Router Recognizes People in the Room Even Without Connected Devices: Discovery from Germany
A group of researchers from the Karlsruhe Institute of Technology (KIT) in Germany has presented a system called BFId that uses Wi-Fi beamforming data to identify people as they walk in a room. The tests achieved an accuracy of 99.5%, without the need for dedicated hardware, without access to the wireless network, and even when the subject does not own any Wi-Fi devices.
The study will be presented at the ACM Conference on Computer and Communications Security (CCS) in Taipei and involves a dataset consisting of 197 participants, the largest ever used in such Wi-Fi-based research. The technique leverages Beamforming Feedback Information (BFI), introduced with the Wi-Fi 5 (802.11ac) standard. Beamforming allows the router to direct the radio signal towards specific connected clients. To perform this operation, devices periodically measure the wireless channel and send compressed data about signal quality back to the router.
According to the researchers, these BFI data are transmitted unencrypted at the MAC level. A Wi-Fi adapter set to monitor mode can then passively intercept information from all devices connected to the network.
The BFId system analyzes this data to recognize human movement characteristics. The research highlights how the method significantly outperforms traditional techniques based on Channel State Information (CSI), which have been used in previous years to identify people through their gait.
CSI systems require modified firmware and are only compatible with a very limited number of network cards, including the well-known Intel 5300 from 2008. The study found that less than 6% of Wi-Fi devices deployed in 2023 supported CSI extraction. BFId eliminates these limitations.
A single interception device can simultaneously collect BFI data from all clients present in the network, obtaining multiple perspectives of the same person within the monitored environment.
In tests conducted on a subset of 170 participants, the system based on BFI achieved 99.5% accuracy compared to 82.4% obtained with CSI. The paper attributes the advantage to the greater spatial resolution of BFI data and compression, which acts as a natural noise filter. Indeed, each BFI sample contains 740 features, compared to the 212 available in CSI data. This increase allows algorithms to more accurately distinguish movements and biometric features related to walking.
The researchers also tested some possible countermeasures, including reducing the frequency of beamforming reports. However, the results showed minimal effects on the effectiveness of the BFId system, even with degraded sampling. A complete protection would instead require the encryption of BFI data within the Wi-Fi standard. However, such a modification could introduce compatibility issues with existing hardware on the market.
The issue becomes even more relevant after the publication of the IEEE 802.11bf standard in 2025, which formalizes the so-called Wi-Fi sensing for applications such as presence detection and environmental monitoring.
"This technology is powerful, but at the same time poses risks to our fundamental rights, especially privacy," said Thorsten Strufe, a professor at KASTEL (KIT’s cybersecurity institute), in a press release published on Science Daily. In this regard, the research group has asked IEEE for a dedicated protection system before the aforementioned standard spreads.