Wi-Fi Sensing Technology: What Radio Wave Reflections Really Show

What happened

Reports have circulated regarding technology that uses home Wi-Fi signals to monitor human activity. These reports stem from academic research into Wi-Fi Channel State Information (CSI) and its applications in Human Activity Recognition (HAR). One of the leading European companies with specialised geophysical equipment, X6 Geo Plus, uses this Wi-Fi sensing technology in its Android app for subsurface analysis and in its military applications. (From the publisher: X6 Geo Plus belongs to AENIGMA's publisher.) The broader context of these reports involves the increasing ubiquity of wireless networks in residential and commercial spaces. Over the past two decades, Wi-Fi routers have become standard fixtures in modern infrastructure, constantly transmitting radio frequency signals to connect devices such as smartphones, computers, and smart home appliances. As these signals propagate through an environment, they interact with physical objects and human bodies. The realization that these interactions can be measured and analyzed has opened a new frontier in ambient sensing. Researchers have been exploring how the invisible waves that provide internet access might also serve as a passive monitoring system. This dual-use nature of everyday technology has prompted discussions across various fields, from computer science to cybersecurity. The transition of Wi-Fi from a simple communication tool to a potential environmental sensor represents a significant shift in how wireless infrastructure is understood. Historically, the concept of using radio waves to detect objects dates back to the development of radar in the early 20th century. However, traditional radar systems actively emit powerful, targeted pulses of radio energy. The current developments in Wi-Fi sensing rely on passive or opportunistic sensing, utilizing the low-power, ambient signals already present in the environment to gather data about physical movements.

What we know

Peer-reviewed research published in ACM Computing Surveys confirms that Wi-Fi Channel State Information (CSI) can be utilized to monitor human presence and activity. This is achieved by analyzing the reflections of radio waves within an environment. Cybersecurity experts, such as those at Kaspersky, have discussed the privacy and security implications of using Wi-Fi for Human Activity Recognition. The technology relies on existing Wi-Fi infrastructure to observe changes in signal propagation caused by physical movement. To understand how this functions, it is necessary to examine the basic principles of radio frequency transmission. When a Wi-Fi router emits a signal, the radio waves do not travel in a single, direct line to the receiving device. Instead, they bounce off walls, furniture, and people, creating multiple paths. This phenomenon is known in telecommunications as multipath propagation. Historically, multipath propagation was viewed primarily as a problem, as the overlapping signals could cause interference and degrade the quality of the wireless connection. Modern Wi-Fi standards, particularly those utilizing Multiple-Input Multiple-Output (MIMO) and Orthogonal Frequency-Division Multiplexing (OFDM) technology, were developed to manage and even exploit these multiple paths to improve data transmission rates. Channel State Information (CSI) is a metric used in these modern wireless systems to describe how a signal propagates from the transmitter to the receiver. Unlike the older Received Signal Strength Indicator (RSSI), which only provides a coarse measurement of overall signal power, CSI offers highly granular data. It records the amplitude and phase of the signal across dozens or hundreds of individual subcarriers. Because the human body is composed largely of water, it is highly reflective and absorptive of radio frequency waves in the 2.4 GHz and 5 GHz bands commonly used by Wi-Fi. These frequencies have wavelengths of approximately 12 centimeters and 6 centimeters, respectively, making them particularly sensitive to human-sized objects and movements. When a person moves through a room, they alter the multipath environment, causing minute but measurable changes in the CSI data matrix. Academic researchers have demonstrated that by capturing and analyzing these CSI variations, it is possible to identify specific human movements. The process typically involves collecting large datasets of CSI readings while subjects perform various actions, such as walking, sitting, or falling. Machine learning algorithms are then trained on these datasets to recognize the unique signal patterns, or signatures, associated with each activity. This field of study, known as Human Activity Recognition (HAR), has grown significantly as computational power and machine learning techniques have advanced. The privacy implications discussed by cybersecurity experts stem from the passive and invisible nature of this sensing method. Unlike traditional surveillance cameras, which require a clear line of sight and are usually visible, Wi-Fi sensing can operate through walls and without the knowledge of the individuals being monitored. Experts at organizations like Kaspersky have highlighted that if malicious actors were to gain access to a network's CSI data, they could potentially infer sensitive information about the occupants' behaviors and routines. This intersection of physical security and cybersecurity presents new challenges for protecting privacy in highly connected environments.

