{
  "docId": "019dd923-622c-750b-8b96-76efb5813bae",
  "docSlug": "8ff52fe302da",
  "documentTitle": "St. Jude Medical (STJ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2016-08-25 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 18,
  "pageCount": 34,
  "prevPage": 17,
  "nextPage": 19,
  "slideType": "research-note",
  "function": "diagnose_problem",
  "density": "overcrowded",
  "nDataPoints": 0,
  "notes": "This page contains text from a research report regarding cybersecurity vulnerabilities in medical devices.",
  "elementsJson": [
    "paragraph",
    "footnote"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-76efb5813bae/18",
  "deckHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-18",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "We believe in-home communication compatible Cardiac Devices should be recalled, either voluntarily by STJ or mandatorily by the U.S. Food and Drug Administration (\"FDA\").",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-1ac3-70f9-854f-eceb7f05bae8",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.07,
        "w": 0.78,
        "x": 0.11,
        "y": 0.69
      },
      "kind": "paragraph",
      "text": "Manufacturers independently initiate the overwhelming majority of medical device recalls. These are labeled “voluntary” recalls conducted pursuant to 21 CFR Part 7. However, the FDA’s authority pursuant to Section 518(e) of the Federal Food, Drug, and Cosmetic Act (“FDCA”)",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "1d416b33-7980-4305-9686-1c712f899c1b",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.78,
        "x": 0.11,
        "y": 0.55
      },
      "kind": "paragraph",
      "text": "We believe in-home communication compatible Cardiac Devices should be recalled, either voluntarily by STJ or mandatorily by the U.S. Food and Drug Administration (“FDA”).",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "78e6483c-3a31-4a21-a7e4-254f089ddeb5",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.11,
        "w": 0.78,
        "x": 0.11,
        "y": 0.21
      },
      "kind": "paragraph",
      "text": "A large scale attack is theoretically possible either through [redacted] and possibly through STJ's own Merlin network. An attack through the Merlin network could be possible because of the compromised login credentials for the network.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "7c05f2cf-8920-4701-b3f5-754165de9712",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.07,
        "w": 0.78,
        "x": 0.11,
        "y": 0.09
      },
      "kind": "paragraph",
      "text": "their bedrooms, making it possible to run down batteries while users are sleeping. While untested, MedSec believes the new code would drain devices at six times the rate – or in approximately two weeks of nightly broadcasts.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "8bca41a7-2680-4138-8791-76e22fbc77cb",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.07,
        "w": 0.78,
        "x": 0.11,
        "y": 0.37
      },
      "kind": "paragraph",
      "text": "We are unaware of any imminent threat to patient safety. However, we believe it is prudent from a security standpoint for STJ to immediately disable the RF capability of patients' implanted devices.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "b7204577-cd9f-4d40-99d5-cc7897a2a244",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "quote",
      "text": "MedSec’s medical advisor, Dr. Hemal Nayak, who is a cardiac electrophysiologist, has advised his patients to disconnect their Merlin@home units. He is no longer implanting STJ devices until the problem is remediated.",
      "attrs": null,
      "subkind": null,
      "toolName": "Authority citation",
      "toolSlug": "authority-citation",
      "confidence": null,
      "componentId": "019dd953-1ac3-70f9-854f-f02e13a830ad",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.78,
        "x": 0.11,
        "y": 0.77
      },
      "kind": "source-note",
      "text": "Footnotes 21-25 detailing sources and regulatory references.",
      "attrs": null,
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "4c62eb35-6d02-499a-ab4f-9bc4f142e22c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.04,
        "w": 0.78,
        "x": 0.11,
        "y": 0.49
      },
      "kind": "title",
      "text": "Analysis of Recall Likelihood & FDA Medical Device Cybersecurity Regulatory Framework",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "167a9a3b-496c-4c11-9e97-b90b49e491a4",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.02,
        "w": 0.78,
        "x": 0.11,
        "y": 0.65
      },
      "kind": "title",
      "text": "FDA Statutory and Regulatory Basis for Device Recalls",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d06d4c4a-fdb0-4a31-a5cb-ba209587d212",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 22,
      "from": 18,
      "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de",
      "arcName": "Problem-Agitate-Solution",
      "arcSlug": "problem-agitate-solution",
      "beatName": "Solution (Provide relief)",
      "beatSlug": "problem-agitate-solution-solution-provide-relief",
      "evidence": "The document provides a solution through regulatory action and recall likelihood analysis",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": "Resolution",
      "parentBeatSlug": "resolution"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}