Saturday, first talk of the day, let's give them a great big DEF CON welcome. Come on!
Let's hear it! Yeah!
Alright. Hey, welcome everybody. We're really appreciative.
You know, I think it's wild just to think about how far DEF CON's come.
We're at DEF CON 30. How insane is that?
You look around, walking through the halls, there's marble, and this is just so interesting to see where we've come.
So I think it's worth a second to just look around, see who's there, see how much we've grown and appreciate that we have just begun to burn down all the shit that's wrong in this world and fix it with our hacker minds.
So guys, give yourself a round of applause. That is important, and you being here is part of that, and we really appreciate that.
Thank you so much for being with us, especially at 10 a.m. on a Saturday, which in DEF CON time is like 3 in the morning in the real world.
So really appreciate it. My name is Jeff. My friends call me Replicant.
I'm a pediatrician and an anesthesiologist, and I do some security research about clinical medicine technology with this guy.
I'm Christian Demeth. Kawati is my handle. I am an emergency medicine physician and security researcher.
And I'm Cory Doctorow. I've worked with the Electronic Frontier Foundation for 20 years in different capacities. I'm currently the
special advisor. I write science fiction novels, and I'm on the computer science faculty
at the Open University and the library science faculty at the University of North Carolina.
So a little known fact. Kawati actually brought me to my first DEF CON, which I think was DEF CON 18 or 19, back when
we were baby medical students. And I was thinking the other day about what has happened in medicine since then.
I mean, it seems like the 10 plus years have gone by quickly, but in medicine that's a lifetime.
And there have been some incredible advances
in some of the ways we used our technology to treat patients that we can really
look at with two lenses. You know, a lens of promise for the future and the incredible achievements we can make, but also one, a peril of a
future in which we want to avoid
really significant concerns and tensions with privacy and autonomy.
And so just to kind of give you a little bit of a consideration for that.
You know, we have gene therapies now that treat
diseases that were fatal to children when I was in my pediatric residency, and that's incredible. That's incredible promise.
Looking at it the other way though, if you don't have insurance,
you got to pay half a million dollars a year to keep your your kid alive right
we're going to talk about artificial pancreas says incredible technology that
hackers have pioneered that can help to improve your diabetic control and really
increase your quality of life but we can see a future where some people may be
forced to use a black box that they don't fully understand that collects
data that they can access that depends on DRM shackled consumables that they
need in order to continue to have a function or a future in which
telemedicine is available to everybody and people can see a primary care
provider and they can use personalized medicine to customize treatments for
them you know you can see a flip side of that coin where private equity is buying
up your primary care provider and Amazon's acquiring your doctor's offices
and you're starting to get targeted ads based on the data they're mining from
you so really want to explore those tensions today as we talk and we
thought no better a person to help us talk about this then you know the
activist Corey
Corey doctor so we're gonna let Corey take it over for now give it up for Corey give it up
thank you all so I want to talk about a group of people who uh rely on Med Tech and also rely
on modifying Med Tech and some of the ways that their own safety has been weaponized against them
and some of the stuff that's come out that's made life better for people who rely on it so
I'm talking about people who use power wheelchairs which are a significant part of the 50 billion
dollar durable medical equipment market there's about three million
Americans who use powered wheelchairs uh it's the uh complex Rehab Tech area of of Medicare and
Medicare is pretty dysfunctional in this regard they very narrowly interpreted their mandate and
so if you use a power wheelchair and you rely on Medicare to provide it to you Medicare will only
give you an indoor powered wheelchair although many of us like to leave our homes uh and they
will also refuse to cover any preventative maintenance so this is a recipe for disaster you
know Medicare that's being used in ways that it's not supposed to be used and you can't perform
preventative maintenance on it um one problem of the way that Medicare procures these chairs is
that they go to lowest bitters and the way to generate a low bid is to have economies of scale
and so two private equity roll-ups a company called new motion and another company called
National seating and mobility have bought virtually all the other companies that make
powered wheelchairs so people who use power wheelchairs buy from one of those two companies
and private equity firms they have a common uh playbook which is to load up their acquisitions
with a lot of debt and then squeeze them to service that debt they pay themselves a special dividend on
acquisition and then to make to make good on that debt they then have to squeeze them one of the
areas they've squeezed is by cutting uh service and so parts are billed at very high prices and
it takes a very long time to get serviced so all of this was examined in detail in a report that
