Pharma Drones; Veteran Health Records; Light to Voice Hacks (#14)

Hi everyone. Welcome to this week's episode of 16 Minutes. I'm Sonal, and I'm here with the 14th episode of this news podcast where we cover the headlines that A6 and Z-Way— why they're in the news, why they matter from our vantage point in tech. And this week we're quickly covering a variety of topics. First, the news that UPS just delivered medicines via drones for the very first time to homes. Second, the news that Apple opened up health records to veterans. Notably, this was recorded just on the heels of Veterans Day. And finally, the headlines around how all kinds of voice-enabled devices can be manipulated by lasers. Now onto the episode. Before I introduce your ACNC experts, let me first quickly summarize the first news item. So just recently, UPS, a subsidiary of UPS, just completed what it claims is the first for the US drone delivery market, which is that they delivered prescription medicine. So it's the first time prescription medicines have been flown by drone and more significantly directly to residential homes. And they're doing this in partnership with the pharmacy and a logistics company. and the flight was made autonomously, but it was still monitored by remote operator, which I think that's actually a legal FAA thing that you have to do that. But in any case, they did in North Carolina, and one of the things they delivered was prescription drugs to a retirement home. So that's the news. Let me now introduce our A6NZ experts. We have general partner Julie Yu on the A6NZ bio team and Venkat Murtula, also on the bio team on the market development side. You guys break it down for me. Why do we think this news is interesting or not?

Yeah, so the pharmacy-patient relationship is one of the highest volume, highest frequency interactions that patients patients have with the healthcare system. And owning that node therefore means a lot of strategic leverage into other aspects of the healthcare journey that these patients have. And this is certainly one of the areas that we see a ton of innovation. You see lots of startups focusing on everything from the logistics around pharmacy to the last-mile delivery of pharmacy, as well as actually becoming full-stack pharmacies. I think the other piece that's relevant here is, you know, we talk a lot about the unbundling of the hospital, this notion that healthcare is moving outside of the four walls and into sort of non-traditional care settings, including the home.

Yeah, I love that because is when people talk about the mobile revolution, they think about it in terms of the mobile phone, literally as a device. And one of the things I noticed was that one of the big trends in technology is to miniaturize or make things more mobile in general, which then allows you to go away from these sort of centralized, huge institutional entities. So making it mobile is now, to your point about Ambulatory Hospital, taking the drugs to homes. I just want to pause on that because while exciting, that's actually very significant technologically too.

Oh, absolutely. And what it enables really, and why this is exciting for the overall healthcare system, is that medicines and therapeutics are one of the most evidence-based evidence-based things that actually work for patients when you're trying to cure a disease or make people better. And one of the biggest issues around medication is compliance. It's literally, is the patient getting the prescription? Are they going out of their way physically visiting a pharmacy to actually get those drugs?

So the significance is that makes it easier for people to get their drugs.

Exactly.

I also think what's interesting about this, just coming back from a trip from India, I saw an ad for a company called Mediplus, and they said, if you WhatsApp your prescription, literally take a picture of your prescription, we'll deliver it to your doorstep under 24 hours. And what's interesting is North Carolina has been more open. UPS actually partnered partnered with a few other institutions, but actually WakeMed Hospital has done this.

That's in North Carolina.

North Carolina. They've done 1,500 deliveries for blood and urine samples. We have a portfolio company, Zipline, that delivers blood samples in Rwanda. And so what's fascinating is if you follow the regulatory footprint, I think we might more see innovation outside the US faster when it comes to this.

What I love about what you're bringing up is that it brings up a concept that Mark talks about in an op-ed he wrote years ago for Politico about regulatory arbitrage. And if you think about ways for regions to innovate, it is by thinking of where are the opportunities, especially if you have, in the case of North Carolina, you're saying WakeMed, a local university, a network of talent. And then given that, how can I grow an innovation ecosystem and think of the regulatory arbitrage of, well, this is banned in one place, but we can actually open up. So that's interesting you say that that's kind of happening.

It also, to me, seems antiquated for these brick-and-mortar companies to come up with these new ways. This is why it's really exciting when we look at these new generation companies, not thinking brick-and-mortar first, but thinking mobile first and thinking about a light footprint and digital first. Yeah, distributed.

That's what excites me.

Honestly, from where I'm sitting, That sounds like Silicon Valley hype. Why is it better? Like, what about this native technology approach is valuable?

I think it's valuable for the areas of pharmacy that are more conducive to being delivered in this fashion. It's going to be pills, right? So small molecule drugs, which make up the vast majority of therapeutics that we use in this world. And those are the things that tend to be cheaper. They tend to sort of be more chronic in nature, etc. And as we get into the world of things like gene therapies or cellular therapies, etc., that actually require a higher degree of hands-on logistics to literally do things like inject things into patients or take cells out of someone's body and sort of manufacture them and put them back in. That's actually where we want the future healthcare resources to really be focused is on those much higher order type of challenges. And so the introduction of more digital-first type technologies we think can be applied to really reducing the cost infrastructure on the quote-unquote commoditized aspects of the healthcare system.

