{ "schemaVersion": "deck-intelligence.v1", "id": "019dd923-622c-750b-8b96-76efb5813bae", "slug": "8ff52fe302da", "title": "St. Jude Medical (STJ)", "subtitle": "Carson C. Block · 2016-08", "author": "Carson C. Block", "date": "2016-08-25 00:00:00", "pageCount": 34, "kind": "research-note", "orientation": "portrait", "aspectRatio": 0.77272725, "targetCompany": "St. Jude Medical", "targetTicker": "STJ", "document": { "id": "019dd923-622c-750b-8b96-76efb5813bae", "slug": "8ff52fe302da", "title": "St. Jude Medical (STJ)", "rawTitle": "MW STJ 08252016 2", "authorId": "51_Muddy_Waters", "authorName": "Carson C. Block", "authorDisplay": "Carson C. Block", "kind": { "slug": "research-note", "label": "Research note" }, "sourceType": { "slug": "short_seller", "label": "Short seller" }, "fileName": "2016-08-MW_STJ_08252016_2.pdf", "sourceUrl": null, "sourceDate": "2016-08-25 00:00:00", "presentationDate": "2016-08-25 00:00:00", "ingestedAt": "2026-04-22 19:23:05+00", "status": "ready", "pageCount": 34, "orientation": "portrait", "aspectRatio": 0.77272725, "targetCompany": "St. Jude Medical", "targetTicker": "STJ", "metadata": { "local_root": "/tmp/legacy-images/8ff52fe302da", "activist_firm": "Muddy Waters Capital", "origin_corpus": "contrarian", "extraction_seconds": 156.9734320640564 } }, "coverage": { "pageCount": 34, "pagesIndexed": 34, "pagesWithImages": 34, "pagesWithMetadata": 34, "imageCoveragePct": 100, "metadataCoveragePct": 100, "componentCount": 242, "chartCount": 5, "metricSlides": 0, "toolMatches": 10, "documentToolMatches": 3, "frameworkMatches": 8, "arcMatches": 1, "beatMatches": 3, "loopMatches": 2, "patternMatches": 0, "storymakersMatch": false, "scoreAvailable": false, "reviewAvailable": false, "activistThesisAvailable": true, "pitchdeckMetadataAvailable": false, "pitchdeckProfileAvailable": false }, "blocks": [], "matches": { "arcs": [ { "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "evidence": "The document follows a problem-agitate-solution narrative, highlighting security vulnerabilities, agitating the problem with potential consequences, and providing a solution through regulatory action and recall likelihood analysis", "isPrimary": true, "confidence": 0.8, "extraction": { "at": "2026-07-16 21:58:03.375469+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "beats": [ { "to": 9, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 8, "name": "Problem (Identify pain)", "beatId": "716e823d-942f-4aa0-b02d-57823f8af9bd", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Problem (Identify pain)", "slug": "problem-agitate-solution-problem-identify-pain", "status": "active", "canonId": "019dd9b8-0e78-74bb-b8f6-54348367a131", "version": 1, "description": null }, "evidence": "The document identifies the problem of security vulnerabilities in St. Jude Medical's cardiac device ecosystem", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 16, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 15, "name": "Agitate (Make it worse)", "beatId": "6559ca19-6514-47c9-9f35-ed43e8a37ab7", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Agitate (Make it worse)", "slug": "problem-agitate-solution-agitate-make-it-worse", "status": "active", "canonId": "019dd9b8-0f5a-71dd-bae7-8fadb0d09456", "version": 1, "description": null }, "evidence": "The document agitates the problem by highlighting demonstrated attacks and potential consequences", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Development", "slug": "development", "status": "active", "canonId": "019dd9b8-0332-7008-b3aa-11b0840a57b1", "version": 1, "description": "The middle stretch in arcs that have one. Often where length problems creep in." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 22, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 18, "name": "Solution (Provide relief)", "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Solution (Provide relief)", "slug": "problem-agitate-solution-solution-provide-relief", "status": "active", "canonId": "019dd9b8-0fee-73e9-9ae5-799c7f3895cd", "version": 1, "description": null }, "evidence": "The document provides a solution through regulatory action and recall likelihood analysis", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 30, "from": 25, "loop": { "name": "27_cost_of_inaction", "slug": "27-cost-of-inaction", "status": "active", "bestFor": "Urgent budget requests, compliance, risk mitigation", "canonId": "019dd956-70d1-7395-a15b-857ba858b394", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Status Quo -> The Hidden Costs Accumulating -> The Future State of Inaction -> The Tipping Point", "description": "Quantify what happens if the audience does nothing", "familyLabel": null, "categoryName": "Urgency", "categorySlug": "urgency" }, "matchId": "ab9a2b66-8b1d-4abd-96ba-1ffd9bf1975e", "evidence": "The document presents a scenario table analyzing Boston Scientific's revenue drop after recalls", "position": 0, "objective": "What are the financial implications of inaction on device recalls?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:58:03.620384+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } }, { "to": 24, "from": 23, "loop": { "name": "39_benchmark_gap", "slug": "39-benchmark-gap", "status": "active", "bestFor": "Performance improvement, competitive analysis, target setting", "canonId": "019dd956-75a4-7522-8d1a-af94da4703e9", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "Our Performance -> Industry Average -> Best-in-Class -> The Gap = The Opportunity", "description": "Compare performance against best-in-class to quantify the opportunity", "familyLabel": null, "categoryName": "Comparison", "categorySlug": "comparison" }, "matchId": "d9ef2888-e98f-41cd-8ff2-fb6d0ddcdd8d", "evidence": "The document cites precedent with Hospira Pump Recall Case Study and Guidant Recall Case Study", "position": 1, "objective": "How does St. Jude Medical's security compare to industry standards?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:58:03.660547+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "tools": [ { "tool": { "name": "Peer gap chart", "slug": "peer-gap", "status": "active", "bestFor": "When relative underperformance is the core argument", "canonId": "019dd9e1-54f1-775a-94a1-d5cf3bb75abf", "version": 1, "bodyDocId": "019dd9a1-8653-7748-9050-807f067196c3", "description": "A single visual that benchmarks the target against its best-in-class peers on\na single quantitative KPI — and shows the target losing. The gap is the\npunchline.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "document", "agents": null, "matchId": "9db63570-6294-47f9-946e-9f3a75588e1e", "evidence": null, "pageRefs": null, "priority": null, "whenToUse": "When relative underperformance is the core argument", "confidence": null, "extraction": { "at": "2026-04-29 12:07:50.005477+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": null, "whyItWorks": "- It's the **most credible claim in the deck** because it's arithmetic, not\n opinion.\n- It's immediately **actionable** — close this gap and value accrues.\n- It **pre-empts the \"context is different\" defence** by pitting the target\n against direct peers in the same category.", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Villain naming", "slug": "villain-naming", "status": "active", "bestFor": "When governance or specific decisions are the core thesis", "canonId": "019dd9e1-55a4-74db-9314-0ced4cd46cd2", "version": 1, "bodyDocId": "019dd9a1-88f1-72ad-8f4e-56ec29d7b369", "description": "You identify a **specific person** responsible for the target's underperformance\nor the behaviour you want changed — and name them. Not \"management\" or \"the\nboard\". A named executive or director with a specific failure attributable to\nthem.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "document", "agents": null, "matchId": "da6d98ad-2e05-4866-8cb1-aee707610c14", "evidence": "St. Jude Medical management (product design incompetence/indifference); CTAC program cited as misplaced security posture", "pageRefs": null, "priority": null, "whenToUse": "When governance or specific decisions are the core thesis", "confidence": null, "extraction": { "at": "2026-04-29 12:07:50.005477+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": null, "whyItWorks": "- **Accountability needs a face.** Voters (shareholders, regulators,\n journalists) act faster against people than institutions.\n- **Credibility rises with specificity.** \"The CFO has repeatedly missed\n guidance\" > \"Management has missed guidance\".\n- It **pre-empts evasion**. An individual can be removed; an abstraction\n cannot.\n- It **forces the target to respond personally** — and their defensive\n response usually generates more attention for your thesis.", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "document", "agents": null, "matchId": "8a927ee9-9b69-4599-83e7-358deca02394", "evidence": null, "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": null, "extraction": { "at": "2026-04-29 12:07:50.005477+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": null, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Narrative foundations (from the Storymakers methodology)", "slug": "narrative-foundations", "status": "active", "bestFor": null, "canonId": "019df269-258b-71bd-ad14-53598df04d2b", "version": 1, "bodyDocId": "019df269-2567-736e-8b9c-4ec77611334a", "description": "This skill focuses on the *adversarial* genre — activist campaigns, short", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "407c2c67-877f-4e4c-bc4e-797a06ca7151", "evidence": "The Securities and Exchange Commission opened a formal inquiry into 'product disclosures and trading in Guidant stock'.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:57:45.602189+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 24, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Storytelling Effect", "slug": "storytelling-effect", "status": "active", "bestFor": null, "canonId": "019dd956-981b-74f9-9096-5c8df03dab5a", "version": 1, "bodyDocId": null, "description": "Stories are remembered up to 22x better than facts alone", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "374ef6ae-a95f-46a5-9a87-282a513ff01d", "evidence": "Eliot Spitzer, New York's attorney general at the time, alleged that Guidant kept from the public a design flaw in one of its defibrillators.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:57:45.643353+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 24, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Chartjunk Elimination", "slug": "chartjunk-elimination", "status": "active", "bestFor": null, "canonId": "019dd956-b49e-7453-ab01-b60f338eeda1", "version": 1, "bodyDocId": null, "description": "Remove decorative elements that don't convey data: 3D effects, shadows, unnecessary gridlines", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "a691a28e-998a-4172-879d-04af210474f8", "evidence": "Market share trend line from 2007 to 2015", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:57:45.723476+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 25, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Scenario planning", "slug": "scenario-planning", "status": "active", "bestFor": "Time horizon ≥12 months · ≥2 high-impact uncertainties that cannot be expressed as probability distributions · top two uncertainties roughly independent · team commits to revisit every 12–18 months. For shorter horizons use sensitivity analysis; for quantifiable risk use Monte Carlo; for one-dominant-uncertainty use cascade scenarios.", "canonId": "019de52d-1eb5-7639-abaa-44d7f65af562", "version": 1, "bodyDocId": "1b2fdf8f-9345-4d78-9875-7184e3da22ec", "description": "A structured way to think about the future when prediction is impossible. Build three to four distinct, internally-coherent stories of how the world could unfold, and stress-test strategy against each. The output is a set of named worlds the team can argue with — not a probability distribution.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "751d0571-207a-4d82-aa9e-e5810b6bed6b", "evidence": "Assumes that St. Jude shuts down the Merlin@home network for eight quarters to repair and re-architect the entire network.", "pageRefs": null, "priority": null, "whenToUse": "Time horizon ≥12 months · ≥2 high-impact uncertainties that cannot be expressed as probability distributions · top two uncertainties roughly independent · team commits to revisit every 12–18 months. For shorter horizons use sensitivity analysis; for quantifiable risk use Monte Carlo; for one-dominant-uncertainty use cascade scenarios.", "confidence": 0.7, "extraction": { "at": "2026-07-16 22:57:45.803766+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 26, "whyItWorks": "Solves the two failure modes of forecasting at once: being precisely wrong (point estimates anyone can falsify) and uselessly hedged (ranges so wide they cannot guide action). Scenarios commit to a small set of plausible worlds and crystallise strategy into no-regret moves, sequenced bets, and lose-everywhere moves to drop. Names + early signals + wind-vane triggers turn the exercise into a usable contingency plan.", "antipattern": "Best/base/worst case (three points on one axis, not four scenarios) · probability-weighted average of scenarios (collapses to expected value) · Goldilocks-spaced scenarios that rank good-to-bad · scenarios named \"Scenario A/B/C\" instead of world-shape names · 50-row Excel labelled as a scenario (model, not story) · scenarios without measurable early signals.", "cardinality": null, "narrativePurpose": "Force narrative discipline on multi-year decisions where single-point forecasts fail. Translate structural uncertainty into a small set of decision frames the boardroom can act on by name." }, { "tool": { "name": "List presentation", "slug": "list-presentation", "status": "active", "bestFor": null, "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1", "version": 1, "bodyDocId": null, "description": "Bulleted, numbered, or checklist enumerations.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "7d36483d-e352-4525-a19c-d503f3f598c2", "evidence": "R&D: R&D is expected to remain in the 12.5% to 13% of sales range in our model and where management has been guiding for 2016.,Cardiovascular Segment Growth: According to management, the Cardiovascular segment is expected to grow 1% to 3% for 2016.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:45.884549+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 27, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Valuation: DCF", "slug": "dcf", "status": "active", "bestFor": null, "canonId": "019df269-2031-7273-9014-0c70beb91e11", "version": 1, "bodyDocId": "019df269-200e-76ea-8883-6ee35d39c836", "description": "You project free cash flows over an explicit forecast period (typically", "familyLabel": "valuation-move", "categoryName": "Analysis", "categorySlug": "analysis" }, "agent": "architect", "layer": "slide", "agents": [ "architect" ], "matchId": "652c877f-e45b-4a09-8f29-7afc5e6d638c", "evidence": "DCF and Stock Price Sensitivity Results:", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:57:45.964224+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 28, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Table data", "slug": "table-data", "status": "active", "bestFor": null, "canonId": "019dd9e1-4fab-7168-a82f-b847350a006d", "version": 1, "bodyDocId": null, "description": "Tabular layouts of structured data.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "561d9840-f6d0-43eb-a255-909dcc9b9e7b", "evidence": "Consolidated Leverage Ratio calculation table showing EBITDA components and final ratio vs covenant.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:46.126431+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 31, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [ { "matchId": "20e4849a-61e7-47f9-bf4c-cbebb9564c77", "evidence": "Exposing lack of security standards and easy availability of vulnerable devices.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:50:44.37+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "frameworkName": "fraud-exposure" }, { "matchId": "5cb159ac-e166-4f5c-87aa-20e5c9faee1f", "evidence": "The slide exposes security flaws to argue for gross negligence and potential litigation.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:43.984+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "frameworkName": "fraud-exposure" }, { "matchId": "2126edf1-ae65-491d-93fa-16cc4ba2b8c1", "evidence": "The text explicitly singles out STJ for incompetence and indifference to security.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "frameworkName": "antagonist-introduction" }, { "matchId": "91a43238-ce91-48a4-b625-674490e8db56", "evidence": "Medical Devices – Application of Risk Management to Medical Devices", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 20, "frameworkName": "ANSI/AAMI/ISO 14971" }, { "matchId": "cbcfbfe8-de0a-4118-ab5e-cacda4780edd", "evidence": "Common Vulnerability Scoring System", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 20, "frameworkName": "CVSS 3.0" }, { "matchId": "68d8c799-fc58-4c6e-9ef2-8b13370ae314", "evidence": "Risk assessment matrix used to categorize vulnerability severity and exploitability.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 21, "frameworkName": "heatmap-matrix" }, { "matchId": "593189b1-9fbf-4a62-82b4-64c343879cfd", "evidence": "Uses Hospira recall as a precedent to argue for STJ recall.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 23, "frameworkName": "argument-from-analogy" }, { "matchId": "e32893f8-e868-4d48-8a8b-42a7ebbf098a", "evidence": "Tables showing impact of varying WACC and growth assumptions", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:50:47.723+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 29, "frameworkName": "sensitivity-analysis" } ], "patterns": [] }, "storymakers": null, "score": null, "review": null, "activistThesis": { "tone": "adversarial", "notes": "Filename '_2' suffix and page 2 note ('This version has been updated state that Dr. Nayak speaks for himself, and not his employer') indicate this is an updated version of the original 25-Aug-2016 Muddy Waters short report on STJ — not a later follow-up, hence classified as initial_thesis. Format is a long-form Word-style research note (34pp, Times Roman body, footnotes) rather than a designed pitch deck — classified research_note. Unusual collaboration: Muddy Waters licensed research from cybersecurity firm MedSec and paid it via fund profits; MedSec's medical advisor Dr. Hemal Nayak provides a signed patient letter in the appendix. Novel short thesis mechanism: product-safety/cybersecurity exposure driving forced recall, covenant breach and ratings downgrade rather than accounting fraud. Abbott was in the process of acquiring STJ at the time, which raises the MAC-clause parallel the report implicitly invokes via the Guidant/J&J case study. No stake disclosed — short position held by funds MW manages; disclaimer explicitly reserves right to change position.", "kpisCited": [ { "detail": "46% of STJ 2015 revenue ($2,485M across CRM pacemakers/ICDs and CRT portion of Heart Failure)", "metric": "Cardiac Devices share of revenue" }, { "detail": "~260,000 active units in US homes; 490,000 US Cardiac Device users without Merlin@home", "metric": "Merlin@home installed base (US)" }, { "detail": "Stock $81.88, market cap $23.3bn, float 97.5% at report date", "metric": "Market cap / stock price" }, { "detail": "Crash and battery-drain attacks demonstrated within ~50 foot RF radius of a Merlin@home unit", "metric": "Attack radius" }, { "detail": "Used units typically $10-$35; Merlin programmer seen at $3,499", "metric": "Merlin@home resale price on Ebay" }, { "detail": "$6.4bn (assumes $15,000 per Merlin@home user x 260,000 plus $5,000 per 490,000 non-Merlin users)", "metric": "Estimated product-liability damages" }, { "detail": "Calculated at 4.45x vs 4.25x covenant for 2015; covenant steps down to 4.0x in 2016", "metric": "Consolidated Leverage Ratio" }, { "detail": "~$3.8bn of secured debt (revolver + term loan) potentially re-priced after covenant breach", "metric": "Secured debt at risk" }, { "detail": "Estimated 2 years to develop new RF protocol (10-15 person team) plus 3-6 months FDA approval", "metric": "Remediation timeline" }, { "detail": "WACC sensitized 6%-11% (Bloomberg 6.5%, peers 7.7%+); perpetuity growth -5% to +3%; assumes $1bn litigation settlement in 4 years", "metric": "DCF inputs" } ], "closingAsk": "Short St. Jude Medical; hospitals, physicians and patients should treat the Cardiac Device ecosystem as compromised and disable RF capability until a multi-year remediation is complete.", "extraction": { "at": "2026-04-22 19:23:05+00", "model": "unknown-legacy", "runId": null, "seconds": 156.97343, "promptVersion": null }, "scqaReward": "DCF sensitivity under network-shutdown and share-loss scenarios implies roughly 50-90% downside from $82; a likely 3Q16 covenant breach, $6.4bn litigation exposure and rating downgrades compound the decline.", "thesisTypes": [ "fraud_exposure", "other" ], "top3Reasons": [ "STJ cardiac devices (46% of 2015 revenue) can be remotely crashed or battery-drained within a 50-foot radius", "Hundreds of thousands of Merlin@home units ship with unencrypted SSH keys and are sold on Ebay for ~$35", "A mandated recall and 2-year RF rewrite likely trigger a 3Q16 covenant breach and $6.4bn litigation exposure" ], "scqaSituation": "St. Jude Medical is a $23B medical device company whose pacemakers, ICDs and CRTs — 46% of 2015 revenue — depend on a Merlin@home and Merlin.net ecosystem for RF-based remote patient monitoring.", "thesisSummary": "Muddy Waters is short St. Jude Medical (STJ), arguing that 46% of the $23B company's revenue — pacemakers, ICDs and CRTs — is exposed to an imminent cybersecurity-driven recall. Working with cybersecurity firm MedSec, the firm demonstrates two catastrophic attacks on STJ's implantable cardiac devices: a 'crash' attack that forces dangerous pacing and a battery-drain attack, both executable within a 50-foot radius using the hundreds of thousands of $35 Merlin@home monitors STJ has distributed and which are readily sold on Ebay with unencrypted SSH keys. Muddy Waters argues remediation requires a full two-year RF protocol rewrite, triggering a sales moratorium, a likely 3Q16 bank-covenant breach, $6.4bn of product-liability exposure, and ratings downgrades. DCF sensitivity on network-shutdown and market-share-loss scenarios implies roughly 50-90% downside from $82 per share.", "primaryDemands": [ "STJ should recall its pacemakers, ICDs and CRTs", "Immediately disable the RF capability of patients' implanted devices as a compensating control", "Rebuild the RF communication protocol and harden the Merlin ecosystem (estimated two-year remediation)", "Patients unplug their Merlin@home monitors until remediation is complete" ], "scqaResolution": "STJ must recall the pacemakers, ICDs and CRTs, disable RF as a compensating control, and rewrite the RF communication protocol — a two-year remediation that imposes a product sales moratorium.", "thesisOneLiner": "St. Jude's $23B cardiac-device franchise rests on a Merlin ecosystem so insecure that hackers can crash pacemakers from 50 feet — a recall and two-year remediation imply 50%+ downside and likely covenant breach.", "precedentsCited": [ "Hospira Symbiq infusion pump recall (Billy Rios / FDA advisory 2015)", "Guidant pacemaker/defibrillator recall (J&J acquisition collapse, 2005)", "Boston Scientific defibrillator recall (2010, 13% overnight share drop)", "Thoratec HeartMate II LVAD blood-clot defect (2012-2015 market share loss)" ], "scqaComplication": "MedSec found STJ's cardiac ecosystem is grossly negligent on security: hundreds of thousands of $35 Merlin@home units hold unencrypted SSH keys and can be weaponized to crash or battery-drain patients' implants from 50 feet.", "narrativeInterest": 5, "notableSlidePages": [ 2, 5, 11, 26, 28, 30 ], "peerCompaniesCited": [ "Medtronic", "Boston Scientific", "Johnson & Johnson", "Guidant", "Hospira", "Pfizer", "Thoratec" ], "valuationFrameworks": [ "dcf", "precedent_transactions" ], "visualCraftInterest": 2 }, "pitchdeck": { "metadata": null, "profile": null }, "slides": [ { "page": 1, "type": "setup", "title": "Standard legal boilerplate for investment research.", "function": "other", "imagePath": "https://imgproxy.kitesheet.com/0gGjVR_gOAQcMC67-PcaaCwiIhjgYUt0S2W_leV1EFk/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy84ZmY1MmZlMzAyZGEvcDAwMS5qcGc", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "sparse", "densityScore": 21, "componentCount": 4, "textChars": 732, "nDataPoints": 0, "notes": "Standard legal boilerplate for investment research.", "elementsJson": [ "paragraph", "callout_box", "logo_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:45.234+00", "seconds": 4.704, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/1", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-1", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "You should assume that as of the publication date of our reports and research, Muddy Waters Capital LLC (possibly along with or through our members, partners, affiliates, employees, and/or consultants) along with our clients and/or investors and/or their clients and/or investors, has a short position in all stocks (and/or options, swaps, and other derivatives related to the stock) and bonds covered herein, and therefore stands to realize significant gains in the event that the price of either declines.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854e-9e42400903aa", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.82, "x": 0.09, "y": 0.14 }, "kind": "disclaimer", "text": "Use of Muddy Waters reports is limited by the Terms of Service on its website...", "attrs": null, "canon": { "kind": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc", "version": 1, "description": "Legal/cautionary text that occupies most of the body of its slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.234+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cc2a6132-0a30-4c2d-9e6d-12867583cb4f", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.2, "x": 0.09, "y": 0.07 }, "kind": "image", "text": "Muddy Waters Capital", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.234+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "48583271-18a8-4b14-afe6-2e0325259b99", "parentComponentId": null }, { "bbox": { "h": 0.7, "w": 0.82, "x": 0.09, "y": 0.22 }, "kind": "paragraph", "text": "By downloading from, or viewing material on the Muddy Waters Research website, you agree to the following Terms of Service...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.234+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7331c35-5023-48f8-88fc-56a6fee70708", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "thumbSrc": "https://imgproxy.kitesheet.com/gy9ibBJ5-9DCvNyXVZ3N9YcZH_96gfkNTxF8E7H6REM/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy84ZmY1MmZlMzAyZGEvcDAwMS5qcGc", "imagePathAlt": "https://imgproxy.kitesheet.com/5ODhOY8TuvwPey2-L3X3lF-DgDRAP5PulYpMPscA9aE/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy84ZmY1MmZlMzAyZGEvcDAwMS5wbmc", "thumbSrcAlt": "https://imgproxy.kitesheet.com/on6Q87StlsXz1CrXeksYs_YLX4O9jE2yAQHKJmoMY-4/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy84ZmY1MmZlMzAyZGEvcDAwMS5wbmc" }, { "page": 2, "type": "setup", "title": "The slide serves as the formal introduction to the short thesis, establishing the firm's position and the core argument regarding product recalls and cybersecur", "function": "frame_situation", "rawType": "executive_summary", "block": null, "metadata": { "slideType": "executive_summary", "slideTypeCanon": { "name": "Executive summary", "slug": "executive_summary", "status": "active", "canonId": "019de52d-06be-73ff-81b3-f99fe7f0025e", "version": 1, "description": null }, "function": "frame_situation", "functionCanon": { "name": "Frame situation", "slug": "frame_situation", "status": "active", "canonId": "019de52d-17bc-718f-8752-05ef2b72d7b3", "version": 1, "description": null }, "density": "sparse", "densityScore": 4, "componentCount": 2, "textChars": 141, "nDataPoints": null, "notes": "The slide serves as the formal introduction to the short thesis, establishing the firm's position and the core argument regarding product recalls and cybersecurity risks.", "elementsJson": [ "data_table", "paragraph", "footnote" ], "confidence": null, "extraction": { "model": "unknown-legacy", "runId": null, "at": "2026-04-22 23:22:37+00", "seconds": null, "promptVersion": null } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/2", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-2", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "There is a strong possibility that close to half of STJ’s revenue is about to disappear for approximately two years.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:37+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854e-810f358289a5", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Market Cap: $23.3 billion", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:37+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854e-87bc1baa5e45", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 3, "type": "appendix", "title": "This is a text-heavy research note page. It discusses the collaboration between Muddy Waters and MedSec to expose security flaws in STJ devices.", "function": "diagnose_problem", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 79, "componentCount": 10, "textChars": 2021, "nDataPoints": 0, "notes": "This is a text-heavy research note page. It discusses the collaboration between Muddy Waters and MedSec to expose security flaws in STJ devices.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:44.968+00", "seconds": 4.292, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/3", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-3", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The lack of security in the STJ pacemaker and ICD infrastructure stunned MedSec. STJ’s apparent lack of device security is egregious, and in our view, likely a product of years of neglect.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:37+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854e-6b276e95dca5", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.28 }, "kind": "paragraph", "text": "Dr. Hemal Nayak, a cardio electrophysiologist at the University of Chicago, is recommending his patients unplug their Merlin@home units; and, he is not going to implant STJ devices until the problems discussed in this report are remediated.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7f283014-b2de-4ca0-8891-7bf1536c069c", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.16 }, "kind": "paragraph", "text": "The vulnerabilities result from an apparent lack of device security; and, the communication protocols for the Cardiac Device ecosystem – which we believe lacks basic protections such as encryption and authentication – are in fact compromised.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9d9113be-859a-4868-a69d-57e26c0a5383", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.46 }, "kind": "paragraph", "text": "MedSec is a cybersecurity research firm focused on the healthcare industry. It contacted Muddy Waters after largely completing an assessment of major manufacturers’ pacemakers and implantable cardioverter defibrillators (“ICDs”).", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bd909859-ebb4-441b-b061-6fb0743e7264", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "to cause implanted devices to malfunction and harm users. We believe that courts will hold STJ’s lack of security in its Cardiac Device ecosystem is grossly negligent, unless STJ settles the litigation we see as inevitable.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d3bb1b85-7619-47a4-ab55-62ab5a4b7cde", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.76 }, "kind": "paragraph", "text": "MedSec has given Muddy Waters multiple demonstrations evidencing how hollow STJ’s device security is. To illustrate the severity of these vulnerabilities, MedSec demonstrated two types of", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e914d534-80c3-4a2f-8c66-b64f5e69e97b", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.53 }, "kind": "paragraph", "text": "The lack of security in the STJ pacemaker and ICD infrastructure stunned MedSec. STJ’s apparent lack of device security is egregious, and in our view, likely a product of years of neglect.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "eb98842a-69e2-4503-a48b-fb6d0a3dbf5c", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "Dr. Hemal Nayak, a cardio electrophysiologist at the University of Chicago, is recommending his patients unplug their Merlin@home units; and, he is not going to implant STJ devices until the problems discussed in this report are remediated.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:37+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854e-6e3a4eda5686", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.85 }, "kind": "source-note", "text": "4 Dr. Nayak had been granted an immaterial equity interest in MedSec prior to MedSec reaching its conclusions regarding STJ. 5 MedSec believes this study is the first of its kind. 6 http://www.reuters.com/article/us-cybersecurity-medicaldevices-insight-idUSKCN0IB0DQ20141022", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bc3d95a8-54c3-46bc-8bf5-48fee0d9f4bc", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.12, "x": 0.11, "y": 0.42 }, "kind": "title", "text": "Background", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.968+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "77942872-e30a-4c7e-96c6-94e2649de1ed", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 4, "type": "setup", "title": "This is a disclosure/methodology page from a Muddy Waters research report regarding St. Jude Medical (STJ) device vulnerabilities.", "function": "frame_situation", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "frame_situation", "functionCanon": { "name": "Frame situation", "slug": "frame_situation", "status": "active", "canonId": "019de52d-17bc-718f-8752-05ef2b72d7b3", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 90, "componentCount": 11, "textChars": 3189, "nDataPoints": 1, "notes": "This is a disclosure/methodology page from a Muddy Waters research report regarding St. Jude Medical (STJ) device vulnerabilities.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:44.962+00", "seconds": 4.281, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/4", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-4", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "As we detail in this report, Muddy Waters believes there is a strong possibility that STJ will need to recall its pacemakers, ICDs, and CRTs while it hardens security of the device ecosystem.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854e-b3dedd3bf27a", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.81 }, "kind": "paragraph", "text": "For our purposes, the Cardiac Device ecosystem consists of four components: the implantable device, the Merlin programmer, the STJ network, and the Merlin@home.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3381a1d5-a35b-4aa9-8c2f-af53137cbfdb", "parentComponentId": null }, { "bbox": { "h": 0.09, "w": 0.78, "x": 0.11, "y": 0.58 }, "kind": "paragraph", "text": "The Merlin@home devices were obtained second hand – often from online vendors. The programmers were obtained via a third party partnership with a licensed physician. The observations regarding device security in this report are derived from the substantial majority of devices studied, and it is possible that newer versions of these devices have some security enhancements that could eliminate some seemingly minor vulnerabilities in those particular devices.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5ad231f5-e445-49a4-adac-7cefc8f427cb", "parentComponentId": null }, { "bbox": { "h": 0.09, "w": 0.78, "x": 0.11, "y": 0.47 }, "kind": "paragraph", "text": "The devices MedSec studied, and that formed the basis for these conclusions included pacemakers and ICDs; but, did not include CRTs. Because the CRTs are compatible with the compromised Merlin@home devices, this report assumes that they have similar vulnerabilities, and should also be recalled and remediated. (Were the CRTs not to have the expected or similar vulnerabilities, then the products would not need to be recalled.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7f8870c3-b5bf-496a-b964-48b9ddc6546a", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.14 }, "kind": "paragraph", "text": "In addition to making an investment case, the purpose of this report is to inform device users and their physicians of these risks. MedSec and we believe that users have a right to know that there are serious security problems with their implanted Cardiac Devices, and the related devices. However, we are withholding and redacting technical information that could give potential attackers a roadmap.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "86f7f095-7401-4b79-b461-bf108daff50e", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.37 }, "kind": "paragraph", "text": "As we detail in this report, Muddy Waters believes there is a strong possibility that STJ will need to recall its pacemakers, ICDs, and CRTs while it hardens security of the device ecosystem. This recall would likely entail a moratorium on sales of these devices, and we estimate this moratorium would be effective for a remediation period of at least two years.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a130ba36-e2aa-4152-a286-ab2e7ea42764", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "attacks that could do severe harm to devices and users, and theoretically could be deployed on a large scale.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "aca6c217-ccee-444a-87bf-04dfd3b80d60", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.78, "x": 0.11, "y": 0.24 }, "kind": "paragraph", "text": "We are unaware of any imminent threat to patient safety. However, we believe it is prudent from a security standpoint for STJ to immediately disable the RF capability of patients' implanted devices. Regardless, Cardiac Device users should speak with their physicians about the risks. Muddy Waters is providing the United States Food and Drug Administration and Department of Homeland Security with a version of this report, and expects to facilitate dialogue between the agencies and MedSec.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "aec5c1c9-f3b1-48d2-8023-7908fce253f1", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.69 }, "kind": "paragraph", "text": "However, even if new generations of devices have some enhancements, we still view the entire ecosystem as greatly compromised. There are likely hundreds of thousands of Merlin@home devices with easily exploitable vulnerabilities in the world, and vulnerable devices are easily purchased online for no more than $35. This train has already left the station.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b8e69fd2-11a9-4004-9e32-c4e75ee3ee2a", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.88 }, "kind": "source-note", "text": "7 It would have been illegal to try to validate the ability to commit large scale attacks. 8 The device pictures supra are representative, and are not pictures of the actual devices studied.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2c57623a-2132-41a7-a779-73bff46c03d4", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.4, "x": 0.11, "y": 0.77 }, "kind": "title", "text": "STJ's Compromised Cardiac Device Ecosystem", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.962+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "969a21d2-3732-4956-87f0-a7c38b8621f4", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 5, "type": "setup", "title": "The slide highlights a lack of encryption and authentication across the ecosystem, framing it as a security vulnerability.", "function": "frame_situation", "rawType": "comparison_table", "block": null, "metadata": { "slideType": "comparison_table", "slideTypeCanon": { "name": "Comparison table", "slug": "comparison_table", "status": "active", "canonId": "019de52d-0a06-73f8-8813-fe022fab1de2", "version": 1, "description": null }, "function": "frame_situation", "functionCanon": { "name": "Frame situation", "slug": "frame_situation", "status": "active", "canonId": "019de52d-17bc-718f-8752-05ef2b72d7b3", "version": 1, "description": null }, "density": "sparse", "densityScore": 23, "componentCount": 5, "textChars": 339, "nDataPoints": 4, "notes": "The slide highlights a lack of encryption and authentication across the ecosystem, framing it as a security vulnerability.", "elementsJson": [ "screenshot", "data_table", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:43.037+00", "seconds": 2.169, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/5", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-5", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The programmers studied lack encryption and also present a substantial vulnerability.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-2a48ea877baa", "parentComponentId": null }, { "bbox": { "h": 0.75, "w": 0.15, "x": 0.15, "y": 0.12 }, "kind": "image", "text": "Images of the four devices", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.037+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5e097b31-64d9-4524-a0ed-6b818db3f34e", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "revenue: 46%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-2d347f9a96a1", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.81 }, "kind": "paragraph", "text": "Any programmer or Merlin@home device can generally communicate with any Cardiac Device because there is no strong authentication built into the protocol.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.037+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f123164-aea6-4687-89ce-2d43244a40c2", "parentComponentId": null }, { "bbox": { "x": 0.92, "y": 0.79 }, "kind": "table", "text": "Implantable Device, Programmer, Merlin.net Network, Merlin@Home", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.037+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8f47cdc7-1db2-467f-af8e-116d5ddd86a4", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 6, "type": "tension", "title": "The slide uses a diagram to show the connectivity between patient, home device, programmer, and network, followed by text arguing that STJ lacks standard securi", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 35, "componentCount": 6, "textChars": 781, "nDataPoints": 1, "notes": "The slide uses a diagram to show the connectivity between patient, home device, programmer, and network, followed by text arguing that STJ lacks standard security defenses.", "elementsJson": [ "process_diagram", "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:44.37+00", "seconds": 3.436, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/6", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-6", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Perhaps most shocking about STJ's lack of security is that it has distributed hundreds of thousands of devices that are apparently so easily analyzed for vulnerabilities.