UW Computer Security Research and Course Blog

Overview: 

Overlake Hospital Birthing Center has put a security system and policies in place to make sure babies are safe there.  First of all, mothers are given a bracelet when they come in that identifies who they are.  This is just the regular hospital bracelet with the name of the doctor on it.  As soon as the baby is born, he is given to the mother.  Babies are never to be taken out of the room without one of the parents except in extreme emergency cases.  The nurses ask the parents for the name of the new child.  Then, four bracelets are printed out – one for the mother, one for the father or birthing coach, one for the baby’s wrist, and one for the baby’s ankle.  Each of these have a matching number that must be checked whenever nurses give the baby back to the parents.

There is also an ankle band put on the baby with a security device.  Every door leading out of the birthing center is equipped with a security mechanism that will sound if a security band is brought within ten feet of the door.  This causes a complete lock down.  Every door is immediately closed and locked.  The band also will sound an alarm if it is cut.

 Assets:

1.       The most important asset is the safety of the babies born there.  It is essential that babies not be mixed up and that every baby goes home with its mother.

2.      Another asset is the reputation of the hospital.  If a security incident involving a baby was to happen, it would ruin the hospital’s reputation and parents would choose to give birth elsewhere.  Other patients might also want to go elsewhere for their surgeries and treatments.  If there were ongoing problems, the hospital could lose whatever governmental permit they must have to operate a hospital.

Adversaries:

1.       Adversaries include people looking to sell babies on the black market, either to adoptive parents or evil doers.  There are those looking to make a profit that might steal a baby and then pose as the parents of the child.  They could then offer to give the baby to a couple who wants to adopt for a price.  Many couples get desperate because the legal adoptive system is often very slow and disappointing.

2.      Ex-husbands of the mothers, other disenfranchised family members, and fathers of babies who have been banned from seeing their baby are also potential adversaries.  These could have motives of anger and revenge or just a desire to see and have custody of their baby.

Vulnerabilities:

1.       The security bands on the babies could fall off or be cut off.  Although the nurses try to get the band tight enough that it will not come off, infants’ feet are very small and the security band can slip off. 

2.      The nurses just make you read off the number on your bracelet while they are looking at the baby’s number.  An adversary could easily memorize the number and pretend to read off the number without having the bracelet.  Nurses are continually changing because they have shifts.  Thus, new shifts of nurses don’t know what the parents look like so they might be tricked by the adversary.

3.      The security mechanisms on the door are most likely run on electricity.  The hospital probably has backup generators, but these take a short amount of time to come on and could also be attacked.

4.      The security band and the main system communicate wirelessly.  An adversary could try to intercept signal of band and learn the communication protocol.  Then the adversary could send signals to imitate that the band is not cut when it is.

5.      The doors look pretty heavy duty, but they are susceptible to attack.  They could be held open by an accomplice or propped open.  An adversary could break the locking mechanism on the door or remove or break the door so that it cannot close.

Defenses:

1.       From personal experience, I know how easily the security bands can slip off of the baby.  I don’t think that there is an easy way to correct this problem.  One defense might be to put the band on the baby’s wrist, but that might be just as susceptible to slipping off.  They could use a smaller device and implant it in the baby, but I don’t think that would be acceptable to parents.  They could use a five-point harness type mechanism instead of just a band.  The security device would be on the baby’s stomach with bands going over both shoulders, around the waist and through the crotch.  However, this would make changing diapers extremely difficult and really unsanitary.  I don’t think that this would be acceptable to doctors, nurses, or parents.

2.      The hospital could change policy to have nurses always visually inspect identification bands.  Of course, an adversary could forge these, so more protection is needed.  Instead, the baby’s band could have pictures of the parents.  Visually inspecting the parents’ wrist band for a matching number and looking at the pictures could help prevent the baby getting into an adversary’s hands. 

3.      To protect against power outage problems with the security mechanism on the door, the door could be held open with an electromagnet.  This only holds the door open when electricity is run through it.  Otherwise it will release and the door will close.  The security mechanisms could also be powered by batteries.

4.      To defend against an adversary imitating the signal of a security band, the band could communicate using an encrypted message with a rotating key. 

5.      The doors could be equipped with anti-tampering controls.  This would make the door set off an alarm if it is damaged, removed, or hindered in any way.

Risks:

1.       Because there can be a lockdown on the building, there is the risk that people would be trapped inside if a there was a fire.  Parents would not be able to leave because bringing their babies near the door would cause a lockdown.  I’m sure that the fire department is able to open the doors, but it takes time for a firefighter to get there.  The doors could be changed to allow exit if fire alarms go off, but this opens another avenue for an adversary to attack.  I am not sure how fire code plays into this, but it is definitely a risk that must be mitigated.

2.      All of this security can help parents feel that the hospital is secure, but it also can make them think about all the weaknesses in the system and how very insecure the whole thing is.  Security is necessary, however, because other hospitals have had attempted kidnappings.

Conclusion:

Even though there are a lot of vulnerabilities, I think a major goal of having a security system in place is deterrence.  If adversaries know that the hospital has security measures, they will probably choose somewhere else to make their attack.  The system definitely has holes, but I think overall and given limited resources, the system is sufficient.