Researchers in Germany say a normal WiFi network can be turned into a surprisingly effective identification tool, with a method that allegedly recognized people with 99.5% accuracy. The catch is unsettlingly mundane: the technique relies on signals your router already handles, which means the surveillance risk is baked into everyday infrastructure rather than hidden inside some exotic spy gadget.
The study from Karlsruhe Institute of Technology uses beamforming feedback information, or BFI, alongside machine learning to identify people moving through a network’s range. Unlike older approaches that often need custom hardware or modified firmware, the researchers say BFI can be accessed without special equipment and even without a direct connection to the WiFi network. That makes the privacy problem a lot less theoretical.
How BFI turns movement into an identifier
Beamforming arrived with WiFi 5 to help routers aim signals more efficiently at connected devices. To do that, devices send feedback back to the router, and that feedback is not encrypted, according to the researchers. In other words, a feature designed to improve performance can also leak enough information to distinguish one person from another.
The team says the method can identify people even if they are not carrying any connected device, so long as they are inside the network’s range. Once the model has been trained, the process takes only a few seconds. That is a very fast trip from ”network optimization” to ”quietly tracking pedestrians outside a café.”
What the tests found
In the study, researchers recorded WiFi signals from nearly 200 participants walking through a WiFi field using different walking styles. They compared four viewpoints and tested both the new BFI approach and channel state information, or CSI, an older WiFi sensing technique that watches how signals change as they bounce around a space. CSI was less effective here, but still reached 82.4% accuracy when identifying people by their normal walk.
- BFI-based identification: 99.5% accuracy
- Older CSI approach: 82.4% accuracy
- Participants studied: nearly 200
That gap matters because CSI has long been the more familiar academic route, but it is harder to use in practice. BFI, by contrast, is tied to standard WiFi behavior, which makes the privacy implications harder to dismiss as a lab-only trick.
Why the IEEE standard matters now
The researchers are urging the IEEE to build stronger privacy protections into 802.11bf, the upcoming standard for WiFi sensing applications. That timing is awkward for the industry, because standardizing the feature could also standardize the surveillance risk unless privacy controls arrive with equal ambition.
WiFi sensing is not new in concept: radio signals already reveal a lot about the spaces and bodies they pass through. The difference here is scale. If this kind of identification becomes broadly usable, then the quiet, invisible network in a shop, station, or office stops being just connectivity and starts doubling as a behavioral fingerprinting system. The question is whether standards bodies move fast enough to blunt that before vendors ship the convenience first.