GNOME Chief Sandler Seeks Open-Source Code for Life-Saving Implants

O'Reilly

Proprietary medical software conceals fatal bugs and wireless vulnerabilities while legal preemption blocks patient lawsuits, making open source an urgent necessity for life-critical technology.

AI-assisted summary of OSCON 2011: Karen Sandler — original source. Check the original for full context.

Source published: 2011-07-31

Key ideas

Karen Sandler highlights the danger of closed-source medical software after discovering she could not inspect the proprietary code controlling her implanted cardioverter-defibrillator. (2:40)
Research into FDA recalls indicates that roughly 98% of isolated medical software defects could have been detected and prevented using basic all-pairs testing. (4:35)
Federal preemption case law strips patients of the right to bring state-level product liability lawsuits against medical device manufacturers for software defects. (4:35)
Security researchers demonstrate that commodity radio equipment can wirelessly intercept and manipulate medical implants, risking battery depletion or unauthorized electric shocks. (8:21)

Detailed notes

## Background This talk was delivered at OSCON 2011 and published on YouTube by O'Reilly on July 31, 2011. The video description highlights speaker Karen Sandler, then the newly appointed Executive Director of the GNOME Foundation and former General Counsel of the Software Freedom Law Center.

## TL;DR After being diagnosed with hypertrophic cardiomyopathy, Karen Sandler was faced with the life-saving necessity of receiving an implanted defibrillator, only to find that manufacturers and regulators completely barred her from inspecting the proprietary software wired to her heart. Investigating the medical device ecosystem, she uncovered systemic regulatory blind spots at the FDA, alarming software defect rates, and vulnerable, unencrypted wireless communications that leave patients physically exposed. Expanding her focus beyond her own chest, Sandler argues that code now governs critical societal infrastructure—from automotive controls and voting machines to mobile healthcare apps. She issues an urgent call to action for developers and consumers to reject closed proprietary systems and instead champion free and open source software, spotlighting user-centric platforms like GNOME 3.

## Atmosphere & style The presentation blends raw, high-stakes personal vulnerability with incisive legal analysis and a passionate rallying cry. Sandler strikes an engaging, warm, and candid tone, using self-deprecating humor about becoming a 'cyborg' to disarm the audience before confronting them with the terrifying reality of unreviewable code controlling human organs. Watching her speak feels both intimately relatable and intellectually alarming, culminating in an impassioned moral challenge that leaves attendees visibly rethinking their everyday relationship with proprietary technology.

## Bulletin - [02:40](https://www.youtube.com/watch?v=nFZGpES-St8&t=160s) Karen Sandler highlights the danger of closed-source medical software after discovering she could not inspect the proprietary code controlling her implanted cardioverter-defibrillator. - [04:35](https://www.youtube.com/watch?v=nFZGpES-St8&t=275s) Research into FDA recalls indicates that roughly 98% of isolated medical software defects could have been detected and prevented using basic all-pairs testing. - [04:35](https://www.youtube.com/watch?v=nFZGpES-St8&t=275s) Federal preemption case law strips patients of the right to bring state-level product liability lawsuits against medical device manufacturers for software defects. - [08:21](https://www.youtube.com/watch?v=nFZGpES-St8&t=501s) Security researchers demonstrate that commodity radio equipment can wirelessly intercept and manipulate medical implants, risking battery depletion or unauthorized electric shocks.

## Key takeaways - [00:05](https://www.youtube.com/watch?v=nFZGpES-St8&t=5s) Sandler was diagnosed with hypertrophic cardiomyopathy, an enlarged heart condition creating a fatal risk of sudden cardiac death. - [00:05](https://www.youtube.com/watch?v=nFZGpES-St8&t=5s) Medical teams urged an implantable cardioverter-defibrillator and pacemaker, forcing Sandler to confront the reality of living as a 'cyborg'. - [02:40](https://www.youtube.com/watch?v=nFZGpES-St8&t=160s) Medical device manufacturers and doctors refused Sandler's requests to inspect the source code running on her heart implant, even under NDA. - [04:35](https://www.youtube.com/watch?v=nFZGpES-St8&t=275s) Complex software inherently carries defects, with industry metrics estimating roughly one bug per hundred lines of code. - [04:35](https://www.youtube.com/watch?v=nFZGpES-St8&t=275s) The FDA does not maintain a central repository of medical device code or routinely perform independent premarket source code audits. - [04:35](https://www.youtube.com/watch?v=nFZGpES-St8&t=275s) Federal tort preemption leaves patients harmed by defective medical devices with virtually no legal recourse under state product liability law. - [08:21](https://www.youtube.com/watch?v=nFZGpES-St8&t=501s) Modern medical implants couple closed, proprietary software with insecure wireless broadcasts susceptible to tampering via off-the-shelf radio equipment. - [08:21](https://www.youtube.com/watch?v=nFZGpES-St8&t=501s) Bodily autonomy and safety require open-source software so that independent researchers and competitors can identify flaws and build patches. - [09:58](https://www.youtube.com/watch?v=nFZGpES-St8&t=598s) Software dependence has spread from specialized technical tools into critical public infrastructure like cars, voting systems, and financial markets. - [11:27](https://www.youtube.com/watch?v=nFZGpES-St8&t=687s) As ordinary consumers integrate software into daily logistics and health tracking, interfaces must be designed for non-technical users. - [11:27](https://www.youtube.com/watch?v=nFZGpES-St8&t=687s) GNOME 3 was intentionally redesigned around ordinary user workflows to make free and open source software accessible to the general public. - [13:00](https://www.youtube.com/watch?v=nFZGpES-St8&t=780s) Technologists must build systems on open platforms rather than proprietary ecosystems to prevent permanent dependence on closed code for human survival.

