Big Router is watching you: WiFi could secretly track you even if you leave your phone at home

The New York Post headline "Big Router is watching you" sounds like the opening line of a paranoid thriller. The underlying research, however, comes from the Karlsruhe Institute of Technology in Germany. Where scientists demonstrated that ordinary WiFi signals can be repurposed to detect and track people - even when those people aren't carrying a phone, smartwatch. Or any connected device. The popular press described the mechanism as "sound waves," but that's technically inaccurate. WiFi routers emit electromagnetic radio waves, not acoustic pressure waves. The confusion matters because it obscures what is actually a much more important engineering story.

The infrastructure you installed to stream Netflix may be turning your home into a low-resolution surveillance sensor. And you would never see a permission prompt. This isn't a malware exploit or a router backdoor it's a physical-layer property of WiFi that researchers and a growing number of vendors are learning to exploit. In this article, I want to walk through the signal processing, the threat model, the tooling, and the countermeasures from the perspective of an engineer who has spent time debugging wireless stacks and building edge inference pipelines.

Before we go further, one clarification: I have worked in production environments where passive RF monitoring was used for spectrum management and device localization. The same techniques that help a network administrator find a rogue access point can be turned into people tracking. The transition from engineering tool to privacy problem isn't always obvious. But it's predictable once you look at the data path.

Separating Radio Waves from Sound Waves in the Reporting

A WiFi router communicates by modulating information onto radio frequency carriers, typically at 2. 4 GHz or 5 GHz, and those are electromagnetic waves, not soundWhen a person moves through a room, their body reflects, scatters. And absorbs some of that RF energy. The router doesn't need the person to emit anything; the router only needs to observe how its own transmitted signal changes after bouncing off the environment. Journalists sometimes call this "sound waves" because the math resembles sonar. But the physics is entirely different.

This distinction isn't pedantic. If you think the system relies on sound, you might assume that closing a window or installing acoustic foam would stop it. It would not. RF propagation is affected by walls - metallic objects, water content in the human body. And multipath interference. A concrete wall attenuates the signal. But doesn't necessarily eliminate the sensing capability. Engineers designing privacy controls need to work at the RF layer, not the acoustic layer.

For anyone who wants the raw technical baseline, the IEEE 802. 11 standards define how orthogonal frequency-division multiplexing (OFDM) transmits data across subcarriers. Those subcarriers experience different amplitude and phase shifts depending on the environment. This is the foundation for what researchers call Channel State Information. Or CSI. Understanding CSI is the key to understanding WiFi-based tracking. Related internal guide: OFDM and channel estimation for wireless engineers

How WiFi Channel State Information Creates a Radar

Every modern WiFi frame includes known pilot symbols and preambles. A receiver can compare the received signal against the expected transmitted signal to estimate how each subcarrier was altered. That per-subcarrier estimate is the Channel State Information it's not the same as received signal strength indicator, or RSSI. And rSSI is a single coarse numberCSI is a matrix of complex values representing frequency response over time and across antennas.

When a person moves, the multipath reflections change, and some paths lengthen, some shortenThe phase and amplitude of individual subcarriers shift in measurable ways. By sampling CSI at 20 to 100 Hz or more, you can build a Doppler-like profile of movement. A person walking across a hallway creates a distinct pattern. A person breathing creates a slower periodic variation. A person falling creates a sudden broadband change. This is essentially passive radar using an existing communications transmitter.

In a lab setting, researchers can extract CSI using modified firmware or specialized Wi-Fi chips. Stock consumer routers typically don't expose CSI to end users, but that is changing as silicon vendors add sensing features for motion detection, presence awareness. And healthcare monitoring. The key point is that the underlying information has always been present in the physical layer. The question is who gets to parse it.

The Karlsruhe Institute of Technology Experiment in Technical Detail

The Karlsruhe Institute of Technology experiment described in news reports did not require the tracked person to carry a phone, wearable,? Or RFID tag? According to the reported setup, the researchers used standard WiFi hardware operating in the 5 GHz band and collected Channel State Information from multiple receiving antennas. By applying machine learning classifiers to the CSI streams, they were able to distinguish different individuals and track movement patterns through walls or around obstacles. Some reports mentioned "sound waves," but the paper's methodology, based on RF sensing, aligns with a growing body of work on passive human activity recognition.

