Kohler Dekoda: toilet camera falsely claimed end-to-end encryption

A camera tucked beneath a toilet seat may sound amusing at first. That amusement can disappear quickly once you realise that data relating to your bodily waste may end up on the manufacturer’s servers.

Kohler, a US brand specialising in bathroom equipment, launched an accessory called Dekoda this year. Similar to the product offered by Throne, it is a small camera fitted beneath the toilet seat. It has a clear view of the bowl so it can examine what is deposited there and build a picture of your gut health. That naturally raises a legitimate question: who can access the captured images, and what exactly do they contain?

Kohler had anticipated those concerns, saying that the camera sensor faces only the bottom of the bowl and that its data is covered by “end-to-end encryption”. In cryptography, that is generally reassuring terminology: it describes an encryption method used by messaging apps such as Signal and WhatsApp. In principle, it means nobody, including the company itself, can view anything concerning your intimate deposits. The issue is that this was not the case at all. Had Kohler overlooked the most basic privacy rules?

Dekoda and the misleading promise of end-to-end encryption

Big Brother in the loo

The issue was uncovered by security researcher Simon Fondrie-Teitler, who highlighted a technical post published by the company and its improper use of the phrase “end-to-end encryption”. Kohler’s consumer health data privacy policy states in plain terms: “We may create, infer, or derive consumer health data from other data we collect.”

To do this, the company must necessarily be able to access the raw data - images of faeces and urine - and decrypt it on its own systems so that its analysis algorithms can be applied. Genuine end-to-end encryption would not allow it to handle the data in this way.

In practice, its protocol is simply standard TLS (Transport Layer Security) encryption, which secures communications in the same way as any HTTPS website. Your stool is plainly not in the same category as your banking details, however, and offering such a low level of protection for a device this intimate is deeply inappropriate. Images from your toilet bowl did therefore pass through Kohler’s servers, where they were decrypted for processing - lovely, isn’t it?

Kohler servers and sensitive toilet-bowl images

Asked about this particularly creative use of technical terminology, Kohler did not respond to requests from TechCrunch, which reported the information. A company representative did nevertheless say that the data was “securely stored” on the phone, the accessory and the company’s servers.

According to that representative, data transfers were “end-to-end encrypted while travelling between the user’s devices and our systems”. The data is still “decrypted and processed to provide our service”, he explained. That is complete nonsense in cryptographic terms, as it effectively means: “no one can see your data except us”. It is the sort of neat sidestep that Meta - and one Mark Zuckerberg in particular - would hardly disown.

Fondrie-Teitler rightly points out: “It is important to use the right terms, particularly when privacy is a major concern.” It may sound obvious, but apparently Kohler had left the toilet door rather too open, so the specialist is right to give it a kick. The company may also be able to use the collected images to train its own AI models, despite claiming otherwise. It says these are “trained only on anonymised data”, a claim as vague as the bottom of a toilet bowl before it is flushed. After its somewhat deceptive definition of end-to-end encryption, how can its assurances be trusted?