Writing

If you are reading this on your phone or your laptop, there is a good chance you are connected to a WiFi network right now. That network lets you access this page. But it is also doing something else. The WiFi signal passing through your body carries your heart rate, your breathing pattern, and enough information about how you move to identify you personally. Not through a camera. Not through a microphone. Through the radio waves bouncing off your chest. And it works through walls, which means the person extracting this information does not need to be in the same room as you. They do not need to be in the same apartment.

With cheap hardware, published algorithms, and a few hours of work, this information can be extracted. I know because I did it.

What I Built

I am an artist. I work with pen plotters and computational systems. I have no degree in signal processing. What I had was curiosity, about twenty-five euros to spend on two ESP32 microcontroller boards, and access to an AI model. The AI handled everything that would have stopped me: the firmware, the signal processing pipeline, the configuration. I described what I wanted. It wrote the code. When something broke, I described the error, and it fixed it.

The result: a reading of my heart rate, updated in real time, on the first try. It was noisy. The number would sometimes jump. But most of the time it tracked. I checked it against my own pulse. Close enough to be unsettling.

I walked to the other side of the room, about five meters away. Still reading. I walked through the door into the next room. Still there, noisier, less confident, but present. My heartbeat, sensed by a cheap microcontroller through a wall, by someone who had never done this before.

How It Works

WiFi signals propagate through the environment via multiple paths, reflecting off walls, furniture, floors, and bodies. When a router sends a signal to your phone, the phone receives not just the direct transmission but a cloud of reflections from every surface. To decode your internet reliably, the phone measures exactly how the signal was distorted by the environment. That measurement, CSI, is computed continuously by every WiFi device.

Your body creates a distinctive pattern of reflections. When you move, those reflections change. When your chest expands to breathe, the reflections shift by fractions of a wavelength. When your heart beats, the shift is smaller still, but enough. And all of this works through walls, because radio waves pass through walls. That is not a flaw in the technology, that is how WiFi works.

With better hardware, researchers have gone much further. Breathing rate detection with median error below one breath per minute. Heart rate accuracy above 96%. Gait recognition. Activity classification. A 2022 study at Carnegie Mellon demonstrated body pose estimation from WiFi signals under controlled conditions, reconstructing a skeletal model through walls. Not all of this works equally well outside a laboratory. But the trend is consistent: the algorithms improve, the hardware gets cheaper, the list of what can be detected keeps growing.

The Standard

In September 2025, the IEEE published 802.11bf, an amendment to the WiFi standard that formalizes sensing capabilities at the protocol level. Until now, routers computed CSI to decode your internet traffic and discarded the rest. 802.11bf defines how routers can initiate “sensing sessions,” exchange specific frames for channel measurement, and retain the results.

Qualcomm is already developing chipsets that support it. Once these ship in consumer routers, WiFi sensing moves from a research capability to a built-in feature that any software or service provider can activate. The standard does not include any privacy protection, any consent mechanism, or any way to opt out.

The Care Door

Every surveillance infrastructure enters the world through the door of care. CCTV was sold as crime prevention. Phone tracking was sold as finding missing children. This pattern is well documented and has changed nothing.

WiFi sensing will enter through the same door. Is your baby breathing? Is your grandmother alright? The router is just there, doing what routers do, and now it watches over them without asking anyone to wear anything or remember to charge anything. Or take sleep apnea: a clinical diagnosis currently requires a night in a sleep laboratory, wired to machines, sleeping in a strange bed. WiFi sensing can monitor your breathing patterns at home, in your own bed, over weeks, producing better data under real conditions than a single uncomfortable night in a lab ever could.

Some of these applications would save lives. If my doctor suspected sleep apnea, I would rather be monitored by my own router than spend a night in a clinic. If I had an aging parent living alone, I would want to know they had not fallen.

The Moment

But the system I built did not ask me who I wanted to care for. The moment it picked up someone else’s heartbeat through the wall, I was probably breaking the law. Heart rate is biometric data. Under European data protection law, processing biometric data requires explicit consent. I did not have consent from the person in the next room. I did not ask. I did not even know they were there until my screen showed me their breathing pattern. The system does not distinguish between my body and anyone else’s. It senses every body in range, through walls, without asking. I built a GDPR violation for twenty-five euros in an afternoon.

