You've spent years worrying about the right surveillance threats. Cameras at intersections. The microphone on your phone. Smart speakers recording your conversations. Facial recognition at airports. These are real. They are also, increasingly, not the most important ones.
In October 2025, researchers at Germany's Karlsruhe Institute of Technology presented a paper at the ACM Conference on Computer and Communications Security in Taipei. The paper's title is dry: "BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information." What it demonstrated is not.
Their system — called BFId — can identify specific individuals using nothing but the WiFi signals already bouncing around your home. No camera. No microphone. No phone in your pocket. No connection to any network required. Just you, moving through a room, and a standard WiFi router doing what it always does.
They tested 197 people. Their accuracy rate was 99.5%.
The researchers are not rogue hackers. Professor Thorsten Strufe leads KIT's KASTEL Security Research Labs — a government-funded cybersecurity institute. Julian Todt, the paper's lead author, stated plainly: "This technology turns every router into a potential means for surveillance."
He was not exaggerating.
To understand why this works, you need to understand beamforming — and you need to understand that your body is not invisible to radio waves.
Modern WiFi 5 routers (the standard in most homes since roughly 2014) use a technique called beamforming to direct signals toward connected devices rather than broadcasting in all directions. To do this, the router and the receiving device constantly exchange what's called Beamforming Feedback Information — BFI — a stream of data describing the radio environment between them.
Here is the critical detail: that BFI data is unencrypted. It is broadcast openly, constantly, by every modern WiFi router. Any device with a WiFi adapter in what's called "monitor mode" can passively intercept it. No login. No connection. No permission.
And embedded in that data — whether the router knows it or not — is a record of everything the radio waves encountered on their way across the room. Including you.
Professor Strufe put it in plain language for KIT's press release: "By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present. This works similarly to a normal camera — the difference being that in our case, radio waves instead of light waves are transformed into an image."
A camera you cannot see, in a spectrum you cannot perceive, operating without any indicator light, through walls and closed doors, without ever touching your phone.
The Karlsruhe research did not emerge from nowhere. The underlying capability has been building in research institutions for years, largely unreported outside specialist circles.
The paper contains direct side-by-side comparisons of what a standard camera sees versus what the WiFi system produces. Left column: image-based DensePose from an RGB camera. Right column: the identical output produced using only WiFi signals — no camera, no radar, nothing but two standard routers at $30 each.
The coloured body-mapping overlays — showing limbs, torso, head position and posture — are near-identical between the two methods. These are not illustrations. They are the actual experimental results, published in a peer-reviewed paper submitted to arXiv on 31 December 2022.
The pattern is consistent: the research proves something, the commercial sector moves to monetise it, and by the time the public becomes aware, the infrastructure is already in place.
This distinction matters and should be stated clearly.
Every previous form of digital surveillance required your active participation in the surveillance infrastructure. Your phone tracks you — because you carry the phone. Facial recognition identifies you — because you face a camera. Bluetooth beacons log your location — because your device emits a signal. In every case, if you choose to leave the device behind, the surveillance stops.
WiFi sensing does not work this way.
Co-author Julian Todt stated in the KIT press release: "If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognised later — for example by public authorities or companies."
This is not a hypothetical. It is a description of a technically demonstrated capability, available now, using hardware that already exists in virtually every commercial and residential space in the developed world.
The most important dimension of this story is not what researchers can do in a lab. It is what is being standardised for permanent deployment in every WiFi device manufactured going forward.
The IEEE — the international body that writes the technical standards governing WiFi — is actively developing a new specification called IEEE 802.11bf. Its explicit purpose is to formalise WiFi sensing as a core function of the next generation of wireless networks. Motion detection. Presence sensing. Gesture recognition. Human activity classification. All built into the standard that will define every router, access point, and WiFi-enabled device produced after it ships.
Intel, Qualcomm, and Huawei are among the organisations contributing to 802.11bf's development.
Here is the pattern this mirrors, described by researchers at State of Surveillance: location data shipped before privacy laws existed; browser fingerprinting shipped before regulators understood it; smartphone tracking shipped before anyone asked whether it should. The surveillance capability ships first. The reckoning comes later — if at all.
Abstract surveillance research becomes concrete when money changes hands.
