WEBVTT

00:04.520 --> 00:08.880
Welcome to our latest Ethics Village Talk.

00:08.880 --> 00:14.360
We are very fortunate to have with us today Jessica Wilkerson from the FDA.

00:14.360 --> 00:15.740
Jessica, welcome.

00:15.880 --> 00:16.940
Thanks for taking time to talk to us.

00:16.940 --> 00:20.840
Thank you so much for... well, thank you so much for having me.

00:21.480 --> 00:25.980
So, first question, really kind of introductory.

00:26.500 --> 00:28.560
Tell us a bit about yourself.

00:28.560 --> 00:31.120
You've had a super exciting and interesting career.

00:31.120 --> 00:35.120
You've done a bunch of different policy things, all of which have been really important.

00:35.240 --> 00:38.740
Tell us a bit about yourself and how you ended up at the FDA.

00:40.160 --> 00:40.820
Sure.

00:40.820 --> 00:44.200
So, I don't know... I've had an exciting career development.

00:44.200 --> 00:45.140
That's good news.

00:45.140 --> 00:46.200
It's good to hear.

00:47.140 --> 00:50.540
But I... so, I'm currently at the FDA.

00:50.540 --> 00:52.900
I am a cyber policy advisor.

00:53.320 --> 01:03.740
So, I generally work with... across the FDA to do... to look at cybersecurity of medical devices, not necessarily in the review of them necessarily.

01:03.740 --> 01:06.720
I leave that to people who are much more qualified than I am.

01:06.820 --> 01:14.400
But looking at various concepts... I'm so sorry, my cat is causing me a whole bunch of problems.

01:14.420 --> 01:15.120
There we go.

01:15.120 --> 01:16.640
That's a bonus round here.

01:16.640 --> 01:17.880
That's totally allowed.

01:17.940 --> 01:21.800
If the cat has opinions on your career trajectory, that's totally welcome too.

01:22.180 --> 01:24.900
I'll be sure to quiz him later.

01:26.180 --> 01:43.760
But essentially, I look at things like software bill of materials, coordinated disclosure, things like legacy devices and others that I think we're going to get into a little bit later that from a higher level, more so than the review level, will really influence what it means for a medical device to be cyber secure.

01:44.680 --> 01:49.280
And I ended up at FDA through sort of a very winding process.

01:49.280 --> 01:57.660
And I guess I will work backwards to sort of explain how I ended up here and why a lot of the experience that I brought with me to the FDA is relevant.

01:57.660 --> 02:01.040
But prior to this, I was with the Linux Foundation.

02:01.040 --> 02:03.120
I was the Cybersecurity Research Director.

02:03.500 --> 02:12.240
And this really stemmed from a recognition that I had a few years ago that I think many other people had had much earlier than I had it.

02:12.240 --> 02:16.980
But essentially around this reality that open source software isn't everything.

02:16.980 --> 02:19.120
Everything is built out of open source software.

02:19.200 --> 02:22.840
It is the basis of modern technology today.

02:23.060 --> 02:31.560
And so if we want to have cyber secure products and cyber safe products, we have to have secure and safe open source software.

02:31.560 --> 02:42.500
And you know, given the characteristics of the open source ecosystem, that is a more challenging undertaking than it traditionally is in more proprietary or closed source software.

02:42.600 --> 02:46.180
And so I spent a year with the Linux Foundation really examining those issues.

02:46.860 --> 02:52.340
But the bulk of my experience really came from working with the United States Congress.

02:52.360 --> 02:58.120
I was a professional staff member and then had a few other titles throughout my time there.

02:58.120 --> 03:03.940
But I spent five and a half years with the Committee on Energy and Commerce doing cybersecurity issues.

03:04.340 --> 03:16.960
And so the thing to really know about the Committee on Energy and Commerce is that when it comes to congressional committees who have jurisdiction, Energy and Commerce is on a hill.

03:17.100 --> 03:26.720
So they have jurisdiction over energy, over healthcare, over telecommunications, over commercial issues, over... I'm missing a very obvious one that I can't think of.

