Researchers Warn of WiFi 7 Routers as 'A Potential Means for Surveillance'
What they're not telling you: WiFi 7 Routers Can Identify You Through Walls Without Your Knowledge or Consent Researchers at the Karlsruhe Institute of Technology have demonstrated that standard WiFi routers can identify individuals with 99.5% accuracy using unencrypted beamforming feedback data that requires no specialized hardware to intercept and no direct network access to obtain. The technical vulnerability centers on beamforming feedback information (BFI), a feature introduced in WiFi 5 that allows routers to optimize signal delivery to connected devices. When devices send feedback to the router confirming signal receipt, that feedback travels unencrypted across the network.
What the Documents Show
According to the KIT study presented at the ACM Conference on Computer and Communications Security in November, this unencrypted data reveals enough about an individual's physical movement patterns that a trained machine learning model can identify a specific person in seconds—whether or not that person carries any connected device. The mechanism operates through what researchers call WiFi sensing: the analysis of how radio signals interact with physical objects and human bodies as they propagate through space. Thorsten Strufe, a KIT professor and study co-author, stated in the institute's press release that "by observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present. This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition." The researchers trained their model on WiFi signal recordings from nearly 200 participants walking through a WiFi field at varying speeds and angles, collecting data from four separate perspectives simultaneously. What distinguishes this vulnerability from earlier WiFi sensing research is both its precision and its accessibility.
Follow the Money
Previous work relied on Channel State Information (CSI)—a more complex measurement of how radio signals degrade and reflect as they travel through rooms. BFI-based identification requires only the basic feedback signals that modern routers already broadcast, meaning the attack surface exists in virtually every commercial WiFi 6 and WiFi 7 installation. The researchers found no meaningful technical barrier to collecting and analyzing this data remotely. The encryption gap is the critical failure point. Commercial WiFi specifications do not mandate encryption of beamforming feedback despite the fact that, as this research demonstrates, the data contains biometric information: a unique physical signature tied to an individual's gait, body mass, and movement patterns. A malicious actor within WiFi range—whether in an adjacent apartment, a neighboring office building, or a vehicle outside a residence—could passively collect this information without authentication, without triggering any standard network monitoring tool, and without the knowledge or consent of anyone inside the coverage area.
What Else We Know
The KIT study makes no claims about deployment of this technique by government or corporate entities. The researchers published their work through standard academic channels. However, the technical capacity now exists and is reproducible using the methods they documented. Any entity with basic signal processing capability and access to the BFI transmission standard can identify individuals through walls, across encrypted WiFi networks, and without direct connection to network infrastructure.
The pattern here is institutional incompetence meeting a vacuum in standards enforcement. I find striking that the WiFi standards bodies—the IEEE 802.11 working group, the WiFi Alliance—permitted beamforming feedback to remain unencrypted through two full generational upgrades of the protocol despite having no technical justification for doing so. No regulatory body intervened. No manufacturer faced liability for deploying it.
What this reveals is how the surveillance infrastructure gets built: not through spectacular federal programs that eventually leak, but through quiet standards decisions that distribute the biometric extraction capability across billions of routers. The benefit accrues to anyone with signal processing expertise and radio proximity—corporate location analytics firms, foreign intelligence services, domestic law enforcement operating without warrant authority, and individual actors with basic technical skills.
Watch the response from the IEEE and WiFi Alliance working groups over the next six months. If they issue encryption requirements, the timeline matters: delay means years of unpatched vulnerability. If they don't, understand that's the operative decision—that the standards bodies have chosen to leave this channel open. That choice is institutional.
Primary Sources
- Source: Hacker News
- Category: Surveillance State
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.