KIT researchers identified 197 people with a standard WiFi router — no cameras needed

The radio waves that carry your home WiFi signal already know who is in the room. Researchers at the Karlsruhe Institute of Technology spent two years proving it.

Their system requires no hardware beyond a standard router. It reads beamforming feedback information — a set of unencrypted signals that WiFi devices and routers exchange continuously to optimize transmission. Those signals create a form of radio-wave portrait of the people moving through a space. The way a human body scatters electromagnetic radiation turns out to be specific enough, and consistent enough, to serve as an identifier.

In a study of 197 participants, the system correctly identified individuals with near-100% accuracy. Recognition required only a few seconds after initial model training, and it worked regardless of the angle from which a person approached or their walking pattern — two variables that defeat many camera-based systems. The paper, ‘BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information,’ was accepted at the ACM Conference on Computer and Communications Security in Taipei, one of the leading academic venues for security research.

What separates this from earlier WiFi-sensing research is the signal it exploits. Prior approaches required specialized LIDAR hardware or detailed channel state information measurements that demand firmware access to the router. Beamforming feedback information is already in the air, already unencrypted, and already parseable by any device within radio range. ‘This technology turns every router into a potential means for surveillance,’ said Julian Todt, one of the paper’s authors at KIT’s KASTEL security institute.

The team developed BFId specifically as a demonstration of what passive surveillance already makes possible. The system can detect that an unknown person is present, and once it has observed a known individual once, it recognizes them on every subsequent pass. There are no lights, no activation sounds, and no indication to the person being identified that anything is happening.

Some limits are worth noting. Testing took place in controlled environments; how well the technique holds up in dense apartment buildings with overlapping WiFi networks has not been established. The model requires prior observation to build a signature for each person — a stranger encountered for the first time gets detected as present, not named. The signal range is bounded by the router’s radio coverage, not unlimited.

The researchers are calling for privacy safeguards in the upcoming IEEE 802.11bf WiFi standard — a protocol amendment deliberately adding sensing capabilities to WiFi. Their argument is that beamforming feedback already enables surveillance unintentionally, and that 802.11bf is a chance to design protections into the standard before the capability becomes widespread. The WiFi router you own may already be watching. The next generation was designed to.

Tags: Cybersecurity, beamforming, BFId, IEEE 802.11bf, Karlsruhe Institute of Technology, KIT