03:26.720 --> 03:29.640
But they have jurisdiction over so much.

03:30.480 --> 03:43.940
And as technology has continued to weave its way into the fabric of daily society, what that means is that the sectors and the issues that Energy and Commerce has jurisdiction over began to do the same.

03:43.940 --> 03:49.020
So everything that we were doing in a lot of cases ended up taking on a cybersecurity bent.

03:49.340 --> 03:53.960
So I ended up looking at just this whole host of things when I was working for Energy and Commerce.

03:54.300 --> 04:10.400
Things all along the spectrum from the way that the federal government divides authority between different federal agencies like the Department of Health and Human Services or Homeland Security or the Department of Energy when it comes to cybersecurity emergency response.

04:10.600 --> 04:17.360
I looked at things like the 2017 ransomware outbreak and what that meant and what kind of things that that had.

04:18.640 --> 04:20.240
Just sort of all across the board.

04:20.240 --> 04:40.080
And what ended up happening is the last couple of years that I was there was really starting to represent the shift in the healthcare sector's mentality to recognize that cybersecurity wasn't just this little tiny part of their lives where you could have the IT people sort of off in their corner or their basement doing whatever it is,

04:40.080 --> 04:42.480
mystical arts that IT people do.

04:42.480 --> 04:45.580
But this was a thing that affected patients.

04:45.580 --> 04:49.340
It was a patient safety issue and that they needed to be paying attention to it.

04:49.520 --> 05:01.980
And so I was really privileged in a lot of ways to be there sort of at the cusp of this realization and sort of work with many parts of the healthcare sector to develop it as it began to go.

05:01.980 --> 05:11.200
So I worked with the Food and Drug Administration where I now sit and others to really encourage the healthcare sector to adopt software-available materials.

05:11.660 --> 05:15.440
We were huge advocates when I was on the Committee of Coordinated Disclosure.

05:16.000 --> 05:21.980
And we were starting to look at things like old and outdated medical devices and things like that and what should be done.

05:22.140 --> 05:44.320
So sort of through that spectrum of experience, starting with Energy and Commerce going to the Lawrence Foundation and then ending up at FDA, what I hope to bring, what I try to bring is just this very broad breadth of experience on these various cyber security issues that help inform the way that we approach,

05:44.320 --> 05:46.760
as an agency, cyber security.

05:50.080 --> 05:52.920
It's all about the wizards in the dark corners, right?

05:53.160 --> 05:53.960
Yes.

05:54.720 --> 05:57.380
So what types of issues do you work on today at FDA?

05:57.380 --> 06:01.940
You've mentioned Coordinated Vulnerability Disclosure and probably policy stuff.

06:01.940 --> 06:06.000
What can you tell us about the issues that you encounter on a regular basis?

06:06.820 --> 06:11.820
Yeah, so I think they generally tend to split into two buckets.

06:11.840 --> 06:28.680
There are the sort of the internal agency machination issues where, speaking of Coordinated Disclosure and software-available materials and these things, medical device vulnerabilities or cyber security vulnerabilities that are relevant to medical devices come in on a very regular basis.

06:28.680 --> 06:33.360
And the agency has to look at those vulnerabilities and decide what do we need to do with them?

06:33.360 --> 06:37.300
What do we need to do with them and what do we need our stakeholders to be doing with them?

06:37.360 --> 06:52.800
And so I spend a significant part of my day working with dedicated experts within the agency looking at cyber security vulnerabilities that might impact medical devices and ensuring that not only FDA but the sector as a whole is doing what it needs to do.

06:53.360 --> 07:06.060
This often involves third-party security researchers who either bring vulnerability information directly to us or, on an increasing basis, which we like, they go directly to the manufacturer.

07:06.220 --> 07:19.500
And the manufacturers, medical device manufacturers, have certainly matured over the last couple of years to the point where when a security researcher knocks at their door, they're not sort of running around like chickens with their heads cut off, freaking out.

07:19.500 --> 07:21.520
They're actually like, oh, yes, great, please come in.

