Medical Devices - Security and Privacy Issues

The session opens with the case for medical devices, from pacemakers and insulin pumps to retinal implants and fitness trackers, and explains why patients accept them despite their risks. The speakers argue that these devices collect intimate data, and that people generally want that data kept private even when they share it casually.

The middle of the talk covers privacy and security. They describe how device transmissions carry identifiers such as names, dates of birth and serial numbers, and cite a 2013 study in which a few coarse data points singled out most people in a large dataset. They point to recurring flaws across devices, a 2022 figure that most medical IoT devices have known security gaps, and historical NSA slides on collecting medical "pattern of life" data. Basic hardware is outlined as well: a microcontroller, sensors, ISM-band radios and near-field communication.

The speakers then present their own devices. Pam describes her spinal stimulator and its near-field programmer, which has no login, and adjusts it live on stage. Jim, who joined remotely, is covered through a recorded demonstration of his defibrillator and a Q&A. The talk closes by noting that vendor support, device lifetimes and the limits of RF shielding pouches leave patients with few practical options.