{
  "docId": "019dd923-622c-750b-8b96-73aafa09c850",
  "docSlug": "9686328c7016",
  "documentTitle": "St. Jude Medical (STJ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2016-08-29 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 3,
  "pageCount": 6,
  "prevPage": 2,
  "nextPage": 4,
  "slideType": "expose_contradiction",
  "function": "expose_contradiction",
  "density": "overcrowded",
  "nDataPoints": 0,
  "notes": "This is a page from a research note/report by MedSec/Muddy Waters. It uses a numbered list to systematically dismantle STJ's claims.",
  "elementsJson": [
    "paragraph",
    "quote_block",
    "footnote"
  ],
  "metadataConfidence": 0.95,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-73aafa09c850/3",
  "deckHref": "/decks/019dd923-622c-750b-8b96-73aafa09c850",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-73aafa09c850.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-73aafa09c850#slide-3",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "In actuality, STJ's communications protocol uses a simple data mixing technique to address performance, not data protection. St. Jude Medical's own supplier, Zarlink, refers to this as \"whitening\" rather than encryption.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-203b-7073-9f32-616e265775a7",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.78,
        "x": 0.11,
        "y": 0.4
      },
      "kind": "list",
      "text": "4. STJ showed its poor understanding of security when it stated that Merlin@home encrypts communications it sends. This appeared to be an attempt to impress readers with a specific purported security feature of the device.",
      "attrs": null,
      "subkind": "numbered",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "4735b9c2-e7d8-4d6d-a973-4a25a4b83927",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.78,
        "x": 0.11,
        "y": 0.3
      },
      "kind": "list",
      "text": "3. STJ stated that MedSec's claim that the ability to impersonate any device in the STJ ecosystem is speculative. MedSec is confident it is correct because the communications protocol used between devices does not sufficiently authenticate the end points. In other words, authentication was not built in to the communications protocol used between devices.",
      "attrs": null,
      "subkind": "numbered",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "9c86cbfb-c192-4324-a5df-4bfa4b1b5c86",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.78,
        "x": 0.11,
        "y": 0.65
      },
      "kind": "list",
      "text": "5. STJ disputes that its ICD was \"crashed\" by the attack. We have posted a video of a crash attack test on a pacemaker. We invite STJ to explain what is going on with its pacemaker. The video is available at https://vimeo.com/180593205",
      "attrs": null,
      "subkind": "numbered",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "a95b4289-72e1-4805-ba1e-453908d1d9c6",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.04,
        "w": 0.78,
        "x": 0.11,
        "y": 0.24
      },
      "kind": "paragraph",
      "text": "Finally, STJ did not address that it has produced programmers with removable, unencrypted hard drives.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "1d194559-083f-4461-bb3a-625968ee6140",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.78,
        "x": 0.11,
        "y": 0.55
      },
      "kind": "paragraph",
      "text": "In actuality, STJ's communications protocol uses a simple data mixing technique to address performance, not data protection. St. Jude Medical's own supplier, Zarlink, refers to this as \"whitening\" rather than encryption. In MedSec's opinion, this method doesn't even come close to the most basic encryption protections expected to protect patient data.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "ab009089-4037-46db-bcc9-0661fc9c3c6b",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.78,
        "x": 0.11,
        "y": 0.09
      },
      "kind": "paragraph",
      "text": "If STJ were to expressly state that its software updates addressed all of the findings, such a statement would strike us as completely wrong. STJ seems not to understand that many of the issues identified by MedSec on the Merlin@home device cannot be addressed with software updates alone, in part due to open UART, JTAG, and SPI interfaces; and, removable NAND. The large number of available devices, combined with the seeming lack of protection makes the job of an adversary much easier.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "ca0d614a-c9e4-4e56-bb4a-5e62c8f60f59",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.09,
        "w": 0.78,
        "x": 0.11,
        "y": 0.73
      },
      "kind": "paragraph",
      "text": "We now address the fluff. We engaged a firm to do a credibility analysis of STJ's response. The following analysis, prepared by a former Central Intelligence Agency behavioral analyst and polygrapher, indicates deception throughout the response. Many of these indicia are in the portions of the response we label \"fluff\". The analysis is published as presented to Muddy Waters Capital LLC, and redacted only to protect the identity of the former CIA officer.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d74f36fe-f92b-49fc-9f19-7e26542da5f4",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.7,
        "x": 0.15,
        "y": 0.47
      },
      "kind": "quote",
      "text": "The data transferred by Merlin@home are fully encrypted and meet or exceed all applicable national data privacy and security requirements in all countries where the Merlin.net PCN is used.",
      "attrs": null,
      "subkind": "pull-quote",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "0dc956c7-0b4f-4c99-8552-069fb1efe30b",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "quote",
      "text": "“The data transferred by Merlin@home are fully encrypted and meet or exceed all applicable national data privacy and security requirements in all countries where the Merlin.net PCN is used.” — St. Jude Medical",
      "attrs": null,
      "subkind": null,
      "toolName": "Authority citation",
      "toolSlug": "authority-citation",
      "confidence": null,
      "componentId": "019dd953-203b-7073-9f32-65a424505ab6",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.04,
        "w": 0.78,
        "x": 0.11,
        "y": 0.89
      },
      "kind": "source-note",
      "text": "5 http://www.microsemi.com/document-portal/doc_view/127877-zl170101-1645-19-fullds\n6 There was no video taken of the test with the particular ICD featured in the picture of the programmer.",
      "attrs": null,
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "850db472-4dde-4b2a-a73e-e0b7a5214f3c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.04,
        "w": 0.4,
        "x": 0.3,
        "y": 0.83
      },
      "kind": "title",
      "text": "Credibility Assessment: St. Jude Medical (STJ)\n27 August, 2016",
      "attrs": null,
      "subkind": "subtitle",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3b53c14f-f78b-4ec8-80b4-276089faa72b",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 5,
      "from": 2,
      "beatId": "00b380e0-e19f-4a6e-ad54-6c51909a9cc5",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "The Monster",
      "beatSlug": "overcoming-monster-the-monster",
      "evidence": "The analysis of St. Jude Medical's credibility and the exposure of contradictions",
      "position": 0,
      "confidence": 0.8,
      "parentBeatName": "Hook",
      "parentBeatSlug": "hook"
    }
  ],
  "loops": [
    {
      "to": 3,
      "from": 3,
      "name": "Aha Moment",
      "slug": "03-aha-moment",
      "bestFor": "Data-heavy sections, research findings, analytical arguments",
      "matchId": "4c4bd1c4-e2b8-410c-8259-251983e2c907",
      "evidence": "The analysis highlights a specific statement by STJ as a concern",
      "position": 0,
      "objective": "What is the key concern with St. Jude Medical's response?",
      "structure": "The Problem/Question -> What the Data Shows -> The Insight",
      "confidence": 0.8,
      "description": "Establish a tension, present data, then deliver the insight that changes everything"
    },
    {
      "to": 5,
      "from": 2,
      "name": "Myth Buster",
      "slug": "12-myth-buster",
      "bestFor": "Rebranding, changing market perception, correcting false assumptions",
      "matchId": "250b742a-5438-494d-ae72-24c9b8a42556",
      "evidence": "The document exposes contradictions in STJ's response",
      "position": 1,
      "objective": "What are the contradictions in St. Jude Medical's response?",
      "structure": "The Common Belief -> The Friction/Failure of that Belief -> The New Truth",
      "confidence": 0.8,
      "description": "Address a common misconception head-on to clear the room for a new truth"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}