The Ventilator Won’t Accept the Part Until It’s Blessed

The ventilator won’t accept the part until it’s blessed

Meet Medtronic, the company that pretends to be Irish. It’s the world’s largest medical-technology company, having bought up nearly all of its competitors and then pulled off the largest tax inversion in history — selling itself to an Irish firm so its profits could sit in a state of untaxable grace somewhere over the Irish Sea. It makes the world’s most widely used ventilators. And it booby traps them the exact same way John Deere booby traps its tractors.

Here’s the racket. After a hospital’s own technician puts a new part into a Medtronic ventilator, the ventilator’s central computing unit will not recognize the part — until it completes a cryptographic handshake proving that an authorized Medtronic technician was paid hundreds of euros to carry out a repair that the hospital’s own tech almost certainly already performed. It’s a toll booth, bolted to the inside of a breathing machine, and the toll is hundreds of euros every time the machine breaks.

When the planes stopped flying, the toll booth stayed

Now, that would be bad enough on a good day. But during the COVID lockdowns, when every ventilator was desperately needed and the planes weren’t flying, there was no way for Medtronic technicians to come and bless the hospital technicians’ repairs. Ventilators sat unrepaired while hospitals begged manufacturers for the software keys and service codes that only authorized technicians were supposed to hold. It was lethal. It killed people.

The independent repair community had to hack around it. Repair technicians resorted to homemade dongles smuggled out of Poland — little circuit boards that spoof the cryptographic handshake so a refurbisher can sync a secondhand monitor to a working breathing unit. One refurbisher used such a dongle to fix at least 70 Puritan Bennett ventilators he sold to hospitals and governments to handle the COVID surge. The dongle exists only because Medtronic’s own service tool is kept out of the hands of everyone who isn’t paying the toll.

Why the lock is lethal

This is where anti-circumvention law does its deadly work. The ventilator is a machine whose software is legally locked shut. Reverse engineering it — or building a tool to get past its handshake — can be treated as a crime. So the manufacturer gets to decide who repairs the machines, at what price, and on what timeline, while the people who actually own the machines and the patients who need them have no legal way to force the issue.

It’s not “smart for me, it’s smart for the manufacturer,” a repair technician told VICE — “because you spend this enormous amount of money [to repair them].”

Medtronic would rather a ventilator sit dead, or make you pay hundreds of euros for a technician to click “yes” on a laptop, than let a trained hospital tech do the same job for free. In a pandemic, that’s not a business model. It’s a body count.

The fix is right-to-repair for machines that keep people alive

When the thing you’re ransoming is a car stereo, it’s an annoyance. When it’s a ventilator, it’s murder. Medical devices should be the absolute last category on Earth to carry repair DRM — and instead they’re among the worst offenders. The fix is a legal right to repair, real parts and service data for hospitals and independent biomed techs, and a rule that says no one should need a manufacturer’s blessing to keep a breathing machine working.

Watch: Cory Doctorow, The Post-American Internet, 39C3