How an Obsolete Medical Device With a Security Flaw Became a Must-Have For Some Patients With Type 1 Diabetes (theatlantic.com) 124
From a report on The Atlantic: In 2014, a few hackers realized that the security flaw in certain Medtronic pumps could be exploited for a DIY revolution. Type 1 diabetes is a disease where the pancreas is unable to produce insulin to control blood sugar. For years, Boss (the anecdote in the story who purchased used insulin pumps from some dealer on Craiglist) had counted, down to the gram, the carbohydrates in every meal and told his pump how much insulin to dispense. [...] By 2014, the hardware components of a DIY artificial pancreas -- a small insulin pump that attaches via thin disposable tubing to the body and a continuous sensor for glucose, or sugar, that slips just under the skin -- were available, but it was impossible to connect the two. That's where the security flaw came in. The hackers realized they could use it to override old Medtronic pumps with their own algorithm that automatically calculates insulin doses based on real-time glucose data. It closed the feedback loop.
They shared this code online as OpenAPS, and "looping," as it's called, began to catch on. Instead of micromanaging their blood sugar, people with diabetes could offload that work to an algorithm. In addition to OpenAPS, another system called Loop is now available. Dozens, then hundreds, and now thousands of people are experimenting with DIY artificial-pancreas systems -- none of which the Food and Drug Administration has officially approved. And they've had to track down discontinued Medtronic pumps. It can sometimes take months to find one. Obviously, you can't just call up Medtronic to order a discontinued pump with a security flaw. "It's eBay, Craigslist, Facebook. It's like this underground market for these pumps," says Aaron Kowalski, a DIY looper and also CEO of JDRF, a nonprofit that funds type 1 diabetes research. This is not exactly how a market for lifesaving medical devices is supposed to work. And yet, this is the only way it can work -- for now.
They shared this code online as OpenAPS, and "looping," as it's called, began to catch on. Instead of micromanaging their blood sugar, people with diabetes could offload that work to an algorithm. In addition to OpenAPS, another system called Loop is now available. Dozens, then hundreds, and now thousands of people are experimenting with DIY artificial-pancreas systems -- none of which the Food and Drug Administration has officially approved. And they've had to track down discontinued Medtronic pumps. It can sometimes take months to find one. Obviously, you can't just call up Medtronic to order a discontinued pump with a security flaw. "It's eBay, Craigslist, Facebook. It's like this underground market for these pumps," says Aaron Kowalski, a DIY looper and also CEO of JDRF, a nonprofit that funds type 1 diabetes research. This is not exactly how a market for lifesaving medical devices is supposed to work. And yet, this is the only way it can work -- for now.
Re:planned obsolescence (Score:4, Insightful)
This could have been done by the manufacturer the day they sat down with the design
The FDA would have never approved a device that was designed to be programmed by users, and Medtronics would have been sued out of existence by the first user killed by a bug.
Free software for freedom to run one's life. (Score:3)
Contrary to the manufacturers of cars, say, which were until rather recently far more under the control of the owner than they are today and yet somehow cars are still being manufactured. The shift toward putting proprietary software-controlled cars in drivers' hands isn't out of fear of projected liability, it's out of a desire for more control over the user and acclimating users to that lack of freedom over their own lives. It's better to push for freedom to run one's own life and that means valuing softw
Re: (Score:2)
Which is the reason the FDA should be driven out of existence. The fact that it exists as a gatekeeper vs an advisory board drives the cost of healthcare higher with no corresponding benefit. I've worked and a regulated health company, and the only word to adequately describe the expensive and pointless hoops necessary to release a product is "stupid".
All Medtronics should have to do to avoid the lawsuit is demonstrate how the machine was used outside of its designed purpose. The fact that our product li
Re: (Score:2)
The blue states are blue because their leftist population is the one calling for ever more government "protections". The blue-state mouthbreathers are the ones at fault in this situation. Your pull request has been declined.
Re:planned obsolescence (Score:5, Insightful)
Type 1 diabetes can't be cured. These people using these pumps are not being cured. There is certainly money to be made for a company that produces a closed-loop system for treating type 1 diabetes in closed loop fashion! So your argument may be applicable to some cases, but does not seem to be applicable here.
Re:planned obsolescence (Score:5, Informative)
Besides, Medtronic has actually introduced one fairly recently. It's simpler to use than openAPS (it uses a specific new medtronic pump and medtronic continuous glucose sensor and no other hardware), but it's also less customizable, very paranoid (it only runs closed-loop in fairly specific conditions), and I'm sure the pump isn't cheap. Still, it's a genuine quality of life improvement for people still using normal pumps (or, heaven forbid, pens).