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-5227241f2e68", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.5, "x": 0.25, "y": 0.1 }, "kind": "diagram", "text": "Ecosystem diagram showing Patient, @Home Device, Programmer, and Network connectivity.", "attrs": null, "canon": { "kind": { "name": "Diagram", "slug": "diagram", "status": "active", "canonId": "019de52c-f9f0-734a-81de-15382ff28c65", "version": 1, "description": "Schematic or relational diagram." }, "tool": null, "subkind": { "name": "Hub and spoke", "slug": "hub-spoke", "status": "active", "canonId": "019de52d-04db-73e6-81ca-a234f2f23fc1", "version": 1, "description": null }, "framework": null }, "subkind": "hub-spoke", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.37+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1df93a69-50c9-40f1-bb2b-0acd7c2662b3", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.58 }, "kind": "paragraph", "text": "Perhaps most shocking about STJ's lack of security is that it has distributed hundreds of thousands of devices that are apparently so easily analyzed for vulnerabilities. There are numerous Merlin@home units for sale on Ebay – usually for no more than $35.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.37+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "140a4751-b9cd-4538-a76e-b89971c7fe87", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.35 }, "kind": "paragraph", "text": "Usually, devices part of an ecosystem such as this one would have defenses including strong authentication, encrypted software and code, anti-debugging tools, and anti-tampering mechanisms.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.37+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "eeec5ba6-1693-476b-b22c-32084cf36246", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.3, "x": 0.1, "y": 0.9 }, "kind": "source-note", "text": "The search was run on August 3, 2016.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.37+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dc69fbfa-a3fb-4e66-9911-2a01d01378fa", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.52 }, "kind": "title", "text": "Hundreds of Thousands of Keys to the Castle", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.37+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a8c16e9c-ec72-4cc7-a2c8-86864279726f", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "20e4849a-61e7-47f9-bf4c-cbebb9564c77", "evidence": "Exposing lack of security standards and easy availability of vulnerable devices.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:50:44.37+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 7, "type": "tension", "title": "The slide highlights the ease of acquiring medical hardware that researchers have proven to be hackable from a distance of 50 feet.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 27, "componentCount": 4, "textChars": 943, "nDataPoints": 0, "notes": "The slide highlights the ease of acquiring medical hardware that researchers have proven to be hackable from a distance of 50 feet.", "elementsJson": [ "screenshot", "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:44.401+00", "seconds": 3.334, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/7", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-7", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Merlin@home devices and implants now have additional RF capabilities, with a communications range of approximately 50 feet. They now pose a far more significant risk to user safety than before.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-07141e91bd8c", "parentComponentId": null }, { "bbox": { "h": 0.63, "w": 0.76, "x": 0.12, "y": 0.09 }, "kind": "image", "text": "eBay search results for Merlin@Home transmitters", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b7e27321-e2d6-4ba0-9d3d-c4f24c108496", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.76, "x": 0.12, "y": 0.75 }, "kind": "paragraph", "text": "When a patient receives a Cardiac Device implant, it is usually bundled with a Merlin@Home monitor. Previous generations of these devices were shown to be vulnerable to hacking within very close proximity. However, these devices had wands that needed to be within inches of the Cardiac Device in order to communicate. Merlin@home devices and implants now have additional RF capabilities, with a communications range of approximately 50 feet. They now pose a far more significant risk to user safety than before. The Merlin@home devices MedSec tested generally only required approximately 10 minutes to get access to the root directory.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8e1e06f5-1e6c-43ea-8a76-84bb93aeaf42", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.4, "x": 0.12, "y": 0.89 }, "kind": "source-note", "text": "10 http://www.secure-medicine.org/public/publications/icd-study.pdf", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7836fd3b-a474-474d-a798-112af0e5e4c7", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 8, "type": "tension", "title": "This slide details specific technical security failures found during research.", "function": "diagnose_problem", "rawType": "problem_statement", "block": null, "metadata": { "slideType": "problem_statement", "slideTypeCanon": { "name": "Problem statement", "slug": "problem_statement", "status": "active", "canonId": "019de52d-0879-768d-bba8-8da8a5a121d4", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "dense", "densityScore": 50, "componentCount": 7, "textChars": 1207, "nDataPoints": 0, "notes": "This slide details specific technical security failures found during research.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:47.323+00", "seconds": 6.173, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/8", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-8", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "There are numerous ways in which the Merlin@home devices violate security standards (and defy logic):", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854e-c7618aca6e70", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.78, "x": 0.11, "y": 0.17 }, "kind": "list", "text": "No apparent tamper-proofing or hardware identity protection. Unprotected software. Lack of a layered defense. Easy availability of device firmware.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.323+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5b220a1b-e3e3-4400-a47f-9df93cb5fac7", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.75 }, "kind": "paragraph", "text": "The first shocking thing one encounters when getting root on the Merlin@home device is unencrypted security information that takes no additional effort to access. This information includes:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.323+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "58a367cc-1f7c-4344-83a8-a70661bbe529", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.62 }, "kind": "paragraph", "text": "MedSec believes a software update was likely pushed to some of the Merlin@home devices that made them appear more secure; however, in MedSec's opinion, this update represented a very slight change in security.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.323+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ef3bd584-adf1-4232-877b-d48aefc60908", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "\"Getting root\" on the Merlin@home devices exposes sensitive STJ network credentials. We believe the ease of getting root shows how poor the device security is. MedSec identified three methods to get root on the @home devices.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.323+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f54e4045-bf77-4413-a456-847182651a0c", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.85 }, "kind": "source-note", "text": "11 See https://www.blackhat.com/docs/us-14/materials/us-14-Oh-Reverse-Engineering-Flash-Memory-For-Fun-And-Benefit-WP.pdf\n12 Devices manufactured in 2016 are difficult to obtain on the secondary market. MedSec was able to obtain one such device, and was able to get root using a previously identified exploit.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.323+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dba4d4f3-8891-45a8-bbde-db360481fd1e", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.35, "x": 0.11, "y": 0.71 }, "kind": "title", "text": "Getting Root Opens the Door", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.323+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "874473a9-429e-4370-8c7c-1f6cc684df4f", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 9, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 8, "name": "Problem (Identify pain)", "beatId": "716e823d-942f-4aa0-b02d-57823f8af9bd", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Problem (Identify pain)", "slug": "problem-agitate-solution-problem-identify-pain", "status": "active", "canonId": "019dd9b8-0e78-74bb-b8f6-54348367a131", "version": 1, "description": null }, "evidence": "The document identifies the problem of security vulnerabilities in St. Jude Medical's cardiac device ecosystem", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 9, "type": "tension", "title": "The slide uses a 'root' access screenshot to prove the vulnerability of the device.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 30, "componentCount": 6, "textChars": 716, "nDataPoints": 0, "notes": "The slide uses a 'root' access screenshot to prove the vulnerability of the device.", "elementsJson": [ "bullet_list", "paragraph", "screenshot" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:43.984+00", "seconds": 2.823, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/9", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-9", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Even if the SSH keys have been changed, their unencrypted existence on older @home devices is shocking.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-5cef21bc23e3", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.6, "x": 0.2, "y": 0.42 }, "kind": "image", "text": "Screenshot showing root access terminal and browser window.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.984+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "26bfce2d-3fc4-4595-b4aa-c212f69bbcf8", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.75, "x": 0.14, "y": 0.09 }, "kind": "list", "text": "The toll-free access number for the Merlin network. The User ID and Password for the Merlin network. STJ server IP addresses. SSH keys.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.984+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8b9d04b4-cf27-4bb3-9ada-2fedb4ce5eef", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.85 }, "kind": "paragraph", "text": "We have little doubt that STJ is about to enter a period of protracted litigation over these products. Should these trials reach verdicts, we expect the courts will hold that STJ has been", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.984+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b7dc4307-9c27-4a25-818b-dfbe85042a95", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.3 }, "kind": "paragraph", "text": "The network credentials present on the @home device likely could be exploited to obtain confidential (and legally protected) patient data from the Merlin network.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.984+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e5f039d7-5d75-4b05-aab3-420be3d4a5a5", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.7, "x": 0.11, "y": 0.82 }, "kind": "title", "text": "Security Well Below Industry Standards (the Case for Gross Negligence)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.984+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6ff476f8-a2a7-47db-a04a-ad871e2b7b29", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "5cb159ac-e166-4f5c-87aa-20e5c9faee1f", "evidence": "The slide exposes security flaws to argue for gross negligence and potential litigation.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:43.984+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 9, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 8, "name": "Problem (Identify pain)", "beatId": "716e823d-942f-4aa0-b02d-57823f8af9bd", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Problem (Identify pain)", "slug": "problem-agitate-solution-problem-identify-pain", "status": "active", "canonId": "019dd9b8-0e78-74bb-b8f6-54348367a131", "version": 1, "description": null }, "evidence": "The document identifies the problem of security vulnerabilities in St. Jude Medical's cardiac device ecosystem", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 10, "type": "tension", "title": "The slide uses a confrontational tone to frame STJ as negligent in cybersecurity, citing a $6.4 billion potential liability.", "function": "name_villain", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "name_villain", "functionCanon": { "name": "Name villain", "slug": "name_villain", "status": "active", "canonId": "019de52d-1746-70d6-bc58-5eeaf5865526", "version": 1, "description": null }, "density": "dense", "densityScore": 51, "componentCount": 7, "textChars": 1012, "nDataPoints": 3, "notes": "The slide uses a confrontational tone to frame STJ as negligent in cybersecurity, citing a $6.4 billion potential liability.", "elementsJson": [ "paragraph", "photo", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:44.499+00", "seconds": 3.262, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/10", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-10", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "As a result, any programmer or Merlin @ Home device can communicate with any Cardiac Device, and once the communication protocol is understood, generally any device can be impersonated.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-45812dd3f51e", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.3, "x": 0.35, "y": 0.35 }, "kind": "image", "text": "Medtronic MyCareLink monitor", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dc4acd6e-dd2e-464a-800c-4388f3d16dc7", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.764, "x": 0.118, "y": 0.093 }, "kind": "paragraph", "text": "grossly negligent in its product design. (We estimate awards if litigated to a verdict could total $6.4 billion.13)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "07e609f3-c0e7-4378-80c9-a81e364116ff", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.764, "x": 0.118, "y": 0.65 }, "kind": "paragraph", "text": "The STJ communication protocol does not include the use of any unique or one-time tokens... any programmer or Merlin @ Home device can communicate with any Cardiac Device.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "19247614-5d68-4110-8b70-021b70770361", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.764, "x": 0.118, "y": 0.54 }, "kind": "paragraph", "text": "MDT's MyCareLink monitor has a wand that has to be detached and put within inches of the implantable to communicate – similar to earlier versions of STJ's home monitoring devices.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3fab3d3b-f758-44be-b8a8-e4aabe31a549", "parentComponentId": null }, { "bbox": { "h": 0.071, "w": 0.764, "x": 0.118, "y": 0.148 }, "kind": "paragraph", "text": "One of the purposes of this report is unapologetically to single out STJ for what we see as its incompetence in, or indifference to, device security.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5b23113c-2b9c-43e3-897b-2f91314a91b0", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.764, "x": 0.118, "y": 0.88 }, "kind": "source-note", "text": "13 Assumes damages of $15,000 per each of 260,000 Merlin@home device users, plus damages of $5,000 per each of an estimated 490,000 U.S. Cardiac Device users who do not use Merlin@home.", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6c2f002c-7ba9-42b1-83f5-0b7a8cdc5368", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "2126edf1-ae65-491d-93fa-16cc4ba2b8c1", "evidence": "The text explicitly singles out STJ for incompetence and indifference to security.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:44.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "frameworkName": "antagonist-introduction" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 11, "type": "setup", "title": "The table highlights significant security vulnerabilities for STJ compared to competitors.", "function": "compare_peers", "rawType": "comparison_table", "block": null, "metadata": { "slideType": "comparison_table", "slideTypeCanon": { "name": "Comparison table", "slug": "comparison_table", "status": "active", "canonId": "019de52d-0a06-73f8-8813-fe022fab1de2", "version": 1, "description": null }, "function": "compare_peers", "functionCanon": { "name": "Compare peers", "slug": "compare_peers", "status": "active", "canonId": "019de52d-1453-72ba-a367-9ba3d34c1630", "version": 1, "description": null }, "density": "sparse", "densityScore": 12, "componentCount": 1, "textChars": 73, "nDataPoints": 44, "notes": "The table highlights significant security vulnerabilities for STJ compared to competitors.", "elementsJson": [ "comparison_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:43.563+00", "seconds": 2.223, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/11", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-11", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": { "h": 0.78, "w": 0.82, "x": 0.09, "y": 0.11 }, "kind": "table", "text": "Comparison table of security features for STJ vs Competitors 1, 2, and 3.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.563+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "728fb93f-c5d9-4a96-ae4f-00270e33f480", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 12, "type": "tension", "title": "The slide uses technical teardown evidence to argue for gross negligence in product design, citing potential litigation damages of $6.4 billion.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 54, "componentCount": 7, "textChars": 1167, "nDataPoints": 3, "notes": "The slide uses technical teardown evidence to argue for gross negligence in product design, citing potential litigation damages of $6.4 billion.", "elementsJson": [ "paragraph", "photo", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:48.089+00", "seconds": 6.682, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/12", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-12", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "What we can say is that it constitutes an extreme departure from industry standards, as evidenced by the security efforts its competitors have made, and further shows a remarkable indifference to protecting its customers from cybersecurity threats.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-a7f458fe6665", "parentComponentId": null }, { "bbox": { "h": 0.23, "w": 0.74, "x": 0.13, "y": 0.29 }, "kind": "image", "text": "Circuit board photograph with labels for Samsung and Zarlink chips.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.089+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "59d29c54-5226-42e8-82b2-b29a68002f10", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.76, "x": 0.118, "y": 0.11 }, "kind": "paragraph", "text": "The Merlin@home circuit board shows some of the device's substandard security. STJ's RF chip is clearly an off the shelf un-customized Zarlink chip. In contrast, the other manufacturers have proprietary RF chips developed specifically for their protocols.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.089+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "11cca245-a86a-417c-8bc1-2553534f44d1", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.76, "x": 0.118, "y": 0.79 }, "kind": "paragraph", "text": "Perhaps more worryingly, the physician office programmers are not well secured either. Shockingly, the STJ programmer has an easily accessible removable SATA/IDE harddrive. The hard drive is unencrypted.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.089+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a3f1625c-9de3-4c45-9c32-d9085dab267a", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.76, "x": 0.118, "y": 0.59 }, "kind": "paragraph", "text": "Whether SJM's conduct constitutes simple negligence, gross negligence, or recklessness we leave to the courts... We estimate awards could total $6.4 billion.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.089+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a7997756-6597-425e-8300-8eabb3a37a83", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.118, "y": 0.88 }, "kind": "source-note", "text": "15 Assumes damages of $15,000 per each of 260,000 Merlin@home device users, plus damages of $5,000 per each of a conservatively estimated 490,000 U.S. Cardiac Device users who do not use Merlin@home.