## Detailed walkthrough ### [00:05](https://www.youtube.com/watch?v=nFZGpES-St8&t=5s) Becoming a Cyborg: Diagnosis and the Need for a Defibrillator

Karen Sandler opens her OSCON talk with a striking declaration she had long waited to deliver: “I am a cyborg lawyer running on proprietary software.” She explains that until about a month prior, she served as general counsel at the Software Freedom Law Center (SFLC). A few years earlier, she discovered that she had an enlarged, obstructed heart—a condition known as hypertrophic cardiomyopathy. While she experienced no outward physical symptoms and felt completely capable in day-to-day life, the condition placed her at an exceptionally high risk of sudden cardiac arrest, known clinically as “sudden death.” Even mundane activities carried dread; she could not sprint to catch a bus without the terrifying knowledge that she might collapse.

To mitigate this fatal risk, her physicians prescribed medication and strongly urged her to receive an implantable cardioverter-defibrillator (ICD) and pacemaker. The device functions as an internal safety net, ready to shock her heart back into rhythm should she collapse, sparing her the gamble of hoping an external automated external defibrillator (AED) and a competent bystander might be nearby. Yet confronting the surgery triggered severe personal reckoning. Sandler struggled with the unsettling identity shift of literally becoming a cyborg, uncomfortable with the prospect of having a mechanical device implanted into her body and screwed directly into her heart muscle. Over time, she reconciled herself to the idea—thinking she could be a “cyborg for good”—partly because living un-implanted was agonizing for her family and friends, who lived in constant terror that she might drop dead on a simple afternoon walk.

[02:40](https://www.youtube.com/watch?v=nFZGpES-St8&t=160s) “What Does It Run?”: Confronting Doctors, Reps, and Manufacturers

When Sandler finally met with her electrophysiologist to proceed with the implant, her professional background in software freedom abruptly collided with standard medical practice. The doctor slid a sample device across the table, pitching its compact, unobtrusive form factor. Sandler responded with a question that completely derailed the consultation:

> “I said great, what does it run?”

Her electrophysiologist looked at her as if she were insane, her mother stared in disbelief, and the entire room ground to a halt. When Sandler pressed further, asking about the software running on the hardware, who audited it, and whether she could inspect the source code, the staff was flabbergasted. The clinic brought in medical device sales representatives from two separate manufacturers who happened to be on-site. Unaccustomed to such inquiries, the representatives became noticeably nervous and offered zero answers.

Refusing to drop the matter, Sandler personally phoned all three major manufacturers of pacemakers and defibrillators. She pleaded her case as an incoming patient about to connect their hardware to her heart, asking to inspect the code to verify its integrity, even offering to sign a Non-Disclosure Agreement (NDA). None of the manufacturers possessed any procedure or willingness to handle her request. Trapped between the absolute refusal of the companies to disclose proprietary code and the looming reality that delay could literally cost her life, Sandler relented and underwent the implantation surgery.

[04:35](https://www.youtube.com/watch?v=nFZGpES-St8&t=275s) Bugs, FDA Loopholes, and the Legal Black Hole of Preemption

Following surgery, Sandler returned to the Software Freedom Law Center determined to investigate the safety and governance of medical device software. She submitted multiple Freedom of Information Act (FOIA) requests to the U.S. Food and Drug Administration (FDA), which remained unanswered years later. Delving into academic studies, Sandler encountered sobering realities about software engineering. Drawing on metrics from the Software Engineering Institute estimating approximately one bug for every 100 lines of code, she realized that complex medical devices inevitably host latent software defects. Reading detailed accounts of device malfunctions and patient deaths proved gut-wrenching, frequently forcing her to put the research aside to cope with the anxiety of hosting an identical device in her chest.

