1
00:00:00,120 --> 00:00:01,890
- Saturday first talk of the day,

2
00:00:01,890 --> 00:00:03,900
let's give them a great
big DEFCON welcome.

3
00:00:03,900 --> 00:00:05,369
Come on.
(crowd applauding)

4
00:00:05,369 --> 00:00:06,790
Chad, yeah.

5
00:00:06,790 --> 00:00:07,893
- Yeah, woo.

6
00:00:09,090 --> 00:00:10,500
All right.

7
00:00:10,500 --> 00:00:12,930
Hey, welcome everybody,
we're really appreciative.

8
00:00:12,930 --> 00:00:14,060
I think it's wild,

9
00:00:14,060 --> 00:00:16,530
just to think about how far DEFCON's come,

10
00:00:16,530 --> 00:00:19,170
we're at DEFCON 30, how insane is that?

11
00:00:19,170 --> 00:00:22,260
You look around walking through
the halls, there's marble,

12
00:00:22,260 --> 00:00:23,400
and this is just so,

13
00:00:23,400 --> 00:00:25,410
it's interesting to see where we've come.

14
00:00:25,410 --> 00:00:29,490
So I think its worth a
second to just look around,

15
00:00:29,490 --> 00:00:32,790
see who's where, see how much
we've grown and appreciate

16
00:00:32,790 --> 00:00:36,593
that we have just begun to burn down

17
00:00:36,593 --> 00:00:38,910
all the shit that's wrong in this world

18
00:00:38,910 --> 00:00:40,290
and fix it with our hacker mind.

19
00:00:40,290 --> 00:00:42,480
So guys give yourself a round of applause,

20
00:00:42,480 --> 00:00:43,590
like that is important
(chuckles)

21
00:00:43,590 --> 00:00:45,267
and you being here is part of that,

22
00:00:45,267 --> 00:00:46,833
and we really appreciate that.

23
00:00:48,720 --> 00:00:49,770
- Thank you so much for being with us,

24
00:00:49,770 --> 00:00:51,960
especially at 10:00 AM on a Saturday,

25
00:00:51,960 --> 00:00:53,220
which in DEFCON time

26
00:00:53,220 --> 00:00:55,200
is like three in the
morning in the real world.

27
00:00:55,200 --> 00:00:56,550
So really appreciate it.

28
00:00:56,550 --> 00:00:59,107
My name is Jeff, my
friends call me Replicant.

29
00:00:59,107 --> 00:01:02,190
I'm a pediatrician and an anesthesiologist

30
00:01:02,190 --> 00:01:03,840
and I do some security research

31
00:01:03,840 --> 00:01:06,290
about clinical medicine
technology with this guy.

32
00:01:07,200 --> 00:01:09,870
- I'm Christian Dameff,
"quaddi" is my handle.

33
00:01:09,870 --> 00:01:11,550
I am an emergency medicine physician

34
00:01:11,550 --> 00:01:13,290
and security researcher.

35
00:01:13,290 --> 00:01:14,640
- And I'm Cory Doctorow.

36
00:01:14,640 --> 00:01:16,590
I've worked with the
Electronic Frontier Foundation

37
00:01:16,590 --> 00:01:18,630
for 20 years in different capacities.

38
00:01:18,630 --> 00:01:21,750
I'm currently the special advisor.

39
00:01:21,750 --> 00:01:23,220
I write science fiction novels

40
00:01:23,220 --> 00:01:25,470
and I'm on the computer science faculty

41
00:01:25,470 --> 00:01:28,230
at the Open University and
the library science faculty

42
00:01:28,230 --> 00:01:30,030
at the University of North Carolina.

43
00:01:31,007 --> 00:01:32,070
- So a little known fact,

44
00:01:32,070 --> 00:01:34,200
quaddi actually brought
me to my first DEFCON,

45
00:01:34,200 --> 00:01:36,000
which I think was DEFCON 18 or 19

46
00:01:36,000 --> 00:01:38,160
back when we were baby medical students.

47
00:01:38,160 --> 00:01:40,022
And I was thinking the other day

48
00:01:40,022 --> 00:01:42,833
about what has happened
in medicine since then.

49
00:01:42,833 --> 00:01:44,970
I mean, it seems like the 10 plus years

50
00:01:44,970 --> 00:01:47,520
have gone by quickly, but in
medicine that's a lifetime

51
00:01:47,520 --> 00:01:50,460
and there have been
some incredible advances

52
00:01:50,460 --> 00:01:54,450
in some of the ways we used our
technology to treat patients

53
00:01:54,450 --> 00:01:56,580
that we can really look
at with two lenses,

54
00:01:56,580 --> 00:01:59,550
a lens of promise for the future

55
00:01:59,550 --> 00:02:01,440
and the incredible
achievements we can make,

56
00:02:01,440 --> 00:02:04,110
but also one of peril of a future

57
00:02:04,110 --> 00:02:07,860
in which we want to avoid
really significant concerns

58
00:02:07,860 --> 00:02:09,990
and tensions with privacy and autonomy.

59
00:02:09,990 --> 00:02:11,700
And so just to kind of
give you a little bit

60
00:02:11,700 --> 00:02:14,760
of a consideration for that,
we have gene therapies now

61
00:02:14,760 --> 00:02:17,730
that treat diseases that
were fatal to children

62
00:02:17,730 --> 00:02:19,410
when I was in my pediatric residency.

63
00:02:19,410 --> 00:02:20,490
And that's incredible.

64
00:02:20,490 --> 00:02:22,920
That's incredible promise.

65
00:02:22,920 --> 00:02:23,790
Looking at it the other way though,

66
00:02:23,790 --> 00:02:24,810
if you don't have insurance,

67
00:02:24,810 --> 00:02:26,340
you gotta pay half a
million dollars a year

68
00:02:26,340 --> 00:02:28,680
to keep your kid alive, right?

69
00:02:28,680 --> 00:02:30,420
We're gonna talk about
artificial pancreas's,

70
00:02:30,420 --> 00:02:33,390
incredible technology that
hackers have pioneered

71
00:02:33,390 --> 00:02:36,570
that can help to improve
your diabetic control

72
00:02:36,570 --> 00:02:38,943
and really increase your quality of life.

73
00:02:38,943 --> 00:02:40,830
But we can see a future where some people

74
00:02:40,830 --> 00:02:42,630
may be forced to use a black box

75
00:02:42,630 --> 00:02:44,460
that they don't fully understand

76
00:02:44,460 --> 00:02:46,770
that collects data that they can access,

77
00:02:46,770 --> 00:02:48,923
that depends on DRM shackled consumables

78
00:02:48,923 --> 00:02:52,320
that they need in order to
continue to have a function

79
00:02:52,320 --> 00:02:55,590
or a future in which telemedicine
is available to everybody

80
00:02:55,590 --> 00:02:57,390
and people can see a primary care provider

81
00:02:57,390 --> 00:02:58,920
and they can use personalized medicine

82
00:02:58,920 --> 00:03:00,960
to customize treatments for them.

83
00:03:00,960 --> 00:03:03,000
You can see a flip side of that coin

84
00:03:03,000 --> 00:03:05,670
where private equity is buying
up your primary care provider

85
00:03:05,670 --> 00:03:08,130
and Amazon's acquiring
your doctor's offices

86
00:03:08,130 --> 00:03:09,720
and you're starting to get targeted ads

87
00:03:09,720 --> 00:03:11,430
based on the data they're mining from you.

88
00:03:11,430 --> 00:03:15,990
So really wanna explore those
tensions today as we talk.

89
00:03:15,990 --> 00:03:17,790
- And we thought no better a person

90
00:03:17,790 --> 00:03:22,790
to help us talk about this than
the activist Cory Doctorow.

91
00:03:23,700 --> 00:03:25,110
So we're gonna like Cory,
take it over for now.

92
00:03:25,110 --> 00:03:26,600
Give it up for Cory, give it up.

93
00:03:26,600 --> 00:03:28,380
(crowd applauding)
- Thanks gentlemen.

94
00:03:28,380 --> 00:03:29,760
Thank you all.

95
00:03:29,760 --> 00:03:32,416
So I wanna talk about a group of people

96
00:03:32,416 --> 00:03:35,760
who rely on med tech and also
rely on modifying med tech

97
00:03:35,760 --> 00:03:37,586
and some of the ways that

98
00:03:37,586 --> 00:03:40,320
their own safety has been
weaponized against them.

99
00:03:40,320 --> 00:03:42,420
And some of the stuff that's come out,

100
00:03:42,420 --> 00:03:44,970
that's made life better
for people who rely on it.

101
00:03:44,970 --> 00:03:47,310
So I'm talking about people
who use power wheelchairs,

102
00:03:47,310 --> 00:03:48,420
which are a significant part

103
00:03:48,420 --> 00:03:51,780
of the $50 billion durable
medical equipment market.

104
00:03:51,780 --> 00:03:53,310
There's about 3 million Americans

105
00:03:53,310 --> 00:03:55,140
who use powered wheelchairs.

106
00:03:55,140 --> 00:03:59,490
It's the complex rehab
tech area of Medicare

107
00:03:59,490 --> 00:04:01,860
and Medicare is pretty
dysfunctional in this regard.

108
00:04:01,860 --> 00:04:04,800
They very narrowly
interpreted their mandate.

109
00:04:04,800 --> 00:04:07,590
And so if you use a power wheelchair

110
00:04:07,590 --> 00:04:09,690
and you rely on Medicare
to provide it to you,

111
00:04:09,690 --> 00:04:13,110
Medicare will only give you
an indoor powered wheelchair,

112
00:04:13,110 --> 00:04:16,740
although many of us
like to leave our homes

113
00:04:16,740 --> 00:04:19,080
and they will also refuse

114
00:04:19,080 --> 00:04:20,550
to cover any preventative maintenance.

115
00:04:20,550 --> 00:04:22,500
So this is a recipe for disaster.

116
00:04:22,500 --> 00:04:24,060
You have a chair that's being used

117
00:04:24,060 --> 00:04:25,940
in ways that it's not supposed to be used

118
00:04:25,940 --> 00:04:29,300
and you can't perform
preventative maintenance on it.

119
00:04:29,300 --> 00:04:32,910
One problem of the way that
Medicare procures these chairs

120
00:04:32,910 --> 00:04:35,730
is that they go to lowest bidders.

121
00:04:35,730 --> 00:04:37,530
And the way to generate a low bid

122
00:04:37,530 --> 00:04:39,030
is to have economies of scale.

123
00:04:39,030 --> 00:04:41,190
And so two private equity rollups,

124
00:04:41,190 --> 00:04:42,450
a company called NewMotion

125
00:04:42,450 --> 00:04:45,000
and another company called
National Seating & Mobility

126
00:04:45,000 --> 00:04:46,983
have bought virtually
all the other companies

127
00:04:46,983 --> 00:04:48,810
that make powered wheelchairs.

128
00:04:48,810 --> 00:04:50,550
So people who use power wheelchairs

129
00:04:50,550 --> 00:04:52,529
buy from one of those
two companies typically

130
00:04:52,529 --> 00:04:57,000
and private equity firms,
they have a common playbook,

131
00:04:57,000 --> 00:04:59,430
which is to load up their
acquisitions with a lot of debt

132
00:04:59,430 --> 00:05:01,380
and then squeeze them
to service that debt.

133
00:05:01,380 --> 00:05:03,990
They pay themselves a special
dividend on acquisition

134
00:05:03,990 --> 00:05:06,480
and then to make good on that debt,

135
00:05:06,480 --> 00:05:08,160
they then have to squeeze them.

136
00:05:08,160 --> 00:05:11,820
One of the areas they've
squeezed is by cutting service.

137
00:05:11,820 --> 00:05:14,490
And so parts are billed
at very high prices

138
00:05:14,490 --> 00:05:17,460
and it takes a very long
time to get serviced.

