When 4-year-old Evan Costik was diagnosed with type 1 diabetes, his father began sleeping on the floor beside his bed. Every hour or two, John woke up to test the preschooler’s blood-sugar level by pricking his finger and squeezing a drop of blood onto a test strip he’d slipped into a meter. A level between 80 and 120 milligrams per deciliter was good. Below that, bad. Potentially very very bad. One night, it was 36. Any lower and Evan could have fallen into a coma. He could have died.

John and Evan Costik at home. Mike Bradley

Waking up every two hours to jab your kid’s finger is no fun, and after about six months, the Costiks switched over to something called a continuous glucose monitor. Now a tiny sensor implanted just under Evan’s skin sent numbers to a pager-like display every five minutes. His parents kept it next to their bed, and while they wished the alarm was a little louder, it sure beat sleeping on the floor.

But children, it turns out, sometimes leave the house. And if those children have continuous glucose monitors, the display unit leaves the house with them. Parents have to rely on teachers, school nurses, and coaches to check the device to see if the kid is headed into blood-sugar meltdown.

Indeed, the first day Costik dropped Evan off at daycare in February 2013 with his monitor, he found the lack of information so nerve-wracking that he started hacking a solution. A programmer for Wegman’s supermarkets in Rochester, N.Y., Costik wanted the monitor to send its data not only to the little display unit, but also to the cloud, where he could check it from his computer. He started tinkering.

The result? A solution that seems so simple it’s crazy it didn’t already exist: an Android app that let him monitor Evan’s blood sugar on a phone. It was kludgy and only he could use it, but it worked. So if Evan was at soccer running around, John could be in the bleachers (or at home) watching glucose levels rise and fall on his smartphone. If they jigged out of range, Costik or his wife could take action.

Costik tweeted a screen shot of his phone displaying Evan’s glucose level. He had no idea that by doing so, he was about to incite a mini-revolution among thousands of other parents who wanted to see their kids’ glucose levels on their phones. And it cracked open the door for another, somewhat more controversial, breakthrough: a home-grown automatic system—a bionic pancreas—that would not only sense blood sugar levels, but dole out insulin in response, automatically, no human required.

You probably don’t think much about your pancreas, so long as it’s working properly. Tucked close beside your small intestine, the ugly, yellowish blob secretes digestive enzymes and squirts out hormones, insulin among them. Insulin tells your cells to open their big fat mouths already and slurp glucose out of your bloodstream to use for energy. No insulin, and the cells stay snapped shut. That’s what happens in type 1 diabetes, when the immune system wakes up one day and decides to kill the insulin-producing cells. As a result, in spite of all the sugar floating in the blood, a person with type 1 diabetes will eventually starve and die. Currently, at least 1.5 million people in the United States have type 1—compared to nearly 30 million who have type 2, in which obesity and age reduce your cells sensitivity to insulin.

The discovery and purification of insulin was nothing short of a 20th century miracle. In 1922, when researchers first injected dozens of dozens of dying, comatose children with insulin for the first time, the patients revived almost instantly, raised, Lazarus-like, from the near-dead.

Diabetes was no longer a death sentence, but to this day it still means a life shackled by regular blood-sugar checks, insulin treatment by injection or pump, and the constant threat of overdosing on the very medication that’s keeping you alive. Indeed, one in 20 people with type 1 die from severe low blood sugar, not the high blood sugar that was the problem in the first place. It’s a delicate balance.

Associated Press reporter Patrick Connolly, in 1986, adjusts the insulin pump he wears on his belt to keep his blood sugar near normal. The 1-pound pump delivers a squirt of insulin through a slim tube into a small needle under the skin of Connolly's abdomen every few minutes. AP

In the 1980s, insulin pumps came on the market. The setup involves a tiny catheter injected under the skin (it’s replaced every three days) to deliver insulin. They were more convenient than syringes, but they were far from automatic, requiring users (or their parents) to do frequent blood sticks and calculations to decide how much insulin to dispense. Other innovations followed, like the continuous monitor, first approved in 2005, and in clinical trials, even more miraculous machines awaited. Most tantalizing has been the artificial, or bionic, pancreas, an external device that combines the pump with the continuous glucose monitor and smart algorithms to control blood sugars automatically, just like the biological one is supposed to do. In hundreds of published trials, they have performed well, but the algorithms for deciding how much insulin to give can be surprisingly complex, and so the ever-cautious FDA remains years from approving a fully automated bionic pancreas for commercial sale. After all, one machine error, one malfunction, could cause the machine to administer too much insulin and send the patient into a blood sugar nosedive—and death. Lawsuit city.

The response to Costik’s simple hack, however, revealed something new about the community of patients and their families: They have grown increasingly unwilling to wait for the FDA’s blessing for equipment upgrades, whether fully automatic or not.