So basically let technology do the part that should be done in a better way, and that in turn allows these institutions to focus on those other core services.

I mean, to the point where you push a button and imagine a drone coming and delivering to your house.

What are the problems with this approach?

You know, the question with any last-mile delivery solution is always cost. And the notion of doing one-off deliveries, you know, to individual patients into their homes, there's still an unanswered question about what something like that would look like over time. In fact, that is actually one of the reasons why mail-order delivery has not been adopted historically is because the cost structure is just— it's more expensive to do so. The reason that we ask patients to all come to a centralized hub is because it's cheaper to deliver drugs that way. This was definitely a proof of concept. It was a pilot. It was one delivery of one package of therapeutics. And so that's one big question about this. I think also thinking about who's going to pay for this, for these kinds of services. We're early days in terms of thinking about the non-traditional components of the pharmacy value chain that will be covered under the new sort of health plan benefits.

I think that's part of the excitement of non-traditional entrants in the space, because how Amazon can justify their cost structure for delivering medicines is so different than a local hospital or health system. Or even a pharmacy retailer. The other aspect of this, frankly, is regulation. I think we can't get around the fact that the FAA is going to be pretty involved in this, and so that might slow us down.

I'm glad we covered the challenges, but now what are some of the opportunities? When you mentioned earlier that people really care about pharma because it's like a high leverage point, you called it, which I basically interpreted as like a great opportunity for people to innovate around because there's so many touch points. So what are some of the things that you see coming? Because quite frankly, it sounds so boring to me.

Oh no, absolutely not. There's a huge area of innovation. I think specifically around this notion of the patient-pharmacy relationship, you know, one, as we mentioned earlier, as I mentioned earlier, there are many companies who are specifically innovating around making deliveries of drugs much lower cost and much more effective. And so we see a lot of innovation there. There's a huge, massive data play. So if you have visibility into who is actually fulfilling their meds in real time and, you know, sort of gathering and aggregating that information, that is a huge blind spot to most of the healthcare ecosystem, whether it be the pharma companies themselves and wanting to understand their customer set, all the way to providers who typically don't even know what happens once they send that script, So there's a huge amount of data plays, and you see a lot of companies sort of looking at how do we use data to drive medication adherence and really improve the health of larger populations.

So bottom line it for me, guys. How should we think about this UPS delivering drugs for the first time to residential homes and retirement communities news?

We think it's a great example of the direction that more and more of healthcare will go, which is these technology-enabled solutions for the last mile, the notion of healthcare moving outside of the hospital, and the strategic focus on the pharmacy node as one through which you can really enhance the patient relationship. That's fantastic.

Fantastic. Okay. So the second item of news I wanted to talk to both of you about really quickly is that Apple just opened up its health record service to veterans with iPhones. And basically they've been working with the Department of Veterans Affairs for months and they want to give veterans at the VA access to their medical information despite whoever their provider is. So that's like the super high-level summary of the news. Julie and Venkat, what do you think is and isn't significant about it?

You know, I think what is significant about it is, first of all, the veteran community, they're mired in healthcare challenges here in the US. And there's been a lot of efforts from an EHR perspective The fun fact, of course, is that the VA actually came up with the first EHR in the country called VistA.

Are you serious? Like the first electronic health record?

That is correct.

At the Veterans Administration Hospital?

That is correct. They were the sort of birthplace for this innovative digital health record. Now we have in most hospitals across the country. What I do think is interesting and I find meaningful is that the knock on the digital health industry overall is that a lot of the sort of bright, shiny objects, if you will, in our industry, they're great for pilots but haven't really scaled. So when we look at pockets such as the VA or the NHS, National Health National Health Services. That's right. National Health Services from the UK. And so if you think about the populations, the VA and the NHS are really interesting populations because you can actually in one go scale, which is why now the Googles, the Amazons, the Apples more and more are focused on the VA, focused on the NHS. You know, it's not because they are these like bastions of awesome innovation. It's because it's a captive population that they can go from a million lives to like a few million, 10, 20, 30 million.

So I love what you're saying, Venkat, especially because I love of the idea of supporting veterans. The key point, what I really heard is that these can help accelerate something because you have this difficulty scaling is what you're saying. And so you can actually do it in a fast way and learn and develop things that then kind of trickle down to everyone else in these places, which is great. But I have to say, EHRs, electronic health records, have been around for ages. It's like the holy grail of medicine. They never seem to work. People keep talking about them. They're not really still quite here at the full vision. So like, come on, like what's really happening here?

