[00:00.000 --> 00:05.160]  Thanks to the corroborate, what the previous speaker said, that light is extremely blinding.
[00:05.620 --> 00:07.940]  So if I close my eyes, I'm not about to fall asleep.
[00:08.060 --> 00:10.720]  I could, but most likely it's about the light.
[00:10.920 --> 00:13.440]  It's kind of difficult to look up with that light.
[00:14.680 --> 00:16.280]  So this is the way it's going to work.
[00:16.520 --> 00:21.560]  I'm going to give a little introduction on who are we and where do we say these things.
[00:22.180 --> 00:29.640]  And then my friend Alvaro will be handing out the technical details and interesting stuff.
[00:30.160 --> 00:38.180]  If by the time he's done, you're not scared to death, then I'll close the presentation by proposing some things that we can do about it.
[00:38.360 --> 00:41.200]  Because you're going to hear a lot of scary stuff today.
[00:42.140 --> 00:45.460]  So brief introduction, who are we and what do we do here?
[00:46.260 --> 00:52.420]  A few HOPEs ago, HOPE Number Six, we gave a talk, a very different one.
[00:53.120 --> 00:57.580]  I don't recall any of your faces, but I wouldn't even if I saw you there.
[00:57.580 --> 01:03.740]  So we talked about copyleft and against patents and P2P networks and all that.
[01:05.860 --> 01:10.660]  At that time, I explained how I was a lecturer in a university in Spain.
[01:10.840 --> 01:14.640]  I was kicked out of the university for defending P2P networks.
[01:15.560 --> 01:19.600]  The Motion Picture Association of America didn't like my stance against copyright.
[01:20.460 --> 01:22.140]  So they pressured it in.
[01:22.420 --> 01:28.940]  I got kicked out, lectured about it, toured the world, speaking that annoying little story.
[01:29.860 --> 01:31.600]  And that got me thinking.
[01:31.640 --> 01:42.420]  I got involved into a lot of debates about alternative methods, alternative business models in the world of copyleft and all that.
[01:43.640 --> 01:52.320]  So I decided that it was about time to do something, not just talk about copyleft, not just talk about free software, but to do something.
[01:52.560 --> 01:54.360]  To prove these people they were wrong.
[01:54.540 --> 01:55.640]  They wouldn't listen to reason.
[01:55.800 --> 01:59.560]  They wouldn't listen to university studies and numbers.
[01:59.560 --> 02:02.260]  So let's speak the language they speak, which is money.
[02:02.860 --> 02:09.880]  So let's start a company that makes money with free software and prove to them that it can be done.
[02:10.680 --> 02:12.080]  That's why I started this company.
[02:12.320 --> 02:13.380]  I wouldn't even mention the name.
[02:13.480 --> 02:14.200]  This is not sales pitch.
[02:15.600 --> 02:19.800]  And I figured, free software, in which industry?
[02:20.160 --> 02:31.160]  And I thought, well, what's the most saturated market and yet controlled by the biggest corporations that are the least willing to go open-source free software?
[02:32.800 --> 02:33.860]  Yeah, military.
[02:34.180 --> 02:34.320]  I know.
[02:34.660 --> 02:38.320]  After that, I don't like to mess with the Pentagon.
[02:38.700 --> 02:39.860]  Not anymore, though.
[02:41.340 --> 02:42.700]  Yes, the healthcare.
[02:42.880 --> 02:49.720]  Healthcare industry is controlled, dominated by a number of large corporations.
[02:50.180 --> 02:51.380]  You all know them.
[02:51.500 --> 02:52.340]  I won't mention them.
[02:53.360 --> 02:57.300]  But there are very few and control a very large market share.
[02:57.940 --> 03:07.180]  So every time that happens, the incentive to innovate, the incentive to collaborate, the incentive to be open, is extremely small.
[03:07.420 --> 03:12.240]  I mean, if you control a very large piece of the market, you know, who cares about what the customer wants?
[03:12.340 --> 03:13.380]  Who cares about innovating?
[03:13.500 --> 03:14.160]  Who cares about...
[03:14.160 --> 03:16.040]  And I'm not saying these companies don't innovate.
[03:16.040 --> 03:20.640]  I'm not saying these companies, individuals that work in there, don't care.
[03:20.880 --> 03:25.100]  I'm just saying as companies, as market dynamics goes, it just doesn't happen.
[03:26.320 --> 03:30.660]  So true enough, started this company, knew nobody, knew nothing about this stuff.
[03:31.060 --> 03:35.900]  And just gathered around a few of my friends and hackers and programmers and stuff.
[03:35.980 --> 03:40.280]  And so let's do things in the medical device industry and the medical software industry.
[03:40.280 --> 03:41.780]  And let's see what's out there.
[03:42.960 --> 03:46.260]  Well, true enough, as soon as we started, we realized there were a lot of things to be done.
[03:46.500 --> 03:47.920]  We concentrated on medical imaging.
[03:48.140 --> 03:53.760]  But one of the things that I noticed from day one, and I said, someday I've got to speak about this.
[03:54.000 --> 03:55.620]  And today is that, someday.
[03:56.500 --> 04:04.940]  It's the very scary security thing in hospitals and healthcare networks and environments.
[04:07.280 --> 04:11.920]  I know some of you work for a hospital, like, sysadmins and stuff.
[04:12.100 --> 04:14.780]  So I know some of you, like, know more than I do about this stuff.
[04:14.980 --> 04:16.020]  But most of you don't.
[04:16.180 --> 04:20.760]  So I'll throw in a few terms that probably Albert will be mentioning, so you know what it is.
[04:22.160 --> 04:24.720]  You've all been in a hospital and know what it is and stuff.
[04:24.880 --> 04:26.840]  So you imagine these scanners, for example.
[04:27.180 --> 04:29.940]  I mean, you get a CT scan, you get an x-ray, you get an ultrasound.
[04:30.840 --> 04:32.060]  They're all scanners to me.
[04:32.220 --> 04:32.740]  They scan things.
[04:33.560 --> 04:36.980]  Those are called modalities in the hospital world.
[04:38.620 --> 04:45.260]  Those modalities don't act like your regular scanner, like your desktop scanner.
[04:45.700 --> 04:46.380]  Some do.
[04:46.840 --> 04:49.000]  Some are pretty lousy and just throw you a JPEG.
[04:49.220 --> 04:55.260]  But most of them will output some file that is in a particular format.
[04:55.420 --> 04:56.600]  It should be a DICOM file.
[04:56.840 --> 05:01.540]  Some are different non-compliant DICOMs and some are really weird.
[05:01.540 --> 05:03.200]  But they got their own files.
[05:03.560 --> 05:06.160]  They got their own protocols to talk to each other.
[05:06.540 --> 05:07.220]  Like you got the server.
[05:07.480 --> 05:09.100]  The server cannot be just the server.
[05:09.440 --> 05:11.460]  I mean, if you do video, you have a server.
[05:11.940 --> 05:13.980]  If you do mail, you have a server.
[05:14.160 --> 05:16.860]  If you do websites, you have a server.
[05:17.100 --> 05:19.220]  If you're in healthcare, you have a PAX.
[05:19.220 --> 05:22.100]  Because, you know, healthcare people are cooler.
[05:22.300 --> 05:23.460]  We need different acronyms.
[05:24.540 --> 05:34.320]  And the PAX is a server that takes files, they just happen to be DICOM, and it communicates through their own protocol using their own ports and their own kind of stuff.
[05:34.520 --> 05:35.460]  But it's the server.
[05:36.200 --> 05:38.000]  And the scanners are scanners.
[05:38.300 --> 05:40.220]  They're just using their own kind of thing.
[05:40.880 --> 05:44.280]  Well, that goes on and on with all the things in the network, in the hospitals.
[05:44.540 --> 05:51.200]  So hospitals have networks, have files, have servers, just like everybody else, but they are a little different.
