Tomorrow is the big day.  I will be getting a new implantable cardioverter defibrillator (ICD).  It’s been almost eight years since my original implantation.  So technology has changed.  As noted before, I’ll be getting a Medtronic Virtuoso.  And this device comes equipped with wireless management technology.
The potential benefits of using wireless technologies in this application are staggering.  During implantation, there is no need to put anything in the sterile field except the doctor’s hands and the device that will be implanted.  And I’m already using Medtronics remote care and management services (trademarked as CareLink).  But the latest generation of CareLink will allow the doctor to obtain vital information almost immediately.
But the benefits aren’t without downside risks.  First and foremost, I wonder what it would take to hack this new device.  Using the MICS frequencies helps; I won’t be subject to WiFi hacking!  😉  But if I ever become famous or important, I wonder just how high the barrier would be to hijacking either the “information channel” or the “control channel” for this device.  I give Medtronic a great deal of credit for addressing these matters.  But I wonder how safe these systems truly are.
In candor, if someone wants my data, there are easier points of attack.  First, my cardiac data is on traditional computing systems managed by Medtronic.  And the data will be available from my CareLink unit, the data in my cardiologists office and also at Medtronic’s facility.  It would be far easier to hack these systems (either via frontal assaults or via social engineering) than it would be to directly hack the source of my data (i.e., the device in my chest).  And I’m sure that there are plenty of people that handle my data such that social engineering assaults are both plausible and low-cost.
But as of tomorrow, my abstract concerns become practical considerations.  Here’s hoping that none of my teenage neighbors get any fanciful ideas about hacking my heart! 😉  I just wish that I could add a few layers of additional security.  For example, I  would require using a VPN to access my device.  And my device would only be  accessible via an additional token of my choosing (and via a CA I choose).  But I really don’t want to see if this is possible as it would strip the veneer of confidence that I’ve meticulously constructed!
-Roo