Researchers Warn: WiFi Could Become an Invisible Mass Surveillance System

Researchers say a new technology can identify individuals even when they are not carrying a WiFi device by passively recording signals in radio networks, raising serious privacy concerns and prompting calls for stronger protections.

Walking past a café with an active WiFi network could be enough for you to be identified, even if you are not carrying a cell phone. Researchers at the Karlsruhe Institute of Technology (KIT) have shown that people can be recognized solely by recording WiFi communication in their surroundings, a capability they warn poses a serious threat to personal privacy.

The method does not require individuals to carry any electronic devices, nor does it rely on specialized hardware. Instead, it makes use of ordinary WiFi devices already communicating with each other nearby. As radio waves move through a space and interact with people, they create distinctive patterns that can be captured and analyzed. These patterns are comparable to images produced by cameras, but they are formed using radio signals rather than light. The research team argues that this emerging capability highlights the urgent need for stronger privacy protections.

“By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present,” says Professor Thorsten Strufe from KASTEL (KIT’s Institute of Information Security and Dependability). “This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition,” explains the cybersecurity expert. “Thus, it does not matter whether you carry a WiFi device on you or not.”

Turning off your own device offers no protection, he adds, because “it’s sufficient that other WiFi devices in your surroundings are active.”

WiFi Routers as “Quiet Observers”

“This technology turns every router into a potential means for surveillance,” warns Julian Todt from KASTEL. “If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later, for example by public authorities or companies.”

Felix Morsbach notes that intelligence agencies or cybercriminals currently have simpler ways to monitor people, such as accessing CCTV systems or video doorbells. “However, the omnipresent wireless networks might become a nearly comprehensive surveillance infrastructure with one concerning property: they are invisible and raise no suspicion.”

WiFi networks are now found in most homes, offices, restaurants, and public spaces.

No Special Hardware Require

Unlike attacks that rely on LIDAR sensors or earlier WiFi-based techniques that use channel state information (CSI), meaning measurements of how radio signals change when they reflect off walls, furniture, or people, this approach does not require specialized equipment. Instead, it can be carried out using a standard WiFi device.

The method takes advantage of normal network communication between connected devices and the router. These devices regularly send feedback signals within the network, known as beamforming feedback information (BFI), which are transmitted without encryption and can be read by anyone within range.

By collecting this data, images of people can be generated from multiple perspectives, allowing individuals to be identified. Once the machine learning model has been trained, the identification process takes only a few seconds.

Almost 100% Accuracy – Technology Entails Risks to Privacy

In a study with 197 participants, the team could infer the identity of persons with almost 100% accuracy – independently of the perspective or their gait.

“The technology is powerful, but at the same time entails risks to our fundamental rights, especially to privacy,” emphasizes Strufe.

The researchers warn that this is particularly critical in authoritarian states where the technology might be used for the observation of protesters. Therefore, they urgently call for protective measures and privacy safeguards in the forthcoming IEEE 802.11bf WiFi standard.

Reference: “BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information” by Julian Todt, Felix Morsbach and Thorsten Strufe, 22 November 2025, CCS ’25: Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security.
DOI: 10.1145/3719027.3765062

The project was funded under the Helmholtz “Engineering Secure Systems” topic.

Never miss a breakthrough: Join the SciTechDaily newsletter.
Follow us on Google and Google News.