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.089+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8b68ded2-a287-44c8-bb0d-9673126b2299", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.45, "x": 0.118, "y": 0.75 }, "kind": "title", "text": "Merlin Programmers are also Non-Secure", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.089+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "295893cf-e348-4d1a-b9be-d93582d2c113", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 13, "type": "appendix", "title": "The slide contains a screenshot of an eBay listing for a St Jude Medical MERLIN 3650 Patient Care System.", "function": "illustrate_case", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "illustrate_case", "functionCanon": { "name": "Illustrate case", "slug": "illustrate_case", "status": "active", "canonId": "019de52d-13b4-772c-bb73-1873612a7463", "version": 1, "description": null }, "density": "sparse", "densityScore": 23, "componentCount": 4, "textChars": 645, "nDataPoints": 1, "notes": "The slide contains a screenshot of an eBay listing for a St Jude Medical MERLIN 3650 Patient Care System.", "elementsJson": [ "paragraph", "screenshot" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:43.748+00", "seconds": 2.305, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/13", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-13", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "This makes the vulnerability discovery process for an attacker significantly easier.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-dae125eebb60", "parentComponentId": null }, { "bbox": { "h": 0.535, "w": 0.764, "x": 0.118, "y": 0.285 }, "kind": "image", "text": "eBay listing screenshot for St Jude Medical MERLIN 3650", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.748+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b51814ce-a070-4106-b639-b3517c49ace6", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.764, "x": 0.118, "y": 0.238 }, "kind": "paragraph", "text": "These devices are readily available online for a few thousand dollars – including occasionally on Ebay. A Merlin programmer available on Ebay on August 10, 2016:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.748+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "550bc558-cc22-495b-bc85-794aced129c1", "parentComponentId": null }, { "bbox": { "h": 0.135, "w": 0.764, "x": 0.118, "y": 0.093 }, "kind": "paragraph", "text": "hard drive using a SATA/IDE to USB adapter cable. This makes the vulnerability discovery process for an attacker significantly easier. If the applications are reverse engineered it could potentially allow an attacker emulate the full functionality of the programmer using custom hardware in a much more compact form – e.g., a pocket size device.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:43.748+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "785a52bb-0ef0-4556-9ef2-4c9cc8482426", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 14, "type": "tension", "title": "Includes a photograph of a disassembled device with a red box highlighting a 'Removable hard drive'.", "function": "name_villain", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "name_villain", "functionCanon": { "name": "Name villain", "slug": "name_villain", "status": "active", "canonId": "019de52d-1746-70d6-bc58-5eeaf5865526", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 75, "componentCount": 9, "textChars": 2020, "nDataPoints": 0, "notes": "Includes a photograph of a disassembled device with a red box highlighting a 'Removable hard drive'.", "elementsJson": [ "photo", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:48.364+00", "seconds": 6.824, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/14", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-14", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We believe the foregoing issues evidence a company that either does not know how to do device security, or does not care about it.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-06d26b26c81c", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.764, "x": 0.118, "y": 0.091 }, "kind": "image", "text": "Disassembled device showing internal components and removable hard drive", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.364+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9f3d69f2-d72d-4d83-b0c1-2b55e2dfb534", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.764, "x": 0.118, "y": 0.539 }, "kind": "paragraph", "text": "We believe the foregoing issues evidence a company that either does not know how to do device security, or does not care about it. Ironically, STJ touts its claimed strength in network security.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.364+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "120c0188-7054-42ec-b5a0-7483eb8bcc9e", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.764, "x": 0.118, "y": 0.763 }, "kind": "paragraph", "text": "MedSec was able to review only a small portion of the massive code base, yet it found vulnerabilities on a regular basis. STJ should and could identify and fix these as subset of the MedSec identified vulnerabilities, and new vulnerabilities will likely continue to exist, unless", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.364+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c7a06f5d-e151-4350-be14-3729c562412d", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.764, "x": 0.118, "y": 0.662 }, "kind": "paragraph", "text": "Although MedSec has spent considerable time researching STJ's devices (and those of its major competitors), it expects that there are numerous additional security issues with its Cardiac Device ecosystem. MedSec extrapolates this based on the obvious lack of attention to security evident in the devices it has researched. This seeming shoddiness is more likely than not a systemic problem at STJ, rather than an isolated one.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.364+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cb59dba7-25f3-4585-8597-fda21ead563a", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.764, "x": 0.118, "y": 0.59 }, "kind": "paragraph", "text": "It strikes us as bizarre that STJ seems so focused on its internal corporate network, which is arguably its last line of defense (and does nothing to protect against local attacks), while distributing hundreds of thousands of non-secure Merlin@home devices into the homes of its customers.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.364+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d959414f-58b0-4be5-8e88-bf778a3d4770", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "STJ seems quite proud of its “CTAC” – “Cyber Threat Action Center”. “CTAC’s mission is to identify, protect against, respond to, and enhance resiliency against cyber security threats. Learn how St. Jude Medical fulfills this mission by using threat intelligence to monitor for emerging threats against the healthcare industry and make informed verdicts on events in its SIEM.” — St. Jude Medical (via footnote 16)", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-083806523218", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.764, "x": 0.118, "y": 0.836 }, "kind": "source-note", "text": "16 STJ seems quite proud of its “CTAC” – “Cyber Threat Action Center”. “CTAC’s mission is to identify, protect against, respond to, and enhance resiliency against cyber security threats...", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.364+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b2d6aab7-f9b0-4300-8633-3255438c41c7", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.358, "x": 0.118, "y": 0.505 }, "kind": "title", "text": "Incompetence or Indifference?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.364+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3c3fc0c5-ea65-4b6e-bfe0-5e2c27b18725", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 15, "type": "tension", "title": "This is a research note detailing cybersecurity vulnerabilities in medical devices.", "function": "diagnose_problem", "rawType": "problem_statement", "block": null, "metadata": { "slideType": "problem_statement", "slideTypeCanon": { "name": "Problem statement", "slug": "problem_statement", "status": "active", "canonId": "019de52d-0879-768d-bba8-8da8a5a121d4", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 85, "componentCount": 10, "textChars": 2305, "nDataPoints": 2, "notes": "This is a research note detailing cybersecurity vulnerabilities in medical devices.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:49.259+00", "seconds": 7.656, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/15", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-15", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "MedSec demonstrated two types of potentially catastrophic attacks: \"crash\" attacks that remotely disable cardiac devices, and in some cases, appear to cause the Cardiac Device to pace at a dangerous rate, and a battery drain attack that remotely runs Cardiac Device batteries down.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-bef005600301", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.35 }, "kind": "list", "text": "“crash” attacks that remotely disable cardiac devices, and in some cases, appear to cause the Cardiac Device to pace at a dangerous rate, and a battery drain attack that remotely runs Cardiac Device batteries down.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7f0ce34-e0a9-4365-b9fb-6d4df73dc86c", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.8, "x": 0.1, "y": 0.2 }, "kind": "paragraph", "text": "In the U.S. alone, STJ has over 260,000 active Merlin@home devices in the homes of users of Cardiac Devices. (The worldwide number is likely hundreds of thousands of units higher.) Many Merlin@home users keep the devices in their bedrooms, connected to STJ’s network while they sleep.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0cf926a6-540c-4ba1-b424-7e46f90c59fd", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.52 }, "kind": "paragraph", "text": "It is important to note that MedSec demonstrated these attacks on pacemakers and ICDs. CRTs, which were 16% of 2015 revenue, were unavailable for the demonstrations. Because these attacks exploit the communication protocol between the Merlin@home devices and the Cardiac Devices, MedSec is confident that CRTs are similarly vulnerable.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5aba308d-d9dd-4f7b-b69c-fcb96dad806a", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.8, "x": 0.1, "y": 0.09 }, "kind": "paragraph", "text": "STJ reworks large portion of the code of the Merlin@home, Programmer, and implantable Cardiac Devices. The company should include anti-fuzzing, anti-debugging methods, buffer overflow protection, integer overflow protection, and string format protection.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a77f7776-a55b-482b-a626-106f8208a583", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.65 }, "kind": "paragraph", "text": "The Crash Attacks involve broadcasting a combination of signals that places Cardiac Devices into a state of malfunction. Many of the Cardiac Devices tested are vulnerable to attacks broadcast through a single Merlin@home device that is either compromised, or via a software defined radio (“SDR”) using a broadcast antenna. The Crash Attacks generally took less than one hour to take effect.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c0a9d24d-c7ae-449a-b56f-98631cd66182", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "\"Software-defined radio (SDR) is a radio communication system where components that have been typically implemented in hardware (e.g. mixers, filters, amplifiers, modulators/demodulators, detectors, etc.) are instead implemented by means of software on a personal computer or embedded system.\" — Markus Dillinger, Kambiz Madani, Nancy Alonistioti (via Wikipedia/Wiley & Sons, 2003)", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-c35c35e87e35", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.8, "x": 0.1, "y": 0.78 }, "kind": "source-note", "text": "17 As of May 2014... 18 “Software-defined radio (SDR) is a radio communication system...", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0856a36a-0975-4150-af9e-5ea96b8026ca", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.5, "x": 0.1, "y": 0.16 }, "kind": "title", "text": "Demonstrated Attacks – Likely Just Two of Many Possibilities", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2b8948a9-9f71-46fc-a2f1-8925bca29e8e", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.1, "y": 0.62 }, "kind": "title", "text": "a. “Crash Attacks”", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.259+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f64b7643-688b-4a56-94a8-d6928a405361", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 16, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 15, "name": "Agitate (Make it worse)", "beatId": "6559ca19-6514-47c9-9f35-ed43e8a37ab7", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Agitate (Make it worse)", "slug": "problem-agitate-solution-agitate-make-it-worse", "status": "active", "canonId": "019dd9b8-0f5a-71dd-bae7-8fadb0d09456", "version": 1, "description": null }, "evidence": "The document agitates the problem by highlighting demonstrated attacks and potential consequences", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Development", "slug": "development", "status": "active", "canonId": "019dd9b8-0332-7008-b3aa-11b0840a57b1", "version": 1, "description": "The middle stretch in arcs that have one. Often where length problems creep in." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 16, "type": "appendix", "title": "This slide serves as a descriptive narrative of a technical vulnerability, referencing a specific demonstration and expert interpretation.", "function": "diagnose_problem", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "balanced", "densityScore": 37, "componentCount": 5, "textChars": 1287, "nDataPoints": 0, "notes": "This slide serves as a descriptive narrative of a technical vulnerability, referencing a specific demonstration and expert interpretation.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:48.299+00", "seconds": 6.416, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/16", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-16", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "MedSec strongly suspects they were in many cases “bricked” – i.e., made to be non-functional.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-8e60ca2a3a48", "parentComponentId": null }, { "bbox": { "h": 0.115, "w": 0.764, "x": 0.118, "y": 0.111 }, "kind": "paragraph", "text": "In many cases, the Crash Attack made the Cardiac Device completely unresponsive to interrogations from Merlin@home devices and Merlin programmers. It was therefore impossible to tell whether, and how the Cardiac Devices, are functioning. MedSec strongly suspects they were in many cases “bricked” – i.e., made to be non-functional. It is likely physicians would explant a device that did not respond to the programmer.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cfdf250a-ee37-4883-ad66-cb064d663451", "parentComponentId": null }, { "bbox": { "h": 0.115, "w": 0.764, "x": 0.118, "y": 0.238 }, "kind": "paragraph", "text": "In some cases, a Cardiac Device subjected to a Crash Attack was still able to communicate with the programmer, and the information displayed was alarming. In a Crash Attack demonstration we witnessed on an ICD, the Crash Attack appears to have caused the device to pace at a rapid rate that could have adverse health consequences if it performed this way in a user.19 Below is a screenshot from the programmer showing the apparent malfunction. The red error messages above the lowest line are also indicators that the device is malfunctioning.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d40cc415-acaf-40a1-9ce9-0c5115c1d1be", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "Interpretation of pacing data by MedSec medical advisor and board member, Dr. Hemal Nayak. See The Appendix. — Footnote 19", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:38+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-93505860b985", "parentComponentId": null }, { "bbox": { "h": 0.025, "w": 0.65, "x": 0.118, "y": 0.881 }, "kind": "source-note", "text": "19 Interpretation of pacing data by MedSec medical advisor and board member, Dr. Hemal Nayak. See The Appendix.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6b80ee98-f51e-427d-bf9a-27069d7a0a1b", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 16, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 15, "name": "Agitate (Make it worse)", "beatId": "6559ca19-6514-47c9-9f35-ed43e8a37ab7", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Agitate (Make it worse)", "slug": "problem-agitate-solution-agitate-make-it-worse", "status": "active", "canonId": "019dd9b8-0f5a-71dd-bae7-8fadb0d09456", "version": 1, "description": null }, "evidence": "The document agitates the problem by highlighting demonstrated attacks and potential consequences", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Development", "slug": "development", "status": "active", "canonId": "019dd9b8-0332-7008-b3aa-11b0840a57b1", "version": 1, "description": "The middle stretch in arcs that have one. Often where length problems creep in." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 17, "type": "appendix", "title": "The slide includes a photograph of a St. Jude Medical device interface and a descriptive paragraph about a security vulnerability.", "function": "illustrate_case", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "illustrate_case", "functionCanon": { "name": "Illustrate case", "slug": "illustrate_case", "status": "active", "canonId": "019de52d-13b4-772c-bb73-1873612a7463", "version": 1, "description": null }, "density": "sparse", "densityScore": 19, "componentCount": 5, "textChars": 464, "nDataPoints": 0, "notes": "The slide includes a photograph of a St. Jude Medical device interface and a descriptive paragraph about a security vulnerability.", "elementsJson": [ "screenshot", "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:46.853+00", "seconds": 4.834, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/17", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-17", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "MedSec has demonstrated a Battery Drain attack that generates signals from the Merlin@home device to run down batteries in Cardiac Devices at a greatly accelerated rate.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-caeeb9115fa4", "parentComponentId": null }, { "bbox": { "h": 0.65, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "image", "text": "St. Jude Medical device interface", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.853+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "87efdefe-d8d2-4723-bd4c-4e3efdecf979", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.78, "x": 0.11, "y": 0.8 }, "kind": "paragraph", "text": "MedSec has demonstrated a Battery Drain attack that generates signals from the Merlin@home device to run down batteries in Cardiac Devices at a greatly accelerated rate.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.853+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "43156997-7cac-4182-9c71-c413605d4a71", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.5, "x": 0.11, "y": 0.89 }, "kind": "source-note", "text": "20 The exact depletion rate depends on the type and version of device.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.853+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a0216f5a-dda0-4c39-9071-1f8699f9eb0b", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.17, "y": 0.768 }, "kind": "title", "text": "b. Battery Drain Attack", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.853+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5b4c0220-68d2-4f08-9817-25efc339fe71", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 18, "type": "analysis", "title": "This page contains text from a research report regarding cybersecurity vulnerabilities in medical devices.", "function": "diagnose_problem", "rawType": "research-note", "block": null, "metadata": { "slideType": "research-note", "slideTypeCanon": null, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 77, "componentCount": 10, "textChars": 1685, "nDataPoints": 0, "notes": "This page contains text from a research report regarding cybersecurity vulnerabilities in medical devices.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:46.716+00", "seconds": 4.433, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/18", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-18", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We believe in-home communication compatible Cardiac Devices should be recalled, either voluntarily by STJ or mandatorily by the U.S. Food and Drug Administration (\"FDA\").", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-eceb7f05bae8", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.69 }, "kind": "paragraph", "text": "Manufacturers independently initiate the overwhelming majority of medical device recalls. These are labeled “voluntary” recalls conducted pursuant to 21 CFR Part 7. However, the FDA’s authority pursuant to Section 518(e) of the Federal Food, Drug, and Cosmetic Act (“FDCA”)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1d416b33-7980-4305-9686-1c712f899c1b", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.55 }, "kind": "paragraph", "text": "We believe in-home communication compatible Cardiac Devices should be recalled, either voluntarily by STJ or mandatorily by the U.S. Food and Drug Administration (“FDA”).", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "78e6483c-3a31-4a21-a7e4-254f089ddeb5", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.78, "x": 0.11, "y": 0.21 }, "kind": "paragraph", "text": "A large scale attack is theoretically possible either through [redacted] and possibly through STJ's own Merlin network. An attack through the Merlin network could be possible because of the compromised login credentials for the network.