Your Wifi Router Can Recognize You Without Your Phone

WiFi Surveillance: How Ordinary Routers Are Becoming Invisible People-Trackers

Estimated reading time: 10 minutes

Key Takeaways

• WiFi surveillance can identify people using ordinary WiFi signals with nearly 100% accuracy.
• Beamforming feedback information (BFI) is transmitted without encryption by design and can be captured passively.
• BFId works without special equipment, without a phone, and even through walls.
• IEEE 802.11bf could standardise WiFi sensing and scale dual-use surveillance globally.
• Defences include BFI encryption, obfuscation/randomisation, and rate limiting, plus policy and legal reform.

Your router might already know who you are — and you never agreed to that.

Introduction

WiFi surveillance is no longer a sci-fi concept. It is happening right now, in labs, and soon, potentially everywhere.

Researchers at the Karlsruhe Institute of Technology (KIT) in Germany have demonstrated a system that uses ordinary WiFi signals to identify people with nearly 100% accuracy. No camera. No app. No device in your pocket. Just the radio waves already bouncing around any room with a router.

This is not a distant threat. The hardware required already exists in most homes, offices, cafés, and airports. The artificial intelligence needed to make it work can be trained quickly. And the data it feeds on — beamforming feedback information — is transmitted without any encryption by design.

This post breaks down exactly how it works, why it matters, and what is being done about it.

Section 1: What Is WiFi Surveillance and Why It’s Different This Time

WiFi sensing privacy is being redefined by a new class of passive tracking attack.

Most people think of surveillance as cameras, microphones, or tracking apps. WiFi surveillance is different. It is invisible, passive, and does not require the person being tracked to interact with any device at all.

Here is what makes the new research from KIT so significant:

• It works without any special equipment. The system runs on standard, off-the-shelf WiFi hardware already found in millions of buildings.
• It works even if you turn off your phone. Nearby connected devices generate enough signal activity for the system to identify you.
• It works through walls. Earlier research into related techniques, such as the LeakyBeam study, showed that WiFi-based occupancy detection functions at distances of up to roughly 20 metres, even through physical barriers.
• It works in seconds. Once the machine learning model is trained, identifying a person takes only a few seconds.

Professor Thorsten Strufe from KASTEL — KIT’s Institute of Information Security and Dependability — describes it clearly:

> “By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present. This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition. Thus, it does not matter whether you carry a WiFi device on you or not.”

This is a fundamental shift. Traditional surveillance requires you to be in front of something — a lens, a sensor, a checkpoint. WiFi-based identification wraps around you whether you know it or not.

This is not theoretical. Proof-of-concept systems already identify individuals, detect occupancy, and even estimate coarse body shape in real time. Adjacent academic systems like WhoFi and other WiFi sensing prototypes have independently demonstrated over 90% accuracy for identifying or tracking people based on how their bodies disturb WiFi signals.

The era of wireless biometric tracking — using radio waves as a kind of invisible biometric layer — has effectively already begun.

Researchers identify people through ordinary Wi-Fi routers with 99 percent accuracy

EurekAlert news release

Section 2: How Beamforming Feedback Makes This Possible

Beamforming feedback is the unencrypted data stream at the heart of this WiFi sensing privacy threat.

To understand why this works, you need to understand one technical concept: beamforming feedback information, or BFI.

What Is Beamforming Feedback?

Modern WiFi routers use a technique called beamforming. Instead of blasting signals in all directions equally, a beamforming router focuses its signal toward connected devices. This improves speed and range.

To do this well, the router needs feedback. Connected devices regularly send back data — beamforming feedback information — that tells the router how the signal is travelling through the space. That feedback describes, in detail, how radio waves are bouncing off walls, furniture, and people in the room.

Here is the critical problem: this data is sent without encryption.

Anyone with a standard WiFi adapter running in monitor mode can capture this data without ever joining the network. No password. No handshake. No permission needed.

How the BFId Attack Works

The research team’s system, called BFId (Beamforming Feedback Identity inference), works in two stages:

1. Training phase: The system collects BFI packets passively while known individuals move through a space. The machine learning model learns the unique way each person’s body disturbs the wireless signal — a kind of radio wave fingerprint tied to body shape, gait, and movement patterns.
2. Identification phase: When an unknown person enters the space, the system compares the incoming BFI data against its trained profiles. A match is returned in seconds.