[05:51.700 --> 05:52.620]  Why are they different?
[05:52.720 --> 05:59.580]  Because that way, the large companies that dominate that market can keep on dominated, or so they thought.
[06:01.160 --> 06:07.700]  A few years ago, there was a little change in the industry, and they realized they couldn't keep up with this.
[06:07.700 --> 06:10.900]  This is mine, I'm not going to let you play with my toys kind of attitude.
[06:11.600 --> 06:13.640]  They started to try to collaborate with each other.
[06:14.600 --> 06:17.060]  And that's what hell broke loose.
[06:17.900 --> 06:19.700]  Security stuff started to happen.
[06:19.820 --> 06:21.100]  You'll hear some things.
[06:21.240 --> 06:26.840]  I'm pretty sure you've all heard stories in the news about data breaches and accesses and all that.
[06:28.500 --> 06:31.340]  And it's going to get a lot, a lot worse.
[06:31.820 --> 06:33.680]  Because the holes are there.
[06:34.220 --> 06:35.600]  They're not easy to be plugged.
[06:35.780 --> 06:37.000]  They're not playing nice.
[06:37.000 --> 06:38.240]  They're not letting us.
[06:38.380 --> 06:40.980]  When you go, let's do this.
[06:41.040 --> 06:41.440]  Let's do that.
[06:41.500 --> 06:42.020]  Let's collaborate.
[06:42.340 --> 06:42.860]  Let's open.
[06:43.000 --> 06:44.420]  Let's share this information.
[06:44.980 --> 06:46.900]  They're not about to let that happen.
[06:47.720 --> 06:55.580]  So just so you have an idea on how difficult this is, and how messy Avaro, like I said, will tell you stories.
[06:55.580 --> 06:58.100]  Where did we gather these stories from?
[06:58.500 --> 07:00.940]  Yeah, Google, like everybody else.
[07:01.100 --> 07:03.240]  But most are from our experience.
[07:03.700 --> 07:05.920]  We have installations in 15 countries.
[07:06.220 --> 07:11.600]  We've worked with, like, national health systems that we control their whole system.
[07:11.800 --> 07:17.140]  And we manage tens of millions of images every time we move something around.
[07:17.640 --> 07:23.200]  And we work with very little tiny clinics with two doctors that will be having their iMacs and the desktop.
[07:23.360 --> 07:24.320]  And that's the whole setup.
[07:24.580 --> 07:26.300]  So we have a broad view.
[07:26.800 --> 07:28.700]  And we've... I won't say we've seen it all.
[07:29.180 --> 07:31.600]  But because every single day something weird happens.
[07:31.880 --> 07:33.740]  Are you going to tell them about what happened just this morning?
[07:34.140 --> 07:35.120]  Oh, you're going to do that?
[07:35.220 --> 07:35.420]  Okay.
[07:35.620 --> 07:38.360]  I want to step on your... I can do that?
[07:38.800 --> 07:39.200]  Okay.
[07:39.520 --> 07:40.240]  I can do that.
[07:41.080 --> 07:42.180]  He's giving me permission.
[07:43.340 --> 07:44.380]  Oh, look at this.
[07:44.900 --> 07:46.100]  There's probably some information in here.
[07:46.560 --> 07:50.540]  Somebody left this micro USB thing with...
[07:50.540 --> 07:51.400]  I'm sorry, I'm keeping it.
[07:51.960 --> 07:52.920]  No, I'm joking this.
[07:53.680 --> 07:53.780]  Okay.
[07:55.400 --> 07:56.840]  Yeah, I'm just leaving it here.
[07:57.160 --> 07:57.240]  Okay.
[07:59.380 --> 08:02.540]  That's data security in the 21st century.
[08:05.580 --> 08:09.520]  This morning, just this very morning in this hospital, I won't mention the hospital.
[08:09.520 --> 08:10.400]  I won't get in trouble.
[08:10.560 --> 08:11.760]  It's a customer of ours.
[08:12.140 --> 08:17.140]  They have this big major professional basketball player coming in for a routine checkup.
[08:18.060 --> 08:27.080]  Minutes later, this online news service saying this player has this kind of problem and here's the image and here's what's wrong with him.
[08:27.180 --> 08:29.060]  And everybody's paranoid.
[08:29.360 --> 08:30.320]  Everybody's freaking out.
[08:30.420 --> 08:32.540]  My phone is ringing like it's crazy.
[08:32.540 --> 08:33.720]  And I'm like, okay, okay.
[08:33.800 --> 08:34.140]  I know, I know.
[08:34.260 --> 08:35.140]  I read the news.
[08:35.320 --> 08:36.280]  Let me check what happened.
[08:37.020 --> 08:38.900]  It wasn't our fault, number one.
[08:39.420 --> 08:40.400]  I've learned the US way.
[08:40.480 --> 08:40.800]  Not my fault.
[08:43.940 --> 08:44.980]  But we checked.
[08:45.200 --> 08:52.840]  We logged in and we discovered it was somebody, a nurse from the inside that wanted to make an extra buck and wanted to sell this story to the news.
[08:52.840 --> 08:54.780]  So it wasn't the fault of the software.
[08:55.060 --> 08:57.560]  It wasn't the fault of the system, of the server.
[08:57.700 --> 08:58.340]  It was no hacker.
[08:58.520 --> 08:59.880]  It was no network.
[09:00.260 --> 09:01.280]  It was a person.
[09:01.700 --> 09:10.120]  You know the most security threats, not to say all, are people that have legit access to the information.
[09:10.120 --> 09:11.560]  You can't do anything about that.
[09:12.180 --> 09:16.620]  But there are things that can be done to improve the situation.
[09:16.620 --> 09:18.640]  And what is that situation?
[09:18.980 --> 09:19.900]  It's Albert's turn.
[09:22.750 --> 09:23.330]  Thank you.
[09:25.090 --> 09:28.330]  So, first of all, I'm sorry about my broken English.
[09:28.590 --> 09:30.930]  So, please, if you don't mind too much about it.
[09:31.250 --> 09:34.020]  And if you don't understand anything, you can just ask.
[09:34.830 --> 09:38.590]  And sometimes I speak a bit fast, so you may not understand.
[09:38.710 --> 09:43.650]  But I hope that you understand everything.
[09:43.970 --> 09:47.390]  And I'm sorry, this isn't going to be very, very technical.
[09:47.390 --> 09:52.690]  So it's going to be all around over it to get a whole image of how is it going now.
[09:53.510 --> 10:01.130]  So, just to get on it, you know, right now, healthcare institutions are going to get a lot of devices.
[10:01.310 --> 10:08.510]  They have a lot of devices of all kinds that are connected around the hospital, on the networks.
[10:08.510 --> 10:17.610]  Because they have all kinds of pulse monitors, AKGs, magnetic resonance, X-rays, ventilators, patient info, databases.
[10:18.310 --> 10:25.470]  Right now, almost every digital device on a hospital is trying to get connected to a central place.
[10:25.470 --> 10:34.730]  Because we are now in the age of central information, servers, electronic health records and everything.
[10:35.370 --> 10:37.930]  So, historically, all of this has been disconnected.
[10:38.710 --> 10:43.490]  So, the digital devices on hospitals has been there for a long time.
[10:43.490 --> 10:45.390]  But they used to be alone.
[10:45.830 --> 10:49.030]  So, you have an X-ray machine and you get the files out.
[10:49.170 --> 10:52.530]  You have a computer where you have to take the files out.
[10:52.710 --> 10:56.510]  Or you even didn't connect with other devices.
[10:56.930 --> 11:00.930]  So, a lot of it has been done on paper also.
[11:00.930 --> 11:08.230]  But with the arrival of all of these crises of the electronic health reports, sorry, wireless networks and everything.
[11:08.490 --> 11:10.770]  Everybody is in the crisis of getting connected.
