Schneier on Security

SixSixSix • October 31, 2014 12:59 AM

This debates overlooks the severe damage that the Robert’s Court of Supreme Corporate Interests did to medical device safety and security, and to hope for serious reform of medical devices. For all approved Class III devices no matter how incompetent the engineering nor how grossly negligent the manufacturing no America citizen has rights to sue in court – access has been slammed shut by the five Supreme corporate lawyers in black robes. Medical device manufacturers have zero liability once approved upon initial inspection by the FDA.

The legal system which might be hoped to restore balance or promote improvement has been 100% disabled for all patients in America, whether citizens or not come to think of it. That corrective mechanism is totally disabled. American Exceptionalism at its worst no doubt, but also the result of years of big money “tort reform”, more accurately tort deform. Except of course for the medical device corporations themselves. They can sue the hell out of each other for intellectual property infringement and still pretend constitutional law operates just like in the old days. They can even claim that your medical data is their proprietary information. Yes, wanting to know what happened inside of you can be a copy right infringement – a DCMA violation. Bet you thought only music hackers would a risk – nope so are you if you get too nosy about what about that device inside of you.

I had a St Jude Internal Cardiac Defibrillator (ICD) for nine hellish years until I had it remove because in the entire time of serious arrhythmia the only thing that nearly killed me was the device itself. The design was defective and unsafe in the presence of non-lethal arrhythmia. The FDA MAUDE Database has ample entries of death by ICD malfunction. The magnetic suppression feature for surgery and first responders used a Reid switch known to be unreliable in the continuous process control industry (the heart is a gloried pump, a biological one, but a pump nonetheless and an ICD is a low grade digital continuous process controller.) The manufacturing was grossly negligent. In the (bio) chemically active environment of the blood stream they put critical wiring inside of silicon coated cabling, something the industrial process control industry knows not to do. The basic engineering of the device was below far below the standards expected to operate a power plant or even your car for that matter (which has dozens and dozens of such devices). But control device manufactures who mess up a power plant or your car can be sued, especially if their devices cause injury and death.

Consider basic safety. It is a first principle of the controls industry to build fail fast/hard systems. If a device internally or another device monitoring it detects inconsistency indicative of failure the device should shut down rather to continue to send out what might be very dangerous control signals. Ideally a higher control layer should be informed that might be able to mitigate the situation, but failing components should shut down. Not in the St Jude ICD design world. When I requested that feature of the company they flat out refused. This despite making the worst lead ever on the market, one that wore out and then shorted out leading to uncontrolled shocks at 36 joules straight into the side wall of my heart. The Reid switch to inhibit the shocks also failed intermittently which isn’t all that surprising because those reports show up in the FDA MAUDE database as. Oh, so what St Jude management says, we made the financial targets to humor the hedge fund managers that quarter. We sure don’t want to get them irate, after all they have the right and money to sue us. No disabling access to the courts ever for the hedge fund managers.

We will skip over the terrorizing aspect of having technology in you running amuck with serious possibility of mortality; incidentally the shocks are also quite painful and run straight up vagus nerve into the brain where they act as unsolicited electro-shock therapies. Because the signals are out of phase, the shocks delivered have heighten probability of inducing the very fatal arrhythmia they were supposedly designed to mitigate. St Jude would rather kill you with shock after shock after shock than admit their device was failing. As a compromised I asked for a parameter to limit the number of shocks over a unit of time. Nope they were going to shock until death no matter what – especially if one their defectively designed and manufactured leads had made the senor signal into a channel of near pure noise. Truly these designer will bomb a village to save it and the Supreme Court of Injustice will reward them for it.

Now think how odd it is to be OK for a medical device to harm, terrify, get needlessly hijacked, or kill you. No consequence, even less than the Big Banks after 2008. Well, about the same actually. But if an automotive or aircraft manufacture does that or an industrial process control company blows up a chemical plant – big penalties. All of this pampering of medical device companies is justified in the name of “innovation”. But the medical device field shows one the very least rates of innovation among all electronics market segments, far behind other applications such as cell phones and even automobiles. If drones advanced at the rate of medical devices, we would just be getting to those new-fangled joy stick analog radio controlled model airplanes with “advanced” 1966 era Cox 0.49 engines. Ideological abuse of the law can have deadly consequences, but that is the current environment.

The implication for security is severe. There is no conceivable reason for medical device manufacturers to care about security. If they make it perfectly easy for hackers to control your device to torture (very, very easy) or kill you (likewise easily done) they have no responsibility whatsoever. They just have to mumble a few lines on an FDA application reviewed by people who know little to nothing about digital security, and all is golden. Expect America to continue to be exceptional – the furthest behind of any major country because frankly there is no reason to sweat it in the device manufacturing industry here. The rest is just hot air, posturing, and mostly denial.