Data from man's pacemaker led to arson charges | Hacker News Reader

Data from man's pacemaker led to arson charges

journal-news.com

98 pointspavel_lishin121 comments

Imagine that you are in a car accident (the other person hit you). The insurance company uses your sleep tracker to claim that you were negligent due to not getting enough sleep the night before, and are therefore at fault, so they won't pay.

Data is as dangerous as it is helpful. The scary thing is that you cannot control how someone else will interpret your data.

In your example I think it's right that the driver is found at fault. The effects of sleep deprivation on driving are very well documented and are comparable to drinking. If a driver is not fit to be driving a car, then they are a danger to the other road users and must take responsibility for their negligence.

The same evidence could of course be helpful to the driver. If their sleep tracking app shows they are well rested and their phone's use shows no distractions while driving, then they could use that as evidence to fight a charge of driving without due care and attention.

This seems to be a common false logic argument based on an unknown, where the event leads the judgement. "Fault" occurs when someone does something that is against the rules and results in an undesirable outcome. They are NOT at fault if nobody observes them doing the thing that is against the rules + nobody else observes the undesirable outcome that resulted in the causality from doing the wrong thing (because nothing happened).

Even if someone did observe them breaking the rules, the "fault" doesn't exist until the undesirable outcome occurs and is observed. Arguing that loss of privacy will make things safer is illogical, given loss of privacy creates "inverse causality", or causality created by blaming someone for something before they actually do it in an objective frame. Keep in mind that (us) Buddhists believe we are all a single entity, with very specific discrimination that allows each of us to believe we are also a separate entity with an ego. That ego requires privacy to pull off what it does.

The process of "speaking for others" is akin to speculation about someone else's internal subjective frame inside a separate internal subject frame (aka mind's eye) in the observer (the one speaking for the other) BEFORE objective causality occurs. My hypothesis is that, by phrasing the speculation for other entities to consume as if it is an objective fact (which is is not), the "speaker" creates inverse causality event which then spreads in a viral way through the aggregate. See "this video will make you angry" on YouTube.

Apologies if this is still a bit rough around the edges logically and semantically. I'm just now getting it down in words and it's still a work in progress...

It's not as though we can derive some hard cutoff on how little sleep is clearly negligent. We're talking about wide ranges and tolerances for different people in different circumstances.

We're in the same situation with alcohol -- how much before you're actually impaired? -- but most states have responded to that reality with laws that prohibit driving after drinking almost any alcohol at all.

Are you sure you want a similar situation with respect to your sleep?

Given that I don't know of a single driver actually obeying the rules about mandatory breaks for long-distance travel, yes, I'd definitely want a similar situation with respect to sleep.

There is something weird about driving that makes most people feel they're smarter and better than everyone else, so they can ignore traffic laws at their discretion. That attitude costs quite a lot of lives every year.

Commercial truck drivers can have their log books inspected at weigh stations, if they haven't had the required rest (or don't have a logbook), they have to stop and stay off the road.

I stayed up working until 5 am (I was on a roll). Should I be afraid of driving now? I'm not tired at all.

Welcome to the future, where if your habits are abnormal big data can land you in jail for it.

Yes. If it is your habit to stake other people's lives on your subjective opinion that you don't need sleep to be a safe driver, despite evidence to the contrary, those other people have every right to deter and punish your choice.

So we can stake the punishment on subjective limits on required sleep?

Blood alcohol provides a quantifiable measure of impairment. Sleep trackers don't even come close to measuring sleep well enough to provide a single number to use with a threshold.

Even if they are responsible, not receiving insurance coverage for a very expensive mistake like this could run someone's life into the ground. Sometimes, imperfect information helps us lift each other up. I'm all for accountability, but we don't want to leave people hanging out to dry with no second chances either.

Getting hit by a sleepy driver can run you into the ground. The only reason we don't have dui for sleep is we can't measure it. But if we could, it should (and hopefully would) be completely equivalent to alcohol.

Negligence is not a "mistake". It's a crime.

Yeah, it's THEIR fault they're being overworked so hard!