[11:11.150 --> 11:16.530]  And they are going to get like on the same state that your devices at home has.
[11:16.770 --> 11:20.070]  Like all your iPhones and iPods.
[11:20.350 --> 11:22.810]  You have all your devices at home connected together.
[11:22.990 --> 11:25.790]  And this is the way they are going to get on the hospital.
[11:27.050 --> 11:28.890]  So, is this helpful?
[11:29.130 --> 11:29.890]  Is this helpful?
[11:30.150 --> 11:31.730]  Sorry, with my pronunciation.
[11:32.110 --> 11:33.470]  This helps a lot really.
[11:33.730 --> 11:38.830]  It provides doctors a lot of information about the patients with current info.
[11:39.150 --> 11:41.490]  What the treatment that the patient is going on.
[11:41.950 --> 11:43.150]  And the illness.
[11:43.530 --> 11:45.210]  The health problems about the patient.
[11:45.390 --> 11:45.750]  The appointments.
[11:46.710 --> 11:51.350]  An X-ray study you just have done on the X-ray machine.
[11:51.350 --> 11:54.010]  It can be diagnosed from the other side of the country.
[11:54.010 --> 11:56.450]  Or maybe of the planet.
[11:56.810 --> 11:58.050]  Like five minutes later.
[11:58.370 --> 12:01.650]  Thanks to the image servers we were talking about.
[12:01.950 --> 12:02.630]  The back servers.
[12:03.370 --> 12:11.190]  So, the nurses also can be warned about every problem that can arise on a patient on a certain moment.
[12:11.410 --> 12:14.270]  Even if he is not at the hospital.
[12:14.610 --> 12:17.910]  Maybe if he is monitored from home.
[12:17.910 --> 12:24.790]  Or maybe your implants can modify its behavior on some... on demand.
[12:25.090 --> 12:30.130]  Or maybe because your doctor maybe reconfigured the device or something.
[12:31.050 --> 12:40.750]  So, also because of all these new crates you can rest happily at home and be monitored and know that everything is okay without going to the hospital every week.
[12:40.750 --> 12:46.130]  And being checked remotely by your doctor with all the new devices.
[12:46.370 --> 12:59.330]  But, you know, probably by experience with all the devices you have at home that you cannot just connect your computer, your laptop, your iPhone to the network and hope that everything is going to be fine.
[12:59.330 --> 13:15.030]  So, you know, all these problems that arise like every three months or every month that you just connect your computer and it gets infected by a virus or maybe a worm or whatever just because.
[13:15.270 --> 13:17.950]  Because they have found some problems.
[13:18.070 --> 13:29.950]  Even when you have a firewall or you are with your antivirus updated and you are supposedly just with your security up to the last minute up to the last security problems for you.
[13:30.710 --> 13:39.370]  But you know that anyway that doesn't matter and that there are always new vulnerabilities and you are going to find that your computer is on bad health.
[13:39.630 --> 13:49.050]  So, if your computer is on bad health and some computers are going to take charge of your health, what do you think that could happen about it?
[13:49.770 --> 13:52.490]  So, sorry, but you are going to die.
[13:53.490 --> 14:08.350]  Your life is on charge of some computers that maybe can get infected or get some attacks, hacker attacks, but you will ask to yourself, why would I die in a hospital and not by my illness?
[14:08.670 --> 14:17.070]  Why in a place made for taking care of me, for making sure I'm healthy, for improving my life span and my life quality?
[14:17.730 --> 14:21.810]  Why am I going to lose my life for a computer?
[14:22.830 --> 14:25.790]  So, maybe you find your laptop threatening for you?
[14:26.010 --> 14:27.910]  You think your laptop is going to kill you?
[14:28.030 --> 14:29.010]  It may kill you.
[14:29.410 --> 14:30.710]  Let me show a little example.
[14:30.890 --> 14:32.170]  It is not very new.
[14:32.410 --> 14:34.790]  It is from the year 82.
[14:35.030 --> 14:36.150]  You may know something about it.
[14:36.310 --> 14:41.610]  It is one of the first famous problems with medical software.
[14:41.610 --> 14:43.610]  And it is the THERAC25.
[14:44.370 --> 14:46.570]  I don't know if some of you may know about it.
[14:46.730 --> 14:51.930]  So, the THERAC25, this was from the year 85 to 87.
[14:52.530 --> 14:54.210]  It was a radiation therapy machine.
[14:54.710 --> 15:04.670]  So, for cancer patients, you receive some sort of radiation to the malignant tumor you have inside of you for controlling the cell growth.
[15:04.670 --> 15:12.110]  So, this machine has a certain bug that's called race condition.
[15:12.410 --> 15:25.450]  For the non-programmers here, race condition simplifying is when some parts of the software are depending on the result on an exact time from other parts of the software.
[15:25.450 --> 15:37.830]  And if they don't finish on a correct time, the end of that production, that data is going to be invalid.
[15:38.270 --> 15:41.310]  So, this machine, in fact, had some problem.
[15:41.430 --> 15:44.710]  That was like the control panel of the machine.
[15:44.830 --> 15:46.590]  That is an old machine in green and black.
[15:46.590 --> 15:51.710]  So, the doctors that were running this machine were very used to it.
[15:51.810 --> 15:52.790]  They used it daily.
[15:53.010 --> 15:56.010]  So, they were very fast in putting info on it.
[15:56.890 --> 16:15.790]  So, on certain conditions, when the machine, when the doctor input the data on the machine in less than eight seconds, even when the correct info was shown on the screen and you could see how strong were the X-rays you were receiving, it wasn't fine.
[16:15.790 --> 16:21.310]  So, you were going to receive like a hundred times more radiation than you were expecting for what was on there.
[16:21.510 --> 16:27.290]  Because the machine wasn't even ready before eight seconds and it wasn't receiving the data that the doctor was writing down.
[16:28.270 --> 16:37.070]  So, this result on at least these cases with at least three people left during three years.
[16:37.590 --> 16:45.570]  This was kind of very difficult to find because you were treating with people that was in risk of dying anyway.
[16:46.090 --> 16:54.230]  So, it's cancer patients and you don't really know if they died about their illness or this kind of problem.
[16:54.370 --> 16:57.030]  But finally, they found it and put it out of commission.
[16:58.490 --> 17:09.270]  So, this is some kind of scary example where you can find a software that can kill you by an error.
[17:10.710 --> 17:14.030]  So, these kind of dangers can get many saves on medical environments.
[17:14.030 --> 17:22.550]  So, you could be blackmailed because somebody knows some kind of secret about you.
[17:22.930 --> 17:29.050]  Maybe something similar to the example we told before about this basketball player.
[17:29.050 --> 17:33.530]  Or maybe somebody could know that you have some kind of deadly allergy.
[17:34.170 --> 17:39.030]  Or maybe your pacemaker is going nuts and can kill you in a software error.
[17:39.250 --> 17:44.410]  Or maybe, I don't know, you could have your medication swapped by an error also, by a software error.
[17:45.510 --> 17:49.290]  But also, medical networks produce and exchange more and more data every day.
[17:49.810 --> 17:54.050]  So, connecting information is getting very usual.
[17:54.750 --> 17:58.450]  And hospitals connect to other hospitals, to government, to different departments.
[17:58.630 --> 17:59.430]  They just change information.
[17:59.750 --> 18:04.090]  And this kind of electronic processes are still very rough.
[18:04.250 --> 18:07.110]  Because this is very new to the hospitals.
[18:07.990 --> 18:10.590]  And this is not like your computers.
[18:10.790 --> 18:14.050]  There are thousands of millions of computers on the Internet.
[18:14.350 --> 18:18.230]  So, there are thousands of millions, I don't know, of Windows machines, Mac machines.
[18:18.230 --> 18:23.510]  So, it's easier to get errors and debug.
[18:23.830 --> 18:27.290]  But the medical machines are fewer than that.