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7c05f2cf-8920-4701-b3f5-754165de9712", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "their bedrooms, making it possible to run down batteries while users are sleeping. While untested, MedSec believes the new code would drain devices at six times the rate – or in approximately two weeks of nightly broadcasts.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8bca41a7-2680-4138-8791-76e22fbc77cb", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.37 }, "kind": "paragraph", "text": "We are unaware of any imminent threat to patient safety. However, we believe it is prudent from a security standpoint for STJ to immediately disable the RF capability of patients' implanted devices.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b7204577-cd9f-4d40-99d5-cc7897a2a244", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "MedSec’s medical advisor, Dr. Hemal Nayak, who is a cardiac electrophysiologist, has advised his patients to disconnect their Merlin@home units. He is no longer implanting STJ devices until the problem is remediated.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:39+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-854f-f02e13a830ad", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.77 }, "kind": "source-note", "text": "Footnotes 21-25 detailing sources and regulatory references.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4c62eb35-6d02-499a-ab4f-9bc4f142e22c", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.49 }, "kind": "title", "text": "Analysis of Recall Likelihood & FDA Medical Device Cybersecurity Regulatory Framework", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "167a9a3b-496c-4c11-9e97-b90b49e491a4", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.78, "x": 0.11, "y": 0.65 }, "kind": "title", "text": "FDA Statutory and Regulatory Basis for Device Recalls", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d06d4c4a-fdb0-4a31-a5cb-ba209587d212", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 22, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 18, "name": "Solution (Provide relief)", "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Solution (Provide relief)", "slug": "problem-agitate-solution-solution-provide-relief", "status": "active", "canonId": "019dd9b8-0fee-73e9-9ae5-799c7f3895cd", "version": 1, "description": null }, "evidence": "The document provides a solution through regulatory action and recall likelihood analysis", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 19, "type": "appendix", "title": "The text discusses the regulatory framework for medical device recalls and cybersecurity vulnerabilities, referencing specific FDA guidance documents.", "function": "appendix", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "appendix", "functionCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-138d-750b-83c3-49b4bc7a7a38", "version": 1, "description": null }, "density": "balanced", "densityScore": 38, "componentCount": 6, "textChars": 1036, "nDataPoints": 0, "notes": "The text discusses the regulatory framework for medical device recalls and cybersecurity vulnerabilities, referencing specific FDA guidance documents.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:45.324+00", "seconds": 2.946, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/19", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-19", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Should STJ not voluntarily recall these Devices once informed of the high probability that the device would cause serious, adverse health consequences or death, the FDA has ample regulatory basis to order a recall.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-94ff3cae9127", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.764, "x": 0.118, "y": 0.675 }, "kind": "disclaimer", "text": "26-33: Footnotes detailing FDA recall definitions, draft guidance links, and specific document sections.", "attrs": null, "canon": { "kind": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc", "version": 1, "description": "Legal/cautionary text that occupies most of the body of its slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.324+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "17063761-a846-47c3-9b2c-d1f199fcacdf", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.764, "x": 0.118, "y": 0.37 }, "kind": "paragraph", "text": "The Draft Guidance focuses on “assessing the risk to the device’s essential clinical performance”. Essential clinical performance is the “performance necessary to achieve freedom from unacceptable risk”.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.324+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "28a09600-cfff-4f09-8dac-0139377289b7", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.764, "x": 0.118, "y": 0.25 }, "kind": "paragraph", "text": "The FDA issued a draft guidance document entitled “Postmarket Management of Cybersecurity in Medical Devices” (the “Draft Guidance”) on January 22, 2016. The Draft Guidance details FDA’s current thinking on “managing postmarket cybersecurity vulnerabilities for marketed medical devices.”", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.324+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8a024e36-1358-4fe7-aa64-23edc59b0eae", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "a cybersecurity vulnerability might impact all of the medical devices in a manufacturer's portfolio based on how their products are developed... — FDA Draft Guidance", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-99d56a4082b6", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.764, "x": 0.118, "y": 0.217 }, "kind": "title", "text": "FDA Draft Guidance Document on Postmarket Device Cybersecurity", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.324+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b76130c7-c806-4475-84c1-fb7085dab1c3", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 22, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 18, "name": "Solution (Provide relief)", "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Solution (Provide relief)", "slug": "problem-agitate-solution-solution-provide-relief", "status": "active", "canonId": "019dd9b8-0fee-73e9-9ae5-799c7f3895cd", "version": 1, "description": null }, "evidence": "The document provides a solution through regulatory action and recall likelihood analysis", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 20, "type": "appendix", "title": "The page is a continuation of a research note, focusing on risk assessment frameworks (CVSS 3.0 and ANSI/AAMI/ISO 14971).", "function": "appendix", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "appendix", "functionCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-138d-750b-83c3-49b4bc7a7a38", "version": 1, "description": null }, "density": "dense", "densityScore": 61, "componentCount": 7, "textChars": 2414, "nDataPoints": 0, "notes": "The page is a continuation of a research note, focusing on risk assessment frameworks (CVSS 3.0 and ANSI/AAMI/ISO 14971).", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:47.109+00", "seconds": 4.493, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/20", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-20", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Based on the Draft Guidance and its recommended tools, we therefore assess the severity of the exploit to patient health to be “catastrophic.”", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-2314efb4754e", "parentComponentId": null }, { "bbox": { "h": 0.125, "w": 0.772, "x": 0.118, "y": 0.465 }, "kind": "paragraph", "text": "As shown supra, MedSec has demonstrated an attack that can cause a Device to pace at a potentially dangerous rhythm. MedSec has also demonstrated a battery drain attack, and certain Device dependent patients could experience severe health consequences if their Devices lost power and failed to function. Based on the Draft Guidance and its recommended tools, we therefore assess the severity of the exploit to patient health to be \"catastrophic.\" The below matrix from the Draft Guidance deems a vulnerability with high exploitability and catastrophic impact if exploited an uncontrolled risk.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "699a19fc-01b6-467f-86ba-3c010f0368d1", "parentComponentId": null }, { "bbox": { "h": 0.225, "w": 0.772, "x": 0.118, "y": 0.215 }, "kind": "paragraph", "text": "To determine whether a risk is uncontrolled, the Draft Guidance suggests that manufacturers look to cybersecurity vulnerability assessment tools to determine exploitability. It mentions one tool that could assist, called the \"Common Vulnerability Scoring System\", version 3.0. Based on our inputs to the CVSS 3.0 model, the exploitability of the vulnerabilities for the Devices ranges from \"High\" to \"Critical\". Further, FDA's Draft Guidance indicates that manufacturers \"should also have a process for assessing the severity impact to health, if the cybersecurity vulnerability were to be exploited.\" The Draft Guidance suggests one for such assessment to be the ANSI/AAMI/ISO 14971: 2007/R2010: Medical Devices – Application of Risk Management to Medical Devices. Pursuant to this tool, a common term for assessing a qualitative severity level resulting in patient death would be \"catastrophic\" while, on the lower end of the severity spectrum, a common term for a severity level resulting in inconvenience or temporary discomfort would be \"negligible.\"", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "89b824de-50fb-4bbf-95e5-9e11c0801f12", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.772, "x": 0.118, "y": 0.145 }, "kind": "paragraph", "text": "In terms of understanding the probability of an attack taking place, University of Michigan medical device cybersecurity research Kevin Fu pointed out that the malicious third party controls the probability distribution of an attack.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e3bbb3bf-705e-4f00-82a3-38ec84a69074", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.772, "x": 0.118, "y": 0.093 }, "kind": "paragraph", "text": "then manufacturers should remediate it. Based on our conversations with industry experts, we estimate this remediation would take at least two years.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f81e17a8-2168-4e6c-af82-82881b16cade", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "University of Michigan medical device cybersecurity research Kevin Fu pointed out that the malicious third party controls the probability distribution of an attack.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-25af76d5ad5a", "parentComponentId": null }, { "bbox": { "h": 0.125, "w": 0.772, "x": 0.118, "y": 0.805 }, "kind": "source-note", "text": "34-42: Citations and references to Draft Guidance, YouTube, and ISO standards.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b2320618-d73a-492d-b7fb-aa346d6df3b9", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "91a43238-ce91-48a4-b625-674490e8db56", "evidence": "Medical Devices – Application of Risk Management to Medical Devices", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 20, "frameworkName": "ANSI/AAMI/ISO 14971" }, { "matchId": "cbcfbfe8-de0a-4118-ab5e-cacda4780edd", "evidence": "Common Vulnerability Scoring System", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:50:47.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 20, "frameworkName": "CVSS 3.0" } ], "arcBeats": [ { "to": 22, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 18, "name": "Solution (Provide relief)", "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Solution (Provide relief)", "slug": "problem-agitate-solution-solution-provide-relief", "status": "active", "canonId": "019dd9b8-0fee-73e9-9ae5-799c7f3895cd", "version": 1, "description": null }, "evidence": "The document provides a solution through regulatory action and recall likelihood analysis", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 21, "type": "tension", "title": "The slide highlights a specific case study involving St. Jude Medical to demonstrate 'uncontrolled risk' in medical device security.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 44, "componentCount": 7, "textChars": 927, "nDataPoints": 0, "notes": "The slide highlights a specific case study involving St. Jude Medical to demonstrate 'uncontrolled risk' in medical device security.", "elementsJson": [ "heatmap", "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:45.685+00", "seconds": 3.055, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/21", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-21", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The Draft Guidance provides several examples of uncontrolled risks. One examples is strikingly similar to the vulnerabilities and attacks MedSec has discovered:", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-23 01:18:10+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-64d3-706e-a462-6552b82eec32", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.5, "x": 0.25, "y": 0.08 }, "kind": "chart", "text": "Risk Matrix showing Severity Impact to Health vs Exploitability", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Heatmap", "slug": "heatmap", "status": "active", "canonId": "019de52d-00cd-71ee-bf36-233b7817c304", "version": 1, "description": null }, "framework": null }, "subkind": "heatmap", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a6d53d6c-cebb-48ee-9aa4-f125a7114bf3", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.71 }, "kind": "paragraph", "text": "Pursuant to the Draft Guidance, FDA recommends specific changes to address vulnerabilities associated with the types of uncontrolled risks described in this example.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1ff00a68-fc4f-448f-adc0-688169031079", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.45 }, "kind": "paragraph", "text": "A manufacturer becomes aware of a vulnerability via a researcher that its Class III medical device can be reprogrammed by an unauthorized user. This vulnerability could result in permanent impairment, a life-threatening injury, or death.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "354d4940-9614-4f9f-a3cc-dfe11b8d6552", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.34 }, "kind": "paragraph", "text": "The Draft Guidance provides several examples of uncontrolled risks. One examples is strikingly similar to the vulnerabilities and attacks MedSec has discovered:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5d3bc576-28ed-4398-8c6f-2da544dd3c34", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.3, "x": 0.1, "y": 0.87 }, "kind": "source-note", "text": "Draft Guidance, part VII.B. Id. Id.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0784ae7d-a0f9-4c6a-80b7-d3b7bf26be10", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.39 }, "kind": "title", "text": "Examples of Vulnerabilities Associated with Uncontrolled Risk That Must Be Remediated and Response Actions:", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d0a168b0-83ca-4bf4-bf06-7321180d89cc", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "68d8c799-fc58-4c6e-9ef2-8b13370ae314", "evidence": "Risk assessment matrix used to categorize vulnerability severity and exploitability.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:45.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 21, "frameworkName": "heatmap-matrix" } ], "arcBeats": [ { "to": 22, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 18, "name": "Solution (Provide relief)", "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Solution (Provide relief)", "slug": "problem-agitate-solution-solution-provide-relief", "status": "active", "canonId": "019dd9b8-0fee-73e9-9ae5-799c7f3895cd", "version": 1, "description": null }, "evidence": "The document provides a solution through regulatory action and recall likelihood analysis", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 22, "type": "appendix", "title": "This page is a continuation of a research note, likely from a report by MedSec regarding St. Jude Medical (STJ) device security.", "function": "appendix", "rawType": "appendix", "block": null, "metadata": { "slideType": "appendix", "slideTypeCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-0762-71f8-b564-89ab863301cc", "version": 1, "description": null }, "function": "appendix", "functionCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-138d-750b-83c3-49b4bc7a7a38", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 79, "componentCount": 9, "textChars": 3147, "nDataPoints": 0, "notes": "This page is a continuation of a research note, likely from a report by MedSec regarding St. Jude Medical (STJ) device security.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:47.229+00", "seconds": 4.548, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/22", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-22", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Pursuant to 21 CFR § 7.40, STJ should recall its Devices because the Devices present “a risk of injury or gross caption or are otherwise defective” as demonstrated by MedSec’s research and in light of FDA’s current medical device and cybersecurity policies.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-3a40d5be1a8d", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.766, "x": 0.117, "y": 0.268 }, "kind": "paragraph", "text": "The vulnerability in the ecosystem is the compromised communication protocol between the Merlin@home units and the Cardiac Devices. Because in-home units are widely available and easy to exploit, MedSec believes that STJ must develop a new communication protocol in order to secure the Cardiac Devices.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.229+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2be837e2-8200-4db3-8a8d-80b7f41d79e1", "parentComponentId": null }, { "bbox": { "h": 0.075, "w": 0.766, "x": 0.117, "y": 0.353 }, "kind": "paragraph", "text": "We estimate that it would take STJ at least two years to develop a new RF communication protocol. We assume the total team size required for this project would be 10 to 15 people. We understand that adding people to the team would likely not speed up the development time. Our assumption includes an expected approval timeline of three to six months.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.229+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3a2d5f97-f43a-4ed3-828b-6828f73c5128", "parentComponentId": null }, { "bbox": { "h": 0.135, "w": 0.766, "x": 0.117, "y": 0.443 }, "kind": "paragraph", "text": "STJ's lack of adequate attention to secure system architecture and design and implementation has resulted in an embedded system eco-system that will be very difficult to remediate. These solutions would then need to be written into the existing code base. In simpler situations, a security update can be applied to the protocol without affecting the rest of the system. In this case, STJ appears to have intertwined many of the different layers of communication throughout the software. As a result, it appears there is no part of the programming stack on which a remediation effort could focus. Large parts of the extremely large codebase would have to be re-written.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.229+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "734983f9-edeb-4353-a023-5583f10c3561", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.766, "x": 0.117, "y": 0.758 }, "kind": "paragraph", "text": "Pursuant to 21 CFR § 7.40, STJ should recall its Devices because the Devices present \"a risk of injury or gross caption or are otherwise defective\" as demonstrated by MedSec's research and in light of FDA's current medical device and cybersecurity policies. Should STJ not voluntarily", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.229+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7939eb5b-40a5-4456-bc72-695f27f8c651", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.766, "x": 0.117, "y": 0.593 }, "kind": "paragraph", "text": "To protect existing Device users, STJ could disable the Devices' RF (radio frequency) capabilities as a \"compensating control\". A compensating control is a countermeasure used in the absence of sufficient controls designed into the device. MedSec's observations of STJ's devices cause it to believe this is practicable to implement. With the RF disabled, devices would be unable to use the in-home devices and network and would need close proximity for interrogation. As a result, certain patients would need to see their physicians more frequently to compensate for the lack of remote monitoring. It should be noted MedSec sees no reason to expect STJ's major competitors to interrupt access to their home monitoring networks.