One study examining FDA software-related device recalls particularly stunned her: among cases where the underlying failure mechanism could be isolated and analyzed, researchers estimated that roughly 98% of failures could have been detected and prevented with basic all-pairs testing—a standard industry method for verifying multi-variable interactions. When Sandler looked into how the federal government regulates this software, she uncovered systemic regulatory failures:

```mermaid flowchart TD accTitle: FDA Medical Device Oversight Deficiencies accDescr: Flow diagram showing how device companies self-report while the FDA lacks source code and tort preemption blocks patient lawsuits.

subgraph Manufacturer["Device Manufacturers"] Code["Proprietary Source Code<br/>(Stored Internally)"] SelfReports["Self-Authored Test Reports<br/>(No Fixed Requirements)"] Code -->|"Internal summary"| SelfReports end

subgraph Regulator["Regulatory Oversight (FDA)"] FDA["Food & Drug Administration"] NoRepo["No Code Repository<br/>No Source Audits"] SelfReports -->|"Submitted to"| FDA FDA -.->|"Does not inspect"| Code FDA --- NoRepo end

subgraph LegalGap["Patient & Legal Reality"] Patient["Patient with Implant"] Preemption["State Tort Preemption<br/>(No Right to Sue for Defects)"] Patient -->|"Harm from failure"| Preemption end ```

- **Absence of independent code reviews:** The FDA does not routinely examine medical device source code prior to approval, reviewing code only after serious failures are already suspected. - **Reliance on corporate self-reporting:** Regulators rely almost entirely on summary reports written by the manufacturers evaluating their own proprietary software. - **Lack of concrete standards:** The FDA does not prescribe mandatory, standardized testing benchmarks, arguing that strict requirements might fail to anticipate unique edge cases in novel hardware. - **No centralized code escrow or archive:** Because the FDA never demands the actual source code, the agency maintains no central repository; the code remains exclusively on the servers of the private corporations that wrote it. - **Tort preemption protects manufacturers:** Because medical devices undergo federal premarket approval, established federal preemption case law strips patients of the right to bring product liability lawsuits under state tort law, leaving injured individuals with virtually no legal recourse.

[08:21](https://www.youtube.com/watch?v=nFZGpES-St8&t=501s) Insecure Wireless Broadcasts and the Moral Imperative for Open Source

Sandler emphasizes that patients currently endure “the worst of both worlds”: completely closed, unreviewable software on the inside, coupled with unsecured, vulnerable communications on the outside. Modern ICDs incorporate wireless transceivers designed to communicate with external programming units, yet these broadcasts often lack fundamental security safeguards. She cites security researchers who demonstrated that commodity, off-the-shelf radio equipment can intercept and manipulate ICD communications. Hackers were capable of commanding devices to deliver unwarranted, agonizing electric shocks, withholding life-saving therapies during cardiac arrest, or switching devices into a diagnostic test mode that drains the battery without triggering any alert. Because replacing a depleted battery requires invasive surgical extraction, deliberate battery drain represents a critical physical hazard.

> “I want my heart to be free and open. I want the software in my body to be, you know, reviewable by everyone.”

These revelations transformed Sandler's perception of software freedom from a noble intellectual principle into an urgent physical necessity. For Sandler, bodily autonomy requires code visibility: she wants the software regulating her heartbeat open to peer review by friends, family, independent academic researchers, conference attendees, and even commercial competitors incentivized to locate security vulnerabilities in each other's code so that life-saving software patches can be rapidly developed and deployed.

[09:58](https://www.youtube.com/watch?v=nFZGpES-St8&t=598s) The Blurring Line Between Daily Life and Critical Infrastructure

Karen Sandler emphasizes that relying on a single proprietary vendor is dangerous when stakes are life-or-death, but stresses that this vulnerability extends far beyond her own implanted medical device. As she puts it: “I don't want to rely on one company for something as essential as my heart and I think it's really not a quick leap to say that all of our life and society critical functionality should be the same way.” She points out that society already entrusts code to steer cars safely from point A to point B, tally ballots in voting machines, and manage global financial markets. Anything essential to how communities organize and conduct their collective lives now runs on software, making software freedom a fundamental public safety issue rather than an abstract technical debate.

At the same time, the distinction between what is strictly "life and society critical" and what constitutes ordinary software has become heavily blurred. A decade earlier, the audience in the room comprised the primary computer users, occasionally called upon to help relatives with basic word processing. In the intervening years, software adoption has completely saturated everyday life: parents, siblings, and extended family members rely on software for communication, creativity, and daily tasks. People who were uncomfortable around computers five years earlier are now constantly on Facebook and managing their days through smartphones. Because software has become integral to existence, user expectations have drastically shifted—if an application is not immediately intuitive, simple, clear, and functional right out of the box, users consider it fundamentally broken.

- **Examples of societal infrastructure dependent on software:** Automotive safety systems, electronic voting machines, and financial trading markets. - **Cultural shift over ten years:** From tech-savvy specialists assisting family members with word processors to ubiquitous smartphone usage and social networking across generations.

[11:27](https://www.youtube.com/watch?v=nFZGpES-St8&t=687s) GNOME 3 and the Need to Design for Ordinary Users

This shift in human dependence on software led directly to Sandler’s decision to transition from the Software Freedom Law Center to become the Executive Director of the GNOME Foundation roughly a month prior to the talk. Arriving just after the launch of GNOME 3, she showcases its visual interface to the audience. She recounts showing the desktop environment to her mother, whose immediate reaction was to ask, “Oh, when did Apple have a redesign?” Sandler humorously notes that she assured her mother it was far better, “magical,” “revolutionary,” and completely free, prompting her mother to conclude that it was software she could actually use.

The philosophy driving GNOME 3 was a complete rethink of the desktop interface, purposely designed around the workflow and expectations of regular users rather than catering strictly to traditional technical preferences. Sandler notes that software has woven itself into basic physical activities—from hailing taxicabs to logging fitness and diet. She highlights recent developments where smartphone applications interface directly with implanted insulin pumps to monitor blood glucose levels in real time. While technologically remarkable, it represents the exact same dilemma Sandler faces with her defibrillator: everyday consumers are now walking around with proprietary code interfacing directly with their bodies and health.

