5 ms·
Absolutely NOT because this could kill people. If you truly have a pacemaker 0day, contact me (joelparkerhenderson) on most major service and I will connect yo
by jph 12y ago
Absolutely NOT because this could kill people.
If you truly have a pacemaker 0day, contact me (joelparkerhenderson) on most major service and I will connect you with my healthcare policy lawyer. She can rapidly open the doors to the vendors who have the risk.
- iandanforth 12y agoDo most medical device manufacturers carry insurance against lawsuits? If so, historically, how high has the bar been before the insurers pay out? If there is a strong relationship between a device manufacturer getting sued and an insurer losing money then this could be a great contact to try.
- seehafer 12y agoYes, but more importantly, medical device makers have broad immunity when their devices go through the PMA process (the most stringent type of FDA approval). Basically, the argument is "hey, the FDA said it was safe".
- dsuth 12y agoThen this is where the pressure needs to be applied - at the certification process. It needs to be made a legal requirement to attain certification (if not already), and the certifiers need to follow best practices for vulnerability detection. And it needs to be an ongoing, open process.
- niels_olson 12y agoYes, the FDA certification should include something along the lines of "Manufacturer has an ongoing process to evaluate new vulnerabilities and push updates to affected individuals."
- seehafer 12y agoIt does, at least for new approvals post ~2012. Doesn't help existing devices in the field though.
- drcode 12y agoThe question isn't whether it could kill people, but whether it would kill fewer people than not releasing the exploit. (Though even if you were sure fewer people would die it would still be an ethical conundrum)
- sliverstorm 12y agoAnd how exactly does he determine whether that is the case?