How to hack your body

Elon Musk has pushed Neuralink, which promises to help the paralyzed walk and the deaf to hear with a few well-placed brain chips. We are constantly being told that in the future, human augmentation will be ubiquitous and herald an age of human cyborgs with superhero-like abilities. However, from vulnerabilities to hacking to deep moral questions, it appears the elites haven’t entirely thought through this transition.

Nowhere on the internet is safe, yet the internet keeps on growing. First it was bulky mainframes, then personal computers. We added smartphones in everybody’s pockets, and shortly after, our doorbells and fridges were connected. With little concern, water treatment facilities, manufacturing plants, and energy grids were hooked up. Soon we may find ourselves linked up to the network of networks, with nothing but a microsecond between our minds. Before we fully integrate everything and everyone on Earth into the battlefield of cyberspace, perhaps we should think a little about the consequences for us as individuals and as a collective.

Before the World Wide Web was formed, there was the worm. The first of its kind, the Morris worm was able to spread throughout the nascent internet with no need for user interaction. Ten percent of all the computers connected to the internet in 1988 were infected within 24 hours.

The internet, called ARPANET at the time, was initially formed in October 1969 with a connection created from the University of California Los Angeles to the Stanford Research Institute. Much like its modern-day users, its creators could not imagine the fallout of connecting to it.

Due to their ignorance of their creation's impending spread and popularity, the early internet pioneers did not properly consider the necessity of security. An MIT scientist named David Clark, who was around when the Morris worm was working its way through every node it could find, puts it this way: “It’s not that we didn’t think about security. We knew that there were untrustworthy people out there, and we thought we could exclude them.”

This constrained thinking led to a need for more built-in security controls. Paul Vixie, another early internet pioneer, laments the lack of security in early development, saying, “Every app we built for the internet was designed as if it was for a boy in a plastic bubble, a completely clean environment with nothing malicious. … No one ever thought someone would want to lie in the 'from' field of an email or send email the recipient wouldn't want.”

The Morris worm would go on to cause millions of dollars in damage. More importantly, it acts as a demarcation point in internet history. The internet was always insecure, but this event proved it beyond a doubt. However, this attitude is not widely shared among digitally enabled populations. Perhaps it is because of historical ignorance of the internet’s development or a belief that the cybersecurity industry keeps everybody safe. Could it be an insatiable desire for progress, optimization, and digitization? Whatever the reason, humanity is going headfirst, quite literally, into a potential disaster.

Internet of bodies

The Internet of Things is a descriptor for many web-connected physical devices, often not considered computing machines. Think of the smart speaker in your living room, the fridge that displays the daily news, or the doorbell camera you use to monitor the front yard. This world is far larger than most people suspect. That tractor out in the middle of the cornfield busy harvesting is most likely an IoT device. All modern cars now can connect online. Even the clothes you wear will soon be receiving packets.

The Internet of Bodies is a derivative of the Internet of Things focusing on the devices that deal with the human body. The most accessible and visible of this subset is the smartwatch. Smartwatches are not invasive but still produce biometric data susceptible to compromise. Similar devices such as hearing aids and smart glasses (e.g., Google Glass) fall into this category.

Then there is the group of IoB devices that are physically implanted into the body. These are much more complicated, both in design and implication. Heart implants enabled with a network connection will allow for quicker data transfers from patients being monitored for cardiovascular risks. Artificial pancreas systems will be better suited to deliver insulin. Even artificial limbs will see benefits through better movement and performance.

Now you arrive at the cutting edge of the IoB: brain implants. The most well-known example would be Elon Musk’s Neuralink. In this space, the goal is no longer to simply improve the functionality of a “dumb” device through silicon and wireless connectivity. Instead, it is establishing the “brain-computer interface to let you control a computer or mobile device anywhere you go.” On its site, Neuralink acknowledges that after helping those with paralysis, the company will focus on “[expanding] how we interact with each other and experience the world around us.”

Neuralink promises to revolutionize the relationship between man and computer. It would allow us to interact with computational power at the speed of thought and open up unimaginable avenues for human-technology cooperation. This evolution would transform the productivity, usability, and potential of computers under human control.

The IoT is spreading primarily due to the convenience it provides. The IoB is initially being developed to alleviate medical issues and help improve health outcomes. However, the potential benefits of having a direct link to computational power through biological signals will transform the mission, and the desire to integrate IoB devices onto and into our bodies will only grow. The same is true for the issues arising from this symbiotic relationship.