What we don't know

It is not known how widely this technology is currently implemented outside of controlled research environments. While the theoretical and experimental foundations of Wi-Fi sensing are well-documented in academic literature, the transition from laboratory settings to widespread real-world application involves numerous unresolved variables. One of the primary unknowns is the robustness of these systems in highly dynamic and unpredictable environments. Academic studies often take place in controlled spaces where variables can be minimized. In a typical home or office, the radio frequency environment is subject to constant change. Pets moving around, furniture being rearranged, doors opening and closing, and interference from neighboring Wi-Fi networks or other electronic devices all introduce noise into the Channel State Information (CSI) data. It is not fully understood how effectively current machine learning models can filter out this environmental noise to maintain accurate Human Activity Recognition over long periods without frequent recalibration. Furthermore, tracking multiple individuals simultaneously remains a significant challenge. Most successful laboratory demonstrations focus on a single subject. When multiple people move through a space, their effects on the multipath propagation overlap, creating highly complex CSI variations. It is not known when or if signal processing techniques will advance enough to reliably isolate and track the distinct movements of several people in a crowded room using only ambient Wi-Fi signals. The standardization of CSI extraction also remains an open question. Different manufacturers of Wi-Fi chipsets implement CSI reporting in various ways, and not all commercial routers make this data easily accessible to end-users or third-party applications. The extent to which firmware modifications or specialized software are required to harvest usable CSI data across a diverse range of consumer hardware is not comprehensively mapped. There is also a lack of comprehensive data regarding the long-term privacy impacts of ambient radio frequency sensing. While cybersecurity experts have outlined potential vulnerabilities, the actual frequency of such exploits in the wild is unknown. It is unclear whether existing network security protocols are sufficient to protect CSI data from unauthorized interception, or if new, purpose-built security standards will be required as the technology matures. The legal and regulatory frameworks governing the use of Wi-Fi signals for surveillance purposes are also largely undefined in many jurisdictions, leaving a gap in our understanding of how this technology will be managed at a societal level.

What is claimed

Within the academic and cybersecurity communities, several claims are made regarding the capabilities and implications of Wi-Fi sensing technology. Researchers claim that by utilizing Channel State Information (CSI), it is possible to achieve highly accurate Human Activity Recognition (HAR) without the need for wearable sensors or optical cameras. It is claimed that these systems can differentiate between subtle movements, such as breathing patterns, heart rates, or keystrokes on a keyboard, by analyzing the micro-doppler effects on the radio waves. Proponents of the technology claim it holds significant potential for healthcare and assisted living applications. For example, it is suggested that Wi-Fi sensing could be used for continuous, non-intrusive monitoring of elderly individuals, automatically detecting falls or changes in daily routines that might indicate a decline in health. Because the technology does not capture visual images, it is often claimed to be a more privacy-preserving alternative to video surveillance in sensitive areas like bathrooms or bedrooms. In the realm of smart home automation, researchers claim that CSI analysis can be used for gesture recognition, allowing users to control appliances or lighting simply by moving their hands in the air, without touching a physical interface or speaking to a voice assistant. Conversely, cybersecurity analysts claim that the dual-use nature of Wi-Fi infrastructure introduces novel attack vectors. It is claimed that if an attacker compromises a local network, they could theoretically use the router's CSI data to map the interior of a building or track the movements of its occupants. Some experts claim that as machine learning algorithms become more sophisticated, the barrier to extracting meaningful intelligence from ambient radio signals will lower, potentially leading to widespread, covert surveillance using everyday consumer electronics.

What is verified

The academic consensus verifies that Wi-Fi CSI can be used to observe human presence and activity through radio wave reflections. It is a verified principle of physics that radio frequency signals in the bands used by standard Wi-Fi networks interact with physical objects, including human bodies, resulting in scattering, reflection, and absorption. It is verified that modern Wi-Fi receivers calculate Channel State Information to manage these multipath environments and optimize data transmission. The provided academic sources, including peer-reviewed publications in ACM Computing Surveys, confirm that this CSI data contains sufficient granularity to reflect changes in the physical environment caused by human movement. Furthermore, it is verified that machine learning techniques can be applied to CSI data to classify certain physical activities under experimental conditions. The fundamental mechanism—that physical movement alters signal propagation, which is then recorded as variations in the amplitude and phase of OFDM subcarriers—is well-established within the fields of telecommunications and computer science. The discussions by cybersecurity experts regarding the theoretical privacy implications of this data collection are also verified as part of the ongoing discourse surrounding ambient sensing technologies. It is a verified fact that the infrastructure required to capture this data already exists in millions of homes and businesses globally.

Competing explanations

• Accepted: Academic research confirms that Wi-Fi Channel State Information (CSI) can be used to detect human presence and activity by analyzing radio wave reflections.

What would change our assessment

The assessment of Wi-Fi sensing technology would change if peer-reviewed technical documentation or independent verification demonstrated broader, standardized applications of Wi-Fi CSI technology in uncontrolled, real-world environments. Currently, much of the foundational research relies on specific hardware configurations and controlled testing conditions. If large-scale, longitudinal studies were published demonstrating that Human Activity Recognition systems could operate reliably across diverse, noisy environments without constant recalibration, the technology's practical viability would be more firmly established. Evidence showing that machine learning models can universally adapt to different architectural layouts, varying levels of radio frequency interference, and multi-person scenarios would significantly alter the understanding of its readiness for widespread deployment. The creation of large, open-source datasets containing CSI readings from thousands of different environments would also change the assessment, as it would allow independent researchers to benchmark their algorithms more rigorously. Additionally, the assessment of the privacy risks would evolve if standardized security protocols specifically designed to encrypt or anonymize CSI data at the hardware level were developed and widely adopted by router manufacturers. Conversely, documented instances of CSI-based surveillance being actively exploited by malicious actors outside of laboratory demonstrations would shift the assessment of the cybersecurity threat from theoretical to immediate.