RF Privacy — Counter-Sensing Audit
5 emitters tracked · 2 above the sensing-risk floor · posture 55/100
Defenses and Their Limits
Sensing NDP encryption
802.11bf does not mandate encrypted sensing NDPs the way 802.11az mandates secure-LTF. Vendor-dependent today.
Not enforceable by the venue owner
CSI fuzzing
Randomised phase offsets injected by cooperating APs degrade an eavesdropper's channel estimate.
Costs throughput; only helps for compliant infrastructure
Obfuscation emitters
Low-power scramblers raise the noise floor in the 0.1–0.5 Hz breathing band.
Can break legitimate sensing and may be regulated
Passive metasurfaces
Tuned reflective panels shape leakage away from the building perimeter.
Static; effective only for the geometry it was tuned to
Perimeter Leakagehow much occupancy escapes
Lobby → street
Occupancy inferable at 18 m
Meeting room A → corridor
Motion inferable, identity unlikely
Exec office → car park
Presence only
Server room → alley
Below inference floor
802.11bf Privacy Gap
802.11bf makes sensing a first-class capability but does not mandate encrypted sensing null data packets the way 802.11az mandates secure-LTF for ranging. Privacy protection stays vendor-dependent, so enterprise buyers must ask for it explicitly.
[████████······] 55%
Further Reading
- A Survey on Secure WiFi Sensing TechnologyMDPI Sensors, 2025 — attack/defense taxonomy
- RF Sensing Security SurveyarXiv, 2025 — comprehensive overview
- Awesome-WS-Security430+ papers · Victim / Weapon / Shield taxonomy
- Detection ladderWhat CSI can detect — the attacker's target list
Wavey is an awareness layer, not a medical or legal-grade surveillance detector.