Despite accessing user data, Kohler still says its smart toilet cameras use E2EE

Kohler is currently under scrutiny following revelations about the privacy implications of its new smart toilet cameras. An engineer has raised alarms regarding the company's claims surrounding 'end-to-end encryption' (E2EE), prompting a closer examination of the privacy measures for a device that monitors activities in a toilet bowl. In October, Kohler introduced its first health-focused product, the Dekoda, a $599 toilet bowl attachment that also requires a monthly subscription beginning at $7. Marketed as a tool that utilizes 'optical sensors and validated machine-learning algorithms' to provide valuable health insights, the Dekoda connects to the dedicated Kohler Health app, allowing users to track various health indicators directly from their mobile devices. Features touted for user protection include fingerprint authentication and E2EE, but questions arise about the actual privacy afforded by these measures. To many, E2EE is a familiar term associated with secure messaging platforms like Signal, where messages are encrypted and can only be read by the intended sender and recipient, shielding them from third-party access. However, the application of E2EE in a toilet-mounted camera remains ambiguous. Simon Fondrie-Teitler, a software engineer and former FTC technology advisor, sought clarification on this issue. He pointed out that the Kohler Health app does not facilitate direct user-to-user data sharing, raising concerns about who can decrypt the data collected by the Dekoda. Further communications with Kohler's privacy representative revealed that the other 'end' of the encryption process is the company itself. The data is encrypted while stored on users' devices and Kohler's systems, but it is decrypted for processing on Kohler's servers. In response to inquiries from Ars Technica, a Kohler spokesperson affirmed that the data is encrypted as it travels from the toilet camera to the company's servers, but this has not alleviated concerns regarding potential access by Kohler employees.