“Better the devil you know ...” That’s a worst-case scenario outlook. The best case is an angel you know. But what if that angel was somewhat of a devil all along? Researchers have shown that ordinary Wi-Fi technology can serve as a powerful surveillance tool.
Researchers at Germany’s Karlsruhe Institute of Technology (KIT) have shown that ordinary Wi-Fi traffic can identify individuals with almost 100% accuracy, without a camera, dedicated sensing hardware, or requiring the person being watched to carry a phone or any device at all.
The enabling system, created by the researchers, uses machine learning to analyze information that Wi-Fi devices already send back to their routers. As a person moves through the room, their body physically alters the radio waves traveling through it. Those alterations contain enough biometric information for the system to "learn" a person and later distinguish them from everyone else, much like a radio fingerprint.
In a study of 197 participants, the system correctly identified individuals regardless of the viewing angle or how they walked. Once the underlying machine learning model has been trained, tagging a person takes only a few seconds.
So how does a router become a surveillance sensor? The key is something called beamforming feedback information (BFI). To keep a connection strong, your phone or laptop constantly tells the router how it is receiving the signal, so the router can aim its transmissions more precisely. Wi-Fi devices produce that BFI feedback continuously.
The radio waves bounce around a room and wash over everything in it, including you. Your body, with its particular shape, height, and posture, distorts those waves in a way that is subtly your own. If an AI model has enough of these distortions, it learns your radio signature, much like a camera-based system learns a face.
Unfortunately, BFI travels unencrypted.
A malicious device doesn't have to break into the Wi-Fi network to collect it. Because beamforming reports are broadcast back to the access point in the clear, a Wi-Fi adapter within range can passively record them in monitor mode. The person being identified also doesn't have to own any of the devices involved. Traffic between somebody else's router and somebody else's laptop, say in a random coffee shop or an airport, can provide the radio field that your body disturbs to create your specific signature.
Another unsettling aspect is that it does not fall for the obvious workarounds. A system that recognized you by your walk could be fooled by walking differently, and one that only worked head-on could be dodged with a sideways approach. A signature that was tested held its accuracy across viewing angles and across gaits, providing more reliable identification than a camera.
One important clarification. The system is similar to a fingerprint scanner. While it can capture your signature, it doesn't automatically know who you are. It first needs reference recordings. In the researchers' main experiment, the machine-learning model was trained on some recordings of each participant and then asked to determine which known participant produced new recordings. However, that qualification hardly addresses the privacy concerns.
With a fingerprint, someone generally has to obtain your print and link it to your identity. You are also usually aware when you're pressing a finger onto a scanner. A radio fingerprint can potentially be gathered while you simply walk through a Wi-Fi-covered space, without touching anything, carrying anything, or knowing that biometric information is being collected at all.
Even more worrisome is the fact that Wi-Fi devices are quite literally everywhere. Wi-Fi networks already hum away in homes, offices, airports, cafes, and shops worldwide, giving a technique like this enormous potential reach. Cameras, for all their creepiness, are at least visible. You can see one, avoid its lens, or point at it in a meeting.
A surveillance layer riding on the Wi-Fi already in the walls raises no suspicion at all. The researchers warn that this is exactly what makes it dangerous. They flag authoritarian settings in particular, where the same trick could be turned on protesters without any of the obvious hardware that usually gives surveillance away.
Rather than simply raising the alarm, the team is pushing for a fix at the level of the standard itself.
They want privacy safeguards built directly into IEEE 802.11bf, the upcoming Wi-Fi standard that formalizes wireless sensing, framing it as one of the last clean opportunities to bake protection into the protocol before the capability spreads. The work was funded under the Helmholtz "Engineering Secure Systems" program, and the 197-person dataset has been released for non-commercial research, so other groups can probe both the attack and the defenses against it.
The team presented its work, titled “BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information,” at the ACM Conference on Computer and Communications Security (CCS) in Taipei.