139
00:05:17,460 --> 00:05:19,620
So all of this was examined in detail

140
00:05:19,620 --> 00:05:22,920
in a report that came out
this spring called Stranded

141
00:05:22,920 --> 00:05:26,190
from the Public Interest
Research Group, or PIRG.

142
00:05:26,190 --> 00:05:27,829
Stranded found that 93%

143
00:05:27,829 --> 00:05:31,050
of the power wheelchair
users they surveyed

144
00:05:31,050 --> 00:05:34,050
had had a need for
service in the last year.

145
00:05:34,050 --> 00:05:37,470
62% of them had waited four
weeks for that service,

146
00:05:37,470 --> 00:05:42,470
and 40% of them had waited
seven or more weeks for service

147
00:05:42,630 --> 00:05:44,580
and, or seven, yeah, seven or more weeks,

148
00:05:44,580 --> 00:05:46,380
sorry, I thought that was
months, no seven or more weeks.

149
00:05:46,380 --> 00:05:49,140
And you have to understand
that in some instances,

150
00:05:49,140 --> 00:05:51,780
this meant not only that you
couldn't leave your home,

151
00:05:51,780 --> 00:05:53,760
but possibly that you
couldn't leave your bed.

152
00:05:53,760 --> 00:05:56,610
So it makes it very hard
to be, have a family life,

153
00:05:56,610 --> 00:05:58,740
have a personal life, do shopping,

154
00:05:58,740 --> 00:06:01,140
maintain your job and
do all of these things.

155
00:06:01,140 --> 00:06:02,188
So the question is

156
00:06:02,188 --> 00:06:05,880
why can't people who are
literally stuck in bed

157
00:06:05,880 --> 00:06:07,830
for seven weeks waiting for a part,

158
00:06:07,830 --> 00:06:09,810
why can't they just fix their own chairs?

159
00:06:09,810 --> 00:06:11,790
And partly that's because
the part stream itself

160
00:06:11,790 --> 00:06:14,070
has been starved by the duopoly.

161
00:06:14,070 --> 00:06:19,070
So in Stranded, PIRG collected stories

162
00:06:19,680 --> 00:06:21,570
from people who use power wheelchairs

163
00:06:21,570 --> 00:06:24,074
about their problems
getting parts and service,

164
00:06:24,074 --> 00:06:28,770
they found multiple people
reporting that the $6 inner tube

165
00:06:28,770 --> 00:06:33,770
that their chair used cost
$300 as a Medicare build part,

166
00:06:34,380 --> 00:06:36,690
and that it would take six
to eight weeks to procure.

167
00:06:36,690 --> 00:06:40,560
So you would have a flat
for six to eight weeks

168
00:06:40,560 --> 00:06:43,680
while you waited for
your chair to get fixed.

169
00:06:43,680 --> 00:06:46,050
There was an instance
of a $20 power button

170
00:06:46,050 --> 00:06:47,970
that literally turned on the chair

171
00:06:47,970 --> 00:06:50,790
that cost $500 and took four months.

172
00:06:50,790 --> 00:06:53,310
But even where people can
get parts and they do,

173
00:06:53,310 --> 00:06:56,160
they source them from eBay and
they source them from Amazon.

174
00:06:56,160 --> 00:06:59,490
And there's one great story
about a stability wheel

175
00:06:59,490 --> 00:07:01,800
that they were having
trouble sourcing a couple

176
00:07:01,800 --> 00:07:03,607
and then their son looked
up and he was like,

177
00:07:03,607 --> 00:07:05,340
"That's just a skateboard wheel"

178
00:07:05,340 --> 00:07:08,430
and showed them how to
buy that wheel with cool,

179
00:07:08,430 --> 00:07:10,110
like orange glitter and whatever.

180
00:07:10,110 --> 00:07:11,640
And they just replaced it, right,

181
00:07:11,640 --> 00:07:14,580
So sometimes you can just fix your chair

182
00:07:14,580 --> 00:07:17,070
by going around this
treating them as damage

183
00:07:17,070 --> 00:07:18,180
and routing around them,

184
00:07:18,180 --> 00:07:21,420
but sometimes you get blocked
by digital rights management.

185
00:07:21,420 --> 00:07:23,430
So these chairs use
digital rights management

186
00:07:23,430 --> 00:07:25,710
to restrict access to
their management consoles.

187
00:07:25,710 --> 00:07:27,780
That means that you can't
get diagnostic information

188
00:07:27,780 --> 00:07:28,613
out of them,

189
00:07:28,613 --> 00:07:31,260
it also means that you can't
make routine adjustments.

190
00:07:31,260 --> 00:07:32,479
So for example,

191
00:07:32,479 --> 00:07:35,873
there's often a delay built
into the steering mechanisms.

192
00:07:35,873 --> 00:07:38,070
As you get more proficient
with your chair,

193
00:07:38,070 --> 00:07:39,330
you might wanna reduce that delay,

194
00:07:39,330 --> 00:07:41,010
you can't do that on your own.

195
00:07:41,010 --> 00:07:43,350
Also, if you change the
pressure on your tires

196
00:07:43,350 --> 00:07:44,550
for different terrain

197
00:07:44,550 --> 00:07:46,440
and you wanna adjust the
torque and the motor,

198
00:07:46,440 --> 00:07:50,355
that's also an alteration
needed security dongle for.

199
00:07:50,355 --> 00:07:55,047
So the good news is that
Colorado and June passed the HB

200
00:07:55,047 --> 00:07:56,250
221031,

201
00:07:56,250 --> 00:07:59,460
the consumer right to Repair
Power Wheelchairs Act,

202
00:07:59,460 --> 00:08:02,430
which substantially fixes
a lot of these things.

203
00:08:02,430 --> 00:08:04,708
They did run up against a
really important problem though,

204
00:08:04,708 --> 00:08:07,980
which is that removing DRM as
a felony under federal law,

205
00:08:07,980 --> 00:08:11,070
section 12.1 of the Digital
Millennium Copyright Act

206
00:08:11,070 --> 00:08:14,640
provides for a five year prison
sentence and a $500,000 fine

207
00:08:14,640 --> 00:08:18,090
for providing a tool to bypass DRM.

208
00:08:18,090 --> 00:08:20,340
And so they couldn't authorize people

209
00:08:20,340 --> 00:08:22,620
who wanted to fix wheelchairs
or who used wheelchairs

210
00:08:22,620 --> 00:08:24,570
or used wheelchairs and
wanted to fix wheelchairs.

211
00:08:24,570 --> 00:08:26,820
They couldn't authorize them to make

212
00:08:26,820 --> 00:08:29,940
or provision each other with tools

213
00:08:29,940 --> 00:08:31,680
that would allow them
to affect these repairs.

214
00:08:31,680 --> 00:08:33,870
So instead they did an end run around it

215
00:08:33,870 --> 00:08:35,490
and they ordered the wheelchair companies

216
00:08:35,490 --> 00:08:38,070
to just provide the tools
that would allow them to read

217
00:08:38,070 --> 00:08:39,510
at the diagnostics and so on.

218
00:08:39,510 --> 00:08:42,750
This is a good solution,
but really it's not enough.

219
00:08:42,750 --> 00:08:45,090
And so I just wanna finish by saying

220
00:08:45,090 --> 00:08:46,560
that Electronic Frontier Foundation,

221
00:08:46,560 --> 00:08:49,200
we're representing Matthew
Green and Andrew Bunny Wang

222
00:08:49,200 --> 00:08:53,040
in a lawsuit to overturn
section 1201 of the DMCA.

223
00:08:53,040 --> 00:08:55,830
And finally to say that, as I noted,

224
00:08:55,830 --> 00:08:57,600
there's some deep structural problems

225
00:08:57,600 --> 00:08:59,940
that make it hard for people
who use powered wheelchairs.

226
00:08:59,940 --> 00:09:02,490
Right, there's the duopoly,

227
00:09:02,490 --> 00:09:04,410
there's Medicare only
paying for indoor chairs

228
00:09:04,410 --> 00:09:06,810
and not supporting
preventative maintenance

229
00:09:06,810 --> 00:09:09,900
and better repair doesn't
solve any of those problems,

230
00:09:09,900 --> 00:09:11,580
but it does fix wheelchairs.

231
00:09:11,580 --> 00:09:14,700
Right, and that in itself
is something worth doing

232
00:09:14,700 --> 00:09:17,150
and we can walk and chew
gum, we need to do both.

233
00:09:18,990 --> 00:09:19,823
- That story,

234
00:09:19,823 --> 00:09:24,243
how many people out here were
surprised about that story?

235
00:09:25,410 --> 00:09:27,420
Have you guys experienced
modern healthcare

236
00:09:27,420 --> 00:09:29,031
that raised your hand?

237
00:09:29,031 --> 00:09:30,780
(crowd chuckles)

238
00:09:30,780 --> 00:09:32,850
Raise your hand if you've been frustrated

239
00:09:32,850 --> 00:09:35,640
with the inefficiencies,
the lack of communication,

240
00:09:35,640 --> 00:09:37,590
the broken insurance system.

241
00:09:37,590 --> 00:09:38,880
Yeah, okay.

242
00:09:38,880 --> 00:09:40,260
We can all relate with that, absolutely.

243
00:09:40,260 --> 00:09:42,270
As clinicians, we relate with that.

244
00:09:42,270 --> 00:09:44,790
And as patients ourselves, we do.

245
00:09:44,790 --> 00:09:45,870
We're gonna transition a little bit

246
00:09:45,870 --> 00:09:49,950
to another very strong
theme in modern medicine,

247
00:09:49,950 --> 00:09:53,669
which is just that we often are unaware

248
00:09:53,669 --> 00:09:57,090
of how the tools we use actually function.

249
00:09:57,090 --> 00:09:58,800
And so (indistinct) can take us away.

250
00:09:58,800 --> 00:10:01,590
- So my day job, I'm an anesthesiologist

251
00:10:01,590 --> 00:10:04,410
and I somewhat (indistinct) say
that I hack people's brains.

252
00:10:04,410 --> 00:10:07,140
So I turn you off and somebody
pokes you with a hot knife

253
00:10:07,140 --> 00:10:08,605
and I turn you back on again.

254
00:10:08,605 --> 00:10:09,990
If it's a neurosurgery,

255
00:10:09,990 --> 00:10:11,940
we blow on it before we put it back in,

256
00:10:11,940 --> 00:10:13,560
but
(crowd chuckles)

257
00:10:13,560 --> 00:10:15,780
it's widely accepted among our profession

258
00:10:15,780 --> 00:10:18,900
that it's less than ideal
to wake up during surgery.

259
00:10:18,900 --> 00:10:21,960
And so one of the things
that we used as a monitor

260
00:10:21,960 --> 00:10:24,960
that helps us in addition
to a couple other variables,

261
00:10:24,960 --> 00:10:26,730
kind of keep track on how deep a patient

262
00:10:26,730 --> 00:10:29,190
is under anesthesia, it's
called the BIS monitor.

263
00:10:29,190 --> 00:10:30,870
We've used it for about the last 20 years,

264
00:10:30,870 --> 00:10:34,050
it has been the topic of
1000s of academic papers

265
00:10:34,050 --> 00:10:36,570
that really investigate
how anesthetics even work.

266
00:10:36,570 --> 00:10:38,800
So it's something that we're
all very familiar with.

267
00:10:38,800 --> 00:10:40,770
And without getting too much in the weeds,

268
00:10:40,770 --> 00:10:41,670
this is a monitor,

269
00:10:41,670 --> 00:10:44,160
the name BIS is derived from how it works,

270
00:10:44,160 --> 00:10:47,070
it takes electrical signals
of the brain, the EEG,

271
00:10:47,070 --> 00:10:49,680
and it processes it to
produce a unit list,

272
00:10:49,680 --> 00:10:51,720
dimensional list number
that people can trend.