Re: (Score:3)
Look man, I'm OSS-pro as much as the next Slashdotter, but there is a reason that some proprietary software exists. When a "tweak" and "automatic update" to an algorithm can kill thousands of people inside of a day, you have to be careful. Someone has to be responsible.
I get it, the OSS people above are taking that responsibility for themselves. Whew - that is a big dose of it. I'm a pretty good programmer, but I don't know that I would trust my life to something I programmed... Or an OSS package from
Re: (Score:2)
Alas, I'm stuck with pens. No Type 1 diabetes (for which my insurance would pay for the pump and CGM), but no pancreas either. So I do it the old-fashioned way. Very annoying to have to plan any physical activity in advance, so I can keep my blood sugar from dropping through the floor, or going sky-high....
Re: (Score:2)
The Medtronics system sells for $7,000
A pump that the user can controll could be bought from Africa for $2,000
Why the discrepency? $5,000 would improve my quality of life.
Re: (Score:2)
If they can afford it. If not, it might as well not exist as far as they are concerned.
Re: (Score:3)
Re: (Score:2)
LASIK and plastic surgery are also cheap because they are elective. If it's too pricy, people will go with contacts and make-up.
If you could make all medical procedures elective, they would get cheaper too.
Re: "Can't be cured." Like... EVER? ... Bull-shit! (Score:5, Insightful)
It annoys me to no end that so many people believe "I have seen with my own eyes" is a meaningful statement.
Re:"Can't be cured." Like... EVER? ... Bull-shit! (Score:5, Informative)
It annoys me to no end, that people confuse symptoms with a disorder.
You did not, in fact, see someone cure their dairy allergy. You saw their symptoms fade when they stopped triggering them.
Auto-immune disorders are when the immune system overreacts to a trigger, and starts attacking one's own body, instead of foreign pathogens. It is a well-known and generally-accepted method of treatment to limit exposure to those aggravating triggers, and symptoms will eventually settle down. The lucky folks can then live a mostly-normal life by avoiding that one allergen.
None of that is remotely relevant to type 1 diabetes. "Diabetes" as a whole is when the body doesn't respond to insulin as it should, causing lots of symptoms that stem from being unable to move glucose from the bloodstream into cells. It is not an auto-immune disorder (though an auto-immune disorder might be involved).
In type 2 diabetes, the insulin itself is fine, but the cells don't react to it properly. This can be due to poor nutrition or obesity. It starts off mild, and progressively gets more severe as the cells respond less to the same amount of insulin.
Type 1 diabetes is worse. The pancreas doesn't make insulin at all, or enough, or the insulin it does produce is defective. There is no real cure, because in many cases, the pancreas itself is physically damaged, often from birth. Sometimes it's a gestational defect. Sometimes it's genetic. Either way, it's not an immune-system reaction to something that can be avoided. It's not something a particular drug will kick back to normal. It's a permanent condition, most tragic because it usually appears in children.
Type 1 diabetes has a cause. You can get it; You can be cured from it. Let's find out what!
You don't really "get" type 1 diabetes. The current medical theory (at least, the last I heard) is that the conditions start from day 1, and its symptoms show up gradually through childhood as the pancreas shuts down. That shutdown can be the result of an auto-immune attack, but it's irreversible. The cellular structures to produce insulin are dead and gone.
Currently, the only avenue to a cure is to transplant in a functional organ.
(First try no refined carbs, enough prebiotics [aka complex carbs], no heated dairy. For 10 years. In a proper study. Then, if that fails, we can try other stuff.)
Changing the diet won't help. Reducing one's carbohydrate intake will reduce the amount of glucose in the bloodstream, which might make it easier to control glucose levels, but it's not going to rebuild the pancreas. To do that, you need to have an understanding of precisely what's damaged, how it grows, and how to cause it to rebuild. That's actually what real researchers are studying, trying to understand routes for an actual cure.
On the other hand, it seems like you don't actually want a cure for diabetes. You named off a few fad diets, which coincidentally cover your anecdotes, as well. At best, you're randomly picking a treatment with no evidence, in the hope that something works. You might as well suggest applying leaches or smelling more flowers. Really, I suspect that you're looking to blame any illness of the day on carbs and heated dairy, because that's your pet evil right now.
Let's be ultra-pendantic! (Score:4, Interesting)
You want pendantic? I'll bring you pedantic!
The above statement is sloppy, which seriously compromises your criticism of the previous poster for being sloppy. (Even though your criticism is basically valid and much less wrong that its predecessor.)
Diabetes is when the insulin-mediated absorption of glucose from the bloodstream doesn't work as it should, leading to high blood sugar levels.
