Your WiFi Router Can Identify You Without Cameras

Your WiFi Router Can Identify You Without Cameras — Nearly 100% Accuracy

Researchers at Germany's Karlsruhe Institute of Technology have shown that ordinary WiFi networks can identify people with nearly 100% accuracy — using only the unencrypted beamforming feedback signals that phones and routers exchange as a matter of routine. In a test with 197 participants, the system recognized individuals within seconds, even from different angles, and it works whether or not the person carries any device.

Key Takeaways

Researchers at Germany's Karlsruhe Institute of Technology have shown that ordinary WiFi networks can identify people with nearly 100% accuracy — using only the unencrypted beamforming feedback signals that phones and routers exchange as a matter of routine.
In a test with 197 participants, the system recognized individuals within seconds, even from different angles, and it works whether or not the person carries any device.

AI synthesis3 sources14

A privacy warning from cybersecurity researchers: the WiFi network in a café, office, or home could be used to identify you without a camera, without a sensor, and without your phone — because the radio signals themselves carry enough information.

A team at KASTEL, the cybersecurity institute of Germany's Karlsruhe Institute of Technology (KIT), has demonstrated that ordinary WiFi can recognize people with nearly 100% accuracy. The technique exploits beamforming feedback information (BFI) — unencrypted signals that connected devices routinely send to routers to optimize wireless communication. Anyone in range can read them.

"By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present," says Professor Thorsten Strufe. "This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used."

Because the method relies on signals bouncing off people's bodies, the target doesn't need to carry a phone, smartwatch, or any WiFi device — and even turning your own device off doesn't help if other devices nearby remain active. In tests with 197 participants, the system inferred identities with almost 100% accuracy regardless of viewing perspective or walking style, and identification took only seconds once the model was trained.

The researchers see serious implications for privacy and surveillance. "This technology turns every router into a potential means for surveillance," warns Julian Todt. Someone who regularly passes a café with a WiFi network could be identified there without noticing — and later recognized by authorities or companies. Unlike a visible security camera, WiFi-based monitoring is invisible and raises no suspicion.

The team is particularly concerned about use in authoritarian countries, where such identification could be applied to monitor protesters without the obvious infrastructure of conventional cameras. They are calling for privacy safeguards to be built into the forthcoming IEEE 802.11bf WiFi standard. The findings were presented at the ACM Conference on Computer and Communications Security in Taipei.