Everyone is also negligent at one time or another.

So?

So you're say that Fitbit data, which has several cases of inaccuracy reported, should decide if a person should go to jail or not?

[0]: https://www.nytimes.com/2016/05/26/technology/personaltech/f...

> So you're say that Fitbit data, which has several cases of inaccuracy reported, should decide if a person should go to jail or not?

No, he's saying that choosing to drive while suffering from the very real effects of severe sleep deprivation probably constitutes negligence.

If the evidence that someone was suffering from severe sleep deprivation comes from a highly unreliable source, than that evidence should be treated as...highly unreliable. Courts are actually pretty good at that.

Yeah, I agree with everything you said, but the parent (and other comments) mentioned using "their sleep tracking app", which to me would never be reliable.

So what is the legal minimum amount of sleep for the night before I am allowed to drive?

If you have a neural mesh, the state will likely have intent to claim they have access and rights to the date in the mesh, regardless of whether it is in your body or not.

There's no way in hell I'm ever hooking a computer up to my brain in this reality.

You are of course assuming the data will be easy to understand. One possibility for a neural mesh is that we emulate parts of the brain in hardware to say add more 'storage.' We don't need an understanding of the 'format' a memory is stored to do this, much in the same way that we can build a hard drive for a computer without understanding the JPEG format.

It could be really difficult to extract useful information from such hardware. Let's say we have a brain implant that maps a 3d scene concept to positions of objects in 3d space. So input scene foo gives me baz(1,1,1), bar(1,2,1), quz(1,3,3), etc.

Such stored data is next to useless if we don't know what the inputs and outputs map to. We don't know if scene foo is a scene of a desk or a scene of a movie and we don't know if baz is a book, a gun, or an open book, but the person's brain using the implant does. Determining what these mappings are could be very difficult. We may have to expose the implant's wearer to millions of different objects to determine how they what the object tags are.

Your interpretation: data is "next to useless". Plaintiff's expensive lawyer interpretation: "clear, decisive and overwhelming". Hope you have a good lawyer too.

I know I'm being cynical when I say this is 2017 and facts don't matter. Yet here we are.

Even in alternate realities, really. There's a Black Mirror episode (a really good one, so no spoilers here) about exactly that scenario.

I think multiple episodes including the season 2 christmas episode comment on brain computer interfaces in one form or another and they all seem realistic and scary to me. Best not use direct brain computer interfaces.

Is that s3e01?

Why not build a well regulated state that only uses such powers in narrow circumstances?

I mean, you are sort of implying that installing a neural mesh would give you greater exposure to injustice than not doing so, so why not just fight the injustice to begin with?

Not believing that such a state is achievable is one thing, but you did say "in this reality".

> Why not build a well regulated state that only uses such powers in narrow circumstances?

Because the definition of "well regulated" is highly subjective and any state that's in power would consider its own uses to be with the confines of any circumstance no matter how narrow.

The only way to win is to not play the game.

No, the only way to win is to continually work to build a more just society.

It may be pragmatic to keep computers out of your brain in the meantime.

I would recommend the book Animal Farm.

The revolution was good in every way. It was peaceful and the animals got back control of their lives. But even from that, the pigs convinced everyone they needed leaders.

Unfortunately, the pragmatic reality is that no matter how much you try to shape a system of control to be balanced, the people who eventually get into power are the ones that crave it and often don't have much respect for the individual.

Yes, you must continually work to build a more just society. There is no sitting back and enjoying it after you have finished it because it will never be finished.

The intractable problem is that what constitutes "more just" is highly subjective, highly debatable, and always will be.

All historic societies believed they were being "more just" in some sense.

First reason that springs to mind is that the deviation from "well regulated state" to "fascist dictatorship" is always one election away.

Even the narrowest of circumstances tend to broaden when it can benefit the state.

"It is not that power corrupts but that it is magnetic to the corruptible." - David Brin

There is no such thing. Absolute power corrupts absolutely and all stateful societies will trend toward dystopia.

And all stateless societies will tend towards a state.