```mermaid flowchart TD accTitle: Expansion of Software into Critical Human Health accDescr: Diagram illustrating how software moved from specialist tools to everyday utilities and life-critical medical devices. subgraph Everyday["Everyday Adoption"] A["Communication & Social Media"] B["Hailing Taxis & Daily Logistics"] C["Diet & Exercise Tracking"] end subgraph Critical["Life-Critical Applications"] D["Automotive & Financial Systems"] E["Implanted Insulin Pumps"] F["Sandler's Heart Defibrillator"] end Everyday -->|"Blurring boundaries"| Critical ```

[13:00](https://www.youtube.com/watch?v=nFZGpES-St8&t=780s) A Crossroads for Software Freedom and a Call to Action

Sandler brings her narrative full circle, linking mobile health tracking back to the dilemma of her own heart. Because software that governs life- and society-critical functions is now embedded everywhere, society can no longer predict which devices or systems will suddenly become matters of survival. For this reason, users cannot afford to trust single private vendors with their wellbeing: “I don't want to rely on one company for any part of my life I don't want to rely on Medtronic for my heart and I don't want to rely on any other company for any other thing I want everybody to be able to see the source code and I especially want to see the source code.”

Looking out across the conference hall, Sandler notes the widespread presence of Apple laptops and challenges the audience directly. She urges attendees, as they close their MacBooks and head to the next sessions, to confront the software future they are creating for their families and future generations. She implores the community to build exclusively on free and open source software and open platforms, ensuring that society never finds itself permanently dependent on closed-source, proprietary code for the systems people rely on to stay alive. Sandler concludes with a practical appeal to support the ecosystem: adopt GNOME 3, support software nonprofits that form the bedrock of the movement, and become a Friend of GNOME.

- **Core demand:** Complete transparency and accessibility of source code for all software impacting personal safety and civil society. - **Final actions urged by Sandler:** - Build exclusively on free and open platforms rather than proprietary ecosystems. - Test and run GNOME 3. - Donate to non-profit organizations supporting free and open source software. - Join the GNOME Foundation's donor program by becoming a "Friend of GNOME."

## Notable quotes > [09:58](https://www.youtube.com/watch?v=nFZGpES-St8&t=598s) I don't want to rely on one company for something as essential as my heart and I think it's really not a quick leap to say that all of our life and society critical functionality should be the same way. — Karen Sandler

## Mentioned Karen Sandler, GNOME Foundation, GNOME 3, Software Freedom Law Center, Software Freedom Conservancy, Gibson, Dunn & Crutcher LLP, Clifford Chance, Columbia Law School, The Cooper Union, U.S. Food and Drug Administration, Software Engineering Institute, Apple, Medtronic, Facebook, OSCON 2011

## Video description Karen Sandler

Executive Director, GNOME Foundation

Karen M. Sandler is the Executive Director of the GNOME Foundation. Prior to joining GNOME, she was General Counsel of the Software Freedom Law Center. Karen continues to do pro bono legal work with SFLC and serves as an officer of both the Software Freedom Conservancy and SFLC. Before joining SFLC, she worked as an associate in the corporate departments of Gibson, Dunn & Crutcher LLP in New York and Clifford Chance in New York and London. Karen received her law degree from Columbia Law School in 2000, where she was a James Kent Scholar and co-founder of the Columbia Science and Technology Law Review. Karen received her bachelor's degree in engineering from The Cooper Union.

[Source](https://www.youtube.com/watch?v=nFZGpES-St8)

中文简报

GNOME负责人Sandler呼吁为救命植入设备推行开源代码专有医疗软件掩盖了致命缺陷和无线漏洞，而联邦法律优先权又阻断了患者诉讼，这使得开源成为关键生命技术的当务之急。在被诊断出患有肥厚型心肌病后，Karen Sandler面临着植入除颤器以挽救生命的必要性，却发现制造商和监管机构完全禁止她审查连接到自己心脏的专有软件。在调查医疗设备生态系统时，她揭露了美国食品药品监督管理局（FDA）系统性的监管盲区、令人担忧的软件缺陷率，以及让患者面临人身风险的脆弱未加密无线通信。Sandler将关注点从自身胸腔扩展开来，指出代码如今掌控着从汽车控制系统、投票机到移动医疗应用等关键社会基础设施。她发出紧急呼吁，号召开发者和消费者拒绝封闭的专有系统，转而支持自由和开源软件，并重点推介了像GNOME 3这样以用户为中心的平台。 Karen Sandler在发现自己无法审查控制其植入式心脏复律除颤器的专有代码后，指出了闭源医疗软件的危险性。 (2:40) 对FDA召回事件的研究表明，大约98%被隔离的医疗软件缺陷本可以通过基础的全对测试被检测并预防。 (4:35) 联邦优先权判例法剥夺了患者就软件缺陷向医疗设备制造商提起州级产品责任诉讼的权利。 (4:35) 安全研究人员证实，商用无线电设备可以通过无线方式拦截和操纵医疗植入设备，带来耗尽电池电量或导致未经授权电击的风险。 (8:21)

