AINEWS
Researchers at the Karlsruhe Institute of Technology (KIT) show that the signal aiming routine (beamforming) baked into WiFi 6 and 7 can re identify people from radio reflections, with no device required on the target.
Walk past a café with an open WiFi network, and the router on the counter could, in principle, recognize you, even if you are not carrying a phone, a laptop, or any WiFi-enabled device. A team at the Karlsruhe Institute of Technology has shown that the beamforming signal that every modern WiFi 6 or 7 router uses to aim its radio waves is also enough to identify the people walking through its coverage area with 99.5% accuracy on a controlled test set, by reading the radio reflections bouncing off them (ScienceDaily summary; paper, ACM CCS 2025).
The mechanism the team exploits is called Beamforming Feedback Information, or BFI. To focus a radio beam at a client device, an 802.11ax or 802.11be router asks nearby devices to report back how strong the signal looks from their side. The router steers its next transmission based on those replies, and the exchange happens automatically, in the clear, on every modern WiFi network. BFI is not a feature any operator chose to enable. It is a routine baked into the protocol.
In a paper presented at ACM CCS 2025, Julian Todt, Felix Morsbach, and Thorsten Strufe, all at KASTEL, KIT's Institute of Information Security and Dependability, recorded BFI traces from 197 volunteers walking through normal sequences of movement and trained a classifier on 740 features extracted from the beamforming feedback (KIT record; full PDF). The reported result: 99.5% re-identification accuracy on the test set, versus 212 features and noticeably weaker performance using the older Channel State Information, or CSI, approach (independent cross-check of the 99.5% figure and BFI-versus-CSI feature counts). The team has published the 197-person dataset on radar-service.eu so other researchers can replicate the number.
Strufe frames the technique in plain terms. "By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present," he says. "This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition. Thus, it does not matter whether you carry a WiFi device on you or not. It's sufficient that other WiFi devices in your surroundings are active."
That conditional is the part that changes the privacy framing. The attack doesn't need the target's own phone to be on. Any other nearby WiFi client, the next table's laptop, a stranger's smartwatch, the café's own access point probing for clients, provides enough beamforming traffic for the receiver to map who is in the room. The system the team built is not a product. The underlying radio exchange happens whether or not anyone has installed anything new. Any 802.11ax or 802.11be router is a candidate sensor, and the paper's authors flag home, office, restaurant, and public-space networks as already widespread.
Todt puts the consequence plainly. "This technology turns every router into a potential means for surveillance. If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later, for example by public authorities or companies," he says. Morsbach, for his part, treats BFId as one tool in a larger surveillance toolkit, noting that intelligence agencies and cybercriminals already have simpler tracking methods. The contribution is a new read on the WiFi that is already in the air.
The mitigation surface the paper points at is the standard itself. IEEE 802.11bf, the WLAN sensing amendment, is the standard that will formalize WiFi-based sensing, and the authors argue for mitigations to be considered inside that process, before the sensing use cases lock the protocol in a way that makes the re-identification path a permanent feature.
The next 802.11bf comment cycle is the one window the team is pointing at. The 197-person dataset is open for replication, the paper is peer-reviewed, and the question of what the working group does with the beamforming feedback channel in its next round of edits is the decision that determines whether WiFi stays a connectivity layer or also becomes a passive identification layer built into the protocol.