Your Wi-Fi knows more than you think: Researchers warn of an invisible new surveillance system

For years, privacy advocates have warned about the growth of surveillance cameras, facial recognition systems, and the vast amounts of personal information collected by smartphones. Now researchers in Germany have identified another potential privacy concern, one that may be even harder to detect: ordinary Wi-Fi networks.

According to research presented by scientists from the Karlsruhe Institute of Technology (KIT), standard Wi-Fi infrastructure may be capable of identifying and tracking individuals without cameras, specialist hardware, or even a connected device being carried by the person being observed. The study demonstrated that radio signals routinely exchanged between Wi-Fi devices and routers can be used to create radio-based images of individuals and identify them with near-perfect accuracy. The findings raise important questions about privacy, surveillance, and cybersecurity, particularly in countries such as Canada, where wireless connectivity has become deeply embedded in daily life.

Turning Wi-Fi signals into a form of vision

The technology is based on an emerging field known as Wi-Fi sensing. Whenever wireless signals travel through an environment, they interact with walls, furniture, objects, and people. These interactions alter the signal in measurable ways. Previous research has shown that wireless signals can be used to detect movement, monitor occupancy, and even assess certain health indicators.

The KIT researchers have now taken this concept considerably further. Their system analyses radio wave propagation to generate representations of people moving within a monitored space, functioning in some respects like a camera that uses radio waves instead of visible light. Professor Thorsten Strufe of KIT’s Institute of Information Security and Dependability explains that observing how radio waves move through an environment enables researchers to create an image of both the surroundings and the people present. The crucial difference is that radio frequencies, rather than light, are being used for recognition.

Perhaps most concerning for privacy advocates is that individuals do not need to carry a smartphone, smartwatch, laptop, or any other wireless device to be identified. The presence of other nearby Wi-Fi-enabled devices is sufficient for the technique to function.

The researchers developed a system called BFId and tested it using recordings involving 197 participants. According to their published findings, the system was capable of identifying individuals with extremely high accuracy across different viewing angles and walking styles. The study, BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information, was presented at the ACM Conference on Computer and Communications Security (CCS) and highlights what the researchers describe as previously unexplored privacy risks associated with modern WiFi systems. Once trained, the machine-learning model could determine an individual’s identity within only a few seconds.

The attack exploits a feature found in modern WiFi networks known as Beamforming Feedback Information (BFI). Beamforming, introduced in Wi-Fi 5, helps improve wireless performance by allowing devices to provide information about signal quality and channel characteristics to routers. These feedback signals are routinely exchanged during normal wireless communication. The researchers found that this information can be leveraged as a sensing mechanism. Importantly, the technique does not require specialized sensors, LIDAR systems, or dedicated surveillance hardware. Standard Wi-Fi equipment is sufficient. The only requirement is access to the relevant wireless signal information generated during normal network operation. This means the capability could potentially operate within the vast existing ecosystem of wireless networks already deployed around the world.

Why privacy experts are concerned

The researchers argue that the implications extend far beyond academic curiosity. Julian Todt, one of the study’s authors, warns that every wireless router could potentially become a surveillance device. A person walking past the same café each morning, for example, might theoretically be identified repeatedly without ever connecting to the network or noticing any monitoring activity. Unlike CCTV systems, Wi-Fi-based identification is largely invisible. Most people understand that a security camera may be recording them. They may not realize that the wireless infrastructure surrounding them could potentially be used to establish presence, movement patterns, or identity.

The researchers also note that wireless networks are now nearly ubiquitous across homes, offices, transport hubs, shops, restaurants, and public buildings. Consequently, if such techniques became widely adopted, the scale of potential monitoring could be unprecedented.

Canada has one of the world’s highest rates of internet connectivity and extensive adoption of wireless networking technologies. Smart homes, public Wi-Fi hotspots, municipal wireless infrastructure, universities, airports, hospitals, and commercial centres all rely heavily on Wi-Fi-based communication. At the same time, Canada places significant emphasis on privacy rights and data protection through legislation such as the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy frameworks.

The possibility that wireless networks could be used to identify individuals without consent raises important policy questions:

Would radio-based biometric identification constitute personal information under Canadian privacy law? Could organizations collect such information legally? How would individuals even know they were being monitored?

These are questions regulators may increasingly need to address as sensing technologies evolve. Canada’s cybersecurity and privacy communities are already examining risks associated with artificial intelligence, facial recognition, and behavioural analytics. Wi-Fi-based identification may soon need to be added to that list.

The researchers are not suggesting that widespread Wi-Fi surveillance is inevitable. Instead, they argue that the findings should act as a warning to industry and standards bodies. Specifically, they are calling for stronger privacy protections to be incorporated into future wireless networking standards, including the emerging IEEE 802.11bf standard, which is expected to support advanced Wi-Fi sensing applications. Thus the researchers hope to reverse that pattern by encouraging privacy protections before the technology becomes commercially widespread.