273
00:10:51,720 --> 00:10:54,990
So 20 patients nice and
deep under anesthesia,

274
00:10:54,990 --> 00:10:57,870
80, they're about to wake up
and sue you from malpractice.

275
00:10:57,870 --> 00:11:00,570
So for a long time, that name BIS

276
00:11:00,570 --> 00:11:02,760
was derived because
most people understood,

277
00:11:02,760 --> 00:11:03,870
this is something that looks

278
00:11:03,870 --> 00:11:05,640
at what's called the bispectral index,

279
00:11:05,640 --> 00:11:06,473
which doesn't matter,

280
00:11:06,473 --> 00:11:09,456
it's just a way that you
can analyze that EEG.

281
00:11:09,456 --> 00:11:12,810
Last year, a really
awesome doc at Harvard,

282
00:11:12,810 --> 00:11:13,740
Christopher Connor

283
00:11:13,740 --> 00:11:16,983
reverse engineered these
previously proprietary algorithms.

284
00:11:16,983 --> 00:11:17,816
So there's a black box,

285
00:11:17,816 --> 00:11:19,350
nobody's ever really
seen under the hood here.

286
00:11:19,350 --> 00:11:21,330
He reversed those algorithms

287
00:11:21,330 --> 00:11:23,251
and showed that actually this device

288
00:11:23,251 --> 00:11:26,220
isn't producing a
bi-spectral index at all,

289
00:11:26,220 --> 00:11:29,010
it's looking at a completely
different aspect of the EEG,

290
00:11:29,010 --> 00:11:30,090
which is a little unusual

291
00:11:30,090 --> 00:11:32,068
because a lot of the
research that we've based

292
00:11:32,068 --> 00:11:34,350
and used this monitor to conduct

293
00:11:34,350 --> 00:11:36,900
has operated under this base assumption

294
00:11:36,900 --> 00:11:37,733
that the manufacturer

295
00:11:37,733 --> 00:11:39,930
has never bothered to correct or operate.

296
00:11:39,930 --> 00:11:41,640
And it's kind of a little bit unfortunate

297
00:11:41,640 --> 00:11:43,800
because I think in situations like this,

298
00:11:43,800 --> 00:11:45,090
when we're using these clinical devices

299
00:11:45,090 --> 00:11:46,410
without fully understanding

300
00:11:46,410 --> 00:11:47,760
where they're getting their information,

301
00:11:47,760 --> 00:11:49,050
how they're producing and how we use it,

302
00:11:49,050 --> 00:11:51,030
we miss opportunities to innovate,

303
00:11:51,030 --> 00:11:53,760
we miss opportunities to be
able to use these devices

304
00:11:53,760 --> 00:11:54,870
in different situations,

305
00:11:54,870 --> 00:11:56,670
or to say that they may be less than ideal

306
00:11:56,670 --> 00:11:58,320
for a particular use context.

307
00:11:58,320 --> 00:12:00,870
And I just don't really understand

308
00:12:00,870 --> 00:12:03,330
why we have to live in a paradigm

309
00:12:03,330 --> 00:12:06,480
where these things are so
locked down and proprietary.

310
00:12:06,480 --> 00:12:09,990
And if this is a concern
for clinical devices

311
00:12:09,990 --> 00:12:11,310
that are relatively reliable,

312
00:12:11,310 --> 00:12:13,260
that we've used for the last 20 years,

313
00:12:13,260 --> 00:12:14,490
I'm even more worried

314
00:12:14,490 --> 00:12:19,490
about this coming tsunami of
clinical AI/ML algorithms.

315
00:12:19,530 --> 00:12:22,650
If I had a Dogecoin for
every Silicon Valley guide,

316
00:12:22,650 --> 00:12:25,470
a medical conference, who said,
I've got this AI algorithm

317
00:12:25,470 --> 00:12:27,870
that's gonna revolutionize
the way you practice medicine,

318
00:12:27,870 --> 00:12:30,426
save you billions, I'd have like $4.

319
00:12:30,426 --> 00:12:32,640
(crowd laughing)

320
00:12:32,640 --> 00:12:36,330
So Corey, like why should
we not lift our hands

321
00:12:36,330 --> 00:12:37,170
and welcome our new

322
00:12:37,170 --> 00:12:38,580
clinical AI overlords?

323
00:12:38,580 --> 00:12:41,160
- So, I mean, think that
this is probably an audience

324
00:12:41,160 --> 00:12:43,440
that is well up on all the different ways

325
00:12:43,440 --> 00:12:44,880
that ML can go very wrong.

326
00:12:44,880 --> 00:12:46,980
We have a whole village here at DEFCON

327
00:12:46,980 --> 00:12:49,200
where you can see people giving ML

328
00:12:49,200 --> 00:12:52,230
all kind of hallucinations and
tricking it in lots of ways,

329
00:12:52,230 --> 00:12:53,790
deliberately and accidentally.

330
00:12:53,790 --> 00:12:56,100
It sometimes has some weird failure modes.

331
00:12:56,100 --> 00:12:58,004
And of course that's true of people.

332
00:12:58,004 --> 00:13:01,770
People make mistakes, people
have biases and so on,

333
00:13:01,770 --> 00:13:04,680
but there's one thing about a number

334
00:13:04,680 --> 00:13:08,430
that's given to you by software that is,

335
00:13:08,430 --> 00:13:10,355
I think more dangerous

336
00:13:10,355 --> 00:13:13,140
than a number that's
given to you by human,

337
00:13:13,140 --> 00:13:15,271
which is the degree of
trust we put into it,

338
00:13:15,271 --> 00:13:19,050
that if you take a process that
would normally take someone

339
00:13:19,050 --> 00:13:20,407
aback and have them say,

340
00:13:20,407 --> 00:13:22,500
"Wait a second, that can't be right."

341
00:13:22,500 --> 00:13:25,560
And you have a computer emit
that as a precise number,

342
00:13:25,560 --> 00:13:27,987
instead of as a kind of squishy judgment,

343
00:13:27,987 --> 00:13:32,467
you can empiricism wash your
weird ideas and people go,

344
00:13:32,467 --> 00:13:34,950
"Oh yeah, and I guess
algorithms can't be racist.

345
00:13:34,950 --> 00:13:37,710
There's no such thing as
racist math", to which I say,

346
00:13:37,710 --> 00:13:39,150
meet my friend, the phenologist,

347
00:13:39,150 --> 00:13:42,300
he'd like to measure your
skull with his calipers.

348
00:13:42,300 --> 00:13:45,600
So I think that when you combine

349
00:13:45,600 --> 00:13:47,640
the already difficult situation

350
00:13:47,640 --> 00:13:50,910
in which people often defer
to medical professionals

351
00:13:50,910 --> 00:13:54,450
about things that they're
uniquely situated to describe

352
00:13:54,450 --> 00:13:56,250
because they're part of
their subjective response

353
00:13:56,250 --> 00:13:57,720
to their pathologies,

354
00:13:57,720 --> 00:14:00,007
and then you add a computer
in the mix that says,

355
00:14:00,007 --> 00:14:04,230
"No, everything is fine, it
becomes very hard to imagine

356
00:14:04,230 --> 00:14:08,310
how patients are gonna be
able to exert bodily autonomy,

357
00:14:08,310 --> 00:14:10,260
and autonomy over their care."

358
00:14:10,260 --> 00:14:12,240
And I did wanna add
about that awesome paper

359
00:14:12,240 --> 00:14:14,010
about the BIS monitor that this audience

360
00:14:14,010 --> 00:14:15,390
I think will appreciate,

361
00:14:15,390 --> 00:14:16,739
the guy who reversed the BIS monitor,

362
00:14:16,739 --> 00:14:19,320
one of the ways that
he was able to do this

363
00:14:19,320 --> 00:14:20,550
is by building an emulator,

364
00:14:20,550 --> 00:14:21,870
which turned out to be really easy

365
00:14:21,870 --> 00:14:25,170
'cause the core DSP in the BIS monitor

366
00:14:25,170 --> 00:14:28,200
is a TI DSP that's used
widely in video game systems.

367
00:14:28,200 --> 00:14:31,023
So he could use MAME, which is just great.

368
00:14:31,991 --> 00:14:33,173
(crowd laughing)
- It's rad.

369
00:14:34,320 --> 00:14:37,140
So we've talked about algorithmic bias

370
00:14:37,140 --> 00:14:38,670
and empiricism washing

371
00:14:38,670 --> 00:14:40,780
and how we're all kind of
really aware that these

372
00:14:40,780 --> 00:14:45,204
algorithms can have bias
unintentionally sometimes

373
00:14:45,204 --> 00:14:49,620
just so fully based on the
data that you put into it

374
00:14:49,620 --> 00:14:52,290
or the training set of the
demographic composition

375
00:14:52,290 --> 00:14:54,570
of the individuals that comprise it.

376
00:14:54,570 --> 00:14:56,610
But then it becomes even more concerning,

377
00:14:56,610 --> 00:14:59,377
and a lot of this talks talking
about dystopian futures,

378
00:14:59,377 --> 00:15:02,190
when you consider
adversarial machine learning.

379
00:15:02,190 --> 00:15:03,870
And so if you're not familiar with that,

380
00:15:03,870 --> 00:15:06,055
I meant many of you are,

381
00:15:06,055 --> 00:15:09,600
think about ways in which
an intelligent adversary

382
00:15:09,600 --> 00:15:12,330
could attack machine learning algorithms

383
00:15:12,330 --> 00:15:14,250
to manipulate the outcome.

384
00:15:14,250 --> 00:15:17,047
Right, they could attack classifications,

385
00:15:17,047 --> 00:15:19,473
they could attack training sets,

386
00:15:19,473 --> 00:15:21,930
change what the ground truth is

387
00:15:21,930 --> 00:15:23,869
and design an attack

388
00:15:23,869 --> 00:15:26,790
that manipulates the
outcome of the algorithm,

389
00:15:26,790 --> 00:15:29,100
that could be done in a
variety of really scary ways

390
00:15:29,100 --> 00:15:30,660
for a lot of really scary purposes.

391
00:15:30,660 --> 00:15:33,266
If it's to manipulate you
into buying something,

392
00:15:33,266 --> 00:15:36,930
you can see a financial motivation
in the healthcare space,

393
00:15:36,930 --> 00:15:40,166
you can imagine organizations,
companies, entities

394
00:15:40,166 --> 00:15:43,680
doing that as to compete with one another

395
00:15:43,680 --> 00:15:46,590
and make their particular
AI algorithm less effective,

396
00:15:46,590 --> 00:15:47,610
for example.

397
00:15:47,610 --> 00:15:49,110
There are even some papers out there

398
00:15:49,110 --> 00:15:50,520
that are quite concerning where

399
00:15:50,520 --> 00:15:52,770
it's not necessarily the entire population

400
00:15:52,770 --> 00:15:55,290
that may be impacted by
adversarial machine learning,

401
00:15:55,290 --> 00:15:56,970
but you can craft attacks

402
00:15:56,970 --> 00:15:59,790
that the outcome of that only impacts

403
00:15:59,790 --> 00:16:04,680
a certain group of people,
terrifying implications there.

404
00:16:04,680 --> 00:16:05,940
And one of which

405
00:16:05,940 --> 00:16:07,437
that I'm gonna have a little
bit of a call to action,

406
00:16:07,437 --> 00:16:09,510
and this whole talk is
kind of a call to action,

407
00:16:09,510 --> 00:16:12,000
but of the people in the world

408
00:16:12,000 --> 00:16:15,240
that are best suited to
understand the perils of this

409
00:16:15,240 --> 00:16:16,770
and be equipped

410
00:16:16,770 --> 00:16:19,710
to help defend the future
of humanity in this,

411
00:16:19,710 --> 00:16:22,560
I think hackers are probably
right there at the top, right?