Yeah, you're talking about the story of my life for the last 15 years. I'm sorry. No, I mean, that is absolutely right that like for the last decade or so, you know, the entire provider side of our industry was heads down implementing these electronic health record systems. And as the dust is now settling, we're all recognizing that the one thing that we did not get was interoperability. We've got this great data that's now digitized and sort of stored in these formats that can be leveraged, but to actually get at that data is not a given. And so on the one hand, looking at what Apple has done with its HealthKit solution and, you know, sort of unleashing the data from these EHRs and making it available directly to consumers, all wonderful, great, you know, We all deserve access to our data, and in fact, HIPAA sort of gives us that right to get at that. The other side of that coin is how much utility is there in just releasing the data, right?

There's no imaging data.

There's no imaging data, yeah. So it's limited data. There's no actionability associated with it. So I think ultimately, that's the question that we all need to be asking is like, who's going to actually build the killer app off of this data and actually make it actionable for us? You know, who's doing things like using that data to match patients to the right doctor or using that data to schedule appointments and actually turn that into a utility? I think we're only in the early innings of what we can do now that we've sort of drilled the holes into these oil wells and started to get the data out. So whereas I think it's great that Apple is sort of paving the way for the entire ecosystem to wake up to the fact that this data needs to be released, I think this solution in and of itself is only playing a very minimal role.

Technology for technology's sake is never the right answer. And that's why companies that are actually addressing some of the genomics data and imaging data and thinking about the use cases for a patient who has cancer specifically and what is the use cases they have in mind. And so, you know, to me, like, is Apple going to kill every single company in the PHR space? No.

What's a PHR?

Personal health record.

So personal health record. What's the difference between a PHR and an EHR?

PHRs are patient-driven, whereas EHRs are the things used by the enterprises and the incumbents in the healthcare industry.

Oh, that's so interesting. And we actually had a podcast about the idea of— we didn't use the word PHR, but about this patient-centered concept of data when we did interview with Citizen and Suzanne Fox, who was the former CTO of Health and Human Services. And we went into detail about HIPAA and what it really means for patients. So bottom line it for me, you guys. How should we think about this Apple news? On the vets. It sounds like you guys are on two opposite sides of the coin. I'm okay if you guys want to flip it or both take two halves of it.

Oh, no, I think we're in a happier medium. Look, I think it's fantastic that more and more of the technology ecosystem is thinking about populations like the VA, for example. I think that's a fantastic thing. But there's a limited impact to these headlines. And in fact, if you want to make a deeper impact, you have to think about the patient. You have to think about the workflow. You have to think about all the sort of minor challenges today the industry has.

Yeah, and certainly, as someone who had spent nearly a decade banging my head against the concrete wall of EHR integration to see the fact that companies like Apple and other startups are finally able to leverage that data at scale in a far more frictionless way. I mean, I genuinely see startups doing in 3 months what it took us 3 years to do. And I think if anything, what Apple is showing is that we can do it now. We can get the data out, right? If Apple can do it, anyone in the space can certainly do it because you're going to have far more expert folks who are working in the healthcare ecosystem. And I think the call to action is, all right, innovators, entrepreneurs, you know, go do something with this information that actually ties to a use case that will enable more value-based care that will get reimbursed, etc. So I think that's what we're looking towards.

Thank you for joining this segment of 16 Minutes, you guys.

Thanks, Sonal.

Okay, so now the next segment is on the recent headline posted in Wired, but it also got covered by many places that, quote, hackers can use lasers to speak to your Amazon Echo or Google Home. And the author was Andy Greenberg, and he wrote a great piece sort of analyzing a research paper that was posted. And to be also more technically accurate, this is actually true for all major voice-activated devices, including in the paper they cite cited not just Amazon Echo and Google Home as per the headline, but Facebook Portal, Apple Siri, Google Assistant. Now, we don't actually cover research, but this is in the news because the practice in the security community is to share findings via research papers. And, you know, people expose things with each other's products, post about them, share about them. And so that's how people learn and improve, etc. So let me introduce our Asics and the Expert now, Joel de la Garza, an unfortunate regular on 16 Minutes. Welcome, Joel.

Thank you so much. It's my pleasure to be here. Even though our news is not so fun Well, this is a fun one, I think.

Ah, fun and also scary. So let me quickly summarize what's happening. It's exactly as the headline says, which is that voice commands can be triggered by light. And this is important because laser can be sent through windows. If you're not in the room, like you don't see the telltale signs of flickering lights. And they haven't proven this yet, but they say, like, think about what could happen if you are able to do infrared laser in future, which means this would also then be invisible. What the researchers say in their paper, their paper, by the way, is called Light Commands: Laser-Based Audio Ingestion. Injection Attacks on Voice Controllable Systems. And what they say is that they propose a new class of signal injection attacks, that's a known category, on microphones based on the photoacoustic effect, which by the way, no one knows the physics of how this actually works. But basically what it does is it converts light to sound using a microphone. Maybe you can just break down for me, what does this thing actually do?