What makes the KIT work notable isn't the basic idea. Passive WiFi sensing has been demonstrated in academic papers for more than a decade. The notable part is the normalization of the technique: showing that inexpensive, off-the-shelf routers and a modest machine learning pipeline can recover identifiable movement signatures. That lowers the barrier for real-world deployment. The same method could theoretically run on a Raspberry Pi with a CSI-capable radio and a pre-trained model, without any specialized radar hardware.

It is worth noting that many research papers, including KIT-related publications on WiFi sensing, evaluate performance using metrics like classification accuracy, confusion matrices. And cross-environment generalization. Raw accuracy numbers in the 80-95% range sound impressive, but they often drop significantly when the model is tested in a new building, with different furniture, or with multiple people moving simultaneously. That gap between lab results and production robustness is exactly the kind of thing engineers should scrutinize. For a broader technical overview, you can read the IEEE 80211bf WLAN sensing task group update. While

Why Phone-Free Tracking Changes the Privacy Threat Model

Most consumer tracking relies on a device the person carries. Your phone broadcasts MAC addresses in probe requests, and bluetooth beacons estimate locationApps collect GPS coordinates. You can turn off location services, use airplane mode. Or leave the phone at home. While passive WiFi sensing breaks that model because the sensing target doesn't need to cooperate, transmit. Or even own a device. The router's signal reflects off your body whether you want it to or not.

This is the core privacy shift: consent becomes structurally impossible at the individual level. You did not install the router, you don't control its firmware. And you may never receive a privacy notice. An apartment building, hotel. Or retail store could deploy WiFi sensing for occupancy analytics or security and track everyone inside without any opt-in. In Europe, this raises questions under GDPR's provisions on biometric data and legitimate interest. In the United States, there's no thorough federal standard that clearly addresses ambient RF sensing.

From an engineering perspective, phone-free tracking also changes the anonymity calculus, and a MAC address can be randomizedA person's RF reflection signature, derived from gait, height, body mass. And movement habits, is harder to randomize. Researchers sometimes call this a "soft biometric, and " It isn't a fingerprint,But it can be stable enough to re-identify individuals across sessions if the antenna geometry remains fixed that's a much harder problem to solve with device-level privacy controls.

The Role of MIMO and Beamforming Metadata

Modern routers use multiple-input multiple-output, or MIMO, antenna arrays. Beamforming steers energy toward a client to improve throughput. To do that, the router must estimate the spatial channel between its antennas and the client's antennas. That estimation process isn't just a byproduct; it's an increasingly rich source of environmental information. Every beamforming update contains implicit data about the physical space, even if the router firmware never exposes it to the user.

In 802, and 11ac and 80211ax systems, channel sounding procedures generate compressed beamforming feedback. That feedback can reveal the angle of arrival and multipath geometry of the environment. An attacker or operator with access to that metadata can infer whether a room is occupied, where a person is located. And even the direction of movement. This is why the privacy implications of WiFi sensing aren't limited to research prototypes; they're embedded in the protocol features that ship in consumer hardware today.

From a software engineering view, beamforming metadata is similar to telemetry you did not know you were emitting. It isn't gated behind an application permission. It exists below the network stack, inside the PHY layer. Security teams that audit web traffic, inspect TLS handshakes,, and or monitor DNS queries won't see itYou need a completely different monitoring strategy to detect passive RF sensing abuse. Related internal guide: Observability for the physical layer

Building Passive WiFi Sensing Systems: Tools and Methods

If you want to experiment with WiFi sensing legally and ethically, the open-source ecosystem gives you several entry points. The most widely used tool is the Nexmon CSI extraction framework. Which enables Channel State Information capture on Broadcom-based devices such as the Raspberry Pi 3 and 4. Another option is the Atheros CSI Tool for older Qualcomm Atheros chips, and both require custom firmware and root access,But they expose the raw complex CSI values that commercial firmware hides.

