start	end	text
4520	11160	Welcome to our latest Ethics Village Talk. We are very fortunate to have with us today
11160	16940	Jessica Wilkerson from the FDA. Jessica, welcome. Thanks for taking time to talk to us.
16940	20840	Thank you so much for... well, thank you so much for having me.
21480	29320	So, first question, really kind of introductory. Tell us a bit about yourself. You've had a super
29320	33160	exciting and interesting career. You've done a bunch of different policy things,
33160	37800	all of which have been really important. Tell us a bit about yourself and how you ended up
37800	45140	at the FDA. Sure. So, I don't know... I've had an exciting career development. That's good news.
45140	52900	It's good to hear. But I... so, I'm currently at the FDA. I am a cyber policy advisor.
53320	59660	So, I generally work with... across the FDA to do... to look at cybersecurity of medical devices,
59660	65760	not necessarily in the review of them necessarily. I leave that to people who are much more qualified
65760	73680	than I am. But looking at various concepts... I'm so sorry, my cat is causing me a whole bunch
73680	78840	of problems. There we go. That's a bonus round here. That's totally allowed. If the cat has
78840	84900	opinions on your career trajectory, that's totally welcome too. I'll be sure to quiz him later.
86180	90300	But essentially, I look at things like software bill of materials, coordinated disclosure,
90720	94480	things like legacy devices and others that I think we're going to get into a little bit later
94480	101840	that from a higher level, more so than the review level, will really influence what it means for a
101840	109320	medical device to be cyber secure. And I ended up at FDA through sort of a very winding process.
109320	113740	And I guess I will work backwards to sort of explain how I ended up here and why
114340	119340	a lot of the experience that I brought with me to the FDA is relevant. But prior to this,
119340	123120	I was with the Linux Foundation. I was the Cybersecurity Research Director.
123500	128880	And this really stemmed from a recognition that I had a few years ago that I think many other
128880	135240	people had had much earlier than I had it. But essentially around this reality that open source
135240	140960	software isn't everything. Everything is built out of open source software. It is the basis of
140960	147540	modern technology today. And so if we want to have cyber secure products and cyber safe products,
147540	151940	we have to have secure and safe open source software. And you know,
152460	156380	given the characteristics of the open source ecosystem, that is a more challenging
157160	162500	undertaking than it traditionally is in more proprietary or closed source software.
162600	166180	And so I spent a year with the Linux Foundation really examining those issues.
166860	172340	But the bulk of my experience really came from working with the United States Congress.
172360	178120	I was a professional staff member and then had a few other titles throughout my time there.
178120	181360	But I spent five and a half years with the Committee on Energy and Commerce
181360	187600	doing cybersecurity issues. And so the thing to really know about the Committee on Energy and
187600	196120	Commerce is that when it comes to congressional committees who have jurisdiction, Energy and
196120	201620	Commerce is on a hill. So they have jurisdiction over energy, over healthcare, over telecommunications,
201620	206720	over commercial issues, over... I'm missing a very obvious one that I can't think of.
206720	214900	But they have jurisdiction over so much. And as technology has continued to weave its way into
214900	220720	the fabric of daily society, what that means is that the sectors and the issues that Energy and
220720	225560	Commerce has jurisdiction over began to do the same. So everything that we were doing
225560	231400	in a lot of cases ended up taking on a cybersecurity bent. So I ended up looking at just this whole
231400	236820	host of things when I was working for Energy and Commerce. Things all along the spectrum from
238160	242840	the way that the federal government divides authority between different federal agencies
242840	247060	like the Department of Health and Human Services or Homeland Security or the Department of Energy
247060	252900	when it comes to cybersecurity emergency response. I looked at things like the 2017
253900	257360	ransomware outbreak and what that meant and what kind of things that that had.
