Ordinary WiFi can now identify people with near perfect accuracy

Researchers say ordinary WiFi routers can identify people with nearly 100% accuracy using beamforming feedback information, even when targets are not carrying a device or have their phone turned off. In tests with 197 participants, the system reportedly recognized individuals regardless of viewing angle or walking style, raising significant privacy and surveillance concerns. The team is urging stronger safeguards in the upcoming IEEE 802.11bf standard as the technology could turn ubiquitous routers into invisible tracking tools.

Analysis

This is less a single-product headline than a regime-shift for the privacy stack: it moves surveillance from point solutions toward ambient, low-cost inference embedded in ubiquitous infrastructure. The second-order effect is that “non-camera” sensing becomes commercially viable precisely because it rides on existing enterprise and consumer WiFi installs, which means the addressable market expands much faster than traditional biometrics or security hardware. That should re-rate vendors that can monetize detection/identity/behavior analytics, while compressing the value of incumbents whose moat is hardware access rather than inference quality.

The losers are the companies exposed to consent-risk and compliance friction: consumer WiFi equipment vendors, managed network providers, and any platform that markets “smart building” occupancy analytics without strong privacy controls. A key nuance is that the immediate damage is not to router ASPs but to upgrade cycles and procurement decisions in enterprises, hotels, campuses, and public venues where legal departments may now slow purchases or demand feature disablement. Over 6-18 months, expect a bifurcation: premium security/networking vendors with explicit governance features can take share, while commodity networking names face a modest multiple haircut from “surveillance liability” even if unit demand holds.

The catalyst path is regulatory, not technical. The market will likely underprice how quickly this becomes a standards issue: if IEEE/region-specific rules force encryption or opt-out controls on feedback telemetry, the addressable surveillance use case can be clipped before commercial adoption scales; absent that, the risk broadens over years as model performance improves with more training data. The contrarian view is that this is not immediately a mass-deployment trade because the attack surface still depends on nearby network density and implementation quality; near-perfect lab accuracy may overstate real-world reliability in cluttered environments and across firmware revisions. That argues for trading the policy response and enterprise procurement reaction, not the science alone.

Key Decisions for Investors

• Long PANW / short a basket of commodity networking exposure (e.g., CSCO, HPE on a relative basis) over 3-6 months: if privacy concerns trigger enterprise demand for governance and telemetry controls, security-first platforms should gain wallet share while hardware-only vendors see muted multiples. Risk/reward: ~2:1 if PANW re-rates on compliance features; stop if the theme stays academic and procurement churn doesn’t materialize.
• Buy 6-12 month calls on CRWD as a proxy for identity, device trust, and policy enforcement spend. The thesis is that ambient surveillance raises demand for endpoint/network correlation and anomaly detection, expanding security budgets even without direct product exposure. Best entry on any pullback tied to broader software de-risking; risk is that the spend shifts to networking OEMs instead.
• Short a small basket of consumer/privacy-vulnerable IoT and smart-building names on strength for 1-2 quarters. The market may begin discounting liability and consent friction for occupancy analytics and ambient sensing features before regulation is finalized. Keep size modest: this is a sentiment trade, not a fundamental collapse story.
• Monitor EU and U.S. standards/regulatory headlines; if IEEE 802.11bf or privacy rules tighten, add to long security software and cover network shorts quickly. If no rulemaking emerges within 6 months, fade the move as the market likely reverts to treating this as a niche academic attack.