Doing Harm (34 page)

I sit at Mrs. Samuelson’s bedside, sifting through my thoughts, while Shania gyrates through her usual routines in the room next door. I’m not so sure about the insulin-pump approach anymore. The more I’ve delved into it, the more I’ve realized how many different variables and details are involved with trying to surreptitiously access the programming of an insulin pump. There are
so
many, in fact, that I’m beginning to doubt even GG could pull it off. But I still think medical devices are her most likely approach.

I sigh and watch Mrs. Samuelson’s digital EKG tracing on her heart monitor. Her heart was damaged when she bled in the operating room but, like the rest of her body, has been recovering nicely.

The heart. The engine of the circulatory system. Poets and writers have spent generations plumbing its metaphorical complexity. But when you get down to it, it’s really just a hollow sack of muscle and nerves; the fleshy, fragile motor that drives blood through the human body.

My gaze drifts over the electrodes connecting Mrs. Samuelson to the cardiac monitor, and I think of all the things doctors use to keep sick hearts beating properly: EKGs and powerful medications and high-tech electronic devices. My mind wanders idly over GG’s heart research, and the medical-journal article she was carrying—

I grip the arms of my chair.

An engineering degree from MIT.

Research in a heart laboratory.

A medical journal focused on the safety of implantable heart devices.

Of course.

It was there in front of my face the entire time.

I race back to the office, jump in front of the computer, close my eyes for a moment, and take a deep breath, my hands poised over the keyboard.

And then I go.

God, it feels good. It’s as if the keyboard is an extension of my fingers, and my fingers are directly fused to my brain. I’m at the peak of my form, like when I was in college wired on caffeine and the inexhaustible energy of youth, oblivious to all but the images floating in the soft glow of the screen, drowning gloriously in the digital ether as I dig up everything I can on ICDs: documents from the National Library of Medicine, Google Scholar, medical-device manufacturers, the FDA, even the same issue of the medical journal I saw in GG’s hand.

The data that stream in front of me over the course of the afternoon leave little doubt in my mind that tampering with an ICD would be straightforward, difficult to trace, and deadly—just like the potassium overdose. The latest ICD models are sophisticated minicomputers with wireless radio receivers to allow cardiologists to download data for testing and recalibration. The software is laughably vulnerable and can be altered with something as simple as a pocket magnet, or even an iPod. A determined individual (or a not-so-determined individual, for that matter) could easily hack an ICD’s programming remotely with a computer.

Why? Because no reasonable ICD manufacturer would build a security system sophisticated enough to protect it from attack against someone like GG. Their threat models never anticipated someone like her. Who could imagine that someone would be disturbed enough to deliberately mess with a piece of medical machinery buried deep in the heart muscle of another human being? Besides, encryptions are expensive, and continuously running them would eat up precious battery life on the device.

So, instead of sophisticated encryption algorithms, the security of any given ICD radio signal depends upon two key, easily surmountable elements. First, like any consumer-electronic device, each ICD has a unique serial number, and each command to any given ICD needs to be prefaced by its serial number. But serial numbers are not kept secret and can be readily obtained from the patient’s medical chart. Second, ICDs have very limited radio range, and inputting remote radio commands requires relatively close physical proximity to the patient—within a several-foot radius.

So, given that an ICD can easily be hacked by any individual with access to the medical chart and the opportunity to be close enough to the patient to input commands, the next issue is: what to tell an ICD to do after gaining access to its software system? One approach is to simply switch it off. But there’s no guarantee that the patient will die once the ICD is turned off because the patient’s heart would then have to spontaneously enter into what’s called an arrhythmia—an abnormal heartbeat—in order for him or her to suffer immediate and irreparable harm.

Which leads me to an equally simple, but much more lethal, command.

Tell the ICD to shock the patient.

Cardiologists shock patients all the time under controlled conditions, remotely dumping up to 700 volts of juice directly into the heart via the ICD. The jolt is enough to induce arrhythmias, including something called ventricular fibrillation, or v-fib for short. V-fib is a condition in which the heart starts quivering ineffectually and can no longer pump blood to the rest of the body. Without treatment, it’s fatal within minutes.

