BFAM is a think tank exploring the collision of healthcare, cybersecurity, and artificial intelligence — founded by two brothers (from another mother) who brought the concept of "medjacking" into the medical literature while walking their dogs.
Armstrong and Kleidermacher recruited two other renowned specialists into the collaboration: David C. Klonoff, Clinical Professor of Medicine at UCSF, founder of the Diabetes Technology Society, and editor-in-chief of the Journal of Diabetes Science and Technology; and Marvin J. Slepian, Regents Professor of Medicine, Medical Imaging, and Biomedical Engineering at the University of Arizona, co-founder of SynCardia Systems — maker of the world's first and only FDA-approved Total Artificial Heart — and a named inventor on over 160 patents.
Together, the four wrote the first paper in the peer-reviewed medical literature on medjacking — the malicious hacking of medical devices — bridging a cybersecurity industry concept into clinical medicine and proposing a regulatory framework based on international Common Criteria.
That manuscript catalyzed something unprecedented. Klonoff established the Cybersecurity Standard for Connected Diabetes Devices (DTSec) Steering Committee — the first-ever program to develop a "Protection Profile" for implanted and connected medical devices, starting with insulin pumps and continuous glucose monitors. The committee brought together an extraordinary coalition: the FDA, the Department of Homeland Security, the National Security Council, NIST, NASA, the NSA, Booz Allen Hamilton, the Bluetooth Special Interest Group, and leading device manufacturers. Armstrong served as the lone medical academician on the committee.
DTSec became the world's first consensus cybersecurity standard for connected medical devices, later adopted by IEEE and Underwriters Laboratories as the foundation for IEEE 2621. In 2018, the Insulet Omnipod DASH became the first insulin pump certified under the standard. In 2019, the first-ever recall of a diabetes device for cybersecurity vulnerabilities validated what the four authors had warned about on that dog walk five years earlier.
A decade later, the threat landscape has exploded. AI-powered diagnostics, remote patient monitoring, connected insulin pumps, smart wound care — the attack surface is no longer theoretical. It's on every patient's body.
BFAM exists to think about what happens next.