came from the public interest research group or perg stranded found that 93 of the power wheelchair
users they surveyed had had a need for service in the last year 62 of them had waited four weeks
for that service and 40 of the of them had waited seven or more weeks for service and then seven or
more yeah seven or more weeks sorry I thought that was months no seven or more weeks and you
have to understand that in some instances this meant not only that you couldn't leave your home
to your bed so it makes it very hard to be have a family life have a personal life do shopping
maintain your job and do all of these things so the question is why can't people who are literally
stuck in bed for seven weeks waiting for a part why can't they just fix their own chairs and
partly that's because the part stream itself has been starved by the duopoly so uh in in um uh
stranded perg uh collected stories from people who use power wheelchairs about their problems
getting parts
and service uh they found uh multiple people reporting that the six dollar inner tube that
their chair used cost three hundred dollars uh in in as a Medicare billed part and that it would
take six to eight weeks to procure so you would have a a flat for six to eight weeks while you
waited uh for your chair to get fixed uh there's a an instance of a twenty dollar power button that
literally turned on the chair that cost 500 and took four months but even where people can get
parts and they do they source them from eBay and they source them from Amazon and there's one great
story about a stability wheel that they were having trouble sourcing a couple and then their
son looked up and he was like that's just a skateboard wheel and show them how to buy like
that wheel with cool like orange glitter and whatever and they just replaced it right so
they can sometimes sometimes you can just fix your chair by going around this treating them
as damage and riding around them but sometimes you get blocked by digital rights management so
use digital rights management to restrict access to their management consoles that means that you
can't get diagnostic information out of them it also means that you can't make routine adjustments
so for example uh there's often a delay built into the steering mechanisms uh as you get more
proficient with your chair you might want to reduce that delay you can't do that on your own
also if you change the pressure on your tires for different terrain and you want to adjust the torque
and the motor that's also uh an alteration you need a security dongle for so the good news is
that Colorado in June passed the HB 22-1031 the consumer right to repair power wheelchairs act
uh which substantially fixes a lot of these things they did run up against a really important problem
though which is that removing DRM is a felony under federal law section 12-1 of the digital
Millennium Copyright Act provides for a five-year prison sentence and a 500 000 fine for providing a
tool to bypass DRM and so they couldn't authorize people who wanted to fix wheelchairs or who used
wheelchairs and wanted to fix wheelchairs they couldn't authorize them to make or or uh provision
each other with tools that would allow them to affect these repairs so instead they did an end
run around it and they ordered the wheelchair companies to just provide the tools that would
allow them to read out the diagnostics and so on this is a good solution but really it's not enough
and so I just want to finish by saying that Electronic Frontier Foundation we're representing
the NCA and and and finally to say that you know as I noted there's some like deep structural
problems that make it hard for people to use powered wheelchairs right they they there's the
duopoly there's Medicare only paying for indoor chairs and not supporting uh preventative maintenance
and better repair doesn't solve any of those problems but it does fix wheelchairs right and
that in itself is something worth doing and we can walk and chew gum we need to do both
that story how many of people out here were surprised
about that story have you guys experienced modern health care that raised your hand
uh raise your hand if you've been frustrated with the inefficiencies the lack of communication the
broken insurance system yeah okay we can all relate with that absolutely as clinicians
we relate with that and as patients ourselves we do we're going to transition a little bit
to another very strong theme in modern medicine which is just that we often
are unaware of how the tools we use actually function as a replicant take us away so uh my
day job I'm an anesthesiologist and I somewhat facetiously say that I hack people's brains so
I turn I turn you off and somebody pokes you with a hot knife and I turn you back on again
um if it's a neurosurgery we blow on it before we put it back in but um you know it's widely accepted
among our profession that it's it's it's less than ideal to wake up during surgery right and so one of
the things that helps us in addition to a couple other variables kind of keep track on how deep a
patient is under anesthesia it's called the biz monitor we've used it for about the last 20 years
it has been the topic of thousands of academic papers that really investigate how anesthetics
even work so something that we're all very familiar with and without getting too much in
the weeds this is a monitor the name biz is derived from how it works it takes the electrical
signals of the brain the EEG and it processes it to produce a unitless dimensionless number that