07:21.520 --> 07:23.360
Tell us everything you know about this vulnerability.

07:23.360 --> 07:29.600
Let us work together to address it, which has been a very, very positive development overall.

07:29.980 --> 07:42.360
We are also very much hard at work on just continuously updating FDA's cyber security processes, policies, all of that when it comes to looking at the cyber security of medical devices.

07:44.040 --> 07:49.100
Technology evolves on a constant basis, which means that FDA's procedures can't be static.

07:49.100 --> 07:54.640
So on a day-to-day basis, we have to continuously re-evaluate the way that we approach cyber security.

07:54.660 --> 08:03.380
And if we need to make adjustments to our own process or encourage adjustments in the sector as a whole, that's another thing that I spend quite a bit of my time doing.

08:03.800 --> 08:12.100
The last thing that I would just touch on relatively quickly is there are all of these private partnerships that exist out in the sector.

08:12.480 --> 08:24.540
And some of the ones that we end up working with the most are the Healthcare Sector Coordinating Council, which is just a very valuable body to us where government and private sector just come together.

08:24.700 --> 08:26.640
Really, I think almost anybody can join.

08:26.980 --> 08:31.280
The executive director might have some words with me about that, but I think it's pretty open.

08:32.600 --> 08:34.800
And we talk about the issues of the day.

08:34.940 --> 08:38.260
I'm actually co-leading two task groups underneath that group.

08:38.260 --> 08:42.380
One to look at legacy devices and try and figure out what we do with old stuff.

08:42.380 --> 08:44.020
How do we get old stuff out of hospitals?

08:44.020 --> 08:47.280
How do we make sure that new stuff doesn't become old stuff too soon?

08:48.880 --> 09:01.560
And then another one on vulnerability communications, because I think what we've seen on an increasing basis is where your typical cybersecurity advisory being like, hey, there's a problem .

09:02.640 --> 09:03.960
They're hard to understand.

09:03.960 --> 09:12.960
I mean, you really kind of have to have a lot of background and a lot of technical expertise to be able to read a cybersecurity advisory and understand what it's telling you and know what you're supposed to do.

09:13.200 --> 09:18.260
Well, if you're a patient just trying to be like, hey, I heard there was a vulnerability in my pacemaker.

09:18.480 --> 09:19.580
What do I do?

09:19.580 --> 09:21.720
And you're not a computer science expert.

09:21.720 --> 09:26.420
You're going to have very little idea what you're actually being told.

09:26.860 --> 09:27.900
And so that's a huge problem.

09:27.900 --> 09:29.680
That's something that we're trying to address.

09:30.240 --> 09:32.820
So it's another thing that I work on on a day-to-day basis.

09:34.880 --> 09:36.520
So you mentioned the FDA guidance.

09:36.520 --> 09:46.200
Can you give us just a really quick thumbnail sketch of the pre-market, post-market guidance, kind of the overall regime of the way that FDA approaches security vulnerability disclosure?

09:47.080 --> 09:47.600
Yeah.

09:47.600 --> 09:58.940
So if you think of a device, if you think of the lifetime of a device, it sort of has probably four stages.

09:58.940 --> 10:08.900
You've got the pre-market stage where it's being developed, it's being designed, and then it's being presented to FDA by a company to essentially say, we want to put this device on the market.

10:08.900 --> 10:11.380
And that's the pre-market stage.

10:11.840 --> 10:25.240
And so during the pre-market stage, what FDA does is that device is essentially reviewed and the standard there is, does this device provide a reasonable assurance of safety and effectiveness?

10:25.240 --> 10:26.660
Now that goes beyond cybersecurity.

10:26.660 --> 10:33.620
That is literally, even from like a physical machinations perspective, does this thing do what it's supposed to do in a safe and effective way?

10:34.120 --> 10:36.900
But obviously that counts for cybersecurity too.

10:36.920 --> 10:48.860
So from the cybersecurity perspective in pre-market, our reviewers look at these devices, they look at the security controls that are built into it, and they essentially evaluate, are these good enough?