258640	262960	Just sort of all across the board. And what ended up happening is the last couple of years that I
262960	270060	was there was really starting to represent the shift in the healthcare sector's mentality to
270060	275820	recognize that cybersecurity wasn't just this little tiny part of their lives where you could
275820	281020	have the IT people sort of off in their corner or their basement doing whatever it is, mystical arts
281020	286780	that IT people do. But this was a thing that affected patients. It was a patient safety issue
286780	292020	and that they needed to be paying attention to it. And so I was really privileged in a lot of ways
292020	298420	to be there sort of at the cusp of this realization and sort of work with many parts of the healthcare
298420	305500	sector to develop it as it began to go. So I worked with the Food and Drug Administration
305500	310360	where I now sit and others to really encourage the healthcare sector to adopt software-available
310360	315440	materials. We were huge advocates when I was on the Committee of Coordinated Disclosure.
316000	320060	And we were starting to look at things like old and outdated medical devices and things like that
320060	326960	and what should be done. So sort of through that spectrum of experience, starting with
326960	330900	Energy and Commerce going to the Lawrence Foundation and then ending up at FDA,
331720	336040	what I hope to bring, what I try to bring is just this very broad
338160	343620	breadth of experience on these various cyber security issues that help inform the way that
343620	352920	we approach, as an agency, cyber security. It's all about the wizards in the dark corners, right?
353160	358280	Yes. So what types of issues do you work on today at FDA? You've mentioned Coordinated
358280	363840	Vulnerability Disclosure and probably policy stuff. What can you tell us about the issues
363840	369920	that you encounter on a regular basis? Yeah, so I think they generally tend to split into
369920	377680	two buckets. There are the sort of the internal agency machination issues where, speaking of
377680	382260	Coordinated Disclosure and software-available materials and these things, medical device
382260	386540	vulnerabilities or cyber security vulnerabilities that are relevant to medical devices come in
386540	391640	on a very regular basis. And the agency has to look at those vulnerabilities and decide
391640	394780	what do we need to do with them? What do we need to do with them and what do we
394780	399800	need our stakeholders to be doing with them? And so I spend a significant part of my day working
399800	405360	with dedicated experts within the agency looking at cyber security vulnerabilities that might impact
405360	411800	medical devices and ensuring that not only FDA but the sector as a whole is doing what it needs
411800	419440	to do. This often involves third-party security researchers who either bring vulnerability
419440	425140	information directly to us or, on an increasing basis, which we like, they go directly to the
425140	429940	manufacturer. And the manufacturers, medical device manufacturers, have certainly matured
429940	434720	over the last couple of years to the point where when a security researcher knocks at their door,
434720	439660	they're not sort of running around like chickens with their heads cut off, freaking out. They're
439660	442780	actually like, oh, yes, great, please come in. Tell us everything you know about this
442780	448720	vulnerability. Let us work together to address it, which has been a very, very positive development
448720	456000	overall. We are also very much hard at work on just continuously updating FDA's cyber security
457140	462360	processes, policies, all of that when it comes to looking at the cyber security of medical devices.
464040	469100	Technology evolves on a constant basis, which means that FDA's procedures can't be static.
469100	473720	So on a day-to-day basis, we have to continuously re-evaluate the way that we approach cyber
473720	478000	security. And if we need to make adjustments to our own process or encourage adjustments
478000	483380	in the sector as a whole, that's another thing that I spend quite a bit of my time doing.
483800	488900	The last thing that I would just touch on relatively quickly is there are all of these
488900	494700	private partnerships that exist out in the sector. And some of the ones that we end up
494700	499260	working with the most are the Healthcare Sector Coordinating Council, which is just a very valuable
499260	505840	body to us where government and private sector just come together. Really, I think almost anybody
505840	510560	can join. The executive director might have some words with me about that, but I think it's pretty
510560	517380	open. And we talk about the issues of the day. I'm actually co-leading two task groups underneath
517380	522560	that group. One to look at legacy devices and try and figure out what we do with old stuff. How do
522560	526480	we get old stuff out of hospitals? How do we make sure that new stuff doesn't become old stuff too
526480	533340	soon? And then another one on vulnerability communications, because I think what we've seen
533340	541200	on an increasing basis is where your typical cybersecurity advisory being like, hey, there's a
541200	546280	problem. They're hard to understand. I mean, you really kind of have to have a lot of background
546440	551100	and a lot of technical expertise to be able to read a cybersecurity advisory and understand what
551100	555960	it's telling you and know what you're supposed to do. Well, if you're a patient just trying to be
555960	560360	like, hey, I heard there was a vulnerability in my pacemaker. What do I do? And you're not
560440	566420	a computer science expert. You're going to have very little idea what you're actually being told.
