The Biopsychosocial 4P Matrix: A Psybersecurity Unboxing of the Mental Health Attack Surface

okay hi everyone uh good morning is can everyone hear me okay all right well thanks so much for uh coming by to this session here at bside Seattle my name is Ryan Louie I'm uh I'm a psychiatrist here in Washington state it's great to talk about mental health things and cyber security with everyone here and I'll be talking about this thing called the bioc psychosocial 4p matrix it's a way of thinking about Mental Health not just for patients but what I think and I'll share with you today about how we can use the same tool for looking at organizations and understanding what kind of threats might be happening or if there might be some mental health stuff

going on that might be exploited by people with bad intentions so we're going to talk about that we're going to talk about mental health and we're going to see what we can use how we can use this tool to understand this thing called the mental health attack surface okay I love the theme of bside Seattle 2024 it's about takes a village and that it's about gratitude and uh so we'll start out by expressing gratitude to the people that have helped you to get you to where you are here professionally familywise personally and also most importantly give gratitude for yourself you've come a long way you've taken time out of your day to come here to meet

people learn new things and to feel uh good and kind of level up and take it to the next level for yourself in many different dimensions of your life atmosphere of safety we're here to create a safe environment we're going going to be talking about mental health we want people to feel good inside physically mentally and of course everyone stay in touch with the people important in your life medical providers and of course if there's any emergencies you we always ask people 911 get that emergency help get that help okay and um we're ethical always constantly nurture that feeling and always bring it into your practice of being ethical and doing the right thing okay and uh this is

educational so we're all learning and growing together so keep these four things in mind today and throughout the throughout the the sessions that you visit today I'm a psychiatrist and my favorite question is how are you feeling I always ask everyone this and uh you might think about your day today getting here to uh this campus for bside Seattle you might think about what you did during this week at work or at home or during your leisure times maybe had some good things maybe not so good things stressful things happy things exciting things a lot of things in your mind we take a mental health inventory I think a central theme in a lot of these

talks is to do asset management like you know knowing what you got what's under the hood you know what what's what's what's inside all these machines and and who has access to everything well we do the same thing in psychiatry in in terms of our feelings and emotions what take that mental health inventory they all might go in all these kind of different directions up and down and sideways and everywhere but we need to have some kind of system to kind of think about and make sense of all these things that are going on in our mind you might have even felt some of these things that I listed here in this chart you might have felt happiness

maybe sadness stress risk uncertainty fear whole bunch of different kind of feelings and emotions maybe even some emotions that we can't even describe or don't even know how to express but nevertheless they are real because you're feeling them and you know it's there okay how does all this fit into our heads in our minds we actually look at the surface area of the brain so I'm just talking about the surface area and I read somewhere that's actually the the size of four newspapers all laid out all open and that's the surface area of the brain and of course that doesn't count all the insides of the brain it's all the neurons and the and the substance of

the brain itself a lot of things going on it's might be one of the most mysterious uh things in the world uh in terms of how the brain works and we're constantly thinking about that okay but as you might imagine that even in printed matter and in our digital age of the things we consume and the things that we interact with every day it has a definite very real impact in terms of how we think and how we feel and one of the things I always think about is could there be someone right in the middle that is influen infuencing or making things happen in ways that might not be in the patient or person's best interest

and that person might even have B bad intentions and in this surface area or mental health surface uh attack surface the attacks can go far beyond just what's on the surface of things it could affect people's words emotions their feelings their thoughts how they behave how they think about themselves in the past how they think about themselves right now in the present and what they plan to do in the future it could be very very influential and it could be happening even as we speak and we may not even know that it's happening what does this landscape look like what does this mental health you know attack surface like well a good way of looking at it is through the FBI's

annual report from the ic3 the internet crimes complaint center and this is the most recent data from uh the 2023 uh report and uh it shows uh a chart of all these different types of cyber crimes and in this chart here it shows the the huge financial cost of cyber crime and you see right at the top Investments and then BC business email compromises and all all kinds of uh uh cyber crimes and and there's there's huge huge numbers and these are only the ones that reported it doesn't even count the ones that people may not have even stepped up to report or maybe there's there's not that complete accurate picture of it but it just gives you a sense of the huge

range of it so as I psychiatrist I'm always thinking I look at this chart I say well for everything that happened here there was a person that was the victim there was a person who was trying to help out and then everyone in between and imagine the stress that's going on for each of these things like look at identity theft we see $126 million but what does this do for a person's mental health in terms of what they're feeling so we ask about what is the mental health cost and for every type of cyber crime in mental uh uh in for every type of cyber crime there's a mental health impact component so for example

