So fun fact about this quarantine is Canibal and I started cooking together on the weekends.

744
00:58:03,330 --> 00:58:04,830
Three hour time difference.

745
00:58:05,630 --> 00:58:07,070
He's Mexican.

746
00:58:07,110 --> 00:58:08,310
I'm Puerto Rican.

747
00:58:08,310 --> 00:58:11,270
We started making dishes from each other's cultures.

748
00:58:11,270 --> 00:58:12,430
It opened up our eyes.

749
00:58:12,430 --> 00:58:14,030
We're like super homies now.

750
00:58:14,030 --> 00:58:14,970
It's amazing.

751
00:58:14,970 --> 00:58:19,450
It is probably one of the best friendships I have ever cultivated.

752
00:58:19,450 --> 00:58:22,130
And thank you for being on here.

753
00:58:25,770 --> 00:58:30,330
So quick, just to get to know you, question.

754
00:58:31,170 --> 00:58:33,670
Two lines, one minute.

755
00:58:33,770 --> 00:58:35,070
What's your origin story?

756
00:58:36,210 --> 00:58:37,030
All right.

757
00:58:37,030 --> 00:58:38,370
Origin story.

758
00:58:38,450 --> 00:58:40,570
It's going to be a little bit more than two lines.

759
00:58:40,570 --> 00:58:44,130
But I started out in the medical industry.

760
00:58:44,130 --> 00:58:49,110
This was 12-ish years ago for a medical device manufacturer.

761
00:58:49,690 --> 00:58:58,430
And it's kind of how I got into medical and how I got into security where I was brought in actually more of a support role.

762
00:58:59,110 --> 00:59:03,030
And I noticed that, hey, these devices aren't being patched.

763
00:59:03,030 --> 00:59:05,790
Nobody's really taking the lead on this.

764
00:59:05,790 --> 00:59:09,170
So I just started doing it on top of my other stuff.

765
00:59:09,950 --> 00:59:12,870
And that was kind of it.

766
00:59:12,870 --> 00:59:20,090
At one point, it started rolling up into, oh, hey, hospitals are starting to get hit with ransomware.

767
00:59:20,090 --> 00:59:21,850
This is kind of a big deal.

768
00:59:21,850 --> 00:59:25,870
I'm like, yeah, I've been doing this for years because you guys didn't care about it.

769
00:59:25,870 --> 00:59:26,410
Right.

770
00:59:26,470 --> 00:59:27,470
Perfect segue.

771
00:59:27,550 --> 00:59:30,910
So you've been around the industry for a super long time.

772
00:59:31,030 --> 00:59:39,270
So you've seen it go from health care instantiation with technology and security to where we are now.

773
00:59:39,270 --> 00:59:43,370
What are the biggest differences you see and how much do we still have to go?

774
00:59:44,330 --> 00:59:47,370
There is still so much work that needs to be done.

775
00:59:47,470 --> 00:59:48,810
So, so much work.

776
00:59:50,290 --> 00:59:53,090
I think people are more aware.

777
00:59:53,790 --> 01:00:12,670
I'm talking about a populist standpoint, not so much the medical industry, but people are more aware of their data, the sensitivity of things, and that security is important, especially on devices that are connected to people or those people are relying on those devices for their safety and their well-being.

778
01:00:14,850 --> 01:00:17,370
Things were a mess.

779
01:00:17,610 --> 01:00:21,390
They're still a mess, but not as much of a mess.

780
01:00:22,190 --> 01:00:28,470
I think a lot of it has to do with, one of the things is the regulations, HIPAA.

781
01:00:29,070 --> 01:00:30,650
There's not enough there.

782
01:00:31,330 --> 01:00:36,070
Their heart's in the right place, but they have no way of enforcing it.

783
01:00:36,110 --> 01:00:37,790
The claws have no teeth.

784
01:00:38,510 --> 01:00:39,750
Claws have no teeth.

785
01:00:39,750 --> 01:00:42,170
That's kind of funny because it sounds like it's a cat.

786
01:00:43,410 --> 01:00:44,690
A healthcare cat?

787
01:00:44,690 --> 01:00:45,430
Right.

788
01:00:45,430 --> 01:00:47,590
So, I'm going to bend you on that.

789
01:00:47,590 --> 01:00:48,070
Okay.

790
01:00:48,070 --> 01:00:55,950
So, what would give healthcare policy makers, regulators more teeth?

791
01:00:55,950 --> 01:01:04,810
How do they, and just an extension of that, so then how do they engage more with the sec community hackers to make this better?

792
01:01:05,370 --> 01:01:07,950
How would you like to be engaged by these people?

793
01:01:07,950 --> 01:01:08,650
Yes.

794
01:01:09,110 --> 01:01:17,490
So, that's kind of a, there's no quick, easy answer to it, unfortunately, but this isn't a new issue.

795
01:01:17,550 --> 01:01:20,110
We've known about this for a really long time.

