Could Your Wi-Fi Recognise You Without a Camera?
Researchers have shown how ordinary Wi-Fi equipment could identify people through the movement of wireless signals, raising new questions about privacy and the future of network security.
Wi-Fi is already all around us. It runs through our homes, offices, cafés, schools and public spaces, quietly keeping devices connected throughout the day.
But new research has demonstrated that those same wireless signals could potentially be used for something very different: recognising people without a camera, facial recognition system or wearable device.
Researchers at Germany’s Karlsruhe Institute of Technology have developed a method known as BFId, which uses information exchanged between ordinary Wi-Fi devices and routers to create radio-based representations of people.
In tests involving 197 participants, the researchers achieved identification accuracy of up to 99.5%.
The findings offer a fascinating look at what wireless technology can do, but they also raise serious questions about privacy, surveillance and the information being transmitted around us every day.
How can Wi-Fi identify someone?
Wi-Fi signals do not simply travel directly between a router and a connected device. They move through a physical environment, reflecting off walls, furniture, objects and people.
When someone enters or moves through a room, their body changes the way those signals travel.
The researchers found that these changes could be analysed to produce a radio-based representation of the person in the space. Machine learning could then compare that information with previously collected data and attempt to recognise the individual.
It works in a similar general way to a camera capturing light, except this method interprets radio waves instead.
The technique focuses on beamforming feedback information, or BFI. This is information routinely exchanged by compatible Wi-Fi equipment to help a router direct its signal more effectively towards connected devices.
Crucially, this feedback can be transmitted without encryption and potentially observed by equipment within wireless range.
You would not need to carry a connected device
One of the most surprising parts of the research is that the person being observed does not need to be carrying a smartphone, smartwatch or any other connected device.
The system examines how nearby wireless signals are affected by the person’s presence. As long as other compatible Wi-Fi devices are communicating in the surrounding area, the person could potentially be detected.
Turning off your own phone’s Wi-Fi would therefore not necessarily prevent this form of identification.
Unlike several earlier Wi-Fi sensing methods, BFId was also demonstrated using standard Wi-Fi hardware rather than specialist cameras, LiDAR systems or dedicated motion sensors.
Once trained to recognise a particular individual, the research system could make an identification within seconds.
Does this mean any router can identify you today?
Not quite.
The research does not mean that every office router is currently scanning employees or that somebody can immediately identify any stranger through their Wi-Fi network.
The system must first collect suitable information and train its machine-learning model to recognise the people it is looking for. The study was also carried out under controlled research conditions, which will not perfectly reflect every workplace, public venue or wireless environment.
There is still an important difference between demonstrating that something is technically possible and deploying it reliably at scale.
However, the research shows that data already produced by widely available technology could reveal considerably more than its users expect. As the tools and machine-learning models improve, the barrier to using these techniques may become lower.
Why this matters for businesses
Wi-Fi has traditionally been viewed as part of a company’s connectivity infrastructure. Businesses think about coverage, speed, passwords, guest access and preventing unauthorised connections.
This research introduces a wider question: what other information could wireless infrastructure reveal?
The concern is not limited to somebody breaking into a network. An attacker may potentially be interested in the signals and information being transmitted around it.
For organisations, this could eventually create risks relating to:
- Employee and visitor privacy
- Unauthorised monitoring of sensitive locations
- Tracking movement around offices or public premises
- The collection of biometric-style identification data
- Compliance and data protection responsibilities
- The security of future Wi-Fi sensing technology
The same underlying technology could also support legitimate uses, including detecting falls, monitoring room occupancy and improving smart-building systems. As with many new technologies, its value or danger will depend on who controls it, how transparently it is used and what safeguards are applied.
What can organisations do now?
There is not currently a single setting that completely resolves the privacy concern raised by this research. The researchers themselves have called for stronger protection to be considered within future Wi-Fi standards.
However, businesses can still take sensible steps to improve the security and oversight of their wireless environments:
- Keep routers, access points and connected devices fully updated
- Replace unsupported or outdated networking equipment
- Separate corporate, guest and connected-device networks
- Monitor for rogue or unauthorised wireless equipment
- Control physical access to networking infrastructure
- Review where access points are positioned and how far signals extend
- Maintain an accurate record of every device connected to the network
- Work with experienced specialists when designing or upgrading wireless infrastructure
These measures will not remove every theoretical form of Wi-Fi sensing, but they will reduce avoidable exposure and make the wider network easier to govern.
The meaning of network security is changing
The most important lesson from this research is that cybersecurity can no longer focus only on passwords, firewalls and whether somebody has successfully logged into a network.
Modern infrastructure continuously generates information, sometimes in ways that were never intended when the technology was first introduced.
A signal designed to improve Wi-Fi performance may also reveal the presence, movement and potentially the identity of a person nearby.
For businesses, secure connectivity must therefore combine performance with visibility, responsible management and an understanding of emerging risks.
At Logixal, we help organisations design, manage and secure the technology that keeps their people connected. From business Wi-Fi and network infrastructure to managed IT and cybersecurity, our team can help you understand what is operating across your environment and where improvements may be needed.
If you would like to review the security, performance or management of your current network, speak to the Logixal team.
Research source: Karlsruhe Institute of Technology, “BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information”.