By way of ideals, I'm an anarchist. But I recognize it isn't practically achievable.

Anarchy requires a certain degree of viral sacredness most egos today aren't willing to practice.

Could you expand on the idea of viral sacredness?

Well regulated states are unstable equilibria.

Because 1930's German census and current US politics is why,.

Unfortunately you have to assume the worst will happen, and plan accordingly.

I would argue I am also talking about planning for the worst. Surviving while millions of people are exterminated around you is not an amazing, tremendous success.

It seems people think I was arguing that they should be eager to plug computers into their brains. I was not. I was arguing that hiding while injustices are carried out upon those around you is not success.

I'm curious why you called it a neural mesh. I've never heard that term before and some searching doesn't result in anything. Is that something you made up?

They may've been thinking of something like the "neural lace", from the Iain M. Banks Culture books.

Musk used it a while ago talking about the probability we're already in a simulation. From a Buddhist's perspective, that works for me.

Wouldn't something like that be encrypted and have a neural password?

What makes you think the government couldn't demand the maker of the neural connectors exfiltrate the neural password?

The fact that this is already a solved problem for iPhones via the Secure Enclave?

There is a even easier way to get somebody finished off.. drop a noisy true crypt container on there cellphone or notebook - if they get searched- they will be held in contempt indefinably for a white noise treasure trove they can not open.

Easy to defend, they have to prove you created said file consciously if the device was ever in the possession of someone else other than police. If they are likely to break the law to tamper with evidence, you've already lost.

I'm not convinced it is entirely solved though. Didn't the FBI drop their request to Apple because they found a loophole or security vulnerability that allowed them to accomplish what they wanted?

I think at the end of the day, software has bugs. And if you have an extremely well funded and intelligent group (e.g. Equation Group) looking for these holes and keeping them secret for personal use and exploitation rather than fixing them, there are going to be ways for your data to be compromised.

> Didn't the FBI drop their request to Apple because they found a loophole or security vulnerability that allowed them to accomplish what they wanted?

The phone in the San Bernardino case was an iPhone 5C, with the A6 processor. Secure Enclave was introduced in the A7.

https://9to5mac.com/2016/04/07/fbi-iphone-hack-method-secure...

Ah yes, I forgot this detail. Thanks!

I agree with you, although you were wrong about that specific Apple case. I don't trust "secure enclave" because it would be too easy for a TLA to infiltrate the chip foundry and backdoor the silicon. they can literally print money, circumvent the constitution using secret courts/NSL's, their resources are infinite. what would stop them from doing this ?

Even if you couldn't infiltrate the chip foundry, you could order a bunch of the chips, reverse engineer them, and in a few months, ship a duplicate with a neutered "enclave". Then interdict the shipment to the phone manufacturer (this isn't tinfoil, it's been done) and "supply" them with your version of the "secure enclave". There's no limit to this cat and mouse game.

That's not really an argument against a neural lace, though. You're just as fucked if you don't get one - they drop child porn on your laptop, or just disappear you.

No, the model of the iPhone the FBI wanted to access didn't have the Secure Enclave.

It's a solved problem the way the laws are currently written. It's not a solved problem if the laws are rewritten to require manufacturers to support a backdoor.

How would the maker of the neural connectors get your neural password?

There have been several court cases where the government has compelled people to give up encryption keys in court, I assume this will be no different.

If you have something, a court can order you to give it up. If you know something which might incriminate you (e.g. a password), your testimony is protected by the 5th.

For international laws, see: https://en.wikipedia.org/wiki/Key_disclosure_law

Specifically for the US, see: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord... and https://en.wikipedia.org/wiki/United_States_v._Fricosu

The Florida Second District Court of Appeals disagrees with you.

https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

My iPhone is set to passcode unlock instead of fingerprint because of the reasoning you say, but if other courts start agreeing with this one, I'm inclined to change to Touch ID for simplicity :(

There is still the argument that you can be physically coerced to unlock your phone against your will by someone pressing it against your finger, but you can't type in a passcode against your will.

