Your WiFi Router Is Already a Surveillance Device. Indian Law Has Not Caught Up.

Key Takeaways:

• WiFi signals naturally pass through walls and change measurably when they encounter a human body; researchers have been exploiting this for over 15 years
• A 2022 Carnegie Mellon University paper, "DensePose From WiFi," demonstrated that a deep neural network can reconstruct a full human body surface map from WiFi signal disturbances alone, with accuracy comparable to camera-based systems
• In September 2025, the IEEE ratified the 802.11bf standard, which officially bakes human sensing capability into the WiFi specification itself; every new WiFi router shipped under this standard will natively support sensing applications
• This is not a future threat; open-source implementations are already publicly available, and commodity hardware enabling CSI extraction costs under Rs 1,000
• Indian law has three specific gaps: it does not cover ambient signal exploitation without network access, its privacy provisions are written around visual capture rather than RF-derived body maps, and there is no general private-actor surveillance statute
• The IT Act 2000 Sections 43 and 66E, BNS 2023 Sections 77 and 356, and DPDP Act 2023 Section 4 are the closest applicable provisions, each with significant limitations
• The correct legal response is not to wait for new legislation; existing provisions can be applied creatively, and a cyber law advocate can identify the strongest available ground for each specific fact pattern

In 2009, a researcher at the University of Utah named Neal Patwari made a headline that most people did not take seriously: WiFi signals could detect motion in another room. The technology press ran it for a day and moved on.

Fourteen years later, researchers at Carnegie Mellon University took the same physics and fed it through a deep neural network trained on Facebook's DensePose computer vision architecture. The output was not motion in another room. It was a detailed surface map of a human body, reconstructed from nothing but the WiFi signals that pass through every wall in your home.

By 2025, the IEEE had ratified a new standard that makes this sensing capability an official part of the WiFi specification. Every chipmaker producing WiFi hardware for the 802.11bf standard now builds sensing into the device by design.

The technology moved from a University of Utah curiosity to an IEEE global standard in fifteen years. Indian law has not moved at a comparable pace. This post explains what the technology actually is, how it works, what is already happening with it, and what Indian law currently can and cannot do about it.

The Physics: Why WiFi Sees Through Walls

To understand why WiFi sensing works, you need to understand what WiFi signals actually are.

WiFi operates on radio frequencies, typically 2.4 GHz and 5 GHz, with 6 GHz added in more recent deployments. Radio waves at these frequencies pass through most building materials, including wood, plaster, brick, and glass, with varying degrees of attenuation. This is why your WiFi router can serve devices in rooms it cannot see. The signal passes through the walls between them.

When those radio waves encounter a human body, something specific happens. The human body is roughly 60% water by mass, and water is a strong absorber of radio frequency energy. Some of the signal is absorbed, some is reflected, and some is diffracted around the body. The result is a characteristic disturbance in the signal pattern between the router and any receiving device. That disturbance changes when the person moves, breathes, or shifts their position. Even the expansion and contraction of the chest during normal breathing creates a measurable periodic variation in the signal at approximately 0.1 to 0.5 Hz.

This is the physical foundation of all WiFi-based human sensing. It is not a vulnerability in the WiFi protocol. It is a consequence of the fundamental physics of radio wave propagation. The signal disturbance occurs whether or not anyone is trying to exploit it, because physics does not require permission.

Further reading: MIT Technology Review's history of WiFi sensing from 2009 to 2024: https://www.technologyreview.com/2024/02/27/1088154/wifi-sensing-tracking-movements/

From Signal Strength to Body Maps: A 15-Year Research Arc

The research history of WiFi human sensing is longer than most coverage acknowledges. Understanding it makes the current moment easier to read accurately.

2009: Patwari's Motion Detection

Neal Patwari at the University of Utah demonstrated that WiFi signal strength variations between nodes in a mesh network could detect the presence and movement of a person in an adjacent room. The technique used Received Signal Strength Indicator (RSSI), the single-number signal strength value that consumer devices expose. Accuracy was limited. The technique could confirm human presence and broad movement, but not fine-grained body position.

2013-2018: The MIT CSAIL Work

Dina Katabi's group at MIT's Computer Science and Artificial Intelligence Laboratory systematically advanced the field through a series of projects, including WiTrack, WiSee, and Emerald. These systems used different frequency bands and more sophisticated signal processing, progressively improving resolution from room-level presence detection to gesture recognition to fall detection to vital sign monitoring. The MIT work demonstrated that with better signal processing, WiFi-range radio signals could extract remarkably detailed human behavioral information without any visual sensing.

Katabi described the fundamental principle: wireless signals do not just carry data. They also carry information about the environment they move through.

2019-2022: Deep Learning Changes the Ceiling

The application of deep neural networks to WiFi sensing data removed the ceiling on what was achievable. Previous systems used handcrafted signal processing algorithms designed by researchers who understood what specific signal patterns corresponded to specific human activities. Deep learning replaced the handcrafted features with learned representations. The neural network learned what the signals corresponding to different body positions looked like directly from training data, without the researchers having to specify those relationships explicitly.

This shift in methodology is what enabled the CMU breakthrough.