On the software side, a typical pipeline looks like this:

• Capture CSI frames at 50-100 Hz using a patched driver
• Sanitize the data by removing pilot subcarriers and correcting for automatic gain control jumps
• Extract amplitude and phase features over sliding windows
• Train a classifier such as a random forest, support vector machine, or small convolutional neural network
• Run inference at the edge to minimize data transfer and retain raw signals locally

In my own testing, I found that phase data is often unusable without careful synchronization because consumer Wi-Fi radios have timing jitter and carrier frequency offset. Amplitude-based features are more robust across different devices. But they carry less spatial information. This is one reason lab results don't always translate to real deployments. Researchers often normalize their datasets in ways that production hardware can't reproduce cheaply.

There is also a growing body of work on using ESP32 microcontrollers and software-defined radios for sensing. The ESP32 has limited CSI support and lower bandwidth,, and but it's extremely cheapA fleet of ESP32 sensors could cover a building for a fraction of the cost of radar or lidar. That economic shift is exactly what makes passive WiFi sensing a near-term privacy issue rather than a distant academic concern.

Practical Limitations That Prevent Mass Deployment Today

Despite the alarming headlines, passive WiFi tracking isn't yet a plug-and-play surveillance system. The biggest limitation is environmental variability. A model trained in one apartment will degrade when the sofa moves three feet, when a new mirror is hung. Or when the humidity changes. RF propagation depends on the entire room geometry. And small physical changes can shift CSI distributions enough to confuse a classifier. This is the classic problem of domain shift in machine learning.

Another limitation is multi-person interferenceMost research demonstrations track one or two people in controlled settings. A crowded office, a hallway with five people moving in different directions, or a home with pets creates overlapping reflections that are much harder to separate. The signal-to-noise ratio drops. And the classifier starts producing noisy or ambiguous outputs. That doesn't mean the privacy risk disappears; it means the current technology is more useful for coarse presence detection than for fine-grained individual tracking in dense spaces.

There is also a hardware constraint. Stock consumer routers don't expose raw CSI through their management interfaces. An attacker usually needs either physical access, custom firmware,, and or cooperation from the chip vendorManaged enterprise access points increasingly offer sensing APIs for occupancy and asset tracking. But those are typically opt-in deployments controlled by IT departments. The danger isn't that every router already spies on you. The danger is that the capability is being productized quietly, without a clear consent boundary for non-device-holding occupants.

The IEEE 802. 11bf Standard and Future Native Sensing

The Wi-Fi industry isn't waiting for academic labs to prove the concept. IEEE 802. 11bf, also called WLAN sensing, is a formal amendment to the 802. 11 standard that defines how WiFi devices can perform sensing natively. It covers measurement procedures, feedback formats. And use cases such as motion detection, gesture recognition. And health monitoring. Once 802. 11bf-capable chips ship, the sensing metadata will be a standard part of WiFi operation, not a hidden hack.

From a developer perspective, this is a double-edged sword. Standardization brings better documentation, lower power consumption, and more consistent APIs. It also normalizes ambient sensing as a default feature. The same router that provides internet access may later provide room-level presence data to a cloud service. If the privacy controls aren't built into the standard from the start, they will be bolted on later - and bolted-on privacy usually fails.

Engineers who work on Wi-Fi stacks should start reading the 802. 11bf drafts and asking hard questions about data retention, raw CSI access. And local processing guarantees, and the IEEE 802. While 11bf working group updates are the authoritative source. This isn't a hypothetical future feature; it's multiple years into the standards process and already influencing chip design. Related internal guide: Preparing your codebase for 802. 11bf sensing APIs

Privacy-Preserving Engineering Countermeasures for WiFi Sensing

The most obvious countermeasure is physical: reduce the RF reflections that sensors rely on. That could mean adding RF-absorbing materials, using directional antennas. Or creating spatial diversity that makes it harder to isolate a single person. But physical countermeasures aren't practical for most homes and offices. And they can degrade your own WiFi performance. You do not want to turn your living room into an anechoic chamber just to avoid presence detection.

A more promising approach is to build privacy into the sensing pipeline itself. Techniques include differential privacy on CSI features, federated learning so raw signals never leave the local device. And on-device inference that discards raw data after classification. The NIST Privacy Framework offers a useful reference for thinking about data minimization, transparency. And individual control in sensor systems. You can review the NIST Privacy Framework documentation for a structured approach.

There are also protocol-level optionsA future router could include a physical switch or a configuration toggle that disables sensing subcarriers while preserving communications that's technically complex because sensing uses the same OFDM symbols as data, but it's not impossible. The 802. 11bf standard could define a privacy mode that reduces sensing resolution or limits access to CSI feedback. Without that, users are left with inadequate controls like hiding the SSID - which does nothing to stop RF sensing.

