Ordinary Wi-Fi Can Identify People With Near-Perfect Accuracy, Study Finds

Researchers at Germany's Karlsruhe Institute of Technology (KIT) have shown that ordinary Wi-Fi traffic already flowing between everyday devices and routers can identify individual people with almost 100% accuracy — without a camera, a special sensor, or the person carrying any device at all.

The technique relies on beamforming feedback information (BFI), data that a phone or laptop constantly sends back to a router so it can aim its signal more precisely. As a person moves through a room, their body's shape, height and posture subtly distort the radio waves bouncing around it. A machine-learning model trained on those distortions can learn a person's individual radio signature, much as a camera-based system learns a face.

In a study of 197 participants, the KIT team's system correctly identified individuals regardless of the angle they were viewed from or how they walked, once the model had been trained on reference recordings of each person — a process the researchers compare to a fingerprint scanner that first needs a print on file. After training, tagging a person from fresh Wi-Fi traffic took only a few seconds.

The researchers warn the method raises serious privacy concerns because BFI travels unencrypted. A Wi-Fi adapter within range can passively record it in monitor mode without breaking into the network, and the traffic used to build a signature does not even have to come from the target's own device — a router and laptop belonging to strangers in a coffee shop or airport can supply the radio field a body disturbs. Unlike a camera, which can be seen and avoided, the technique leaves no visible trace, and the researchers specifically flagged the risk of it being used against protesters in authoritarian settings.

The team is now pushing for privacy safeguards to be built directly into IEEE 802.11bf, the upcoming Wi-Fi standard that formalizes wireless sensing. The research, funded under the Helmholtz "Engineering Secure Systems" programme and titled "BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information," was presented at the ACM Conference on Computer and Communications Security in Taipei, and the 197-person dataset has been released for non-commercial research.