566860	569680	And so that's a huge problem. That's something that we're trying to address.
570240	572820	So it's another thing that I work on on a day-to-day basis.
574880	579020	So you mentioned the FDA guidance. Can you give us just a really quick thumbnail sketch of the
579020	584120	pre-market, post-market guidance, kind of the overall regime of the way that FDA approaches
584120	592200	security vulnerability disclosure? Yeah. So if you think of a device,
592200	599460	if you think of the lifetime of a device, it sort of has probably four stages. You've got
599460	603740	the pre-market stage where it's being developed, it's being designed, and then it's being presented
603740	609920	to FDA by a company to essentially say, we want to put this device on the market. And that's the
609920	618160	pre-market stage. And so during the pre-market stage, what FDA does is that device is essentially
618160	624240	reviewed and the standard there is, does this device provide a reasonable assurance of safety
624240	628220	and effectiveness? Now that goes beyond cybersecurity. That is literally, even from
628220	632300	like a physical machinations perspective, does this thing do what it's supposed to do in a safe
632300	638560	and effective way? But obviously that counts for cybersecurity too. So from the cybersecurity
638560	643960	perspective in pre-market, our reviewers look at these devices, they look at the security controls
643960	649140	that are built into it, and they essentially evaluate, are these good enough? Are these
649140	653280	sufficient? Do these do what they need to do to protect the device from cybersecurity threats
653280	659420	and therefore protect the patients? If medical device manufacturers manage to pass the pre-market
659420	665400	stage, then they obviously get to put the device onto the market. And then that is known as the
665400	670720	post-market stage. And so once the device is there, once it's in the marketplace,
671940	677800	there's also guidance that FDA has put out around what do you need to do? Because as we all know,
677800	682840	there is no such thing as a 100% secure product. And something that is secure today is not
682840	689040	necessarily going to be secure tomorrow. So you have to have a process for monitoring devices
689040	694440	that are on the market. You have to have a process for intaking information on potential issues to
694440	698380	include cybersecurity and non-cybersecurity issues. And you have to have a process for
698380	704200	figuring out what you're going to do with it. And so FDA has post-market guidance on all of that,
704200	710560	that essentially says to manufacturers, here are some suggestions that you really should follow
711980	716600	around what you should do for medical device cybersecurity vulnerability that happens once
716600	721880	your device is on the market. There's a lot of things there. There's specific regulations on
721880	727620	when you have to have a recall. But I think the biggest one for cybersecurity is it is in that
727620	732360	guidance that you should have a coordinated disclosure program. So you should have a way
732360	737800	to intake information from third parties, typically cybersecurity researchers, but it can be anybody,
738920	742480	on cybersecurity vulnerabilities. And then once you have it, and this is a really key part that
742480	746100	some people sometimes forget, you can't just take the information and be like, yeah, great, thanks,
746960	751040	you actually have to then take the information and do something with it.
751660	755900	And so that's sort of that last part of that post-market phase is if there is a vulnerability,
756480	761620	how are you going to evaluate it within your company? How are you going to communicate that
761620	765160	you've had a vulnerability and what you're doing about it to the agency? Because you have to tell
765160	769940	us. And then how are you going to tell the public? Where it's appropriate to tell the public that
769940	773740	there's been some kind of issue, what is that going to look like? How are you going to talk
773740	779160	about it? What are you going to do for patients? All of that. So that's that post-market phase.
783860	787500	So this involves a lot of cooperation with the private sector.
787500	791320	What have been your experiences cooperating with the private sector?
791320	794960	And you mentioned that companies are improving in the way that they're
794960	799560	engaging with security researchers. Can you tell us a little bit about
800100	804000	some of those dynamics and maybe share a few success stories of coordinating?
804000	811580	Absolutely. Yeah, so I think what I would start out with is way back in the day when I was still
811580	818680	in Congress, when medical device vulnerabilities were still sort of, I mean, they're still sexy
818680	824500	today, you know, who doesn't love a your medical device can kill you headline. But when they
824500	829860	when they're a little bit more new, they're a little bit more novel. What we would typically
829860	835080	see happen is medical device manufacturers would get contacted by security researchers,
835080	841780	and they would just be so confused. Who is this person? How did they figure this out?
