Your WiFi Can See You Through Walls. Also: Discord Secretly Scanned Faces for Peter Thiel, Amazon Killed a Surveillance Deal, DHS Tried Suspending PreCheck (It Lasted 12 Hours), and DOGE's Year of Make-Believe Savings
February 22, 2026
1. Every WiFi Router Is a Potential Surveillance Camera. German Researchers Just Proved It.
Researchers at Germany’s Karlsruhe Institute of Technology (KIT) have demonstrated that ordinary WiFi routers can identify specific people with near-perfect accuracy. Through walls. Without the target carrying a phone, connecting to the network, or doing anything at all.
Professor Thorsten Strufe and doctoral researcher Julian Todt from KIT’s Institute of Information Security and Dependability (KASTEL) tested the technique on 197 volunteers and achieved identification rates approaching 100%, regardless of viewing angle or walking style. They presented their findings at the ACM Conference on Computer and Communications Security in Taipei last October. The European Commission posted about the research on social media this week, which is when most of the world noticed. The researchers did the work. The EU put it on X.
Here’s how it works. WiFi devices on a network regularly send something called beamforming feedback information (BFI) back to the router. This data is transmitted unencrypted and readable by any device within range. When a human body passes through or near the WiFi signal, the radio waves are disrupted in ways specific to that individual. Unlike cameras, which only capture your outer surface, WiFi signals interact with internal structures: bones, organs, body composition. The result is a biometric signature as distinctive as a fingerprint, formed entirely from radio waves passing through you.
“By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present,” Strufe explained. “This works similar to a normal camera, the difference being that radio waves instead of light waves are used for the recognition. Thus, it does not matter whether you carry a WiFi device on you or not.” Switching your phone off won’t help. “It’s sufficient that other WiFi devices in your surroundings are active.”
No special hardware is needed. A standard WiFi device will do. Once the underlying machine-learning model is trained, identification takes seconds.
“This technology turns every router into a potential means for surveillance,” warned Todt. “If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later, for example by public authorities or companies.”
Fellow researcher Felix Morsbach acknowledged that easier surveillance methods currently exist (CCTV, video doorbells). But he warned that “the omnipresent wireless networks might become a nearly comprehensive surveillance infrastructure with one concerning property: they are invisible and raise no suspicion.”
The researchers are calling for privacy protections in the upcoming IEEE 802.11bf WiFi standard, which governs how WiFi sensing works. Whether standards bodies listen to security researchers before deployment, rather than after, is another question entirely.
Consider the scale. WiFi routers exist in virtually every home, office, restaurant, airport, and public space in the developed world. The surveillance infrastructure isn’t being built. It’s already installed. It’s just waiting for the software.
Sources: KIT Press Release, ACM CCS Paper, Interesting Engineering, Physics World, Athens News
2. Discord Ran a Secret Biometric Experiment. Surprise: It Was Linked to Peter Thiel.
Discord announced recently that all users worldwide will be defaulted to “teen mode” until they verify their age. The platform offered reassurances: most people won’t need to show ID. AI-powered video selfies will estimate your age. Easy.
Then researchers discovered the fine print.
In the UK, Discord had been running a quiet experiment with Persona, an age verification vendor backed by Founders Fund (co-founded by Peter Thiel, whose other venture, Palantir, is one of the largest surveillance contractors on earth). Discord didn’t disclose the partnership publicly. Users discovered it through an FAQ disclaimer that Discord posted, then deleted: “If you’re located in the UK, you may be part of an experiment where your information will be processed by an age-assurance vendor, Persona.”
The real kicker: security researchers who examined Persona’s exposed frontend code found the system performs 269 individual verification checks on submitted data, including screenings for terrorism and espionage. For an age check. On a chat app.
This comes barely a year after a third-party breach of a previous Discord age verification partner exposed 70,000 users’ government IDs. Discord’s global head of product policy had told The Verge that IDs are “deleted quickly, in most cases, immediately after age confirmation.” The deleted FAQ said Persona would store data for up to 7 days.
After the backlash, Discord confirmed the Persona experiment has ended, the partnership is terminated, and all collected data has been deleted. Discord promised to “keep our users informed as vendors are added or updated.” Translation: next time they’ll tell you which surveillance vendor is scanning your face before you find out from security researchers.
Persona’s CEO spent the week responding to furious users.
The UK’s Online Safety Act and Australia’s under-16 social media ban are what’s driving all of this. Governments mandate age verification. Platforms scramble to comply. Surveillance vendors collect biometric data. The data gets breached. Repeat.
Sources: Ars Technica, BBC, Malwarebytes, PC Gamer, IBTimes UK
3. Amazon Blinked. Public Outrage Actually Worked.
File this one under “rare victories.”
Amazon’s Ring cancelled its planned integration with Flock Safety, the surveillance company that makes license plate reader cameras used by police departments, ICE, and school districts across the country. The partnership would have connected Ring’s 20+ million doorbell cameras to Flock’s law enforcement network, creating a real-time surveillance mesh covering residential neighborhoods nationwide.
The plan imploded after Ring’s Super Bowl ad. The 30-second spot showcased a feature called “Search Party”: AI scans footage across the entire Ring camera network to help locate a lost dog. Heartwarming on TV. In practice, a live demonstration that Ring could activate millions of private cameras to scan for any target on command. The Electronic Frontier Foundation called it a “surveillance nightmare.” Privacy advocates, civil liberties groups, and ordinary customers piled on.
