My name is Johannes Roos, we have a company in Luxembourg and in Trier, called Tuom.
We have been dealing with software development and IT security for many years.
I myself have been working in IT for 35 years, started programming with Pascal under Apple 2, got to know mainframes,
worked in the area of AI, a topic that had a hype back then – and now again.
We didnʼt have that much data back then, which is a shame.
In the area of IT security we made the first hacks in 2000, nobody was interested in that at the time.
The sensitivity to hacker attacks has now come thanks to Snowden and the others.
For two or three years, expertise in the field has finally been in demand, I waited 30 years, it took some time.
We also use our expertise in software development.
We are currently developing implants that can be controlled via the cloud.
This is where questions arise such as “what could happen if someone remotely accessed this data
and possibly kills somebody?”, which would be quite possible.
“How do I keep security under control
and how do I manage to protect that data that exists there?”
The cloud is always something that means a lot of danger for many people. That's because they just donʼt know how to handle data
and our experience in this area is that you can back up data in the cloud very well by encrypting it.
AES encryption is still the safest way to protect data today,
so we started thinking about how to set up a secure system relatively early in the whole model.
First of all we thought about it, we asked “what are the problems?”.
On the one there is the typical theme “Security by Design”, how can I build a software and database architecture that is secure?
For us, this means that we not only encrypt the data, but also the implants.
So we encrypted the entire path from the implant to the cloud; an end-to-end encryption.
The whole thing is very complex, because there is this problem that many already know:
Encrypting things in an active implant costs energy.
This energy needs to be covered, and if you have to change an implant every few months because the battery is dead, that's obviously a problem.
That's where the new cloud infrastructure comes in, because we no longer map the essentials in the implant, but simulate them in the cloud.
In other words, we no longer need the energy needed today, we only need very little energy,
because most of the information and algorithms that are still present in the implant today are no longer needed.
We have pure encryption algorithms, we have some intelligent storage and everything else is simulated in the cloud.
On the subject of “Privacy by Design”, we thought about how we can realize data protection relatively early.
The problem with data protection is that many donʼt even know what it's about.
Data protection for me means: I have to have the right of my data. I have to decide what happens to my data.
This is also stated in the new EU General Data Protection Regulation. The second important thing for me is: what happens to my data, is it protected?
Who can access it? We have developed models that make encryption dependent on the person and the role behind it,
in that only the patient and the appropriate physician have access to it and the data is stored in encrypted form.
Not in the form that we encrypt an entire database, and the keys of the database are on the servers, which is too uncertain,
but the encryption takes place in advance, i.e., the data is already encrypted.
These are models that we implement.
The problem with data protection is when we talk about pseudonymisation or similar. Which we would like to,
but our main problem is the contradiction between usability and security and privacy by design.
We could, of course, anonymize all the data in the cloud, you just have a pump number or implant number or a number from any other device
that identifies, thatʼs it.
But at the doctor's we have the problem that he then has to sift through, program and change this implant from the cloud, or read specific information from it.
It would take a lot of work to bring this information back together. There lies the discrepancy.
Securitywise, we can map everything much easier. Privacy by design is not a problem, but is there still usability?
I do not see privacy as the big issue in data protection, as long as you make sure that I decide what happens to my data.
But if I am sick and I want the doctor or nurse to help me, then my interest is justified if I want them to access it.
“Privacy is about protecting people from having their data read” - no. I want to have self-determination rights.
This right to self-determination is very important in data protection and this is also part of the new EU Data Protection Regulation, which is also explicitly stated in the law.
I think we have to point that out again and again.
When it comes to security, one has to weigh up. Certain foresight measures need to be taken.
Usability is always the problem, but you canʼt say that it could not have been avoided.
If dangers occur, you should set the switch at the latest if you have not done so before. The attacks must also increase IT security.
To introduce such a software or even medical technology, you have to meet the highest standards.
Especially the new EU regulation on “medical device regulation”, which comes into force now, has such high requirements.
One important issue that we are dealing with most of the time is risk analysis. Safety measures arise from a risk analysis and a risk assessment.
From this risk assessment, there are actions that must be taken to ensure safety.
Thereʼs this high level of certification in medical technology.
I can make the greatest products, but I wouldnʼt be able to get them released if I did not meet those requirements.