[18:27.410 --> 18:30.910]  So, it's very slow to get feedback.
[18:31.290 --> 18:35.230]  The medical companies are very hard to get information about that.
[18:35.330 --> 18:38.370]  They are not open at all about medical vulnerabilities.
[18:38.710 --> 18:46.410]  So, this is a world when you could be reasonably healthy and be killed by a software error just because.
[18:49.930 --> 18:55.750]  So, one of the easier, most common error could be like a data breach.
[18:56.750 --> 18:58.450]  So, the same we said before.
[18:59.210 --> 19:01.370]  These are the most common kind of vulnerabilities.
[19:01.970 --> 19:06.850]  We could probably find every day news about it on a newspaper.
[19:07.730 --> 19:12.290]  Due to the vast exchange of information that comes on the networks every day.
[19:12.290 --> 19:16.610]  So, this kind of data could leave the network without authorization.
[19:16.610 --> 19:26.390]  If we don't follow all the usual requirements for security that you also check on every typical network for you.
[19:27.550 --> 19:36.490]  But, however, we are going to see the two most common standards on hospitals for this kind of thing.
[19:36.490 --> 19:38.290]  So, we have HL7.
[19:38.630 --> 19:40.570]  This is the acronym for Health Level 7.
[19:40.710 --> 19:49.750]  Health Level 7 is like an association of companies that make standards for changing information between medical software.
[19:49.750 --> 19:58.770]  So, Level 7, the Level 7 part is because it's over the layer 7 on the OC model.
[19:59.630 --> 20:01.250]  If some of you know TCP.
[20:01.670 --> 20:04.130]  So, it means it's around the application level.
[20:04.290 --> 20:08.170]  So, this is around the information that applications exchange.
[20:08.170 --> 20:16.550]  So, for one side, it refers to the association that does these standards.
[20:16.730 --> 20:20.910]  But, on the other side, it also names some of the standards that they create.
[20:21.170 --> 20:26.710]  So, like HL7 version 2 and version 3, and so on.
[20:27.390 --> 20:36.310]  So, these standards define a series of messages that can exchange different software that follow the standard for messaging.
[20:36.310 --> 20:41.010]  Like, when a new patient is created in the hospital.
[20:41.370 --> 20:44.090]  When the patient shows up in the hospital for getting a check.
[20:44.670 --> 20:49.310]  For when he's under some sort of test.
[20:50.230 --> 20:53.630]  And one machine has to say to the other that he's going to show up.
[20:53.790 --> 20:55.810]  For example, you are going to get an X-ray.
[20:56.570 --> 21:03.330]  And the X-ray machine is going to get a message from the central server monitor for knowing that he's going to show up.
[21:03.330 --> 21:07.610]  And you have all the data there without writing it up.
[21:08.230 --> 21:10.710]  It will send your doctor what medication do you need.
[21:10.890 --> 21:14.390]  And it will send the billing department what do you have to pay.
[21:14.510 --> 21:17.430]  Or even will tell them that you haven't paid.
[21:19.110 --> 21:21.250]  The other most common standard is DICOM.
[21:21.550 --> 21:22.970]  That Jorge has said.
[21:23.150 --> 21:27.110]  And this is around radiology departments.
[21:27.770 --> 21:35.210]  Essentially, because even if it is extended to another department, radiology is where it's used the most.
[21:35.390 --> 21:40.450]  And it's a standard that's about the file format for changing medical images.
[21:40.450 --> 21:42.570]  And also about the network format.
[21:42.790 --> 21:46.830]  So it names both the network and the file format for it.
[21:49.230 --> 21:54.130]  So it does a pair of things, or three mostly.
[21:54.370 --> 21:57.410]  So it names the file format for saving images.
[21:57.850 --> 22:03.850]  It is used for printing images on special radiology printers or imaging printers.
[22:03.850 --> 22:06.010]  It saves images on a network.
[22:06.690 --> 22:12.370]  It also will receive some messages when you show up for a test and everything.
[22:12.510 --> 22:13.890]  Everything on the DICOM format.
[22:16.950 --> 22:20.290]  So these two standards will be used on every hospital.
[22:20.550 --> 22:29.890]  So almost 100% sure if you show up on your hospital, there are going to be some machines that are using these standards.
[22:29.890 --> 22:32.650]  Make everything faster, easier, cheaper.
[22:33.350 --> 22:35.650]  They connect every machine on the hospital.
[22:36.230 --> 22:40.250]  And help you for getting a nice review.
[22:40.730 --> 22:43.030]  And getting the work done cheaper.
[22:43.450 --> 22:44.650]  And getting you healthy.
[22:45.150 --> 22:48.970]  And it's like a way of connecting everything.
[22:49.910 --> 22:56.130]  So you could die by a data breach.
[22:56.470 --> 22:57.890]  It's difficult to say.
[22:57.890 --> 22:58.970]  Not directly.
[22:59.210 --> 23:02.530]  Because you couldn't die if somebody snoops on the network.
[23:02.870 --> 23:07.230]  And takes some information about your billing.
[23:07.590 --> 23:09.650]  Or takes some of your medical images out.
[23:09.830 --> 23:10.990]  You couldn't die directly.
[23:11.170 --> 23:18.670]  But as I said before, maybe you could die if somebody gets some critical medical information about you.
[23:19.070 --> 23:19.890]  Blackmail you.
[23:20.110 --> 23:21.130]  Or tries to kill you.
[23:21.190 --> 23:24.450]  Because I don't know what kind of motivation they could have.
[23:24.450 --> 23:29.390]  But so then, this is a very low expectation that you could die by that breach.
[23:29.690 --> 23:33.910]  So we are going to put it like down, down on the scale of dying by computers.
[23:36.790 --> 23:40.530]  On the other side, we have some kind of body-related attacks.
[23:40.890 --> 23:45.610]  So we can talk about the failing hardware like the other example of the Therac-25.
[23:47.010 --> 23:50.530]  So there are a lot of hardware that interacts.
[23:50.670 --> 23:53.130]  Hardware and software that interacts directly with your body.
[23:55.090 --> 23:58.510]  So that part is when we begin to get a bit dangerous.
[23:58.510 --> 24:03.630]  So there are a lot of things that we have seen.
[24:03.730 --> 24:04.410]  The X-ray machines.
[24:04.650 --> 24:05.410]  The CT machines.
[24:05.890 --> 24:09.690]  I don't know which kind of machines you can have for testing your health.
[24:09.990 --> 24:15.570]  We have a lot of implants that go directly inside your body and interact with you.
[24:16.130 --> 24:19.190]  So many of you maybe have some of them.
[24:19.510 --> 24:20.030]  Peacemakers.
[24:20.170 --> 24:20.870]  Insulin pumps.
[24:21.170 --> 24:22.530]  Implantable defibrillators.
[24:23.070 --> 24:23.690]  Neuron implants.
[24:23.930 --> 24:24.570]  Artificial hurts.
[24:24.790 --> 24:25.410]  Cochlear implants.
[24:25.410 --> 24:28.510]  Some of you may have some of those.
[24:30.930 --> 24:33.730]  Those old devices are designed to improve your quality of life.
[24:34.790 --> 24:37.810]  They used to be very autonomous.
[24:38.090 --> 24:48.390]  If you have to make any change on some of these devices, as are they implanted on the old times, they had to put the implant out again.
[24:48.590 --> 24:50.750]  So they had to make a surgical correction.
[24:51.030 --> 24:53.550]  That's not very easy.
[24:54.410 --> 25:00.130]  They had to correct your pacemaker or they had to tweak how your defibrillator is going.
[25:00.930 --> 25:08.170]  So from sometime to now, they are having some kind of loud power radio inside.
[25:08.450 --> 25:12.410]  So the doctor can connect to your device and tweak it.
[25:12.510 --> 25:13.170]  Make some changes.
[25:13.170 --> 25:18.090]  How is the behavior of your device to improve?
