A GitHub repository that turns ordinary WiFi signals into a through-wall human tracking system crossed 55,000 stars this week, reigniting a debate that touches every WiFi router in every home, office, and apartment building: the same radio waves that deliver your internet connection can reveal whether you are home, where in your building you are, and whether your breathing is irregular — and no law specifically prohibits using them to find out.
The project is the work of Toronto-based developer Reuven Cohen and is built on legitimate academic research from Carnegie Mellon University. But the community reaction it has drawn since first going viral in late February 2026 exposes a gap that will outlast any argument about whether this particular tool works as advertised: the IEEE 802.11bf-2025 standard, ratified last year, will eventually bake WiFi sensing capability into every new router chipset on the market — and no consumer protection framework, in the United States or Europe, has been written to govern what happens next.
ESP32 Nodes, $54 in Hardware, and a Genuinely Contested Capability
RuView works by extracting Channel State Information, or CSI — data that WiFi hardware already collects to manage signal quality — and feeding it into machine learning models trained to recognize how human bodies distort radio waves. The system runs on a mesh of four to six ESP32-S3 microcontrollers, available for roughly $9 each. Cohen claims the platform can reconstruct a 17-point body skeleton through drywall at up to eight meters, detect breathing rates and heart rate, and track multiple occupants simultaneously — all without a single camera, all entirely offline, no cloud required.
The research lineage is real. Carnegie Mellon's "DensePose From WiFi" paper, which RuView explicitly cites, demonstrated that multi-antenna WiFi arrays could generate rough body pose maps in a structured lab environment. MIT demonstrated a related through-wall sensing concept called RF-Pose in 2018 using purpose-built radio hardware. RuView's claim is that it can replicate those results with $9 commodity chips.
Whether it actually does is where the community is split, sometimes bitterly.
A GitHub Issues Tab That Reads Like a Graduate Seminar in Session
Hacker News user Zambyte, reviewing the codebase shortly after it went viral, wrote that the repository reads "more like a framework/prototype rather than a functional WiFi-based detection system." GitHub Issue #299, filed March 24, documents a user running two ESP32 nodes, successfully receiving signal data, and seeing zero skeleton output. Issue #230 noted bluntly that no successful running video of the project had been published. Another issue was titled "looks like a scam project." One LinkedIn commenter put it more sharply: "I've yet to see a single piece of evidence of this project working."
The criticism has a specific technical core. The Carnegie Mellon research RuView cites relied on multi-antenna MIMO hardware — arrays with multiple transmit and receive antennas capable of spatial resolution. The ESP32-S3, the consumer chip at the heart of RuView's architecture, is a single-antenna device. Cohen's proposed workaround is deploying multiple nodes in a mesh to approximate, through distributed geometry, what a MIMO array achieves through antenna physics. Whether that substitution is valid remains unresolved and actively contested.
Cohen has not gone quiet. On March 3, 2026, he defended RuView on LinkedIn as grounded in "published physics, real firmware, and self-verifying proof bundles." The project's own README is more candid than its marketing: pose estimation accuracy without camera-supervised training data sits at a PCK@20 score of roughly 2.5 percent — meaning only 1 in 40 predicted keypoints falls within 20 percent of the correct position. The developers acknowledge that camera-supervised training targets a score above 35 percent, but that phase of development has not yet been completed.
CNX Software's Jean-Luc Aufranc, reviewing the project in a March 2026 analysis, reached a measured conclusion: the underlying WiFi CSI science is real, Espressif Systems itself demonstrated a basic ESP32 CSI implementation in 2022, and the issue tracker contains genuine user engagement — but no independently verified video demonstration of the headline through-wall pose capability has been published.
The "Privacy-Preserving" Framing That Obscures the Actual Risk
Cohen and the RuView documentation repeatedly describe the system as "privacy-preserving" because it captures no video. The framing is technically accurate and substantively misleading.
A GitHub issue filed March 3, 2026, raised by a contributor identifying themselves as a security researcher, put the problem directly: "The open-source nature of this project, while valuable for research, lowers the barrier for misuse significantly." The issue named specific abuse vectors — stalkers monitoring individuals in their homes, employers surveilling remote workers without their awareness, and authoritarian governments conducting covert population monitoring.
