{
  "docId": "019dd923-622c-750b-8b96-76efb5813bae",
  "docSlug": "8ff52fe302da",
  "documentTitle": "St. Jude Medical (STJ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2016-08-25 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 22,
  "pageCount": 34,
  "prevPage": 21,
  "nextPage": 23,
  "slideType": "appendix",
  "function": "appendix",
  "density": "overcrowded",
  "nDataPoints": 0,
  "notes": "This page is a continuation of a research note, likely from a report by MedSec regarding St. Jude Medical (STJ) device security.",
  "elementsJson": [
    "paragraph",
    "footnote"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-76efb5813bae/22",
  "deckHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-22",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "Pursuant to 21 CFR § 7.40, STJ should recall its Devices because the Devices present “a risk of injury or gross caption or are otherwise defective” as demonstrated by MedSec’s research and in light of FDA’s current medical device and cybersecurity policies.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-1ac3-70f9-8550-3a40d5be1a8d",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.766,
        "x": 0.117,
        "y": 0.268
      },
      "kind": "paragraph",
      "text": "The vulnerability in the ecosystem is the compromised communication protocol between the Merlin@home units and the Cardiac Devices. Because in-home units are widely available and easy to exploit, MedSec believes that STJ must develop a new communication protocol in order to secure the Cardiac Devices.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "2be837e2-8200-4db3-8a8d-80b7f41d79e1",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.075,
        "w": 0.766,
        "x": 0.117,
        "y": 0.353
      },
      "kind": "paragraph",
      "text": "We estimate that it would take STJ at least two years to develop a new RF communication protocol. We assume the total team size required for this project would be 10 to 15 people. We understand that adding people to the team would likely not speed up the development time. Our assumption includes an expected approval timeline of three to six months.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3a2d5f97-f43a-4ed3-828b-6828f73c5128",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.135,
        "w": 0.766,
        "x": 0.117,
        "y": 0.443
      },
      "kind": "paragraph",
      "text": "STJ's lack of adequate attention to secure system architecture and design and implementation has resulted in an embedded system eco-system that will be very difficult to remediate. These solutions would then need to be written into the existing code base. In simpler situations, a security update can be applied to the protocol without affecting the rest of the system. In this case, STJ appears to have intertwined many of the different layers of communication throughout the software. As a result, it appears there is no part of the programming stack on which a remediation effort could focus. Large parts of the extremely large codebase would have to be re-written.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "734983f9-edeb-4353-a023-5583f10c3561",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.045,
        "w": 0.766,
        "x": 0.117,
        "y": 0.758
      },
      "kind": "paragraph",
      "text": "Pursuant to 21 CFR § 7.40, STJ should recall its Devices because the Devices present \"a risk of injury or gross caption or are otherwise defective\" as demonstrated by MedSec's research and in light of FDA's current medical device and cybersecurity policies. Should STJ not voluntarily",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "7939eb5b-40a5-4456-bc72-695f27f8c651",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.766,
        "x": 0.117,
        "y": 0.593
      },
      "kind": "paragraph",
      "text": "To protect existing Device users, STJ could disable the Devices' RF (radio frequency) capabilities as a \"compensating control\". A compensating control is a countermeasure used in the absence of sufficient controls designed into the device. MedSec's observations of STJ's devices cause it to believe this is practicable to implement. With the RF disabled, devices would be unable to use the in-home devices and network and would need close proximity for interrogation. As a result, certain patients would need to see their physicians more frequently to compensate for the lack of remote monitoring. It should be noted MedSec sees no reason to expect STJ's major competitors to interrupt access to their home monitoring networks.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "9ff4de9e-eb3d-4b3e-97b3-a5b8edcc0d4c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "quote",
      "text": "According to MedSec medical advisor Dr. Hemal Nayak. However, he points out that remote monitoring improves patient outcomes and survival. — Footnote 49",
      "attrs": null,
      "subkind": null,
      "toolName": "Authority citation",
      "toolSlug": "authority-citation",
      "confidence": null,
      "componentId": "019dd953-1ac3-70f9-8550-3d95ea7fbffc",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.766,
        "x": 0.117,
        "y": 0.82
      },
      "kind": "source-note",
      "text": "46 Id. 47 FDA's \"Guidance for Industry: Product Recalls, Including Removals and Corrections,\" available at http://www.fda.gov/Safety/Recalls/IndustryGuidance/ucm129259.htm (last accessed Aug. 22, 2016). 48 Draft Guidance, part IV.A. 49 According to MedSec medical advisor Dr. Hemal Nayak. However, he points out that remote monitoring improves patient outcomes and survival.",
      "attrs": null,
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "784594fa-be98-4758-86b7-9a29b22d20b6",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.015,
        "w": 0.395,
        "x": 0.117,
        "y": 0.233
      },
      "kind": "title",
      "text": "Recall Likelihood and Conclusions",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d3cd92d1-6974-42e1-af86-4ac1979d5899",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 22,
      "from": 18,
      "beatId": "f0d4f08b-4c30-4578-a808-4dc45468a7de",
      "arcName": "Problem-Agitate-Solution",
      "arcSlug": "problem-agitate-solution",
      "beatName": "Solution (Provide relief)",
      "beatSlug": "problem-agitate-solution-solution-provide-relief",
      "evidence": "The document provides a solution through regulatory action and recall likelihood analysis",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": "Resolution",
      "parentBeatSlug": "resolution"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}