Ordinary WiFi can now identify you with near-perfect accuracy

"By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present," says Professor Thorsten Strufe from KASTEL, KIT's Institute of Information Security and Dependability. "This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition," explains the cybersecurity expert.

Because the technique analyzes radio waves moving through a space, a person does not need to have a phone, smartwatch, or other WiFi enabled device with them. "Thus, it does not matter whether you carry a WiFi device on you or not."

Even turning off your own device would not necessarily prevent the system from working. "It's sufficient that other WiFi devices in your surroundings are active."

Ordinary WiFi Routers Could Become Surveillance Tools

The researchers say the findings reveal a potentially serious privacy risk because WiFi networks are already widespread in homes, offices, restaurants, and public spaces.

"This technology turns every router into a potential means for surveillance," warns Julian Todt from KASTEL. "If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later -- for example by public authorities or companies."

There are currently simpler ways for intelligence agencies or cybercriminals to monitor people, Felix Morsbach notes. Those methods can include gaining access to existing CCTV systems or connected video doorbells.

"However, the omnipresent wireless networks might become a nearly comprehensive surveillance infrastructure with one concerning property: they are invisible and raise no suspicion."

That possibility makes WiFi based monitoring especially notable. Unlike a visible security camera, a wireless network normally gives people no obvious indication that its radio signals could potentially be used to recognize who is nearby.

No Special Surveillance Hardware Is Needed

Earlier approaches to sensing people through wireless signals have often relied on specialized equipment or more complex measurements. Some techniques, for example, use LIDAR sensors, which measure distances by sending out light and analyzing the reflected signal.

Other WiFi based approaches use channel state information (CSI). This refers to measurements showing how a wireless radio signal changes as it travels through an environment and reflects from walls, furniture, people, and other objects.

The new technique does not require that kind of specialized hardware. According to the researchers, a standard WiFi device is enough.

The method takes advantage of normal communications produced by legitimate users connected to a WLAN. WLAN is another term for a wireless local area network, essentially the WiFi network operating within a home, office, café, or similar location.

Connected devices routinely send information back to the router to help optimize wireless communication. These signals, known as beamforming feedback information (BFI), are transmitted without encryption, meaning that anyone within range can potentially read them.

By analyzing that information, the system can generate images of people from multiple viewpoints. Those images can then be used to determine a person's identity.

Once the machine learning model has already been trained to recognize individuals, the identification process takes only a few seconds.

Researchers Achieved Almost 100% Identification Accuracy

The team tested the technique in a study involving 197 participants. Their system was able to infer people's identities with almost 100% accuracy, regardless of the viewing perspective or the way a person walked.

"The technology is powerful, but at the same time entails risks to our fundamental rights, especially to privacy," emphasizes Strufe.

The researchers are particularly concerned about how such technology could be used in authoritarian countries. They warn that WiFi based identification could potentially be applied to monitor protesters or other groups without the obvious surveillance infrastructure associated with conventional cameras.

Because wireless networks are already so common, the researchers argue that privacy protections should be built into future WiFi technology before these capabilities become easier to exploit at scale.

They are therefore calling for protective measures and privacy safeguards to be incorporated into the forthcoming IEEE 802.11bf WiFi standard.

Funding and Publication

The project was funded under the Helmholtz "Engineering Secure Systems" topic.

The researchers presented their results at the "ACM Conference on Computer and Communications Security" (CCS) in Taipei.