796
01:01:20,110 --> 01:01:34,750
It's one of those things where if we, if something were just started now, in five, six years from now, we could look back and say, oh, yeah, we still don't have a great plan, but there's something, there's at least this momentum that we can build off of.

797
01:01:36,910 --> 01:01:47,110
Getting some sort of enforcement policy in place, and that usually comes with auditors or someone that would like basically go to each hospital.

798
01:01:47,970 --> 01:01:59,670
Some sort of government funding would be helpful because a lot of the hospitals, a lot of people think that hospitals are making money hand over fist because of how much they cost, but they're just, they're trying to break even.

799
01:02:00,090 --> 01:02:01,870
A lot of hospitals are running in the red.

800
01:02:03,790 --> 01:02:05,710
And they really don't have the money.

801
01:02:05,710 --> 01:02:07,450
A lot of them don't even have IT staff.

802
01:02:07,650 --> 01:02:19,970
A lot of them outsource their IT, and it's one of those things where the doctor will call up and say, hey, I want to be able to check my x-rays or whatever from home, punch this hole through the firewall so I can get access to my machines.

803
01:02:20,930 --> 01:02:32,030
Having some sort of standardized IT policy for hospitals that the government can say, hey, here's a framework, you can either use this or use your own, but you got to use something.

804
01:02:32,650 --> 01:02:41,250
That would be a huge step forward, just having some sort of basic guideline so that the hospitals aren't fumbling around in the dark trying to figure this out.

805
01:02:41,710 --> 01:02:48,350
Newer hospitals tend to be better, but there's so many old hospitals that are just kind of like cobbling things on as they go.

806
01:02:48,870 --> 01:02:49,990
Most hospitals...

807
01:02:51,290 --> 01:02:51,790
What's that?

808
01:02:51,790 --> 01:02:58,930
Working with those legacy devices that they have to continue to integrate and continue to protect with the other things that are coming in.

809
01:02:58,930 --> 01:03:03,630
A lot of hospitals, especially on the East Coast, have been around since before computers were even a thing.

810
01:03:05,790 --> 01:03:07,410
Yeah, right, it's crazy.

811
01:03:07,650 --> 01:03:08,210
Technology.

812
01:03:08,210 --> 01:03:10,590
A lot of them are like, how do I use this fax machine?

813
01:03:10,590 --> 01:03:11,810
I almost took that personal.

814
01:03:11,810 --> 01:03:12,750
I was like, what do you mean?

815
01:03:12,750 --> 01:03:14,770
Are you talking about New York specifically?

816
01:03:15,050 --> 01:03:17,030
Yeah, especially New York.

817
01:03:17,370 --> 01:03:19,130
No, it's actually true, right?

818
01:03:20,630 --> 01:03:22,870
So you're not in healthcare anymore, right?

819
01:03:22,870 --> 01:03:24,410
No, I am no longer in healthcare.

820
01:03:24,410 --> 01:03:26,970
I've been out for maybe three or four years.

821
01:03:26,970 --> 01:03:34,190
So I don't know if you want to talk about the industry you're in, but how does that industry, how can that industry that you're currently in influence what healthcare is doing?

822
01:03:34,850 --> 01:03:40,690
So I'm a Threat Hunter Red Team for local government.

823
01:03:41,230 --> 01:03:51,410
And just having... so my issue with that type of work is the hospitals just need the basics.

824
01:03:52,690 --> 01:04:04,590
It's great that these devices on the user side have two or MFA, usually three forms of authentication in order to be able to pull meds or change access to a patient's record.

825
01:04:04,790 --> 01:04:08,370
But on the admin side of things, a lot of those don't have multi-factor authentication.

826
01:04:08,370 --> 01:04:09,650
It's single auth.

827
01:04:09,670 --> 01:04:13,970
So it's great that the users have to do this, but the admins don't.

828
01:04:14,030 --> 01:04:21,930
The technical side of things is just like, it's just oftentimes a reused password across the vendor.

829
01:04:23,070 --> 01:04:24,350
And I mean, pick your vendor a lot.

830
01:04:24,350 --> 01:04:25,810
Pretty much all of them have it.

831
01:04:26,910 --> 01:04:32,350
So what's your call to action for healthcare or the hacker community, whoever?

832
01:04:34,750 --> 01:04:36,210
So many things.

833
01:04:36,330 --> 01:04:37,330
There's so many things.

834
01:04:37,430 --> 01:04:39,690
One of them is just education.

835
01:04:41,330 --> 01:04:45,090
Get educated on what hospital you're going to.

836
01:04:45,390 --> 01:04:47,270
What standards do they have?

837
01:04:47,270 --> 01:04:48,870
What equipment do they use?

838
01:04:48,870 --> 01:04:51,890
Ask them, how is my information going to be used?

839
01:04:51,890 --> 01:04:53,990
I mean, as a patient, this is what you're talking about.

840
01:04:53,990 --> 01:04:54,270
As a patient.

841
01:04:54,270 --> 01:04:54,730
As a patient.

