Wi-Fi routers turned into surveillance devices

If you pass by a cafe that operates a Wi-Fi network, you can potentially be identified — even if you do not carry a mobile phone with you.

That’s according to researchers from Karlsruhe Institute of Technology (KIT), who have found a way to identify people solely through recording Wi-Fi communication. The team presented their findings at the 2025 ACM Conference on Computer and Communications Security (CCS), held this week in Taipei.

The method works by exploiting the communication of legitimate users of a WLAN, whose devices are connected to the Wi-Fi network. These regularly send feedback signals within the network, also called beamforming feedback information (BFI), to the router — in unencrypted form so that it is readable by anybody in range. This creates patterns comparable to images shot by cameras from different perspectives — just based on radio waves — which can serve to identify the respective persons. Once the underlying machine-learning model has been trained, the identification only takes a few seconds.

“By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present,” said Professor Thorsten Strufe from KIT’s KASTEL – Institute of Information Security and Dependability. “This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition. Thus, it does not matter whether you carry a Wi-Fi device on you or not.”

Unlike attacks with LiDAR sensors or previous Wi-Fi-based methods, which use channel state information (CSI) — ie, measured data that indicate how a radio signal changes when it reflects off walls, furniture or persons — the new method does not require any special hardware outside of a standard Wi-Fi device. Furthermore, switching off your own device does not help: “It’s sufficient that other Wi-Fi devices in your surroundings are active,” Strufe said.

In a study with 197 participants, the team could infer the identity of persons with almost 100% accuracy — independently of the perspective or their gait. As noted by KIT’s Julian Todt, “This technology turns every router into a potential means for surveillance. If you regularly pass by a cafe that operates a Wi-Fi network, you could be identified there without noticing it and be recognised later — for example, by public authorities or companies.”

KIT’s Felix Morsbach acknowledged that there are easier methods for secret services or cybercriminals to observe people right now — for example, by accessing CCTV cameras or video doorbells.

“However, the omnipresent wireless networks might become a nearly comprehensive surveillance infrastructure with one concerning property: they are invisible and raise no suspicion,” he said. Indeed, Wi-Fi networks exist in most homes, offices, restaurants and public spaces today.

“The technology is powerful, but at the same time entails risks to our fundamental rights, especially to privacy,” Strufe said. The researchers said this is particularly critical in authoritarian states where the technology might be used for the observation of protesters. Therefore, they are urgently calling for protective measures and privacy safeguards in the forthcoming IEEE 802.11bf Wi-Fi standard.

Image credit: iStock.com/ronstik