Through-Wall Surveillance

From Nano World Order - Wiki
Revision as of 04:52, 23 September 2026 by Geckopico (talk | contribs) (Create: Through-Wall Surveillance)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Through-Wall Surveillance refers to the detection, tracking, and monitoring of human presence, movement, physiological signals, and behaviour through solid physical barriers — walls, floors, ceilings — without any device implanted on or carried by the subject. A wide spectrum of technologies enables this capability, ranging from purpose-built military radar systems to the passive repurposing of everyday commercial Wi-Fi infrastructure. The field has advanced rapidly since the 2010s, driven by machine learning, cheap commodity radio hardware, and a regulatory environment that has not kept pace with what the technology can do. For Targeted Individuals, privacy advocates, and security researchers, through-wall surveillance represents one of the most immediately deployable and hardest-to-detect forms of covert monitoring available today.

Wi-Fi signals penetrating walls can be used to detect and track human movement

Overview

Through-wall surveillance encompasses any technique that uses signals capable of penetrating construction materials — radio waves, ultrasound, millimetre-wave radiation — to reconstruct information about what is happening on the other side of a barrier. The signals may be purpose-generated by an active transmitter, or they may be ambient signals already present in the environment, such as Wi-Fi transmissions from a neighbour's router or a nearby access point.

Documented capabilities from peer-reviewed research now include:

  • Detection of human presence or absence
  • Counting the number of occupants in a room
  • Localisation and real-time tracking of individuals
  • Gait recognition and individual identification by walking pattern
  • Fall detection for elderly care — and, conversely, covert monitoring
  • Respiratory rate and breathing rhythm extraction
  • Heart rate monitoring
  • Gesture and hand-motion recognition
  • Lip movement detection
  • Keystroke inference from finger micro-movements

This is no longer speculative. Each of the above has been demonstrated in published, peer-reviewed academic literature, largely using unmodified commercial Wi-Fi hardware. The same capabilities exist, at greater range and penetration depth, in dedicated military and law enforcement radar systems linked to programs run by DARPA and intelligence agencies.

Wi-Fi CSI-Based Sensing

The dominant civilian research direction in through-wall surveillance is Channel State Information (CSI)-based sensing. Channel State Information (CSI) describes how a wireless signal propagates from transmitter to receiver across each individual subcarrier frequency in an OFDM (Orthogonal Frequency Division Multiplexing) Wi-Fi link. Unlike the simpler Received Signal Strength Indicator (RSSI), which collapses all signal information into a single power value, CSI preserves the amplitude and phase response across dozens or hundreds of subcarriers simultaneously — providing a rich, high-dimensional fingerprint of the radio channel.

When a human body moves within a space — breathing, walking, turning — it perturbs the multipath propagation environment. Radio signals reflect off walls, furniture, and the human body itself; a moving body changes which reflections arrive at the receiver, at what delay, and at what phase. These perturbations are captured in the CSI measurements extracted from standard Wi-Fi packet exchanges. By processing these changes over time, researchers can reconstruct the nature, location, and identity of the movement that caused them.

Crucially, ordinary commercial Wi-Fi infrastructure requires no hardware modification to function as a passive sensing array. A router and one or more clients already exchange CSI implicitly as part of normal 802.11n/ac/ax operation. Modified firmware or driver-level access (such as the Intel 5300 CSI tool, or Nexmon patches for Broadcom chipsets) allows researchers — and, by extension, adversaries — to extract this data stream from commodity hardware costing less than fifty dollars.

Channel Sounding — the process by which a transmitter probes the channel and a receiver measures its response — is thus already happening continuously in any Wi-Fi network. The sensing capability is a latent feature of the standard, not an add-on.

