WiFi routers can identify you with 99.5% accuracy — no device needed
The router in the corner of the room just became a surveillance tool. New research from Germany's Karlsruhe Institute of Technology shows ordinary WiFi networks can identify who's in a room with near-perfect accuracy — no cameras, no special sensors, and no device required on the person being tracked.
Researchers at the Karlsruhe Institute of Technology (KIT) demonstrated that standard WiFi routers can identify individuals with 99.5 percent accuracy, using nothing but the unencrypted signals devices already exchange with routers.
The system, called BFId, was presented at the ACM Conference on Computer and Communications Security in Taipei. It exploits beamforming feedback information (BFI) — the compressed reports that connected devices send back to routers to steer signal beams. Those reports travel unencrypted, and because they describe how radio waves bounce off walls, furniture, and human bodies, an eavesdropper can reconstruct radio-based images of everyone in a room. A machine learning model trained on those images then recognizes specific people within seconds.
In tests with 197 participants, the system identified individuals with 99.5 percent accuracy regardless of viewing angle or how they walked — up from 82.4 percent for earlier channel-state-information approaches, on the largest dataset yet used in WiFi-based identification research. The person being tracked doesn't need to carry a phone, smartwatch, or any WiFi device at all: the technique only requires other active devices in the area to keep generating BFI data, so even turning your own device off doesn't help. Any WiFi adapter in monitor mode can passively capture the signals — no password, no network access, no special hardware.
The researchers warn this turns every router into a potential surveillance instrument that is invisible and raises no suspicion, and they flag the obvious nightmare scenario: authoritarian governments identifying protesters or dissidents without any visible surveillance infrastructure. Countermeasures are thin. Reducing BFI report frequency barely dented accuracy, and the real fix — encrypting BFI at the protocol level — would break backward compatibility with billions of deployed devices. The team is instead pushing for privacy safeguards in the upcoming IEEE 802.11bf standard, which formalizes WiFi sensing for motion detection and presence tracking.
This is the familiar pattern: the capability ships first, the rules arrive later — if they arrive at all. The identification is fundamentally a machine learning model trained on radio reflections of your body, and before this paper, the only thing missing was the software. Now it's published, peer-reviewed, and free to read.
What to watch: Whether IEEE folds privacy protections into 802.11bf before the standard ships.
If WiFi-based identification becomes practical, should router makers be required to encrypt beamforming data even if it breaks older devices? Tell us in the comments.
Sources: KIT press release · BFId paper (ACM CCS) · ScienceDaily · Tom's Hardware