Reading summary

Karen Sandler argues that society's growing dependence on closed, proprietary software to manage life-critical functions—exemplified by medical devices like her own heart defibrillator—poses severe safety and accountability risks that require a shift toward open-source platforms. Proprietary Medical Implants and Patient Autonomy (0:05) Diagnosed with hypertrophic cardiomyopathy, an enlarged and obstructed heart condition carrying a high risk of sudden cardiac arrest, Karen Sandler was advised by physicians to receive an implantable cardioverter-defibrillator (ICD) and pacemaker. Her request to inspect the device's source code was met with bewilderment by her medical team and outright refusal from device manufacturers, even when she offered to sign a non-disclosure agreement. Faced with a life-threatening condition where delay could prove fatal, Sandler was forced to undergo surgery without knowing how the software regulating her heart was written or audited. This personal confrontation transformed software freedom from an abstract intellectual principle into an immediate necessity for bodily autonomy, demonstrating the vulnerability patients face when compelled to trust their survival to opaque, proprietary code. Regulatory Blind Spots and Legal Immunity (4:35) Sandler's subsequent investigations revealed systemic deficiencies in medical device oversight. The U.S. Food and Drug Administration (FDA) neither inspects medical device source code prior to market approval nor maintains a central code repository, relying instead on summary reports authored by the manufacturers themselves. Furthermore, the agency imposes no mandatory, standardized testing benchmarks, leaving code quality largely self-policed. Citing Software Engineering Institute estimates of roughly one defect per 100 lines of code, Sandler notes that complex medical hardware inevitably harbors latent bugs, pointing to a study indicating that roughly 98% of isolatable software-related recalls could have been detected through basic all-pairs testing. Compounding these technical vulnerabilities is a complete lack of legal recourse. Under established federal preemption case law, medical devices that receive FDA premarket approval shield manufacturers from state product liability lawsuits. Patients harmed by device malfunctions are legally barred from suing for defects, removing a critical market incentive for corporations to rigorously audit their code. Wireless Exploits and the Need for Review (8:21) The hazards of unreviewable internal code are intensified by insecure external communications. Sandler notes that modern ICDs utilize wireless transceivers to transmit data, yet frequently lack basic security safeguards. Independent researchers demonstrated that commodity radio equipment can intercept these transmissions to deliver unauthorized, painful shocks, disable life-saving therapies during cardiac arrest, or trigger diagnostic modes that covertly drain the device's battery—a critical hazard, as replacing a depleted battery requires surgical extraction. Sandler contends that true safety cannot exist without code transparency. Proprietary opacity denies patients and independent experts the ability to audit critical software, whereas open source code enables academics, security researchers, and even commercial competitors to identify vulnerabilities and rapidly deploy life-saving patches. Everyday Software as Critical Infrastructure (9:58) Sandler emphasizes that the boundary between ordinary consumer electronics and life-critical utilities has largely vanished. Software now steers automotive safety systems, tabulates votes, governs financial markets, and—via smartphone apps—interfaces directly with implanted insulin pumps. Because modern existence is thoroughly mediated by code, reliance on single proprietary vendors creates single points of failure across civil society. To address this shift, Sandler transitioned to the GNOME Foundation to advocate for open-source desktop platforms designed for everyday users rather than technical specialists alone. Showcasing GNOME 3, she argues that accessible interfaces are essential to provide ordinary citizens with genuine alternatives to proprietary operating systems. She challenges developers to build exclusively on open platforms and support free software organizations, ensuring public safety and infrastructure do not remain permanently dependent on closed corporate code. Sandler leaves unresolved how medical device manufacturers and regulatory bodies can be legally compelled to disclose proprietary source code given existing federal preemption protections and commercial secrecy. Her argument ultimately relies on developers and users deliberately adopting and funding free, open-source alternatives before proprietary systems become permanently entrenched across vital human and civic infrastructure.

精炼阅读摘要

软件自由法律中心前总法律顾问、GNOME 基金会执行董事 Karen Sandler 指出，专有且不公开的软件已深入植入人类身体与社会核心基础设施，主张唯有推行开源与代码审查，才能消除系统缺陷对人身安全构成的致命隐患。植入体内的专有代码与知情权受挫 (0:05) Sandler 在被确诊患有肥厚型心肌病后面临极高的心源性猝死风险，医生建议她植入带有起搏功能的植入式心律转复除颤器（ICD）。出于长期从事软件自由倡导的职业直觉，她在术前向电生理学家和两家医疗设备厂商的代表询问设备运行的代码细节、代码审计机制并要求审查源码，然而现场所有人均无法回应。她随后联系了全美三大主要起搏器与除颤器制造商，甚至主动提出签署保密协议（NDA）以核验代码完整性，但各家厂商均缺乏配合意向及处理流程。在等待可能招致生命危险的现实压力下，她被迫接受了体内植入完全封闭、不透明的专有软件。监管缺位、测试不足与法律问责漏洞 (4:35) Sandler 术后向美国食品药品监督管理局（FDA）提交多份信息自由法案（FOIA）申请以调查医疗软件监管，但数年未获回应。根据软件工程研究所的估算标准，复杂软件每 100 行即可能包含 1 个缺陷。一项针对 FDA 召回事件的学术研究显示，在能够隔离并分析故障机制的医疗设备软件故障中，约 98% 原本可通过多变量组合交互的基础全对测试（All-pairs testing）进行检测与预防。调查进一步揭示了监管机制的系统性漏洞：FDA 在设备获批前通常不检查源代码，仅在发生严重事故后介入；监管严重依赖制造商自拟的测试报告，且缺乏强制统一的基准；FDA 未设立集中的源码托管库，代码完全封存在商业公司内部；更为严重的是，根据联邦先占权（Preemption）相关判例，通过联邦上市前审批的医疗设备阻断了患者依据州侵权法提起产品责任诉讼的权利，导致受害患者在法律救济层面陷入困境。无线通信安全漏洞与代码透明必要性 (8:21) Sandler 指出，患者目前承受着体内封闭软件与外部不设防通信相结合的“双重最坏境地”。现代 ICD 设备普遍配备用于体外程控的无线收发功能，但多数缺乏基础安全防护。安全研究人员已经证实，利用市售常规无线电设备即可拦截并篡改除颤器的无线信号，从而远程下达错误指令：这包括无故施加剧烈的电击、在心脏骤停的关键时刻蓄意扣发救命电击，或是强制设备切换至诊断测试模式迅速耗尽电池电量。由于更换耗尽的电池需要重新进行侵入性外科手术，电量消耗本身即构成直接的身体创伤。这促使 Sandler 坚信，代码透明与外部审查是保障身体自主权的底线，软硬件必须允许学术界、同行、公众甚至商业竞争对手审查并查找漏洞，以便及时提供补丁。关键系统渗透日常与开源界面转向 (9:58) Sandler 强调，对单一专有软件供应商的过度依赖不仅威胁医疗患者，更扩散到了整个现代社会。当前社会的汽车安全系统、电子投票机与金融交易市场均由软件控制，与此同时，普通大众的生活也已全面依赖智能手机、社交媒体与打车应用。针对普通用户对技术直观易用性的高要求，Sandler 转任 GNOME 基金会执行董事并推动 GNOME 3 的开发，致力于让非技术背景的普通人也能顺畅使用完全自由的桌面环境。鉴于智能手机已开始直接连接植入式胰岛素泵等人体医疗硬件，关键系统与日常应用的界限已经彻底模糊，公众无法预知身边的哪项设备何时会直接关乎生死。 Sandler 呼吁技术社群直面专有代码带来的普遍风险，警惕对单一商业公司的盲目信任，并敦促开发者停止对封闭平台的依赖，全面转向自由与开源软件生态，积极参与 GNOME 等开源非营利项目的建设与资助。