The BFI data effectively creates multiple “views” of a person simultaneously, because signals bounce from many angles. This gives the AI model richer data than a single camera angle would.

BFId vs. Earlier WiFi Sensing Approaches

Previous WiFi-based tracking systems used a different data source called channel state information (CSI). CSI is harder to access and requires more specialised equipment. The BFId approach is more powerful and easier to deploy:

| Method | Accuracy | Hardware Required |
|—|—|—|
| CSI-based gait recognition | ~82.4% | Specialised equipment |
| BFId (beamforming feedback) | ~99.5% | Standard WiFi adapter |

BFId significantly outperforms earlier approaches while requiring far less to execute. It was introduced with WiFi 5 (IEEE 802.11ac) and applies to all subsequent WiFi generations.

BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information

Wi-Fi sensing applications and standards development

✅ Cut Manual Work from Your Week

Automate the repeatable tasks that drain your time — intake, follow-ups, reporting, and handoffs — so your business runs smoother without more hires.

Book an automation consult →

Section 3: Near-Perfect Accuracy — The Test Results Explained

In a 197-person study, WiFi surveillance reached accuracy levels that challenge existing privacy frameworks.

The KIT team did not test BFId in a small, controlled lab setting. They ran it against a dataset of WiFi recordings collected from 197 real participants.

Key Results

• On a 170-person comparison subset, BFId achieved approximately 99.5% identification accuracy.
• The system worked regardless of viewing angle.
• It worked regardless of how individuals walked.
• It worked whether or not the target was carrying an active device.

This level of accuracy is not incremental. It is the difference between a security camera that sometimes gets it wrong and a system that is nearly always correct.

For context, facial recognition systems — which already face heavy legal and ethical scrutiny — typically operate in the 95–99% accuracy range under controlled conditions. BFId matches or exceeds that bar, while being completely invisible and not requiring the subject to be visible at all.

Why the Scale of the Dataset Matters

197 participants is a meaningful sample. It is large enough to demonstrate that this is not just a party trick that works in a two-person room. The system can distinguish one individual out of nearly two hundred people with near-perfect reliability.

As wireless networks become more connected and more data accumulates, training datasets will only grow. The accuracy is likely to improve further, not decline.

What Researchers Are Warning

Professor Strufe is direct:

> “The technology is powerful, but at the same time entails risks to our fundamental rights, especially to privacy.”

Researcher Julian Todt highlights the real-world tracking scenario:

> “This technology turns every router into a potential means for surveillance. If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognised later — for example by public authorities or companies.”

BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information

EurekAlert news release

Section 4: IEEE 802.11bf — The Standard That Could Scale This Globally

The IEEE 802.11bf WiFi sensing standard is set to make every new router a dual-use surveillance node.

The technology demonstrated by KIT is alarming on its own. But the broader concern is what happens when WiFi sensing is formally built into the next generation of WiFi hardware.

What Is IEEE 802.11bf?

IEEE 802.11bf is the upcoming WiFi sensing amendment to the 802.11 standard — the same standard family that governs all modern WiFi. Once finalised, it will standardise how WiFi devices can be used as environmental and human sensors.

The goals of 802.11bf include:

• Detecting human presence and movement
• Monitoring breathing and gesture recognition
• Enabling smart home automation and retail analytics
• Supporting elder-care monitoring and security applications

These are legitimate, even valuable applications. But they create a serious dual-use problem.

The Dual-Use Risk

Once 802.11bf sensing is standardised:

• Every compatible chipset becomes a sensing node by design. There is no separate hardware to buy. Sensing is built in.
• Every router upgrade is a potential surveillance upgrade. Consumers replacing ageing hardware will automatically receive devices with sensing capabilities.
• The marginal cost of surveillance drops to near zero. The infrastructure is already paid for as connectivity hardware.

Market research projects multi-billion dollar demand for IEEE 802.11bf WiFi sensing applications into the early 2030s, spanning smart homes, retail analytics, healthcare, and security sectors.

Security researchers are calling on the IEEE 802.11bf working group to bake technical protections directly into the standard before it is finalised. Suggested mitigations include:

• BFI encryption — making beamforming feedback data unreadable to passive eavesdroppers
• BFI rate limiting — restricting how frequently feedback data is transmitted, reducing the resolution of captured sensing data
• BFI obfuscation or randomisation — introducing controlled noise that prevents identity inference while preserving legitimate beamforming function

Research into techniques like LeakyBeam has shown that BFI obfuscation is technically feasible with minimal hardware changes. The question is whether the standards body and chipmakers will act before the standard is locked.

