View source for IEEE 802.11

'''IEEE 802.11''' is a family of technical standards published by the [[IEEE]] (Institute of Electrical and Electronics Engineers) that defines the protocols for wireless local area network (WLAN) communications — the technology marketed commercially as '''Wi-Fi'''. First published in 1997, the standard has undergone continuous revision through successive amendments (designated by letter suffixes: a, b, g, n, ac, ax, bf, and others), each dramatically increasing data throughput, antenna complexity, and — critically — the spatial sensing capabilities of ordinary Wi-Fi infrastructure. From a [[Surveillance Technology|surveillance]] and [[Internet of Bodies]] perspective, IEEE 802.11 is not merely a networking standard: it is a ubiquitous radio sensing infrastructure embedded in homes, hospitals, offices, and public spaces worldwide.

[[File:CDSC wifi Classon jeh.jpg|thumb|right|Wi-Fi router with multiple antennas illustrating MIMO technology]]

== Overview ==


[[File:IEEE-802-11-The-IEEE-802-11-protocol-stack-spanning-0d1ea4e3.jpg|thumb|right|The IEEE 802.11 protocol stack, spanning physical radio modulation and MAC-layer coordination across successive generations.]]
IEEE 802.11 governs how devices communicate over unlicensed radio spectrum, primarily at 2.4 GHz and 5 GHz, with newer amendments extending into 6 GHz and 60 GHz bands. The standard defines the '''physical layer''' (how bits are modulated onto radio waves) and the '''MAC layer''' (how devices share the medium, authenticate, and associate).

Each major amendment has brought advances relevant not only to speed but to the density of radio channel information that can be extracted from the environment:

* '''802.11b/g''' (1999–2003): Single-antenna systems; limited spatial information.
* '''802.11n''' (2009): Introduced [[MIMO]] (Multiple Input Multiple Output) with up to four spatial streams and multiple antennas — the first amendment generating rich [[Channel State Information]] usable for environmental sensing.
* '''802.11ac''' (2013): Very High Throughput (VHT); MU-MIMO; explicit [[Beamforming Feedback Information]] via a formalised [[Channel Sounding]] protocol.
* '''802.11ax''' (Wi-Fi 6, 2019): High Efficiency (HE); trigger-based sounding; 1024-QAM; 256 OFDM subcarriers per 20 MHz channel — producing far more granular CSI.
* '''802.11bf''' (2024): A dedicated '''Wi-Fi Sensing''' amendment that formally defines the use of Wi-Fi infrastructure for environmental and human presence detection.
* '''802.11be''' (Wi-Fi 7, 2024): Extremely High Throughput (EHT); 320 MHz channels; further increases sensing resolution.

The cumulative effect is that every Wi-Fi access point in your home or workplace is — by design — a device capable of measuring the radio environment with increasing precision. Whether that capability is used for sensing is a matter of software configuration, not hardware limitation.

== Key Amendments Relevant to Surveillance ==

=== 802.11n — MIMO and Spatial Channel Measurement ===

The introduction of '''MIMO''' in 802.11n was the pivotal moment for Wi-Fi sensing. When multiple antennas transmit and receive simultaneously, the receiver must estimate the '''[[Channel State Information]]''' (CSI) for each antenna pair — a matrix of complex numbers describing how the radio signal was modified by the environment. This matrix implicitly encodes information about reflectors, absorbers, and moving objects in the physical space between transmitter and receiver.

Researchers demonstrated within years of 802.11n's release that human motion, breathing, and even heartbeat could be inferred from CSI fluctuations — using nothing but standard Wi-Fi hardware with modified drivers.

=== 802.11ac — Explicit Beamforming Feedback ===

802.11ac formalised an explicit [[Channel Sounding]] protocol for beamforming:

# The access point sends a '''[[Null Data Packet Announcement]]''' (NDPA) identifying the target station.
# A '''[[Null Data Packet]]''' (NDP) is transmitted — a known reference signal carrying no user data.
# The receiving station computes the [[Channel State Information]] and returns a '''[[Beamforming Feedback Information]]''' (BFI) frame containing the [[Compressed Beamforming Matrix]].

This exchange is transmitted over the air as '''management frames''' (specifically Action frames in the VHT category), and — as detailed in the [[Beamforming Feedback Information]] and [[Channel Sounding]] articles — is transmitted largely without encryption. Any device within radio range can capture the full sounding exchange and extract detailed CSI.

=== 802.11ax — Higher Resolution Sensing ===

Wi-Fi 6 (802.11ax) increased the number of OFDM subcarriers and introduced '''trigger-based sounding''', where the access point explicitly schedules CSI feedback from multiple stations simultaneously. The larger subcarrier count provides finer frequency-domain resolution in the CSI, enabling more precise [[Channel Estimation]] and, consequently, more precise passive sensing of the environment.