The absence of video does not eliminate the surveillance risk; it eliminates the legal framework that was built around video. GDPR and CCPA were both written to govern the collection of personal identifiers and images. Passive CSI-based body tracking collects neither. A threat actor who deploys a $9 ESP32 node in a building's common area and runs RuView to map a neighboring tenant's daily routine and occupancy patterns is conducting surveillance that WPA3 encryption cannot detect — WPA3 secures data packets, not the physical-layer signal distortions that CSI sensing reads — and that no existing privacy regulation in the United States or Europe explicitly covers.
Researchers have been warning about this trajectory for some time. In October 2025, scientists at the Karlsruhe Institute of Technology published findings showing that WiFi identity inference is possible by passively recording beamforming feedback signals — the kind that every connected device broadcasts, unencrypted, to its router — without any special hardware. The target does not need to be carrying a WiFi device for the sensing to work.
The 802.11bf Standard Is the Real Story
The policy stakes behind RuView extend far beyond Cohen's project. The IEEE 802.11bf-2025 standard, ratified by the IEEE Standards Association last year, defines how WiFi routers will formally support sensing applications including human presence detection, activity recognition, and remote wellness monitoring. When chipmakers begin shipping 802.11bf-compliant hardware at scale — and they will, because sensing capabilities are now part of the official specification — the kind of monitoring RuView requires dedicated ESP32 hardware to perform will instead be a feature of the router you already own.
Privacy researcher Claudiu Popa, writing in December 2025, called 802.11bf an "adoption engine" for WiFi sensing, warning that once something becomes a standard, optional becomes everywhere. Popa's concern is not that individual bad actors will deploy RuView today. It is that the regulatory culture needed to govern ambient radio sensing does not exist, and that the technology will normalize faster than policy can pursue it.
Randomizing CSI data at the router level — the most direct technical countermeasure — has been proposed in academic literature but remains unavailable in any commercial router firmware as of May 2026. RF shielding for sensitive spaces such as executive meeting rooms and server facilities is the current state-of-the-art defensive recommendation.
What RuView Can Actually Do Today — and Why That Is Already Enough to Worry About
Strip away both the hype and the debunking, and the picture that emerges is this: RuView reliably delivers coarse presence detection and motion classification on supported hardware. Community testing documented in the issue tracker confirmed basic functionality on Windows using an Intel Wi-Fi 6 AX201 adapter. Full-body pose estimation through walls using the ESP32-S3 mesh is the advertised headline capability, but it has not been independently reproduced outside the developer's own testing environment, and the project's own accuracy metrics confirm it falls well below what camera-based systems can achieve today.
That partial capability is not nothing. Presence detection — knowing whether someone is home, when they left, and when they returned — is surveillance. Breathing rate monitoring — knowing whether the person in the adjacent apartment is asleep — is surveillance. Neither requires a 17-point skeleton to cause harm in the wrong hands.
The applications Cohen intended are legitimate: fall detection for elderly patients living alone, non-camera monitoring in healthcare settings, search-and-rescue sensing through smoke and debris. Those use cases benefit real people. The dual-use problem is that the same sensor mesh a hospital deploys for patient safety can, without modification, be planted outside a domestic violence shelter by someone trying to learn exactly which room a person is sleeping in.
The Gap No Standard Has Closed
Readers who dismiss RuView as a glorified prototype are making the wrong mistake. The question was never whether this specific repository delivers a polished, production-ready surveillance tool today. The question is whether the underlying capability — WiFi signals as a passive, invisible, legally ungoverned sensing layer — is real, accessible, and improving. On all three counts, the answer is yes.
No single reader action closes that gap. But readers who want to accelerate the policy response can demand that the FTC and its counterparts in Europe treat passive CSI-based body tracking as a form of surveillance subject to the same consent requirements as cameras — before 802.11bf chipsets land in every home router and the question becomes considerably harder to answer.
The repository remains active. The stars keep climbing. And the standard that will put this capability into your next router has already been ratified.
ⓒ 2026 TECHTIMES.com All rights reserved. Do not reproduce without permission.
