IEEE Technology and Society Magazine - March 2017 - 57

designs and hypothetical design changes. It can be
expected that an embedded power supply for an
implanted medical device would contribute to the E1
value of the implant, but this contribution could be
eliminated if power were obtained from a ubiquitous
source-type, e.g., scavenged radio-frequency energy.

A wearer of an ICD may then be assumed
to face a high probability of death or
severe debility without the implant.

Significance of Contributory Systems
If the medical device's control is Internet-connected,
then the E1 and E2 value increase associated with Internet connectivity contributes to the implanted device
"exposure" - and hence to user vulnerability. If the control of the medical device is not connected or includes a
local isolation, then the exposure value contributed by
the Internet connection can be eliminated. This demonstrates how design decisions can be informed by an
assessment of the "exposure" metric.

Discussion
The analysis of "exposure" considers the number of
weaknesses in a design, and proposes that a measure
derived from design configurations is a valuable measure of the vulnerability that the design incurs for the
user. In a case where malicious threats are possible,
calculating exposure is a more useful approach than
risk analysis. For connected personal devices in particular, use of the metric highlights the importance of
eliminating single points of failure (e.g., by allowing
multiple options for power supply), and of avoiding
the large contributory exposure values associated
with connected systems. The analysis of "exposure"
leads to the identification of practical measures to
decrease vulnerability, and demonstrates the value of
the approach.
Generally, the analysis of "exposure" is derived from
a consideration of the system components that enable
the supply of the final goods and services at defined levels (noting that separate analyses may be required for
different service - levels), and can demonstrate the
effect of specific measures designed to decrease the
end-user's vulnerability. These principles may be applicable to other systems such as sewage disposal and
perishable food. Initiatives to decrease exposure
include availability of alternative means of communication systems, open specifications for intermediate
streams, repurposable, and reconfigurable processes.
Initial review of example systems also indicates that
some sources of exposure, e.g., financial transaction
systems, fuel, power, and sewage systems, affect many

march 2017

∕

services; a reduction in their exposure contribution will
thus be valuable for all affected services.
The definition of an end-user's "exposure" illustrates
quantitatively how a contributory system (connected
system) is almost certain to incur substantial additional
exposure to the end user, and is particularly relevant to
Internet of Things (IoT) devices and implants. The definition of an end user's "exposure" can be applied to any
supplied goods or service, and the analysis will allow
quantitative measures of proposed changes.

References
[1] Therapeutic Goods Administration, "Australian regulatory guidelines for medical devices (ARGMD)," 2001; https://www.tga.gov.au/
publication/australian-regulatory-guidelines-medical-devices-argmd.
[2] R. Mathre, "Medtronic announces FDA approval and launch
of world's first app-based remote monitoring system for pacemakers," Nov. 17, 2015; http://newsroom.medtronic.com/phoenix
.zhtml?c=251324&p=irol-newsArticle&ID=2113144.
[3] I. Eusgeld, C. Nan, and S. Dietz, "System-of-systems approach for
interdependent critical infrastructures," Reliability Engineering
and System Safety, vol. 96, pp. 679-686, 2011.
[4] T. Forester and P. Morrison, "Computer unreliability and social
vulnerability," Futures, vol. 22, pp. 462-474, 1990.
[5] L Robertson, "From societal fragility to sustainable robustness:
Some tentative technology trajectories," Technology in Society,
vol. 32, pp. 342-351, 2010.
[6] "ISO/IEC 31010:2009 - Risk Management - Risk Assessment
Techniques (supporting standard for ISO 31000:2009," Risk management - Principles and guidelines), 2009.
[7] Y. Haimes, Risk Modeling, Assessment, and Management.
Wiley, 2015.
[8] L. Robertson and K. Michael, "Risk, complexity, and sustainability," IEEE Technology & Society Mag., vol. 32, 2013.
[9] Medtronic, Implantable Cardioverter Defibrillators (ICDs), 2016;
http://www.medtronic.com/for-healthcare-professionals/productstherapies/cardiac-rhythm/implantable-cardioverter-defibrillators-icds/.
[10] J.A. Sholder and B.M. Mann, "Programmable automatic implantable cardioverter/defibrillator and pacemaker system," Feb. 5,
1991.
[11] "Programmable automatic implantable cardioverter/defibrillator and pacemaker system. US 4989602," A. Siemens-Pacesetter,
Inc., 1991; http://www.google.com/patents/US4989602.
[12] L. Robertson et al., "Supply system's technology configuration
as a contributor to end-user vulnerability," in Proc. Int. Symp. Technology and Society (ISTAS15), Dublin, Ireland, 2015.

IEEE Technology and Society Magazine

https://www.tga.gov.au/ http://newsroom.medtronic.com/phoenix http://www.medtronic.com/for-healthcare-professionals/products http://www.google.com/patents/US4989602

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2017