A few days after Costik tweeted about his app for viewing continuous glucose numbers on his phone, another tech-savvy father duplicated his efforts. In the following year, a dozen more parents followed suit. Then, in February of 2014, a California programmer named Scott Leibrand blogged about an app he had created for his girlfriend, Dana Lewis. Leibrand’s app took the numbers pouring out of her device, cranked them through some simplified algorithms, and spit out automated recommendations for how much insulin she needed to correct a high, or how much sugar to take for a low.

“I feel a huge difference,” Lewis says. “I don’t have to be constantly wondering how much insulin to take, or always checking my glucose level. Scott’s algorithm beeps me if I have to do something. And my time in the proper range has gone from around 60 percent to nearly 90 percent. It’s amazing.”

Still, as recently as this past April, neither Leibrand nor Costik had yet posted any of their apps or algorithms online in a way that non-techies could make sense of—they were afraid that someone might unintentionally harm themselves or their child. And no one had yet dared to let those algorithms automatically control a pump. But rumors were swirling. As the author of a book on diabetes and a person with type 1 myself, I heard from one official in a leading diabetes organization that somebody had actually stitched his own bionic pancreas together. The person, I was told, had taken a hack like Kostik’s for exporting blood glucose data, married it to an algorithm like Leibrand’s for deciding how much insulin a pump should administer, and then figured out a way to get the algorithm to automatically control the pump.

Knowing how hard the FDA would come down on anyone audacious enough to distribute a homebrew bionic pancreas, I was told that the guy who had hacked one for his kid didn’t even want to tell other parents about what he had done, much less talk to a reporter. He was like Bigfoot, with no confirmed sightings. So I went hunting for him.

The pancreas. Getty Images

Meanwhile, the knowledge of how to jailbreak a glucose monitor was already spreading far beyond savvy coder types. A health marketing consultant in San Diego named Jason Adams turned to Elance.com, looking for someone who could turn Costik’s open-source code, which he finally posted on github.com, into a more user-friendly app for his 8-year-old daughter with type 1. In 20 minutes, Rajat Gupta, a computer engineering student in Karnataka, India, figured it out and sent Adams a plug-and-play app. Then Laurie Schwartz, a retired dentist in Denver, saw his Facebook post about it and paid Gupta to send her the app for her son, Adam.

Adams and Schwartz created a Facebook group in which they described how they had put their kids’ glucose numbers onto their phones, even onto a Pebble watch. Within a week, a hundred other parents had joined. By December, membership exceeded 8,700.

For now, the FDA is fine with these DIY medical device hackers: “We believe it’s a good thing to have this data available on a cell phone for a parent who is not near their child,” says Courtney Lias, director of the division that oversees glucose monitors and other devices at the FDA. So long as people are using the technology for themselves, she added, “It’s unlikely we would do something.” But beware of sharing: “As soon as they start distributing that or making it more broadly available, that’s where we become more concerned.”

Does that trouble Adams, whose Facebook group could certainly be considered “making it more broadly available” by the FDA? Kinda, but not enough to shut down their Facebook page. “Our biggest concern as we expand is that we’re seeing more parents with very little technical savvy,” he says. “We are continually updating our Facebook page to make clear what this app can do, and what it can’t do. We don’t want it to ever, ever harm anybody.”

I continue to obsess with tracking down Bigfoot. Please, I tell an official who claims to know the guy, tell him I will guarantee his confidentiality. Meetings in an underground parking garage are an option. But still the Bigfoot character who had supposedly hacked a fully automated bionic pancreas remains in hiding, refusing to talk to anyone. Others have heard about him, too. “I have heard whispered rumors that such a person exists,” says Amy Tenderich, who runs the prominent Diabetes Mine site. “But nobody will tell us who he is.”

Then, an email appears in my inbox. It contains a phone number to call.

“I was a year ahead of John Costik in getting this remote monitoring onto a phone,” says the voice on the other end of the line. (He’ll speak to me only if I agree not to publish his name or any identifying biographical details.) Yes, he says, it was certainly possible, hypothetically speaking, to construct a homemade bionic pancreas.

But just because people can do something, he continues, doesn’t mean they should. “I have no problem with technically savvy people doing these things. Where I get concerned is with people who do not understand the limitations. They might go to bed thinking their phone will wake them if their kid’s glucose level goes low, but then their Internet connection goes down, the phone doesn’t ring, and the kid dies.” That, he says, is when people get sued. And the parents aren’t going to sue the FDA—they’re going to sue the hacker. “If people know it’s possible to put together their own artificial pancreas,” he says, “that’s only going to encourage them. So I can neither confirm nor deny that I’ve done it.”

As the movement of pancreas hackers extracting data from their kids’ glucose monitors gained momentum, I had finally spoken to the guy who, supposedly, hacked his own bionic pancreas. But at the end of the call, I wasn’t sure if I had talked to Bigfoot, or a guy in a gorilla suit.

Dan Hurley's latest book, Smarter: The New Science of Building Brain Power, is now available in paperback.