any you know patients nice and deep under anesthesia 80 they're about to wake up and sue you from
malpractice so um for a long time that name biz was derived because most people understood this
is something that looks at what's called the bispectral index which doesn't matter it's just
a way that you can analyze that EEG last year a really awesome doc at Harvard Christopher Connor
reverse engineered these previously proprietary algorithms this is a black box nobody's ever
really seen under the hood here he reversed those algorithms and showed that after
actually this device isn't isn't producing a bispectral index at all it's looking at a
completely different aspect of the EEG which is a little unusual because a lot of the research that
we've based and used this monitor to conduct has operated under this base assumption that
the manufacturer has never bothered to correct or operate and it's kind of a little bit unfortunate
because I think in situations like this when we're using these clinical devices without fully
understanding where they're getting their information how they're producing and how we
use it we miss opportunities to innovate we miss opportunities
to be able to use these devices in different situations or to say that they may be less than
ideal for a particular use context and I just don't really understand why we have to live in
a paradigm where these things are so locked down and proprietary and if this is a concern
for clinical devices that are relatively reliable that we've used for the last 20 years I'm even more
worried about this coming Tsunami of clinical AI ML algorithms you know if I had a doge coin for every
guy at a medical conference who said I've got this AI algorithm that's going to revolutionize the
way you practice medicine save you billions I'd have like four dollars so Corey like why should
we not lift our hands and welcome our new clinical AI overlords so I I mean I think that this is
probably an audience that is well up on all the different ways that ML can go very wrong we have
a whole village here at Defcon where you can see people giving ML all kind of hallucinations and
tricking it in lots of ways
deliberately and accidentally it sometimes has some weird failure modes and of course that's true
of people right you know people make mistakes people have biases and so on but there's one
thing about a number that's given to you by software that is I think more dangerous than
a number that's given to you by human which is the degree of trust we put into it that if you
take a process that would normally take someone a back and have them say wait a second that that
can't be right
and you have a computer emit that as a precise number instead of as a kind of squishy judgment
you can empiricism wash your your weird ideas and people go oh yeah and I guess algorithms can't be
racist there's no such thing as racist math you know to which I say meet my friend the phrenologist
he'd like to measure your skull with his calipers so you know I think that that when you combine the
already difficult situation in which people often defer to medical professionals about things that
uh that they are uniquely situated to describe because they're part of their subjective response
to their pathologies and then you add a computer in the mix that says no everything is fine it
becomes very hard to imagine how patients are going to be able to uh exert a ton bodily
autonomy and autonomy over their care and I did want to add about that awesome paper about the
bis monitor that this audience I think will appreciate the guy who reversed the bis monitor
one of the ways that he was able to do this is by building an emulator which turned out to be really
a core DSP in the bis monitor is a ti DSP that's used widely in video game systems so he could
use maim which is just great that's rad um so we've talked about algorithmic bias and empiricism
washing and how we're all kind of really aware that these algorithms can have bias unintentionally
sometimes just basically just solely based on the data that you put into it or the training set of
the individuals that comprise it but then it becomes even more concerning and you know a lot
of this talk is talking about dystopian Futures when you consider adversarial machine learning
and so if you're not familiar with that I mean many of you are think about ways in which an
intelligent adversary could attack machine learning algorithms to manipulate the outcome right they
could attack classifications they could attack training sets change what the ground truth is and
design an attack that manipulates the outcome of the algorithm that could be done in a variety of
really scary ways for a lot of really scary purposes if it's to manipulate you into buying
something you can see a financial motivation in the healthcare space you can imagine organizations
companies entities doing that as to compete with one another and make their particular AI algorithm
less effective for example there are even some papers out there that are quite concerning where
it's not necessarily the entire population
that may be impacted by adversarial machine learning but you can craft attacks that the
outcome of that only impacts a certain group of people uh terrifying implications there and one
of which that I'm going to have a little bit of a call to action this whole talk is kind of a call
to action but of the people in the world that are best suited to understand the perils of this and
be equipped to help defend the future of humanity in this I think hackers are probably right there
at the top right