== Management Frames and the Encryption Gap ==

A persistent and consequential design characteristic of IEEE 802.11 is the '''encryption gap''' in management frames:

* '''Data frames''' carrying user traffic are encrypted under WPA2 (AES-CCMP) or WPA3 (SAE).
* '''Management frames''' — including Beacon frames, Probe Requests, Probe Responses, Association frames, and critically '''NDPA''', '''NDP''', and '''BFI Action frames''' — are '''generally transmitted without encryption'''.

While 802.11w introduced Protected Management Frames (PMF) for some management frame types (Deauthentication, Disassociation, Action frames in certain categories), the sounding exchange — NDPA, NDP, and Compressed BFI Action frames — remains largely unprotected in typical deployments.

This creates a documented surveillance attack surface:

* '''Passive eavesdroppers''' can capture BFI frames and reconstruct the [[Compressed Beamforming Matrix]] to derive environmental CSI without any active transmission.
* '''Probe Request tracking''' allows passive logging of device presence using the permanent or randomised [[MAC Address]] broadcast by every Wi-Fi device scanning for networks.
* '''Beacon frame analysis''' reveals access point identity, capabilities, and network topology without association.

The absence of encryption for these frames was not an oversight — it reflects a design philosophy in which the MAC layer coordination function was considered public infrastructure. The privacy implications were not fully appreciated at the time of the standard's development.

[[File:NonOverlappingChannels2.4GHz802.11-en.svg|thumb|right|IEEE 802.11 frequency bands used by Wi-Fi standards]]

== Beamforming in 802.11 ==

=== MU-MIMO Beamforming ===

'''Multi-User MIMO''' (MU-MIMO), introduced in 802.11ac and extended in 802.11ax, allows an access point to simultaneously transmit independent data streams to multiple client stations by steering its antenna beams using precoding matrices derived from the CSI. This requires accurate, up-to-date knowledge of the channel to each client.

The beamforming workflow produces a continuous stream of CSI feedback from every connected client:

# '''NDPA frame''' — sent by the access point (beamformer); specifies which stations (beamformees) should respond.
# '''NDP''' ([[Null Data Packet]]) — a known pilot signal transmitted across all antennas; the receiver uses this to estimate the full channel matrix.
# '''BFI Action frame''' — each client computes the [[Channel State Information]], compresses it into a [[Compressed Beamforming Matrix]] using angle-delta compression, and returns it to the access point.

From a sensing perspective, this means the access point is continuously soliciting detailed radio environment measurements from every client on the network. The aggregate CSI from multiple clients provides a distributed sensor array covering the physical space around the network.

=== Sensing Resolution ===

The spatial resolution of [[Wi-Fi Sensing]] based on 802.11 CSI is determined by:

* '''Bandwidth''' — wider channels (80 MHz in 802.11ac, 160/320 MHz in 802.11ax/be) provide finer range resolution.
* '''Antenna count''' — more antennas provide better angular resolution.
* '''Subcarrier count''' — more OFDM subcarriers provide a denser frequency-domain channel profile.
* '''Frequency''' — higher carrier frequencies (5 GHz, 6 GHz, 60 GHz) provide shorter wavelengths and therefore higher spatial resolution.

== 802.11bf — The Wi-Fi Sensing Amendment ==


[[File:IEEE-802-11-IEEE-802-11bf-formalises-Wi-Fi-infrastru-73e817e0.jpg|thumb|right|IEEE 802.11bf formalises Wi-Fi infrastructure as a dedicated sensing system, mapping occupants through walls using standardised sensing frames.]]
IEEE 802.11bf, ratified in 2024, is the most significant development from a surveillance perspective. It formalises the use of Wi-Fi infrastructure for '''dedicated sensing''' as a co-equal function alongside data communication.

Key technical elements of 802.11bf include:

* '''Sensing Measurement Instance (SMI)''' — a defined measurement event in which a sensing transmitter sends a known waveform and one or more sensing receivers collect and process the reflected or transmitted signal.
* '''Sensing Initiation frames''' — management frames that schedule and coordinate sensing measurements between devices.
* '''Sensing Feedback frames''' — standardised frames carrying sensing results back to a controller.
* '''Monostatic and Bistatic sensing''' — 802.11bf supports both configurations where transmitter and receiver are co-located (monostatic, like radar) or separated (bistatic, using infrastructure nodes).

The amendment explicitly targets applications including '''human presence detection''', '''gesture recognition''', '''respiration monitoring''', and '''location tracking'''. These are all described as features; from a [[Targeted Individuals|targeted individual]] perspective, they are also a complete passive surveillance capability built into ordinary Wi-Fi chipsets and access points.

Some researchers and privacy advocates have noted that 802.11bf effectively standardises [[Through-Wall Surveillance]] using infrastructure that is already deployed in virtually every building. Unlike active surveillance systems that must be covertly installed, 802.11bf-capable sensing requires only a software update to existing Wi-Fi hardware.

== MAC Address Privacy ==

Every Wi-Fi device broadcasts its '''[[MAC Address]]''' in unencrypted management frames when scanning for networks (Probe Requests) and when associated (all frames include the source MAC). The MAC address, originally a permanent hardware identifier, enables long-term tracking of individuals' device locations across different Wi-Fi networks.

