The Presentation That Never Happened
Las Vegas, August 2013: Black Hat. The world's most serious gathering of security researchers, government analysts, and the people who make a profession out of breaking things that were supposed to be unbreakable. Thousands of attendees. Dozens of presentations. One slot, scheduled for 1 August, that everyone in the room had been waiting for.
The presenter was Barnaby Jack. New Zealand-born, 35 years old, Director of Embedded Device Security at IOActive. A man who had already made ATMs spit cash on stage in front of a standing ovation three years earlier. A man who had already demonstrated, publicly and reproducibly, that he could remotely control a diabetic patient's insulin pump from 300 metres away and deliver a fatal dose without triggering a single alarm on the device. A man who, in 2012, had stood on a stage in Melbourne and demonstrated that he could send a lethal electric shock to anyone within 50 feet wearing a pacemaker, without knowing their name, without knowing their serial number, without any physical contact whatsoever.
The title of his August 2013 presentation was "Implantable Medical Devices: Hacking Humans."
He never gave it.
Barnaby Jack was found dead in his San Francisco apartment on 25 July 2013, seven days before he was due on that stage. The official cause of death, determined months later by the San Francisco Medical Examiner's office, was acute mixed drug intoxication: heroin, cocaine, Benadryl and Xanax. Ruled accidental. Case closed.
I am not going to tell you he was definitely murdered. What I am going to do is lay out, plainly and in sequence, what he knew, who stood to lose from that knowledge becoming permanent public record, the financial and intelligence architecture that connected those parties, and what the pattern of events suggests about how power actually operates when it feels genuinely threatened. Not power as it is described in leadership textbooks. Power as it functions when no one is watching and nothing is at stake except everything.
Whatever industry you are in, whatever company you built or work inside, the architecture is closer to this than you have been told. The names will be different. The system you have spent your working life inside will not be.
What Barnaby Jack Actually Proved
Before you can assess the significance of his death, you need to understand the significance of his work. Not in vague terms. Specifically.
In 2010, Jack stood on stage at Black Hat in Las Vegas and caused two ATMs to dispense cash on command using nothing but custom software and a flash drive. He had reverse-engineered the firmware, bypassed the password architecture, and written malware that gave him complete control of the machines' dispensing mechanisms. The ATM industry, which had been told by researchers for years that its security was inadequate, had dismissed the concern. After that demonstration, it moved to patch the vulnerabilities within months. That is how Jack operated. He did not write papers. He did not send polite emails. He walked onto a stage and made the problem impossible to ignore.
In 2011, working at McAfee, he demonstrated an attack on Medtronic insulin pumps. These devices had wireless transmitters that allowed doctors and patients to adjust dosages remotely, a genuine and useful medical convenience. Jack's contribution was to show that those transmitters were completely unencrypted, that the device serial number could be discovered remotely without any prior knowledge, that the range of the attack was not a few feet but 300 metres with a modified antenna, and that his software could override both the dosage restrictions and the vibration alarm that was supposed to warn the patient a dose was being delivered. He demonstrated this live, on a friend with diabetes, in an audience. Medtronic subsequently redesigned its products.
In 2012, he went further. He demonstrated that pacemakers and implantable cardiac defibrillators were remotely hackable, that a lethal shock could be delivered to the person wearing one from 50 feet away, and that the fictional television scenario depicted in the Showtime series Homeland, in which a vice president is assassinated by having his pacemaker hacked, was not fiction. It was a technical description of an existing capability. He wrote about it in a blog post titled "Broken Hearts," noting with characteristic bluntness that the TV show had actually understated the ease of the attack: "TV is so ridiculous! You don't need a serial number!"
He delivered that demonstration live at the BreakPoint security conference in Melbourne.
Vice Presidential Real World Validation
The most consequential validation of that demonstration did not come from the security community. It came from the White House. In 2013, former US Vice President Dick Cheney revealed on CBS's 60 Minutes that in 2007, his doctors had disabled the wireless functionality of his implanted cardiac defibrillator. The reason: fear of assassination by remote hack. His cardiologist, Dr Jonathan Reiner, was explicit about the thinking. "It seemed to me to be a bad idea for the Vice President to have a device that maybe somebody on a rope line or in the next hotel room or downstairs might be able to get into."