The Sounding Loop as Radar

In modern Wi-Fi networks operating under 802.11ac and 802.11ax (Wi-Fi 6), a formalised sounding loop exists as part of the beamforming protocol. This loop functions analogously to a bistatic radar system:

  1. The access point (AP) transmits a Null Data Packet Announcement (NDPA) frame, signalling that a channel sounding sequence is about to begin.
  2. The AP then transmits a Null Data Packet (NDP) — a special frame carrying no payload data, used purely to probe the channel.
  3. The receiving station measures the channel from this NDP and computes a Compressed Beamforming Matrix summarising the channel state.
  4. This matrix is returned to the AP as Beamforming Feedback Information (BFI) — a compressed representation of CSI — so the AP can adjust its antenna weights to focus signal energy toward the client.

From a surveillance standpoint, this loop constitutes a periodic, structured radar sweep. The NDP acts as the transmitted radar pulse; the BFI returned by the client encodes the channel response — which includes the influence of any moving bodies in the environment. The cycle repeats at intervals determined by the network, potentially hundreds of times per second in active networks.

This architecture means that the radio environment is being actively and repeatedly probed by any 802.11ac/ax network in the vicinity. Any receiver capable of capturing these frames can use the BFI data to perform passive through-wall sensing without transmitting a single packet.

What Can Be Detected

The following capabilities are documented in peer-reviewed literature:

Presence Detection

Human presence can be detected with accuracy exceeding 98% using simple CSI variance thresholds. Even a stationary, sleeping person introduces detectable perturbations through breathing micro-movements.

Occupancy Counting

Systems have been demonstrated that can count the number of people in a room to within one or two individuals, using the statistical properties of CSI across multiple subcarriers.

Localisation and Tracking

By triangulating CSI perturbations across multiple access points or antenna arrays, real-time 2D and 3D position tracking of individuals has been demonstrated through standard interior walls. MAC Address correlation can link tracked movement to specific devices.

Gait Recognition and Identity

Each person's gait produces a characteristic pattern of Doppler micro-shifts and multipath perturbations in CSI. Deep learning models trained on these patterns can re-identify individuals by their walk with accuracy rates reported between 85% and 99% across different studies — without any biometric database, purely from their movement signature through a wall.

Physiological Signals

Perhaps most striking is the extraction of breathing rate and heart rate from CSI. The chest displacement of normal breathing (approximately 3–5 mm) and cardiac micro-tremor (sub-millimetre) are sufficient to modulate Wi-Fi signals measurably. Published systems report breathing rate accuracy within ±1 breath per minute and heart rate estimates within a few BPM under controlled conditions.

Gesture and Fine Motor Recognition

Hand gestures, finger movements, and even lip movement have been inferred from CSI perturbations, opening the possibility of passively reading sign language, counting keystrokes on a physical keyboard, or monitoring speech articulation — all through a wall.

Dedicated through-wall radar systems use UWB pulses to image subjects behind barriers

Dedicated Through-Wall Radar Systems

Military and law enforcement agencies have deployed purpose-built through-wall sensing systems that do not depend on ambient Wi-Fi:

  • Ultra-Wideband (UWB) Radar: transmits short pulses across a very wide frequency band, achieving fine range resolution and deep wall penetration. Systems such as the Camero Xaver series and DARPA-funded platforms can produce real-time human silhouettes through concrete walls.
  • Millimetre-Wave (mmWave) Radar: operates at 60–90 GHz, offering high angular resolution. Used in security screening and increasingly in smart home devices (Google's Soli chip in Pixel phones uses mmWave radar for gesture sensing at close range).
  • MIMO Radar Arrays: multiple transmit and receive antennas provide spatial diversity and aperture synthesis, enabling high-resolution imaging through barriers. DARPA's HISS (Human Identification at a Distance) and related programs have explored these architectures.
  • Stepped-Frequency Continuous Wave (SFCW) Radar: sweeps through frequencies sequentially, synthesising a wideband response. Used in law enforcement "see-through-wall" devices marketed to police departments.

