title: Brainjacking: Implant Security Issues in Invasive Neuromodulation.
abstract: The security of medical devices is critical to good patient care, especially when the devices are implanted. In light of recent developments in information security, there is reason to be concerned that medical implants are vulnerable to attack. The ability of attackers to exert malicious control over brain implants ("brainjacking") has unique challenges that we address in this review, with particular focus on deep brain stimulation implants. To illustrate the potential severity of this risk, we identify several mechanisms through which attackers could manipulate patients if unauthorized access to an implant can be achieved. These include blind attacks in which the attacker requires no patient-specific knowledge and targeted attacks that require patient-specific information. Blind attacks include cessation of stimulation, draining implant batteries, inducing tissue damage, and information theft. Targeted attacks include impairment of motor function, alteration of impulse control, modification of emotions or affect, induction of pain, and modulation of the reward system. We also discuss the limitations inherent in designing implants and the trade-offs that must be made to balance device security with battery life and practicality. We conclude that researchers, clinicians, manufacturers, and regulatory bodies should cooperate to minimize the risk posed by brainjacking.
authors.affiliation: Oxford Functional Neurosurgery, University of Oxford, John Radcliffe Hospital, Headington, Oxford, United Kingdom. Electronic address: laurie.pycroft@nds.ox.ac.uk.
authors.forename: Laurie
authors.initials: L
authors.lastname: Pycroft
authors.affiliation: Oxford Functional Neurosurgery, University of Oxford, John Radcliffe Hospital, Headington, Oxford, United Kingdom.
authors.forename: Sandra G
authors.initials: SG
authors.lastname: Boccard
authors.affiliation: Department of Applied Health and Professional Development, Oxford Brookes University, Headington Campus, Oxford, United Kingdom.
authors.forename: Sarah L F
authors.initials: SLF
authors.lastname: Owen
authors.affiliation: Department of Physiology, Anatomy, and Genetics, Sherrington Road, Oxford, United Kingdom.
authors.forename: John F
authors.initials: JF
authors.lastname: Stein
authors.affiliation: Oxford Functional Neurosurgery, University of Oxford, John Radcliffe Hospital, Headington, Oxford, United Kingdom.
authors.forename: James J
authors.initials: JJ
authors.lastname: Fitzgerald
authors.affiliation: Oxford Functional Neurosurgery, University of Oxford, John Radcliffe Hospital, Headington, Oxford, United Kingdom.
authors.forename: Alexander L
authors.initials: AL
authors.lastname: Green
authors.affiliation: Oxford Functional Neurosurgery, University of Oxford, John Radcliffe Hospital, Headington, Oxford, United Kingdom.
authors.forename: Tipu Z
authors.initials: TZ
authors.lastname: Aziz
mesh_terms: D001930:Brain Injuries / Q000209:etiology* / Q000517:prevention & control; D016494:Computer Security; D046690:Deep Brain Stimulation / Q000009:adverse effects* / Q000295:instrumentation*; D004868:Equipment Failure; D004869:Equipment Safety / Q000295:instrumentation* / Q000379:methods*; D006801:Humans; D061214:Patient Safety; D019736:Prostheses and Implants / Q000009:adverse effects*
keywords: Brainjacking; Cybersecurity; Deep brain stimulation; Hacking; Implantable medical device; Implantable pulse generator; Medical device security; Neurosecurity; Neurosurgery