We already had the studies where they could use WiFi to track people and their movements inside a building, but this identifying people is a new wrinkle. And a good example of why you don’t want to run WiFi routers where you don’t control the firmware, e.g. your ISP’s equipment. And why going to opensource firmware is looking like it might become necessary, so check equipment for compatibility before purchasing. The real problem is WiFi devices, as we rarely can control the vendor blobs even if using opensource operating systems, but they probably can’t code in the network access to effectively bypass the operating system.
https://www.sciencedaily.com/releases/2026/08/260811052857.htm
Everyday WiFi networks could potentially identify and track people without cameras or special equipment, using signals already being transmitted by nearby devices.
Source: Karlsruher Institut für Technologie (KIT)
Summary: Ordinary WiFi networks could quietly become powerful surveillance tools, allowing people to be identified without cameras, special sensors, or even carrying a connected device. Researchers showed that unencrypted signals routinely exchanged between WiFi devices and routers can be used to create radio-based images of people and recognize them within seconds. In tests involving 197 participants, the system identified individuals with nearly 100% accuracy, even from different angles and regardless of how they walked.
WiFi signals could potentially be used to identify people and map their surroundings without relying on cameras or requiring the person being observed to carry a connected device.
“By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present,” says Professor Thorsten Strufe from KASTEL, KIT’s Institute of Information Security and Dependability. “This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition,” explains the cybersecurity expert.
Because the technique analyzes radio waves moving through a space, a person does not need to have a phone, smartwatch, or other WiFi enabled device with them. “Thus, it does not matter whether you carry a WiFi device on you or not.”
Even turning off your own device would not necessarily prevent the system from working. “It’s sufficient that other WiFi devices in your surroundings are active.”
Ordinary WiFi Routers Could Become Surveillance Tools
The researchers say the findings reveal a potentially serious privacy risk because WiFi networks are already widespread in homes, offices, restaurants, and public spaces.
“This technology turns every router into a potential means for surveillance,” warns Julian Todt from KASTEL. “If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later — for example by public authorities or companies.”
There are currently simpler ways for intelligence agencies or cybercriminals to monitor people, Felix Morsbach notes. Those methods can include gaining access to existing CCTV systems or connected video doorbells.
“However, the omnipresent wireless networks might become a nearly comprehensive surveillance infrastructure with one concerning property: they are invisible and raise no suspicion.”
That possibility makes WiFi based monitoring especially notable. Unlike a visible security camera, a wireless network normally gives people no obvious indication that its radio signals could potentially be used to recognize who is nearby.
No Special Surveillance Hardware Is Needed
Earlier approaches to sensing people through wireless signals have often relied on specialized equipment or more complex measurements. Some techniques, for example, use LIDAR sensors, which measure distances by sending out light and analyzing the reflected signal.
Other WiFi based approaches use channel state information (CSI). This refers to measurements showing how a wireless radio signal changes as it travels through an environment and reflects from walls, furniture, people, and other objects.
The new technique does not require that kind of specialized hardware. According to the researchers, a standard WiFi device is enough.
The method takes advantage of normal communications produced by legitimate users connected to a WLAN. WLAN is another term for a wireless local area network, essentially the WiFi network operating within a home, office, café, or similar location.
Connected devices routinely send information back to the router to help optimize wireless communication. These signals, known as beamforming feedback information (BFI), are transmitted without encryption, meaning that anyone within range can potentially read them.
By analyzing that information, the system can generate images of people from multiple viewpoints. Those images can then be used to determine a person’s identity.
Once the machine learning model has already been trained to recognize individuals, the identification process takes only a few seconds.
Researchers Achieved Almost 100% Identification Accuracy
The team tested the technique in a study involving 197 participants. Their system was able to infer people’s identities with almost 100% accuracy, regardless of the viewing perspective or the way a person walked.
“The technology is powerful, but at the same time entails risks to our fundamental rights, especially to privacy,” emphasizes Strufe.
The researchers are particularly concerned about how such technology could be used in authoritarian countries. They warn that WiFi based identification could potentially be applied to monitor protesters or other groups without the obvious surveillance infrastructure associated with conventional cameras.
Because wireless networks are already so common, the researchers argue that privacy protections should be built into future WiFi technology before these capabilities become easier to exploit at scale.
They are therefore calling for protective measures and privacy safeguards to be incorporated into the forthcoming IEEE 802.11bf WiFi standard.
Funding and Publication
The project was funded under the Helmholtz “Engineering Secure Systems” topic.
The researchers presented their results at the “ACM Conference on Computer and Communications Security” (CCS) in Taipei.