ABOUT THIS EPISODE
Billy Rios, vulnerability researcher and (CS)²AI Fellow, joins Derek Harp for the audience Q&A after presenting his team's research on a connected wheelchair that was later recalled. Billy explains why the FDA's power to keep a device off the US market is the biggest stick in any industry, what a recall means when the problem is software, and why a manufacturer can't simply switch off a core feature to fix a flaw. They get into legacy "big iron" devices (Billy has bought a CT scanner and a C-arm), why the FDA's guidance works even though it isn't prescriptive, and how manufacturers' behavior has changed in about ten years. Billy also gives advice to researchers: bug bounties, making a living as an independent, how the CFAA and DMCA good-faith exception affect legal risk, and a plain-English explanation of side-channel attacks.
Watch the wheelchair clip: https://youtu.be/6-iBC5ugiSo
More from (CS)²AI on YouTube: https://www.youtube.com/@cs2ai
Guest: Billy Rios, (CS)²AI Fellow, Cybersecurity Researcher, Author, and Co-Founder of QED Solutions
Host: Derek Harp, Founder and Chairman, (CS)²AI
Recorded live during a (CS)²AI Online webinar on October 21, 2026.
Chapters:
00:42 Welcome from Trisha Harp and the wheelchair research
02:01 Who decides whether a manufacturer reports to the FDA?
04:44 Are manufacturers getting better? Why the FDA matters
08:43 The FDA's biggest stick: keeping a device off the market
09:16 What a recall means when the problem is software
11:15 Guidance that isn't prescriptive
14:16 Controlled vs. uncontrolled vulnerabilities, and the wheelchair dilemma
17:30 How the FDA process changed manufacturers
20:11 Legacy "big iron": CT scanners, C-arms and VBScript
24:08 Standards, secure by design and the "soup" analogy
26:10 Connected devices multiplying inside and outside the hospital
28:24 Advice for researchers: the 300 backdoor passwords and the PATCH Act
30:58 Bug bounties and making a living as a researcher
34:55 Legal risk: the CFAA and the DMCA good-faith exception
37:11 Side-channel attacks explained
38:56 Why only the FDA can do this 41:13 Parting words
Legal topics in this episode are Billy's views, not legal advice.
Produced by (CS)²AI (Control System Cyber Security Association International).