[25:18.410 --> 25:21.950]  How is it working with your exact illness or problem?
[25:24.010 --> 25:26.170]  But this has computers inside.
[25:26.850 --> 25:30.510]  The doctor could even have to reboot your implant.
[25:30.510 --> 25:35.350]  I have seen that once with a patient that has had a problem in Morocco.
[25:36.170 --> 25:39.690]  And he had a problem with his defibrillator.
[25:39.970 --> 25:45.730]  So it went crazy and began to defibrillate again and again and again and again like 10 times a day.
[25:45.890 --> 25:50.810]  So he had to fly to Spain and had a doctor reboot his defibrillator.
[25:50.810 --> 25:53.030]  So it's a computer anyway.
[25:54.870 --> 25:57.930]  So this is one of the famous vulnerabilities.
[25:58.410 --> 25:59.890]  This is Jay Bradclive.
[26:00.050 --> 26:01.750]  I think he works for IBM.
[26:03.190 --> 26:05.590]  Like a year and a half ago in Black Hat.
[26:05.770 --> 26:06.690]  He discovered...
[26:06.690 --> 26:10.870]  He opened like a vulnerability on an insulin pump.
[26:11.170 --> 26:12.610]  Do any of you have an insulin pump?
[26:13.430 --> 26:13.930]  No?
[26:14.250 --> 26:14.690]  You are safe.
[26:14.790 --> 26:15.390]  I know you have one.
[26:15.790 --> 26:16.290]  You know this?
[26:17.850 --> 26:18.770]  You are scared.
[26:20.330 --> 26:20.790]  Just a bit.
[26:20.910 --> 26:21.350]  Okay, anyway.
[26:21.970 --> 26:27.390]  An insulin pump is a device that you get inside of you if you are diabetic.
[26:28.250 --> 26:28.770]  So...
[26:28.770 --> 26:29.530]  Diabetic.
[26:29.530 --> 26:34.270]  So instead of having to put insulin like...
[26:34.270 --> 26:36.990]  It's time you feel bad and everything.
[26:37.150 --> 26:39.810]  It has some kind of deposit with insulin.
[26:40.350 --> 26:41.010]  It's fine.
[26:41.830 --> 26:45.050]  Yeah, so it's time that you need a bit of insulin.
[26:45.190 --> 26:49.750]  It's going slowly and feeds you for a month or 40 days or something like that.
[26:49.850 --> 26:53.290]  And you just go to the hospital and refill it again and it's going autonomous.
[26:53.930 --> 26:54.590]  Something like that.
[26:55.850 --> 26:56.510]  I don't know.
[26:56.510 --> 27:03.270]  So this device in concrete, it has some deposit of insulin?
[27:04.450 --> 27:05.010]  Yeah?
[27:05.290 --> 27:05.810]  Outside.
[27:06.090 --> 27:06.650]  Outside.
[27:06.830 --> 27:06.930]  Okay.
[27:07.130 --> 27:09.410]  But it goes...
[27:09.410 --> 27:10.990]  But you refill that in the hospital?
[27:11.830 --> 27:12.110]  No?
[27:12.350 --> 27:12.790]  Yourself?
[27:13.430 --> 27:13.630]  Anyway.
[27:13.990 --> 27:15.550]  How long does it last?
[27:16.430 --> 27:17.210]  A week?
[27:17.330 --> 27:17.470]  Okay.
[27:18.050 --> 27:24.210]  I have seen or I have read about some that last like for 45 days or something like that.
[27:24.710 --> 27:24.990]  I don't know.
[27:26.690 --> 27:27.170]  Yeah.
[27:28.490 --> 27:34.050]  So anyway, these devices have some kind of radio control.
[27:34.750 --> 27:52.350]  So this guy discovered that he could go over the security measures that that device has and pull all the full deposit of insulin inside of him without warning.
[27:53.890 --> 27:54.790]  That's not good.
[27:55.370 --> 27:56.490]  That's not good, really.
[27:57.270 --> 28:08.650]  So theoretically, the device that he was wearing, because he is diabetic by the way, also has some kind of warning that vibrates if the pump begins to function.
[28:08.650 --> 28:17.250]  So he could also jump over that protection and dump all the full deposit of insulin on him.
[28:17.430 --> 28:18.170]  So that's...
[28:18.170 --> 28:19.310]  You could die by that.
[28:20.570 --> 28:31.590]  He discovered that with a small antenna that device is something that he made by himself could function like even 100 feet away or so.
[28:31.590 --> 28:39.570]  So he could make this exact device empty all the insulin deposit on somebody.
[28:40.730 --> 28:43.170]  This device was made by Methronix.
[28:44.670 --> 28:48.270]  Methronix didn't even say anything like for a year, something like that.
[28:49.490 --> 28:56.310]  They didn't even say like, it's difficult, it's hard, it's not like, it's not dangerous.
[28:56.570 --> 29:00.050]  They didn't even say anything for a year.
[29:00.050 --> 29:06.390]  So finally, a year later, they say that they are working on it, but I'm not sure about it.
[29:08.030 --> 29:15.550]  That was a very famous problem, but you have a lot of vulnerabilities like Panama in 2001.
[29:15.890 --> 29:21.790]  This is a similar case to the one to the Therac-25, Theratron 70C.
[29:21.790 --> 29:27.150]  This is also a radiation therapy machine.
[29:27.850 --> 29:31.090]  So 28 patients died or exposed to radiation.
[29:33.570 --> 29:39.070]  The problems they found there is they have a lack of plan verification.
[29:39.070 --> 29:46.250]  So they didn't have a standard for weekly or monthly or whatever to check how much radiation they were receiving.
[29:47.070 --> 29:50.170]  So how many people...
[29:50.980 --> 29:55.270]  Theoretically, five of the deaths were related to that radiation.
[29:55.670 --> 29:56.890]  So some people died there.
[29:56.890 --> 30:17.090]  But this is not only out of the States, but CEDAR-CNI discovered like two years ago that during 18 months, some patients, hundreds of patients were receiving like, I don't know, like, sorry, like 20 to 50% more radiation than they saw.
[30:18.130 --> 30:33.730]  Only because the doctor that set up first the machine, when the machine came to the hospital, set up some value incorrectly and nobody ever found that this machine was giving too much radiation.
[30:33.950 --> 30:41.010]  So they didn't find until a year and a half later, people kept losing all their hair when they didn't.
[30:41.010 --> 30:42.750]  And investigated that.
[30:42.930 --> 30:52.270]  But even the usual test on the machine that they made like monthly or so, discover why this was failing.
[30:53.770 --> 30:58.270]  So this isn't the only software that you thought it wasn't friendly with you.
[30:58.690 --> 31:08.410]  You can find a lot of different software that aren't even inside of medical devices that can kill you or give you problems.
[31:08.410 --> 31:11.310]  At first, you can find antivirus.
[31:13.190 --> 31:18.290]  So you have some recent examples there.
[31:18.970 --> 31:30.350]  So in 2010, McAfee had some update that went crazy, went nuts and began to reboot every computer where you made that update inside.
[31:30.350 --> 31:43.870]  So a third of the hospitals in Rhode Island, in April 2010, reboot all the computers continuously until they pulled all the computers out of the network and updated all the software.
[31:44.430 --> 31:51.570]  So technically they sat down like a third of the hospitals in Rhode Island only for an antivirus update.
[31:51.570 --> 32:07.790]  Or more recently, I have some news about an antivirus deleting fetal monitoring data because the antivirus find like the log file of the computer was like strange and it decided that it was something dangerous for the computer and deleted it.
[32:07.790 --> 32:15.890]  So the baby was fine but they lost like the last nine hours of monitoring for that baby.
[32:17.430 --> 32:27.550]  Also you can find examples like CareFusion, the CareFusion company that makes ventilators was hacked by a simple SQL bug.
