Introduction

Spinal cord stimulation (SCS) (i.e., dorsal column stimulation) therapy involves an implantable neuromodulatory device that generates and sends electrical currents to the dorsal columns for the treatment of chronic neuropathic pain [10, 26]. The most common indication for SCS therapy is failed back surgery syndrome (post-laminectomy syndrome), a neuropathic pain condition that sometimes appears after lumbar spinal surgery [2, 18]. Other indications include distinct states of chronic neuropathic pain, such as diabetic neuropathy and complex regional pain syndrome [32]. The mechanism of action of SCS for pain relief is not well-defined; it is speculated that the electrical impulses activate the Aβ fibers of the dorsal column, altering sensory and pain thresholds and higher order processing within the cortex [26]. Though the efficacy of treatment with SCS varies between cases, it is considered to be successful if the reduction of pain is greater than 50% postoperatively [21].

The efficacy of SCS to relieve pain does not have the same negative consequences as other treatment options, such as physical dependence associated with opioids, which renders it an ideal therapeutic option for chronic neuropathic pain. However, complications associated with installation or usage of a SCS system can occur. Lead migration is the most common complication, which can occur due to an intraoperative error, trauma, or abnormal scar tissue [3]. Hardware-related problems (i.e., lack of electrical current generation, inability to connect to remote controller, or discharge of battery) are also possible, while serious neurological complications are rare [3].

Although various complications of SCS system installation and use have been documented, there have been no previously recorded cases of SCS failure due to intentional tampering with the device to modulate output beyond conventional functions of the provided remote controller. We recently encountered a patient in the clinical setting who attempted to “hack” his SCS system via connection through the manufacturer-exclusive encrypted Bluetooth signal in order to alter device impulse generation at the software level, resulting in operational failure of SCS. The patient did not arrive for his scheduled explanation and we have been unable to contact him.

We found no reported cases of hacking of SCS systems or other neuromodulatory devices in the clinical setting. However, security issues associated with an unspecified wireless neuromodulatory device have been documented in an academic setting [11]. Other implantable medical devices, including insulin delivery pumps and implantable cardiac defibrillators, have had instances of security breaches [23].

The increasing use and development of neuromodulation, including implementation of wireless technologies, call for the need to assess the safety of these devices. Thus, it is critical to review the technological specifications of existing SCS systems on the market in the context of potential hacking. Here, we present a review of the SCS system and possible methods and consequences of remote tampering with the device.

Technology and specifications

Modern SCS systems typically consist of the following four or five components:

  • Implantable pulse generator (IPG): Acts as battery that generates and transmits electrical currents to the leads via wires. All companies offer primary cell and/or rechargeable IPGs, which last up to 10 years [8]. The IPG needs to be surgically replaced at end of life.

  • Leads: Placed in the spinal epidural space and transmit electrical impulses [8].

  • Remote controller: Allows for limited adjustment of SCS system settings by the patient.

  • Clinician programmer: Allows for programming of the SCS system by the clinician. This is either a tablet computer or laptop.

  • Battery recharger (only rechargeable SCS systems): Allows for wireless charging of the IPG.

IPGs are capable of generating various impulses, which affect the mode of pain relief. The conventional approach has been low-frequency stimulation, which is thought to relieve pain via the gate control theory [31]. This mechanism requires the application of impulses with low frequency (40–100 Hz), high amplitude (3.6–8.5 mA), and long pulse width (300–600 μs) [7]. This form of SCS therapy is offered by Abbott Laboratories (Chicago, IL, USA), Boston Scientific (Marlborough, MA, USA), and Medtronic (Minneapolis, MN, USA). The recently developed high-frequency therapy is paresthesia-free, but its mechanism of action has not been elucidated [6]. It incorporates impulses with high frequency (10,000 Hz), low amplitude (1–5 mA), and short pulse width (30 μs). This form of SCS therapy is exclusively offered by Nevro (Redwood City, CA, USA). Both forms of SCS therapy are employed in the clinical setting and essentially involve the same method of implantation and use.