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.229+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9ff4de9e-eb3d-4b3e-97b3-a5b8edcc0d4c", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "According to MedSec medical advisor Dr. Hemal Nayak. However, he points out that remote monitoring improves patient outcomes and survival. — Footnote 49", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-3d95ea7fbffc", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.766, "x": 0.117, "y": 0.82 }, "kind": "source-note", "text": "46 Id. 47 FDA's \"Guidance for Industry: Product Recalls, Including Removals and Corrections,\" available at http://www.fda.gov/Safety/Recalls/IndustryGuidance/ucm129259.htm (last accessed Aug. 22, 2016). 48 Draft Guidance, part IV.A. 49 According to MedSec medical advisor Dr. Hemal Nayak. However, he points out that remote monitoring improves patient outcomes and survival.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.229+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "784594fa-be98-4758-86b7-9a29b22d20b6", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.395, "x": 0.117, "y": 0.233 }, "kind": "title", "text": "Recall Likelihood and Conclusions", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.229+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d3cd92d1-6974-42e1-af86-4ac1979d5899", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 22, "arc": { "name": "Problem-Agitate-Solution", "slug": "problem-agitate-solution", "status": "active", "bestFor": "Sales pitches, urgency-driven, competitive displacement", "canonId": "019dd956-5ec6-70f9-9fd8-fdbaaff39acf", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Problem (Identify pain) -> Agitate (Make it worse) -> Solution (Provide relief)", "description": null, "familyLabel": null }, "from": 18, "name": "Solution (Provide relief)", "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de", "matchId": "8b428f59-a264-4e2d-9486-e235035e71e2", "beatType": { "name": "Solution (Provide relief)", "slug": "problem-agitate-solution-solution-provide-relief", "status": "active", "canonId": "019dd9b8-0fee-73e9-9ae5-799c7f3895cd", "version": 1, "description": null }, "evidence": "The document provides a solution through regulatory action and recall likelihood analysis", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 23, "type": "evidence", "title": "The slide uses a historical precedent (Hospira) to argue for the necessity of a recall for STJ devices based on similar cybersecurity risks.", "function": "cite_precedent", "rawType": "cite_precedent", "block": null, "metadata": { "slideType": "cite_precedent", "slideTypeCanon": { "name": "Cite precedent", "slug": "cite_precedent", "status": "active", "canonId": "019de52d-12ec-72be-8881-51b438fa76c7", "version": 1, "description": null }, "function": "cite_precedent", "functionCanon": { "name": "Cite precedent", "slug": "cite_precedent", "status": "active", "canonId": "019de52d-142b-714b-86d4-58aad7b568ec", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 87, "componentCount": 10, "textChars": 2520, "nDataPoints": 3, "notes": "The slide uses a historical precedent (Hospira) to argue for the necessity of a recall for STJ devices based on similar cybersecurity risks.", "elementsJson": [ "headline_text", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:47.452+00", "seconds": 4.561, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/23", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-23", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Medical device recall precedents support our view that the devices should be recalled - in our opinion, the risks and severity of the STJ vulnerabilities rise at least to the levels of the following recalled devices.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-68da5f6d355b", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.764, "x": 0.118, "y": 0.093 }, "kind": "paragraph", "text": "recall the Devices, FDA has a regulatory basis to and could mandate that STJ recall the Devices pursuant to its recall authority granted under section 518(e) of the FDCA and 21 CFR part 810. Medical device recall precedents support our view that the devices should be recalled - in our opinion, the risks and severity of the STJ vulnerabilities rise at least to the levels of the following recalled devices.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "34532cdf-5fe8-407b-8554-fe4c0173a64b", "parentComponentId": null }, { "bbox": { "h": 0.115, "w": 0.764, "x": 0.118, "y": 0.251 }, "kind": "paragraph", "text": "In late 2013, well-known researcher Billy Rios purchased a Hospira Symbiq infusion pump on eBay for around $100 on a lark. Such pumps are commonplace in hospitals where health care providers use them to automatically deliver IV drips and injectable drugs to patients. Rios didn't have anything in particular in mind for the device, mostly looking to tinker. He soon discovered that he could remotely take over the device, which could have lethal consequences if used maliciously.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "71e6735f-ed0e-4fb1-aa05-b96e9256c744", "parentComponentId": null }, { "bbox": { "h": 0.055, "w": 0.764, "x": 0.118, "y": 0.373 }, "kind": "paragraph", "text": "Recognizing the implications of his discovery, Rios sent his detailed findings to the Department of Homeland (DHS) Security Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). In turn, ICS-CERT notified the Food and Drug Administration (FDA) and sent a report to Hospira.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "89def413-353c-4a54-aee1-828ef052a531", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.764, "x": 0.118, "y": 0.617 }, "kind": "paragraph", "text": "This tangible evidence showing how easily he could craft code that could kill someone prompted the FDA to take action. In July 2015, it issued an advisory urging hospitals to stop using Hospira's infusion pump.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ac25b417-e5c0-4dda-b03f-9db777f5fef4", "parentComponentId": null }, { "bbox": { "h": 0.075, "w": 0.764, "x": 0.118, "y": 0.525 }, "kind": "paragraph", "text": "Months passed without Rios hearing a word from Hospira and there was no indication that government agencies were preparing to take action. Rios renewed the fight after a medical scare forced him into a hospital—and hooked up to a Hospira pump—for several days. He filmed himself hacking into the infusion pump and provided DHS and FDA with sample computer code.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bda382f5-64dc-4f3f-b2ba-db8d4e6ae515", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.764, "x": 0.118, "y": 0.459 }, "kind": "paragraph", "text": "Interestingly, in 2013 Hospira had already decided to discontinue the Symbiq pump and planned to spend $300-$350 million on doing away with its legacy pumps and developing replacements, purportedly due to scrutiny by the FDA of quality issues.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d803ad48-e893-4294-9153-92e2ce10e484", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.764, "x": 0.118, "y": 0.683 }, "kind": "paragraph", "text": "Pharmaceuticals giant Pfizer proceeded with its acquisition of Hospira (announced in February 2015) despite the negative publicity and closed the $17 billion deal in September 2015. In May", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f6a03f68-d1b5-44ee-a5f8-9ce08885cb84", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.764, "x": 0.118, "y": 0.777 }, "kind": "source-note", "text": "50-55: Citations for the Hospira case study including Bloomberg, Chicago Tribune, and FDA notices.", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a03bf6d5-c997-47fa-9258-a85f1f4b16b4", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.315, "x": 0.118, "y": 0.216 }, "kind": "title", "text": "Hospira Pump Recall Case Study", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "351c3a2f-b936-41d1-8df9-542eb4198a41", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "593189b1-9fbf-4a62-82b4-64c343879cfd", "evidence": "Uses Hospira recall as a precedent to argue for STJ recall.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:50:47.452+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 23, "frameworkName": "argument-from-analogy" } ], "arcBeats": [], "loops": [ { "to": 24, "from": 23, "loop": { "name": "39_benchmark_gap", "slug": "39-benchmark-gap", "status": "active", "bestFor": "Performance improvement, competitive analysis, target setting", "canonId": "019dd956-75a4-7522-8d1a-af94da4703e9", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "Our Performance -> Industry Average -> Best-in-Class -> The Gap = The Opportunity", "description": "Compare performance against best-in-class to quantify the opportunity", "familyLabel": null }, "matchId": "d9ef2888-e98f-41cd-8ff2-fb6d0ddcdd8d", "evidence": "The document cites precedent with Hospira Pump Recall Case Study and Guidant Recall Case Study", "position": 1, "objective": "How does St. Jude Medical's security compare to industry standards?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:58:03.660547+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 24, "type": "appendix", "title": "This page serves as a reference document with footnotes for a larger research report.", "function": "appendix", "rawType": "appendix", "block": null, "metadata": { "slideType": "appendix", "slideTypeCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-0762-71f8-b564-89ab863301cc", "version": 1, "description": null }, "function": "appendix", "functionCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-138d-750b-83c3-49b4bc7a7a38", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 83, "componentCount": 9, "textChars": 2077, "nDataPoints": 14, "notes": "This page serves as a reference document with footnotes for a larger research report.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:48.207+00", "seconds": 5.032, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/24", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-24", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": { "h": 0.18, "w": 0.78, "x": 0.11, "y": 0.25 }, "kind": "paragraph", "text": "Eliot Spitzer, New York’s attorney general at the time, alleged that Guidant kept from the public a design flaw in one of its defibrillators. Shortly afterward, Johnson & Johnson, invoked the “material adverse change” clause (MAC). Guidant’s stock dropped to a low of $56.53 or down 25.6% from the $76 offer price. Ultimately, Boston Scientific stepped in and bought Guidant, but the acquisition proved to be even more costly with almost $9 billion of write downs from 2006 to 2012 and a $600 million settlement with Johnson & Johnson in 2015. Boston Scientific’s market capitalization a few years after buying Guidant for $27.2 billion dropped below $13 billion and hit a low of $7.7 billion in 2012.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3308c5e7-09db-4d16-87a5-ac9fe6524518", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.16 }, "kind": "paragraph", "text": "Johnson & Johnson announced that it was acquiring Guidant on December 15, 2004, for $76 a share, at a cost of $25.4 billion. Shortly after the acquisition announcement, issues with Guidant’s pacemakers and heart defibrillators arose.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "43bf43dc-2842-4ad1-aac1-853eccfebe0f", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.48 }, "kind": "paragraph", "text": "Boston Scientific’s ill-fated 2006 acquisition of Guidant in 2006 came to a head in March 2010 when the company announced a recall of its entire lineup of implantable defibrillators, a legacy Guidant business area. The news prompted an overnight 13% drop in Boston Scientific’s share price, erased hundreds of millions in annual revenue, and resulted in a drop in total market share for defibrillators from 28% to 22%. A study at the time by McKinsey, a consulting firm, estimated that the company would lose $5 million each day these products were off the market.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "696d4122-b9c9-430d-8927-05452b77452f", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.08 }, "kind": "paragraph", "text": "2016, however, reports surfaced that Pfizer was looking to sell Hospira’s troubled pump business for $1.2-$2 billion.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a90f5d31-8e1c-4eb4-86dd-3d420a466520", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.62 }, "kind": "paragraph", "text": "Boston Scientific recalled (to their credit, voluntarily) the devices upon discovering that two manufacturing process changes were made without FDA approval. The scope of those changes", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f73c37d1-32c6-4943-b2ee-987b28ae63e5", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "The Securities and Exchange Commission opened a formal inquiry into “product disclosures and trading in Guidant stock”. — Eliot Spitzer, New York's attorney general at the time", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-e2fbf51a00bb", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.78, "x": 0.11, "y": 0.68 }, "kind": "source-note", "text": "Footnotes 56-66 listed at the bottom of the page.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c62e04e0-36dd-4f20-8d14-5805fa35b3c6", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.25, "x": 0.11, "y": 0.13 }, "kind": "title", "text": "Guidant Recall Case Study", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "11c5cfa5-8156-4508-a373-2a8b1b3f322d", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.25, "x": 0.11, "y": 0.45 }, "kind": "title", "text": "Boston Scientific Case Study", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.207+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "31954cc5-5280-462a-826f-8429f58360d1", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Narrative foundations (from the Storymakers methodology)", "slug": "narrative-foundations", "status": "active", "bestFor": null, "canonId": "019df269-258b-71bd-ad14-53598df04d2b", "version": 1, "bodyDocId": "019df269-2567-736e-8b9c-4ec77611334a", "description": "This skill focuses on the *adversarial* genre — activist campaigns, short", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "407c2c67-877f-4e4c-bc4e-797a06ca7151", "evidence": "The Securities and Exchange Commission opened a formal inquiry into 'product disclosures and trading in Guidant stock'.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:57:45.602189+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 24, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Storytelling Effect", "slug": "storytelling-effect", "status": "active", "bestFor": null, "canonId": "019dd956-981b-74f9-9096-5c8df03dab5a", "version": 1, "bodyDocId": null, "description": "Stories are remembered up to 22x better than facts alone", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "374ef6ae-a95f-46a5-9a87-282a513ff01d", "evidence": "Eliot Spitzer, New York's attorney general at the time, alleged that Guidant kept from the public a design flaw in one of its defibrillators.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:57:45.643353+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 24, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [], "loops": [ { "to": 24, "from": 23, "loop": { "name": "39_benchmark_gap", "slug": "39-benchmark-gap", "status": "active", "bestFor": "Performance improvement, competitive analysis, target setting", "canonId": "019dd956-75a4-7522-8d1a-af94da4703e9", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "Our Performance -> Industry Average -> Best-in-Class -> The Gap = The Opportunity", "description": "Compare performance against best-in-class to quantify the opportunity", "familyLabel": null }, "matchId": "d9ef2888-e98f-41cd-8ff2-fb6d0ddcdd8d", "evidence": "The document cites precedent with Hospira Pump Recall Case Study and Guidant Recall Case Study", "position": 1, "objective": "How does St. Jude Medical's security compare to industry standards?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:58:03.660547+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 25, "type": "analysis", "title": "The chart appears to be a screenshot from a financial data terminal (e.g., Bloomberg).", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 31, "componentCount": 6, "textChars": 359, "nDataPoints": 9, "notes": "The chart appears to be a screenshot from a financial data terminal (e.g., Bloomberg).", "elementsJson": [ "paragraph", "line_chart", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:48.546+00", "seconds": 5.318, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/25", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-25", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": { "h": 0.38, "w": 0.76, "x": 0.118, "y": 0.157 }, "kind": "chart", "text": "Market share trend line from 2007 to 2015", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.546+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ae65a737-dad4-4b53-a041-f6e088b10adf", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Market Share: 23.2983", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-7d6ca5bfb9d4", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.76, "x": 0.118, "y": 0.093 }, "kind": "paragraph", "text": "was not divulged. The company asked doctors to cease implanting the devices and return all inventory, although implanted devices were deemed safe.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.546+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7dd8c645-741c-42e0-8079-ce439aab031b", "parentComponentId": null }, { "bbox": { "h": 0.01, "w": 0.2, "x": 0.118, "y": 0.544 }, "kind": "source-note", "text": "*Millennium Research Group", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.546+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9ca04254-8dd1-4377-9b23-e6c3253194b7", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.6, "x": 0.118, "y": 0.894 }, "kind": "source-note", "text": "67 http://www.drugrecalllawyerblog.com/2010/03/heart_devices_and_the_companie.html", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.546+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f1910617-c0b2-4c1b-b9b5-c72afac153de", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.43, "x": 0.118, "y": 0.144 }, "kind": "title", "text": "Boston Scientific Revenue Market Share Loss", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.546+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a1fcc99e-b07d-4679-a517-675bcd326e2f", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Chartjunk Elimination", "slug": "chartjunk-elimination", "status": "active", "bestFor": null, "canonId": "019dd956-b49e-7453-ab01-b60f338eeda1", "version": 1, "bodyDocId": null, "description": "Remove decorative elements that don't convey data: 3D effects, shadows, unnecessary gridlines", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "a691a28e-998a-4172-879d-04af210474f8", "evidence": "Market share trend line from 2007 to 2015", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:57:45.723476+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 25, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [], "loops": [ { "to": 30, "from": 25, "loop": { "name": "27_cost_of_inaction", "slug": "27-cost-of-inaction", "status": "active", "bestFor": "Urgent budget requests, compliance, risk mitigation", "canonId": "019dd956-70d1-7395-a15b-857ba858b394", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Status Quo -> The Hidden Costs Accumulating -> The Future State of Inaction -> The Tipping Point", "description": "Quantify what happens if the audience does nothing", "familyLabel": null }, "matchId": "ab9a2b66-8b1d-4abd-96ba-1ffd9bf1975e", "evidence": "The document presents a scenario table analyzing Boston Scientific's revenue drop after recalls", "position": 0, "objective": "What are the financial implications of inaction on device recalls?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:58:03.620384+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 26, "type": "analysis", "title": "The slide combines historical data for Boston Scientific with a forward-looking DCF sensitivity analysis for St. Jude Medical.", "function": "analyze_data", "rawType": "scenario_table", "block": null, "metadata": { "slideType": "scenario_table", "slideTypeCanon": { "name": "Scenario table", "slug": "scenario_table", "status": "active", "canonId": "019de52d-129c-7393-8845-c5e595ce9a7b", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 51, "componentCount": 8, "textChars": 557, "nDataPoints": 15, "notes": "The slide combines historical data for Boston Scientific with a forward-looking DCF sensitivity analysis for St. Jude Medical.", "elementsJson": [ "headline_text", "line_chart", "footnote", "valuation_table", "paragraph" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:46.394+00", "seconds": 2.83, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/26", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-26", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Assumes that St. Jude shuts down the Merlin@home network for eight quarters to repair and re-architect the entire network.