[32:27.550 --> 32:31.150]  Like this was, I think, two years ago.
[32:32.690 --> 32:34.570]  They got infected on their web page.
[32:34.770 --> 32:45.250]  So some investigator from the Massachusetts University went to the web page for downloading a firmware update because you can update your firmware of your implanted devices over the Internet.
[32:45.770 --> 32:47.770]  Like it was a router or something.
[32:48.450 --> 32:52.230]  And found an antivirus told him that the web page was infected.
[32:52.230 --> 33:04.790]  So this concrete vulnerability wasn't dangerous per se because this infection was related to another thing.
[33:04.990 --> 33:10.890]  So this was a typical virus looking for zombie computers.
[33:10.890 --> 33:24.290]  But if it was really malicious, they could find that you can download and anonymize the firmware that is infected, that has a different behavior that you would expect.
[33:25.110 --> 33:28.930]  And even on the web page for these people, they encouraged the patients.
[33:29.530 --> 33:34.970]  Their advice was simply click run when the file download security warning dialog box appears.
[33:37.090 --> 33:39.650]  So that's what they advised on their web page.
[33:40.190 --> 33:42.350]  So you could download a new firmware for your ventilator.
[33:42.490 --> 33:44.170]  That's what you need for breathing.
[33:45.450 --> 33:47.410]  And it's infected with a virus.
[33:47.770 --> 33:50.790]  The web page even says, ah, you don't mind, just download it.
[33:51.410 --> 33:56.010]  Open it and update your ventilator with some virus or something.
[33:57.850 --> 33:58.830]  So could I die?
[33:59.350 --> 33:59.810]  Yes.
[34:00.550 --> 34:01.150]  Yes.
[34:01.150 --> 34:01.530]  Yes.
[34:02.050 --> 34:02.130]  Yes.
[34:03.670 --> 34:05.810]  Almost every device...
[34:06.530 --> 34:06.950]  Okay.
[34:07.070 --> 34:09.350]  Every digital device you get has software inside.
[34:10.670 --> 34:12.310]  Every software has vulnerabilities.
[34:13.670 --> 34:22.450]  So you could expect that if that digital device is going to take care of your life, and it has vulnerabilities, you could die.
[34:22.450 --> 34:22.470]  Okay.
[34:24.370 --> 34:29.870]  So, a lot of people says that you will need some motivation for that.
[34:30.210 --> 34:31.370]  For killing people randomly.
[34:32.050 --> 34:36.030]  If you just have some kind of device vulnerable for this.
[34:36.330 --> 34:43.630]  So, on one side, never attribute to malice that which is adequately explained by stupidity.
[34:43.850 --> 34:44.010]  Sorry.
[34:44.930 --> 34:46.130]  This is hand-loss razor.
[34:46.130 --> 34:57.330]  So, almost every of those people that were responsible for those bugs were acting of pure good faith.
[34:57.870 --> 35:00.770]  So, they were programming software for taking care of you.
[35:00.970 --> 35:07.230]  They were programming some kind of radiation therapy machine for curing you of your cancer.
[35:07.230 --> 35:09.710]  The doctors weren't of good faith and the programmers.
[35:10.230 --> 35:13.530]  Theoretically, I should think that they were trying to do the good thing.
[35:13.670 --> 35:16.250]  But they were lazy or they didn't know.
[35:16.590 --> 35:20.030]  They just didn't know and didn't do it right.
[35:22.210 --> 35:24.990]  But you have to see what the FDA says about it.
[35:25.090 --> 35:29.490]  Software failures responsible of 24% of all medical devices recalls.
[35:30.850 --> 35:35.210]  So, I may think that this is really dangerous and this is a thing right now.
[35:38.290 --> 35:41.550]  On the other side, people need no motivation to cause damage.
[35:42.150 --> 35:45.270]  So, there are serial killers.
[35:45.570 --> 35:46.430]  There are crazy people.
[35:46.730 --> 35:47.470]  There are terrorists.
[35:47.850 --> 35:48.230]  There are...
[35:48.230 --> 35:48.590]  I don't know.
[35:49.370 --> 35:51.630]  Whatever crazy people you can find around.
[35:51.630 --> 36:06.850]  So, I have been told by some people that why would somebody investigate how to break an insulin pump or a cardiac defibrillator or whatever to kill somebody that he doesn't even know who is him.
[36:07.490 --> 36:08.430]  Just because.
[36:08.610 --> 36:09.570]  Because people lost it.
[36:09.710 --> 36:17.410]  So, we just cannot expect on good faith of people for not killing you if they have the opportunity to do it.
[36:20.950 --> 36:27.150]  I don't know if you can remember this, but you can remember the Chicago Tylenol murders from 1992.
[36:28.070 --> 36:37.950]  Some random people, I don't think they even caught him, decided to get Tylenol from the pharmacies, take it home.
[36:39.050 --> 36:39.610]  Sorry?
[36:41.050 --> 36:42.110]  I didn't hear you.
[36:42.650 --> 36:42.890]  Up.
[36:44.290 --> 36:46.330]  And fill it with venom.
[36:46.670 --> 36:47.890]  Put it back on the counters.
[36:48.590 --> 36:49.450]  And let people lie.
[36:49.610 --> 36:49.970]  Just because.
[36:52.110 --> 37:01.090]  So, you don't have to expect that people won't kill you just because you are not important or you have no enemies.
[37:04.290 --> 37:08.170]  So, you should adopt a common sense security practice.
[37:08.650 --> 37:17.790]  This is essentially for, I don't know, sysadmins, sysadmins in hospitals, or maybe people developing hardware or software for medical devices.
[37:18.870 --> 37:20.930]  But you have two problems here.
[37:21.230 --> 37:33.470]  So, on one side it's difficult, not only because it's difficult to make everything 100% safe, but because right now everybody wants to connect to every device.
[37:33.470 --> 37:45.090]  So, you have doctors who want to connect from their offices to the hospital network, from their iPads, from their iPhones, from their home computers for checking the last things that happened there.
[37:45.330 --> 38:01.130]  So, it's very difficult to contain every device on a separate network, on a secure network, and it's like a constant struggle to fight with them that maybe they don't need everything they want.
[38:02.450 --> 38:05.450]  On the other side, also, they won't let you.
[38:06.650 --> 38:08.830]  Because there are some problems with the FDA.
[38:10.970 --> 38:13.790]  There are some good things that the FDA says.
[38:14.310 --> 38:22.150]  FDA mandates you to get some certificates and pass some tests for getting your device to the market.
[38:22.490 --> 38:29.950]  But also, you cannot upgrade or update your device, like, because you have to do that you have found a problem.
[38:30.070 --> 38:41.810]  If right now you find a problem on, I don't know, an X-ray machine, again, or, like, the insulin pump or whatever, you cannot, as the maker, you cannot update the firmware.
[38:42.030 --> 38:46.030]  I would love that to the Internet and just push it to everybody.
[38:46.210 --> 38:58.530]  Because the FDA asks you to put all that firmware, again, to the test and have some bureaucracy going and call your lawyers and make some petitions and everything.
[38:58.710 --> 39:00.410]  And it could be delayed by months.
[39:00.610 --> 39:09.070]  So if you mix up that the medical companies are very close about this, and even if they wanted to do that, it's very difficult.
[39:10.270 --> 39:16.430]  You don't get, like, the last information about how is your medical device working.
[39:16.430 --> 39:17.930]  Also, liability.
[39:18.770 --> 39:23.550]  They don't want people to know that some of their devices can fail.
[39:24.650 --> 39:28.470]  So, what's happening about this?
[39:29.370 --> 39:36.150]  There are some initiatives, almost, like, public and private.
[39:36.950 --> 39:47.130]  FDA says it's developing techniques and laboratory expertise to assist our review staff in identifying potential vulnerabilities and evaluating risk mitigation measures.