when patients tell me that they've been a victim of identity theft or or fraud often times they describe to me these sort of feelings they sometimes tell me that they feel violated as if it were a physical attack they sometimes have paranoia they're they're kind of very cautious about things they doubt things a lot uh it certainly makes them feel anxious it doesn't make them feel good you know they're we like you know should I be online shopping again should I even be doing this and they avoid technology these are technologies that obviously have two sides of the same coin advantages and disadvantages but they might be taking more precautions than would be typical and hence they might be

losing out on a technology that might otherwise have been helping them so they avoid those kind of things these are certain examples of changes in behavior from these types of things we talk about mental health effects in cyber security I mean with all of these effects of cyber crime it impacts both victims and First Responders and these might be the same people in cyber security as many of you uh uh have maybe uh heard about or maybe even experienced yourself there's a lot of things that go on Josh Michaels gave a great talk this morning on burnout and cyber security he talked about burnout and that's part of it too there's other things that might go on as well like

Stress and Anxiety even PTSD kind of things post-traumatic stress disorder type of symptoms paranoia delusions anxiety there could be substance use issues and and and alcohol and many many other things it's a very very complex and evolving kind of situation so we got be thinking about that we're no longer in our own silos you know uh in medical school and residency training and even in Hospitals and Clinics we don't really talk about cyber security all that much uh we talk about you know passwords and it departments and we got that orientation but often times we have to think more broadly about that I'm thinking that cyber security is actually a Vital sign it's part of patient care patients ask

me hey with these mental health records where who's going to see them and who's going to access them where are they stored these are all active conversations that we all need to have so when I think about this I think we should all work together so cyber security and Psychiatry if we blend it together we think about like cyber security now in terms of this mental health attack surface a natural question was how do you know if some something might be going on how do we know if there's something kind of Brewing or how do we even know can we know one way to look at it from uh a lens is to look back at your own type of

work so I'll use my own example I'm a psychiatrist so in my mode of work I work with patients and they oftentimes come to my clinic with a a problem so we look at the problem we talk about what's been going on we do an interview then we kind of build this thing diagnosis we we actually call it a different differential diagnosis it's the idea that give me your best guess and rank order them so number one I think it's this number two I think it's this number three I think it's this so you're kind of building your diagnosis and then you assess you kind of put all the data together kind of think about it say I

think this is what's going on here's the proposed treatment would you be agreeable to do this uh kind of treatment in this pathway and then we select a treatment in my case I help patients with medications and then we look at the response and it kind of goes in this way we talk about Precision medicine and you might have seen this term uh uh around in in the media it could be very technical and you know like kind of like very molecular but it could be as simple as listening to a patient understanding what they need and picking a treatment that fits right for them I see that as Precision medicine so that's how one way we can do it to see

how this all works let's look at Charlie Brown uh I love I love Charlie Brown and uh and I like this because Lucy is a psychiatrist and Charle Brown sees uh Lucy the psychiatrist every December every winter usually in the middle of December and uh and uh and she she always charges 5 cents she's always in and then but Charlie Brown the the the patient you know and you know a question is has he been helped and in what ways has Lucy the psychiatrist helped him so in look at this we see a lot of things that are going on we see a patient who needs some help and we need we see a provider and for those of you who may

not be uh familiar with this story Charlie Brown is a person in this story who uh is assigned to get a a tree he selects a tree that's not good or at least he thinks it's not good and he thinks he's a failure probably a lot of imposter syndromes going on in in for him but then he sees Lucy's psychiatrist and he wants to find meaning Lucy psychiatrist gives him a whole bunch of diagnosis a lot of phobias and then it actually overwhelms Charlie Brown and he gets knocked out but then he says Lucy says um what you need to do is join the school play so he finds that as a therapy uh for himself and at the end of

the story all is well he feels better okay so how do we make sense of something like this here here's the slide of this biocycle social model 4p matrix it's a technique that's been uh developed decades ago uh and it's taught in medical schools it was taught in my residency training program Psychiatry it's taught in many other type of uh classroom settings and it's one way to describe and to parse out to micro disect what might be happening for a a patient's mental health and and life history and condition in a way that helps us understand it a little bit more more and there's many variations of this there's even expanded categories but I just

picked three main ones biological psychological social you see that all coming across the top there and then along the right hand or your left side uh of the the chart here are these things called four Ps they are things like predisposing precipitating perpetuating and protective okay so each of these are things that allow a certain thing to happen or increase intensity happening there are things that promote or make something worse or kind of fester or keep rolling or snowballing there are certain things that that that that that trigger it like a precipitating event and then lastly there's something that's protective so it's something good something that's protective for this person so I left this intentionally

blank and I left it just as a as a as a still screen here because in actual life I want you everyone here to picture this in your mind just kind of have that in your in your mind you know a 3x4 chart biocyc social biological psychological social predisposing precipitating perpetuating protective and I laid it out like this because often times when things happen we don't have time to dig out that chart oh was that chart or we don't have time to write things down if there's an incident response going on things are really stressful you're things might be very very chaotic you want to just have this in your mind flash it just really quick and use a

