Brainjacking: Implant Security Issues in Invasive Neuromodulation

Abstract

The security of medical devices is critical to good patient care, especially when the devices are implanted. In light of recent developments in information security, there is reason to be concerned that medical implants are vulnerable to attack. The ability of attackers to exert malicious control over brain implants ("brainjacking") has unique challenges that we address in this review, with particular focus on deep brain stimulation implants. To illustrate the potential severity of this risk, we identify several mechanisms through which attackers could manipulate patients if unauthorized access to an implant can be achieved. These include blind attacks in which the attacker requires no patient-specific knowledge and targeted attacks that require patient-specific information. Blind attacks include cessation of stimulation, draining implant batteries, inducing tissue damage, and information theft. Targeted attacks include impairment of motor function, alteration of impulse control, modification of emotions or affect, induction of pain, and modulation of the reward system. We also discuss the limitations inherent in designing implants and the trade-offs that must be made to balance device security with battery life and practicality. We conclude that researchers, clinicians, manufacturers, and regulatory bodies should cooperate to minimize the risk posed by brainjacking.

Towards new human rights in the age of neuroscience and neurotechnology

“…The new knowledge and technologies in the field of neuroscience clearly offer new and more efficient possibilities for carrying out unconsented personality changes. For example, Pycroft et al (2016) recently reported the concern that brain implants like DBS are vulnerable to attack by third parties who want to exert malicious control over the users’ brain activity. They called this risk of modification of a person’s brain activity through unauthorized use of neurodevices by third parties ‘brainjacking’ (Pycroft et al 2016).…”

“…For example, Pycroft et al (2016) recently reported the concern that brain implants like DBS are vulnerable to attack by third parties who want to exert malicious control over the users’ brain activity. They called this risk of modification of a person’s brain activity through unauthorized use of neurodevices by third parties ‘brainjacking’ (Pycroft et al 2016). Negative consequences of brainjacking include (i) information theft, which would result in a violation of the right to mental privacy; (ii) cessation of stimulation, draining implant batteries, inducing tissue damage, and impairment of motor function, which would result in violations of the right to mental integrity.…”

Cybersecurity in Health Care

“…Although there have been no real incidents known to date, for years, hackers, security experts, and scientists have been illustrating the vulnerabilities of IMDs: Jerome Radcliffe presented a talk at the Black Hat conference in 2011 at which he explained how he was able to get access to implanted insulin pumps through reverse engineering (Radcliffe 2011); Barnaby Jack showed his successful hack in order to control pacemakers (Burns et al 2016: 70); and Pycroft et al (2016) discussed the actual possibilities of 'brainjacking' neurological implants. In 2017, the FDA published a safety communications issue in which it announced that almost half a million cardiac pacemakers must get a software update "[…] to reduce the risk of patient harm due to potential exploitation of cybersecurity vulnerabilities […]" (FDA 2017).…”

Neurotechnology and society

“…In this vein Julia Bossmann (President, Foresight Institute) noted that "We shouldn't forget that AI [artificial intelligence] systems are created by humans, who can be biased and judgemental". 11 In an attempt to help ethically sound research and development in the field of robotics The British Standards Institute has issued a "Guide to the ethical design and application of robots and robotic systems". 12 Focussing on healthcare robots (van Wynsberghe, 2013 [60]; van Wynsberghe, 2016 [118]) proposes a framework for the ethical evaluation of care robots: "care centered value sensitive design" (CCVSD).…”