The leads can be percutaneous (cylindrical-shaped) or paddle-shaped. In the percutaneous lead, electrical currents are released from all angles of the cylindrical head. In comparison, the paddle lead is flat and thus the electrical currents are released from one side. Leads typically have from 16 to 32 contacts.

Four manufacturers (Abbott Laboratories, Boston Scientific, Medtronic, and Nevro) currently offer SCS systems available internationally. Each manufacturer has engineered its respective SCS system(s) to operate in a unique manner, including the mechanisms of coupling the remote controller or clinician programmer with the IPG and recharging the IPG. Thus, the different SCS systems have distinct technological specifications (Table 1). Herein, we describe the functionality of each manufacturer’s SCS system(s). It is important to note that other vendors, such as Saluda Medical (Artarmon, New South Wales, Australia) and Stimwave Technologies (Pompano Beach, FL, USA), also offer SCS systems that are gradually becoming available to consumers in various markets.

Table 1 Specifications for wireless connectivity between components of SCS systems from four manufacturers available in the global market
Full size table

Abbott Laboratories [29, 30]

Two types of SCS systems are manufactured by Abbott Laboratories, i.e., rechargeable and primary cell.

Rechargeable

The patient is able to adjust IPG settings with the remote controller, which connects via a wire to the communicator. The communicator connects wirelessly to the IPG. The clinician programmer can program the IPG via a wire that connects to the remote controller. The battery recharger connects to an electrical outlet and a unique communicator, which connects wirelessly to the IPG.

Primary cell

This SCS system allows for direct pairing between the IPG and a mobile device (which is an iPod Touch supplied by the manufacturer) via Bluetooth wireless technology, which is encrypted by the IPG upon pairing [30]. Another mobile device may be used instead to connect to the SCS system. The clinician programmer connects to the IPG via Bluetooth wireless technology as well.

Boston Scientific [4, 5]

The patient is capable of adjusting settings of the IPG with the remote controller, which connects to the IPG wirelessly. The clinician can program the IPG with a laptop or tablet computer that connects to the communicator via a wire; the communicator connects to the IPG wirelessly. The IPG is charged wirelessly by a battery recharger. The battery of the battery recharger is charged by a separate base station connected to an electrical outlet. Furthermore, the Boston Scientific SCS system offers pairing between the remote controller and a mobile device via Bluetooth wireless technology; when pairing is completed, the communication channel undergoes advanced encryption standard—counter with cipher block chaining message authentication code (AES-CCM) encryption [5].

Medtronic [14, 16, 17]

The patient can program the IPG with a remote controller that connects wirelessly to the IPG. Each remote controller is unique to each IPG. The clinician tablet connects wirelessly to a communicator, which connects wirelessly to the IPG. However, the clinician programmer must initially connect to the communicator via a wired connection to permit wireless connection [16]. The IPG is charged wirelessly via the battery recharger, which contains a battery that is charged via an electrical outlet.

Nevro [20]

The patient can adjust IPG settings with a remote controller that connects to the IPG wirelessly. The clinician can program the IPG with a laptop that connects via a wired connection to a communicator, which connects wirelessly to the IPG. The battery recharger charges the IPG wirelessly. The battery of the battery recharger is charged via a wired connection to an electrical outlet.

Implantation

The trial SCS system placement involves implanting one or more leads in the spinal epidural space which are then connected to an external pulse generator to determine pain relief, typically over a period of 10 days [8]. Permanent SCS system installation involves surgically implanting the IPG typically in the upper buttock region and re-implanting the leads in the spinal epidural space [10]. Electrodes are implanted percutaneously, whereas paddle lead implantation requires laminectomy.

Adjustable factors

The SCS system is programmed during the installation procedure by a company representative. The SCS system can be connected to a clinician programmer, which can adjust a wide range of factors such as frequency, amplitude, range of amplitude accessible by remote controller, pulse width, on/off time, locations of active electrodes, and power on/off. The patient can connect to the SCS system via the remote controller and manually adjust a more limited set of factors, such as amplitude (in a pre-set range), program (each includes pre-set characteristics such as locations of active electrodes), and power on/off.

