Many people believe that revoking certain microphone privileges on their phones or smart devices is enough to avoid digital surveillance. However, a new study from Germany shows that this is not the case. Even something as simple as the WiFi router in a local coffee shop could be used to identify individuals.
Researchers at the Karlsruhe Institute of Technology (KIT) have developed a system that can identify people using only the wireless signals from standard WiFi routers. Their method, called BFId, achieved 99.5% accuracy when tested on 197 subjects, the largest dataset to date in WiFi-based identification studies. The system identifies people without special hardware or direct network access, even when they are not carrying a device.
These results, presented at the 2025 ACM Conference on Computer and Communications Security in Taipei, raise new questions about whether current privacy protections are enough for a surveillance method that uses technology already found in everyday places.
Using Radio Waves to Sense Surroundings
BFId is difficult to defend against because it exploits how modern WiFi routers work. WiFi 5 routers use a feature called beamforming, which directs wireless signals toward connected devices instead of sending them in all directions. To do this, devices on the network regularly send back signal feedback, known as beamforming feedback information (BFI), so the router can adjust its signal.
These feedback signals travel through the air unencrypted. That means anyone nearby with a regular WiFi adapter set to monitor mode can pick them up and read them, no hacking or special access required, just being close enough and running the right software.
BFI is valuable for identification because it captures how signals bounce off people and objects, creating multiple snapshots of anyone moving nearby. Earlier WiFi identification methods relied on something called channel state information, which provided only a single viewpoint per device. BFId, by contrast, gathers multiple perspectives at once, giving AI models a much richer set of data to work with. Once trained, the system can recognize someone in just a few seconds.
“By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present,” said Professor Thorsten Strufe, a cybersecurity researcher at KIT’s KASTEL security institute. “This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition. Thus, it does not matter whether you carry a WiFi device on you or not.”
Existing Infrastructure for Surveillance
Researchers have previously shown that WiFi signals can detect human presence or movement. BFId differs because it does not require any new equipment. Every WiFi 5 router in homes, offices, airports, and cafés already generates BFI. The infrastructure for this type of surveillance already exists, even if scientists have not yet used it for identification.
“This technology turns every router into a potential means for surveillance,” said Julian Todt, one of the study’s co-authors. “If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later, for example by public authorities or companies.”
Researcher Felix Morsbach noted that intelligence agencies and other groups already have direct surveillance tools at their disposal. However, the widespread presence of wireless networks changes the situation. Security cameras and internet-connected doorbells require installation in specific places, while WiFi networks exist almost everywhere and often go unnoticed.
“The omnipresent wireless networks might become a nearly comprehensive surveillance infrastructure,” Morsbach warned, “with one concerning property: they are invisible and raise no suspicion.”
Regulations Required
The researchers call for stronger privacy protections in the upcoming IEEE 802.11bf WiFi standard, which will formalize WiFi sensing as a feature. They are concerned that without clear safeguards, the same technology used for smart home applications and building security could also be used for identification and tracking.
The team found that the technology is already accurate enough for use, achieving 99.5% accuracy across different walking styles and viewing angles. However, the rules and regulations needed to control its use are not yet in place.
Austin Burgess is a writer and researcher with a background in sales, marketing, and data analytics. He holds an MBA, a Bachelor of Science in Business Administration, and a data analytics certification. His work focuses on breaking scientific developments, with an emphasis on emerging biology, cognitive neuroscience, and archaeological discoveries.