so two things one continue the transparency that we've talked about these bis monitor as an example
about how we as hackers are generally in support of far more transparency especially with these
algorithms that touch every aspect of our life and then also that we possess a unique skill set
one that can understand how malicious adversaries you know I was just going to attack these uh we
how we can defend against them and how we can better secure the infrastructure that will then
hopefully with the promise of a lot of this technology potentially give us huge insights
into clinical care right improve treatments new medications that can completely um do away with
pathologies we never thought would be possible and so that kind of peril uh and promise we need
you out there to make sure that these things that would thwart that future that promising future
don't come to fruition so we're hopeful in that let's switch a little bit from the doom and gloom
that happens when hackers pwn themselves and are actually able to take the initiative and innovate
on some of those stuff yeah absolutely so as you probably know one in 10 Americans has diabetes 92
million Americans are pre-diabetic and diabetes while anyone can get it is is disproportionately
falls on uh on marginalized people it's a disease of poverty and so people who have diabetes are
structurally find it difficult to demand high quality care and to push back against abusive
practices by medtech
so in 2013 uh some people with diabetes decided to do something about this two hackers uh Dana
Lewis and John caustic took a continuous glucose monitor and figured out a way to hook it up
directly to a insulin pump and wrote an algorithm that monitored your blood sugar tried to predict
where it was going and tried to dose you with insulin as you went along and the closed Loop
pancreas artificial pancreas was born they call themselves loopers
and they gather on a platform called openaps.org a lot of the people who built these tools early
on were parents of young children so my friend sulca haro is a video game developer he worked
on a bunch of solarkey games in the old days his young son who was two years old at the time had
just been diagnosed with type 1 diabetes and was in daycare and the people who worked at the daycare
weren't experts in managing diabetes and so he wanted to be able to oversee partially automate
and correct and get alerts on his son's insulin levels blood sugar levels and so he became a core
developer on on the looping tools and you know there's a lot of hacker overlap with this looping
stuff and it's one of these great examples of hackers helping normies where the stuff that we
build for ourselves ends up sort of leaking out into the rest of the world and there's a reason
that hackers want to build looping software and it's not because they're too lazy to manage their
blood sugar it's because uh doing a routine task perfectly all the time is why we have computers
right there's there's a reason we replace all of our routine tasks as hackers with shell scripts
like do you remember when Unix systems used to ship without a pre-built Cron job that rotated
the log files and they would just crash every three days because no one could remember to rotate
log files and you know replacing the routine things in your life with a shell script is especially
important if when you screw it up it's hard for you to think right and if you screw up your blood
sugar it can impair your cognition so we lost a dear friend last year uh excuse me I always get
choked up at this point but Dan Kaminsky died last year he was uh he had diabetes uh he had
management problems with it he was in lockdown he was isolated other people couldn't see what
was going on and you can see how even someone as brilliant as our
Al Dan couldn't manage a routine task perfectly all the time and could experience a literally
fatal cascading failure which is why we love this stuff so you have these hackers who are
hacking hardware hacking software making their own algorithms and to do this stuff they need
to rely entirely on jailbroken heart hardware so they can affect these changes so I'll bring
it back to you guys yeah I mean a question that we very commonly get is this sounds awesome why
aren't more doctors recommending these systems to their patients why aren't
clinicians coming and asking for this type of care and we want to kind of hit a little bit on
some of the reasons why we need to do some more work so the first is education again these were
not tools and Technologies that existed even 10 years ago when we were training let alone the
endocrinologist who's been out in practice for 30 years right and even as widely adopted as these
are in the hacker community I think Loop which is one of the biggest uh platforms has about 9 000
people using it and there are 1.9 million type 1 diabetics so we really have a lot of work to do
doctors who learn about this are going to just inherently worry about its clinical efficacy and
safety you know and put aside the fact that we give diabetics a vial of 100 units of insulin
tell them to go figure it out on their own but people are going to say oh this you know can't
they screw it up if they set this up themselves and we're starting to just now get some really
interesting data to support the efficacy of these different types of devices there's a really
interesting paper published last year by some folks at Stanford and Loop in Miami that was
really unique in its design and kind of demonstrated the
effectiveness of decentralized clinical trials they basically just found people who are signing