Mechanisms of hacking

The use of radiofrequency (RF) signaling in the communication between implanted SCS systems and operator controllers (i.e., remote controllers and clinician programmers) renders it a highly susceptible point of entry for sabotage. Hijacking of RF communication can be achieved most easily via a software-defined radio (SDR), which facilitates the capture and replication of nearby transmitting RF signals [22]. A SDR would be capable of recording the frequency of the RF communication between a SCS system and its operator controller and subsequently replaying the same frequency with the purpose of exerting outside and potentially malicious control of the stimulator. In 2011, a SDR equipped with a consumer-grade microprocessor and a RF transmitter was used to breach the security of a RF-controlled insulin pump [23, 24]. In 2018, SDR was shown to be effective in breaching a wireless neuromodulatory device [11]. These hacking mechanisms can theoretically be applied to any RF-controlled medical device, including SCS systems, and device-specific adjustments can be made with knowledge of security information that is typically published in SCS operating manuals (Table 1).

Another possible route of maliciously accessing a SCS system is through hijacking control of mobile devices (specifically smartphones or tablet computers) or laptops that control the SCS system via an app or software. This allows for remote manipulation of the SCS system to the extent of the setting adjustments capable of its respective app or software. Obtaining control of these devices is possible through methods that are continuously evolving.

Consequences of a breached system

Once the security of a SCS system has been breached, multiple avenues of attack are possible. Malicious alterations of SCS parameters include turning the device on and off as well as adjusting operational parameters such as active lead contacts (i.e., bipole configuration), amplitude, frequency, and pulse width. Unlike tampering of the aforementioned insulin pump, unwarranted hacking of SCS systems is unlikely to cause lethal harm; however, such attacks may reduce the efficacy of the SCS system in alleviating pain or, conversely, exacerbate the harmful side effects of stimulation, which can lead to tissue burns or electrical shocks. As there are no other documented cases of malicious tampering of SCS functionality, the following routes of attack and proposed repercussions are speculative (Table 2); nonetheless, clinicians should be aware of potential avenues of disruption.

Table 2 Potential consequences of manipulating SCS parameters
Full size table

The simplest method of attack would be to relay signals that turn the IPG on or off. Turning off the IPG would result in loss of therapeutic effect; the inconvenience of this action would depend directly on the magnitude of the pain being treated by the stimulator. In the case of implanted patients suffering from severe intractable pain, turning off the SCS system may result in crippling discomfort. Although repeated activation of the SCS system when inactive may not inflict any direct harm on the patient, this action would accelerate drainage of the IPG battery. Rechargeable IPGs would have to be recharged more frequently and thus replaced sooner than anticipated due to accelerating degradation of the battery cathode, while primary cell IPGs would have to be explanted and replaced more frequently. Additionally, many patients with SCS systems periodically deactivate their device during circumstances in which their pain is lessened (i.e., when lying down or sleeping). This action prevents desensitization of the patient’s nervous system to the pain-masking sensation delivered by the stimulator. Forcing the SCS device to remain on may induce or accelerate desensitization to the signals generated by the SCS system, dampening its efficacy in pain relief.

Although not as straightforward as the aforementioned modes of attack, RF signals that directly alter the stimulation parameters of the SCS device (such as bipole configuration, amplitude, frequency, and/or pulse width) can be simulated. Such manipulation would require more detailed knowledge of the patient’s condition, such as the nature and location of the pain as well as the current stimulation parameters utilized by the patient. Depending on the degree of access that the patient has to these parameters as well as their ability to readjust these altered settings to their original values, alterations to these functional values could inflict various amounts of harm, from a small inconvenience to necessitating programming to restore original stimulation values. Although altering the physical location of the lead contacts within a patient would be impossible, an analogous effect could be achieved by reconfiguring the contacts that serve as the paired cathode and anode. This would directly change the coverage of stimulation delivered by the device to areas affected by pain, which may not only reduce therapeutic efficacy but also deliver paresthesia to unwanted areas specifically in the case of low frequency SCS systems.