842
01:04:55,390 --> 01:05:04,090
As a hospital, it'd be one of those things of like, yeah, holding your vendor a little bit more accountable as to what equipment they're putting on your network.

843
01:05:04,350 --> 01:05:07,850
So many of them basically say, hey, we're on your network.

844
01:05:07,850 --> 01:05:15,290
It's up to you to protect this equipment, not we're going to harden this stuff because, you know, we don't know what's there.

845
01:05:15,550 --> 01:05:18,210
And every hospital is different.

846
01:05:18,270 --> 01:05:22,110
There's no standardized network for hospitals.

847
01:05:22,690 --> 01:05:29,850
I keep kind of going back to the whole standardized policy thing of this is a basic framework.

848
01:05:30,090 --> 01:05:32,930
You're welcome to modify this as much as you want.

849
01:05:33,450 --> 01:05:35,470
But these are the basics.

850
01:05:35,470 --> 01:05:46,030
You need to, be able to segment off some of this equipment or have a standardized 2FA or MFA policy for your internal staff and admins.

851
01:05:46,170 --> 01:05:50,310
And if you're not going to have your on-site IT, these are the rules they have to play by.

852
01:05:50,330 --> 01:05:55,390
So what if it's a baseline where people just have to meet this very small criteria to meet?

853
01:05:55,610 --> 01:05:58,890
And then from there they can build up, but they cannot go below?

854
01:05:58,890 --> 01:05:59,690
Right.

855
01:06:00,090 --> 01:06:05,190
Who would be the organizing body to lead that or who would be involved in that?

856
01:06:05,190 --> 01:06:08,530
That would seem like it'd be kind of fall onto the FDA.

857
01:06:09,990 --> 01:06:23,450
And there's, they have some stuff, but it doesn't really call out a basic framework or some sort of structure that hospitals can, can fall back on if they have these questions that are going unanswered.

858
01:06:24,850 --> 01:06:27,070
So we're almost out of time.

859
01:06:27,070 --> 01:06:27,650
Okay.

860
01:06:27,650 --> 01:06:29,850
So what's your shameless plug?

861
01:06:30,490 --> 01:06:31,630
I don't have one.

862
01:06:31,630 --> 01:06:38,270
Just, just get angry, get, get informed and like realize how like, how poorly everything has been.

863
01:06:38,910 --> 01:06:42,570
They're like, this is this, none of this is new.

864
01:06:42,570 --> 01:06:47,310
We've, we've been talking about this for 10 years and very little has been done.

865
01:06:47,610 --> 01:06:57,150
One, one thing I will plug is if you look up the HHS breach report, whenever there's a breach, it has to be notified.

866
01:06:57,150 --> 01:07:09,230
It has to be reported and you can go and you can read these reports and you can see is like, Oh, look, 10,000 records just got breached or this other, you know, CVS got breached.

867
01:07:09,230 --> 01:07:14,290
There was one recently, I think within the last week for CVS in one specific area.

868
01:07:14,290 --> 01:07:18,370
And it's one of those things where it's like, I feel like nobody's really looking at this.

869
01:07:18,370 --> 01:07:20,330
Think about how CVS is networked, right?

870
01:07:20,330 --> 01:07:22,410
You can go to any CVS and pick up your meds.

871
01:07:22,410 --> 01:07:27,270
So it's not just a singular, a singular one area that got hit.

872
01:07:27,270 --> 01:07:35,610
If you go to Google and you just search for the HHS breach report, that's a hotel, hotel, Sierra breach report.

873
01:07:37,210 --> 01:07:44,230
It'll take you to a page and you scroll down and you look for breaches greater than 500 or less than 500.

874
01:07:44,930 --> 01:07:49,330
I don't know if there's a way to display them both for what I mean, it's a .gov site.

875
01:07:49,330 --> 01:07:50,910
So at least you're getting something.

876
01:07:51,950 --> 01:08:01,690
This, so the one I was just talking about is the CVS pharmacy and that's 21,000 records or not even records, but individuals.

877
01:08:01,930 --> 01:08:04,130
The next one down is 25,000.

878
01:08:04,130 --> 01:08:11,590
The one below that for university of Utah is 10,000, you know, 78,000 for the NCP healthcare management company.

879
01:08:11,790 --> 01:08:17,250
These are all within the last, you know, seven to 10 days.

880
01:08:17,830 --> 01:08:19,050
This is a lot.

881
01:08:19,050 --> 01:08:24,710
And, and it just, it just scrolls every, every day or every few days, there's just another one and another one and another one.

882
01:08:25,090 --> 01:08:29,990
And I feel like not enough people are looking at the breach report.

883
01:08:30,470 --> 01:08:38,030
And if you get enough people, you get enough eyes on this report, it kind of paints a picture of this is a really big issue.

884
01:08:38,030 --> 01:08:43,910
And if, if we just followed some basic practices, it could really prevent this.

885
01:08:43,910 --> 01:08:51,810
If, and it also shows you the, the location and the type of breach, you know, hacking IT incident, hacking IT incident, unauthorized access or disclosure.