mental note you not even using any physical thing for writing but just kind of place them in your mind what goes here what goes there what goes there and just talk through it even talking through it or thinking about in your mind so we can do this with Charlie Brown biological we don't know much about his parents actually there's no adults in the in the cartoon and all you hear is his voice as is wah wah wah so we don't know that but we do know that biologically you know he has a sister Sally and uh he looks like his home's pretty good you know he seems uh be uh you know pretty healthy in terms of uh

physical health and uh you know he's not the best athlete you know Lucy always takes that football away and he always tries to kick and he falls on the ground but you know but in general you know we don't know a whole lot about biological things but we see that he's kind of managing okay but in the realm of psychological and socially there's a lot of things going on right psychological predisposing if if growing up Charlie Brown was always kind of doubting himself he's always trying to kick that football and Lucy at the last moment removes the football he's missing it all the time so he's getting this feeling that he can't do things well right

precipitating in this story that we just had he was assigned to be in charge of getting the tree that's a stressor that's he he he got assigned with the job and then he brought it back and his deliverable was like everyone laughed at him they thought it was kind of a a wimpy tree but it turned out to be good perpetuating people kind of laughed and there were people kind of like putting that pressure on him protective he has Snoopy he has his dog a pet dog you know who's been supportive although he's very independent but he has a very good friend Linus so that's a very protective thing for him psychologically often times the psychological realm also goes

into the social realm because these same people who have helped him with uh being protective also serve as both good things and and could be negative things as well because in this story The predisposing Factor is that a lot of people laughed at him so that's a lot of social stress but at the end of the story after he decides to join the school play everyone kind of comes together decorates the tree he finds the true meaning of the holidays and uh and he's able to do it so that's a protective protective matter and perpetuating uh in terms of that sort of like a sequence of things and he was able to resolve it and that's a story

within a 30 minute show uh so that's Charlie Brown as I brought that example up you might see how it might relate to your own life you know everyone has to have some kind of thing that might be applicable to them and in many cases we might be similar to Charlie Brown in many ways I'd like to extend this beyond the way of looking at it in terms of people to a whole organization okay so in a whole organization or an organization is made up of people and often times uh at the helm of a leader who generates the culture we can even apply the same thing to to companies biological this is like the DNA of the

company the founder statement the history we've always done it this way Innovation happens like this and this is the way that's done it's policy it's set in stone we all get that that that that Mantra through the uh the orientations and and and the way we work in teams so that could be biological it could be predisposing right and then precipitating often times the precipitating stress in the world of cyber security is is a cyber security incident right so all of a sudden there's things happening perpetuating if there's a if there's a a culture of not wanting to say no to certain things everyone want to work after hours and everyone want to look good for the team

it's good and bad right uh Josh uh said at today's session that even helpers need help all right so that could be perpetuating it's it's that constant idea of wanting to do good things right and protective maybe the company has a good mental health program in place uh just like uh the previous speaker from cisa sisa said that don't come during the the emergency times get there early get that contact that's protective right so and and that's just one example psychologically socially in these companies they are social organizations a lot of things going on as a psychological aspect of well as well psychological safety right so being able to understand something that keeps things safe that people are able to

speak up if something is wrong say something right if you see something say something so that's part of the the aspect of it as well and then also socially because we are all people we look up to our colleagues for support we look up to our mentors and our teachers and our leaders for that leadership of guiding uh the mission both personally and as an organization so with these with this kind of chart you get the idea that you get a lay of the land this whole landscape of all these different things that are going on and it helps you organize a different uh uh a different view of things seeing in various different dimensions being able

to to categorize it and organize it in your mind with that after you gather all the data and this happens in medicine to we build this thing called the differential diagnosis uh doctors usually say what's your what's your best guess of what might be going on and for for us in Psychiatry we think about different symptoms like in a depression or anxiety or other kind of things and we rank them and in medical school they always talk about these things called horses and zebras they don't talk about unknown to the mind so I added that part but for common things you know if someone has a certain set of signs and symptoms it's most likely that right so that's that's

common you got to know that we can't miss those kind of things rare stuff definitely possible rare but very unusual sometimes it always shows up on exams so that's why we learn zebras in med school so I put in the zebras that's are rare but I want to bring up this one way on the right side unknown to the mind in the cyber security world I guess that would be called a a zero day so uh you know things that have never been exploited before I've never seen them they just pop up in the wild and we don't know what to do about it sometimes it might even be a backd door of some type it might be happening even when