10:48.860 --> 10:49.800
Are these sufficient?

10:49.800 --> 10:55.380
Do these do what they need to do to protect the device from cybersecurity threats and therefore protect the patients?

10:56.300 --> 11:02.920
If medical device manufacturers manage to pass the pre-market stage, then they obviously get to put the device onto the market.

11:03.800 --> 11:07.140
And then that is known as the post-market stage.

11:07.660 --> 11:16.520
And so once the device is there, once it's in the marketplace, there's also guidance that FDA has put out around what do you need to do?

11:16.660 --> 11:20.840
Because as we all know, there is no such thing as a 100% secure product.

11:20.840 --> 11:25.100
And something that is secure today is not necessarily going to be secure tomorrow.

11:25.140 --> 11:29.940
So you have to have a process for monitoring devices that are on the market.

11:29.940 --> 11:37.520
You have to have a process for intaking information on potential issues to include cybersecurity and non-cybersecurity issues.

11:37.520 --> 11:40.400
And you have to have a process for figuring out what you're going to do with it.

11:41.140 --> 11:58.040
And so FDA has post-market guidance on all of that, that essentially says to manufacturers, here are some suggestions that you really should follow around what you should do for medical device cybersecurity vulnerability that happens once your device is on the market.

11:58.780 --> 12:00.200
There's a lot of things there.

12:00.200 --> 12:03.400
There's specific regulations on when you have to have a recall.

12:03.820 --> 12:10.980
But I think the biggest one for cybersecurity is it is in that guidance that you should have a coordinated disclosure program.

12:10.980 --> 12:20.680
So you should have a way to intake information from third parties, typically cybersecurity researchers, but it can be anybody, on cybersecurity vulnerabilities.

12:20.680 --> 12:31.040
And then once you have it, and this is a really key part that some people sometimes forget, you can't just take the information and be like, yeah, great, thanks, you actually have to then take the information and do something with it.

12:31.660 --> 12:38.780
And so that's sort of that last part of that post-market phase is if there is a vulnerability, how are you going to evaluate it within your company?

12:39.360 --> 12:44.620
How are you going to communicate that you've had a vulnerability and what you're doing about it to the agency?

12:44.620 --> 12:45.820
Because you have to tell us.

12:46.560 --> 12:48.420
And then how are you going to tell the public?

12:48.420 --> 12:52.860
Where it's appropriate to tell the public that there's been some kind of issue, what is that going to look like?

12:52.860 --> 12:54.460
How are you going to talk about it?

12:54.460 --> 12:55.780
What are you going to do for patients?

12:55.780 --> 12:56.880
All of that.

12:57.060 --> 12:59.160
So that's that post-market phase.

13:03.860 --> 13:07.500
So this involves a lot of cooperation with the private sector.

13:07.500 --> 13:11.320
What have been your experiences cooperating with the private sector?

13:11.320 --> 13:17.640
And you mentioned that companies are improving in the way that they're engaging with security researchers.

13:17.640 --> 13:24.000
Can you tell us a little bit about some of those dynamics and maybe share a few success stories of coordinating?

13:24.000 --> 13:24.900
Absolutely.

13:26.360 --> 13:42.820
Yeah, so I think what I would start out with is way back in the day when I was still in Congress, when medical device vulnerabilities were still sort of, I mean, they're still sexy today, you know, who doesn't love a your medical device can kill you headline.

13:42.820 --> 13:47.980
But when they when they're a little bit more new, they're a little bit more novel.

13:48.820 --> 13:58.240
What we would typically see happen is medical device manufacturers would get contacted by security researchers, and they would just be so confused.

13:58.680 --> 14:00.100
Who is this person?

14:00.100 --> 14:01.780
How did they figure this out?

14:01.780 --> 14:03.040
What is going on?

14:03.040 --> 14:15.260
And usually, and Andrew, you probably know this better than anybody, they're like, sue them, sue them right now, make it so they can't talk about it, make it so that they clearly broke the law when they did this research.

14:15.260 --> 14:17.680
And so somebody like make them stop.

