The Surveillance Nobody Installed
Researchers at Carnegie Mellon have demonstrated that ordinary WiFi routers can detect and track human movement through walls. Not with special hardware. Not with cameras. Just by analyzing how WiFi signals bounce off bodies as they move through a space.
The technique uses deep learning to interpret signal disturbances. When you walk through a room, you create ripples in the WiFi field. Those ripples can be decoded into surprisingly detailed information: not just presence detection but full body pose estimation, enough to know whether someone is sitting, standing, walking, or lying down.
This isn't theoretical. The published research shows tracking accuracy comparable to camera-based systems, through walls, using equipment that's already in most buildings.
Why This Matters for Your Office
Commercial building owners are already deploying WiFi sensing for "occupancy analytics." The pitch is energy efficiency: why heat empty floors? Why light empty conference rooms? The technology can detect presence without cameras, which sounds more privacy-preserving until you realize what presence data over time actually reveals.
Pattern-of-life intelligence is what security services call it. If you know when someone arrives, when they leave, which rooms they frequent, how long they stay, you've built a remarkably complete picture of their daily routine. You know when they're in the bathroom. You know when they skip lunch. You know when they're in someone else's office.
This data is being collected in buildings right now, often without any notice to occupants beyond boilerplate lease terms about "building systems."
The Consumer Version
Amazon's Eero routers already include WiFi motion sensing as a feature, marketed for home security. Turn it on, and your router notifies you when motion is detected while you're away. Helpful for catching burglars. Also helpful for anyone with access to your Eero account to know when your home is occupied.
The feature is opt-in for now. But the capability exists in hardware that's already deployed. The same routers that provide your internet could be upgraded via firmware to provide detailed occupancy tracking. No new devices required.
This is the pattern to watch: capabilities that are technically possible but currently gated by software. Today's optional feature is tomorrow's default. Today's anonymous aggregate is tomorrow's individual profile.
What Founders Should See
If you're building IoT hardware, the WiFi sensing capability creates both opportunities and liabilities.
On the opportunity side: presence detection without cameras is genuinely valuable. Smart home systems that know you're home without requiring you to wear a tracker, building systems that actually respond to occupancy, elder care monitoring that doesn't require surveillance cameras. These are real use cases with real demand.
On the liability side: any device that can sense presence can be compelled to report it. Subpoenas for smart home data are already routine. If your device has WiFi sensing capabilities, that data is potentially discoverable in litigation, available to law enforcement, and attractive to data brokers.
The question for product designers is whether to build sensing capabilities that could later be used in ways users don't expect. The answer probably depends on your threat model and your lawyers.
The Countermeasure Market
Where there's surveillance, there's counter-surveillance. The research that enables WiFi tracking also suggests possible defenses: materials that block or randomize WiFi signals, devices that generate noise patterns, architectural designs that limit signal propagation.
This is a nascent market. Most counter-surveillance products today target cameras and microphones, threats people understand intuitively. WiFi sensing is harder to explain and harder to defend against, which means the market is earlier and the opportunities less obvious.
For founders interested in privacy hardware, this is a space to watch. The threat is real, the awareness is low, and the technical defenses are underdeveloped.
The Regulatory Gap
Current privacy regulations weren't written with WiFi sensing in mind. GDPR protects personal data, but whether WiFi signal patterns constitute personal data is an open question. Building occupancy data might be considered operational rather than personal. The distinctions that matter for cameras don't map cleanly to sensing that works through walls.
This regulatory ambiguity is a window. Companies deploying WiFi sensing now face fewer compliance requirements than they would with equivalent camera systems. That window will probably close as awareness increases, which creates timing questions for both deployers and privacy advocates.
The Bigger Pattern
WiFi sensing is one example of a broader phenomenon: infrastructure originally deployed for one purpose gaining surveillance capabilities through software updates. Your router was deployed to provide internet access. It can now detect your movements. Your smart speaker was deployed to play music. It can now recognize emotional states from voice patterns.
The pattern for founders is to think about deployed infrastructure as a platform for future capabilities, not a fixed-function device. Whatever hardware you put in the world will eventually do things you didn't plan. The question is whether you've structured the permissions, disclosures, and legal terms to handle those future capabilities responsibly.
Most haven't. That's how we end up with routers that see through walls and terms of service that nobody reads.