886
01:08:53,630 --> 01:08:56,050
Those are the ones that you see the most.

887
01:08:56,530 --> 01:09:02,030
The, the one at the very top for Walgreens is theft, but, and, and the one below it is loss as well.

888
01:09:02,030 --> 01:09:04,650
But I mean, those are, those are all preventable things.

889
01:09:04,650 --> 01:09:09,150
These are, these are easy things that, that can be mitigated.

890
01:09:11,350 --> 01:09:16,510
Basic framework, just a very basic framework of how to handle passwords.

891
01:09:16,590 --> 01:09:37,090
2FA has to be required for not just the medical staff, like the, the RNs getting the meds out of the machine, but the techs servicing the machines and, and the vendor companies that are putting this equipment in the hospital should have some degree of accountability for what they're introducing to the network.

892
01:09:37,090 --> 01:09:43,430
So we're going to see each other later because it's Friday for us and it's a cooking day.

893
01:09:43,430 --> 01:09:45,910
So here for later.

894
01:09:48,030 --> 01:09:49,110
Thanks.

895
01:09:50,750 --> 01:09:51,830
Later.

896
01:09:52,570 --> 01:09:55,390
So Sri, hi, how are you?

897
01:09:55,390 --> 01:09:55,870
Good.

898
01:09:55,870 --> 01:09:56,450
Thank you.

899
01:09:56,450 --> 01:09:57,030
How are you?

900
01:09:57,030 --> 01:09:58,270
I'm good.

901
01:09:58,270 --> 01:10:00,770
So tell us about yourself.

902
01:10:00,770 --> 01:10:03,150
Where do you work and a little bit about your origin story?

903
01:10:03,710 --> 01:10:04,370
Sure.

904
01:10:04,370 --> 01:10:04,710
Yes.

905
01:10:04,850 --> 01:10:09,310
I've been working on controlling pandemics since the Ebola epidemic.

906
01:10:09,370 --> 01:10:13,830
I got pulled into that by a complete, by almost by accident.

907
01:10:13,870 --> 01:10:24,450
I was at a conference, Ted Med that looked at, looking at all kinds of medical topics, but just a few days before that, the Ebola crisis was, was escalating.

908
01:10:24,530 --> 01:10:34,110
And the CDC director had a press conference saying this is the, at that time it was Tom Frieden saying this is the worst epidemic of his career since the AIDS epidemic.

909
01:10:34,110 --> 01:10:40,290
And then, so it was like, oh wow, if the CDC doesn't have things under control, then things must be pretty bad.

910
01:10:40,330 --> 01:10:53,330
So although we were, you know, we're having drinks at the city hall in San Francisco for the, at the conference, it was very hard to relax because we were thinking about, well, what was happening with Ebola as the whole rest of the world was worried about.

911
01:10:53,330 --> 01:10:57,590
So I happened to meet my, a gentleman who became my coauthor.

912
01:10:57,590 --> 01:11:00,750
He was a Harvard public health school professor.

913
01:11:01,390 --> 01:11:15,490
And it turns out I just was, I just happened to randomly meet him there and started, he told me he had a lot of experience with Ebola in, sorry, with health, public health in West Africa and East Africa and India and a whole bunch of places.

914
01:11:15,490 --> 01:11:18,910
So I said, wow, so you must know all about what's going on there.

915
01:11:18,910 --> 01:11:23,130
And so I just asked him questions and we just kept talking and kept in touch.

916
01:11:23,130 --> 01:11:37,550
And then realizing that there may be some ways to solve this problem in a, you know, kind of a cool headed way, as opposed to all the panic that was being, if you look at the literature at the time, there were people who were openly panicking and it was kind of a strange time.

917
01:11:37,550 --> 01:11:44,610
And so, so we said, we wrote some things down on paper, just started emailing a bunch of people and saying, Hey, could you try this and do that?

918
01:11:44,610 --> 01:11:56,810
And, you know, and ultimately about a month later, that paper, that, that, that got written into a sort of article format and we submitted it and it got published in the Lancet.

919
01:11:57,110 --> 01:12:05,970
And then the president of Guinea saw that and invited my coauthor to, to come advise him on how to, how to control Ebola in his country.

920
01:12:06,250 --> 01:12:08,390
And he was supposed to be there for two weeks.

921
01:12:08,390 --> 01:12:12,250
He ended up there for, for six months unexpectedly.

922
01:12:12,250 --> 01:12:18,470
And I was there on the phone with him almost every day, just we're working through the details of how you create a national Ebola response.

923
01:12:18,470 --> 01:12:27,270
So that's how I got plunged into this pandemics field just by completely a bunch of random events.

924
01:12:27,910 --> 01:12:31,130
So now we're in COVID.

925
01:12:31,130 --> 01:12:31,330
Yeah.

926
01:12:31,330 --> 01:12:33,890
And you have the experience with Ebola.