up for Loop so Loop is one of the systems and they said hey we're just going to pull some data from
you if that's okay with you give us your baseline data we're going to see how you do over the next
six months but we're not going to tell you how to use this Tech all the patients who were in this
study had to you know work with the community troubleshoot guidelines on their own so it was
really not a very paternalistic platform to say you need to follow this protocol exactly but the
results were pretty incredible patients after using this closed-loop system
were able to spend longer time in a normal blood sugar range they were able to avoid really
significant low blood sugar episodes and there were no episodes of sort of the more feared
complication DKA so really impressive technology that we're starting to see is efficacious and is
pretty low risk that people can use one thing I do want to kind of comment on some of these
studies and the population in general is that it does sort of tend to reflect some of the
inequities that we previously discussed so the 500 or so patients in this study 90 of them were white
percent of them were college educated or higher 70 of them made more than a hundred thousand dollars
a year and 95 had private insurance so there's work for us as we continue to push some of these
open source platforms to make sure that the inequity that pervades modern medicine and
formal clinical trials doesn't persist in these spaces lastly we'll just talk really quickly about
this idea of risk so in order to give something to a patient you need to have a discussion with
them it's called informed consent we talk about the risk we talk about the benefits we make sure
that you understand those quality and I are working on developing this concept
of a cyber informed consent that we'd be happy to talk about with people if they're interested but
if your doctor is going to be giving you these connected Technologies we'd like to think that
they should be able to have that kind of discussion about the potential risks and there are risks that
arise from the connected nature of the techniques yeah someone just quickly pull the audience here
like who here has had gone into a hospital and had a procedure done and a doctor or someone else has
gone to them and talked to them about the risk okay you might have an infection or you lose
blood or anything like that raise your hand okay how many people have out there
ever had someone talk to them about the risks of their privacy or security of connected medical
devices when they get them anyone yeah that's a problem right but it's a problem in so many
really interesting ways uh first of all it's a problem because it's not the right thing that
should happen right we should be informed of these things too often you do not have a choice
right what dictates what insulin pump you get when you're a diabetic isn't necessarily a free market
guide and look along all of them and say this is the one I want because it's the one that protects
my privacy the most or it's the one that has the greatest hardware features you don't have those
choices uh in our modern health care system it's an insurance thing and the last thing I would say
about cyber security informants that I know cyber got I would help this isn't this isn't a whiskey
but I'm supposed to say that at Defcon but the other interesting thing is that the people telling
you about the risks have no idea what the hell they're talking about
like how many of your doctors could even articulate basic security and privacy concepts so people
tasked with asking you to consent to this don't themselves understand it don't talk to you about
it and there are structural reasons why it's a really hard nut to crack and so changing that
requires education awareness and a lot of other things we're going to also talk about the elephant
in the room now which is
a lot
of the features that the Looper Community was able to accomplish with this technology were because
the devices themselves were vulnerable that is an interesting Prospect and I I have a hypothesis
here I want to just do a little thought experiment in the audience because I think this is a unique
composition who here would wear a vulnerable insulin pump infusing insulin into their body it
has uh Bluetooth
connectivity with no authentication that you can change the settings off just by connecting to it
who here would wear that device and rely on it to take care of them every single day please raise
your hand wide hi yeah I'm sorry if it allowed you if it allowed you to do those feature sets
forgive me I put a little caveat on you you can wear this device it's vulnerable but it allows you
to have all those cool features that the Looper Community uh has made please raise your hand
question
foreign
yeah so there's a question about like is there a way to secure it and have all the feature sets
we're going to get to that in a minute but the question to the audience is who would wear a
vulnerable pump if it allow you to have all these cool features that the Looper Community
is making raise your hand who here would never wear a vulnerable pump that had no authentication
right well so this is the elephant in the room this is that the seeming conflict between the
looper community and the security space right we've had multiple security researchers over
the years discuss real vulnerabilities in these connected medical devices that pose
really scary safety risks not just your privacy but to your physiology to your well-being the fda
