How Wi-Fi Can Track Your Movements, Everywhere, Even If You're Not Carrying a Device

In spy movies, when a human target is being tracked around the world, it's always via cameras. The movie's protagonists hack into traffic cams, surveillance networks, vehicle cameras.

Now, that will no longer be necessary. As it turns out, number one, Wi-Fi can actually be used as a motion detector. Broadband provider Comcast has announced a new feature they're offering to customers, called Xfinity Shield WiFi Motion. It's being billed as a home security system where you don't need to install any new equipment. Instead, your Comcast router doubles as a motion detector. As Wi-Fi signals bounce around your home, they're interrupted by things like moving bodies, which then alter the signals' strength and route. The router clocks this, and knows when a body is moving through space.

That's because of something called BFI, or Beamforming Feedback Information, a system embedded in modern Wi-Fi standards. All routers are trying to beam their signals efficiently. When they bounce a signal to a device, like a laptop or phone, that device sends back BFI data, like "Hey we're getting an interrupted signal, there's an obstacle between us" and the router then compensates, tweaking its transmissions to get around that obstacle.

Number two, all of us have different bodies. So when we interrupt Wi-Fi signals by walking through them, we all interrupt them in different ways as the signals bend around our unique body shapes. (I am oversimplifying things somewhat, but this is the gist.) We generate a kind of digital fingerprint, always interrupting a Wi-Fi signal in the same way, and differently than someone else's body interrupts a Wi-Fi signal. And now a team of researchers at Germany's Karlsruhe Institute of Technology have figured out how to learn that fingerprint.

The researchers used machine learning to identify individuals, using 197 test participants all walking through environments with Wi-Fi. By poring over BFI data, the researchers "could infer the identity of persons with almost 100% accuracy – independently of the perspective or their gait."

It's worth noting that the subject being tracked, does not need to be carrying a Wi-Fi enabled device. It is their mere presence in a Wi-Fi environment filled with other people's Wi-Fi devices, that gives them away.

It's also worth noting that while the Karlsruhe system, which they're calling BFId (get it?) can tell individuals apart, but doesn't know who they are. In other words, it's like the FBI getting a bunch of physical fingerprints handed to them, with no names or faces attached. The BFId system would need an intervening party to tell them, "This particular fingerprint belongs to person X."

That should be easy enough to accomplish. A hacker could hack into your home's Wi-Fi to obtain your BFId fingerprint, or hack into a security camera in a Wi-Fi-rich environment you're traveling through to match your BFId fingerprint with your face.

"This technology turns every router into a potential means for surveillance," says researcher Julian Todt. "If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later – for example by public authorities or companies."