{
  "docId": "019dd923-622c-750b-8b96-76efb5813bae",
  "docSlug": "8ff52fe302da",
  "documentTitle": "St. Jude Medical (STJ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2016-08-25 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 23,
  "pageCount": 34,
  "prevPage": 22,
  "nextPage": 24,
  "slideType": "cite_precedent",
  "function": "cite_precedent",
  "density": "overcrowded",
  "nDataPoints": 3,
  "notes": "The slide uses a historical precedent (Hospira) to argue for the necessity of a recall for STJ devices based on similar cybersecurity risks.",
  "elementsJson": [
    "headline_text",
    "paragraph",
    "footnote"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-76efb5813bae/23",
  "deckHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-76efb5813bae#slide-23",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "Medical device recall precedents support our view that the devices should be recalled - in our opinion, the risks and severity of the STJ vulnerabilities rise at least to the levels of the following recalled devices.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-1ac3-70f9-8550-68da5f6d355b",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.085,
        "w": 0.764,
        "x": 0.118,
        "y": 0.093
      },
      "kind": "paragraph",
      "text": "recall the Devices, FDA has a regulatory basis to and could mandate that STJ recall the Devices pursuant to its recall authority granted under section 518(e) of the FDCA and 21 CFR part 810. Medical device recall precedents support our view that the devices should be recalled - in our opinion, the risks and severity of the STJ vulnerabilities rise at least to the levels of the following recalled devices.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "34532cdf-5fe8-407b-8554-fe4c0173a64b",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.115,
        "w": 0.764,
        "x": 0.118,
        "y": 0.251
      },
      "kind": "paragraph",
      "text": "In late 2013, well-known researcher Billy Rios purchased a Hospira Symbiq infusion pump on eBay for around $100 on a lark. Such pumps are commonplace in hospitals where health care providers use them to automatically deliver IV drips and injectable drugs to patients. Rios didn't have anything in particular in mind for the device, mostly looking to tinker. He soon discovered that he could remotely take over the device, which could have lethal consequences if used maliciously.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "71e6735f-ed0e-4fb1-aa05-b96e9256c744",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.055,
        "w": 0.764,
        "x": 0.118,
        "y": 0.373
      },
      "kind": "paragraph",
      "text": "Recognizing the implications of his discovery, Rios sent his detailed findings to the Department of Homeland (DHS) Security Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). In turn, ICS-CERT notified the Food and Drug Administration (FDA) and sent a report to Hospira.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "89def413-353c-4a54-aee1-828ef052a531",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.045,
        "w": 0.764,
        "x": 0.118,
        "y": 0.617
      },
      "kind": "paragraph",
      "text": "This tangible evidence showing how easily he could craft code that could kill someone prompted the FDA to take action. In July 2015, it issued an advisory urging hospitals to stop using Hospira's infusion pump.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "ac25b417-e5c0-4dda-b03f-9db777f5fef4",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.075,
        "w": 0.764,
        "x": 0.118,
        "y": 0.525
      },
      "kind": "paragraph",
      "text": "Months passed without Rios hearing a word from Hospira and there was no indication that government agencies were preparing to take action. Rios renewed the fight after a medical scare forced him into a hospital—and hooked up to a Hospira pump—for several days. He filmed himself hacking into the infusion pump and provided DHS and FDA with sample computer code.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "bda382f5-64dc-4f3f-b2ba-db8d4e6ae515",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.045,
        "w": 0.764,
        "x": 0.118,
        "y": 0.459
      },
      "kind": "paragraph",
      "text": "Interestingly, in 2013 Hospira had already decided to discontinue the Symbiq pump and planned to spend $300-$350 million on doing away with its legacy pumps and developing replacements, purportedly due to scrutiny by the FDA of quality issues.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d803ad48-e893-4294-9153-92e2ce10e484",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.035,
        "w": 0.764,
        "x": 0.118,
        "y": 0.683
      },
      "kind": "paragraph",
      "text": "Pharmaceuticals giant Pfizer proceeded with its acquisition of Hospira (announced in February 2015) despite the negative publicity and closed the $17 billion deal in September 2015. In May",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "f6a03f68-d1b5-44ee-a5f8-9ce08885cb84",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.085,
        "w": 0.764,
        "x": 0.118,
        "y": 0.777
      },
      "kind": "source-note",
      "text": "50-55: Citations for the Hospira case study including Bloomberg, Chicago Tribune, and FDA notices.",
      "attrs": {
        "numbered": true
      },
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "a03bf6d5-c997-47fa-9258-a85f1f4b16b4",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.018,
        "w": 0.315,
        "x": 0.118,
        "y": 0.216
      },
      "kind": "title",
      "text": "Hospira Pump Recall Case Study",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "351c3a2f-b936-41d1-8df9-542eb4198a41",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [
    {
      "name": "argument-from-analogy",
      "slug": null,
      "matchId": "593189b1-9fbf-4a62-82b4-64c343879cfd",
      "evidence": "Uses Hospira recall as a precedent to argue for STJ recall.",
      "confidence": 0.9
    }
  ],
  "arcBeats": [],
  "loops": [
    {
      "to": 24,
      "from": 23,
      "name": "Benchmark Gap",
      "slug": "39-benchmark-gap",
      "bestFor": "Performance improvement, competitive analysis, target setting",
      "matchId": "d9ef2888-e98f-41cd-8ff2-fb6d0ddcdd8d",
      "evidence": "The document cites precedent with Hospira Pump Recall Case Study and Guidant Recall Case Study",
      "position": 1,
      "objective": "How does St. Jude Medical's security compare to industry standards?",
      "structure": "Our Performance -> Industry Average -> Best-in-Class -> The Gap = The Opportunity",
      "confidence": 0.6,
      "description": "Compare performance against best-in-class to quantify the opportunity"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}