in my opinion has done a fantastic job over the last 10 years of pushing device manufacturers
through the right thing about security right they've done the post-market guidance they have
a pre-market guidance document that says if you want to market a device in the united states you
have to be this tall on this on the security side you have to do these basic practices
and i will say this the fda also is the first to the podium to defend security researchers
when device manufacturers try to take a on them right when device manufacturers tried to
intimidate and or do less than desirable things for security researchers
fda is at the podium defending this work so but they're tasked with the safety of medical devices
right and so if there's an issue if there's a vulnerability in a medical device they might
issue a recall then those devices are no longer going to be in the community for loopers to
innovate on right this is the seeming seeming conflict and one of the points of this talk was to
make sure that we're not trying to say we want our cake and we want to eat it too you know what
we should be doing instead of fighting between the looper community against the fda is instead
using this as a as an example of a market failure that consumers patients parents of type
one diabetics want access to the data they want better control over the technology that keeps them
alive and that's something that they demand and they deserve at the same time we want secure
medical devices that don't have hard-coded passwords what we should be doing is pushing
device manufacturers do the right thing and what we also don't want to do in this dystopian
future is allow for documents like the pre-market guidance recommendations that devices should be
secured to be a reason a medical device manufacturer's site as to why they can't be open
you can't have access to your own damn data because they'll say oh we can't expand the
attack surface why don't we just challenge that paradigm and say why don't you employ better
secure development practices you know retool your security infrastructure to be both open
transparent allowing for our patients to have access to that data and then far more
defensible from a security posture is that is that fair to say is that the best thing we could do
yeah well we need you to out there telling people that it should happen
so i want to close this out by by uh talking about how this all interacts with cyber law
and the stuff eff does and competition so medtech companies don't like that patients
are jailbreaking their devices and they use laws like the digital millennium copyright act
to take down software that allows you to change your firmware it might allow you to change your
firmware to make it more vulnerable it also might allow you to change your firmware to make it more
secure so for example abbott labs got github to take down librelink which was uh software for
the libra 2 glucose monitor in 2019 citing the digital millennium copyright act and
they argued that this was about patient safety but a thing that is a common motif in medtech
research especially around medical implants and especially around medical implants for people
with diabetes is that firms do not respond in a timely fashion or sometimes at all
to really significant vulnerability disclosures
about their products when they're not being used by loopers
to give themselves a better healthcare experience.
So for example, in 2019, a couple of hackers,
Billy Rios and Jonathan Butts,
did a responsible disclosure to Medtronic
to tell them that their MiniMed paradigm pump
was super vulnerable.
And they sat on that vuln for two years,
and then last year at Black Hat,
the researchers who revealed the vuln
released a proof of concept
called a universal remote for killing people,
and that's what actually got Medtronic to take action.
So this is a pattern that's repeated
across all the major hardware vendors,
including companies like Johnson & Johnson,
this track record of foot dragging
when there are issues that are live threats to patients,
but leaping to action when there's a live threat to profits.
In the shareholder communications that these firms make,
they're pretty blatant about what they want to do.
They want to build closed ecosystems for closed loops.
Where you have a single vendor providing the algorithm,
the glucose monitor, the pump,
and sometimes they talk about proprietary consumables.
Right, either proprietary formulations
or proprietary packaging for the formulations.
Basically, they want to turn your artificial pancreas
into an inkjet printer,
and use all the printer tactics
that we have historically seen in the printer world.
And this has triggered an absolute inferno
of mergers and acquisitions activity,
especially in the market.
Because private equity companies see a lot of potential upside
from building these closed ecosystems.
And the closed ecosystems beget more closed ecosystems.
So there's a great advocate for this stuff,
a woman who calls herself the Savvy Diabetic.
Her name is Joanne Milo.
And in June, she sent a letter to the FDA
objecting to the merger of a glucose monitor
company called Dexcom with a pump company called Insulet.
And although this was super anti-competitive,
there's a reason Dexcom was doing it,
which is that Medtronic,
had bought another insulin pump company
and locked out Dexcom.
They did that with a company called Companion.
And Tandem had also blocked them.
So here you have this company that makes the glucose monitor
and is watching all the insulin pumps get bought up
by other glucose monitor companies and locked down.
