jmmass wrote:
1. The machine has a hard drive that collects this data: correct
2: The SD card also collects the data, and the card is to be sent into the center: correct
3: Then what the F is the modem for? What data is being collected, by whom and why? Give me the details in writing: they don't have it...not even on the SD card.
1) The machine has something like flash memory that records the compliance information. Sort of the non-mechanical equivalent of a hard drive.
2) The machine will write the compliance data onto the SD card, along with some more detailed data on how your therapy is working. (Depending on the particular model of machine you have.)
3) With the modem, they can check data that tells you did the previous night any time they want. They can adjust your pressure up and down. If you have problems and your doctor knows what he's doing, it's a very good thing for the patient. If your pressure is too low or too high, he can look at your data, and adjust the pressure with a phone call. That day. No need to send the SD card into the office.
4) Any GSM phone will do the buzzing noise thing you heard. If you put an AT&T cell phone where the CPAP is, you'll probably hear the same noises.
5) The cell phone data link itself may not be secure. If the companies involved did their job right, the data itself could be encrypted securely, even over an insecure link. It's very easy to do these days. Someone could listen in and see a bunch of ones and zeros going by, but wouldn't have any clue about what they mean. They wouldn't be able to send phony commands to your CPAP.
Unfortunately, I seriously doubt that the CPAP companies bother to do any security at all. Even if they did, I wouldn't be surprised if they did it badly. An awful lot of "secure" communications is done really badly.
I think it's really unlikely anyone unauthorized will bother to intercept the modem traffic for CPAPs. There are so many more attractive targets like credit card info, e-mail, spam, etc. Even if they did, all they'd get would be something like "Serial Number 123456 PAPCO model 3176 CPAP machine, powered on at 11:23 PM, powered off at 8:23 AM, pressure 11-15, apnea at 1:33, waveforms, etc."
Someone could conceivably change the pressure on your CPAP remotely, but that would be a considerable degree more difficult.
While it might be possible to intercept, it would take considerable effort without a lot of profit potential. Most of the computer crime these days is for profit. The "script kiddies" just out to have fun are much rarer these days.