Source quotes

[9:58] Karen Sandler: I don't want to rely on one company for something as essential as my heart and I think it's really not a quick leap to say that all of our life and society critical functionality should be the same way.

Original transcript

[0:05] hi everyone I'm here to talk about [0:07] freedom from my heart to the desktop [0:10] I've always wanted to say this at ocan I [0:12] am a cyborg lawyer running on [0:14] proprietary software I'm a cyborg lawyer [0:17] fear me um I uh until about a month ago [0:22] I was a lawyer at the um software [0:24] Freedom Law Center and I found out a few [0:27] years ago that I I have a heart [0:29] condition [0:30] um I I have a very big heart um actually [0:35] I have a huge heart um I have [0:37] hypertropic cardiomyopathy which means I [0:40] have an enlarged and obstructed heart [0:42] and everything's fine about that I don't [0:45] have any symptoms I can do everything [0:47] it's just that I can um I'm at a very [0:51] high risk of suddenly [0:53] dying so um the the issue with that is [0:57] that I can't think about running to to [1:00] bus without worrying about the fact that [1:02] I might Keel over um and and that was a [1:06] a very stressful thing to find out um I [1:09] went to the doctors and they told me [1:11] about this and they you know prescribed [1:12] medication but then they also told me [1:14] that I needed a um an implanted [1:16] defibrillator and basically if I got an [1:19] pacemaker defibrillator I would know [1:21] that if I had a problem if I if I killed [1:23] over the actual medical term is sudden [1:27] death if I went into sudden death I [1:30] would be shocked it would be like people [1:32] following me around with paddles and uh [1:34] and I would be revived and it's great I [1:35] wouldn't have to rely on all those [1:37] external defibrillators that you might [1:39] need to locate in the case somebody has [1:40] a heart attack a few blocks away and [1:42] it's good because it's me and I don't [1:43] want to have to rely on somebody else [1:44] using their phone to find an um external [1:46] defibrillator um but the problems with [1:48] that you know when I started thinking [1:50] about getting it were you know we really [1:51] personal you know aside from the [1:53] mortality I I wasn't sure if I was ready [1:55] to become a [1:57] cyborg um there are a lot of identity [1:59] issues and become a cyborg um and I I [2:02] didn't know if I was ready for it and um [2:04] just the idea of getting something put [2:06] inside your body and screwed into your [2:08] heart is is a lot to kind of take in and [2:12] deal with so um the more I thought about [2:15] it the more I thought well I really need [2:16] this device and being a cyborg wouldn't [2:18] be so bad I could be a cyborg for good [2:22] so I decided that um that I couldn't [2:24] wait any longer because um my family and [2:27] friends were freaking out every time we [2:29] would for a walk they would look at me [2:31] and they' say are you okay is something [2:32] going to happen are you okay um and I I [2:35] I I didn't want to have to put them [2:36] through that and I didn't want to put [2:37] myself through that um so I decided that [2:40] to really seriously think about getting [2:41] the device but there was one problem I [2:45] was a lawyer at the software Freedom Law [2:46] Center so when my [2:49] electrophysiologist slid the um the [2:51] device across the table at me well not [2:53] the device I actually got a one that [2:55] they show a patients slid it across the [2:57] table to me and said look how great it [2:58] is it's small it's compact it's really [3:00] not that big of a deal I said great what [3:02] does it [3:06] [Applause] [3:10] run and he looked at me like I was mad [3:14] my mother looked at me like I was mad [3:16] everyone in the room just sort of kind [3:17] of stopped and said what do you mean and [3:19] I said well what kind of software is on [3:20] it who's checking it how does it work [3:22] can you can you tell me I'd love to see [3:24] the source code we brought in the we [3:26] brought in the medical device reps from [3:29] all the different comp you know from the [3:30] two companies that happen to have people [3:32] in on site and uh they they totally had [3:34] never feeled this question [3:36] before they got a little [3:39] nervous um and and and in the end that [3:41] office had no answers for me so I went [3:44] and I um I called all three of the major [3:47] uh pacemaker defibrillator manufacturers [3:50] and I asked each of them you know can I [3:52] see the source code for these devices I [3:54] need one I'm gonna put it in my body can [3:57] can I look at it why don't I why don't [3:58] you know just just send me the source [4:00] code and I'll take a look and I'll feel [4:02] more comfortable about putting something [4:04] you know connecting it to my heart if I [4:06] know that I can review it and see how it [4:08] works of course that went [4:09] nowhere I I I called them all they [4:11] weren't just weren't equipped to handle [4:13] the question they they they they didn't [4:15] really know what to say um I I even [4:17] offered to sign an NDA um I I I asked as [4:21] much as I could and in the end of the [4:22] day I I knew I I just I just needed to [4:25] get the device because every day that I [4:28] didn't get it I I could just die and [4:32] that's a really scary position to be in [4:35] so I got the device and I vowed that [4:39] when I went back to the software Freedom [4:40] Law Center that we would begin looking [4:42] into this issue so I did a whole lot of [4:44] research I um you know I I I put in all [4:48] these Freedom of