[39:47.590 --> 39:50.030]  Like, a bit difficult to know.
[39:50.710 --> 39:54.270]  It's, like, very vague and I don't know.
[39:55.130 --> 40:09.850]  So, theoretically, they are trying to get every device they get for testing, for FDA, and do some kind of black box or white box consulting and finding errors on them.
[40:09.850 --> 40:16.170]  But this is not very concrete and they are not saying what kind of politics they have now for that.
[40:17.650 --> 40:20.330]  Also, we have the MOT database.
[40:21.490 --> 40:27.170]  The MOT database you can check online if you get the name and look for it on Google.
[40:27.970 --> 40:33.010]  It represents reports of adverse events involving medical devices since 1993.
[40:33.870 --> 40:36.030]  But this means every medical device.
[40:37.510 --> 40:48.090]  A medical device can mean a wheelchair, or it can mean a bed in the hospital, or a door in the hospital, or everything you can find there.
[40:48.190 --> 40:49.530]  This is, like, huge.
[40:49.910 --> 40:54.430]  Because every failure of something you can find there, you can find in the hospital, it's out loud there.
[40:54.430 --> 41:02.930]  And I was trying to look for concrete digital reporting of digital devices reporting there.
[41:03.230 --> 41:09.450]  And it's way, way, way difficult because you have no way of filtering that.
[41:09.710 --> 41:18.590]  And only for this year, I have found, like, 240,000 reports of adverse events.
[41:18.590 --> 41:26.510]  It could be your wheelchair broke a handle, or it could be somebody died for, I don't know, which malfunction of the device.
[41:28.570 --> 41:30.610]  There is another thing I like more.
[41:30.870 --> 41:35.190]  This is OMDRL, the Open Medical Device Research Library.
[41:35.490 --> 41:37.590]  This is done by the University of Massachusetts.
[41:38.370 --> 41:43.710]  The same guy that discovered the infected website is working on this.
[41:43.710 --> 41:53.290]  This is some kind of, I don't know, initiative that they have put together.
[41:53.590 --> 42:03.730]  So every implanted medical device that cannot be used anymore for a human, because it's already used, or failed it, or whatever, you can donate that.
[42:04.250 --> 42:06.110]  You donate every device there.
[42:06.350 --> 42:16.510]  So they take the devices, clean them, and on the other side, if you're an investigator, you can ask them to get medical devices and test them.
[42:17.450 --> 42:32.970]  You can borrow the devices for one year, and make every kind of security test, I don't know, over them for getting a paper, a paper about security, or maybe for just investigation, because you are worried about something on concrete.
[42:33.150 --> 42:35.670]  So you have to register on the webpage.
[42:35.670 --> 42:45.270]  You can also find with OMDRL where you can do this, and fill the forms, and ask for a device.
[42:45.450 --> 42:47.890]  You could even destroy some devices if it's needed.
[42:48.150 --> 42:57.090]  You just have to ask for a concrete device that is going to have, I don't know, a destructive test.
[42:58.070 --> 43:21.230]  So, by one side, you could say that there are some people doing things, but I'm very worried about the medical companies being so close, and the FDA being sometimes too hard on the information.
[43:21.230 --> 43:32.070]  And I would like, like the OMDRL people, some people opening and giving more access to the medical devices, and being more safe about it.
[43:32.850 --> 43:40.830]  So, you have seen this is like a general view, a general impression about how is it working right now.
[43:42.190 --> 43:49.450]  And letting Jorge finish, and you can ask some questions now, or maybe you have something more technical later.
[43:50.110 --> 43:52.350]  After we finish, you can reach us.
[43:52.750 --> 43:52.990]  Thank you.
[43:54.250 --> 44:01.790]  So, now you know why usually when people go to the doctor, you know, the doctor tells you, you've got a virus.
[44:02.890 --> 44:05.710]  When we go to the doctor, we tell the doctor, you've got a virus.
[44:07.530 --> 44:11.650]  And it's really not funny when we say that, because we know what could happen.
[44:12.630 --> 44:14.050]  So, what do we do?
[44:14.050 --> 44:26.810]  And I know some of you are thinking, okay, we'll just wait until George Bush goes to the hospital, and we play a little bit with the dose in the radiation machine, you know?
[44:27.830 --> 44:28.730]  And just to serve.
[44:28.970 --> 44:30.050]  But that's not what I mean.
[44:30.550 --> 44:32.290]  What do we do about this situation?
[44:34.930 --> 44:37.290]  A single-minded approach is usually wrong.
[44:38.070 --> 44:43.430]  So, if we expect, let's say government, to take care of us.
[44:43.650 --> 44:46.970]  I mean, your government, my government, any government, I don't care where you're from.
[44:48.330 --> 44:50.750]  Usually, if that's your only answer, that's wrong.
[44:51.070 --> 44:55.350]  I mean, and that's what happens when you get the FDA overloaded with work.
[44:55.550 --> 44:57.430]  I mean, they seriously overloaded with work.
[44:57.630 --> 45:00.350]  I got friends there, and they can't deal with anymore.
[45:01.070 --> 45:02.630]  And yet, they have all this information.
[45:02.810 --> 45:03.750]  They put it all on the web.
[45:04.030 --> 45:05.550]  It's not withholding anything.
[45:05.810 --> 45:08.450]  But they can't make it easy to work with that information.
[45:08.750 --> 45:10.250]  So, that information is really not good.
[45:11.790 --> 45:13.490]  You can't expect...
[45:13.490 --> 45:17.510]  So, the law may cover you, but up to some point.
[45:17.690 --> 45:27.690]  You can't expect, also, the law to cover everything and then make it so hard on device manufacturers that they can't even take a step with a mountain of bureaucracy.
[45:28.010 --> 45:30.210]  I mean, it would be invariable to them.
[45:30.950 --> 45:35.830]  So, shall we rely on the device manufacturers and the companies, companies like us?
[45:37.570 --> 45:41.130]  Not only because economic interest.
[45:41.630 --> 45:45.210]  I mean, you know the Dilbert comic strip.
[45:45.870 --> 45:51.890]  If you got to choose money, people, money, people, money, money, money, money, money, what?
[45:52.870 --> 45:54.970]  So, they're not going to think people.
[45:55.190 --> 45:57.890]  They're going to think customers, if anything.
[45:58.870 --> 46:00.290]  And most likely, they're only going to think money.
[46:01.690 --> 46:04.070]  Shall we rely on the user?
[46:04.510 --> 46:10.870]  Should doctors become technology experts and know every vulnerability, know how to close them, know what to do?
[46:12.290 --> 46:13.030]  Not only.
[46:13.270 --> 46:14.570]  You can't expect that.
[46:14.770 --> 46:16.350]  I mean, the guy spent...
[46:16.870 --> 46:19.910]  God knows how many years in college to get that degree.
[46:19.910 --> 46:22.970]  And now he's too busy finding where to park his Ferrari.
[46:23.130 --> 46:26.830]  I mean, you know, delivering care to the patient.
[46:27.570 --> 46:31.170]  He's not going to spend hours and hours reading technical magazines and stuff.
[46:31.290 --> 46:31.970]  And that's understandable.
[46:33.210 --> 46:36.330]  Do we rely on the hospital IT people?
[46:38.190 --> 46:38.910]  Not really.
[46:39.610 --> 46:42.210]  Because they also are overloaded with work.
[46:42.410 --> 46:43.470]  I mean, this is like a mountain.
[46:43.590 --> 46:45.150]  It's coming to them at full speed.
[46:45.150 --> 46:49.570]  All of a sudden, like Alvaro said, doctors want to connect their iPhone to their iPad.
[46:49.730 --> 46:50.890]  And their iPad to their iMac.
[46:51.010 --> 46:52.210]  And their iMac to the PC.
[46:52.330 --> 46:54.870]  And the PC to the hotel's laptop.
[46:54.970 --> 46:56.690]  And the hotel want to connect to the conference.