On 24 February 2026, ADT Inc. — the United States' largest home security company, with millions of residential customers — announced the acquisition of Origin Wireless (trading as Origin AI) for $170 million in cash. Origin AI's entire product suite is built on WiFi-based human sensing: detecting presence, tracking movement, and classifying activity throughout a home, without cameras, microphones, or wearable devices.
The acquisition press release describes Origin AI's technology as detecting "classification of motion and human detection without cameras, audio, or wearable devices" and enabling "deeper understanding of presence, occupancy, motion, and related activity within the home." ADT stated it expects to begin commercialising new products incorporating the technology in 2027.
Read that carefully. Intelligence-driven. Proactive. A system that does not wait to be triggered by an event — but monitors continuously, learns the patterns of who is in your home and when, and acts on that knowledge. Framed as a security product. Carrying all the capability of the surveillance systems the KIT researchers warned about.
ADT is not a niche startup. It is a publicly listed company with a nationwide network of security professionals, long-term monitoring contracts, and established relationships with emergency services and law enforcement. The data generated by continuous WiFi-based home occupancy sensing will flow into that ecosystem.
Origin AI holds more than 200 patents on this technology. The company's existing customer base includes Fortune 500 internet service providers and multinational security firms. The infrastructure for mass residential WiFi sensing deployment exists now. The product launch is scheduled for next year.
You might reasonably expect that technology capable of identifying and tracking individuals through walls — without their knowledge, without their devices, without any visible equipment — would be subject to some form of legal regulation. Surveillance law, privacy law, something.
It is not.
Heavily regulated in most jurisdictions. Visible disclosure typically required in commercial spaces. Subject to data protection legislation. Clear legal frameworks around access, storage, and retention. Citizens have established legal recourse.
No legal framework exists in any jurisdiction. No disclosure required. No consent mechanism. No visible indicator. No standard notification system. No established right of access to data collected. No legal recourse for individuals identified without knowledge.
The KIT researchers noted this gap explicitly: unlike video surveillance, which is heavily regulated and requires visible disclosure in most countries, WiFi sensing operates invisibly. There is no standard notification. There is no easy way to disable it. There is no legal requirement that anyone tell you it is happening.
A person in their own home has no way to determine whether their router — or a neighbour's router, or the router in the café downstairs — is performing this kind of analysis. There is currently no obligation for any company or government agency to tell them.
If you have read SSO's previous work on Digital Twins, Combatting Brainwashing, or The Parasite Economy, you will recognise the architecture.
Each technology described in those articles — algorithmic profiling, behavioural nudging, AI-generated identity models built from your data — required your active participation to function. You had to post. You had to search. You had to click. The system learned from what you chose to put in.
WiFi sensing removes that requirement entirely.
When combined with existing data — your digital twin, your purchasing history, your movement patterns from phone GPS, your social graph — a continuous WiFi-based presence record of your home becomes something qualitatively different from any previous surveillance system. It knows when you are home and when you are not. It knows your sleep patterns. It knows whether you have visitors, how often, and how long they stay. It knows your daily routines with a precision no camera system could match — because cameras require line of sight, and WiFi passes through walls.
That data does not need to be labelled "surveillance data" to function as surveillance. It only needs to exist, in a system connected to other systems, held by entities with the legal means and economic incentive to use it.
Not every piece of information about surveillance requires an action. Some of it simply requires awareness — the habit of knowing what the environment is doing, so that when decisions are made on your behalf, you have at least been informed.
Here is what is verifiably true as of June 2026:
Standard WiFi 5 routers — including the one most likely in your home — broadcast beamforming feedback data that can be used to identify and track individuals with 99.5% accuracy, through walls, without any device carried by the target. This was formally demonstrated at a major international cybersecurity conference. The researchers who demonstrated it warned publicly that it constitutes a serious threat to privacy and fundamental rights, and called urgently for regulatory safeguards.
The next WiFi standard — 802.11bf — is being actively developed to formalise sensing as a core WiFi function. Privacy protections have not yet been built into it. Industry bodies including Intel, Qualcomm, and Huawei are contributing to its design.
ADT has paid $170 million for the leading commercial WiFi sensing company and plans to deploy the technology across millions of US homes by 2027. The beamforming feedback data used by these systems is currently unencrypted and unregulated in every jurisdiction on earth.
The researchers who discovered this named the legal risk plainly: "This is particularly critical in authoritarian states, where the technology could be used to monitor protesters." They were referring to other countries. But the technology does not check passports.
What you do with this information is your choice. But you have now been told.