when when we don't even know what's going on so that's something that's important to look at so I'm thinking about that that last part of things unknown to the mind I started think about in my own field in Psychiatry can that be happening can there be an active person or an actor of some type that might be actively counteracting what a patient's well-being is all about and I don't know of any actual cases of this happening but in many ways it's already happening look back at that ic3 report there's all those cyber crimes going on and already we already know that attackers are are targeting people's mental health to Target the elderly because they're more

vulnerable to scams they might be using a certain uh uh social media platform because has access to a certain audience and they know people's behaviors and things like that right and a lot of data might be exchanged from people's phones right in terms of uh uh usage data and privacy and things like that so I started thinking about psychiatric engineering and I was thinking that it's the creation of mental health signs and symptoms by a person who might have bad intentions and who manipulates a victim by exploiting their mental health and they do this by using Precision medicine in a Twisted anti- hypocritic oath type of way okay so that's that's that's psychiatric engineering and we look back at that at that chart

in terms of how Psychiatry is provided that's the one at the top psychiatric care what about psychiatric engineering that's at this lower part here at every point in the process every point of the way there can be an intervention by a bad person and that person means that they're exploiting something somewhere along this trajectory signs and symptoms might be created or engineered there might lead it might lead to an altered interview which means that it's an artificially inaccurately engineered diagnosis and this might not be known by the patient it may not even be known by the doctor if I were to say in my differential diagnosis uh when I'm reporting to colleagues I say well in my

differential diagnosis I think it's going to be uh let's say depression secondary to a Cyber attack they might say what or secondary to hacking or secondary to uh something you know that's that's so far down on the list but I think that we have to generate a culture that we have to start talking about that because think that it's not going to be rank number 100 in terms of the possibilities I mean we're seeing cyber attacks happening in the healthcare space uh uh even as we speak right now and so that's probably going to be rising upwards so this is a chart that lets us think about what that process might be now how we might be

able to do this is that um there's a way forward it's about takeaways that you can do and and and and take for yourselves to to make it your own right you take that mental health inventory get that asset inventory know what's there your going to use the biopsychosocial 4p Matrix have it in your mind and think about how you want to use it and keep it handy because it's always in your mind just kind of think about it oh yes I see that chart start filling it in mentally use it for people use it for yourself use it for organizations start making that that differential diagnosis practice at it you know it's always okay to say hey you

know what about this what about that just just just lay it out there because if we never laid it out and we never know it exists and we never be we will never be able to talk about it if we don't know that it's there so just kind of laid out there and uh be open to new ideas new people new backgrounds exchange ideas uh go across different fields and think about it and uh and work together and always stay curious always wonder about things you know horses zebras things from Left Field unknown to the mind okay and of course we go back to that first slide when we talked about the theme of Seattle be

sides 2024 we go back to those same things because these are actually your protective factors it's that bottom row right think about being ex uh being uh thankful expressing gratitude uh building the atmosphere of safety wherever you go being ethical and always constantly learning and doing good things and growing okay so everyone U you know start with security in mind if you have your uh mind set in the right place and you feel that's it's the right direction and you're doing good things for yourself and for your organization you can feel confident that you are making the right choice okay and with that um I'll take questions and feel free to to send me a

a message if uh if if you have anything things you want to share and I'm also on Twitter or I guess it's called X now so that's me and thank you very [Applause] much yes um so the first question so first of all thank you so much for the presentation um I think the first question is are the slides going to be available afterward uh yes yes yes some of the things I didn't have time to write down and so I appreciate that yes second is it sounds like the anti pattern you were talking about sounds a lot like what the military would call Sops so so where they're looking at the psychological aspects and how they would

like influence it so I wonder if there's already some like some existing study or research like to may not be public but that's one thing also on the the healing part you talking about um in a lot of engineering they'll have a retrospective at the end of each Sprint or cycle and that seems like a particularly valuable place to insert this psychological way of thinking to help the team as a group to study their their support their like the different types of mental burnout like things like that I'm curious is that like those were the things that came to my mind like do you have any like thought on that or or any any other ways where we might be

able to take these lessons back with us to our job yes yes thank you and the first question is uh will the slides be available yes uh they will be posted online uh if you send me a email I could give you the slides I'll probably just post them up on Twitter as well so we can have them seen and the second question uh Sops psychological operations yeah that's been going on for a very long time and the military has been uh it's been an active use in militaries around the world um you know both public information maybe not public kind of information I haven't looked too much into that but I do know that it

exists and and that's a great question because psychological and psychiatric there's a lot of the mental models and things that happen in the mind but in terms of Psychiatry I'm thinking like if we drool down to a level of medications and actually uh influencing that that's uh that's something I want to look at but great question and that uh retrospect uh sort of like looking back yeah certainly have that active conversation don't be afraid to talk about things you don't need to be a psychiatrist or mental health professional to talk about it it's in your DNA thank you so much [Applause]