Wi-Fi sensing applications and standards development

IEEE 80211bf WiFi Sensing Market

Section 5: Who Is at Risk and What the Threats Look Like

WiFi sensing privacy threats are not limited to protesters in authoritarian regimes — they affect everyday users everywhere.

Researcher Felix Morsbach acknowledges that intelligence agencies and cybercriminals currently have easier tools available, including hacked security cameras and internet-connected doorbells. But he identifies what makes WiFi different:

> “The omnipresent wireless networks might become a nearly comprehensive surveillance infrastructure with one concerning property: they are invisible and raise no suspicion.”

High-Risk Scenarios

Authoritarian governments tracking dissent
The research team specifically flags the risk of WiFi surveillance being used in authoritarian countries to monitor protesters or track political opponents. Unlike cameras, which activists can avoid or obscure, WiFi signals cannot be seen or blocked by ordinary citizens.

Retail and commercial profiling
A café, shop, or airport could identify repeat visitors and track movement patterns without ever asking for consent. Unlike cookie consent banners on websites, there is no current mechanism for a person to opt out of BFI-based identification simply by walking past a building.

Law enforcement and government agencies
Public WiFi networks operated by cities, transit authorities, or government buildings could potentially be repurposed for passive identification of citizens going about their daily lives.

Stalkers and bad actors
The barrier to entry is low. A standard WiFi adapter in monitor mode and a trained model is all that is needed. This is not exclusively a state-level threat.

Domestic surveillance
Installed in a home or apartment building, this technology could monitor occupants without their knowledge.

The Consent Problem

Privacy and legal analysts are converging on a key point: existing consent and notice frameworks for WiFi and cookies are not designed to handle bystander sensing. A person can be identified or profiled under BFId without ever connecting to the network in question. They have no way of knowing, no way of opting out, and currently, no legal recourse in most jurisdictions.

Legal analysts argue that BFI-based identification should be treated as a form of biometric processing — triggering strict protections under data protection regulations and human rights law. In the European Union, biometric data is classified as a special category under GDPR. In many parts of the United States, biometric privacy laws are still sparse or unenforced.

EurekAlert news release

NDSS Symposium paper

Section 6: What Can Actually Be Done About WiFi Surveillance?

Practical defences against beamforming feedback tracking range from hardware-level fixes to policy and legal reform.

This is not a problem without solutions. It is a problem where solutions exist but have not yet been required or widely adopted.

Technical Defences

• BFI encryption at the hardware level. If beamforming feedback data were encrypted, passive capture by outside parties would be effectively blocked. This is the most direct fix and could be built into 802.11bf chipsets.
• BFI obfuscation and randomisation. Adding controlled noise to BFI transmissions degrades the quality of sensing data enough to block identity inference, while keeping legitimate beamforming improvements intact. This has already been shown to be feasible in academic research.
• Rate limiting BFI transmissions. Reducing how often devices send feedback data limits the amount of signal data available for sensing purposes.

What Individuals Can Do (Limited But Worth Knowing)

There is currently no easy consumer-level defence against passive BFI capture. However:

• Turning off WiFi on your devices when not in use reduces the signal environment marginally, though nearby devices will still generate BFI data.
• Choosing locations with fewer routers or networks reduces exposure.
• Supporting privacy-focused policy and standards advocacy is the most meaningful action most people can take.

What Policymakers and Standards Bodies Can Do

• Mandate BFI encryption in IEEE 802.11bf before the standard is finalised.
• Classify BFI-based identification as biometric processing under existing data protection law, triggering consent requirements.
• Extend data protection regulations to cover passive sensing of individuals who never interacted with a network.
• Require disclosure when any premises uses WiFi sensing systems capable of identification.

The research team from KIT is actively calling for these protections to be incorporated into the 802.11bf standard before it is ratified.

BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information

IEEE 80211bf WiFi Sensing Market

Wi-Fi sensing applications and standards development

Frequently Asked Questions

Research published in: Julian Todt, Felix Morsbach, Thorsten Strufe. BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information. CCS ’25: Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security. DOI: 10.1145/3719027.3765062