Information Act [4:49] requests with the Food and Drug [4:51] Administration which uh still have not [4:53] been answered and this was I think two [4:55] years ago uh we're still waiting um it's [4:58] really hard to find information about [4:59] this stuff but I read a lot of studies [5:02] and um and some of the things I found [5:04] would surprise you and some of them [5:07] would not like software has bugs the [5:10] software engineering Institute estimates [5:13] that every 100 lines of code introduce [5:16] one bug so for any typical device think [5:19] about how many lines of code there are [5:20] and how many bugs are typically [5:21] introduced even if you catch most of [5:23] them that's still some [5:25] bugs it was a little nauseating because [5:27] as you're researching into medical [5:29] devices and you have one you read about [5:31] all the ways that they fail it's it's [5:33] just really stressful reading about [5:35] people dying because of the devices that [5:37] they have in their body that they're [5:38] using to count on for life saving [5:40] therapy is just you know it's just an [5:43] awful thing so I kept putting it down [5:44] and coming back and putting it down and [5:45] coming back and uh and and and this [5:47] study um had done the same thing and [5:49] they aggregated all this information and [5:51] and they said found that when they [5:53] looked at all of the um food and um Food [5:56] and Drug Administration recalls that [5:58] were identified as software fail [6:00] um of the ones that they could actually [6:02] see what had gone wrong and and really [6:05] evaluate it they estimated that about [6:07] 98% of them um could have been prevented [6:10] with simple allp Paris testing which [6:12] means testing for multiple conditions [6:14] it's really basic kind of testing that [6:16] any computer scientist would probably do [6:18] and that really just astounded me so I I [6:22] I I took a look into okay well you know [6:24] these devices are reviewed by the Food [6:26] and Drug Administration I would take a [6:29] look and see what they were doing about [6:31] this problem but what I found out is [6:33] what they're not doing the FDA does not [6:37] typically review source code of these [6:38] devices so it turns out that they only [6:41] look at the source code if there is an [6:43] actual if they already get a sense that [6:44] there's a [6:45] problem what they rely on are reports [6:49] written by the companies themselves [6:51] about their own software yeah it's it's [6:54] amazing where still they don't actually [6:57] say what the reports actually need to be [6:59] about there are no really fixed [7:01] requirements and the idea behind that is [7:03] that you know each device is different [7:06] and the FDA is worried that if they you [7:08] know set up a a list of strict [7:10] requirements they might miss something [7:11] and that because the device [7:13] manufacturers are the ones who are [7:15] actually you know who are most familiar [7:16] with the device they understand what are [7:18] the particular tests that need to be [7:19] done but that also means that there are [7:21] no mandatory I mean there are some ideas [7:23] that they say that they need to follow [7:25] but no actual concrete requirements and [7:28] then what scared me the most was that [7:30] because the FDA is not reviewing the [7:32] source code they're not requesting it so [7:35] they're not receiving copies of the [7:37] source code they're only receiving these [7:38] reports so they don't have a repository [7:41] with the source code in it which means [7:44] that the source code is only wherever [7:46] the company has decided it can be which [7:48] could be just at that [7:52] company as a lawyer I looked into okay [7:55] well what what does that mean and it [7:58] turns out that because the FDA is a [8:01] federal agency and because of the way [8:02] the pre the approval process works that [8:03] there's actually a a set of case law [8:06] that says that patients can't sue [8:08] they're preempted from suing under State [8:10] Tor law so even given the fact that the [8:12] FDA isn't even looking at any of this [8:14] stuff if there's failure there's a whole [8:17] um realm of remedies that aren't even [8:18] accessible to um to patients which is [8:21] really just terrifying so it comes down [8:25] to I don't have freedom in my own body I [8:28] can't see the source code that's [8:29] connected to my heart it's just not a [8:31] right result and in fact it's the worst [8:34] of Both Worlds so there's um proprietary [8:38] closed code on the one hand and on the [8:40] other hand these devices have wireless [8:43] components to them they're broadcasting [8:45] and there's no real Security on those [8:47] broadcasts they have been hacked into [8:50] there's a think tank that was able to um [8:52] use just regular equipment nothing [8:55] special talk to these devices have them [8:57] deliver unwanted shocks have them um [9:00] prevented from delivering therapy and [9:03] perhaps even worse run into test mode [9:05] which no one would ever detect which [9:07] runs down the battery and these devices [9:09] are only as good as their battery life [9:11] as soon as the battery is dead the [9:12] device is dead and you need to go [9:14] through surgery to get a new one so [9:17] really scary stuff actually what I've [9:20] learned from this and I thought that FR [9:22] open source software was cool and really [9:24] important before but after going through [9:26] this I know that it's it's essential I [9:29] want my heart to be free and open I want [9:33] the software in my body to be you know [9:35] reviewable by everyone I want to