SCIENCE & TECH
THE SIGNAL THAT WAS HIDING IN PLAIN SIGHT
Every time a laptop, phone, or smart speaker talks to a Wi-Fi router, it isn't just sending the cat video or the email you asked for. Buried inside the handshake between device and router is a constant stream of housekeeping data most people have never heard of — including something called Beamforming Feedback Information, or BFI. It's a technical measurement your device sends back to the router describing exactly how the radio signal was distorted on its way through the room, so the router can aim its signal more precisely next time.
It sounds like the most boring part of your internet connection. It isn't sent with any encryption. And a team of researchers at the Karlsruhe Institute of Technology's KASTEL Security Research Labs just showed that this "boring" data can be turned into a full-body radar scan capable of identifying who is standing in a room — with almost no error, using nothing more exotic than a laptop and a Wi-Fi card.
They call the technique BFId, and the paper describing it — "BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information," by Julian Todt, Felix Morsbach, and Thorsten Strufe — was presented at the ACM Conference on Computer and Communications Security in Taipei, with KIT publishing details of the findings on August 12, 2026.
HOW YOUR BODY BECOMES THE TARGET
Here's the physics in plain terms: Wi-Fi signals don't travel through a room in a straight, clean line. They bounce off walls, furniture — and people. A human body, being mostly water, absorbs and reflects radio waves in a distinctive way depending on size, shape, posture, and movement. When your device measures how much the signal got warped on its trip across the room and reports that distortion back to the router as BFI, it's inadvertently describing the shape of everything the signal passed through, including you.
Todt, Morsbach, and Strufe realized that if you can eavesdrop on that unencrypted BFI traffic — and you can, because it's broadcast in the clear as a normal part of how Wi-Fi networks operate — you can reconstruct those radio-wave distortions from multiple viewing angles and effectively build a crude radar "image" of a person's body. Feed enough of those reconstructions into a machine-learning classifier trained on a given individual's radio signature, and the system can tell you, with startling confidence, exactly who just walked into the room.
"By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present," the researchers explained — comparing the process conceptually to how a camera builds an image from light, except BFId uses radio waves instead, and doesn't need to see you to do it.
THE NUMBERS ARE THE SCARY PART
This isn't a proof-of-concept that sort of works in ideal lab conditions. The KIT team built a dataset from 197 real participants and put BFId through its paces across varying angles, walking styles, and gaits. The result: 99.5% identification accuracy, with a margin of error of just 0.38 percentage points.
For comparison, that's in the same performance range as commercial facial recognition systems — except BFId doesn't need a camera, doesn't need line of sight, works through walls and in darkness, and doesn't require its target to be carrying any device at all. Turning your phone off doesn't help. Leaving your phone in another room doesn't help. If your body is inside the radio footprint of a Wi-Fi network — yours or someone else's — you are a data point.
The researchers also tested whether simple defenses could blunt the attack, such as reducing how often BFI data gets sent (time-coarsening). It barely moved the needle. Sampling the signal less often only marginally reduced accuracy, meaning casual, low-effort mitigations aren't going to be enough to stop it.
WHY THIS IS DIFFERENT FROM THE SURVEILLANCE YOU ALREADY KNOW ABOUT
Wi-Fi sensing itself isn't brand new — researchers have shown for years that wireless signals can detect breathing, count people in a room, or track gross movement. What makes BFId different, and what's driving the alarm in the privacy research community this month, is the leap from "detecting a body is present" to "identifying precisely which body it is" — at near-perfect accuracy, using data that's already flowing, unencrypted, from essentially every Wi-Fi-enabled device on the planet.
That combination — ubiquity plus precision plus zero cooperation required from the target — is what separates this from prior wireless-sensing research. You don't need to hack anyone's network. You don't need their password. You don't even need to be connected to their router. A nearby listener with off-the-shelf equipment can simply capture the BFI broadcasts floating through the air and go to work. Wi-Fi networks are already blanketing homes, offices, restaurants, hospitals, and public transit — meaning the raw material for this kind of identification is, quite literally, everywhere modern life happens.
EXPERT PERSPECTIVE
The KASTEL team is explicit that BFId isn't primarily a warning about some hypothetical future attacker — it's a warning about an architecture flaw that's been sitting inside the Wi-Fi standard the entire time, waiting for someone to notice it could be exploited this way. The researchers argue the real fix has to happen at the protocol level: encrypting or otherwise cryptographically protecting BFI packets so that only the router a device is actually talking to can read them, closing off the eavesdropping vector entirely rather than trying to patch around it device by device.
That's a meaningful engineering lift. BFI reporting is baked into how modern Wi-Fi standards — including the widely deployed 802.11ac and 802.11ax (Wi-Fi 6) protocols — implement beamforming, the technique that lets routers focus their signal directly at connected devices instead of broadcasting in every direction. Changing how that feedback is transmitted means touching a piece of the wireless standard used in essentially every router, laptop, and phone sold in the last decade. It's the kind of fix that takes years to propagate through hardware refresh cycles, not a software patch that ships next Tuesday.
Security researchers outside the KIT team who've reviewed the work broadly agree it represents a serious, previously underappreciated privacy gap — not because the individual pieces (radio reflection, machine learning classification, unencrypted metadata) are novel on their own, but because BFId is among the first demonstrations to chain them together into a working, highly accurate, device-free identification system and validate it against nearly 200 real people rather than a handful of volunteers in a controlled lab.
WHAT THIS MEANS FOR YOU
Practically speaking, there is no consumer-side fix you can flip on today. You can't "turn off BFI" without breaking how your Wi-Fi router optimizes its connection to your devices, and the mitigation researchers tested — reducing how often the feedback is sent — barely dented the attack's accuracy. That's an uncomfortable spot to be in: a known, demonstrated privacy hole with no simple patch available to the person actually at risk.
What it does mean is that the comfortable assumption "I'm not carrying a tracking device, so I can't be tracked" no longer holds in any building with a Wi-Fi router — which today is nearly every building. Anyone thinking through physical privacy — domestic violence survivors avoiding a stalker, journalists meeting sensitive sources, or simply people who'd rather not have every visit to a specific building logged and attributable — now has a genuinely new threat model to account for, one that doesn't show up in a phone's location settings or a browser's privacy dashboard because it isn't touching your phone or your browser at all.
For the industry, the pressure now shifts to the standards bodies that govern Wi-Fi protocols and to router manufacturers, who will likely face growing calls to encrypt beamforming feedback in future hardware and firmware. Until that happens at scale, the KIT team's underlying message is blunt: the walls of unencrypted metadata quietly surrounding modern wireless networks are bigger, and more personally revealing, than almost anyone assumed.
THE BOTTOM LINE
Julian Todt, Felix Morsbach, and Thorsten Strufe didn't need a single camera, a hacked password, or a target's phone to identify 197 different people with near-perfect accuracy — they just listened to the radio traffic that ordinary Wi-Fi routers broadcast into the air every day as a matter of routine housekeeping. BFId is a wake-up call that the "invisible" data our devices constantly exchange isn't as harmless as it looks, and that the next big privacy fight may not be about the apps on your phone at all — it may be about the box on your wall you never think about.
