2. There are regulatory obstacles for businesses.

As someone in the biotech space, this is by far the biggest factor. When you are dealing with humans, crashes and bugs mean deaths. Deaths mean increased regulation, often under the mistaken assumption that more rules would prevent engineers from making bugs. Modern testing and build systems might, but regulators aren't keen to change their testing systems, many of which were encoded by legislation decades ago. For example, adaptive clinical trials have been known to be theoretically superior to the Phase I/II/III design for 15 years, yet are still in limbo[1] at the FDA; their proponents are still banned from trying them out. Facebook does not need a Federal Software Assocation to sign off on its new unit testing framework.

Moreover, it is just more stressful to deal with a regulatory climate where any error is assumed to have happened because you were an evil corner-cutting capitalist who didn't allocate enough for safety. This kind of Monday morning quarterbacking is unfortunately usually done by people who've never shipped a drug or device in their lives, like most politicians, journalists, or federal regulators. Twitter, unlike Genzyme[2], is not fined millions of dollars by the FDA when its site is down.

Finally, you have to guess what the law is. There is so much "discretion" [3,4] afforded to regulatory agencies that the threat of fines and seizures over bizarre interpretations of the law by a Carmen Ortiz-style ambitious regulator is never far from your mind. Example [5]:

[Newsweek:] What exactly would constitute a “medical
claim?” Would pointing people to medical research papers
[qualify]?

[FDA]: It depends. There are rules as to how one can do
that … Those rules are actually worked out pretty well,
and they just would need to make sure they’re staying
within the rules.

[Newsweek:] Are those rules on the Web?

[FDA]: I don’t know where the policy is. I would have to
get it for you. It’s an agencywide policy. I would have to
find it for you. And it won’t be that easy for people to
follow it…

Another example [6]:

The agency has urged hospitals to allow vendors to guide
them on security of sophisticated devices. But the vendors
sometimes tell hospitals that they cannot update FDA-
approved systems, leaving those systems open to potential
attacks. In fact, the agency encourages such updates.

“A lot of people are very confused about FDA’s position on
this,” said John Murray Jr., a software compliance expert
at the agency.

And one more [7]:

In United States v. Park, the Supreme Court held that a
responsible corporate official can be convicted of a
misdemeanor based on his or her position of responsibility
and authority to prevent and correct violations of the
Food Drug and Cosmetic Act (FDCA). Thus, evidence that an
individual participated in the alleged violations or even
had knowledge of them is not necessary.

Think about that: criminal penalties for violations of laws that "won't be that easy for people to follow", where knowledge or participation in the alleged violations is not necessary. And the law is not static. The FDA also can and does write "guidances" outside of the legislative process which will make your business model illegal overnight or vastly more expensive due to unanticipated regulatory costs. Google does not need to guess what the DNS protocol is or will be in 2013.

For just a taste of how all this plays out, look at the FDA's ongoing attempt to regulate[8] mobile health apps. Who knows what the rules will be, what they will cost, or what the fines are? Look at the FDA's attempt to deny[5] people access to their genome without a prescription. Look at the fact that they issued a record 10000+ 483s in 2011[9], which threaten a business with civil or criminal penalties. Look at the fact that they used these 483s to shut down Teva and Sandoz and Hospira and Bedford at the same time[10], causing a massive shortage of injectables which they blamed on industry profit seeking and used to gain[11] yet more regulation, more power, more budget.

Look, finally, how they claim in an official court filing against family farms producing raw milk that you have "No Generalized Right to Bodily and Physical Health" [12], where they approvingly cite the case of Cowan vs. US, where a terminal cancer patient was denied access to experimental medication, denied the right to opt-out of the FDA:

There is No Generalized Right to Bodily and Physical
Health.

Plaintiffs’ assertion of a “fundamental right to their own
bodily and physical health, which includes what foods they
do and do not choose to consume for themselves and their
families” is similarly unavailing because plaintiffs do
not have a fundamental right to obtain any food they wish.
In addition, courts have consistently refused to
extrapolate a generalized right to “bodily and physical
health” from the Supreme Court’s narrow substantive due
process precedents regarding abortion, intimate relations,
and the refusal of lifesaving medical treatment.

See Glucksberg, 521 U.S. at 721 (warning that the fact
“[t]hat many of the rights and liberties protected by the
Due Process Clause sound in personal autonomy does not
warrant the sweeping conclusion that any and all
important, intimate, and personal decisions are so
protected”); see also Cowan v. United States, 5 F. Supp.
2d 1235, 1242 (N.D. Okla. 1998) (rejecting a claim that
the plaintiff had the fundamental “right to take whatever
treatment he wishes due to his terminal condition
regardless of whether the FDA approves the treatment”).

I know it sounds surreal, but they are arguing here that you only control your own body with respect to abortion, intimate relations, and euthanasia. Everything else is controlled by the FDA, yea even unto your death from cancer.

The only solution here is for hackers to carve out a jurisdiction in which the FDA has no say, where patients are free to be early adopters and startups are free to push the technological envelope. Patients in this zone will need to be mature and understand that these are version 1.0s, and may not help or even actually harm them. But every drug or device or surgery needs someone to be first, and a few brave risk takers could both benefit their own health and push humanity forward. After all, we have thousands of people dying for futile risks in various foreign wars.

So, the limiting reagent is not money, or expertise, or motivation, or smarts. raganwald, you and most of HN are plenty smart enough. It's about the freedom for companies to innovate, for patients to take risks. We need a jurisdiction (a seastead? Singapore? Estonia?) that enables us to push the technological frontier. Everything else will fall into place once we can't be punished for innovating.

[1] http://jnci.oxfordjournals.org/content/104/18/1347.extract#

[2] http://www.fiercepharma.com/story/genzyme-submits-175m-fine-...

[3] http://www.ivdtechnology.com/article/letters-labcorp-show-fd...

[4] http://www.fdalawblog.net/fda_law_blog_hyman_phelps/2011/03/...

[5] http://www.thedailybeast.com/newsweek/blogs/the-human-condit...

[6] http://articles.washingtonpost.com/2012-12-25/news/36015727_...

[7] http://www.gatewayfda.com/fda-regulations/under-park-doctrin...

[8] http://m.spectrum.ieee.org/biomedical/devices/the-fda-takes-...

[9] http://blog.fdazilla.com/2011/11/fda-issues-483-every-50-min...

[10] http://www.forbes.com/sites/aroy/2012/06/15/how-margaret-ham...

[11] http://www.fda.gov/Drugs/DrugSafety/DrugShortages/ucm050796....

[12] http://www.organicpastures.com/pdfs/FDA%20dismissal%20docume...