What Regulators and Developers Should Do Next

Regulators tend to think about data collection When it comes to devices and identifiers. Passive WiFi sensing doesn't fit that model. It collects information about people who never connected to a network, never agreed to terms, and may not even know the sensors exist that's a regulatory blind spot. The European GDPR has concepts like "legitimate interest" and "biometric data," but applying them to ambient RF reflections is still unsettled. The United States lacks a thorough privacy law, and sectoral rules don't address room-level RF sensing.

Developers and architects have a more immediate responsibility. If you're asked to build a WiFi sensing feature, you should document the data flow, define retention limits. And require explicit signs or notices in physical spaces where sensing operates. You should also design for local processing by default. Sending raw CSI to the cloud is the technical equivalent of streaming a microphone feed from every room. Even if the vendor promises it's only used for motion detection, that data is a liability waiting for a subpoena or a breach.

The KIT experiment isn't a reason to throw away your router it's a reason to understand what your infrastructure is already capable of. WiFi was designed for communication. But the same physics that carries your packets also reflects off your body. That dual-use nature isn't going away. The choice is whether we build sensing systems with accountability. Or wait until the capability is silently industrialized.

Frequently Asked Questions: WiFi Passive Sensing

Does my current WiFi router track me right now?
Most consumer routers don't expose raw Channel State Information to the user or the vendor. However, enterprise access points and some smart home devices increasingly include motion sensing or presence detection features. The capability exists at the physical layer. But misuse typically requires custom firmware or vendor-specific APIs.

Can passive WiFi sensing work through walls?
Yes, radio waves can penetrate many building materials. The resolution decreases with distance, wall density, and metal content. But coarse movement detection through drywall is feasible. This is why the phone-free tracking scenario is so concerning: you may not know the sensor is across the wall.

Does turning off WiFi on my phone stop this,
NoPassive WiFi sensing doesn't require your phone to transmit anything. The router transmits, the signal reflects off your body. And the receiver measures changes in the reflected signal. Your phone's WiFi state is irrelevant.

What is the difference between RSSI and CSI?
RSSI is a single scalar value representing total received signal strength. CSI is a per-subcarrier matrix of complex numbers that describes amplitude and phase across frequency. CSI contains much richer spatial information, which is why it enables tracking; RSSI is too coarse for reliable human movement classification.

Can I detect if someone is using WiFi sensing against me?
Detection is difficult but not impossible. A trained RF engineer can sometimes spot unusual probing or elevated channel sounding activity using a spectrum analyzer or software-defined radio. However, if the sensing uses the same frames as normal communication, it may be indistinguishable from ordinary WiFi traffic. This is why transparency and regulatory safeguards matter more than personal counter-surveillance.

Conclusion

The "Big Router is watching you" story is easy to dismiss as clickbait, but the technical core is real. WiFi signals carry enough environmental information to infer human presence, movement. And even identity under the right conditions. The Karlsruhe Institute of Technology experiment adds another data point to a long line of research showing that this capability is becoming cheaper, more accurate. And more accessible. The challenge for engineers isn't to panic. But to build systems that respect physical-space privacy before the sensing layer becomes another invisible data exhaust.

If you're designing wireless products, start by auditing what CSI or beamforming metadata your hardware already exposes. If you're responsible for security, extend your threat model to include ambient RF sensing, not just application-layer attacks. And if you're a user, remember that no permission prompt means no consent. The most effective pushback is technical literacy plus clear regulatory boundaries.

For a hands-on look at capturing CSI with off-the-shelf hardware, check out our tutorial on Nexmon CSI extraction. For guidance on deploying edge AI models that keep raw sensor data local, see our article on private inference at the edge.

What do you think?

Should router manufacturers be required to ship a physical switch that disables CSI-based sensing, even if it reduces MIMO beamforming performance?

Would a GDPR-style consent notice posted in a physical space be enough to make ambient RF tracking acceptable,? Or is the technology inherently incompatible with consent?

If passive WiFi sensing could reliably detect falls in elderly care, would you accept the surveillance trade-off - and where would you draw the line on data retention and law enforcement access?