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-200eba9366bb", "parentComponentId": null }, { "bbox": { "h": 0.365, "w": 0.765, "x": 0.118, "y": 0.106 }, "kind": "chart", "text": "Historical revenue trend from 2006 to 2015", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.394+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d5e0228a-68f5-40c8-b6d2-9878baf2367f", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Revenue: $0.783B", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-24866d90f49a", "parentComponentId": null }, { "bbox": { "h": 0.155, "w": 0.765, "x": 0.118, "y": 0.738 }, "kind": "paragraph", "text": "Assumes that St. Jude shuts down the Merlin@home network for eight quarters to repair and re-architect the entire network. We think approximately 46% of St. Jude's revenues could be related or connected to the Merlin@home device.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.394+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "be795f4a-e6ae-479f-8807-47883c884521", "parentComponentId": null }, { "bbox": { "h": 0.081, "w": 0.527, "x": 0.237, "y": 0.592 }, "kind": "table", "text": "Revenue segment breakdown for 2015", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.394+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "484e49b0-8f2a-43d1-b61c-dcad45aca1a1", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.335, "x": 0.118, "y": 0.705 }, "kind": "title", "text": "Network Shut Down and Repair Scenario:", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.394+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "09d0b5eb-54e7-4dea-be00-906c6818be27", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.595, "x": 0.118, "y": 0.091 }, "kind": "title", "text": "Boston Scientific ICD Revenue Drop (including Leads) after Recalls:", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.394+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9b93e4dc-5b9a-4285-9de9-d22dafe27c46", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.101, "x": 0.118, "y": 0.551 }, "kind": "title", "text": "Valuation", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.394+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b2b3a6fb-369b-4e59-843e-f9dcae373954", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Scenario planning", "slug": "scenario-planning", "status": "active", "bestFor": "Time horizon ≥12 months · ≥2 high-impact uncertainties that cannot be expressed as probability distributions · top two uncertainties roughly independent · team commits to revisit every 12–18 months. For shorter horizons use sensitivity analysis; for quantifiable risk use Monte Carlo; for one-dominant-uncertainty use cascade scenarios.", "canonId": "019de52d-1eb5-7639-abaa-44d7f65af562", "version": 1, "bodyDocId": "1b2fdf8f-9345-4d78-9875-7184e3da22ec", "description": "A structured way to think about the future when prediction is impossible. Build three to four distinct, internally-coherent stories of how the world could unfold, and stress-test strategy against each. The output is a set of named worlds the team can argue with — not a probability distribution.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "751d0571-207a-4d82-aa9e-e5810b6bed6b", "evidence": "Assumes that St. Jude shuts down the Merlin@home network for eight quarters to repair and re-architect the entire network.", "pageRefs": null, "priority": null, "whenToUse": "Time horizon ≥12 months · ≥2 high-impact uncertainties that cannot be expressed as probability distributions · top two uncertainties roughly independent · team commits to revisit every 12–18 months. For shorter horizons use sensitivity analysis; for quantifiable risk use Monte Carlo; for one-dominant-uncertainty use cascade scenarios.", "confidence": 0.7, "extraction": { "at": "2026-07-16 22:57:45.803766+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 26, "whyItWorks": "Solves the two failure modes of forecasting at once: being precisely wrong (point estimates anyone can falsify) and uselessly hedged (ranges so wide they cannot guide action). Scenarios commit to a small set of plausible worlds and crystallise strategy into no-regret moves, sequenced bets, and lose-everywhere moves to drop. Names + early signals + wind-vane triggers turn the exercise into a usable contingency plan.", "antipattern": "Best/base/worst case (three points on one axis, not four scenarios) · probability-weighted average of scenarios (collapses to expected value) · Goldilocks-spaced scenarios that rank good-to-bad · scenarios named \"Scenario A/B/C\" instead of world-shape names · 50-row Excel labelled as a scenario (model, not story) · scenarios without measurable early signals.", "cardinality": null, "narrativePurpose": "Force narrative discipline on multi-year decisions where single-point forecasts fail. Translate structural uncertainty into a small set of decision frames the boardroom can act on by name." } ], "frameworks": [], "arcBeats": [], "loops": [ { "to": 30, "from": 25, "loop": { "name": "27_cost_of_inaction", "slug": "27-cost-of-inaction", "status": "active", "bestFor": "Urgent budget requests, compliance, risk mitigation", "canonId": "019dd956-70d1-7395-a15b-857ba858b394", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Status Quo -> The Hidden Costs Accumulating -> The Future State of Inaction -> The Tipping Point", "description": "Quantify what happens if the audience does nothing", "familyLabel": null }, "matchId": "ab9a2b66-8b1d-4abd-96ba-1ffd9bf1975e", "evidence": "The document presents a scenario table analyzing Boston Scientific's revenue drop after recalls", "position": 0, "objective": "What are the financial implications of inaction on device recalls?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:58:03.620384+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 27, "type": "analysis", "title": "The slide outlines specific adjustments to management guidance for various segments (CRM, Heart Failure, AF, Cardiovascular, Neuromodulation) and financial metr", "function": "analyze_data", "rawType": "appendix_methodology", "block": null, "metadata": { "slideType": "appendix_methodology", "slideTypeCanon": { "name": "Appendix methodology", "slug": "appendix_methodology", "status": "active", "canonId": "019de52d-07d9-726c-8599-167f2d2ffaa7", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 94, "componentCount": 16, "textChars": 2387, "nDataPoints": 18, "notes": "The slide outlines specific adjustments to management guidance for various segments (CRM, Heart Failure, AF, Cardiovascular, Neuromodulation) and financial metrics (Margins, SG&A, R&D, Capex) to reflect a stress-test scenario.", "elementsJson": [ "headline_text", "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:49.266+00", "seconds": 5.561, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/27", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-27", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": { "h": 0.03, "w": 0.76, "x": 0.118, "y": 0.735 }, "kind": "list", "text": "Longer dated revenue growth rates of 12% in 2019E and 8% in 2020E, margins, capex and tax rates recover to 2015 levels and remain relatively stable.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0298f11d-4bfd-427a-b6e4-7f7f23d2646c", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.118, "y": 0.3 }, "kind": "list", "text": "Atrial Fibrillation Segment Growth: Management 2016 guidance is in the 10% to 11% growth range. In this scenario, the CRM network slow down also impacts the AF segment, and we assume 8% growth through 2018 in this segment.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "05bcf427-1b68-4c1e-b222-438e8b47f3aa", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.118, "y": 0.165 }, "kind": "list", "text": "Traditional CRM Segment Decline: Traditional CRM segment (25% of 2015 Total Revenues) drops to zero for eight quarters and then starts coming back in 2018 and beyond.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0c207b8c-e164-42e4-927e-66d46c596070", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.76, "x": 0.118, "y": 0.41 }, "kind": "list", "text": "Neuromodulation Segment Growth: Management 2016 guidance, is in the 7% to 9% range. We think growth moves to 5% with technology security concerns in this segment.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "32c94424-6da5-49ab-8b34-1ea06fad294d", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.76, "x": 0.118, "y": 0.49 }, "kind": "list", "text": "SG&A: Management 2016 guidance range of 31.3% to 31.8%, however we think the percentage moves higher over an eight quarter period and closer to 33%.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4aecf9dd-91d5-4599-b5b5-4d0f20bc3fd9", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.76, "x": 0.118, "y": 0.66 }, "kind": "list", "text": "Capital Expenditures: Capex as a percent of sales is expected to increase to 5% from a historical range of 3% to 4% for an eight quarter time period and return to historical ranges thereafter.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "57719106-4bf4-4fc5-b8b0-8bc1819e4dca", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.76, "x": 0.118, "y": 0.58 }, "kind": "list", "text": "Other Expenses and Interest Expenses: Management guidance for 2016 of ~$155 million to $165 million, primarily driven by interest expense on our outstanding debt.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "58a90bfe-fb50-44ae-93d6-1640751c0732", "parentComponentId": null }, { "bbox": { "h": 0.01, "w": 0.76, "x": 0.118, "y": 0.77 }, "kind": "list", "text": "Assuming no foreign currency fluctuations.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6cc9050f-de3f-4e18-bedb-94abf98f4d28", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.76, "x": 0.118, "y": 0.63 }, "kind": "list", "text": "Tax Rate: For full year 2016, we continue to expect the effective tax rate to be in the range of 15.5% to 16.5%.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7e8203e6-dd1b-4ab0-8418-19d3cb08e4de", "parentComponentId": null }, { "bbox": { "h": 0.01, "w": 0.76, "x": 0.118, "y": 0.705 }, "kind": "list", "text": "Working Capital: Working capital remains flat at zero.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8baa6d93-f75d-4829-97b1-f863362dfad7", "parentComponentId": null }, { "bbox": { "h": 0.01, "w": 0.76, "x": 0.118, "y": 0.72 }, "kind": "list", "text": "Assumes debt maturities are refinanced in the market at the moment at the same rate.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "921e9974-4ead-48f8-9adc-9c0478407ace", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.76, "x": 0.118, "y": 0.445 }, "kind": "list", "text": "Gross Margins: Management 2016 guidance, of 69.0% to 69.5%, however we think margins will be impacted by lower ASPs and pressure from the CRM segment and thus assume 67% gross margin until 2Q18E.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "99369a3e-dd4e-4d02-b825-96a9ec5d4745", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.118, "y": 0.355 }, "kind": "list", "text": "Cardiovascular Segment Growth: According to management, the Cardiovascular segment is expected to grow 1% to 3% for 2016. In this scenario, the Merlin@home issues also negatively impact this segment and thus moves growth to zero percent.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "acfc45c7-9dae-4c1f-8ab2-e0fdd1a78607", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.76, "x": 0.118, "y": 0.22 }, "kind": "list", "text": "Heart Failure Segment Decline: Approximately 78% of the Heart Failure segment (20% of 2015 Total Revenues) comes from CRT-D and CRT-P cardiac devices, which are also connected to the Merlin@home device.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b37f6f5e-e2ea-47db-975f-8676c90a5784", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.118, "y": 0.525 }, "kind": "list", "text": "R&D: R&D is expected to remain in the 12.5% to 13% of sales range in our model and where management has been guiding for 2016. R&D moves to 17% for an eight quarter period to leave the expense level relatively flat with 2015's R&D spend levels.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fba23e85-455f-4a8a-ae04-7be3416d33fb", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.15, "x": 0.118, "y": 0.125 }, "kind": "title", "text": "Main Assumptions:", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.266+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "27fefb94-4993-47fc-92d6-7806fd456745", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "List presentation", "slug": "list-presentation", "status": "active", "bestFor": null, "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1", "version": 1, "bodyDocId": null, "description": "Bulleted, numbered, or checklist enumerations.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "7d36483d-e352-4525-a19c-d503f3f598c2", "evidence": "R&D: R&D is expected to remain in the 12.5% to 13% of sales range in our model and where management has been guiding for 2016.,Cardiovascular Segment Growth: According to management, the Cardiovascular segment is expected to grow 1% to 3% for 2016.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:45.884549+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 27, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [], "loops": [ { "to": 30, "from": 25, "loop": { "name": "27_cost_of_inaction", "slug": "27-cost-of-inaction", "status": "active", "bestFor": "Urgent budget requests, compliance, risk mitigation", "canonId": "019dd956-70d1-7395-a15b-857ba858b394", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Status Quo -> The Hidden Costs Accumulating -> The Future State of Inaction -> The Tipping Point", "description": "Quantify what happens if the audience does nothing", "familyLabel": null }, "matchId": "ab9a2b66-8b1d-4abd-96ba-1ffd9bf1975e", "evidence": "The document presents a scenario table analyzing Boston Scientific's revenue drop after recalls", "position": 0, "objective": "What are the financial implications of inaction on device recalls?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:58:03.620384+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 28, "type": "analysis", "title": "Includes a line chart for revenue segments, a list of DCF assumptions, a data table for EPS/Revenue metrics, and a bar chart for Adj. EPS change.", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 63, "componentCount": 10, "textChars": 504, "nDataPoints": 60, "notes": "Includes a line chart for revenue segments, a list of DCF assumptions, a data table for EPS/Revenue metrics, and a bar chart for Adj. EPS change.", "elementsJson": [ "line_chart", "bullet_list", "data_table", "bar_chart_vertical" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:50.657+00", "seconds": 6.804, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/28", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-28", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Sensitivity to St. Jude Medical's current stock price is in the lower table.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-021a19e14abf", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.32, "x": 0.54, "y": 0.65 }, "kind": "chart", "text": "Adj. EPS Change bar chart", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Vertical bar chart", "slug": "bar-vertical", "status": "active", "canonId": "019de52c-fe9d-70f2-b3b7-a9ae294f5917", "version": 1, "description": null }, "framework": null }, "subkind": "bar-vertical", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ebd44897-92e0-4fa0-a085-70be4b1bd83c", "parentComponentId": null }, { "bbox": { "h": 0.26, "w": 0.65, "x": 0.17, "y": 0.12 }, "kind": "chart", "text": "Revenue trends by segment from 1Q16A to 4Q18E", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6390ac3d-21ee-4c50-a07c-88d111cd1842", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.11, "y": 0.45 }, "kind": "list", "text": "Growth and margins return to normalized levels; WACC sensitivity; Perpetuity Growth Rate; $1B settlement assumption.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8090e507-9e16-456a-a06e-26ca2a0f450c", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Adj. EPS: $1.86", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-04377a5d71a2", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.35, "x": 0.11, "y": 0.63 }, "kind": "paragraph", "text": "DCF and Stock Price Sensitivity Results:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0d1b1ef8-c15d-4144-9f52-0a607be1cdf9", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.11, "y": 0.42 }, "kind": "paragraph", "text": "Main DCF Assumptions:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3baf6234-063d-4014-8b87-5f906e42b34d", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.6, "x": 0.11, "y": 0.86 }, "kind": "paragraph", "text": "Sensitivity to St. Jude Medical’s current stock price is in the lower table.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bb30c6d4-6288-4e66-bbba-b2f85b7ed6a8", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.35, "x": 0.12, "y": 0.66 }, "kind": "table", "text": "Table showing % of Revenues, GAAP/Adj EPS, and % changes for 2015-2018E", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7e4fe2f1-42ec-41aa-adb5-2cdf05d0ce2d", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.26, "x": 0.37, "y": 0.09 }, "kind": "title", "text": "Revenues by Segment", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:50.657+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "99bbf2a2-b2be-46a3-a700-4d2c05b8af10", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Valuation: DCF", "slug": "dcf", "status": "active", "bestFor": null, "canonId": "019df269-2031-7273-9014-0c70beb91e11", "version": 1, "bodyDocId": "019df269-200e-76ea-8883-6ee35d39c836", "description": "You project free cash flows over an explicit forecast period (typically", "familyLabel": "valuation-move", "categoryName": "Analysis", "categorySlug": "analysis" }, "agent": "architect", "layer": "slide", "agents": [ "architect" ], "matchId": "652c877f-e45b-4a09-8f29-7afc5e6d638c", "evidence": "DCF and Stock Price Sensitivity Results:", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:57:45.964224+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 28, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [], "loops": [ { "to": 30, "from": 25, "loop": { "name": "27_cost_of_inaction", "slug": "27-cost-of-inaction", "status": "active", "bestFor": "Urgent budget requests, compliance, risk mitigation", "canonId": "019dd956-70d1-7395-a15b-857ba858b394", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Status Quo -> The Hidden Costs Accumulating -> The Future State of Inaction -> The Tipping Point", "description": "Quantify what happens if the audience does nothing", "familyLabel": null }, "matchId": "ab9a2b66-8b1d-4abd-96ba-1ffd9bf1975e", "evidence": "The document presents a scenario table analyzing Boston Scientific's revenue drop after recalls", "position": 0, "objective": "What are the financial implications of inaction on device recalls?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:58:03.620384+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 29, "type": "analysis", "title": "The tables represent a sensitivity analysis for St. Jude Medical (STJ) based on a hypothetical market share loss scenario.", "function": "analyze_data", "rawType": "scenario_table", "block": null, "metadata": { "slideType": "scenario_table", "slideTypeCanon": { "name": "Scenario table", "slug": "scenario_table", "status": "active", "canonId": "019de52d-129c-7393-8845-c5e595ce9a7b", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 34, "componentCount": 6, "textChars": 445, "nDataPoints": 264, "notes": "The tables represent a sensitivity analysis for St. Jude Medical (STJ) based on a hypothetical market share loss scenario.", "elementsJson": [ "valuation_table", "bullet_list", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:47.723+00", "seconds": 3.749, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/29", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-29", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In this scenario, the company loses market share and revenue, but continues to operate its Traditional CRM and Heart Failure segment.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-ac26eb0eba75", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.75, "x": 0.14, "y": 0.51 }, "kind": "list", "text": "Narrative explanation of the share loss scenario and historical precedent (Thoratec)", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.723+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "763fc556-9d1c-4e75-a9fc-de4ae0825ec1", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "STJ Share Price Change: -87%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:40+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8550-b00b35650fb9", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.75, "x": 0.117, "y": 0.87 }, "kind": "source-note", "text": "Footnotes regarding Thoratec market share loss and STJ share price reference", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.723+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d1ef4c3b-a8da-4472-83ac-f702fc689b46", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.75, "x": 0.16, "y": 0.09 }, "kind": "table", "text": "Sensitivity tables for Enterprise Value, EV/EBITDA, Share Price, and Share Price Change", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Valuation table", "slug": "valuation", "status": "active", "canonId": "019de52d-034c-74ed-b5c8-22b5e6ac196d", "version": 1, "description": null }, "framework": null }, "subkind": "valuation", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.723+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "89813868-29df-4b08-acf0-b82059bfca80", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.35, "x": 0.117, "y": 0.48 }, "kind": "title", "text": "Share Loss and Revenue Loss Scenario:", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.723+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9b2d4d97-e674-445c-b5bb-5b008503323b", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "e32893f8-e868-4d48-8a8b-42a7ebbf098a", "evidence": "Tables showing impact of varying WACC and growth assumptions", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:50:47.723+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 29, "frameworkName": "sensitivity-analysis" } ], "arcBeats": [], "loops": [ { "to": 30, "from": 25, "loop": { "name": "27_cost_of_inaction", "slug": "27-cost-of-inaction", "status": "active", "bestFor": "Urgent budget requests, compliance, risk mitigation", "canonId": "019dd956-70d1-7395-a15b-857ba858b394", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Status Quo -> The Hidden Costs Accumulating -> The Future State of Inaction -> The Tipping Point", "description": "Quantify what happens if the audience does nothing", "familyLabel": null }, "matchId": "ab9a2b66-8b1d-4abd-96ba-1ffd9bf1975e", "evidence": "The document presents a scenario table analyzing Boston Scientific's revenue drop after recalls", "position": 0, "objective": "What are the financial implications of inaction on device recalls?