What if you have a self destruct code? (engineered in a way that makes it indistinguishable that it has been activated instead of normal description)

Or better yet, a dead man switch.

Cannot be really held in contempt for having features to prevent coercion.

Call me when a circuit court makes a decision, at the least. SCOTUS will almost certainly decide on "forgetting your password is not a crime".

Important to note that this is a legal theory, that is not yet backed up by precedent or statute! The police have successfully compelled password disclosure many times.

There has been tons of precedent, on both sides: http://www.zdnet.com/article/florida-court-says-password-dis...

This is the only sane interpretation, though, as people have more and more encrypted devices, it's unreasonable to punish someone for not remembering a password.

unless you're that police officer from pennsylvania who they just locked up without due process until he coughs up the password.

  they just locked up

That wording implies that this "just" happened, even perhaps during the current administration. The court order was 18 months ago, and he's been "locked up" for the past 16 months.

I think he meant 'just' in the 'simply' sense.

Source? I'm from PA and haven't heard about this.

https://www.washingtonpost.com/news/morning-mix/wp/2016/04/2...

apparently the "All Writs Act" of 1789 is the "constitution doesn't apply to you" trump card.

Passwords have only been protected by the 5th amendment when ownership of the electronic account/device is unproven.

The keys are derived from the password which can't be compelled.

I get it but this is some scary stuff that pushes the bounds of ethics. I mean, on one hand we want to prevent insurance fraud because it impacts everyone. On the other, where do we draw the line? Should we even have to consider that a pacemaker could be used to gather data about us before we consent to a pacemaker? It shouldn't. Now it is.

I don't see why this is scary. I think it's somewhat comparable to the police examining his clothes, for example, and finding no traces of sweat or smoke, which would make his story not credible. Or what about looking at how many steps a Fitbit recorded? If the pacemaker had a GPS or something embedded in it, that would be egregious, but a pacemaker collecting data on the pace it's making is expected, and the police should be able to look at it with a warrant. Police can access medical records with a warrant, and this is basically just a very recent medical record.

You don't need clothing to stay alive, nor a fitbit.

And medical history can't really be used to indict someone. Where this clearly was.

EDIT: can't be used to indict, only as addition evidence for a trial. It's an important distinction, but I'm not sure I think it's okay either.

Why isn't it ok? The whole purpose of a warrant is to reveal private information when necessary. I get that medical history is especially sensitive, but I don't see why it should be completely off limits. What if, say, someone claimed to be out of the country for an extended period of time, but their medical history showed they actually required frequent treatment at a local hospital? Should that be inadmissible?

IMO, it's not okay because the strict alternative is the patient must choose death. Pace makers are very invasive. They're not generally installed unless absolutely needed.

In this case, it's very similar to saying. "If you don't let us install this device that the government can use to know exactly what you were doing every hour of every day; you'll die."

It's not quite the fact that it's medical history, but it's very detailed, personal medical history. "He had gout some time in the last few weeks/months" vs "He was running 14 times in the last 21 days, and heres' the exact minute he started and ended"

> but their medical history showed they actually required frequent treatment at a local hospital? Should that be inadmissible?

That they acquired treatment? Maybe. That they were treated for an STI? Yes, that should be inadmissible. Because as a medical person, I don't want you avoiding ANY treatment because you scared the information about the treatment would be used against you.

You can't stay alive without blood, but we can use it to convict a person.

The 4th amendment isn't there to make it hard to get a conviction. It is there to make sure you aren't harassed by searches.

It's not quite the same. I assume you mean donated blood, because otherwise your response doesn't make much sense. So if you are cut, and leave blood behind (yours and the donated blood?) The could be used to convict you because it's something you abandoned.

Where in this case, the got a court order to take information from a device. Not to compare it to a sample they already had, but at a single point of evidence, that will be used to incriminate.

Additionally, that same evidence could be used to prove innocence, where the pacemaker data couldn't be used as evidence to prove innocence.