So they're like, we have to have an insulin pump company too.
But for all that they're the victim in this,
they're also a terrible company
with a long history of threatening their patients
when the patients take them.
They're the ones that take actions to try and come out
and extract their data.
So none of these firms have their patients back all the time.
And if we allow them to merge and create
these closed ecosystems, it comes
at the expense of patients who have idiosyncratic problems
with their health that they want to resolve by mixing
and matching pumps and algorithms, consumables,
and monitors.
It also harms them in that it makes the supply chain brittle.
Because if your pump only works with one glucose monitor,
and that glucose monitor can't be found because of a supply chain
problem, then your whole pump breaks down.
We saw what single sourcing vendors did during the pandemic
and after the pandemic with things like the baby formula
shortage.
So it is true when these firms say patients might harm
themselves by modifying their devices.
It is true.
And it is true when their security researchers
or security staff say, we are only locking these down
because we want to help our patients.
It's true that that's a thing that they do.
And it's something that comes up a lot when I speak at DEF CON
and in other hacker forums about competition more broadly.
I work on the competition team at EFF.
And we're talking about dismantling big tech
and letting smaller firms enter the market.
And oftentimes, I'll speak at an event like this,
and someone will come up and say, you have no idea
the eye-wateringly terrible stuff I block every day
in my job at Apple or Facebook or Google.
And they're absolutely telling the truth.
But the thing that they need to recognize,
that we all need to recognize, is that they need to recognize,
is your boss will pay you to defend me from his enemies.
Your boss is never going to pay you to defend me from your boss.
And this is why, ultimately, if we're
going to have an arbiter that decides what mods are safe
and which ones aren't, it can't be the manufacturers.
There's a role for the FDA to show up and say, no,
don't do that, you'll kill yourself.
But if we rely on the manufacturers to do it,
sometimes they'll be sincere, and sometimes they'll
be talking out of their ass.
And what they really mean is, don't do that
or you're going to spook our shareholders.
We have to figure out which one they mean.
We should have access to a democratically accountable
system that tells us what the truth is.
Can we just clap on that?
On that note, we have a little less than 10 minutes.
If anybody has any questions, we'd
love to get a couple of those out of the way.
We've got a mic back there if folks are able to get in line.
And yeah, thanks so much for coming out.
You talk about these acquisitions.
And why isn't the FTC getting involved in antitrust?
Yeah, you know what?
I've got good news for you about that.
So the FTC for 40 years took a nap.
The official doctrine on antitrust enforcement
in America and most of the world for 40 years
has been something called consumer welfare, which
basically ignored all monopoly problems
and allowed, for example, Microsoft to corner 95%
of the US market and lots and lots of mergers.
Two companies make all the beer in the world.
There's one professional wrestling league.
All the glasses are made by the company
that makes all the frames and owns all the retailers.
It's terrible.
But five years ago, a law student named Lena Kahn
published an astoundingly good Yale Law Review paper
called Amazon's Antitrust Paradox
that demolished the arguments for antitrust forbearance.
Today, that law student of five years ago
is the chairwoman of the FTC.
She has promulgated amazing new guidelines
to block future mergers.
And she's just announced antitrust scrutiny
on privacy practices by firms, bypassing the deadlock
in Congress and promising to regulate firms on privacy
directly through the administrative branch.
She is a hero.
She needs our support.
There is a public listening session on September the 8th
that the FTC is holding on privacy.
You can go and intervene.
Your position as technologists is really
going to make a difference.
We are in a moment in which we have better news on antitrust
than we have had since I was 10 years old.
I cannot overstate how fucking great the antitrust movement
is right now.
It is amazeballs.
.
.
.
.
.
.
.
.
.
.
.
.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
things seen as like a competitive business practice? Why is there this
orboros between, oh, if we can't keep these things secret, we can't innovate?