927
01:12:33,890 --> 01:12:39,150
So how is that medical data being, being taken in?

928
01:12:39,150 --> 01:12:40,750
How is it being allocated?

929
01:12:41,470 --> 01:12:42,270
Okay.

930
01:12:43,170 --> 01:12:43,790
So that's great.

931
01:12:43,790 --> 01:12:48,550
So the data is, is not, it's still not where it needs to be.

932
01:12:48,570 --> 01:12:56,330
And I think there's a lot of, as we know, there's, there's these big problems with the CDC and the federal government trying to gather the data from all over the country.

933
01:12:56,990 --> 01:13:00,490
And our testing is far behind what it needs to be.

934
01:13:00,590 --> 01:13:05,930
But we're probably seeing a very small percentage of the cases that are actually people are having.

935
01:13:05,930 --> 01:13:13,110
This is, this is a disease that has asymptomatic infection as well as pre-symptomatic spread.

936
01:13:13,350 --> 01:13:17,210
So we're basically only seeing a fraction of the, of the picture.

937
01:13:17,690 --> 01:13:20,110
And this, this is a reflected way.

938
01:13:20,110 --> 01:13:29,130
We know this is that if you so in other words, I think the data that we have is only a small fraction of what really is out there.

939
01:13:29,130 --> 01:13:37,490
And I think that's the point I'm trying to make is that we, whatever data we have is, is a tiny, tiny, you know reflection of the, of the ocean.

940
01:13:38,610 --> 01:13:43,430
So how is the data that we have going to influence COVID care?

941
01:13:43,430 --> 01:13:51,430
And then beyond that, once we get past COVID, how is this data going to influence change within healthcare as a whole?

942
01:13:52,510 --> 01:13:55,950
This data is already influencing, I think, in a very big way.

943
01:13:55,950 --> 01:14:05,850
I think, for example, you know, the like take the state of California there, the there's a, there's a metric called a positivity rate, which is the percentage of tests that get returned that are tested positive.

944
01:14:05,850 --> 01:14:08,350
So if you do a hundred tests, how many come back positive?

945
01:14:08,350 --> 01:14:20,010
On average, it's 7% in the state of California, but in parts of the state, it's actually 12 or 20% close to 10, 14, 17, 20%.

946
01:14:20,010 --> 01:14:21,590
Like that's in central California right now.

947
01:14:21,970 --> 01:14:26,230
Whereas in the, in the San Francisco Bay area, it's closer to two to 4%.

948
01:14:26,230 --> 01:14:29,550
So the average is not really reflecting the whole state.

949
01:14:29,550 --> 01:14:30,570
It's, it's really highly variable.

950
01:14:30,570 --> 01:14:34,990
So that people are using that data, that percentage to allocate resources.

951
01:14:34,990 --> 01:14:47,410
So the governor allocated $52 million of extra effort, you know, to do contact tracing and a whole bunch of things for central California based on that data, based on that positivity rate.

952
01:14:47,650 --> 01:14:50,250
So that's one way in which the data is really important.

953
01:14:50,250 --> 01:14:53,290
It gives us insight into where the problems are.

954
01:14:54,290 --> 01:14:59,910
So actually, I want to do current state versus future state.

955
01:14:59,910 --> 01:15:06,830
So current state with COVID, how is that data influencing changes in healthcare?

956
01:15:07,430 --> 01:15:18,550
And for future state of healthcare, what are we learning that we need to start changing in how hospitals operate, how patient care is done?

957
01:15:20,490 --> 01:15:21,990
Learning a lot.

958
01:15:22,010 --> 01:15:26,750
I think there's a probably a number of different topics that we could talk about in that area.

959
01:15:26,750 --> 01:15:28,170
So I could just pick one maybe.

960
01:15:28,170 --> 01:15:34,410
And, you know, I think one is, the other thing about this is that it's so fast.

961
01:15:34,410 --> 01:15:39,930
I mean, this is happening like at light speed, faster than anybody can even keep up with.

962
01:15:40,190 --> 01:15:42,050
So that's the other part about this.

963
01:15:42,050 --> 01:15:51,250
The data, there's obviously a lot of clinical data in terms of treatment of patients that people are learning about treatments on real time, which works, which doesn't.

964
01:15:51,250 --> 01:16:10,510
And there's a really, I think one of the examples that people point to is there's by the UK National Health Service, where they conducted a whole bunch of, they constructed a clinical trial for a large number of drugs, and they came up with dextromethazone as one that has effectiveness for treating COVID patients.

965
01:16:10,510 --> 01:16:21,050
And so that's an example how by properly constructing the trial, they can draw accurate conclusions and come up with solutions.

966
01:16:23,030 --> 01:16:33,770
So from all the information, I think you've been involved in the data couriership of COVID since it started, is that correct?

967
01:16:33,770 --> 01:16:34,730
The data what?

968
01:16:34,730 --> 01:16:39,130
The data couriership and gathering since the beginning of this, since the beginning of COVID?