EDIT, Also, the 4th is protection from unreasonable searches... e.g. if the device I required to live needs extra data to do it's job. IMO, it is an unreasonable search to use that against me because I have no choice in wither or not, I create the data, or use the device. Because the alternative is I choose to die.

I'm sorry, what? A warrant for something intangible and inert inside of my body? Police will have access to the information I choose to store inside my own body when I am either dead, or heavily restrained and tranquilized, and not a moment before.

Is it really that scary?

Suppose there was a criminal who claimed that, with a broken leg, they couldn't possibly have committed some act. Isn't it reasonable to get a warrant for the person's XRays in order to get hard evidence that the person was or was not incapacitated?

The scary part to me is the medical examiner. They are making a very advanced claim (that they can determine something definitive about what the person was or was not doing) based on the heart data. Given previous overreaches from forensic examiners, I'd want to see some actual research before chucking the person into jail.

When it comes to assistive technologies the current legal situation is scary, because data generated and stored by devices you need to use by medical reasons are treated the same way as devices ( and data ) you choose to use.

The more information about you that is available the more likely it is that a spurious correlation, misremembered facts or inferenced made from the data will often make you seem less trustworthy than somebody you have less data about as long as both parties behave according to societal norms.

If you have an actual impairment, especially cognitive, the situation is even worse.

> Should we even have to consider that a pacemaker could be used to gather data about us before we consent to a pacemaker? It shouldn't.

Your pacemaker gathers that data (exertion history over time) so that your doctor can view it after the fact and ask you "what were you doing last Thursday afternoon? The pacemaker says it was running extra high between 3:30 and 4:30."

I think most people would opt into such a device for their own health - in fact, many might wear it on their wrist and pair it with their phone.

This is just one more inflammatory example of why free software is necessary, especially in medical devices. It should not be possible for your computing devices to be used against you without your consent. For more on this area specifically, please watch this excellent talk by Karen Sandler: https://www.youtube.com/watch?v=GcWlD2Y6HNM

Why specifically computing devices? Everything else can be used against you without your consent. I mean obviously you should be allowed to encrypt your stuff if you want to, but I don't see what's so inflammatory about this example. This guy did give his consent when he got a pacemaker installed, presumably so his doctor could give him better treatment by analyzing its data.

What would free software change in this scenario? Assuming that the free-software pacemaker had the same functionality (including storing historical data) the same warrant could and would be used to retrieve that data without consent of the suspect.

At least police obtained the data through the proper channels, securing a search warrant. I can't think of an argument against this being valid and reasonable.

Same reason they can't make a spouse testify against you. The chilling effect would be problematic. (Or, if you want something more medical, why Physicians or Psychiatrists can't be force to testify against you.)

As a former medical person, and a current tech person; I'm sitting here wondering how I could write software that would allow me to get the data to help and protect my patient's health, while still protecting/limiting the data from things/actions like this one.

When helping my patients to make the decision of whether or not to have a pacemaker installed, I don't want them worrying if it's ever going to become evidence against them at some later date.

I know that spousal privilege is codified into law, which got me thinking if there are similar protections between doctors and patients (like there are with attorneys). It looks like some countries have protections between patients and doctors, but not the USA.

https://en.wikipedia.org/wiki/Physician%E2%80%93patient_priv...

I agree that this information should be protected, but it looks like we will need additional laws to grant these privileges.

There are exceptions to patient privilege. Most states have laws regarding ongoing abuse or abuse of a minor which must be reported by doctors.

Sure, because someone is actively being harmed, or will be harmed in the future. (and is injury that's not easily recouped, i.e. abuse of a minor could be a life long injury, where insurance fraud is build into the cost of premiums)

This was the reassuring part to me. Hey they can get a warrant to download your vehicle's "black box" history too. It would have alarmed me if they simply told the pacemaker service provider "this is a person of interest, give us all your data on them, oh and you can't tell anyone about this or we'll bring you up on treason charges." That is the kind of stuff that really bothers me.

I'm curious how a) they determined he had a pace maker b) where they got the idea to check it for data. Pretty wild.

Exactly - parallel construction is a thing.

