So far, St. Jude Medical weathering cybersecurity scrutiny

The interrogation took place in a darkened room, a single lamp illuminating the subject in the shaky internet video.

Two faceless men can be heard discussing the process of breaking down their subject. Off camera, one narrates the plan to crack the subject's defenses. A good deal of money is on the line as the man in the video, after 15 minutes, displays the subject again, apparently broken, beaten.

The subject in the video last week was no kidnapping victim or enemy combatant. It was a Minnesota-made pacemaker.

The pacemaker's manufacturer, St. Jude Medical in Little Canada, said the hackers did not break their device as claimed. But that was after the short-seller Muddy Waters Securities publicized the supposed vulnerabilities Aug. 25 and disclosed it had made investments allowing it to profit if St. Jude's stock price tanks. The alleged wireless security vulnerability, if proved, could apply to many thousands of implanted devices.

On Thursday, private cybersecurity firm Virta Labs in Michigan published a report that analyzed Muddy Waters' claims and found them unsupported. Investors appear to be sticking with the stock for now, and doctors said they aren't making changes without more definitive evidence.

If the gambit nets a profit for Muddy Waters, med-tech security experts said more videos and reports are likely to surface, prompting questions about the legality and ethics of publishing security flaws in lifesaving devices — especially without first informing the manufacturer, which Muddy Waters did not do.

"Will it happen again? Sure," said Brian Isle, a medical device cybersecurity consultant and University of Minnesota senior fellow. If short-sellers with allegations about vulnerable medical devices "can make money off of it, they'll do it again."

St. Jude executives have said Muddy Waters' claims appear to be false.

"Interrogation" is the med-tech industry's term for wirelessly communicating with an implanted medical device. Usually done to read patient data and make sure a device is functioning, last week internet viewers saw a hacker interrogating a St. Jude Medical pacemaker to demonstrate a vulnerability purportedly created by gaps in its wireless security.

St. Jude officials said their product actually performed well under pressure.

Rather than crashing, the video appears to show the device going into the intended "safe mode" that was designed to ensure a device continues to work if attacked, St. Jude's Chief Technology Officer Phil Ebeling said in a statement. Independent experts and the Department of Homeland Security are working separately to evaluate the alleged problems.

Medical devices have long been said to harbor security gaps that could allow a malicious hacker to disable or disrupt the lifesaving machines.

Cybersecurity researchers have reported concerns about many medical devices to the government since then, culminating in last year's warning from the Food and Drug Administration that hospitals stop using Hospira's Symbiq drug-infusion pump because of security vulnerabilities.

The people who find security problems in medical devices often approach the manufacturers first so that the company can confirm the issue and devise solutions.

"If there is no mitigation for a discovered vulnerability, and you disclose it, you actually put more people at risk," said Mike Ahmadi, director of critical systems security at software firm Synopsys who has personally discovered cybersecurity flaws in medical devices. "We have to keep in mind that regardless of the potential inherent risks of these devices, they are indeed keeping people alive."

Muddy Waters said it has told federal officials about the alleged security vulnerabilities, while redacting key details from its public report to avoid giving attackers a "road map."

The private researchers who discovered the alleged vulnerabilities with St. Jude's heart devices said they took their concerns to a short-selling firm because they weren't confident St. Jude would address the issue. Justine Bone, CEO of Florida-based MedSec Holdings, which discovered the alleged problems, has said St. Jude knew about the security problems since at least 2013.

St. Jude officials said they partner with industry insiders to develop safeguards because of the "dynamic and changing nature of cybersecurity."

Muddy Waters, registered in California, has a track record of challenging large companies that it sees as having inflated values because of "opacity and hype," according to its website.

The firm was founded by short-seller Carson Block, whose past targets have included Chinese timber company Sino-Forest Corp. That company had a $6 billion market cap before Block called the firm a fraud and shorted the stock, eventually forcing it into bankruptcy protection.

MedSec, on the other hand, is a virtual unknown in the industry, Ahmadi said.

"Nobody who I work with knows who these people at MedSec are," Ahmadi said. "Usually before things like this hit the press, we all know about it. People talk. … This blindsided everybody. We don't know where it came from."

It might be too early to know whether Muddy Waters and MedSec acted ethically, because no regulator or independent group has validated MedSec's findings, no peer-reviewed research has been published, and no one has proved what St. Jude officials knew and when they knew it.

University of Michigan cybersecurity researcher Kevin Fu, whose team has expressed doubts about one claim in Muddy Waters' report, said the ongoing controversy has had at least one positive side effect.

"I suspect that this is going to generate some very healthy debate. I'll give them that," Fu said. "This has raised a very important debate, over how to protect the security of medical devices in the public interest, for the public good."