969
01:16:39,610 --> 01:16:42,790
Yeah, that's so much the data and more the epidemic modeling.

970
01:16:43,370 --> 01:16:48,110
Yeah, modeling of how you can control the epidemic.

971
01:16:48,410 --> 01:16:49,350
Oh, perfect.

972
01:16:49,510 --> 01:16:51,810
Perfect segue, because that was the next question.

973
01:16:51,870 --> 01:16:54,290
So what is the data showing you on how to control this?

974
01:16:54,770 --> 01:17:01,310
What should the American society understand about how the data should influence how we're going to control this?

975
01:17:01,330 --> 01:17:02,510
Okay, great question.

976
01:17:02,510 --> 01:17:18,130
I think one of the things that we can do, so the testing is something that we have tried to do, and we are doing and continuing to improve at some rate, and it's now in full swing, and people are trying to increase testing all over the country and make it better,

977
01:17:18,130 --> 01:17:20,570
cheaper, faster, which is all good.

978
01:17:20,750 --> 01:17:22,950
It's certainly not been enough.

979
01:17:23,570 --> 01:17:27,910
And so that doesn't mean that, you know, we want to stop testing, we want to keep going.

980
01:17:28,130 --> 01:17:35,510
And that will help us find cases and reduce the burden, but we need something else to control the spread and combination.

981
01:17:35,510 --> 01:17:59,030
And I think we talked about this on our podcast about how combining it with masks or social protections of some kind will, and that could include social distancing or anything, would be able to bring the transition rate below one, the R0 below one, in order to stop the spread of the epidemic.

982
01:17:59,450 --> 01:18:20,270
And since we talked at a time, one thing that's become clear is that people are finding that the virus transmits not only through droplets, which are greater than five microns in size, but also in aerosols, which are smaller, less than five microns, even less than one micron.

983
01:18:20,350 --> 01:18:27,950
And the properties of these droplets are that they pass right through the cloth or cotton masks that people are wearing.

984
01:18:27,950 --> 01:18:44,110
So although the cotton masks will filter a certain percentage of the virus that's exhaled by the breath or incoming in the environment, these aerosols linger for many hours and they can pass right through this cloth.

985
01:18:44,110 --> 01:18:46,130
And so we're only getting partial protection.

986
01:18:46,630 --> 01:18:59,550
And so one of the things we can do, we discovered, I think this has all happened the last 30, 40 days, is that using... it's kind of like these cloth masks are like socks, and we need shoes.

987
01:18:59,550 --> 01:19:04,330
We need something that's going to be much better if we want to keep walking in the streets.

988
01:19:04,750 --> 01:19:10,590
And so the one example of that is, of course, in healthcare settings, people use N95 masks.

989
01:19:11,190 --> 01:19:21,430
And these N95 masks are designed to stop the aerosols, to give the shoes of the industry, except that they've been reserved for healthcare workers because they need them.

990
01:19:21,450 --> 01:19:28,390
But the problem is that the more the virus spreads in the community, the more cases they're going to be showing up at the hospital.

991
01:19:28,630 --> 01:19:36,530
So you're actually not really solving any problem by more and more people getting infected, more and more people showing up at the hospital, and even more people dying.

992
01:19:36,670 --> 01:19:40,750
So there are actually industrial masks that are not used by the hospital system.

993
01:19:40,750 --> 01:19:41,970
This is an example.

994
01:19:42,250 --> 01:19:43,450
This is one example.

995
01:19:43,450 --> 01:19:54,050
It's a NIOSH-approved N95 mask, and it could be used by essential workers or healthcare workers... I'm sorry, non-healthcare workers to protect themselves.

996
01:19:54,050 --> 01:20:05,530
And because these people who are exposed on a daily basis to the public and to other workers that are keeping the economy running, they are actually... they're finding that those are the people ending up in the hospital.

997
01:20:05,970 --> 01:20:15,090
And so, you know, people staying at home who can isolate, they're much less likely to get the virus than the people who are obviously exposed.

998
01:20:15,090 --> 01:20:17,570
And that obviously makes logical sense.

999
01:20:17,750 --> 01:20:19,650
So these types of masks.

1000
01:20:19,650 --> 01:20:21,750
Another mask is this mask here.

1001
01:20:21,750 --> 01:20:24,550
It's from Canada.

1002
01:20:27,630 --> 01:20:30,990
It has an N95 filter in it.

1003
01:20:32,150 --> 01:20:35,710
And it has... let me get the other one that I have here.

1004
01:20:36,510 --> 01:20:43,390
This is a little bit more very industrial looking, but it's a Lastomeric mask.

1005
01:20:43,390 --> 01:20:46,030
You put it on like this and strap it around.

1006
01:20:46,030 --> 01:20:47,770
And these are N95 filters.

1007
01:20:48,190 --> 01:20:52,710
But the point... the thing is, these are just like a seat belt.

1008
01:20:52,710 --> 01:20:53,490
They're dummy-proof.

1009
01:20:53,490 --> 01:20:54,490
They're very easy to use.