412
00:16:22,560 --> 00:16:24,420
So two things, one,

413
00:16:24,420 --> 00:16:26,550
continue the transparency
that we've talked about,

414
00:16:26,550 --> 00:16:30,090
these BIS monitor as an
example about how we as hackers

415
00:16:30,090 --> 00:16:33,000
are generally in support
of far more transparency,

416
00:16:33,000 --> 00:16:34,320
especially with these algorithms

417
00:16:34,320 --> 00:16:36,120
that touch every aspect of our life.

418
00:16:36,120 --> 00:16:40,020
And then also that we
possess a unique skillset.

419
00:16:40,020 --> 00:16:44,207
One that can understand
how malicious adversaries

420
00:16:44,207 --> 00:16:45,908
just can attack these,

421
00:16:45,908 --> 00:16:47,639
how we can defend against them

422
00:16:47,639 --> 00:16:50,730
and how we can better
secure the infrastructure

423
00:16:50,730 --> 00:16:52,067
that will then

424
00:16:52,067 --> 00:16:55,980
hopefully with the promise
of a lot of this technology,

425
00:16:55,980 --> 00:16:59,280
potentially give us huge insights
into clinical care, right,

426
00:16:59,280 --> 00:17:02,030
improve treatments, new
medications that can completely

427
00:17:03,330 --> 00:17:05,790
do away with pathologies we
never thought would be possible.

428
00:17:05,790 --> 00:17:09,600
And so that kind of peril and promise,

429
00:17:09,600 --> 00:17:11,160
we need you out there

430
00:17:11,160 --> 00:17:12,270
to make sure

431
00:17:12,270 --> 00:17:14,850
that these things that
would thwart that future,

432
00:17:14,850 --> 00:17:16,590
that promising future
don't come to fruition.

433
00:17:16,590 --> 00:17:18,123
So we're hopeful in that.

434
00:17:19,140 --> 00:17:20,550
- Let's switch a little
bit from the doom and gloom

435
00:17:20,550 --> 00:17:22,230
to flip the script and talk about

436
00:17:22,230 --> 00:17:23,970
what happens when hackers pone themselves

437
00:17:23,970 --> 00:17:25,260
and are actually able
to take the initiative

438
00:17:25,260 --> 00:17:26,400
and innovate on some of this stuff.

439
00:17:26,400 --> 00:17:27,390
- Yeah, absolutely.

440
00:17:27,390 --> 00:17:31,230
So as you probably know, one
in 10 Americans has diabetes,

441
00:17:31,230 --> 00:17:33,615
92 million Americans are pre-diabetic

442
00:17:33,615 --> 00:17:35,937
and diabetes while anyone can get it

443
00:17:35,937 --> 00:17:40,710
disproportionately falls
on marginalized people,

444
00:17:40,710 --> 00:17:41,880
it's a disease of poverty.

445
00:17:41,880 --> 00:17:45,420
And so people who have
diabetes are structurally,

446
00:17:45,420 --> 00:17:49,050
find it difficult to
demand high quality care

447
00:17:49,050 --> 00:17:51,060
and to push back against abusive practices

448
00:17:51,060 --> 00:17:53,130
by med tech firms.

449
00:17:53,130 --> 00:17:56,370
So in 2013, some people with diabetes

450
00:17:56,370 --> 00:17:57,870
decided to do something about this,

451
00:17:57,870 --> 00:18:00,652
two hackers, Dana Lewis and John Costak

452
00:18:00,652 --> 00:18:03,463
took continuous glucose monitor

453
00:18:03,463 --> 00:18:06,270
and figured out a way
to hook it up directly

454
00:18:06,270 --> 00:18:09,930
to a insulin pump

455
00:18:09,930 --> 00:18:12,420
and wrote an algorithm that
monitored your blood sugar,

456
00:18:12,420 --> 00:18:13,800
tried to predict where it was going

457
00:18:13,800 --> 00:18:16,500
and tried to dose you with
insulin as you went along,

458
00:18:16,500 --> 00:18:20,460
and the closed loop pancreas
artificial pancreas was born.

459
00:18:20,460 --> 00:18:21,650
They call themselves "loopers"

460
00:18:21,650 --> 00:18:26,650
and they gather on a
platform called openaps.org.

461
00:18:27,270 --> 00:18:30,570
A lot of the people who
built these tools early on

462
00:18:30,570 --> 00:18:32,250
were parents of young children.

463
00:18:32,250 --> 00:18:35,220
So my friend, Soul Kajaro who
is a video game developer,

464
00:18:35,220 --> 00:18:39,060
he worked on a bunch of
Solarky games in the old days,

465
00:18:39,060 --> 00:18:43,170
his young son who was
two years old at the time

466
00:18:43,170 --> 00:18:45,120
had just been diagnosed
with type one diabetes

467
00:18:45,120 --> 00:18:46,560
and was in daycare.

468
00:18:46,560 --> 00:18:49,680
And the people who worked at the daycare

469
00:18:49,680 --> 00:18:51,392
were very diligent and caring,

470
00:18:51,392 --> 00:18:54,810
but they weren't experts
in managing diabetes.

471
00:18:54,810 --> 00:18:59,810
And so he wanted to be able
to oversee, partially automate

472
00:18:59,880 --> 00:19:04,880
and correct and get alerts
on his son's insulin levels,

473
00:19:05,460 --> 00:19:06,480
blood sugar levels.

474
00:19:06,480 --> 00:19:11,403
And so he became a core
developer on the looping tools.

475
00:19:12,570 --> 00:19:16,620
And there's a lot of hacker
overlap with this looping stuff,

476
00:19:16,620 --> 00:19:18,000
and it's one of these great examples

477
00:19:18,000 --> 00:19:20,768
of hackers helping normies,

478
00:19:20,768 --> 00:19:23,220
where the stuff that
we build for ourselves

479
00:19:23,220 --> 00:19:25,530
ends up sort of leaking out
into the rest of the world.

480
00:19:25,530 --> 00:19:26,640
And there's a reason

481
00:19:26,640 --> 00:19:29,310
that hackers want to
build looping software,

482
00:19:29,310 --> 00:19:32,070
and it's not because they're too lazy

483
00:19:32,070 --> 00:19:33,720
to manage their blood sugar,

484
00:19:33,720 --> 00:19:37,230
it's because doing a routine
task perfectly all the time

485
00:19:37,230 --> 00:19:39,273
is why we have computers.

486
00:19:39,273 --> 00:19:41,070
There's a reason we replace

487
00:19:41,070 --> 00:19:44,040
all of our routine tasks as
hackers with shells scripts.

488
00:19:44,040 --> 00:19:46,170
Do you remember when
Unix systems used to ship

489
00:19:46,170 --> 00:19:48,660
without a prebuilt cron job
that rotated the log files

490
00:19:48,660 --> 00:19:50,370
and they would just crash every three days

491
00:19:50,370 --> 00:19:53,310
'cause no one could remember
to rotate their log files?

492
00:19:53,310 --> 00:19:55,650
And replacing the routine
things in your life

493
00:19:55,650 --> 00:19:57,810
with a shell script is
especially important

494
00:19:57,810 --> 00:20:00,510
if when you screw it up, it's
hard for you to think right,

495
00:20:00,510 --> 00:20:02,130
and if you screw up your blood sugar,

496
00:20:02,130 --> 00:20:03,810
it can impair your cognition.

497
00:20:03,810 --> 00:20:06,900
So we lost a dear friend
last year, excuse me,

498
00:20:06,900 --> 00:20:08,190
I always get choked up at this point,

499
00:20:08,190 --> 00:20:12,057
but Dan Kaminski died last
year, he had diabetes,

500
00:20:12,057 --> 00:20:14,310
he had management problems with it,

501
00:20:14,310 --> 00:20:16,050
he was in lockdown, he was isolated,

502
00:20:16,050 --> 00:20:18,510
other people couldn't
see what was going on

503
00:20:18,510 --> 00:20:22,170
and you can see how even
someone as brilliant as our

504
00:20:22,170 --> 00:20:25,770
Powell Dan couldn't manage a routine task

505
00:20:25,770 --> 00:20:27,480
perfectly all the time

506
00:20:27,480 --> 00:20:30,780
and could experience a literally
fatal cascading failure,

507
00:20:30,780 --> 00:20:32,336
which is why we love this stuff.

508
00:20:32,336 --> 00:20:35,190
So you have these hackers
who are hacking hardware,

509
00:20:35,190 --> 00:20:36,023
hacking software,

510
00:20:36,023 --> 00:20:38,220
and making their own algorithms
and to do this stuff,

511
00:20:38,220 --> 00:20:41,100
they need to rely entirely
on jailbroken hardware

512
00:20:41,100 --> 00:20:42,690
so they can affect these changes.

513
00:20:42,690 --> 00:20:44,520
So I'll bring it back to you guys.

514
00:20:44,520 --> 00:20:45,480
- Yeah, I mean

515
00:20:45,480 --> 00:20:48,420
a question that we very commonly
get is this sounds awesome,

516
00:20:48,420 --> 00:20:50,250
why aren't more doctors

517
00:20:50,250 --> 00:20:51,930
recommending these
systems to their patients,

518
00:20:51,930 --> 00:20:52,763
why aren't more patients

519
00:20:52,763 --> 00:20:54,570
coming and asking for this type of care?

520
00:20:54,570 --> 00:20:56,370
And we just wanna kind
of hit a little bit on

521
00:20:56,370 --> 00:20:58,290
some of the reasons why we
need to do some more work.

522
00:20:58,290 --> 00:21:00,300
So the first is education.

523
00:21:00,300 --> 00:21:02,280
Again, these were not
tools and technologies

524
00:21:02,280 --> 00:21:04,530
that existed even 10 years
ago when we were training,

525
00:21:04,530 --> 00:21:05,670
let alone the endocrinologists

526
00:21:05,670 --> 00:21:08,040
who's been out in practice for 30 years.

527
00:21:08,040 --> 00:21:10,170
And even as widely adopted

528
00:21:10,170 --> 00:21:11,850
as these are in the hacker community,

529
00:21:11,850 --> 00:21:14,250
I think Loop, which is one
of the biggest platforms

530
00:21:14,250 --> 00:21:16,020
has about 9,000 people using it,

531
00:21:16,020 --> 00:21:18,480
and there are 1.9 million
type one diabetics.

532
00:21:18,480 --> 00:21:19,740
So we really have a lot of work to do

533
00:21:19,740 --> 00:21:21,990
to sort raise awareness there.

534
00:21:21,990 --> 00:21:23,880
Doctors who learn about this

535
00:21:23,880 --> 00:21:24,713
are going to just

536
00:21:24,713 --> 00:21:27,720
inherently worry about its
clinical efficacy and safety.

537
00:21:27,720 --> 00:21:30,090
And put aside the fact
that we give diabetics

538
00:21:30,090 --> 00:21:31,590
a vile of a 100 units of insulin,

539
00:21:31,590 --> 00:21:32,970
tell 'em to go figure it out on their own,

540
00:21:32,970 --> 00:21:35,550
but people are gonna say,
"Oh, can't they screw it up

541
00:21:35,550 --> 00:21:37,290
if they set this up themselves?"

542
00:21:37,290 --> 00:21:38,760
and we're starting to just now

543
00:21:38,760 --> 00:21:40,290
get some really interesting data

544
00:21:40,290 --> 00:21:43,890
to support the efficacy of these
different types of devices.

545
00:21:43,890 --> 00:21:45,990
There's a really interesting
paper published last year

546
00:21:45,990 --> 00:21:48,288
by some folks at Stanford
and Loop in Miami,

547
00:21:48,288 --> 00:21:50,880
that was really unique in its design

548
00:21:50,880 --> 00:21:52,560
and kind of demonstrated the promise

549
00:21:52,560 --> 00:21:54,390
of decentralized clinical trials.

550
00:21:54,390 --> 00:21:55,560
They basically just found people

551
00:21:55,560 --> 00:21:56,610
who are signing up for Loop.