I feel obligated to mention it every time in these circumstances because even if it doesn't apply in this particular case, people should be aware of how surveillance can affect them even if what the police do is on the up and up on the surface.

From the article:

> Compton, who has extensive medical problems, including an artificial heart implant that uses an eternal pump

(I'm fairly certain they meant "external" there.)

Good pickup. Haha I'd an "eternal" pump would be handy.

i read another article about this, and apparently he told the 911 operator something along those lines...

Edit: "Compton also told the dispatcher he had “an artificial heart.” http://www.networkworld.com/article/3162740/security/cops-us...

I can, maybe. Is that pacemaker legally part of that man's body? If so, wouldn't this be requiring a man to testify against himself, and would a search warrant be appropriate? I don't think you can use one to force a DNA or HIV test, for example.

Being part of the body doesn't make a difference - with an appropriate warrant, you certainly can force a DNA or HIV test, or take fingerprints or any other analysis of the body; self-incrimination doesn't cover that.

DNA tests can be forced to determine paternity.

People dislike government but love their technology. So it makes sense for them to not like when government uses technology.

It seems unlikely that the heart rate data alone would allow for indictment but it was one more piece of data since the suspect was not cooperating. [http://www.networkworld.com/article/3162740/security/cops-us...]

They found gasoline on his clothing, investigation revealed the fire started at multiple locations and he told 911 that "everyone was out of the house" but was heard over the phone telling someone to get out of here. So he was an idiot and got caught...

I wonder if he had any idea his pacemaker collected such data or that it could be used against him? Should patients be made aware of this risk when they're receiving the devices?

> Should patients be made aware of this risk when they're receiving the devices?

Yes, if they find out via the internet, instead of the physician; now your patient doesn't trust you as much, and you can't do your job.

> Should patients be made aware of this risk when they're receiving the devices?

What risk? The risk that the truth comes out? Give me a break.

Devil's Advocate:

Software has bugs, what if the data implicated him but was incorrect? Of course bugs in a pacemaker means bigger problems... but you get my point.

The possibility of bugs is something that the defence can argue - the court would need to find beyond reasonable doubt that the defendant was guilty. It's certainly not the responsibility of manufacturer to provide perfect or imperfect certainty about the data, but it's the prerogative of the jury to decide the trustworthiness of that data.

I assume that a reasonable justice system wouldn't sentence someone based on a singular piece of evidence. True facts reinforce each other; false claims oppose the truth. Therefore if the data was incorrect, hopefully there would be other pieces of evidence that would contradict the data.

You assume that the truth will set you free, and not to an interment camp, or lose you your refugee status.

The risk that the data is accessible. Today it's the police, tomorrow: who else?

Apart from anything else, there's a delightful irony in that the device that (probably) kept him alive to be able to commit a crime was also responsible for catching him.

It sounds as though the doctors' evidence was fairly powerful regardless of the data from the pacemaker.

The Tell-Tale Heart

You should take a bow for that one, way to stick the landing.

Excellent!!

One person's metadata is another's data

How is this not a HIPPA violation?

HIPAA is a federal EDI standard for healthcare providers and insurance companies that includes protections for patient safety and privacy as well as security mandates intended to protect the integrity and availability of the medical/insurance data collection and interchange processes. It has nothing to do with the lawful collection of evidence, and in fact specifically allows that:

https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe...

HIPPA allows disclosure in response to a court order or warrant (among other things). See here: https://www.law.cornell.edu/cfr/text/45/164.512#f

IANAL nor American but this feels like another thing stepping on top of their constitution, specially the spirit of the fifth:

> nor shall be compelled in any criminal case to be a witness against himself

I can be tried for my data? That's kind of messed up, what if the data was faked, etc.

Of course you can be tried for you data. Letters, records, etc. have always been used.

There should be even more stories where data from fitness trackers is used, right?

They can't proof that you were wearing the device at the time of the incident. It's also possible to fake the data, either by letting someone else wear it or by spoofing the bluetooth device itself.

Reply on news.ycombinator.com