I live in Europe. GDPR is supposed to protect me. And it tries: heart rate is classified as biometric data, a special category that requires explicit consent before processing. The law has good intentions. But GDPR was designed for a world where data processing leaves traces. A website plants cookies you can inspect. An app requests permissions you can review. There is always a trail, and the trail is what makes enforcement possible.

WiFi sensing leaves no trail. Someone can extract your heart rate, your breathing pattern, your position in a room, from the other side of a wall, and you will never know. There is no packet to capture, no log to subpoena, no notification to read. The data can be processed and deleted before you ever suspect it existed. You cannot prove that someone sensed you, because the sensing is physically indistinguishable from normal WiFi operation. GDPR protects you on paper. In practice, you cannot enforce a right against a violation you cannot detect.

And the capabilities go further than vital signs. In laboratory settings, researchers have demonstrated WiFi-based keystroke inference: reconstructing what a person is typing from the micro-movements of their fingers as reflected in CSI. The accuracy is limited today (it works best on numeric keypads, at close range, with a single user typing slowly), but the direction is clear. A research team achieved 88.9% accuracy on numeric input and 96.4% on individual keystrokes under controlled conditions.

Think about the trajectory. Heart rate extraction through walls was a lab curiosity five years ago. Now I can do it with twenty-five euros of hardware. Keystroke inference is at the lab curiosity stage today. The algorithms improve, the hardware gets cheaper and the sensing standards get better. At some point, the gap between “works in a lab” and “works in your apartment” closes, and when it does, someone could read what you type from the radio waves between your fingers and your keyboard. No phishing email. No malware. No trace.

Partition

The sensing experiment became an art project before it became a security problem. Partition is a system where the WiFi signal’s reading of a body drives a pen plotter that draws in real time. A wall, rendered opaque. A peephole. On the other side, a machine drawing. The plotter’s speed is governed by the cardiac rhythm of whoever stands at the peephole, sensed through the wall via WiFi CSI. Heart rate only. Consumed in real time by the drawing process. Not stored.

The viewer consents at the peephole via a GDPR notice, but the artistic exemption means consent was never legally required. The heartbeat data is consumed by the drawing and discarded. Nothing is stored. You cannot reconstruct the heartbeat from the ink. The drawing is a mute record of a system that took what it did not need because nothing prevented it.

The network sees you, and the machine makes a mark. That mark is what the network’s reading of your body looks like when it becomes irreversible matter: ink, paper, time.

Two Walls

What stays with me is not the law, or the technology, or even the dilemma between care and surveillance. It is something simpler.

Two walls fell. The walls of the house, and the walls of the body.

We have always assumed that the physical walls of our homes guarantee some kind of privacy. We suspect our phones are listening, that the algorithms are tracking us, but those are digital walls, and we have learned, reluctantly, that digital walls are thin. The physical walls of your house, though: those still meant something. WiFi sensing dissolves that assumption. The signal passes through the wall, and your body is readable from the other side.

But there is a second wall, and this is the one I cannot stop thinking about. Your skin. The boundary of your own body.

Until now, what happened inside your body was private by default. Your heart rate, your breathing, the rhythm of your sleep: these were yours. Not because they were protected by law, but because they were protected by physics. To access them, someone needed to touch you, or you needed to choose to share them. The boundary of your body was the boundary of your data.

That is no longer true. My heartbeat is no longer just inside me. It is in the room, in the WiFi signal, drifting through the air. When I walk through a mall, my heartbeat floats through the space alongside everyone else’s. When I sit in a museum, my breathing is present in every signal bouncing between the walls. The most internal thing I have, the rhythm that keeps me alive, is already outside me, already readable, in every space where there is a WiFi signal.

We are used to thinking about privacy as something that concerns our behavior: what we browse, what we buy, where we go. Those are things we do, and we can choose not to do them. But your heartbeat is not something you do. It is something you are. It is not a behavior but a condition of being alive.

There is a reason people cry when they hear a heartbeat on an ultrasound. It takes a special machine, a trained person, a room set aside for exactly this. Hearing a heartbeat has always required closeness, intention, care.

WiFi sensing does the same thing, casually, from the next room, to everyone in range, all the time. Nobody set aside a moment for it. Nobody asked if you were ready.

The signal always carried the heartbeat. Nothing was invented. Someone learned where to look. That knowledge does not un-arrive. And we will have to decide, soon, what we want to do about a world where the same signal that could save your grandmother can read a stranger’s body through a wall.

Pascal Piron is an artist based in Luxembourg. Partition (2026) makes WiFi sensing visible through computational drawing.