552
00:21:56,610 --> 00:21:59,340
so Loop is one of the
systems and they said,

553
00:21:59,340 --> 00:22:00,960
hey, we're just gonna
pull some data from you

554
00:22:00,960 --> 00:22:02,704
if that's okay with you,
give us your baseline data,

555
00:22:02,704 --> 00:22:04,650
we're gonna see how you do
over the next six months,

556
00:22:04,650 --> 00:22:06,840
but we're not gonna tell
you how to use this tech.

557
00:22:06,840 --> 00:22:08,910
And all of the patients
who were in this study

558
00:22:08,910 --> 00:22:10,710
had to work with the community,

559
00:22:10,710 --> 00:22:12,310
troubleshoot guidelines on their own.

560
00:22:12,310 --> 00:22:15,787
So it was really not a very
paternalistic platform to say,

561
00:22:15,787 --> 00:22:17,700
"You need to follow
this protocol exactly",

562
00:22:17,700 --> 00:22:19,028
but the results were pretty incredible.

563
00:22:19,028 --> 00:22:21,956
Patients after using
this closed Loop system

564
00:22:21,956 --> 00:22:24,150
were able to spend longer time

565
00:22:24,150 --> 00:22:25,740
in a normal blood sugar range.

566
00:22:25,740 --> 00:22:27,180
They were able to avoid,

567
00:22:27,180 --> 00:22:29,370
release significant low
blood sugar episodes,

568
00:22:29,370 --> 00:22:30,450
and there were no episodes

569
00:22:30,450 --> 00:22:33,030
of sort of the more
feared complication DKA.

570
00:22:33,030 --> 00:22:34,816
So really impressive technology

571
00:22:34,816 --> 00:22:37,410
that we're starting to see is efficacious

572
00:22:37,410 --> 00:22:39,570
and is pretty low risk
that people can use.

573
00:22:39,570 --> 00:22:40,830
One thing I do want to kind of comment

574
00:22:40,830 --> 00:22:41,663
on some of these studies

575
00:22:41,663 --> 00:22:42,930
and in the population in general

576
00:22:42,930 --> 00:22:44,310
is that it does sort of

577
00:22:44,310 --> 00:22:45,960
trend to reflect some of the inequities

578
00:22:45,960 --> 00:22:47,550
that we previously discussed.

579
00:22:47,550 --> 00:22:49,860
So the 500 or so patients in this study,

580
00:22:49,860 --> 00:22:51,690
90% of them were white,

581
00:22:51,690 --> 00:22:54,360
85% of them were college
educated or higher,

582
00:22:54,360 --> 00:22:56,880
70% of them made more
than a $100,000 a year

583
00:22:56,880 --> 00:22:59,040
and 95% had private insurance.

584
00:22:59,040 --> 00:23:00,540
So there's work for us as we continue

585
00:23:00,540 --> 00:23:02,100
to push some of these
open source platforms

586
00:23:02,100 --> 00:23:05,820
to make sure that the inequity
that pervades modern medicine

587
00:23:05,820 --> 00:23:09,690
and formal clinical trials
doesn't persist in these spaces.

588
00:23:09,690 --> 00:23:11,520
Lastly, we'll just talk
really quickly about

589
00:23:11,520 --> 00:23:12,510
this idea of risk.

590
00:23:12,510 --> 00:23:14,130
So in order to give
something to a patient,

591
00:23:14,130 --> 00:23:15,480
you need to have a discussion with them

592
00:23:15,480 --> 00:23:16,860
what's called informed consent.

593
00:23:16,860 --> 00:23:18,690
We talk about the risk, we
talk about the benefits,

594
00:23:18,690 --> 00:23:20,340
we make sure that you understand those.

595
00:23:20,340 --> 00:23:21,450
Claudia and I are working on

596
00:23:21,450 --> 00:23:23,820
developing this concept of
a cyber informed consent

597
00:23:23,820 --> 00:23:25,230
that we'd be happy to
talk about with people

598
00:23:25,230 --> 00:23:26,220
if they're interested.

599
00:23:26,220 --> 00:23:27,053
But if your doctor

600
00:23:27,053 --> 00:23:29,250
is gonna be giving you these
connected technologies,

601
00:23:29,250 --> 00:23:30,570
we'd like to think that
they should be able

602
00:23:30,570 --> 00:23:32,760
to have that kind of discussion
about the potential risks.

603
00:23:32,760 --> 00:23:33,810
And there are risks

604
00:23:33,810 --> 00:23:37,170
that arise from the connected
nature of the techniques.

605
00:23:37,170 --> 00:23:39,240
- Yeah, just someone to just
quickly pull the audience here,

606
00:23:39,240 --> 00:23:42,390
like who here has had gone into a hospital

607
00:23:42,390 --> 00:23:44,280
and had a procedure done and a doctor

608
00:23:44,280 --> 00:23:45,360
or someone else has gone to them

609
00:23:45,360 --> 00:23:46,440
and talked to them about the risk?

610
00:23:46,440 --> 00:23:48,330
Like, okay, you might have an infection

611
00:23:48,330 --> 00:23:50,670
or you lose blood or anything
like that, raise your hand.

612
00:23:50,670 --> 00:23:51,503
Okay.

613
00:23:51,503 --> 00:23:53,430
How many people have out
there have ever had someone

614
00:23:53,430 --> 00:23:55,050
talk to them about the risks,

615
00:23:55,050 --> 00:23:58,350
their privacy or security
of connected medical devices

616
00:23:58,350 --> 00:23:59,183
when they get them?

617
00:23:59,183 --> 00:24:00,600
Anyone?

618
00:24:00,600 --> 00:24:03,390
Yeah, that's a problem, right.

619
00:24:03,390 --> 00:24:06,540
But it's a problem in so
many really interesting ways.

620
00:24:06,540 --> 00:24:07,560
First of all, it's a problem

621
00:24:07,560 --> 00:24:10,590
because it's not the right
thing that should happen.

622
00:24:10,590 --> 00:24:13,560
We should be informed of these things too.

623
00:24:13,560 --> 00:24:15,465
Often you do not have a choice,

624
00:24:15,465 --> 00:24:18,570
right, what dictates
what insulin pump you get

625
00:24:18,570 --> 00:24:19,770
when you're a diabetic,

626
00:24:19,770 --> 00:24:21,660
isn't necessarily a free market thing

627
00:24:21,660 --> 00:24:23,580
where you can go and decide
and look along all of them

628
00:24:23,580 --> 00:24:24,690
and say, "This is the one I want"

629
00:24:24,690 --> 00:24:27,180
because it's the one that
protects my privacy the most,

630
00:24:27,180 --> 00:24:29,130
or it's the one that has the
greatest hardware features.

631
00:24:29,130 --> 00:24:30,988
You don't have those choices

632
00:24:30,988 --> 00:24:32,940
in our modern healthcare system.

633
00:24:32,940 --> 00:24:35,130
It's an insurance thing.

634
00:24:35,130 --> 00:24:36,720
And the last thing I would say

635
00:24:36,720 --> 00:24:38,160
about cyber security informants

636
00:24:38,160 --> 00:24:41,580
that I know cyber got
I, this isn't whiskey,

637
00:24:41,580 --> 00:24:44,970
but I'm not supposed
to say that at DEFCON.

638
00:24:44,970 --> 00:24:46,740
But the other interesting thing

639
00:24:46,740 --> 00:24:49,770
is that the people telling
you about the risks

640
00:24:49,770 --> 00:24:52,680
have no idea what the hell
they're talking about.

641
00:24:52,680 --> 00:24:54,030
Like how many of your doctors

642
00:24:54,030 --> 00:24:58,920
could even articulate basic
security and privacy concepts?

643
00:24:58,920 --> 00:25:01,020
So the people tasked with asking you

644
00:25:01,020 --> 00:25:04,320
to consent to this don't
themselves understand it,

645
00:25:04,320 --> 00:25:05,760
don't talk to you about it,

646
00:25:05,760 --> 00:25:07,830
and there are structural reasons

647
00:25:07,830 --> 00:25:09,870
why that's a really hard nut to crack.

648
00:25:09,870 --> 00:25:13,830
And so if changing that
requires education, awareness

649
00:25:13,830 --> 00:25:15,130
and a lot of other things.

650
00:25:16,050 --> 00:25:20,130
We're gonna also talk about
the elephant in the room now,

651
00:25:20,130 --> 00:25:25,130
which is a lot of the features
that the Looper community

652
00:25:25,620 --> 00:25:28,380
was able to accomplish
with this technology

653
00:25:28,380 --> 00:25:32,733
were because the devices
themselves were vulnerable.

654
00:25:33,840 --> 00:25:35,670
That is an interesting prospect.

655
00:25:35,670 --> 00:25:37,530
And I have a hypothesis here,

656
00:25:37,530 --> 00:25:39,690
I want to just do a
little thought experiment

657
00:25:39,690 --> 00:25:40,523
in the audience

658
00:25:40,523 --> 00:25:43,500
because I think this is
a unique composition.

659
00:25:43,500 --> 00:25:48,500
Who here would wear a
vulnerable insulin pump,

660
00:25:48,690 --> 00:25:50,640
infusing insulin into their body,

661
00:25:50,640 --> 00:25:54,420
it has Bluetooth connectivity
with no authentication

662
00:25:54,420 --> 00:25:55,920
that you can change the settings off

663
00:25:55,920 --> 00:25:56,850
just by connecting to it,

664
00:25:56,850 --> 00:25:59,250
who here would wear that device

665
00:25:59,250 --> 00:26:01,530
and rely on it to take care
of them every single day?

666
00:26:01,530 --> 00:26:03,147
Please raise your hand wide.

667
00:26:03,147 --> 00:26:04,413
Yeah.

668
00:26:04,413 --> 00:26:05,712
I'm sorry.

669
00:26:05,712 --> 00:26:06,545
- If it allowed you.

670
00:26:06,545 --> 00:26:09,090
- If it allowed you to do
those feature sets, forgive me,

671
00:26:09,090 --> 00:26:10,410
I put a little caveat on it.

672
00:26:10,410 --> 00:26:12,600
You can wear this device, it's vulnerable,

673
00:26:12,600 --> 00:26:14,610
but it allows you to have
all those cool features

674
00:26:14,610 --> 00:26:16,860
that the Looper community has made.

675
00:26:16,860 --> 00:26:18,372
Please raise your hand.

676
00:26:18,372 --> 00:26:19,658
- [Woman In Audience] I have a question.

677
00:26:19,658 --> 00:26:20,575
- Question.

678
00:26:22,366 --> 00:26:26,404
- [Woman In Audience] I
guess, is there research to

679
00:26:26,404 --> 00:26:28,900
sort of securing it from
an outside perspective?

680
00:26:28,900 --> 00:26:30,180
- Yeah, so there's a question about,

681
00:26:30,180 --> 00:26:32,580
is there a way to secure it
and have all the feature sets?

682
00:26:32,580 --> 00:26:33,540
We're gonna get to that in a minute,

683
00:26:33,540 --> 00:26:35,610
but the question to the audience is

684
00:26:35,610 --> 00:26:37,440
who would wear a vulnerable pump

685
00:26:37,440 --> 00:26:39,030
if it allow you to have
all these cool features

686
00:26:39,030 --> 00:26:40,110
that the Looper community is making?

687
00:26:40,110 --> 00:26:41,100
Raise your hand.

688
00:26:41,100 --> 00:26:43,440
Who here would never
wear a vulnerable pump

689
00:26:43,440 --> 00:26:46,080
that had no authentication?

690
00:26:46,080 --> 00:26:48,630
Well, so this is the elephant in the room,

691
00:26:48,630 --> 00:26:51,210
this is that the seeming conflict

692
00:26:51,210 --> 00:26:55,020
between the Looper community
and the security space.