So in your device, whatever device that might be, it could be an Alexa, it could be a Google product, it could be an Apple product, there are microphones that are, you know, obviously listening to commands. And there's There's a specific microphone design that is vulnerable to this type of attack. And when it's exposed out to the world and you can show a light on it, this light is able to kind of heat up the microphone in such a way that it mimics the waves of voice, getting the microphone to activate. You know, this is actually an area of research that's pretty old. It goes back quite a ways.

What's this?

So looking for ways to use different frequencies of energy to affect systems.

That's what they mean by signal injection attacks.

Correct, yeah. So like I can use light to mimic sound, right? By modulating the frequency. The frequency of that light to make it appear like sound to a relatively simple digital signal processing device. This goes back, I mean, during the Cold War, the Russians and the Americans were doing this sort of thing to spy on embassies. There have been a lot of examples of using microphones in concrete. Then you started to see the emergence of radio surveillance and radio eavesdropping. And then during the peak of the Cold War, there was the rumor that you could sit outside a government office and see the radiation from the cathode ray tubes from the street, right? And you could see what analysts were seeing on their screens. And this is a field This is research that's been around since the advent of the radio.

So the category and the research is old, since basically World War II time period, and it's been continually evolving. But the difference now is that our surface area of attack is much bigger. We now operate— many of us operate in a very voice-operated world, and that's gonna continue to grow.

Well, yeah, if you've got a financial account, you've got a brokerage account, I'm sure most of us have heard, "My voice is my password," right?

That actually comes from the movie Sneakers, one of my all-time favorite movies.

And see, I just said it on a podcast, so whoever's gonna record that will probably one day use it to play get into one of my accounts.

And just to put voice in context as an interface, it's a contextual evolution of moving from, you know, mouse, which we had our hands tethered to like a wire and a laptop and a keyboard, then moving to more touchscreen type interfaces. Like the next kind of inevitable thing is voice interfaces because you can do so many things when you're untethered. So it does open up new possibilities, but it also opens up new security problems. So now put this in context for me with these practical products. From a security perspective, how worried should consumers be, and what do the designers of these products need to do to make them more secure?

So I think this specific attack, if my understanding of it is correct, is that you need to put a certain film, a protective film that blocks light from getting to microphones. So something that will let sound through, but possibly not light.

Interesting.

There's probably something in microphone design, and I would imagine that right now all the hardware manufacturers are scrambling to come up with a way that they can replace this and make potentially any software corrections corrective measures that they could take looking for the signal happening there. But we've got a lot of focus now on finding ways to actually make voice secure, right? Finding fingerprints in the way that people talk. You can actually look for noise in recordings. You can look for certain artifacts in the way that things are expressed through the microphone to show that it's an attack. And even some of the more sophisticated attacks, right? We saw a story a couple months ago that said that they were using a machine learning algorithm to generate the voice of a CEO to initiate a wire transfer.

Right. That's more in the category of synthetic audio, basically.

Synthetic audio, which is not too dissimilar from using a laser to create synthetic audio, right? It's a very similar attack surface and probably used for similar ends. And there's a company called PinDrop, for example, that's figuring out how to make voice a more reliable signal, to filter out the fraud, and to make it kind of something that in combination with other things could one day replace our password. But as a consumer, I mean, this is an incredibly sophisticated attack. Like, it was done by a bunch of PhDs and PhD candidates at the premier computer science facilities in the world. I don't think the average consumer needs to really get too concerned about it.

So I also read in the article that there was even solutions like doing a PIN, which would be annoying because the whole purpose of having voice is not to have a PIN. But then the other thing was having so-called, quote, wake words that the owner would speak. But those have a risk associated with them because those too could be manipulated through synthetic fraud.

Would a wake word mean that my device is woke? Sorry, I couldn't pass that one up. If there's one thing I'm sure of, it's that consumers just generally don't like friction. And the thought of putting a PIN in front of voice commands or additional words or authenticators is just probably going to make the technology less adopted. And I think as security professionals, we need to do the hard work and actually find a way to make it a seamless, frictionless experience.

Constant age-old tension between usability and security.

Absolutely. It doesn't have to be though.

So Joel, bottom line it for me. How should we think about this interesting development?

So security is perpetually a game of cat and mouse, and it's always about new attacks and new responses. And this is just yet another cat that's shown up to the party, and we've got to kind of re-engineer the way they build their systems to make sure that they keep out of their cheese.

Thank you for joining this segment of 16 Minutes, Joel.

Thank you so much. My pleasure.