Nope. You're all wrong! (from the extremely pedantic point of view. Otherwise you're actually more or less okay)
The high levels of blood sugar aren't the definition of diabetes...
Diabetes literally means to pee [wiktionary.org] (a lot) because that was the symptom that was noted in the antiquity.
Having the glucose metabolism fucked up is *one* of the possible physiopathological mechanism causing it (with type I and II being differences at which step of the loop there is problem). That's why one of the family of Diabetes, the one which all people usually speak about is called Diabetes mellitus (sweet diabetes, i.e.: you pee a lot of sweet pee).
There's an entirely different family of Diabetes, called Diabetes insipidus (bland diabetes, ie.: you also pee a lot, but it's mostly water, no sweets). These diabetes are due to the system regulating volume and electrolyte being broken.
It just boils down to the history of medicine. Diabetes was called so, because people came to the doctor complaining that they pee abnormal quantities. Doctors, with the rudimentary means back then, when investigating the diseases, noticed that the sugar content was different between the cases and decided to make a distinction between the sweet and the insipid variants, because it also made sense from the dietary recommendation that suited best each case (e.g.: the *sweet* diabetes is the one where the patient would better avoid eating sweets and bread. The same recommendation doesn't work with somebody having the other type).
Eventually modern medicine brought much more possibility to investigate the physiopathological process in much more details, and helped us understand better the diseases and treat them better. But for historical reasons we kept the "Diabetes" part in the name of all "pee-a-lot" diseases.
And yes, nowadays, Diabetes Mellitus is usually defined by the high levels of blood glucose. I'm just playing the pedantic game with regard to the diabetes name.
(Disclaimer: before university, back in high school, I studied latin, greek and linguistics)
Re: (Score:3)
Re: (Score:2)
Re: (Score:1)
Type 1 Diabetes kills all of the beta cells in the person's body, rendering the pancreas unable to produce insulin. I have had it for 25 years now. If you were to treat my immune system so that I no longer produce the T-cells that targeted and killed my insulin producing cells, you would still be left with a non-functioning (for the purposes of insulin production) pancreas. You will have cured the cause of the T1 Diabetes, but not the results.
You can "cure" T1 diabetes like you "cure" liver failure. Transpl
Re: (Score:1)
Re: (Score:2)
And a government regime of FDA regulators has nothing to do with that failure?
Sure thing.
Re: (Score:2)
Actually, this is an interesting case.
In America, the innovators are using the socialist forces of the FDA to protect their monopolies. Meanwhile, the socialist universal healthcare forces of the European's have been falling down under their own weight, and opening the doors for smaller players to innovate.
The loopers have been getting their equipment from overseas, because the authoritarians (oligarchs and socialist are equal in this regard) have locked down the American market.
Re: (Score:2)
Well, not the only way (Score:2)
And yet, this is the only way it can work in the U.S. -- for now
There you go.
Re:Well, not the only way (Score:4, Informative)
Nope, that's not correct either. Medtronic has had a pump (670G) out for 3 years now that is combined with a continuous blood sugar monitor will automatically adjust your basal rate. Having had this pump since it came out I can tell you that my A1C dropped from 9 to 6.8 in less than 6 months. This device was available overseas before the US but only for about 6 months.
Don't get me wrong. This is good news for people that have older devices for whatever reason and want to try to take advantage of some of the ways these guys have been able to get them to behave. The Auto mode alone is life changing and does provide for better overall control of blood sugars instead of always trying to guess.
Re: (Score:2)
Re: (Score:1)
Amatures will kill someone, sooner or later.
It won't necessarily be the user/hacker. He could hit someone with his car when he passes out.
Re:Gambling with health. (Score:4, Interesting)
Re: (Score:2)
So no professional every killed someone? The statement professionals will eventually kill someone is equally as true.
The difference is the rate at which they will kill people. The professionals are required to go through a great deal of review and testing. The amateurs, not so much.
The question is are you less likely to kill someone, by having this technology it as opposed to not having it.
No, the question is are you less likely to kill someone by having this technology hacked by amateurs as opposed to not having it.
Except that "not having it" is a strawman, since Medtronic is selling a "professional" model, and not having access to it is a financial barrier caused by our insane beliefs about healthcare.
Re: (Score:2)
I don't have to go far for a counter example: user/hacker Richard K. Bernstein pioneered modern at-home blood glucose monitoring and a modern diabetes diet. The experts were wrong. The experts were killing people with bad advice and by not trusting them.
The hacker improved the lives of millions.
Medical Device Testing and Regulatory Clearance (Score:5, Informative)
While medical devices are much less tightly scrutinized than drugs (it's a lot easier -- but slow), the companies that create them need to test them, record them, and insure against customers adverse experiences (both reducing the risks and insuring against damages).