1010
01:20:54,490 --> 01:20:59,490
They don't require this big, you know, careful fitting and healthcare training and all that.

1011
01:20:59,510 --> 01:21:00,550
They're stretchy.

1012
01:21:00,550 --> 01:21:02,490
And the word Lastomeric means stretchy.

1013
01:21:02,730 --> 01:21:14,370
So that's what we can do is by wearing these kinds of off-the-shelf pre-approved masks and putting them in the hands of essential workers, I think we can make a big difference.

1014
01:21:15,330 --> 01:21:17,050
So last question.

1015
01:21:17,650 --> 01:21:25,390
What's your call to arms from the security research community, from healthcare, from the American population?

1016
01:21:26,370 --> 01:21:27,890
I call to arms.

1017
01:21:27,930 --> 01:21:32,490
I think right now... I think I already sort of discussed a little bit more.

1018
01:21:32,490 --> 01:21:36,630
I think essential workers need these masks, these N95-capable masks.

1019
01:21:36,630 --> 01:21:37,050
Without that...

1020
01:21:38,490 --> 01:21:50,730
until this... I think that's really the number one thing we need to get done right now, is put them... protect the essential workers so that they don't spread the disease and get sick and bring it home to their families.

1021
01:21:51,410 --> 01:21:55,930
And I think that would be the number one thing that would...

1022
01:21:55,930 --> 01:22:00,110
Thank you, Sri, from patientknowhow.com.

1023
01:22:00,110 --> 01:22:03,230
So go check that out for more information on everything that he's just talked about.

1024
01:22:03,230 --> 01:22:04,130
Thank you so much.

1025
01:22:04,130 --> 01:22:04,910
Thank you.

1026
01:22:04,910 --> 01:22:21,950
So for everyone that doesn't know, this is Josh, our recording producer for this year's virtual conference, and he literally just got told that he is the next interview for this keynote.

1027
01:22:21,950 --> 01:22:23,950
So let's all welcome Josh.

1028
01:22:25,050 --> 01:22:36,410
And just to be clear, he does not work in the cybers, but the reason I wanted you here is literally that reason.

1029
01:22:37,510 --> 01:22:41,290
You've recorded... I think there's one more talk left.

1030
01:22:41,290 --> 01:22:45,990
You've recorded 95% of the talks that we've had so far.

1031
01:22:47,490 --> 01:22:49,210
How's your brain?

1032
01:22:49,330 --> 01:22:59,510
It is really full because I did not have any understanding of this field before, and I just watched like 20, I think 28 lectures or seminars or whatever we call them.

1033
01:22:59,570 --> 01:23:04,750
And I'm just the type of personality that if I'm watching something, I'm really paying attention to it and trying to figure it out.

1034
01:23:04,750 --> 01:23:08,130
So it's kind of bursting at the moment.

1035
01:23:08,910 --> 01:23:15,850
So from all the talks you've heard, where in life are your concerns for healthcare?

1036
01:23:16,470 --> 01:23:23,270
Well, the massive lack of any type of cybersecurity at many HDOs is pretty bad.

1037
01:23:23,690 --> 01:23:37,550
Personally, I'm going to be working at a small mental health clinic in a few weeks, and I'm sure that I'll be asking them a lot of questions about what their cybersecurity is, especially since we're delivering all of our services over telehealth.

1038
01:23:37,570 --> 01:23:39,650
So what are the concerns for that?

1039
01:23:40,210 --> 01:23:52,430
But I also really enjoyed Yusuf's talk about representation in medical studies, and I think that's super important in research, coming from, again, studying social work.

1040
01:23:52,570 --> 01:23:56,470
So coming from that background, that's also really important now, especially now when we see such

1041
01:23:59,490 --> 01:24:02,730
dramatic demographic distribution of COVID cases.

1042
01:24:05,850 --> 01:24:07,190
What are your takeaways?

1043
01:24:07,190 --> 01:24:11,670
What should we be working on as a security community?

1044
01:24:12,290 --> 01:24:16,850
What's your greatest concern that you think we should get to straight away?

1045
01:24:16,850 --> 01:24:28,950
Well, I thought Sri's takeaway on getting masks to essential workers seems like the most urgent takeaway from any of the talks now, just because that specifically saves lives.

1046
01:24:28,950 --> 01:24:32,090
But I don't think that's really cybersecurity, so I don't know if that really answers it.

1047
01:24:32,170 --> 01:24:35,390
It's part of the maker space, part of it.

1048
01:24:36,210 --> 01:24:59,470
So then if we're going to go back into the security side, being that you've heard 28 intense talks, and I'm not sorry for that, and you're going to go into social work, and you have an understanding, you very likely have a better understanding of how healthcare works now and the security around it,

1049
01:24:59,470 --> 01:25:03,670
more so than a lot of other patients out there.

1050
01:25:03,750 --> 01:25:10,350
As a patient, as someone going into the hospital, what's your takeaway?