That decision was made in 2007. Four years before Jerome Radcliffe's insulin pump research. Four years before Kevin Fu's academic work entered public circulation. Five years before Jack's Melbourne demonstration. Five years before the Homeland episode that supposedly introduced the concept to the public imagination.
Cheney and his cardiologist did not arrive at this conclusion independently. Someone told them this was a real and present threat. That someone had operational knowledge of the capability well before it existed in any public research domain. Which means the intelligence community, at the highest levels, and most likely the manufacturers, already knew what Jack was preparing to demonstrate. They had known for years. Just another ‘cigarettes, addiction, cancer, and Big Tobacco scenario’.
Cheney himself, years after the 60 Minutes’ interview, when asked about the ‘Homeland’ television series scenario, called it "an accurate portrayal of what was possible." That is a remarkable statement from a former Vice President. Read it carefully. He did not say it was theoretically plausible. He said it was an accurate portrayal of what was possible. Past tense. Known quantity. Already understood.
The question nobody in the mainstream coverage asked is the obvious one: who told him?
Institutional Expert Not Fringe
Barnaby Jack’s testimony before the US Food and Drug Administration in 2012 directly led to new regulatory requirements for wireless medical devices. The Government Accountability Office cited his work in a formal report calling on the FDA to act. The FDA's own deputy director of science publicly acknowledged that Jack's work had "contributed importantly to progress in the field."
This was not fringe activity. This was a researcher operating within the legitimate structures of his profession, producing verified results, moving regulators, and forcing manufacturers to improve products that were, by his demonstration, capable of being used as instruments of assassination.
And he was days away from the most detailed public presentation of that capability he had ever given when he died.
Who Had the Most to Lose
When you ask that question seriously, not rhetorically and not conspiratorially but as a straightforward exercise in following the money and the motive, the answer is not one entity. It is a network. And the nodes of that network are connected in ways that are documented, not speculative.
Start with the obvious. The three dominant manufacturers of implantable cardiac devices in 2013 were Medtronic, St. Jude Medical, and Boston Scientific. These were not small companies. Medtronic alone was valued at over forty billion dollars. Their products, pacemakers, defibrillators, and related implanted devices, were inside the bodies of millions of people. Those devices could not be patched remotely the way a phone receives a software update. The only remediation for an already-implanted device with no encryption and an unprotected wireless interface is surgical replacement. The liability exposure from Jack's presentation making that fact undeniable, on the record, in front of thousands of security professionals and a global press contingent, was not theoretical. It was catastrophic.
Medtronic had already been forced to act on the insulin pump vulnerabilities Jack exposed in 2011. His 2013 presentation was going to go further: technically, publicly, and with full reproducible detail.
Now go one level up. Who owned these companies?
At the time of Jack's death, the dominant institutional shareholders of all three manufacturers were the same three entities: Vanguard Group, BlackRock, and State Street. Vanguard held approximately 8.7 per cent of Medtronic. BlackRock held approximately 7.5 per cent. State Street held approximately 4.2 per cent. The picture at Boston Scientific and St. Jude was similar. In the very year Jack died, BlackRock increased its stake in Boston Scientific by 4.6 per cent, and Vanguard took up a 6.7 per cent position as the company's shares rose over 105 per cent.
This was not coincidental. These three asset managers are, by structural design, the dominant shareholders of the American economy. Together they are the largest shareholder in more than 40 per cent of all publicly traded US companies and hold positions in 88 per cent of the S&P 500. One or the other of BlackRock or Vanguard is the single largest institutional investor in 84 per cent of the index.
This matters because it means the financial exposure from a regulatory and litigation disaster in implantable cardiac devices was not isolated to those three manufacturers. It was distributed across the same concentrated ownership architecture that dominates American corporate finance. The people managing those funds, and the people they answer to, had direct financial stakes in the question of whether Jack's presentation went ahead.
That is the first ring of the target.
The second ring is less visible but considerably more significant.
The Israeli Connection
All three major cardiac device manufacturers had established deep operational ties to the Israeli medical technology ecosystem well before 2013. These were not passive investments or arms-length licensing agreements. They were equity positions, joint ventures, co-located R&D facilities, and formal incubator partnerships with Israeli medical institutions and technology companies.