It's not cheap, and it's not quick, and with insulin pumps being a commodity, there's not a lot of incentive to innovate.
I'd be very cautious about using a completely automated, closed-loop system that hasn't been through extensive testing and validation. What if there's a problem with the sensor and it keeps feeding you more and more insulin, thinking your glucose level is too high, or cuts you off thinking the glucose is already low when it isn't? You need to monitor, set limits, etc., which patients may not be patient enough to do. An app that interacts with the system, records trends and has alerts would be a good step (then your phone becomes a regulated medical device too).
This is why we should be spending more tax dollars on research (and fewer on the military) - an NIH-based study, that requires reasonable prices for these upgrades to the pump and glucose monitor, yet is backed by the support of the manufacturer, _should_ show benefits to public health: fewer diabetic comas, fewer patients with long-term damage, etc. More FDA Center for Devices and Radiological Health reviewers would help too.
Note: I am not a physician nor a manufacturer of drugs or medical devices, but I work with the companies that do to get them approved.
Re:Medical Device Testing and Regulatory Clearance (Score:5, Insightful)
In fact, there should be multiple glucose sensors and the loop should only continue while the sensors agree. Otherwise, it should alarm and switch over to manual control.
Re: (Score:2)
Yes, you wouldn't want your pancreas to be found floating in the ocean off Indonesia or in an Ethiopian field.
MCAS (Score:2)
A Boeing jet analogy?
Re: (Score:2)
I assumed that medical devices would be designed the same way if they are acting autonomously. Not an analogy to Boeing. Just a best practice that should cover either industry.
Re: (Score:2)
While those are great arguments against a second sensor, they are equally great arguments against using an automated dosing system.
The sensors would clearly have to be smaller (and probably could be). You aren't trying to get increased accuracy - you're trying to see if the margin of error between them is close enough to allow automated dosing. If the readings are awry - you do NOT want to dose anything and the user needs to know, measure with a glucose meter and self-medicate.
Re:Medical Device Testing and Regulatory Clearance (Score:5, Informative)
inevitable (Score:3)
On the other hand, fast tracking means that it'll take a few years instead of a decade+. To the people who are doing this now and demonstrating the usefullness, I salute you. On the other hand, there's a reason for the FDA. If a sensor goes bad, you're dead. FDA approved devices have failsafes and redundancies that account for stuff like this... and jack up the price.
Re: (Score:1)
The same company already makes and sells an insulin pump with a continuous glucose sensor. I'm sure it's a bit more expensive than a DIY hack, but probably safer.
Right to try, right to hack? (Score:5, Interesting)
After a number of states passed "right to try" laws allowing terminal patients to experiment on themselves with compounds that have passed only Stage 1 testing (for non-toxicity) for compounds in the FDA pipeline, right-to-try was passed at the federal level last year. Although in practice there are not many compounds in test that are available for experimentation in this way, it's a concept that could easily be extended to self-experimentation using hacked medical devices.
Let's include a stipulation that users log results that would be made available as ancillary data for medical trials. There's no such thing as too much experimental data.
Garbage in, garbage out (Score:3)
Poorly collected and annotated data can be worse than none. And it's hard to tell the difference between the two, once said shit data is integrated into the whole.
Re: (Score:1)
I love seeing Medical Attitude on display. Assuming that everybody other than yourself is stupid is not how you make new technical breakthroughs. It's ancillary data, not formal experimental data, to be taken with the appropriate amount of sodium chloride.
Re: (Score:3)
Re: (Score:2)
He (or she) was just told that he was to stupid to take accurate notes. I think it was the GP making assumptions, and Applehu Akbar's anger appears to be righteous.
Re: (Score:2)
Need to take the profit out of healthcare! (Score:1, Offtopic)
Need to take the profit out of healthcare!
Re: (Score:2)
Yeah, then we can stop people from experimenting with unapproved stuff like this at all! We can rely purely on the elite and super-smart government bureaucrats who are paragon's of moral good intentions and only have our best at heart to decide everything for us instead! They may take decades to allow people to heal themselves or deal with their symptoms, but if anything goes wrong they'll at least have a really long paper trail to determine who to blame and it won't be them!
In fact, you should take the pro
Re: (Score:2)
We're not terrified, and we know what to do.
We elected Trump. Remove two regulations for every one created. And, he has been fighting back against the Chinese, if you haven't noticed. Now, we grab pussies.