be able [9:37] to look at it I want my parents to be [9:39] able to look at it I want my friends to [9:40] be able to look at it I want academics [9:42] to look at it I want everybody in this [9:44] room to look at it I want the medical [9:46] device competitors to look at it to find [9:48] flaws in each other's software that is [9:50] what I want I want if there's a problem [9:53] I want to be able to um to have fixes [9:56] patched I want to have uh patches [9:58] applied quickly and I don't want to rely [10:00] on just metronic I don't want to rely on [10:02] one company for something as essential [10:05] as my [10:06] heart and I think it's really not a [10:08] quick leap to say that all of our life [10:10] and Society critical functionality [10:11] should be the same way it's not just my [10:13] heart it's the cars that we're driving [10:15] that we're relying on to get us safely [10:17] from point A to point B it's our voting [10:19] machines it's our financial markets it's [10:21] anything that's critical and essential [10:23] to who we are and how we conduct our [10:24] lives together but we're in such a funny [10:27] time because what is life in society [10:30] critical has really [10:31] blurred the way we use computers has [10:34] really changed and I think this is not a [10:36] news flash to anybody in this room about [10:38] 10 years ago we were the ones who were [10:39] using computers and we were helping our [10:41] our relatives to to kind of you know use [10:43] it just you know use it to to we process [10:45] and things like that but now everybody [10:48] in their mother father brother great [10:50] uncle are all using software for [10:53] everything for every part of their daily [10:54] lives they expect it they expect to use [10:56] it for all sorts of things it's about [10:58] how they communicate with each other how [11:00] we create it's basically we use it for [11:02] every part of our lives and people who [11:05] had been uncertain with computers merely [11:07] five years ago now are on Facebook all [11:09] the time they're using their smartphones [11:11] it's just a part of their lives and [11:13] their expectations about what they use [11:16] about it have changed they expect to be [11:18] able to use things right away or it's [11:20] broken it's not good if you can't use it [11:23] right away if it's not simple if it's [11:24] not clear if it's not easy to use it's [11:26] it's a real [11:27] problem which brings me to the desktop [11:30] so about a month ago as I said I left [11:32] the software Freedom Law Center and I [11:34] became executive director of The Gnome [11:38] Foundation um which was a a really [11:40] interesting change for me but I came [11:42] right after gnome 3 was released and [11:44] isn't it [11:45] pretty I mean it's so pretty I showed [11:49] this to my [11:50] mother and she said oh when did when did [11:54] Apple have a [11:55] redesign it's you know and I told her of [11:58] course that it's far better it's magical [12:00] it's [12:01] revolutionary um but [12:04] uh um and it's [12:06] free so um you know I I I I basically [12:09] showed this to her and she said this is [12:10] something that I can use and basically [12:12] what the gome team did was they they [12:14] gave the desktop a complete rethink and [12:16] they focused on what ordinary users need [12:20] how they use their computers you know [12:21] what what they're going to use it for [12:23] and they dispensed with a lot of things [12:25] that were built in for you know maybe [12:27] for People Like Us sometimes but so that [12:30] everybody can use it because you know [12:31] what everybody has to use it we use [12:34] software for everything we use it to [12:36] call cabs we're using it to monitor our [12:39] diets you know um what astounds me is [12:42] that um people are using um software on [12:44] their phones to monitor their diets and [12:46] their exercise and um there's now [12:48] software that can interact with [12:50] implanted insulin pumps so that you can [12:52] monitor your blood sugar astounding [12:54] stuff but you see where I'm going it all [12:56] comes back to my heart it's all about [12:58] the same thing where we use society and [13:01] life critical software is now everywhere [13:04] we don't know what is going to be [13:06] important we don't know what our lives [13:07] are going to depend on so we need to [13:09] choose free and open platforms we need [13:11] to choose freedom because I don't want [13:13] to rely on one company for any part of [13:15] my life I don't want to rely on metronic [13:18] for my heart and I don't want to rely on [13:20] any other company for any other thing I [13:22] want everybody to be able to see the [13:24] source code and I especially want to see [13:26] the source [13:27] code um so [13:32] we're at a cross at a Crossroads and [13:35] it's it's time to change and I think [13:40] seeing all the Macs in the room when you [13:43] close them and go to your next session [13:44] just think about what kind of software [13:46] you want for your families and for your [13:48] children think about how we want our [13:50] lives to be run and let's start building [13:53] on only free and open source software [13:55] and open platforms let's just make sure [13:57] that all of the software that we use is [14:00] free and open so that we're not in a [14:01] situation where we're relying on [14:03] proprietary software closed source code [14:05] for things that we count on for our [14:07] lives so use gome [14:11] 3 donate to nonprofits because they're a [14:14] heart of free and opener software become [14:16] a friend of gnome and thank you very [14:19] much [14:20] [Applause]