693
00:26:55,020 --> 00:26:58,590
We've had multiple security
researchers over the years

694
00:26:58,590 --> 00:27:00,420
discuss real vulnerabilities

695
00:27:00,420 --> 00:27:01,800
in these connected medical devices

696
00:27:01,800 --> 00:27:04,800
that pose really scary safety risks,

697
00:27:04,800 --> 00:27:07,800
not just to your privacy,
but to your physiology,

698
00:27:07,800 --> 00:27:09,512
to your wellbeing.

699
00:27:09,512 --> 00:27:11,700
The FDA, in my opinion,

700
00:27:11,700 --> 00:27:14,670
has done a fantastic job
over the last 10 years

701
00:27:14,670 --> 00:27:16,620
of pushing device manufacturers

702
00:27:16,620 --> 00:27:19,200
through the right thing about security.

703
00:27:19,200 --> 00:27:20,820
They've done the postmarket guidance,

704
00:27:20,820 --> 00:27:23,467
they have a pre-market
guidance document that says,

705
00:27:23,467 --> 00:27:26,400
"If you wanted market a
device in the United States,

706
00:27:26,400 --> 00:27:29,250
you have to be this tall
on the security side,

707
00:27:29,250 --> 00:27:31,380
you have to do these basic practices."

708
00:27:31,380 --> 00:27:32,730
And I will say this,

709
00:27:32,730 --> 00:27:36,171
the FDA also is the first to the podium

710
00:27:36,171 --> 00:27:39,390
to defend security researchers

711
00:27:39,390 --> 00:27:43,500
when device manufacturers
try to take a shit on them.

712
00:27:43,500 --> 00:27:47,520
When device manufacturers
tried to intimidate

713
00:27:47,520 --> 00:27:49,920
and or do less than desirable things

714
00:27:49,920 --> 00:27:51,003
for security researchers,

715
00:27:51,003 --> 00:27:53,820
the FDA is at the podium
defending this work.

716
00:27:53,820 --> 00:27:58,820
So, but they're tasked with
the safety of medical devices.

717
00:27:58,897 --> 00:28:00,420
And so if there's an issue,

718
00:28:00,420 --> 00:28:03,814
if there's a vulnerability
in a medical device,

719
00:28:03,814 --> 00:28:06,153
they might issue a recall.

720
00:28:07,200 --> 00:28:08,730
Then those devices

721
00:28:08,730 --> 00:28:13,080
are no longer going to be
in the community for loopers

722
00:28:13,080 --> 00:28:14,463
to innovate on.

723
00:28:15,462 --> 00:28:18,000
This is the seeming conflict.

724
00:28:18,000 --> 00:28:22,140
And one of the points of
this talk was to try to say,

725
00:28:22,140 --> 00:28:25,473
we want our cake and
we want to eat it too.

726
00:28:26,340 --> 00:28:27,240
What we should be doing

727
00:28:27,240 --> 00:28:29,940
instead of fighting
between a looper community

728
00:28:29,940 --> 00:28:31,804
against the FDA is instead

729
00:28:31,804 --> 00:28:36,804
using this as an example
of a market failure

730
00:28:37,895 --> 00:28:42,895
that consumers, patients,
parents of type one diabetics

731
00:28:43,350 --> 00:28:45,660
want access to the data.

732
00:28:45,660 --> 00:28:48,750
They want better control
over the technology

733
00:28:48,750 --> 00:28:50,310
that keeps them alive.

734
00:28:50,310 --> 00:28:53,133
And that's something that
they demand and they deserve.

735
00:28:54,098 --> 00:28:57,270
At the same time, we want
secure medical devices

736
00:28:57,270 --> 00:28:59,403
that don't have hard coded passwords.

737
00:29:00,420 --> 00:29:01,710
What we should be doing is

738
00:29:01,710 --> 00:29:03,570
pushing device manufacturers
do the right thing.

739
00:29:03,570 --> 00:29:07,320
And what we also don't wanna
do in this dystopian future

740
00:29:07,320 --> 00:29:11,040
is allow for documents like
the pre-market guidance,

741
00:29:11,040 --> 00:29:13,710
recommendations that
devices should be secure

742
00:29:13,710 --> 00:29:17,790
to be a reason medical
device manufacturer's site,

743
00:29:17,790 --> 00:29:18,960
as to why they can't be open.

744
00:29:18,960 --> 00:29:21,630
Why you can't have access
to your own damn data,

745
00:29:21,630 --> 00:29:22,463
because they'll say,

746
00:29:22,463 --> 00:29:24,270
"Oh, we can't expand the attack surface."

747
00:29:24,270 --> 00:29:27,187
Why don't we just challenge
that paradigm and say,

748
00:29:27,187 --> 00:29:30,312
"Why don't you deploy better
secure development practices?",

749
00:29:30,312 --> 00:29:35,130
retool your security
infrastructure to be both open,

750
00:29:35,130 --> 00:29:36,210
transparent,

751
00:29:36,210 --> 00:29:38,610
allowing for our patients
to have access to that data,

752
00:29:38,610 --> 00:29:40,860
and then far more defensible
from a security posture.

753
00:29:40,860 --> 00:29:44,220
Is that fair to say, is that
the best thing we could do?

754
00:29:44,220 --> 00:29:45,053
Yeah.

755
00:29:45,053 --> 00:29:46,260
Well, we need you to
out there telling people

756
00:29:46,260 --> 00:29:47,264
that it should happen.

757
00:29:47,264 --> 00:29:50,181
(crowd applauding)

758
00:29:51,300 --> 00:29:54,510
- So I wanna close this
out by talking about

759
00:29:54,510 --> 00:29:56,610
how this all interacts with cyber law

760
00:29:56,610 --> 00:30:00,180
and the stuff EFF does and competition.

761
00:30:00,180 --> 00:30:02,970
So med tech companies don't like

762
00:30:02,970 --> 00:30:05,850
that patients are jail
breaking their devices

763
00:30:05,850 --> 00:30:09,210
and they use laws like the
Digital Millennium Copyright Act

764
00:30:09,210 --> 00:30:11,040
to take down software

765
00:30:11,040 --> 00:30:13,320
that allows you to change your firmware.

766
00:30:13,320 --> 00:30:15,210
It might allow you to change your firmware

767
00:30:15,210 --> 00:30:16,350
to make it more vulnerable,

768
00:30:16,350 --> 00:30:18,390
it also might allow you
to change your firmware

769
00:30:18,390 --> 00:30:20,070
to make it more secure.

770
00:30:20,070 --> 00:30:22,620
So for example, Abbott Labs got GitHub

771
00:30:22,620 --> 00:30:24,090
to take down LibreLink,

772
00:30:24,090 --> 00:30:29,090
which was software for the
Libre 2 glucose monitor in 2019

773
00:30:29,610 --> 00:30:32,400
citing the Digital
Millennium Copyright Act.

774
00:30:32,400 --> 00:30:34,740
And they argue that this
was about patient safety,

775
00:30:34,740 --> 00:30:39,270
but a thing that is a common
motif in med tech research,

776
00:30:39,270 --> 00:30:41,190
especially around medical implants

777
00:30:41,190 --> 00:30:42,630
and especially around medical implants

778
00:30:42,630 --> 00:30:44,040
for people with diabetes

779
00:30:44,040 --> 00:30:47,880
is that firms do not
respond in a timely fashion

780
00:30:47,880 --> 00:30:49,260
or sometimes at all

781
00:30:49,260 --> 00:30:52,320
to really significant
vulnerability disclosures

782
00:30:52,320 --> 00:30:55,481
about their products when
they're not being used by loopers

783
00:30:55,481 --> 00:30:58,140
to give themselves a better
healthcare experience.

784
00:30:58,140 --> 00:31:03,000
So for example, in 2019,
a couple of hackers,

785
00:31:03,000 --> 00:31:05,490
Billy Rios and Jonathan Butts

786
00:31:05,490 --> 00:31:08,070
did a responsible disclosure to Medtronic

787
00:31:08,070 --> 00:31:10,080
to tell them that their
mini med paradigm pump

788
00:31:10,080 --> 00:31:11,640
was super vulnerable.

789
00:31:11,640 --> 00:31:14,160
And they sat on that bone for
two years, and then last year,

790
00:31:14,160 --> 00:31:17,866
a black hat, the researchers
who revealed the bone,

791
00:31:17,866 --> 00:31:20,040
released a proof of concept

792
00:31:20,040 --> 00:31:23,100
called "A universal remote
for killing people."

793
00:31:23,100 --> 00:31:25,830
and that's what actually got
Medtronic to take action.

794
00:31:25,830 --> 00:31:27,960
So this is a pattern
that's repeated across

795
00:31:27,960 --> 00:31:29,280
all the major hardware vendors,

796
00:31:29,280 --> 00:31:31,380
including companies like
Johnson and Johnson,

797
00:31:31,380 --> 00:31:33,030
this track record of foot dragging

798
00:31:33,030 --> 00:31:35,352
when there are issues that
are live threats to patients,

799
00:31:35,352 --> 00:31:37,068
but leaping to action

800
00:31:37,068 --> 00:31:39,757
when there's a live threat to profits.

801
00:31:39,757 --> 00:31:42,810
In the shareholder communications
that these firms make,

802
00:31:42,810 --> 00:31:44,640
they're pretty blatant
about what they want to do,

803
00:31:44,640 --> 00:31:48,090
they want to build closed
ecosystems for closed loops,

804
00:31:48,090 --> 00:31:50,970
where you have a single vendor
providing the algorithm,

805
00:31:50,970 --> 00:31:53,250
the glucose monitor, the pump.

806
00:31:53,250 --> 00:31:56,866
And sometimes they talk about
proprietary consumables,

807
00:31:56,866 --> 00:31:59,730
right, either proprietary formulations

808
00:31:59,730 --> 00:32:01,800
or proprietary packaging
for the formulations.

809
00:32:01,800 --> 00:32:04,200
Basically they want to turn
your artificial pancreas

810
00:32:04,200 --> 00:32:05,760
into an inkjet printer

811
00:32:05,760 --> 00:32:07,724
and use all the printer tactics

812
00:32:07,724 --> 00:32:12,060
that we have historically
seen in the printer world.

813
00:32:12,060 --> 00:32:14,820
And this has triggered an absolute inferno

814
00:32:14,820 --> 00:32:17,340
of mergers and acquisitions activity

815
00:32:17,340 --> 00:32:20,700
as private equity companies
see a lot of potential upside

816
00:32:20,700 --> 00:32:22,680
from building these closed ecosystems

817
00:32:22,680 --> 00:32:25,440
and the closed ecosystems beget
get more closed ecosystems.

818
00:32:25,440 --> 00:32:27,840
So there's a great
advocate for this stuff,

819
00:32:27,840 --> 00:32:29,670
a woman who calls herself
"The Savvy Diabetic",

820
00:32:29,670 --> 00:32:31,110
her name is Joanne Milo.

821
00:32:31,110 --> 00:32:33,212
And in June, she sent a letter to the FDA

822
00:32:33,212 --> 00:32:37,350
objecting to the merger of
a glucose monitor company

823
00:32:37,350 --> 00:32:40,920
called Dexcom, with a
pump company called inlet.

824
00:32:40,920 --> 00:32:44,640
And although this was
super anti-competitive,

825
00:32:44,640 --> 00:32:46,200
there's a reason Dexcom was doing it,

826
00:32:46,200 --> 00:32:47,760
which is that Medtronic

827
00:32:47,760 --> 00:32:51,960
had bought another insulin pump company

828
00:32:51,960 --> 00:32:53,190
and locked out Dexcom.

829
00:32:53,190 --> 00:32:55,920
They did that with a
company called Companion

830
00:32:55,920 --> 00:32:57,870
and in tandem had also blocked them.