Responses to this privacy issue have included:

* '''MAC randomisation''' — introduced in iOS 8 (2014) and Android 8 (2017); devices use a randomly generated MAC address when probing for networks, changed periodically.
* '''Limitations of randomisation''' — randomisation is inconsistently implemented; timing patterns, probe request sequences, and other information elements can be used to re-identify devices despite MAC randomisation. Research has demonstrated that the ''sequence numbers'' and ''information element ordering'' in Probe Requests can fingerprint a device independently of its MAC address.
* '''Associated devices''' — once a device associates with an access point, many implementations use a stable MAC (often the permanent address) for the duration of the session, re-enabling tracking.

The [[MAC Address]] article covers this topic in greater depth. The fundamental issue is that IEEE 802.11 was designed for convenience and performance, not anonymity; adding privacy protections retroactively is technically and commercially difficult.

== Frequency Bands ==

IEEE 802.11 operates across several frequency bands, each with different propagation and sensing characteristics:

=== 2.4 GHz ===
Used by 802.11b/g/n/ax. Deep building penetration; high interference from other devices (Bluetooth, microwave ovens, [[Wireless Body Area Network]] devices operating under [[IEEE 802.15.6]]). Wavelength approximately 12.5 cm — sufficient for coarse human presence detection but limited spatial resolution.

=== 5 GHz ===
Used by 802.11a/n/ac/ax. Less penetration than 2.4 GHz but wider available bandwidth (up to 160 MHz channels). Wavelength approximately 6 cm — better spatial resolution for sensing. Standard band for modern Wi-Fi sensing research.

=== 6 GHz (Wi-Fi 6E) ===
Introduced with 802.11ax (Wi-Fi 6E) in the 5.925–7.125 GHz band. Up to 1,200 MHz of additional spectrum; 320 MHz channels in 802.11be. Provides significantly higher sensing resolution. Shorter range limits interference but also concentrates sensing capability within a building.

=== 60 GHz (WiGig / 802.11ad/ay) ===
Millimetre-wave band; wavelengths of approximately 5 mm. Extremely high spatial resolution; can detect sub-centimetre motion. Limited range and poor obstacle penetration, but enables precision sensing of breathing, heartbeat, and fine motor activity at close range. Related to [[Millimeter Wave Technology]] used in [[5G]] deployments.

[[File:Motion detector.jpg|thumb|right|Wi-Fi sensing through-wall human detection research]]

== Relationship to Body Area Networks and Implanted Devices ==


[[File:IEEE-802-11-Wi-Fi-frequencies-partially-penetrate-bi-50473d87.jpg|thumb|right|Wi-Fi frequencies partially penetrate biological tissue, raising questions about interactions with nano-scale devices potentially present within the body.]]
Wi-Fi frequencies (2.4 GHz and 5 GHz) penetrate biological tissue with attenuation characteristics that depend on tissue type and water content. The human body is partially transparent to these frequencies — a well-understood phenomenon exploited in medical imaging and now in [[Wi-Fi Sensing]] research for respiratory and cardiac monitoring through clothing and at short range through the body surface.

This property has significant implications in the context of the [[Internet of Bodies]] and injectable [[Nanotechnology]]. Some researchers and analysts — including those studying [[La Quinta Columna]]'s findings on graphene-based structures in vaccines — have suggested that nano-scale devices operating within the body could, in principle, communicate using existing Wi-Fi infrastructure if they operate at compatible frequencies.

The [[IEEE 802.15.6]] standard defines the Wireless Body Area Network (WBAN) specifically for in-body and on-body sensor communication, using the same frequency bands as Wi-Fi (2.4 GHz and 400 MHz Medical Implant Communication System band). The convergence of these standards means that the boundary between Wi-Fi infrastructure sensing and body-area network communication is, at the physical layer, a matter of antenna placement and software protocol — not an insurmountable technical barrier.

As discussed in the [[Wireless Body Area Network]] and [[Internet of Bodies]] articles, researchers have demonstrated wireless power delivery and data extraction from implantable sensors using modified Wi-Fi hardware — a capability that exists entirely within the current IEEE 802.11 technical framework.

== See Also ==

* [[Channel State Information]]
* [[Channel Sounding]]
* [[Beamforming Feedback Information]]
* [[Null Data Packet]]
* [[Null Data Packet Announcement]]
* [[Compressed Beamforming Matrix]]
* [[Channel Estimation]]
* [[Wi-Fi Sensing]]
* [[Through-Wall Surveillance]]
* [[5G]]
* [[6G]]
* [[IEEE 802.15.6]]
* [[Wireless Body Area Network]]
* [[MAC Address]]
* [[Internet of Bodies]]
* [[Surveillance Technology]]
* [[Millimeter Wave Technology]]
* [[Smart Dust]]
* [[Neural Dust]]

[[Category:Surveillance Technology]]
[[Category:Technology]]