In some patients, cardiologists deliberately induce v-fib to make sure the ICD is working properly: If the ICD is working, it immediately senses the v-fib and shocks the heart back into a normal rhythm. If the ICD isn’t working—doesn’t detect the v-fib and/or deliver the second shock to stop it—the cardiologist steps in and immediately corrects the situation.

With the proper series of commands, a hacker could simultaneously induce v-fib and switch off the ICD’s ability to stop it. And with something relatively straightforward called a buffer-overflow attack, a hacker could gain deep-level access to the system in order to erase and reset the software logs. If it was done at night, to a sleeping and otherwise stable patient, during a work shift when up to four hours can elapse between nursing checks, a patient could be dead for hours before anyone realized it. There’s even a chance that the initial shock would induce an immediate cardiac arrest. In either case, an autopsy would later show that the patient had died of a cardiac arrest caused by a malfunctioning ICD.

Brilliant.

I have the how. Now all I need is who. Who is she going to attack?

I lean back in my chair, massage the back of my neck with fingers numbed by thousands of keystrokes, and, glancing out the window, realize with a start that it’s dark outside. I try to puzzle out the next logical step, to start picking out a likely victim, but I hit a mental wall. My brain has been on afterburner for hours. I’m starting to come down from my high and feel my ripe old age of thirty-two. I decide to call it a night. Tomorrow, I can compare notes with Luis, and we can start identifying potential victims together.

*   *   *

Sally is up waiting for me when I get home, sitting on the couch in the living room. The house is quiet. She sets aside the book she had been reading and crosses her arms as I come in and wordlessly take a seat on the opposite end of the couch. She seems … small, somehow. Deflated. Resigned.

We sit there without saying anything, the two of us, separated by the space on the couch.

“Is this how it starts?” she asks calmly after several minutes.

“How what starts?”

“You know. Divorce. Do you think this is how it starts? Or at least, how it starts for us?”

Wow.
I wasn’t expecting this.

“You mean … you want to get a divorce?”

“No, Steve … Jesus, for such a smart guy, you can be so goddamn literal sometimes. No, I don’t want a divorce.” She grabs a throw pillow and hugs it tightly to her chest. “At least, not yet.”

She turns to face me.

“Are you screwing around?” she asks. “Is that what this is about? All the nights and weekends at the hospital, the sudden and complete lack of interest in me or the kids, coming home at all hours with alcohol on your breath, mysterious research projects … If you’re screwing around, just tell me now, and we’ll go on from there, okay? I’m not stupid, Steve. I know what goes on there. In the hospital. In those call rooms.”

I wasn’t expecting this, either. “No, I’m not screwing around.” I’m careful to use the present tense, which means that I’m not lying. Technically.

“I don’t believe you.”

“Really, Sally. I’m not screwing around. Do I look like the kind of guy who can score a little action in the hospital whenever he wants to?”

The levity gambit doesn’t work. In fact, it only makes her angry. “Don’t do that, Steve,” she fumes, drawing herself up and throwing the pillow aside. “Not now. Don’t joke around. This is serious. If you’re screwing around, I want to know. Right now.”

“Sally. I’m not screwing around.”

She purses her lips and shakes her head.

“Honest to God, Sally! I’m not.”

“I don’t believe you.” She gets off the couch, walks over to the window, and gazes out into the front yard. Sally has never been very emotional. Instead, when she gets upset, her voice and demeanor assume a flat, calm quality. I think it’s how she’s able to really hold it together in a crisis.

You’d never know it now, but Katie was born almost two months premature, with severely underdeveloped lungs that weren’t yet equipped for breathing on their own. She almost died. It was that bad.

Sitting next to her incubator in the Neonatal Intensive Care Unit, wearing the bright yellow smock all the parents had to wear, I was an emotional wreck, weak and scared and numb: ironically enough, completely incapable of any coherent interactions with Katie’s doctors. But not Sally. Sally was the one who calmly listened to the neonatologists recite grim survival statistics as our newborn daughter walked the razor’s edge between life and death for days. Sally was the one who prepared for the worst and made all of the decisions. She never lost it, not once—something which, as a surgeon, I’ve always respected the hell out of her for.

