Yes, Wi-Fi Technology Can Map Your House

Maddy, Cyb3rMaddy on YouTube, is a cyber analyst and security educator with over 100K subscribers on YouTube. She’s associated with Hive Mind Security and covers cybersecurity full-time: threat breakdowns, hands-on tool walkthroughs, vulnerability explainers, and security news. Her approach is deliberate: she builds understanding rather than alarm, and she consistently covers topics that matter before they reach mainstream awareness.

Her content spans beginner entry points and technical depth depending on the topic. What holds it together is the format: she shows her work. Demonstrations, outputs, real hardware. It’s the kind of channel that's useful whether you’re new to security or just want to see something working rather than described.

I’ve been hearing about Wi-Fi sensing for a while. The IEEE ratified 802.11bf in September 2025 and the academic research goes back years. But this is my first time seeing it exemplified so thoroughly in practice. Her recent video is the clearest consumer-level demonstration I’ve come across. Here’s what she covers, and why the regulatory picture hasn’t kept pace.

Maddy opens by showing the hardware: standard off-the-shelf consumer equipment, nothing specialized. The point she makes early: this isn’t a nation-state capability or a research lab setup. This is the kind of hardware you’d find at any electronics retailer.

She then demonstrates what happens to the signal when someone moves through the space. The underlying mechanism is Channel State Information (CSI): a measurement of how a Wi-Fi signal distorts between transmitter and receiver. When a person moves, the distortion pattern shifts. Those shifts are readable without touching packet content, without cameras, without modifying the router.

CSI is richer than older signal-strength measurement: rich enough to infer posture and gesture, not just presence. And because Wi-Fi passes through walls, the physical barriers that limit cameras don’t apply.

By the end of the demonstration, Maddy has established the core point cleanly: a device you can buy, running software you can find, using the wireless signal already broadcasting in any home or office, can resolve who is in a room and what they’re doing, without a single camera in the picture.

The video covers more than position and identity. She also demonstrates vital sign monitoring (heart rate and breathing rate extracted from signal distortion through walls) and covers commercial deployments that aren’t coming: they’re already here. Xfinity’s WiFi Motion feature ships natively on XB7+ gateways, notifying customers of motion events with no additional hardware (a proprietary pre-standard implementation, separate from 802.11bf, but the same underlying physics). The hardware walkthrough and the full commercial deployment scope are worth watching directly.

Carnegie Mellon’s DensePose from WiFi used two standard routers and a neural network to reconstruct 3D body positions from signal data alone, approaching vision-based systems in their test conditions.

This is what the output looks like when Maddy runs the tracking test:

Researchers at Germany’s Karlsruhe Institute of Technology (KASTEL) demonstrated passive biometric identification at ACM CCS 2025. Their paper, BFId, tested 197 subjects and reached roughly 99.5% identification accuracy using Beamforming Feedback Information (BFI) frames: a compressed, SVD-derived form of channel state data that 802.11ac/ax clients transmit back to the access point in plaintext, even on WPA3 networks. Unlike earlier CSI-based approaches that required modified firmware or specialized hardware, BFI is passively capturable off the air with no modification to the network. Each person’s body shapes the signal distinctly enough to identify them across viewing angles and walking patterns. No enrollment, no opt-in, no modification to the access point required.

The research record here is important context for what Maddy demonstrates. This isn’t fringe research or a novel exploit; it’s a documented capability with years of work behind it, including peer-reviewed conference publication. What the video provides is something the papers don’t: a working demonstration on accessible hardware, with visible outputs, that a non-specialist audience can evaluate for themselves.

In September 2025, the IEEE ratified 802.11bf, a new standalone amendment to the 802.11 standard that defines sensing procedures for sub-7 GHz bands (the same spectrum used by Wi-Fi 6 and Wi-Fi 7) and 60 GHz. It requires explicit chipset support; no existing Wi-Fi 6 or Wi-Fi 7 device is automatically sensing-capable. Qualcomm and Intel are building that support into their next-generation chips. By 2027–2028, most new routers ship with it built in.

What 802.11bf standardizes is the interface between the sensing capability and the hardware: a common protocol so applications can request and receive signal data from any compliant chipset. Fall detection, occupancy management, security systems that distinguish humans from pets. Those use cases are real and the standard serves them.

The same interface also enables at-a-distance, through-wall, passive detection of who is present and where. Any application running on a compliant router can request that data. The standard specifies how to get it; it does not specify what you’re allowed to do with it.

Existing privacy regulation is camera-centric. Surveillance law was built around visible sensors: something with a lens, a light, a discernible footprint. Wi-Fi sensing has none of those. It operates passively from hardware indistinguishable from a device doing nothing unusual, through walls, with no indicator that sensing is active.

The ACLU’s Daniel Kahn Gillmor has flagged the law enforcement dimension plainly: “We have lots of examples of law enforcement overreach.” RF sensing derives information from wireless signal behavior rather than visual capture. That distinction puts it outside most legal frameworks currently governing surveillance.

The KIT/KASTEL finding compounds this. Passive presence detection is one thing; passive identity inference (at 99.5% accuracy, from plaintext beamforming frames your device broadcasts automatically, with no firmware modification required) from a sensing layer in a building you entered is another. The legal category for the latter doesn’t reliably exist yet.

This applies beyond residential settings. Workplaces, hotels, hospitals: any space with a Wi-Fi router carries the same sensing surface. Who controls the router, and what they’re permitted to do with its sensing output, is an open question in most jurisdictions.

Bottom Line

The standard is ratified. The research is peer-reviewed. The chipsets are shipping. Cyb3rMaddy’s video is a good demonstration of what this looks like in practice, and I hadn’t seen it executed this clearly before.

Policy is behind. The surveillance law that exists was written for visible sensors. Wi-Fi sensing is invisible by default: same hardware, different software configuration, no observable indicator.

I’ve written about similar dynamics with physical surveillance infrastructure that outpaces its accountability frameworks. See the piece on Flock Safety cameras for a parallel look.