831
00:32:57,870 --> 00:33:00,750
So here you have this company
that makes the glucose monitor

832
00:33:00,750 --> 00:33:02,550
and is watching all the insulin pumps

833
00:33:02,550 --> 00:33:04,920
get bought up by other
glucose monitor companies

834
00:33:04,920 --> 00:33:05,753
and locked down.

835
00:33:05,753 --> 00:33:07,680
So they're like, "We have to
have an insulin company too,

836
00:33:07,680 --> 00:33:10,830
we have to an insulin pump company too",

837
00:33:10,830 --> 00:33:12,930
but for all that, they're
the victim in this,

838
00:33:12,930 --> 00:33:14,280
they're also a terrible company

839
00:33:14,280 --> 00:33:16,500
with a long history of
threatening their patients

840
00:33:16,500 --> 00:33:17,940
when the patients take actions

841
00:33:17,940 --> 00:33:20,910
to try and come out
and extract their data.

842
00:33:20,910 --> 00:33:23,820
So none of these firms
have their patients backed

843
00:33:23,820 --> 00:33:25,020
all the time.

844
00:33:25,020 --> 00:33:28,350
And if we allow them to merge

845
00:33:28,350 --> 00:33:30,030
and create these closed ecosystems,

846
00:33:30,030 --> 00:33:31,800
it comes at the expensive patients

847
00:33:31,800 --> 00:33:34,260
who have idiosyncratic
problems with their health

848
00:33:34,260 --> 00:33:36,570
that they wanna resolve by
mixing and matching pumps

849
00:33:36,570 --> 00:33:40,290
and algorithms, consumables, and monitors.

850
00:33:40,290 --> 00:33:43,500
It also harms them in that it
makes the supply chain brittle

851
00:33:43,500 --> 00:33:46,650
because if your pump only
works with one glucose monitor

852
00:33:46,650 --> 00:33:48,600
and that glucose monitor can't be found

853
00:33:48,600 --> 00:33:50,340
because of a supply chain problem,

854
00:33:50,340 --> 00:33:52,050
then your whole pump breaks down.

855
00:33:52,050 --> 00:33:55,530
We saw what single sourcing
vendors did during the pandemic

856
00:33:55,530 --> 00:33:56,610
and after the pandemic

857
00:33:56,610 --> 00:33:59,370
with things like the
baby formula shortage.

858
00:33:59,370 --> 00:34:01,890
So it is true when these firms say

859
00:34:01,890 --> 00:34:04,740
patients might harm themselves
by modifying their devices.

860
00:34:04,740 --> 00:34:05,700
It is true,

861
00:34:05,700 --> 00:34:07,770
and it is true when they
security researchers

862
00:34:07,770 --> 00:34:09,307
or security staff say,

863
00:34:09,307 --> 00:34:10,890
"We are only locking these down

864
00:34:10,890 --> 00:34:13,260
because we want to help our patients."

865
00:34:13,260 --> 00:34:14,920
It's true that that's a thing that they do

866
00:34:14,920 --> 00:34:17,190
and it's something that comes up a lot

867
00:34:17,190 --> 00:34:20,550
when I speak at DEFCON
and in other hacker forums

868
00:34:20,550 --> 00:34:21,990
about competition more broadly,

869
00:34:21,990 --> 00:34:24,000
I work on the competition team at EFF,

870
00:34:24,000 --> 00:34:26,430
and we're talking about
dismantling big tech

871
00:34:26,430 --> 00:34:28,080
and letting smaller
firms enter the market.

872
00:34:28,080 --> 00:34:30,897
And oftentimes I'll speak
at an event like this

873
00:34:30,897 --> 00:34:33,600
and someone will come up
and say, "You have no idea

874
00:34:33,600 --> 00:34:35,460
the eye wateringly terrible stuff

875
00:34:35,460 --> 00:34:39,180
I block every day in my job at
Apple or Facebook or Google."

876
00:34:39,180 --> 00:34:40,920
And they're absolutely telling the truth.

877
00:34:40,920 --> 00:34:43,260
But the thing that they need to recognize,

878
00:34:43,260 --> 00:34:44,670
that we all need to recognize

879
00:34:44,670 --> 00:34:48,840
is your boss will pay you to
defend me from his enemies,

880
00:34:48,840 --> 00:34:49,673
your boss

881
00:34:49,673 --> 00:34:52,152
is never gonna pay you to
defend me from your boss.

882
00:34:52,152 --> 00:34:55,320
And this is why ultimately if
we're gonna have an arbiter

883
00:34:55,320 --> 00:34:57,870
that decides what mods are
safe and which ones aren't,

884
00:34:57,870 --> 00:34:59,785
it can't be the manufacturers.

885
00:34:59,785 --> 00:35:02,617
There's a role for the
FDA to show up and say,

886
00:35:02,617 --> 00:35:04,770
"No, don't do that, you'll kill yourself."

887
00:35:04,770 --> 00:35:07,020
But if we rely on the
manufacturers to do it,

888
00:35:07,020 --> 00:35:08,700
sometimes they'll be sincere,

889
00:35:08,700 --> 00:35:10,080
and sometimes they'll be
talking out of their ass,

890
00:35:10,080 --> 00:35:11,880
and what they really mean is don't do that

891
00:35:11,880 --> 00:35:13,860
or you're gonna spook our shareholders.

892
00:35:13,860 --> 00:35:16,230
And we shouldn't have to
figure out which one they mean,

893
00:35:16,230 --> 00:35:19,140
we should have access to a
democratically accountable system

894
00:35:19,140 --> 00:35:20,823
that tells us what the truth is.

895
00:35:22,530 --> 00:35:23,562
- Can we just clap on that.

896
00:35:23,562 --> 00:35:26,729
(audience applauding)

897
00:35:30,090 --> 00:35:33,180
- On that note, we have a
little less than 10 minutes,

898
00:35:33,180 --> 00:35:34,350
if anybody has any questions,

899
00:35:34,350 --> 00:35:36,000
we'd love to get a couple
of those outta the way,

900
00:35:36,000 --> 00:35:37,800
we've got a mic back there.

901
00:35:37,800 --> 00:35:40,500
Folks are able to get in line and yeah,

902
00:35:40,500 --> 00:35:42,000
thanks so much for coming out.

903
00:35:45,246 --> 00:35:47,220
- [Male Audience Member] You
talk about these acquisitions

904
00:35:47,220 --> 00:35:50,310
and why isn't the FTC
getting involved antitrust?

905
00:35:50,310 --> 00:35:51,270
- Yeah.

906
00:35:51,270 --> 00:35:52,103
You know what?

907
00:35:52,103 --> 00:35:53,400
I got good news for you about that,

908
00:35:53,400 --> 00:35:56,427
so the FTC for 40 years took a nap.

909
00:35:56,427 --> 00:36:00,150
The official doctrine on
antitrust enforcement in America

910
00:36:00,150 --> 00:36:01,410
and most of the world for 40 years

911
00:36:01,410 --> 00:36:03,540
has been something
called consumer welfare,

912
00:36:03,540 --> 00:36:06,270
which basically ignored
all monopoly problems

913
00:36:06,270 --> 00:36:07,770
and allowed for example, Microsoft

914
00:36:07,770 --> 00:36:10,320
to corner 95% of the OS market

915
00:36:10,320 --> 00:36:12,450
and lots and lots of mergers.

916
00:36:12,450 --> 00:36:14,040
Two companies make all
the beer in the world,

917
00:36:14,040 --> 00:36:15,570
there's one professional wrestling league,

918
00:36:15,570 --> 00:36:17,100
all the glasses are made by the company

919
00:36:17,100 --> 00:36:19,470
that makes all the frames
and owns all the retailers,

920
00:36:19,470 --> 00:36:20,303
it's terrible.

921
00:36:20,303 --> 00:36:23,340
But five years ago, a law
student named Lena Conn

922
00:36:23,340 --> 00:36:26,670
published an astoundingly
good Yale law review paper

923
00:36:26,670 --> 00:36:28,560
called "Amazon's Antitrust Paradox"

924
00:36:28,560 --> 00:36:32,010
that demolished the arguments
for antitrust forbearance,

925
00:36:32,010 --> 00:36:34,290
today that law student of five years ago

926
00:36:34,290 --> 00:36:36,054
is the chairwoman of the FTC.

927
00:36:36,054 --> 00:36:39,120
She has promulgated amazing new guidelines

928
00:36:39,120 --> 00:36:40,440
to block future mergers,

929
00:36:40,440 --> 00:36:42,939
and she's just announced
antitrust scrutiny

930
00:36:42,939 --> 00:36:45,300
of privacy practices by firms

931
00:36:45,300 --> 00:36:47,310
bypassing the deadlock in Congress

932
00:36:47,310 --> 00:36:49,290
and promising to regulate firms on privacy

933
00:36:49,290 --> 00:36:51,390
directly through the
administrative branch.

934
00:36:51,390 --> 00:36:53,430
She is a hero, she needs our support.

935
00:36:53,430 --> 00:36:56,250
There is a public listening
session on September the eighth

936
00:36:56,250 --> 00:36:58,860
that the FTC is holding on privacy.

937
00:36:58,860 --> 00:37:00,570
You can go and intervene.

938
00:37:00,570 --> 00:37:02,280
Your position as technologists

939
00:37:02,280 --> 00:37:03,390
is really gonna make a difference.

940
00:37:03,390 --> 00:37:07,170
We are in a moment in which we
have better news on antitrust

941
00:37:07,170 --> 00:37:09,360
than we have had since I was 10 years old,

942
00:37:09,360 --> 00:37:12,420
I cannot overstate how fucking great

943
00:37:12,420 --> 00:37:14,220
the antitrust picture is right now.

944
00:37:14,220 --> 00:37:15,766
It is amaze-balls.

945
00:37:15,766 --> 00:37:18,683
(crowd applauding)

946
00:37:22,944 --> 00:37:24,930
- [Male Audience Member Two]
I have a question about trust,

947
00:37:24,930 --> 00:37:28,170
as somebody who lives and
breathes, this is a BIPAP user.

948
00:37:28,170 --> 00:37:29,617
- Closer to the mic, please.

949
00:37:29,617 --> 00:37:32,498
- [Male Audience Member
Two] Hi, as a BIPAP user,

950
00:37:32,498 --> 00:37:35,610
what you've been describing as
sort of the dystopian future

951
00:37:35,610 --> 00:37:37,837
is already kind of reality for me,

952
00:37:37,837 --> 00:37:40,530
Phillips Respironics
has been killing people

953
00:37:40,530 --> 00:37:41,850
knowingly for years

954
00:37:41,850 --> 00:37:44,790
and took them three years to
actually recall their products.

955
00:37:44,790 --> 00:37:47,273
Similarly, ResMed, if you
don't pay them enough,

956
00:37:47,273 --> 00:37:48,690
they're not gonna tell you

957
00:37:48,690 --> 00:37:51,120
that you have changed oaks breathing,

958
00:37:51,120 --> 00:37:54,990
even though it's just a flip
that you need to do all that.

959
00:37:54,990 --> 00:37:56,490
How can we actually have trust

960
00:37:56,490 --> 00:37:58,443
in the medical institutions today?

961
00:37:59,682 --> 00:38:01,593
- That's a really good question.

962
00:38:03,150 --> 00:38:06,300
Sunshine is the best
disinfectant and Cory,

963
00:38:06,300 --> 00:38:10,830
I mean, why is this black
box proprietary aspect

964
00:38:10,830 --> 00:38:11,670
of some of these things

965
00:38:11,670 --> 00:38:13,470
seen as a competitive business practice?

966
00:38:13,470 --> 00:38:15,240
Why is there this or borrows between,

967
00:38:15,240 --> 00:38:18,120
oh, if we can't keep these
things secret, we can't innovate?

968
00:38:18,120 --> 00:38:20,910
- So I think the problem
is, again, an antitrust.