841780	846340	What is going on? And usually, and Andrew, you probably know this better than anybody, they're
846340	852180	like, sue them, sue them right now, make it so they can't talk about it, make it so that they
852180	858580	clearly broke the law when they did this research. And so somebody like make them stop. And that was
858580	863600	really how it was handled. You have these security researchers who were like, hey, I found this
863600	869820	problem. Do you do you want to know about it? And they were very good faith. But there was just,
869820	875120	it was such a new thing for these manufacturers. And there was so much in, you know, to give them
875220	879640	a little bit of credit or to have a little bit of sympathy for the manufacturers. There's a lot
879640	886140	that rides on them not having issues, you know, obviously, they're a heavily regulated industry.
886140	890380	If there is a problem with their medical device, there's consequences, you know,
890380	895560	whether those are regulatory consequences, or they are getting sued, or whatever it is,
895560	904800	patient harm consequences, it's a big deal. And so it took them a significant amount of time
905420	913620	and a significant amount of work by a lot of discrete parties within the security research
913620	919740	community. I'm sure, Andrea, you played a role in this. Josh Corman, Bo Woods, Katie Masuris,
919740	926460	Nina Ali, a lot of these folks put in a lot of time and effort to actually sit down with the
926460	930780	medical device manufacturers and others, you know, this was also going on in auto and energy and other
930780	937220	sectors, and essentially be like, look, we come in peace, like, we're really just trying to help
937220	944520	you here. And over time, as you know, we had also some visionaries on the medical device side,
944520	949520	and certainly my boss, I can't take credit for this, I wasn't at FDA at this time, but Dr. Suzanne
949520	956700	Schwartz, Dr. Seth Carmody, Dr. Afton Ross, they actually sort of also went out on a limb
957380	962300	and began to embrace the security research community. There were some of these visionaries
962300	968120	at these medical device manufacturers, Colin Morgan, Rob Suarez, Michael McNeil,
968700	975200	others who really took the lead on recognizing that coordinated disclosure, and just the ability
975200	982520	to be given information in a friendly way, rather than a blackmail way, helped everyone.
983460	992120	And so from about, I don't know, 2015-ish to now, what we see much, much, much more frequently
992120	997980	is the security researchers go directly to the medical device manufacturers who receive them
997980	1002360	with open arms, they have this continuous dialogue that we don't even know about for
1002360	1008480	weeks, months, however long it takes place, and then at some point prior to the public disclosure,
1008480	1015380	they come to us as a united front and essentially say, hey, this awesome guy over here, whoever
1016800	1021500	found a cybersecurity vulnerability, they told us about it, here's all the things that we've done,
1022320	1028200	they agree, they've checked our math, they think that it's correct, and we're going to
1028200	1031620	just close on this day, we're going to do this, this is our plan for post-market,
1031620	1038060	as we had discussed before. And it's a much smoother, it's a much more collaborative,
1038060	1043520	and it's a much more effective process for us as an agency, so we're not having to stand over
1043520	1050500	everyone and check their work. And it really just benefits patients overall that we all have these
1050500	1058620	relationships. If you were looking for specifics, like specific disclosures that I could point to,
1059060	1065020	I'm trying to think, like, what are some of the best examples that we've run into lately? It's
1065020	1070380	been a little bit confused with COVID, as everyone can, I think, probably sympathize with, because
1070380	1075580	there's a lot going on. But maybe one that I'll point out, too, this is the last one that FDA did
1075660	1088320	a safety communication on. This is a cross-industry problem with Bluetooth low energy,
1088320	1092200	and it didn't just happen in the healthcare sector, but we were the ones who ended up kicking
1092200	1098840	off a lot of the response. But the researchers were in Singapore, the vulnerabilities impacted
1098840	1105060	just numerous medical device manufacturers. But what was really impressive about that
1105060	1110740	is our ability to connect the researchers to the medical device manufacturers and the
1110740	1113520	researchers' willingness to be connected to the medical device manufacturers