Impulse frequency is the primary variable through which a SCS system provides therapeutic effect. Low-frequency impulses generate paresthesia that masks pain signals. Reducing impulse frequency would result in an ineffective impulse generated by the IPG. The consequences of increasing stimulation frequency are not as well understood; recent advances have demonstrated the efficacy of high-frequency SCS [1, 9], and its adverse effect profile has not shown to be significantly different than that of low-frequency SCS [25]. High-frequency electrical currents above 5 kHz have an inhibitory effect on motor strength when applied to peripheral nerves, but the effects of such stimuli in the spinal epidural space have not been explored outside of therapeutic use as seen in high-frequency SCS [25, 27].

Alterations of frequency and pulse width would likely have similar effects on IPG functionality in the patient. Reduced frequency and/or pulse width would result in the generation of an ineffective impulse by the IPG, reducing therapeutic efficacy of the device. Increased amplitude or pulse width may cause patients to experience paresthesia in unintended locations and ultimately mild to severe discomfort. Furthermore, electrical impulses with high pulse width or amplitude (i.e., high charge density or charge per phase) can be associated with tissue burns including neural injury [13], which may cause motor dysfunction or paralysis, although reported cases of SCS-induced paralysis were most commonly associated with interference by strong magnetic fields, as in the case of magnetic resonance imaging or critical hardware malfunction [4, 15, 28]. Functional IPGs likely cannot attain the thresholds required to cause tissue damage through manipulation of functional parameters alone. Another avenue of maliciously altering amplitude would be through adjusting the amplitude steppage value of the IPG controlled by the patient controller. Amplitude steppage is a functional parameter that determines the magnitude of change in the amplitude of the delivered pulse for every unit of change of the displayed amplitude on the remote controller. Amplitude is typically displayed as a percentage value to indicate a defined “strength” of delivered stimulation by the IPG. An increased amplitude steppage would slightly modify the displayed amplitude to translate into large variations in the amplitude of the generated impulse, which is typically perceived as a sudden jolt or small electrical shock. A decreased amplitude steppage would have little to no effect on patients with IPGs that have already been adjusted to the optimal amplitude for delivery of therapeutic effect. However, it would hamper subsequent changes to stimulation amplitude by effectively narrowing the range of amplitudes that the remote controller could attain. Adjustments to the amplitude steppage would also limit the patient’s ability to precisely manipulate the strength of their stimulation, necessitating programming. Amplitude steppage alteration is normally limited to clinician programmers, requiring potential hacks of this nature to be able to generate communicative signals that mimic administrative control signals as opposed to remote controller signals.

Discussion

The rapid development and increasing prevalence of neuromodulatory devices in patients prompt the need to ensure neurosecurity [23]. Security issues of a wireless neuromodulatory device have been documented in an academic setting [11], which calls for action by academic and industrial researchers and governmental agencies to promote patient safety. Furthermore, as the military application of neuromodulation increases, targeting of these devices may become more prevalent as well [19].

The Food and Drug Administration (FDA) regulates medical devices in the USA [12]. In particular, the Office of Neurological and Physical Medicine Devices, which operates within the Center for Devices and Radiological Health of the FDA, is responsible for neuromodulatory devices [12]. It monitors various factors including safety and risk prior to allowing a device to enter the marketplace. The FDA has previously identified cybersecurity flaws and issued security warnings for medical devices, such as a network-accessible drug pump [23]. As neuromodulatory devices evolve and develop in the direction of mobile device (specifically smartphones and tablet computers), connection and remote network access, such as cloud-based computing, cybersecurity risks, further increase. Thus, it is critical to continuously monitor risks and ensure adequate safety of neuromodulatory devices prior to patient use.

Threat modeling is an important step in preventing security breaches of neuromodulatory devices from occurring. Pycroft et al. presented potential security breaches of deep brain stimulation and their respective effects on the patient [23]. We, for the first time, have compiled the technological specifications of all major SCS systems available to patients and discussed the consequences of different methods of manipulation. However, a need to evaluate the security of other neuromodulatory devices, such as epilepsy monitoring devices, brain-machine interfaces, and sensory prosthetics, exists [23].