A modern pacemaker runs firmware. So does a cochlear implant, a deep brain stimulator, an insulin pump and a continuous glucose monitor. They have update mechanisms, radio interfaces, signing keys and a vendor with a roadmap.
This trade has thirty years of accumulated practice for running computers: patch promptly, test the rollback, keep a maintenance window, replace the hardware every few years. Work through that list for a device sutured to somebody's heart and all four assumptions fail at once.
Where the model breaks¶
There is no maintenance window. The device is doing its job continuously, and its job is keeping somebody alive. A firmware update to a pacemaker is performed with a clinician present, with a plan for what happens if the device does not come back. In 2017 a manufacturer recalled roughly half a million implanted pacemakers for a firmware fix, which was administered at a clinic, one patient at a time. There is no fleet-wide push.
Rollback is theoretical. The entire discipline assumes you can return to a known-good state. If a cardiac device misbehaves after an update, the recovery procedure may be a surgical one. Ship an update you cannot withdraw and the blast radius is measured in people.
End-of-life is not a date you choose. Implants last ten to twenty years. Vendors do not. A company that is acquired, pivots or folds leaves devices running in bodies long after the last engineer who understood them has gone. The retina implants whose manufacturer discontinued support are the case everyone cites, and they will not be the last, because the economics are structural rather than accidental.
The threat model includes the patient. People have asked for the data their own implant produces and been refused. Researchers have been threatened for analysing device firmware. The security model is written around a patient who is a potential adversary, which is a strange thing to discover about the computer in your chest.
What it costs¶
Precision, which is the expensive part. The failure mode of a sloppy embedded system is a reboot; here it is a person. That justifies the regulatory burden, the long certification cycles and the conservative engineering. Anyone arguing for faster updates in this domain should have to explain what they would do about the first fatality.
The real cost is the one that falls out of that caution: devices stay vulnerable for years because the process to fix them safely is slow. That is the correct trade, made in the only sane direction. It is also the reason the ownership question below matters more here than anywhere else in this notebook.
What it makes possible¶
Set the problems aside for a moment, because the capability is extraordinary and increasing.
A cochlear implant turns profound deafness into usable hearing. A deep brain stimulator stops a tremor that no drug touches. A closed-loop insulin system does continuously what a person with type 1 diabetes otherwise does by hand a dozen times a day, every day. These are not augmentations of healthy people; they are repairs, and the repairs work.
The direction of travel is towards more of them, with more compute inside them, doing more inference locally. A closed-loop system has to decide without a network, because the network is not there when you are asleep in a field, and the only sensible place for that model is on the device. Which means implanted devices become edge inference nodes, with every property of local inference, good and bad, applying to hardware that is inside a person.
Further out, the interesting line is bidirectional interfaces: devices that read neural signals rather than only stimulating. Restoring movement after spinal injury, restoring speech after a stroke. The engineering is early and the experimental results are real. Within a decade or two this is a field with working products rather than demonstrations.
And then the obvious thing happens, which is that people who are not ill want them. The boundary between repairing a deficit and exceeding a baseline is a social one, not a technical one, and it will be argued about by people with no engineering stake in it. What this lab can say is narrow: the engineering does not distinguish. A device that restores hearing and a device that extends it are the same device with different parameters.
Who holds the key to the thing inside you¶
This is where it gets uncomfortable, and it is the sharpest version of an argument made repeatedly here about signing keys.
An implanted device will only accept firmware signed by its manufacturer. That is correct engineering: the alternative is a device that accepts firmware from anybody, which is indefensible. But it means the manufacturer holds the sole authority over a computer inside a person's body, for the life of the device, which may be longer than the life of the company. The patient owns the object and cannot read its code, cannot audit its behaviour, cannot fix it and cannot authorise anybody else to.
The data position is similar. Telemetry flows to the vendor. Patients have had to fight for access to their own cardiac records. Meanwhile the data has obvious commercial value, obvious insurance value and obvious value to a court. An implant is a witness that never stops recording, and the legal process for compelling that record is being established case by case, mostly without the people wearing the devices in the room.
There is no clean answer and we are not going to pretend otherwise. Patients cannot audit firmware. Mandated escrow has its own failure modes. What is achievable and not yet normal: a legal right to your own device's data in a documented format; an obligation on manufacturers to deposit documentation and keys so that a discontinued device can be maintained by somebody else; independent security research protected rather than prosecuted; and a published support horizon, so a patient knows at implantation when the computer in their chest stops being maintained.
Here at AxisOps we build infrastructure people can own, inspect and rebuild, and we think that argument does not weaken as the hardware gets closer to the body. It gets more urgent. The most important computer a person will ever depend on may be one they cannot switch off, and the current answer to who controls it is a company.
The question we cannot answer¶
Whether any of this is fixable through procurement and regulation, or whether the safety case requires a single controlling vendor. We suspect the first and cannot rule out the second, and the people best placed to settle it are the ones with the commercial interest in the answer.