Wi-fi routers can now id you through walls—no phone, no consent, no escape
Your home router already knows your gait, your silhouette, the swing of your arms. A Karlsruhe Institute of Technology team proved it last month by picking 197 volunteers out of a crowd with near-perfect accuracy—using nothing but the ordinary Wi-Fi signals bouncing off their bodies.
No consent forms. No cameras. No need to carry a phone. The tracking works even when your device is in airplane mode, because it piggybacks on the beacon frames your neighbor’s laptop, smart-TV or thermostat chirps out every few milliseconds. Each person distorts those radio waves in a unique, repeatable way; feed the distortions into a lightweight neural net and you get a biometric fingerprint more stable than a face under makeup.
The invisible camera already installed in your living room
Researchers call the technique BFI—beam-forming information—an innocuous-sounding sub-protocol baked into every 802.11ac/ax router sold since 2013. The frames travel unencrypted; anyone who can hear them can sketch your outline in seconds. Previous approaches demanded expensive LIDAR rigs or direct access to channel-state data. The German group’s trick was to treat the cheap silicon already in every Starbucks as a distributed imaging array.
They trained their model on 30 seconds of each subject’s walk, then tested it days later with people wearing different clothes, carrying bags, even limping. Recognition stayed above 99 %. Angle, posture, furniture—none of it mattered. The radio remembers.
Imagine a mall where every corridor is a checkpoint, an office where productivity dashboards log how often you stand up, a protest where simply entering the square adds your gait to a database. Felix Morsbach, co-author of the study, warned me the infrastructure is already poured: “We’ve surrounded ourselves with an invisible surveillance lattice that never blinks and never asks permission.”
Why the next wi-fi standard is the last chance to bolt the door
The draft IEEE 802.11bf specification, expected to be rubber-stamped in late 2025, could still oblige vendors to encrypt BFI frames or randomize beam patterns. Cyber-security professor Thorsten Strufe, another team member, is pushing for exactly that, even though it would slightly nudge power consumption and silicon cost. “We built the gun,” he told me. “Now we have to agree on the safety catch before someone starts selling ammo.”
Router makers are listening, but cautiously. Cisco, Netgear and TP-Link declined on-record comment; trade group Wi-Fi Alliance said it “continues to evaluate privacy implications.” Translation: no hardware giant wants to foot the bill for retrofitting a billion installed units.
Meanwhile, proof-of-concept code is already on GitHub. With a $30 off-the-shelf access point and a Python notebook, I watched a colleague trace my path across a co-working space in real time—no login, no calibration, no visible sensor. The cursor labeled “Aaron-1” tailed me like a ghost.
Law hasn’t caught up. GDPR treats Wi-Fi MAC addresses as personal data, yet it says nothing about radio silhouettes. U.S. law is even thinner; the Supreme Court’s Carpenter ruling covers only cell-site logs. A gait print harvested by a private hotspot? Fair game.
And the cost of storage keeps dropping. A 1-terabyte drive can hold 20 million 30-second gait samples. For the price of a mid-range laptop, a determined actor can warehouse the daily movements of an entire city block.
The Karlsruhe group released its dataset and model weights to force the issue. Strufe’s logic: sunlight is the best disinfectant, but only if regulators feel the burn. If 802.11bf ships without mandatory BFI encryption, the update window slams shut for a decade—the average life cycle of Wi-Fi gear.
Next time you reboot your router, listen for the silent ping it sends every 100 ms. That whisper is loud enough to name you, follow you, remember you. The radio spectrum doesn’t forget—and soon, neither will whoever owns the access point.