You do not need to carry a phone, wear a smartwatch, or touch any electronic device for a new surveillance system to track and identify you. Researchers at the Karlsruhe Institute of Technology in Germany have developed a system called BFId that uses ordinary Wi-Fi signals to monitor human movement and distinguish individuals by their walking patterns alone - achieving a reported identification accuracy of 99.5 percent across nearly 200 test participants. The findings have prompted urgent questions from cybersecurity experts and digital rights advocates about a form of surveillance that, unlike cameras or GPS trackers, is effectively invisible.
How the Technology Works - and Why It Is So Difficult to Detect
Wi-Fi signals do not travel through space cleanly. They bend, scatter, and reflect off walls, furniture, and human bodies. When a person moves through a room, their body disturbs these radio waves in subtle, consistent ways - subtle enough to seem negligible, but structured enough for machine learning models to interpret. The BFId system captures those disturbances and converts them into what researchers describe as "radio images": movement signatures derived from a person's gait, body shape, and behavioral patterns.
The method exploits a standard Wi-Fi feature called Beamforming Feedback Information, or BFFI, which was built into Wi-Fi 5 and subsequent network generations to help routers direct signals more efficiently toward connected devices. That functional purpose is legitimate and widely used. The problem, as researchers now document, is that BFFI data also contains enough environmental detail to function as a passive motion sensor - one that requires no modification to existing hardware and no cooperation from the person being observed.
This is what separates BFId from most prior tracking technologies. Conventional surveillance depends on some form of identifiable signal emitted by the subject: a GPS ping, a phone connecting to a cell tower, a face crossing a camera's field of view. BFId requires none of that. The Wi-Fi infrastructure simply needs to exist and be operational - a condition already met in millions of homes, offices, airports, hotels, shopping centers, and public transit hubs around the world.
The Surveillance Implications Experts Find Most Alarming
Cybersecurity analysts point to two compounding risks. The first is the absence of consent. Under any current legal or technical framework, individuals entering a Wi-Fi-covered space have no mechanism to opt out of signal-based behavioral monitoring - because no such monitoring is disclosed, and no standard exists to require disclosure. The second risk is data correlation. Wi-Fi tracking data, taken alone, does not reveal a person's name. But when combined with smartphone location logs, social media activity, building access records, or existing behavioral databases, anonymous movement signatures can become identifiable with considerable precision.
Prof. Triveni Singh, a cybercrime expert and former Indian Police Service officer, has specifically warned that journalists, political activists, and individuals operating in sensitive professional roles face a disproportionate threat if technologies of this kind are misused by state or non-state actors. The concern is not hypothetical. Intelligence agencies and law enforcement bodies in numerous jurisdictions already use a range of passive monitoring techniques; a device-free identification system would represent a significant expansion of that capability.
The broader societal implication is a shift in what privacy in physical space actually means. For decades, the reasonable assumption has been that a person moving through a public or semi-public location - without a phone, without logging into any service - retains a degree of anonymity. BFId challenges that assumption at its foundation. If the research holds under wider scrutiny and the method is refined further, physical anonymity may become substantially harder to maintain anywhere that Wi-Fi infrastructure operates.
What Can Be Done - and What Currently Cannot
The researchers themselves have called on global technology standards bodies and regulatory authorities to strengthen Wi-Fi protocols, specifically by introducing stronger encryption and access controls around BFFI data. At present, that data is not adequately protected under existing wireless standards, and there is no technical barrier preventing a sophisticated actor from capturing and analyzing it without the knowledge of router owners or the people in range of a network.
Practical defenses available to individuals right now are limited. Keeping routers and network firmware updated with the latest security patches reduces exposure to known vulnerabilities, though it does not address the fundamental issue that BFFI-based sensing is a feature of how the protocol operates, not a flaw that patches can eliminate. Encrypted network configurations add a layer of protection against casual interception of signal data, but they do not prevent someone with physical proximity and appropriate equipment from conducting passive environmental sensing.
The more durable solutions will need to come from standards bodies such as the IEEE, which governs Wi-Fi specifications, and from data protection regulators who must determine whether passive behavioral tracking via radio signals falls within the scope of existing privacy law. In many jurisdictions, that legal question remains entirely unresolved. The European Union's General Data Protection Regulation, for instance, covers the processing of personal data but the legal status of Wi-Fi signal disturbance patterns as personal data has not been definitively established. That ambiguity, experts argue, needs to close before the technology matures further - not after.
For now, the KIT study serves as a precise technical demonstration of a vulnerability that has existed quietly inside the infrastructure of modern wireless communication. The Wi-Fi router has been one of the most trusted, mundane fixtures of daily life for two decades. This research forces a reconsideration of what that ubiquitous presence actually makes possible.