These systems are distinct from, but increasingly convergent with, Directed Energy Weapons platforms that use similar millimetre-wave technology — see Active Denial System for the directed energy end of the millimetre-wave spectrum.

Passive vs Active Systems

Active systems generate their own dedicated sensing signal. Purpose-built radars, Wi-Fi access points operated by the sensing party, and UWB devices all fall into this category. They offer the greatest control over signal characteristics but require the sensing party to operate transmitting hardware.

Passive systems exploit ambient radio signals already present in the environment — Wi-Fi from a neighbour's network, cellular signals, digital TV broadcasts, or FM radio. The sensing party only needs a receiver. Passive sensing is significantly harder to detect (no novel RF emissions) and requires no legal authorisation to transmit. The trade-off is less control over signal characteristics and typically lower signal-to-noise ratio.

Wi-Fi CSI-based through-wall sensing occupies a hybrid position: the Wi-Fi signals driving the sensing may originate from third-party infrastructure, but a cooperative client device in the target space (owned by or accessible to the sensing party) actively participates in the sounding loop.

The Unencrypted BFI Problem

A critical and largely unaddressed vulnerability in current Wi-Fi standards is that Beamforming Feedback Information frames are transmitted in plaintext — unencrypted — even in networks using WPA2 or WPA3 encryption for data traffic.

BFI frames carry the compressed channel state matrices that encode the physical environment, including the positions and movements of people within it. Because these frames are not encrypted, any device within radio range can capture them using a standard Wi-Fi adapter in monitor mode. No association with the network is required. No decryption is necessary. The channel state data is simply there, in the clear, for anyone with the right software to collect.

This means that a party with no physical access to a property, no relationship with its occupants, and no legal intercept authority can nonetheless passively harvest fine-grained environmental and physiological data about the people inside — using nothing more than a laptop and open-source software. The IEEE 802.11 standard committee has not mandated BFI encryption, and no civilian regulatory framework in any jurisdiction specifically prohibits or regulates CSI-based passive sensing.

Machine Learning Integration

The transformation of raw CSI data into actionable intelligence about human activity is accomplished through machine learning. The pipeline typically involves:

  1. Feature extraction: converting raw CSI amplitude/phase time series into spectrograms, Doppler maps, or statistical feature vectors
  2. Classification or regression models: convolutional neural networks (CNNs), recurrent neural networks (RNNs), or transformer architectures trained to map CSI features to activity labels
  3. Transfer learning: models trained in one environment generalise — imperfectly but usably — to novel environments

Published accuracy figures for key tasks using this pipeline:

  • Activity recognition (walking, sitting, standing, falling): >95% in trained environments
  • Person identification by gait: 85–99%
  • Breathing rate estimation: ±1 breath per minute
  • Emotion inference from physiological signals (heart rate variability, breathing pattern): reported at 70–80% for basic categories (calm, excited, stressed)

The emotion inference capability is particularly significant: it implies that a passive observer with access to ambient BFI frames could infer the emotional state of building occupants with no physical contact, no implanted device, and no awareness by the target. This is directly relevant to the experiences reported by many Targeted Individuals who describe remote monitoring of their psychological states.

Deep learning models process radio frequency channel data to reconstruct human activity

Government and Military Research

DARPA has funded multiple programs in this domain:

  • DARPA CROSSHAIRS: through-wall human detection and tracking
  • DARPA HISS: Human Identification at a Distance, including through-barrier scenarios
  • DARPA NESD and N3: neural interface work that intersects with remote physiological monitoring

The FBI and Department of Homeland Security have deployed commercial through-wall radar to law enforcement without public disclosure of the legal framework governing their use, according to reporting by the Wall Street Journal (2015). Fusion Centres — the joint federal-state-local intelligence hubs — are a probable distribution point for such capabilities to local law enforcement.

