Identifying People Using Wi-Fi Routers

2026-05-26 · Source: Schneier on Security · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Internet of Things (IoT) & Connected Devices · Depth: Intermediate, long

Summary

New research from Germany's Karlsruhe Institute of Technology (KIT) reveals that standard Wi-Fi routers can identify individuals by analyzing their unique walking styles, achieving 82% accuracy among 200 people. This capability, known as Wi-Fi sensing, leverages how radio signals reflect, scatter, or absorb when interacting with people in a physical environment. By comparing expected signal behavior with actual reception, researchers can infer detailed information. While Wi-Fi sensing (IEEE 802.11bf) is already used for applications like fall detection, the KIT study highlights its potential for personal identification without specialized hardware, utilizing existing router-device pairing and a machine learning model. This raises significant privacy concerns, as the underlying signal information is often unencrypted and publicly available, transforming ubiquitous Wi-Fi networks into passive surveillance tools.

Key takeaway

For AI Security Engineers and privacy advocates, this research underscores an urgent need to re-evaluate Wi-Fi network security. Your current infrastructure, even without specialized hardware, can be repurposed for individual identification via walking style, leveraging unencrypted signal data. Prioritize implementing encryption for Wi-Fi sensing data and advocate for robust privacy protections in future wireless standards to prevent ubiquitous routers from becoming silent, pervasive surveillance tools.

Key insights

Standard Wi-Fi routers can identify individuals by analyzing their unique walking styles through unencrypted signal propagation data.

Principles

• EM signal propagation analysis infers environmental details.
• Resolution of EM sensing is wavelength-dependent.
• Unencrypted signal data enables passive surveillance.

Method

Wi-Fi sensing analyzes how radio signals are reflected, scattered, or absorbed by people. A machine learning model deconvolves Received Signal Strength (RSS) data from multiple paths to create a more precise image, identifying individuals by their walking style.

In practice

• Detecting falls in senior persons (IEEE 802.11bf).
• Passive surveillance and individual identification.
• Linking biometric data to payment card identities.

Topics

• Wi-Fi Sensing
• Privacy Vulnerability
• Radio Frequency Surveillance
• Machine Learning
• Biometric Identification
• Wireless Security

Best for: CTO, VP of Engineering/Data, Executive, AI Security Engineer, Policy Maker, AI Ethicist

Related on AIssential

• Ordinary WiFi can now identify people with near perfect accuracy — Standard WiFi routers can identify individuals with near-perfect accuracy using AI and unencrypted signal reflections, posing significant privacy risks.
• FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems — FlowGuard detects data-free model stealing in energy IDS by identifying synthetic queries as out-of-distribution via flow matching.
• AI allows hackers to identify anonymous social media accounts, study finds — LLMs significantly simplify de-anonymization of social media accounts, posing a new privacy risk.
• Private analytics via zero-trust aggregation — A zero-trust private analytics solution combines one-shot cryptographic aggregation with TEEs for robust, multi-layered data protection.
• Friday Squid Blogging: Regulating Squid Fishing in the South Pacific — The "gap twixt physical object and sensor" makes digital identity verification inherently vulnerable to circumvention.
• SecureRouter: Encrypted Routing for Efficient Secure Inference — SecureRouter accelerates encrypted AI inference via input-adaptive model selection and MPC-optimized model pools.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Schneier on Security.