So I think the problem is, again, an antitrust. I think that when you have an
industry dominated by like five firms, if they all settle on the same convenient
bullshit, like if I told you about it, I'd have to kill you, no one who's
credible, which is to say no one who works for a comparably sized firm steps
up and says, no, no, no, wait, that's nonsense. We absolutely can share this
information with people. Not only that, but when firms are very concentrated,
they have a lot of money to spend on lobbying. So the way I think that you get
good regulation is by making sure that firms are neither too big to fail nor too
big to jail. You know, people looked at that photo of Donald Trump at the top of
Trump Tower with all the people who run all the tech companies around a table in
2016 and said, isn't that terrible that they're meeting with Donald Trump?
And I'm like, you know what's really terrible? That they fit around one goddamn
table, right? Because if they can't fit around a table, they will sit around
a table, and when they sit around the table, they're going to figure out how to
screw us. And so this is why as a prerequisite, it's not enough, but it is an
absolute prerequisite for good regulation. Firm sectors have to be diverse with
firms who will blow the whistle on each other when they're telling convenient
commercial lies.
I saw the five-minute mark, so I'll try to make this quick. I have one of the Abbott Freedom
or Libra, whatever the, oh, it's called. It's Gen 1. It's NFC only. And your question
about would I trust this with, I don't need insulin, thank God, yet. But there's a Gen
2 with Bluetooth? I'm not getting that. So I have to upload my data to the cloud as a
necessity to inform my doctor. Also, I had to advocate myself to get this. And then I
was going to pay out of pocket. It just happens to be on my insurance. So I'm very lucky.
I'm very privileged to have insurance. So that's kind of where...
We're at with diabetics in general. It's, yeah. That was my... I had another question,
but I don't think there's enough time, so I'll let other people go.
Thank you a lot.
I think that, you know, one of the things all firmware can do is let you disable the
Bluetooth on your device. And that's one of the things, one of the reasons that we
should support all firmware.
Real quick addendum. Also, the other thing that I could have done with that hacked
firmware is not have to replace this every two weeks.
Right.
I'm fortunate that I have good health insurance. However, my insurance dictates what
devices I can use. So I'm wondering if you have any comments on where the insurance
companies fit in all of this. And if you follow the money, there's quite a bit of money in
the medical insurance business.
That's a really great question and comment. And I mean, I'm sorry that you're in the
position of so many other people, which is you may want to...
select a device for a particular reason, but you can't because of your insurance.
You know, one of the interesting arguments I've heard or opportunities is to talk about
how these devices pose risks to some of those payers.
And what am I talking about?
Health insurance is going to care if they have to spend more money on you.
They also care how much the devices are that they have to spend to treat your illness.
And so if we can talk about risks to privacy, risks to security, and what the ultimate
outcome of that would be from their bottom line, it may be a persuasive argument.
They also are very commonly looking for reasons to try to save a buck.
And so as these things become more and more connected, as these devices and their more
and more vulnerabilities found in the wild, their recalls can be quite costly.
That will eventually hit insurance companies' bottom lines.
And I could see them in the future doing a risk calculation to say, well, this pump
might cost 50 bucks more than this other.
But it's more durable.
It's more secure.
We're having less headaches with this.
And so more and more as we can, they themselves can realize that, I think we'll move in a
better direction.
But also, you as a patient should let them know that that is really important.
Being a voice and advocate for choice and of that choice, privacy and security being
part of that is very persuasive to the people that regulate insurance companies as well.
And so my, it's going to be a long haul.
Keep going.
But raise your voice in that.
So that we can do it.
And change that dynamic.
And then also, just try to advocate broadly so that it isn't so stark a contrast between
device manufacturers.
Really, we want to raise the entire device ecosystem into their security and privacy.
That would help all people across all types of insurance.
Yeah.
We don't want to create a market where, like, if you're lucky, your insurance lets you eat
in the restaurant where they're forced to wash their hands after using the toilet.
But otherwise, they don't.
We just want to eliminate the restaurants where they cook your food without washing
your hands.
Without washing their hands, right?
That's what we actually want.
We just want to abolish the bad devices.
What an appetizing metaphor to end on.
We've got 90 seconds before we turn into a pumpkin.
So I don't want someone to ask a great question that we can't answer.
So thank you guys so much for coming.
We're going to head over here.
Anybody in line who wants to come and find us, we'd be happy to talk outside.
Really appreciate everyone coming.
Have a great con.
I'll be at the EFF booth later as well.