Toilets with built-in gadgets that monitor your health are poised to make a splash in the world of wellness tech 鈥� but these devices come with risks, warn security experts. Some argue that selling them as consumer devices leaves people open to data leaks and that they should instead be tightly regulated as medical devices.
A range of start-ups and research projects have developed smart toilets designed to monitor everything from heart rate to the consistency of stools and the presence of certain proteins in urine that indicate disease. One device even features an 鈥渁nus camera鈥� that takes a photograph of the user from below for identification 鈥� something that as the 鈥減olar opposite of facial recognition鈥�.
But experts point out that many so-called internet of things (IoT) devices have been shown to have poor security, focusing on features rather than safety, and that smart toilets could be hacked to reveal extremely sensitive information.
Advertisement
at the University of Basel, Switzerland, says she is worried that data privacy isn鈥檛 being taken seriously. 鈥淚f you just have a medical hat on, they sound fantastic, but I have a professional privacy hat on,鈥� says Wagner. 鈥淚t looks very much like they jumped on the IoT train to sell consumer devices, only recording much more sensitive data than your average IoT device.鈥�
Wagner and at De Montfort University in the UK recruited a panel of anonymous privacy experts and asked them to imagine scenarios in which smart toilets backfired. One was a data protection officer for local government, one was a privacy and data protection lawyer with a medical degree and the last one was a data protection consultant. All three expressed serious reservations.
One concern was the privacy of users other than the purchaser: if visitors come to their home, are they consenting to have photographs or measurements taken? There were also worries about the risk of losing sensitive data to hackers, as well as the possibility of companies selling the data on deliberately. And if smart toilets were installed in public areas or workplaces, there would be questions about who has access to that data, it was argued.
There were also practical concerns, such as who would be liable if a medical condition was missed, or if false positive diagnoses sent people to overburdened doctors unnecessarily, perhaps leading to painful or invasive tests for no reason.
The group of experts concluded that smart toilets shouldn鈥檛 be sold as consumer devices, but instead as medical devices that have to meet high regulatory standards for privacy and safety.
at smart toilet start-up Coprata says he set out to build a consumer device because creating a medical device under US Food and Drug Administration regulations would raise the price by a factor of 10. It would also mean that, in the US, insurance companies would only offer it to people with diagnosed conditions.
鈥淲e think that we鈥檙e passing up way too much of the population size if it鈥檚 only a medical device,鈥� says Moyle. 鈥淚f you鈥檙e someone who doesn鈥檛 necessarily have a diagnosed gastrointestinal disorder, then hey, you know, bummer for you 鈥� you鈥檙e not going to be able to get this information for yourself.鈥�
Moyle says the company follows best practice on data security. It aims to create a consumer device first before later making a medical device and eventually collecting anonymised data to help researchers working on digestive diseases and nutrition. 鈥淪ure, it鈥檚 nice to have this technology, but what we鈥檙e all about is the data. No one else has captured this data before on a recurring basis,鈥� says Moyle.
at the University of Surrey, UK, who wasn鈥檛 involved in the expert panel, says IoT devices such as heart rate monitors, smoke alarms and CCTV cameras have often been found to contain security flaws, including a non-medical smart toilet with a computer-controlled bidet that was in 2013. He fears that the same could end up being true for the new crop of medical-focused smart toilets.
鈥淲ith a lot of IoT devices, security has never been uppermost in the mind and yet something like a smart toilet is collecting some very personal data,鈥� he says. 鈥淚t鈥檚 not just about the confidentiality of storing very private information. But to me, it鈥檚 the step beyond that where it could potentially cause more harm than good, by giving false results 鈥� false positives, false negatives 鈥� making people worried.鈥�
鈥淚t鈥檚 kind of a solution looking for a problem,鈥� says Woodward. 鈥淭hey鈥檙e making these weird devices because they can, but nobody鈥檚 thought through 鈥榮hould we?'鈥�
arXiv