969
00:38:20,910 --> 00:38:23,340
I think that when you
have an industry dominated

970
00:38:23,340 --> 00:38:24,900
by like five firms,

971
00:38:24,900 --> 00:38:27,810
if they all settle on the
same convenient bullshit,

972
00:38:27,810 --> 00:38:30,030
if I told you about it,
I'd have to kill you.

973
00:38:30,030 --> 00:38:32,190
No one who's credible,

974
00:38:32,190 --> 00:38:34,590
which is to say no one who works
for a comparably sized firm

975
00:38:34,590 --> 00:38:37,290
steps up and says, "No, no,
no, wait, that's nonsense."

976
00:38:37,290 --> 00:38:40,440
We absolutely can share this
information with people.

977
00:38:40,440 --> 00:38:42,660
Not only that, but when
firms are very concentrated,

978
00:38:42,660 --> 00:38:44,292
they have a lot of money
to spend on lobbying.

979
00:38:44,292 --> 00:38:46,710
So the way I think that
you get good regulation

980
00:38:46,710 --> 00:38:47,910
is by making sure that firms

981
00:38:47,910 --> 00:38:50,673
are neither too big to
fail nor too big to jail.

982
00:38:50,673 --> 00:38:53,190
People looked at that
photo of Donald Trump

983
00:38:53,190 --> 00:38:54,960
at the top of Trump Tower

984
00:38:54,960 --> 00:38:56,970
with all the people who
run all the tech companies

985
00:38:56,970 --> 00:38:59,407
around a table in 2016 and said,

986
00:38:59,407 --> 00:39:00,330
"Isn't that terrible

987
00:39:00,330 --> 00:39:01,620
that they're meeting with Donald Trump?"

988
00:39:01,620 --> 00:39:03,480
And I'm like, you know
what's really terrible?

989
00:39:03,480 --> 00:39:06,420
That they fit around one goddamn table,

990
00:39:06,420 --> 00:39:07,950
because if they can fit around a table,

991
00:39:07,950 --> 00:39:09,300
they will sit around a table,

992
00:39:09,300 --> 00:39:10,350
and when they sit around the table,

993
00:39:10,350 --> 00:39:11,940
they're gonna figure out how to screw us.

994
00:39:11,940 --> 00:39:15,150
And so this is why as a
prerequisite, it's not enough,

995
00:39:15,150 --> 00:39:19,966
but it is an absolute
prerequisite for good regulation.

996
00:39:19,966 --> 00:39:22,410
Sectors have to be diverse

997
00:39:22,410 --> 00:39:24,420
with firms who will blow
the whistle on each other

998
00:39:24,420 --> 00:39:26,820
when they're telling
convenient commercial lies.

999
00:39:28,517 --> 00:39:31,684
(audience applauding)

1000
00:39:32,947 --> 00:39:33,930
- [Male Audience Member Three] So I saw

1001
00:39:33,930 --> 00:39:35,700
the five minute mark, so
I'll try and make this quick.

1002
00:39:35,700 --> 00:39:39,510
I have one of the
Abbott, Freedom or Libre,

1003
00:39:39,510 --> 00:39:41,580
whatever it's called.

1004
00:39:41,580 --> 00:39:43,770
It's gen one, it's NFC only.

1005
00:39:43,770 --> 00:39:46,620
And your question about,
would I trust this with,

1006
00:39:46,620 --> 00:39:48,600
I don't don't need insulin, thank God yet,

1007
00:39:48,600 --> 00:39:50,760
but there's a gen two with Bluetooth.

1008
00:39:50,760 --> 00:39:52,620
I'm not getting that.

1009
00:39:52,620 --> 00:39:55,680
So I have to upload my data to the cloud

1010
00:39:55,680 --> 00:39:58,380
as a necessity to inform my doctor.

1011
00:39:58,380 --> 00:40:01,170
Also, I had to advocate
myself to get this,

1012
00:40:01,170 --> 00:40:02,850
and then I was gonna pay outta pocket.

1013
00:40:02,850 --> 00:40:05,070
It just happens to be on my insurance.

1014
00:40:05,070 --> 00:40:07,320
So I'm very lucky, I'm very
privileged to have insurance.

1015
00:40:07,320 --> 00:40:11,790
So that's kind of where we're
I'm with diabetics in general.

1016
00:40:11,790 --> 00:40:13,428
Yeah.

1017
00:40:13,428 --> 00:40:14,850
I had another question,

1018
00:40:14,850 --> 00:40:15,683
but I don't think there's enough time,

1019
00:40:15,683 --> 00:40:16,950
so I'll let other people go.

1020
00:40:16,950 --> 00:40:17,783
- Thank you.

1021
00:40:17,783 --> 00:40:19,800
- I think that one of the
things all firmware can do

1022
00:40:19,800 --> 00:40:23,190
is let you disable the
Bluetooth on your device.

1023
00:40:23,190 --> 00:40:24,870
And that's one of the reasons

1024
00:40:24,870 --> 00:40:27,870
that we should support all firmware.

1025
00:40:27,870 --> 00:40:29,130
- Real quick addendum,

1026
00:40:29,130 --> 00:40:31,094
also, the other thing
that I could have done

1027
00:40:31,094 --> 00:40:33,030
with that hacked firmware

1028
00:40:33,030 --> 00:40:35,460
is not have to replace
this every two weeks.

1029
00:40:35,460 --> 00:40:36,293
- Right.

1030
00:40:38,164 --> 00:40:38,997
- [Male Audience Member
Three] I'm fortunate

1031
00:40:38,997 --> 00:40:42,000
that I have good health insurance.

1032
00:40:42,000 --> 00:40:47,000
However, my insurance dictates
what devices I can use.

1033
00:40:47,100 --> 00:40:49,740
So I'm wondering if you have any comments

1034
00:40:49,740 --> 00:40:53,640
on where the insurance
companies fit in all of this,

1035
00:40:53,640 --> 00:40:55,557
and if you follow the money,

1036
00:40:55,557 --> 00:40:57,150
there's quite a bit of money

1037
00:40:57,150 --> 00:41:00,170
in the medical insurance business.

1038
00:41:00,170 --> 00:41:03,420
- That's a really great
question and comment,

1039
00:41:03,420 --> 00:41:06,420
I mean, I'm sorry that
you're in the position

1040
00:41:06,420 --> 00:41:07,440
of so many other people,

1041
00:41:07,440 --> 00:41:09,600
which is you may wanna select a device

1042
00:41:09,600 --> 00:41:10,433
for a particular reason,

1043
00:41:10,433 --> 00:41:12,450
but you can't because of your insurance.

1044
00:41:12,450 --> 00:41:16,530
One of the interesting arguments
I've heard or opportunities

1045
00:41:16,530 --> 00:41:19,110
is to talk about how these devices

1046
00:41:19,110 --> 00:41:21,390
pose risks to some of those payers.

1047
00:41:21,390 --> 00:41:22,800
And what am I talking about?

1048
00:41:22,800 --> 00:41:24,540
Health insurance is gonna care

1049
00:41:24,540 --> 00:41:26,640
if they have to spend more money on you,

1050
00:41:26,640 --> 00:41:28,260
they also care how much the devices

1051
00:41:28,260 --> 00:41:31,020
are that they have to spend
to treat your illness.

1052
00:41:31,020 --> 00:41:35,250
And so if we can talk
about risks to privacy,

1053
00:41:35,250 --> 00:41:39,180
risks to security and what
the ultimate outcome of that

1054
00:41:39,180 --> 00:41:40,470
would be from their bottom line,

1055
00:41:40,470 --> 00:41:42,600
it may be a persuasive argument.

1056
00:41:42,600 --> 00:41:44,070
They also are very commonly

1057
00:41:44,070 --> 00:41:49,070
looking for reasons to try to save a buck.

1058
00:41:49,290 --> 00:41:52,110
And so as these things become
more and more connected,

1059
00:41:52,110 --> 00:41:54,870
as these devices and there are
more and more vulnerabilities

1060
00:41:54,870 --> 00:41:57,720
found in the wild, their
recalls can be quite costly.

1061
00:41:57,720 --> 00:42:01,260
That'll eventually hit insurance
company's bottom lines.

1062
00:42:01,260 --> 00:42:02,700
And I could see them in the future

1063
00:42:02,700 --> 00:42:04,537
doing a risk calculation to say,

1064
00:42:04,537 --> 00:42:08,430
"Well, this pump might cost
50 bucks more than this other,

1065
00:42:08,430 --> 00:42:10,909
but it's more durable, it's more secure,

1066
00:42:10,909 --> 00:42:12,810
we're having less headaches with this."

1067
00:42:12,810 --> 00:42:14,490
And so more and more as we can,

1068
00:42:14,490 --> 00:42:16,020
they themselves can realize that,

1069
00:42:16,020 --> 00:42:17,580
I think we'll move in a better direction,

1070
00:42:17,580 --> 00:42:20,739
but also you as a patient
should let them know,

1071
00:42:20,739 --> 00:42:23,070
that is really important.

1072
00:42:23,070 --> 00:42:26,910
Being a voice and advocate
for choice and of that choice,

1073
00:42:26,910 --> 00:42:30,090
privacy and security being
part of that is very persuasive

1074
00:42:30,090 --> 00:42:32,670
to the people that regulate
insurance companies as well.

1075
00:42:32,670 --> 00:42:35,940
And so it's gonna be a
long haul, keep going,

1076
00:42:35,940 --> 00:42:38,130
but raise your voice in that

1077
00:42:38,130 --> 00:42:40,020
so that we can change that dynamic.

1078
00:42:40,020 --> 00:42:42,660
And then also just try to advocate broadly

1079
00:42:42,660 --> 00:42:45,390
so that it isn't so stark a contrast

1080
00:42:45,390 --> 00:42:47,310
between device manufacturers.

1081
00:42:47,310 --> 00:42:50,790
Really, we wanna raise the
entire device ecosystem

1082
00:42:50,790 --> 00:42:52,352
into their security and privacy,

1083
00:42:52,352 --> 00:42:55,650
that would help all people
across all types of insurance.

1084
00:42:55,650 --> 00:42:57,990
- Yeah, we don't wanna
create a market where like

1085
00:42:57,990 --> 00:42:58,823
if you're lucky,

1086
00:42:58,823 --> 00:43:00,300
your insurance lets you
eat in the restaurant

1087
00:43:00,300 --> 00:43:01,680
where they're forced to wash their hands

1088
00:43:01,680 --> 00:43:03,570
after using the toilet,
but otherwise they don't.

1089
00:43:03,570 --> 00:43:05,190
We just wanna eliminate the restaurants

1090
00:43:05,190 --> 00:43:07,268
where they cook your food
without washing your hands,

1091
00:43:07,268 --> 00:43:08,940
without washing their hands.

1092
00:43:08,940 --> 00:43:10,560
Right, that's what we actually want.

1093
00:43:10,560 --> 00:43:13,560
We just wanna abolish the bad devices.

1094
00:43:13,560 --> 00:43:16,019
- What an advertising metaphor to end on.

1095
00:43:16,019 --> 00:43:18,720
We got 90 seconds before
we turn into a pumpkin

1096
00:43:18,720 --> 00:43:20,190
so I don't want someone
to ask a great question

1097
00:43:20,190 --> 00:43:21,023
that we can't answer.

1098
00:43:21,023 --> 00:43:22,800
So thank you guys so much for coming.

1099
00:43:22,800 --> 00:43:23,820
We're gonna head over here,

1100
00:43:23,820 --> 00:43:25,470
anybody in line who wants
to come and find us,

1101
00:43:25,470 --> 00:43:27,000
we'd be happy to talk outside.

1102
00:43:27,000 --> 00:43:29,460
Really appreciate everyone
coming, have a great con.

1103
00:43:29,460 --> 00:43:31,330
- I'll be at the EFF booth later as well.

1104
00:43:31,330 --> 00:43:33,348
(crowd applauding)