[46:56.810 --> 46:57.910]  And the conference to the hospital.
[46:57.970 --> 46:59.750]  And the hospital to the medical device.
[47:00.010 --> 47:01.130]  And you think I'm joking?
[47:01.590 --> 47:02.490]  I've seen that happen.
[47:03.470 --> 47:05.110]  I've had a customer asking for that.
[47:05.270 --> 47:07.690]  And I say, just for the fun of it, could you repeat that?
[47:10.150 --> 47:11.950]  And the problem is only gonna get bigger.
[47:12.330 --> 47:14.930]  I mean, there's gonna be more devices, there's gonna be more things connected.
[47:15.350 --> 47:23.110]  Just so you have a picture of... Do you know how big a typical hospital server only for imaging is?
[47:23.410 --> 47:29.250]  Our average customer has between 50 and 70 terabytes in the server.
[47:29.370 --> 47:32.850]  I mean, working images, working memory.
[47:32.970 --> 47:33.830]  This is not just in case.
[47:34.290 --> 47:36.650]  I mean, they're working, they're dealing with this kind of information.
[47:36.650 --> 47:37.830]  That's today.
[47:38.810 --> 47:46.370]  The growth is exponential, but we just introduced a new software that allows you to do that with pathology images.
[47:46.610 --> 47:47.750]  Digital pathology images.
[47:48.530 --> 47:54.410]  Which means their servers are gonna be multiplying by 100 within months.
[47:57.050 --> 48:00.690]  Just picture all that information, all those servers, all those connections.
[48:01.030 --> 48:03.130]  So it's not gonna happen single-handedly.
[48:03.430 --> 48:10.570]  If I had to give a magic receipt, I'll say, hack the hell out of hospitals.
[48:11.530 --> 48:15.030]  Every time you're near a hospital, hack the hell out of it.
[48:15.730 --> 48:19.230]  And please forgive me if you work for a hospital IT department.
[48:19.690 --> 48:21.650]  You know, I sympathize with you.
[48:21.890 --> 48:22.710]  You're my customer.
[48:22.870 --> 48:23.390]  I love you.
[48:24.410 --> 48:25.990]  If you've got problems, talk to me.
[48:26.170 --> 48:26.890]  I can help you.
[48:27.550 --> 48:27.970]  But...
[48:28.770 --> 48:30.190]  Oh, no, it wasn't a sales page.
[48:30.330 --> 48:30.430]  Sorry.
[48:31.810 --> 48:35.530]  But seriously, I think we have to take responsibility.
[48:36.090 --> 48:43.390]  As customers, as users, as people, we have to stop looking at big daddy.
[48:43.610 --> 48:47.070]  Whether it be government, be the hospital, be the IT administrator.
[48:47.770 --> 48:48.530]  Let's take responsibility.
[48:48.530 --> 48:55.670]  I mean, this electronic medical record talk that you've been hearing about, the Google Health went in, Google Health came out.
[48:55.810 --> 48:57.070]  Because what a mess.
[48:57.290 --> 48:58.590]  You know, we're never gonna make it work.
[48:58.730 --> 49:00.450]  Basically, who wants to mess with Cerner?
[49:02.310 --> 49:07.130]  So the new approach is let everybody take care of their own medical data.
[49:07.310 --> 49:09.110]  And let's find a way to interconnect all that.
[49:09.330 --> 49:14.690]  But let's make people accountable for their data so they can keep it, so they can keep it secure, so they can have control of it.
[49:14.690 --> 49:15.550]  That's the key.
[49:15.870 --> 49:26.370]  We gotta press everybody involved to open up their data, to open up their plans, open up their devices, share the information, share the vulnerabilities, share the patches.
[49:27.070 --> 49:28.570]  Teach us how to close that.
[49:28.950 --> 49:30.430]  Let's engage in a conversation.
[49:30.630 --> 49:31.330]  Let's keep it open.
[49:31.510 --> 49:33.810]  That way, we can move at a faster speed.
[49:34.010 --> 49:35.990]  I mean, that's what we've been doing on the Internet, right?
[49:36.570 --> 49:40.210]  I mean, that's why nobody else is using Explorer anymore.
[49:41.370 --> 49:42.390]  That's what we gotta do.
[49:42.850 --> 49:53.490]  If somebody is gonna go down the gutter because when they open their information, we will learn that 200,000 of their devices failed and a lot of people died, I'm sorry for them.
[49:53.810 --> 49:54.870]  But that's what we need.
[49:55.090 --> 49:55.830]  We need to know.
[49:56.310 --> 49:59.710]  And in order to know, we need to ask for it, because they're not gonna give it to us.
[49:59.710 --> 50:03.790]  So that's personally my advice, but I'll leave it open to your questions.
[50:03.990 --> 50:04.250]  Thank you.
[50:05.770 --> 50:06.070]  Okay.
[50:06.350 --> 50:06.930]  And I've
[50:12.480 --> 50:22.600]  been pointing out the severity of the, you guys can imagine waking up tomorrow morning, you read the 757 crack, fall, fall, fall, shut, we're all gonna guess that.
[50:22.920 --> 50:23.980]  You'd be sad, right?
[50:24.960 --> 50:26.760]  And Sunday morning, they went the same.
[50:27.280 --> 50:28.680]  And Monday, and Tuesday, and Wednesday.
[50:29.440 --> 50:33.600]  As the equivalent amount of people died in our hospitals across this country.
[50:33.800 --> 50:34.860]  Every single day.
[50:35.260 --> 50:40.720]  The equivalent of losing a 757 due to the states like the one you're articulating,
[50:44.880 --> 50:47.120]  This is a really severe problem.
[50:47.540 --> 50:49.560]  And I didn't just pull that out of my rear end.
[50:49.700 --> 50:55.600]  That's a quote from Randy Stratt, who's the CIO of Chessing, the largest self-care provider in this country.
[50:57.200 --> 50:58.420]  Yeah, you're completely right.
[50:58.760 --> 50:59.280]  Nothing to add.
[50:59.880 --> 51:00.720]  I'm sorry, first...
[51:01.200 --> 51:01.640]  So,
[51:19.790 --> 51:21.570]  just speaking of that, not on
[51:34.190 --> 51:40.850]  a dialysis machine, for example, and you need dialysis in your home, you have an IO port installed in your bottle.
[51:40.850 --> 51:44.970]  And the thing with that is, there are different standards, right?
[51:45.870 --> 51:48.270]  AT5, AT6, you know, BOATs, all that stuff.
[51:48.430 --> 51:50.950]  Well, there's different standards for what plugs into you, too.
[51:51.350 --> 51:55.570]  And if you go to the wrong hospital, they don't have the equipment that plugs into what you got.
[51:55.990 --> 51:57.150]  You could die from that.
[51:57.670 --> 52:03.350]  So, you know, does it make sense to start maybe talking about a movement to open-source some of the hardware?
[52:03.610 --> 52:16.690]  And just so that, as you said, you know, we can open-source the software, we can eliminate some of these issues, Yeah, you might have heard about these 3D printing blood vessels that have been inserted into a person's body.
[52:17.130 --> 52:17.630]  I mean, that's the future.
[52:17.730 --> 52:19.350]  You'll print your own kidney when you need it.
[52:19.870 --> 52:22.790]  Most likely you won't be able to put it in, but at least you'll have it.
[52:22.990 --> 52:24.990]  But yes, I agree with you completely.
[52:25.130 --> 52:28.710]  Open-source, not only software, not only opening the information, but opening the hardware.
[52:29.450 --> 52:30.170]  Completely agree.
[52:31.590 --> 52:33.830]  There are more questions, but we've got to finish.
[52:34.310 --> 52:35.550]  But we'll be out there.
[52:35.830 --> 52:38.030]  So we'll be more than happy to talk to any of you.
[52:38.210 --> 52:38.710]  Thank you.