Medtronic had been present in Israel since 1979 and had continuously expanded its activities there. Its own country manager described Israel as "a key resource for medical device innovation and technology." Boston Scientific co-founded MedXelerator in Tel Aviv, a medical device accelerator in which it held approximately one-third ownership. Medtronic co-founded MindUP in Haifa alongside IBM and Israeli venture capital firm Pitango. These ventures were not peripheral. They were central to how these companies sourced innovation and talent.
This would be unremarkable if Israel's technology sector were simply a productive engineering hub. It is not only that.
Israel's technology industry, and its cybersecurity industry in particular, is structurally and explicitly connected to the country's military intelligence apparatus in a way that has no equivalent anywhere else in the world. The specific unit that matters here is Unit 8200, the Israeli Defence Force's signals intelligence and cyberwarfare division, which functions as the Israeli counterpart to the NSA.
Israel is the world's second-largest exporter of cybersecurity products and services, behind only the United States. A substantial proportion of the companies generating that export revenue were founded by Unit 8200 veterans, who carry with them the technical training, the classified operational experience, and the ongoing intelligence community relationships developed during their military service. The venture networks that commercialise that talent, including Team8 and Jerusalem Venture Partners, attract capital from the same institutional investment infrastructure. Sequoia Capital, Greylock Partners, and the broader ecosystem of funds that ultimately draws from, or connects to, the same large asset managers that own Medtronic and Boston Scientific.
The capabilities Unit 8200 develops and deploys are precisely the class of capabilities Jack was working in: embedded systems, wireless protocols, implanted device vulnerabilities, remote exploitation at the hardware level. This is not a generalisation. It is a description of what a state-level signals intelligence operation with a documented specialisation in electronic warfare and infrastructure attack would by definition have developed, long before a New Zealand security researcher decided to make it a conference topic.
The entities with the deepest knowledge of what Jack was about to demonstrate, and the greatest operational reason to find that demonstration inconvenient, were not siloed from the entities with the greatest financial reason to prevent it. They were part of the same network.
Cheney's ties to Israeli intelligence during the Bush administration were not incidental. He was among the most aggressively pro-Israeli figures in the US national security establishment, with documented relationships across the Israeli intelligence infrastructure, the same infrastructure that, as we have already established, had deep commercial roots in the medical device companies whose products were at the centre of Jack's work. Unit 8200 and its predecessor units had been operating in signals intelligence and embedded device exploitation for decades. The capability Jack was bringing into the public record was not new. It was known. What Jack was doing was making it impossible to keep quiet.
The Circumstances of His Death
The official account is this: Barnaby Jack, a 35-year-old man in otherwise good health, consumed a fatal combination of heroin, cocaine, Benadryl and Xanax on the evening of 25 July 2013. His girlfriend had spoken to him earlier that day. He had seemed fine. They had dinner plans. When she returned home, he was unresponsive on the floor, surrounded by beer and champagne bottles, rolled-up papers with white powder residue, and e-cigarettes. The medical examiner found no visible trauma. Foul play was ruled out. Accidental overdose.
Several details within that official account are worth sitting with.
His girlfriend told police she had never known him to be hospitalised, but that he had a history of opiate, cocaine, and Xanax use. His colleagues from the security community remembered him as someone who partied hard. There is no reason to dismiss this. Recreational drug use was consistent with how people who knew him described him.
However. No alcohol was detected in his body despite being surrounded by empty bottles. His prescription medicines showed no evidence of abuse. The combination of substances found in his system, heroin, cocaine, a sedative antihistamine, and a benzodiazepine, is precisely the cocktail that produces rapid respiratory failure with no external signs of trauma. It is also the combination that, administered to someone already impaired, would be extremely difficult to distinguish from voluntary recreational excess.
None of this proves anything. What it establishes is that the circumstances of his death sit, with uncomfortable precision, at the intersection of plausibility and convenience. He died in a way that was consistent with his lifestyle, at a moment that was maximally convenient for a specific set of extraordinarily powerful interests, with a cause of death that is by its nature forensically ambiguous.
He died six weeks after investigative journalist Michael Hastings, whose car exploded at high speed in Los Angeles after he had explicitly told colleagues he believed he was under CIA investigation. Richard Clarke, former White House National Co-ordinator for Security and Counter-terrorism, stated publicly that Hastings' crash was "consistent with a cyber attack" on his vehicle's electronic control systems. Neither death was formally investigated as anything other than what it appeared to be on the surface.