Ring and Flock described the cancellation as “mutual,” with Ring claiming the integration “would require significantly more time and resources than anticipated.” (Translation: the PR damage exceeded whatever the contract was worth.) No Ring video data was ever sent to Flock, as the integration hadn’t launched yet.
But here’s what Flock Safety still does without Ring: the company operates tens of thousands of automated license plate readers across the US, feeding data to local police, federal agencies including ICE, and school security systems. A report from The 74 Million noted that Flock cameras are deployed in school zones, tracking the movements of parents and students alongside everyone else.
The victory is real but narrow. Ring walked away from one partnership. The underlying surveillance infrastructure, where your car’s plate is captured dozens of times per day by cameras you never consented to and fed into searchable databases accessible by law enforcement without a warrant, remains fully operational. The next partnership will be quieter.
Sources: CNBC, NY Times, 9to5Mac, Variety, The 74 Million
4. DHS Tried to Suspend Your PreCheck. That Lasted About 12 Hours.
On Saturday, Homeland Security Secretary Kristi Noem announced that TSA PreCheck and Global Entry would be suspended starting 6 a.m. Sunday because of the partial DHS shutdown. By Sunday morning, PreCheck lanes had closed at airports including LAX and St. Louis Lambert. Then, before noon, DHS reversed itself.
“TSA PreCheck remains operational with no change for the traveling public,” TSA posted on X. Just hours after saying the opposite.
The reversal came after Noem spoke with the White House and TSA officials. It also came after Airlines for America, the US Travel Association, and members of Congress publicly blasted the decision. Airlines for America called the move using “the traveling public” as “a political football.” The US Travel Association said it was “a crisis of [DHS’s] own making.”
Global Entry remains suspended at airports including Boston, Austin, and Vancouver. FEMA entered emergency operating status at the same time, halting all non-disaster responses. With a blizzard currently pounding the Northeast, the timing is not ideal.
More than 20 million Americans are enrolled in TSA PreCheck. They paid $78 to $85 for the privilege of a background check and a faster line. Over 10 million use Global Entry. Both programs are funded by user fees, not the general treasury. Suspending them was a choice, not a budgetary necessity.
The shutdown started February 14 after Democrats demanded changes to DHS operations following the fatal shootings of Renee Good and Alex Pretti in Minneapolis by federal immigration agents last month. The Republican majority won’t budge. Neither will the Democrats.
Polymarket bettors have $4 million riding on how long this lasts. Current odds price a 70%+ chance the shutdown drags past two weeks.
Here’s the part that should bother you: the parts of DHS that surveil, detain, and deport people never stopped. ICE and CBP have been fully operational this entire time, funded through last year’s One Big Beautiful Bill Act. The parts that serve you (TSA screening, disaster relief, cybersecurity) are the ones going dark. The announce-then-reverse stunt on PreCheck tells you everything about the calculation. Make travelers suffer just long enough to generate headlines, then “generously” restore service. Global Entry users? They can keep waiting.
Sources: ABC News, The Guardian, CNBC, Washington Post, CNN
5. DOGE Spent a Year Cutting Government. The Government Got Bigger.
DOGE turns one year old this month. Elon Musk showed up with a chainsaw and a mandate from the president to slash federal waste. One year and nearly 30,000 terminated grants and contracts later, USA TODAY did the math on what actually happened.
The headline number: DOGE claims $110 billion in savings across 64 agencies. That’s about $323 per American.
The fine print: nearly 30% of those grants and contracts had already been fully paid before they were “terminated.” You can’t save money on a bill that’s already been settled, but you can put it on a website and call it efficiency. DOGE’s own tracker hasn’t been updated since October 4.
Then there’s how the cuts were made. A lawsuit by the Authors Guild revealed that two DOGE operatives, Nate Cavanaugh (a college dropout who founded a startup) and Justin Fox (an associate at a private equity firm), decided which National Endowment for the Humanities grants to kill by feeding grant titles to ChatGPT and asking: “Does the following relate at all to DEI? Respond factually in less than 120 characters.” If the chatbot said yes, the grant was slated for termination. Actual NEH staff, including the Acting Chair, were blocked from removing grants from the kill list.
The pace peaked at over 16,000 terminations in February and March 2025. By September, it had slowed to 373.
But here’s the real punchline: Congress ignored almost all of it. The Washington Times sampled 30 programs Trump proposed slashing or eliminating in his 2026 budget. Only one was eliminated. Of the remaining 29, just two were cut by more than half. The 2026 budget bills actually increase spending over 2025. “Congress largely rejected the discretionary spending cuts President Trump proposed,” said Cato Institute budget analyst Dominik Lett.
Meanwhile, in Kipnuk, Alaska, the EPA cancelled a $20 million flood mitigation grant in May that was supposed to stabilize a riverbank against permafrost erosion. Five months later, Typhoon Halong battered the village. EPA Administrator Lee Zeldin said the project wouldn’t have been complete anyway and suggested the money would have been “swept into the Kuskokwim River.”
DOGE is scheduled to “delete itself” by July 4, 2026. The federal budget will not notice.
Sources: USA Today, Washington Times, Techdirt, Cato Institute