Hacking the Human Body? Cyber-Bio Crossover: Implantable Medical Device (IMD) Hacking Rebecca Earnhardt, Researcher / Project Manager UMD START-Unconventional Weapons and Technology Division Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

The “Cyber” and “Bio” Crossover Dual-use concerns Ease burden on patient vs. increasing intrusion risks Synthetic development of pathogens GenBank® access and other genetic sequence databases De novo synthesis of horsepox virus to improve vaccines vs. concerns about smallpox reemergence Intellectual property protection Democratization of biotechnology vs. protection against biohacking Increasingly connected and mechanized health management Remote monitoring of medical devices vs. malicious outside interference Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

Case: Implantable Medical Devices Smaller, increasingly powerful, and progressively connected along with an aging population 200,000+ cardiac devices installed annually in the U.S. (World Survey of Cardiac Pacing and Implantable Cardioverter-Defibrillators) 20-30% of patients with Type 1 diabetes mellitus use continuous blood glucose monitor and insulin pump systems Dramatically increased use of vagus nerve stimulators, prompting “brain control” concerns “[U.S.] demand for implantable medical devices is forecast to increase 7.7 percent annually to $52 billion in 2015.” (Freedonia) Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

Concern Dates Back “In 2007, then-U.S. Vice President Dick Cheney ordered some of the wireless features to be disabled on his defibrillator due to security concerns. When asked if he would recommend other patients do the same, Cheney said not necessarily. "You've got to look at all eventualities and do whatever you have to safeguard the capabilities of the individual...” - Jim Finkle, “U.S. government probes medical devices for possible cyber flaws,” Reuters Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

Medical Device Hacking: Worried Well or Warranted Concern? Oct 2016 – Johnson & Johnson One Touch Ping insulin pump system In interviews with Reuters, Johnson & Johnson recognized the system vulnerabilities Black Hat hacker, Jerome Radcliffe, demonstrated insertion of malicious code to trick device into injecting fatal dose of insulin Jan 2017 - Critical defects in St. Jude Medical Center’s implantable cardiac device and Merlin@home transmitter Statement issued by FDA concerning the cyber vulnerability Radio-frequency enabled and WiFi connectivity 2008 experiment demonstrated the ease with which engineers were able to alter RF-enabled cardiac devices Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

Who Would Hack a Medical Device? A new breed of adversary – cyberbioterrorist? Initial scans indicate lone actors motivated to commit insurance fraud or targeted assassination Others suggest different subsets: spies, insiders, and “interferers” Worst case: adversaries combining capabilities to conduct multiple, simultaneous hacks Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

Issues with Extant Analyses Superficial, lacking grounding in adversary behavioral modeling Lack of consistent tracking of potential hacking cases by FDA Exploration of the supply-side dominated by technology-focused analyses instead of focusing on the adversarial demand-side Opportunity is the focus while the adversary is ignored Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

Taking a Balanced Approach Future work includes incorporating technology adoption behavioral modeling into current technology-focused analyses Many decision points and idiosyncrasies that may prohibit adversary adoption Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote

Contact: Rebecca Earnhardt rearnhar@umd.edu Preliminary Research - Do NOT Cite or Quote – Research was Conducted Independently of START-UMD Preliminary Findings - Do NOT Cite or Quote