Two people with the capacity to permanently and publicly expose dangerous state and corporate capabilities, dead within six weeks of each other, in the same city, in the same summer. Both ruled accidents. Both investigations closed.
What This Is Actually About
Here is my read on what this is actually about, and why I think it belongs in a leadership publication rather than an investigative one.
The system that Barnaby Jack operated within, corporate security research, institutional backing, regulatory engagement, professional conference culture, gave every impression of being a legitimate structure with legitimate rules. He followed those rules. He disclosed vulnerabilities to manufacturers before going public. He testified before regulators. He gave advance notice of his presentations. He worked for a respected firm. He was, by every measure, operating exactly as the system asked him to operate.
And the system did not protect him. Not because the system failed. Because the system was never designed to protect him in the first place.
The entities sitting at the top of the architecture that would have been damaged by his work, the asset managers, the manufacturers, the state intelligence operations with commercial outgrowths, the regulatory bodies with institutional relationships to protect, were not accountable to him. They were not constrained by the rules he was following. They had no structural incentive to treat his continued existence as a variable worth preserving when the stakes were high enough.
This is what power without accountability looks like. Not a cartoon villain. Not a secret society. A network of financial, commercial, and intelligence interests so large, so interconnected, and so insulated from ordinary consequence that individuals, however capable, however well-intentioned, however institutionally legitimate, simply do not factor into the calculation at the level that matters.
Most leadership content treats this reality as if it does not exist. It tells people that the system rewards merit, that transparency is always the right strategy, that doing the right thing protects you. It tells them this because it is profitable and comforting to do so, and because most people producing that content have no reason to say otherwise.
This newsletter exists for a different kind of conversation. Conviction, leadership with a backbone, is for founders, executives, operators and senior leaders who have enough at stake to deserve an accurate picture of the environment they are actually working in, rather than the one they have been sold. That picture is not always comfortable. On occasion, as with this piece, it is genuinely disturbing. But clarity is not optional if you intend to lead with your eyes open.
The accurate picture here is this: the higher the stakes, and the more directly your work threatens a sufficiently large concentration of financial or political power, the more the normal rules of professional conduct become irrelevant as a form of protection. Transparency that is inconvenient to the wrong people does not make you safe. Institutional legitimacy does not make you safe. Being right does not make you safe.
What makes you safe, to whatever degree safety is achievable, is understanding who actually holds power in the system you are operating inside, what their interests are, where those interests conflict with yours, and what they are capable of when those interests are seriously threatened.
Barnaby Jack understood the technical vulnerabilities in the systems he studied with extraordinary precision. Whether he understood the human vulnerabilities in the system he was part of is a question that can no longer be answered.
The Question You Should Be Sitting With
I am not going to resolve this into a clean lesson. That would be a disservice to the material and to you.
What I want to leave you with is a question that serious leaders need to be willing to sit with. When you look at the structure of the industry or institution you operate inside, and you trace the ownership and the interests and the relationships between the people who actually hold power in it, does what you find match the story you have been told about how it works?
Barnaby Jack spent his career proving that the gap between what systems claimed to be and what they actually were was not a minor discrepancy. It was the whole story. He proved it with ATMs, with insulin pumps, with pacemakers. He proved it in front of thousands of people, on camera, in ways that forced manufacturers and regulators to act.
The irony, if that is the right word, is that the same gap existed in the system that surrounded him. The gap between the legitimate professional structure he operated within and the actual architecture of power and interest that sat above it.
He was right about everything.
And then he was dead.
Make of that what you will. But make something of it. That is the job.
Paul Lange advises owners, executives, and boards on the decisions that define commercial outcomes and organisational character, and on what a working board actually contributes. He has spent close to four decades across finance, technology, hospitality, professional services, and operating roles, in Europe, Asia, the Middle East, and Australia, on both sides of the table, with private equity and venture capital one part of it, and has taken five of his own companies through to exit. He is the creator of the Total QX™ and TILE Theory™ frameworks, and the author of The 20% Leader, Mis(très)s Entrepreneur Manifesto, Evolve or Be Remembered, and The Inheritance Manifesto. He runs his advisory practice, Manolutions, from the Gold Coast, Queensland. He writes Conviction because leadership without accountability is just theatre.