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:58:03.620384+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 30, "type": "analysis", "title": "Includes four sensitivity tables and a paragraph detailing a bank loan covenant breach calculation.", "function": "analyze_data", "rawType": "valuation_table", "block": null, "metadata": { "slideType": "valuation_table", "slideTypeCanon": { "name": "Valuation table", "slug": "valuation_table", "status": "active", "canonId": "019de52d-12c3-77cd-8474-6cd39cf844cb", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 34, "componentCount": 5, "textChars": 673, "nDataPoints": 360, "notes": "Includes four sensitivity tables and a paragraph detailing a bank loan covenant breach calculation.", "elementsJson": [ "paragraph", "valuation_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:46.39+00", "seconds": 2.346, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/30", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-30", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Under the network shutdown scenario, the company would breach their 4.0x bank loan covenant in 3Q16.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-9082ad02ca4f", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Consolidated Leverage Ratio: 4.45x", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-97bb4bea9d5e", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.72, "x": 0.14, "y": 0.09 }, "kind": "paragraph", "text": "The remaining assumptions remained the same as the prior scenario. Sensitivity to St. Jude Medical's current stock price is in the lower table.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.39+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7e658de3-25f9-482d-854d-ed2069fe30bb", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.54 }, "kind": "paragraph", "text": "Covenant Breach in 3Q16 Highly Likely: Under the network shutdown scenario, the company would breach their 4.0x bank loan covenant in 3Q16. We used Schedule 2 Section 7.13 in the Term Loan Agreement to calculate the company's Consolidated Leverage Ratio...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.39+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ba34614a-50c8-4696-966e-17786dc6af42", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.82, "x": 0.16, "y": 0.16 }, "kind": "table", "text": "Sensitivity tables for Enterprise Value, EV/EBITDA 16E, STJ Share Price, and STJ Share Price Change based on WACC and Exit Perpetual Growth.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Valuation table", "slug": "valuation", "status": "active", "canonId": "019de52d-034c-74ed-b5c8-22b5e6ac196d", "version": 1, "description": null }, "framework": null }, "subkind": "valuation", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.39+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a4fc254d-3b7d-45f3-8350-a49f59f1cdb8", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [ { "to": 30, "from": 25, "loop": { "name": "27_cost_of_inaction", "slug": "27-cost-of-inaction", "status": "active", "bestFor": "Urgent budget requests, compliance, risk mitigation", "canonId": "019dd956-70d1-7395-a15b-857ba858b394", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Status Quo -> The Hidden Costs Accumulating -> The Future State of Inaction -> The Tipping Point", "description": "Quantify what happens if the audience does nothing", "familyLabel": null }, "matchId": "ab9a2b66-8b1d-4abd-96ba-1ffd9bf1975e", "evidence": "The document presents a scenario table analyzing Boston Scientific's revenue drop after recalls", "position": 0, "objective": "What are the financial implications of inaction on device recalls?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:58:03.620384+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 31, "type": "analysis", "title": "The slide combines a formal financial compliance schedule with a qualitative assessment of credit risk and potential covenant renegotiation.", "function": "diagnose_problem", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "balanced", "densityScore": 39, "componentCount": 6, "textChars": 753, "nDataPoints": 12, "notes": "The slide combines a formal financial compliance schedule with a qualitative assessment of credit risk and potential covenant renegotiation.", "elementsJson": [ "data_table", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:46.448+00", "seconds": 2.37, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/31", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-31", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The company is already close to breaching the covenant and is suffering from a slowdown in its Traditional CRM products.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-63e6095533af", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Consolidated Leverage Ratio: 4.45", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-65fb3949e3d3", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.59 }, "kind": "paragraph", "text": "The company is already close to breaching the covenant and is suffering from a slowdown in its Traditional CRM products. We think any additional pressure on the topline would cause a breach in the covenant in the near-term.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.448+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f319ae7-c9b2-4d70-ace9-88c2aa81ac8f", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.77 }, "kind": "paragraph", "text": "Potential Liquidity Issues: Liquidity could start becoming constrained after a covenant breach, which could lead to a reduction to its $1.5 billion revolving credit facility and potential downgrades to their commercial paper (CP) rating.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.448+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "661437f3-65b3-4b29-9ac9-9c92591f5f5f", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.75, "x": 0.13, "y": 0.14 }, "kind": "table", "text": "Consolidated Leverage Ratio calculation table showing EBITDA components and final ratio vs covenant.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.448+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7fa7ca29-c9b8-4b6c-88eb-bbf17a7a0716", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.3, "x": 0.35, "y": 0.09 }, "kind": "title", "text": "SCHEDULE 2 to the Compliance Certificate", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:46.448+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "263b9a82-9051-4dc7-9f6c-9e531b0faf70", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Table data", "slug": "table-data", "status": "active", "bestFor": null, "canonId": "019dd9e1-4fab-7168-a82f-b847350a006d", "version": 1, "bodyDocId": null, "description": "Tabular layouts of structured data.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "561d9840-f6d0-43eb-a255-909dcc9b9e7b", "evidence": "Consolidated Leverage Ratio calculation table showing EBITDA components and final ratio vs covenant.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:46.126431+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 31, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 32, "type": "appendix", "title": "The slide discusses financial leverage metrics (Debt/EBITDA) and their impact on credit ratings.", "function": "diagnose_problem", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "balanced", "densityScore": 40, "componentCount": 6, "textChars": 907, "nDataPoints": 4, "notes": "The slide discusses financial leverage metrics (Debt/EBITDA) and their impact on credit ratings.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:49.929+00", "seconds": 5.498, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/32", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-32", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Rating agencies already have St. Jude Medical on negative watch for a downgrade.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-aba12045008e", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Debt/EBITDA: 4.25x", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-aca888b9e423", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.782, "x": 0.118, "y": 0.094 }, "kind": "paragraph", "text": "these issues with its Merlin network. In 2015, the company generated $853 million of free cash flow (Cash from Operating Activities less Capital Expenditures).", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "48d27063-3fd1-4974-ba9d-4a7f392948ea", "parentComponentId": null }, { "bbox": { "h": 0.115, "w": 0.782, "x": 0.118, "y": 0.181 }, "kind": "paragraph", "text": "Rating agencies already have St. Jude Medical on negative watch for a downgrade. The companies increasing leverage profile from its recent acquisitions has tipped leverage over 4.25x, which is already high for a single A rated company. According to a Moody’s report in May 2016, Investment Grade Leverage (Debt/EBITDA) for 2015 was 2.35x vs.4.25x for STJ.69 Along with the potential Merlin network issues, we think agencies will need to reevaluate their ratings and possibly downgrade their ratings increasing the company’s borrowing costs and cost of capital.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bc961912-147b-4ea1-9053-9533ccd4127d", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.335, "x": 0.118, "y": 0.895 }, "kind": "source-note", "text": "69 Moody’s Sector In-depth Report May 20, 2016, page 10", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "777d7c64-1959-41f1-843b-1067044537e1", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.275, "x": 0.118, "y": 0.145 }, "kind": "title", "text": "Potential Credit Rating Downgrades:", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:49.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "749e3bda-8d02-4682-b3f8-2d1e7b4fce74", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 33, "type": "appendix", "title": "Includes a footnote regarding Dr. Nayak's equity interest in MedSec.", "function": "appendix", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "appendix", "functionCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-138d-750b-83c3-49b4bc7a7a38", "version": 1, "description": null }, "density": "balanced", "densityScore": 40, "componentCount": 7, "textChars": 781, "nDataPoints": 0, "notes": "Includes a footnote regarding Dr. Nayak's equity interest in MedSec.", "elementsJson": [ "screenshot", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:47.227+00", "seconds": 2.625, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/33", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-33", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "MedSec has exposed many ways that St. Jude Medical did not adequately protect its proprietary CIED communication scheme.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-7bde85e0a191", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.52, "x": 0.24, "y": 0.36 }, "kind": "paragraph", "text": "August 25, 2016. Dear Patients and Colleagues, As a cardiac electrophysiologist, I specialize in treating patients with heart rhythm disorders particularly those that require treatment with cardiac implantable electronic devices (CIEDs)...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.227+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "36852319-cc92-4d4c-8e73-1c7b11f20ef0", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.5, "x": 0.25, "y": 0.14 }, "kind": "paragraph", "text": "Dr. Nayak speaks for himself, and not his employer.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.227+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fa84d5bd-4874-4d2d-a2b9-cb0c2c9eb7bb", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "As a physician who cares for patients with CIEDs, observing these experiments and realizing that devices could be manipulated outside of usual means was quite disturbing and upsetting. — Dr. Hemal Nayak", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-7eddd3327427", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.5, "x": 0.12, "y": 0.89 }, "kind": "source-note", "text": "Dr. Nayak has been granted an immaterial equity interest in MedSec.", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.227+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "56b99194-9fb5-4a11-9172-00f05fdb6f1b", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.7, "x": 0.15, "y": 0.11 }, "kind": "title", "text": "Letter to Patients and Physicians from MedSec medical advisor and board member Dr. Hemal Nayak", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.227+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "aa763bf7-dc3e-4386-8460-286a6c21ff50", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.1, "x": 0.45, "y": 0.09 }, "kind": "title", "text": "Appendix", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:47.227+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2a148365-0808-4591-ab4b-efd9837fcca5", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 34, "type": "setup", "title": "This is a formal letter/statement from a physician regarding medical device security.", "function": "summarize", "rawType": "quote_slide", "block": null, "metadata": { "slideType": "quote_slide", "slideTypeCanon": { "name": "Quote slide", "slug": "quote_slide", "status": "active", "canonId": "019de52d-098e-7555-a9fd-4f0af7e80bc2", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 86, "componentCount": 11, "textChars": 3082, "nDataPoints": 0, "notes": "This is a formal letter/statement from a physician regarding medical device security.", "elementsJson": [ "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:50:48.936+00", "seconds": 4.204, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-76efb5813bae/34", "deck": "/decks/019dd923-622c-750b-8b96-76efb5813bae", "deckAnchor": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-34", "deckJson": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In my mind, this CIED cybersecurity issue is first and foremost, a patient safety issue.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-41081befb3f9", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.588, "x": 0.206, "y": 0.565 }, "kind": "paragraph", "text": "MedSec has performed security assessments of CIEDs manufactured by other companies and while not perfect, has not found serious vulnerabilities. As an electrophysiologist, I have stopped implanting CIEDs manufactured by St. Jude Medical but continue to use other companies.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "266015ea-f758-42ed-a69d-a9552c4adf07", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.588, "x": 0.206, "y": 0.511 }, "kind": "paragraph", "text": "For patients who don’t currently have CIEDs but are considering device therapy, I advise them to discuss this cybersecurity issue involving St. Jude Medical with their physician. Device therapy saves lives and a patient should not refuse recommended device therapy based on this issue alone.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2ec753c5-295b-440a-a1c6-197e8f70fbdb", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.588, "x": 0.206, "y": 0.619 }, "kind": "paragraph", "text": "For most of us, the topic of CIED cybersecurity is something “out of left field”. As such, it is scary and unsettling. MedSec is working diligently and is confident that solutions to these vulnerabilities will be found and risks to patients mitigated.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "33f5eb48-f383-4b12-9830-0a471ab0b5fa", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.25, "x": 0.206, "y": 0.683 }, "kind": "paragraph", "text": "Respectfully,\nHemal Nayak, MD, FACC, FHRS\nCardiac Electrophysiology", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "39ab337e-97e3-473e-9688-753ff63dff53", "parentComponentId": null }, { "bbox": { "h": 0.055, "w": 0.588, "x": 0.206, "y": 0.277 }, "kind": "paragraph", "text": "First, I would like to stress that patients with implanted CIEDs manufactured by St. Jude Medical should not worry about the immediate function or performance of their devices. MedSec has not released detailed information about the vulnerabilities publically and will not do so and the details remain confidential. That being said, there may be individuals actively trying to maliciously “hack” into CIED networks.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5d753f65-097e-4cfc-81f6-0912095f017d", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.588, "x": 0.206, "y": 0.163 }, "kind": "paragraph", "text": "While I am hopeful that the FDA will give patients and physicians guidance on what to do in light of this research, I am writing this statement to give my opinion and provide a medical perspective on what the findings mean for patients with these devices and for physicians who care for these patients.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9805abcc-d42e-4a82-ba60-8cf207e55836", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.588, "x": 0.206, "y": 0.418 }, "kind": "paragraph", "text": "Unfortunately, discontinuing home monitoring does not remove all of the vulnerabilities. Because some of the threats involve the RF or wireless communication scheme (which cannot be reduced by discontinuing home monitoring) MedSec has identified temporary solutions while the larger issues are being addressed. MedSec believes that this information will be shared with St. Jude Medical. I would encourage patients to accept any corrective patches or software from the FDA or St. Jude Medical that may reduce these risks.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "99fc951f-370a-426a-87b5-cdc254112c9e", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.588, "x": 0.206, "y": 0.353 }, "kind": "paragraph", "text": "Until the cybersecurity issues with the Merlin home monitoring network are remedied, I have recommended to my patients that they discontinue home monitoring. Unplugging the Merlin unit from the electrical outlet will effectively turn off that function. Patients can have their CIEDs checked or interrogated in person at the office or device clinic as necessary.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dc85fba3-d818-4a8a-9d48-4be15a7aba16", "parentComponentId": null }, { "bbox": { "h": 0.055, "w": 0.588, "x": 0.206, "y": 0.213 }, "kind": "paragraph", "text": "In my mind, this CIED cybersecurity issue is first and foremost, a patient safety issue. Based on what I have seen and the results from the experiments conducted, I feel compelled to bring this issue up to the electrophysiology community at large especially since this is the first time an issue like this has come up. Additionally, I believe that patients with these CIEDs have the right to know.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:50:48.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fa5232c3-bc94-4fb1-b81a-6a36cae54736", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "In my mind, this CIED cybersecurity issue is first and foremost, a patient safety issue. — Hemal Nayak, MD, FACC, FHRS", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:22:41+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-1ac3-70f9-8551-457eec8f51bc", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true } ], "arcBeats": [ { "from": 8, "to": 9, "label": "Problem (Identify pain)", "description": "The document identifies the problem of security vulnerabilities in St. Jude Medical's cardiac device ecosystem" }, { "from": 15, "to": 16, "label": "Agitate (Make it worse)", "description": "The document agitates the problem by highlighting demonstrated attacks and potential consequences" }, { "from": 18, "to": 22, "label": "Solution (Provide relief)", "description": "The document provides a solution through regulatory action and recall likelihood analysis" } ], "loops": [ { "from": 25, "to": 30, "label": "Cost Of Inaction", "description": "What are the financial implications of inaction on device recalls?" }, { "from": 23, "to": 24, "label": "Benchmark Gap", "description": "How does St. Jude Medical's security compare to industry standards?" } ] }