14:18.040 --> 14:20.260
And that was really how it was handled.

14:20.300 --> 14:23.980
You have these security researchers who were like, hey, I found this problem.

14:23.980 --> 14:25.720
Do you do you want to know about it?

14:25.840 --> 14:28.000
And they were very good faith.

14:28.360 --> 14:32.260
But there was just, it was such a new thing for these manufacturers.

14:32.260 --> 14:38.200
And there was so much in, you know, to give them a little bit of credit or to have a little bit of sympathy for the manufacturers.

14:38.680 --> 14:46.140
There's a lot that rides on them not having issues, you know, obviously, they're a heavily regulated industry.

14:46.140 --> 14:59.360
If there is a problem with their medical device, there's consequences, you know, whether those are regulatory consequences, or they are getting sued, or whatever it is, patient harm consequences, it's a big deal.

14:59.700 --> 15:14.240
And so it took them a significant amount of time and a significant amount of work by a lot of discrete parties within the security research community.

15:14.240 --> 15:16.800
I'm sure, Andrea, you played a role in this.

15:17.120 --> 15:33.380
Josh Corman, Bo Woods, Katie Masuris, Nina Ali, a lot of these folks put in a lot of time and effort to actually sit down with the medical device manufacturers and others, you know, this was also going on in auto and energy and other sectors, and essentially be like,

15:33.380 --> 15:38.240
look, we come in peace, like, we're really just trying to help you here.

15:39.320 --> 15:49.260
And over time, as you know, we had also some visionaries on the medical device side, and certainly my boss, I can't take credit for this, I wasn't at FDA at this time, but Dr.

15:49.260 --> 15:50.500
Suzanne Schwartz, Dr.

15:50.500 --> 15:51.940
Seth Carmody, Dr.

15:51.940 --> 16:01.280
Afton Ross, they actually sort of also went out on a limb and began to embrace the security research community.

16:01.280 --> 16:18.160
There were some of these visionaries at these medical device manufacturers, Colin Morgan, Rob Suarez, Michael McNeil, others who really took the lead on recognizing that coordinated disclosure, and just the ability to be given information in a friendly way,

16:18.160 --> 16:22.520
rather than a blackmail way, helped everyone.

16:23.460 --> 16:42.940
And so from about, I don't know, 2015-ish to now, what we see much, much, much more frequently is the security researchers go directly to the medical device manufacturers who receive them with open arms, they have this continuous dialogue that we don't even know about for weeks,

16:42.940 --> 17:01.500
months, however long it takes place, and then at some point prior to the public disclosure, they come to us as a united front and essentially say, hey, this awesome guy over here, whoever found a cybersecurity vulnerability, they told us about it, here's all the things that we've done,

17:02.320 --> 17:13.080
they agree, they've checked our math, they think that it's correct, and we're going to just close on this day, we're going to do this, this is our plan for post-market, as we had discussed before.

17:13.960 --> 17:25.940
And it's a much smoother, it's a much more collaborative, and it's a much more effective process for us as an agency, so we're not having to stand over everyone and check their work.

17:27.300 --> 17:31.400
And it really just benefits patients overall that we all have these relationships.

17:32.920 --> 17:44.260
If you were looking for specifics, like specific disclosures that I could point to, I'm trying to think, like, what are some of the best examples that we've run into lately?

17:44.680 --> 17:51.840
It's been a little bit confused with COVID, as everyone can, I think, probably sympathize with, because there's a lot going on.

17:52.120 --> 17:57.400
But maybe one that I'll point out, too, this is the last one that FDA did a safety communication on.

17:57.620 --> 18:14.460
This is a cross-industry problem with Bluetooth low energy, and it didn't just happen in the healthcare sector, but we were the ones who ended up kicking off a lot of the response.

18:14.700 --> 18:21.980
But the researchers were in Singapore, the vulnerabilities impacted just numerous medical device manufacturers.

18:23.060 --> 18:33.520
But what was really impressive about that is our ability to connect the researchers to the medical device manufacturers and the researchers' willingness to be connected to the medical device manufacturers