The convergence of through-wall surveillance with Remote Neural Monitoring programs — which purportedly extend sensing to neural signals — is an area of active concern among researchers and Targeted Individuals communities. The physiological signal extraction already demonstrated (heart rate, breathing, micro-tremor) forms a technological continuum toward more invasive sensing modalities. See also Electronic Harassment and Targeted Individual Phenomenon.

Internet of Bodies infrastructure, including Wireless Body Area Network devices and Smart Dust concepts, creates additional signal sources that could be exploited by through-wall sensing systems — particularly as these devices proliferate inside homes. 5G and 6G networks, with their dense antenna deployments and millimetre-wave frequencies, significantly expand the passive sensing surface area of the urban environment.

Deployment Concerns

Several classes of actors have privileged access to the data flows that enable CSI-based through-wall surveillance:

  • Internet Service Providers (ISPs): ISP-provided routers often include remote management capabilities; ISPs can in principle access router-level radio statistics
  • Smart home device manufacturers: devices such as Amazon Echo, Google Nest, and similar products contain Wi-Fi chipsets that could be leveraged for CSI extraction via firmware update
  • Building management systems: in commercial buildings, Wi-Fi infrastructure is centrally managed and its data flows accessible to building operators and, potentially, state actors with legal process
  • Telecom infrastructure operators: in 5G deployments, dense small-cell installations create overlapping sensing coverage of outdoor and indoor spaces

The Internet of Things proliferation means that the number of Wi-Fi radio nodes in a typical home — and therefore the potential sensing density — has increased dramatically, with no corresponding increase in occupant awareness or legal protection.

Standards and the Regulatory Gap

The IEEE 802.11 standards body has introduced Wi-Fi Sensing as a formal use case in the 802.11bf amendment (finalised 2024), which explicitly standardises CSI-based sensing as a feature of Wi-Fi networks. While 802.11bf includes provisions for consent signalling between sensing initiator and responder within the same network, it does not address:

  • Third-party passive interception of BFI frames from networks the sensing party does not control
  • Cross-wall sensing of occupants who have no relationship with any device in the network
  • Encryption of BFI/CSI data carried in management frames

No civilian telecommunications regulator — not the FCC, Ofcom, or equivalent bodies — has issued rules specifically governing CSI-based sensing. The capability exists in a legal grey zone: it is not wiretapping (no communications content is intercepted), not unauthorised computer access (no network is joined), and not covered by existing surveillance law frameworks designed for optical or acoustic surveillance.

Counter-Surveillance

Options for individuals seeking to limit their exposure to through-wall Wi-Fi sensing include:

Physical Shielding

RF-attenuating materials — copper mesh, aluminium foil laminates, specialised RF-blocking wallpaper and paint — can reduce signal penetration. A true Faraday cage construction would eliminate external Wi-Fi sensing, but practical whole-room implementations are expensive and difficult to maintain. Partial shielding reduces accuracy without eliminating the threat.

Channel Perturbation Injection

Experimental countermeasures involve introducing deliberate, artificial perturbations into the Wi-Fi channel — random reflectors, moving objects, or software-defined radio (SDR) injectors that corrupt CSI measurements for external observers while leaving the legitimate network functional. These approaches remain largely in academic prototype stage.

Network Configuration

Reducing the frequency of beamforming sounding exchanges (where router firmware permits) limits the rate of CSI data generation. Disabling 802.11ac/ax beamforming entirely forces the network to operate without NDP-based channel sounding, though at a cost to performance.

Regulatory and Legal Approaches

Researchers and civil liberties organisations have called for:

  • Mandatory encryption of BFI and CSI-carrying management frames in future 802.11 amendments
  • FCC and equivalent regulatory bodies to classify CSI-based sensing of non-consenting individuals as a form of unlawful surveillance
  • Transparency requirements for smart home and ISP hardware regarding CSI data collection and retention

See Also

Retrieved from "https://nanoworldorder.com/wiki/index.php?title=Through-Wall_Surveillance&oldid=2384"