1051
01:25:10,450 --> 01:25:15,550
What's your greatest need now as a patient walking in?

1052
01:25:15,550 --> 01:25:18,910
Well, I've never liked to go to the hospital, and I sure don't now.

1053
01:25:18,910 --> 01:25:36,570
But if I did, I think I would just make sure that either myself or a companion who was with me double-checked that whoever was treating me or administering medication or other treatments has my correct record and that the information is correct, that my blood type is correct,

1054
01:25:36,570 --> 01:25:37,250
things like that.

1055
01:25:37,250 --> 01:25:42,290
I would just double-check things, which I always cross-examine a doctor when I talk to them anyway.

1056
01:25:42,310 --> 01:25:44,910
And I think that being an informed patient is really important.

1057
01:25:45,090 --> 01:25:52,010
So I think that the potential for accidental mishaps is probably the thing that would concern me the most.

1058
01:25:54,590 --> 01:25:58,150
How do you think our community can engage more?

1059
01:25:58,970 --> 01:26:00,090
You know what?

1060
01:26:00,090 --> 01:26:01,270
Not even our community.

1061
01:26:01,270 --> 01:26:03,930
How can your community engage more?

1062
01:26:03,990 --> 01:26:05,270
What's my community?

1063
01:26:05,270 --> 01:26:06,550
What is your community?

1064
01:26:06,570 --> 01:26:10,770
My community right now is my son, my wife, and my dog and me.

1065
01:26:10,850 --> 01:26:17,910
Okay, so how can your community engage more in the healthcare security side of the house?

1066
01:26:18,550 --> 01:26:21,770
Wow, I'm not sure I have an answer to that.

1067
01:26:21,790 --> 01:26:22,270
Okay.

1068
01:26:22,270 --> 01:26:36,650
I mean, I'll be talking to people at the clinic and so forth and people that I, you know, study with in Social Work school and professors for all my classes moving forward now for the next couple years because I have attended this conference as the video producer.

1069
01:26:37,250 --> 01:26:44,730
So I think it would probably be in the form of conversations with people, you know, in the Social Work field from my perspective.

1070
01:26:46,350 --> 01:26:51,730
What questions do you have for the security folks, the biohackers?

1071
01:26:51,730 --> 01:26:53,390
I think I did have a question.

1072
01:27:00,250 --> 01:27:01,290
Societal change.

1073
01:27:01,290 --> 01:27:02,650
I mean, changing social policy.

1074
01:27:02,650 --> 01:27:16,470
One thing I do know from studies and from just a career in journalism is that changing social policy in the United States, even when we're at a World War II level event like we're having right now with the coronavirus, is still tremendously slow.

1075
01:27:18,150 --> 01:27:37,570
I think that, and this kind of goes back to the other question about outreach, I think that maybe people in the community need to be doing more outreach through people that they know, whether it's on, you know, probably on social media, just to sort of raise questions and try to stimulate some dialogue about what people should be,

1076
01:27:37,570 --> 01:27:41,010
what regular people should be prioritizing in this situation.

1077
01:27:41,010 --> 01:27:48,510
And, you know, I mean, it's going to come down to who people vote for in November, but it's also, it also comes down to like, how are you going to spend your time online on social media?

1078
01:27:48,610 --> 01:28:00,490
You know, whether it's, are you going to be sharing memes or maybe having a substantial conversation with somebody in the community who might actually have some suggestions for how to improve the situation.

1079
01:28:01,150 --> 01:28:08,210
I know a few people, just by virtue of living where I do, it's a very IT heavy, you know, neighborhood.

1080
01:28:08,410 --> 01:28:16,630
And we have people who've been building respirators in their, or ventilators in their rooms, or designing software for it, or, you know, building masks and things like that.

1081
01:28:17,350 --> 01:28:19,470
So I think that kind of community outreach is really important.

1082
01:28:19,470 --> 01:28:27,050
I think that, you know, that is maybe the type of thing we should be using social media more for these days than spreading bad information.

1083
01:28:28,230 --> 01:28:33,290
So I wanted to make sure people knew who you were, because thank you so much for being part of The Village this year.

1084
01:28:33,290 --> 01:28:38,770
There's so many people that are involved that don't get the accolades that they need.

1085
01:28:38,770 --> 01:28:41,070
So thank you everyone that I interviewed.

1086
01:28:41,070 --> 01:28:44,690
Thank you for trusting me enough to come in cold.

1087
01:28:44,690 --> 01:28:48,470
I want to thank the organizers for this year.

1088
01:28:48,470 --> 01:28:50,770
It was, it was a work of love.

1089
01:28:50,770 --> 01:29:02,030
And thank you to Beau, Sidney, Andrea, Bill, Najla, the volunteers, the sponsors, the device folks that are working with us.

1090
01:29:02,030 --> 01:29:04,730
We appreciate you attendees so much.

1091
01:29:04,730 --> 01:29:06,130
Watch this space.

1092
01:29:06,130 --> 01:29:06,850
Enjoy the show.