Re: (Score:1)
Indeed. If there were no profit then there would be no pumps at all and thus no bugs, and no hackers. Problem solved! \(o_o)/
I have both the old (hackable) and new pump (Score:2)
I am using the new pump with sensor and it provides only very limited feedback. It has a hard limit of 25 units bolus (old pump could do 40) which is very limited for me. When I finish my contract with Medtronic for sensors I'm going to experiment with this.
Re: (Score:2)
Black Hat Conference 2011 (Score:5, Interesting)
I've been looping for several years now, and the results are amazing. It's way more effective than any other therapy I've used (way better control, better A1C), but more importantly I now have a hardware solution that offloads about 100 decisions per day from my life. That part is truly life changing.
Unfortunately, my current device is held together with duct tape, and it's unlikely that any new hackable devices will be brought to market. I expect it will be 10+ years before the commercially supported devices provide the same control I've enjoyed from a home-built solution, since the manufacturers are understandably conservative/risk-averse.
Re: (Score:2)
Thanks for your first hand perspective. Are the devices mechanically or electrically complex? I.e. is it feasible to build one from scratch?
Re: (Score:1)
They charge a lot for the devices, but a lot of that cost goes into patient training before they hand over a high-risk medical device.
Re: (Score:2)
Well, I have some good news for you!
https://loopkit.github.io/loop... [github.io]
Re: (Score:1)
If you read this... (Score:1)
If you read this and don't think the healthcare situation in the US is fucked up, then you're in a coma. Maybe a diabetic coma.
Re:Diabetes (Score:5, Informative)
Type 1 diabetes is not related to sugar consumption. It is an auto-immune disorder where the cells in the pancreas which produce insulin are damaged, rendering the sufferer unable to regulate blood sugar.
Re:Yeah, and auto-immune diseases can be cured too (Score:4, Interesting)
Mind, the problem with type 1 diabetes is that it kills a family of cells that don't seem to regrow; it just doesn't have the same type of spontaneous remission as those do. Imagine if psoriasis killed all your skin cells and immediate predecessors dead, and you have a comparable problem. The default state of an untreated type-1 diabetic living an otherwise healthy, natural, lifestyle is "dead", sadly.
As far as we can tell, t1d is related to some specific immune gene mutations triggering on ... something. One idea I've heard is that the trigger in predisposed individuals is some normal and otherwise neutral/good intestinal flora that just happens to look vaguely like a pancreatic cell marker, and that the increased amount of type 1 diabetics is a side effect of some random mutation in that bacteria that makes it look more so than it used to.
That said, there are ideas out there. Using something like CRISPR to induce a different set of cells to produce insulin in response to glucose (e.g. in the intestines) has been suggested, and would change the routine from "insulin every few hours" to "drink some virus solution every few months". Breeding new insulin-producing pancreatic cells and finding a way to encapsulate them so the immune cells don't get to them has been studied. A research department around here is testing if some specific antiviral treatment in the early phase (where you still make _some_ insulin) could stave off full onset for a while, though I'm not sure what their working theory is.
Re: (Score:2)
Dairy is not harmful if you are are not lactose intolerant, stop reading anti-science blogs.
Re: (Score:2)
You are clearly confusing the disease with the symptoms. They are not the same. FWIW identical symptoms can result from totally different diseases, and conversely the same disease can manifest as quite different symptoms.
So, yes, if you avoid something that you're allergic to, the allergic symptoms will not be triggered by it. This is no surprise to anyone, but it's hardly a cure. I have a nephew who MUST avoid being bitten by ants or stung by bees. He's been avoiding this for over a decade, but this i
Re: (Score:2)
Re: (Score:2)
also Capuchins don't like to live underground and they engage in sex.
Re: (Score:2)
With other monkeys. you need to clarify that in this case.
Re: (Score:2)
Also relevant:
"Never monkey with another monkey's monkey."
Strat
Re: (Score:2)
Well, you've got both the wrong disease, and the wrong cure. The disease you're thinking of is type 2 diabetes, and even then you're wrong. You need, instead, to stop having eaten sugary crap. Also highly processes starches. But do note the tense change, as that's quite significant. Once you have diabetes there is no current cure. I suppress the disease by avoiding all sugar and almost all starches...but I still need to take medication. AFAIKT the diabetes is not progressing now that I've changed my
Re: (Score:2)
Re: (Score:2)
For every careful and thoughtful hacker, there will be one or more nut-cases or greedy hackers whose actions may put people into the emergency room. Look at what the anti-vaxer movement is doing.
It may solve some important problems, but a lot of human guinea pigs may be harmed the process. I'm not saying it surely won't help on aggregate, I'm just saying there is a lot of potential risk in opening the doors. We don't really know.
I would hope that patents not be overly broad so that various companies can ma