I am vulnerable, so I am unable to scream

If it is on the net, it will be compromised. It could be hard to believe such a maxim if you are a casual internet user. Everything seems to be working when you use it, and you do not see vulnerabilities in your devices or active compromise of your data. However, this view is naïve and does not consider the innumerable hours spent by humans and machines to hack into anything that is exposed, undefended, or forgotten. Not to mention, the internet and its protocols are woefully insecure and have been under attack since its inception. Remember the Morris worm?

This reality has heavily impacted the thinking of information security professionals working daily to protect their digital assets. If the people spending billions of dollars on cybersecurity are paying attention to something, you probably should be as well. Increasingly, the private sector is using a framework called Zero Trust. This way of approaching cybersecurity relies on three principles that guide the resulting actions, and each principle is centered on the idea that no device or connection can be trusted. Assuming a breach helps professionals to realize that their network perimeter is not the impenetrable castle wall keeping out intruders. They are already in.

This principle should pause the idea that humanity can simply connect to the internet and progress toward some singularity. The internet is inherently a dangerous place. Putting the physical body and the mind into this buzz saw, without some cybersecurity deus ex machina, is asking for the worst-case scenario. Sadly, the same approach has been reliably taken for years: Connect first, ask security questions later. Would you be comfortable assuming breach as you should, putting your brain on the line?

There is already clear evidence that the IoB is vulnerable and will put people at risk. Back in 2019, the Cybersecurity and Infrastructure Security Agency put out a warning for vulnerable heart defibrillators. The protocol used to communicate with the devices did not even authenticate connections, allowing an attacker within a 20-foot radius to change the device's configuration. In 2018, vulnerabilities in popular insulin pumps allowed attackers to administer a deadly dosage level remotely. The researchers who exposed the vulnerabilities had to go so far as to make a proof-of-concept application that could kill before the insulin pump maker would offer to replace the faulty devices.

You cannot trust manufacturers to develop their products securely; no cybersecurity solution is 100% effective at stopping threats. Costs like these are acceptable for food ordering apps or light bulbs you control from your phone, but are they adequate for our organs? If neural implants and other IoB devices are vulnerable to hacking and other cybersecurity threats, the result will be unauthorized individuals accessing, controlling, or manipulating the devices, potentially causing physical or psychological harm to the user.

Thorns of progress

The cybersecurity risks of augmenting our bodies into the internet are numerous, but they are not the only ones. With any technological advancement, the wealthy reap the immediate benefits before innovation allows for general availability. If brain implants are only available to those already well ahead, could there be an increase in the already widening divide between the top of society and the rest? Humanity has seen firsthand, particularly the youngest generations, the debilitating effects of digital immersion. Removing the final barrier, that of the physical bounds, brings us closer to the brink of losing our humanity. Is it worth losing our essential nature to gain more interconnection that seems to be leaving us ultimately disconnected?

There are also threats to the actual brain matter that must be considered. Implanting a device requires surgery, which carries risks of infection and inflammation. Proper surgical technique and postoperative care can help mitigate these risks, but they cannot be eliminated entirely. The physical presence of an implant can cause damage to the surrounding tissue, either due to the initial surgical procedure or the long-term pressure exerted by the device. This could lead to neurological deficits, such as loss of function or cognitive impairment.

Developers are not infallible, and bugs are often left in code that reaches production. What happens when IoB devices encounter software or hardware glitches? Depending on the implant's function, this could result in loss of intended benefits or even potentially harmful consequences, such as unintended stimulation of brain regions, that result in permanent brain damage, organ failure, or worse.

Neural implants could collect sensitive data about an individual's thoughts, emotions, or experiences, raising significant privacy concerns. Unscrupulous actors could exploit this information for financial gain, blackmail, or other nefarious purposes. Given the recent cultural emphasis on policing opinions, the current government could easily decide that this data could be used to convict people for thought crimes.

The long-term effects of neural implants on brain function are not yet fully understood and won’t be for some time. There may be unforeseen consequences or complications that arise from chronic use of these devices, which could affect an individual's cognitive abilities or overall health. Some users may become dependent on their neural implants for essential functions or cognitive enhancement. This could create a vulnerability should the device fail or become inaccessible, and it also raises questions about an individual's autonomy and self-sufficiency.

The internet has allowed humanity to flourish in ways previously unthinkable. Everything from commerce to information-sharing has seen meteoric progress. However, the internet is insecure and always will be. The desire to connect every conceivable product and device results in unparalleled growth but also systemic insecurity. At the current trajectory, nothing will be left that is not hackable, not even us. Are we willing to accept the risks to body, privacy, and our own cybersecurity that come with such a future? Perhaps we may stop at some point down the line and re-evaluate. Until then, you better start researching a good antivirus for your brain.