Meg Green probably thinks about that moment more than she acknowledges. It was right before the weekend of Memorial Day. She was 26 years old, had Type 1 diabetes, and was sitting with online instructions to hack her insulin pump. Her goal was to make the device smarter than its manufacturer had bothered to make it, not to steal anything or hurt anyone. The hack was successful. That evening, she went out and drank with friends while her insulin was subtly adjusted by her pump. Throughout the evening, she remained steady. “I just wanted to cry,” she later admitted.
You can learn nearly everything you need to know about the motivation behind this movement from that one detail: a young woman sobbing not from pain but from relief after just one night without having to think about it.
For many years, controlling Type 1 diabetes required maintaining three different technologies operating simultaneously: an insulin pump, a continuous glucose monitor, and your own brain continuously calculating the relationship between them. There was no communication between the two devices. At two in the morning, patients had to take on the role of translator, manually modifying dosages, observing numbers, and performing mental math. There was technology in place to connect these systems. Apparently, there was no business need to act quickly enough.
As a result, some patients gave up waiting. A loose network of engineers, caregivers, and patients with programming experience discovered something in 2014: older Medtronic insulin pumps had a known security vulnerability. The wireless communication protocol was sufficiently simple and unencrypted to be intercepted and overridden by anyone with the appropriate equipment.
This was concerning to the majority of security researchers. It was an opportunity for Dana Lewis, a communications professional with Type 1 diabetes. Based on current readings, she developed an algorithm that could forecast blood sugar levels in the future. Ben West, a hacker, discovered a way to apply that algorithm directly to the pump. Together, they created an artificial pancreas-like device, which Lewis then made available for free on the internet under the name OpenAPS, or the Open Automatic Pancreas System.
It spread swiftly, the way things do when they find a solution to an issue that no one had been able to find.
By the late 2010s, thousands of people were “looping”—a term coined by the community to describe the closed-loop method of allowing an insulin pump and CGM to communicate automatically via a $150 bridge device called a RileyLink and a smartphone app. The guidelines were found in community groups and online forums. Even those without a background in computer science, such as Jonathan Garfinkel, an Edmonton-based PhD candidate in humanities and writer, followed them. “I was terrified,” Garfinkel said to Global News. He claimed he hadn’t looked back within a week of starting his loop.
It’s important to be truthful about the true nature of this. The looping community considers the hack to be a corporate annoyance because it only affects older pump models; the more recent models were designed with this vulnerability fixed. Because those were the ones that could be unlocked, this led to the emergence of an underground market for outdated gadgets, with people searching eBay and used medical supply channels for particular discontinued models. It’s an odd irony that patients are looking for out-of-date hardware because the updated version isn’t as good for their needs.
The FDA showed little enthusiasm. After one looper accidentally overdosed on insulin in 2019 and needed medical attention, the agency issued a warning. Their stance was measured but unambiguous: they were worried about unauthorized systems being used, particularly those based on devices that manufacturers were no longer able to support or warrant. Working with looping patients put endocrinologists in a difficult situation. To put it simply, Dr. Irl Hirsch of the University of Washington told his patients that while he appreciated their efforts, he couldn’t legally be held accountable for a hacked pump in the same way that he could for an FDA-approved device. Since no manufacturer will touch off-label, out-of-warranty hardware, there is no safety net in case something goes wrong.
However, for many users, the results were actually better. Hirsch admitted that compared to the authorized devices on the market at the time, hacked pumps provided users with smoother glucose levels. Dr. Peter Senior of the University of Alberta, who was aware of roughly ten loopers, including two doctors, stated uneasily, “The status quo is not awesome.” The impulse made sense to him. Individuals with Type 1 diabetes are already used to making daily decisions about dosage that could mean the difference between life and death. Some people found it difficult to believe that hacking a pump would put those who were already balancing on that specific edge at unacceptable risk.
All of this has a different, more concerning aspect that the looping community inherited rather than created. For years, security researchers had shown how simple it was to attack insulin pumps from the outside. In 2011, Jay Radcliffe demonstrated how he could use an eBay USB device to hack his own pump from a few hundred feet away. In the same year, researcher Barnaby Jack showed that he could remotely give a potentially lethal dose of insulin to a pump without even needing to know its ID number; his scanner just located the device and took over. There was no encryption on the wireless connection. Not one. These protests took place during security conferences. Manufacturers were observing. The solutions were gradual.
Therefore, the DIY community found itself in a field that was equally defined by the potential of technology and the institutions’ inability to keep up with human needs. OpenAPS was not created by careless patients. Compared to some clinical trials, the majority of them were more thorough, shared their code publicly, and meticulously documented their procedures. From the start, Lewis stated that the goal was to close a gap by providing people with options until a commercially available product caught up. Commercial hybrid closed-loop systems from large manufacturers had finally hit the market by 2022. That was interpreted as validation by some in the looping community. For others, it was simply what ought to have been there years ago.
It’s still unclear if device manufacturers and regulators took this lesson to heart or if they classified it as “patients acting out.” The idea of thousands of people—many of them non-technical—constructing working artificial pancreases in their living rooms and kitchens as a result of the medical device industry moving too slowly is more difficult to ignore. There were actual risks associated with the movement. It was effective as well. It’s possible for both of those statements to be true, and the most honest place to be is probably to sit with that tension.
