German researchers have warned that regular WiFi networks could become an invisible and powerful new form of surveillance. They demonstrated a system that uses standard radio signals and artificial intelligence to identify people with remarkable accuracy, even if they are not carrying an active device.
“By observing the propagation of radio waves, we can create an image of our surroundings and the people in them,” says Professor Thorsten Strufe from KASTEL, KIT’s Institute for Information Security and Dependability. “It works like a regular camera, but the difference is that in our case radio waves are used for recognition instead of light waves,” explains the cybersecurity expert. “So it doesn’t matter whether you carry a WiFi device or not.”
Simply turning off your smartphone is not enough to avoid detection. Researchers say nearby wireless devices connected to the network still generate enough signal activity for the system to work.
WiFi routers can become hidden surveillance tools
The researchers say the technology could turn everyday routers into silent surveillance systems that operate without attracting attention.
“This technology turns any router into a potential surveillance tool,” warns KASTEL’s Julian Todt. “If you regularly pass by a cafe that operates a WiFi network, you could be unknowingly identified there and later recognized by public authorities, businesses, etc.”
Researcher Felix Molsbach points out that intelligence agencies and cybercriminals now have easy ways to monitor people, including hacked security cameras and Internet-connected doorbells. But WiFi networks pose unique concerns because they are nearly ubiquitous and largely invisible, he said.
“But ubiquitous wireless networks can become a near-comprehensive surveillance infrastructure, including on property; they are invisible and do not arouse any suspicion.”
Wireless networks are now commonplace in homes, offices, restaurants, airports, and public spaces around the world, and this technology has potentially enormous impact.
No special hardware required
Unlike previous experimental systems that relied on expensive sensors and specialized equipment, this new method works with regular WiFi hardware already installed in most homes and businesses.
Previous approaches often relied on channel state information (CSI), which measures how wireless signals change after reflections from walls, furniture, and people. The new technology instead relies on normal communication between a WiFi router and connected devices.
Devices on your wireless network periodically send feedback data called beamforming feedback information (BFI) to your router. This information is transmitted unencrypted and may be readable by anyone within range. Researchers say the reflection of these signals effectively creates multiple “perspectives” on a person, allowing AI systems to learn and recognize a person’s identity.
Once the machine learning model is trained, it reportedly takes just a few seconds to identify a person.
Near-perfect accuracy raises privacy concerns
In tests with 197 participants, the system identified individuals with nearly 100% accuracy, the researchers said. Recognition was valid regardless of the viewing angle or the participant’s walking style.
“While this technology is powerful, it also carries risks to our fundamental rights, especially to our privacy,” Strouffe emphasizes.
Researchers are particularly concerned about how the technology could be used in authoritarian countries to monitor protesters and track them without their knowledge. They are calling for stronger privacy protections and safeguards to be included in the upcoming IEEE 802.11bf WiFi standard.
This project was funded under the Helmholtz “Engineering of Secure Systems” topic. The team will present their findings at the ACM Conference on Computer and Communications Security (CCS) in Taipei.