Luis told me last night that I’m a lot tougher than I look. Well, at five-foot-one and one hundred pounds, Sally’s a lot tougher than
she
looks.

Anyway, the more upset Sally gets, the calmer she sounds. And right now, she sounds very, very calm. “I’m sorry. But I don’t believe you.”

“I don’t know what else to say, Sally.”

“Tell me what’s bothering you, then. Tell me where you’ve been spending all of your time.”

“I’ve already told you. In the hospital.”

“But why?”

“I told you that, too. Doing research.”

“We’ve got to fix this, Steve.” She turns around and spreads her arms. “Before the baby comes, and I go back to work.”

I frown, and say, “Are you sure you really want to go back to work? Now?”

She walks back to the couch and sits down next to me. “Is
that
what this is all about? My going back to work? I thought you said it didn’t bother you.”

“I don’t know,” I say, shrugging. “Maybe.”

“Nancy told me this might be a problem,” she says, sighing. “Dan has issues with her working, too. Even with the nanny.”

Her again.
“Nancy?” I growl.

“We’ve spent a lot of time together the past few weeks.”

“And because of that I’m supposed to take advice from her about my personal life?”

She draws her mouth into a tight line. “If you hadn’t noticed, you haven’t had much of a personal life lately.”

“Yeah, well,” I say grouchily, “if you’d like to know about screwing around, talk to Dan.”

“What do you mean?”

“He’s been banging every nurse in the hospital. I know. I saw him one night.”

She blanches. “I don’t believe you.”

“It’s true.”

“Okay, fine. But even if it is, what does that have to do with us?”

“I don’t like your talking to Nancy about our personal life.”

“I don’t care. And it’s not like you have any say in the matter.”

“I have plenty of say. It’s my life, too.”

“I have to talk to somebody. At least, somebody who can carry on a conversation about something more sophisticated than Elmo. And you haven’t been around.” She sighs, exasperated. “Look. Whether you like it or not, I’m going back to work. Andrea, at University, has officially offered me the job. And I’m going to take it. We’re going out to dinner in the city a week from next Thursday to hammer out the details.” She reaches over and takes my hand. “Please. It’s something I
need
to do, Steve. I’ve wanted this for a long time. Nancy only helped me realize that. But I can’t do this without your help. It’s not going to be easy. For either one of us.”

“I know. I just—I need to get used to the idea.” I squeeze her hand.

She studies my face. “You’ve really just been doing research? At University?”

“Yes,” I say. It’s true, at least lately, so I have no trouble looking her straight in the eye. “Really.”

“Okay. Is it going to last much longer?”

“No. I don’t think so.”

“Good.” She kisses me on the cheek. “Enough said, then.” She stands up and yawns. “I want to get off to an early start tomorrow, so I’m heading to bed. Have you eaten?” I shake my head. The mention of food makes my stomach growl. She hears it and grins. “Sorry. I didn’t fix you a plate.”

Understandable, given the fact that she was ready to accuse me of adultery the moment I walked in the door tonight. “No problem.”

“There’s a frozen pizza in the freezer.”

“Thanks.”

“I’m guessing you’ll be gone tomorrow morning when I wake up?”

“Tell you what. I’ll go in a little later, so I can help you get the kids ready and load the car up.”

She smiles appreciatively. “Thanks. I’d like that. Turn off the lights when you’re done.” She walks upstairs as I head to the kitchen in search of frozen pizza.

CHAPTER 17

Monday, August 17

I’m walking through the main door of the hospital, eager to talk to Luis. I’m anxious to discuss my ICD idea. Plus, my conversation last night with Sally, and time spent with Katie and Annabelle this morning helping to get them ready for their drive to Providence, have fired me up with new purpose: The sooner I deal with GG, the sooner I can get the rest of my life back in order. Luis’s cell phone is tucked securely in my pocket, and I take it out for perhaps the tenth time that morning to make sure it still has a full charge. I wonder when he’ll call and what he has in mind.