2022: DensePose From WiFi (Carnegie Mellon University)

The paper "DensePose From WiFi," submitted to arXiv on December 31, 2022, by researchers Jiaqi Geng, Dong Huang, and Fernando De la Torre at Carnegie Mellon University, represents the most technically complete demonstration of WiFi-based human body reconstruction published to that point.

The CMU team developed a deep neural network that maps the phase and amplitude of WiFi signals to UV coordinates within 24 human body regions. The UV coordinate system is borrowed from 3D computer graphics: it represents the surface of a 3D human body as a 2D texture map, where every point on the body surface has a specific UV coordinate pair. The network's output is a dense correspondence map covering 24 body regions including arms, torso, legs, and head, along with 17 skeletal keypoints matching the COCO body keypoint format used in standard computer vision benchmarks.

The key result: the CMU model estimated dense human pose with accuracy comparable to image-based approaches, using WiFi signals as the only input.

The paper explicitly addresses privacy, framing the work as paving the way for privacy-preserving algorithms for human sensing. The framing was that WiFi sensing avoids capturing photographic images. This is technically accurate. Whether a system that reconstructs a full body surface map of a person through the walls of their home without their knowledge is privacy-preserving in any meaningful legal sense is a different question, and one the paper did not engage with.

Full paper: "DensePose From WiFi" — Geng, Huang, and De la Torre (CMU), arXiv:2301.00250: https://arxiv.org/abs/2301.00250

Channel State Information: The Data That Makes This Possible

The gap between Patwari's 2009 work and the CMU 2022 results is not just deep learning. It is also the shift from RSSI to Channel State Information (CSI).

RSSI is a single-number summary of signal strength between a WiFi transmitter and receiver. It is low-dimensional and loses most of the information in the signal.

CSI is a far richer measurement. Modern WiFi systems using the 802.11n/ac/ax standards transmit data simultaneously across multiple frequency sub-channels using a technique called Orthogonal Frequency Division Multiplexing (OFDM). A standard WiFi channel contains 52 to 256 separate sub-carriers depending on the channel width. The receiving device measures the amplitude and phase of the signal on each sub-carrier separately, producing a full complex-valued vector of measurements rather than a single number. This vector is the Channel State Information.

CSI captures the fine-grained structure of how the signal has changed between transmission and reception. Different sub-carriers respond differently to the same physical obstruction. A human body does not affect all 52 sub-carriers identically because the body's absorption and reflection characteristics vary with frequency. This frequency-dependent variation is information that RSSI completely discards and CSI preserves.

When combined with multiple antenna pairs (MIMO) and multiple spatial paths, the dimensionality of the CSI dataset becomes sufficient for a neural network to learn detailed body position from signal data. The CMU system used two sets of three WiFi antennas, generating nine signal transmission paths through the sensing area simultaneously.

The practical challenge of CSI extraction is that most consumer WiFi routers do not expose raw CSI data to the user. The hardware measures it internally for the purpose of managing transmission, but the operating system interface does not make it accessible. Certain devices, including modified firmware builds for specific Intel WiFi chipsets and the ESP32-S3 microcontroller, expose CSI data to software. This is what limits the deployment barrier rather than eliminating it.

Technical reference: IEEE 802.11bf overview (NIST): https://www.nist.gov/publications/ieee-80211bf-enabling-widespread-adoption-wi-fi-sensing

802.11bf: When Sensing Becomes the Standard

The most consequential development in WiFi sensing is not any individual research paper or open-source project. It is the IEEE 802.11bf amendment to the WiFi standard, published on September 26, 2025.

The formation of Task Group 802.11bf was first discussed in the IEEE 802.11 Working Group in July 2019. The objective was to develop an amendment that defines modifications to the WiFi medium access control and physical layer specifications to enhance WLAN sensing operation in license-exempt frequency bands between 1 GHz and 7.125 GHz and above 45 GHz.

The official IEEE definition of WLAN sensing is: the use of PHY and MAC features of IEEE 802.11 stations to obtain measurements that may be useful to estimate features of objects in an area of interest. Features include range, velocity, angular position, and motion. Objects explicitly listed include humans and animals.

The 802.11bf amendment formally defines sensing as a use case that WiFi hardware should natively support, alongside data communication. It specifies sensing measurement procedures, roles for initiator and responder stations, and a "sensing by proxy" feature that allows a station to request sensing measurements from another station on its behalf.

MIT Technology Review reported that when the new standard goes into effect, it will allow every WiFi device to easily and reliably extract the signal measurements needed for sensing applications. One researcher described the projected adoption as "explosive."

The significance of 802.11bf for this legal analysis is this: once the standard is fully adopted by chipmakers, WiFi sensing capability will not require special firmware, modified hardware, or laboratory conditions. It will be a feature of standard consumer WiFi routers, built in by the chip manufacturer. The deployment barrier, already low, becomes near-zero.

Standard reference: IEEE 802.11bf-2025, published September 26, 2025: https://standards.ieee.org/ieee/802.11bf/11574/

What This Technology Can Be Used For

The legitimate applications of WiFi-based human sensing are real and have documented value.

Healthcare and Elder Care

Falls are the leading cause of injury-related death among older adults globally. Camera-based fall detection raises significant dignity concerns, particularly in bedrooms and bathrooms. WiFi sensing can detect falls, prolonged stillness, abnormal respiratory rate, and unusual movement patterns without capturing any visual image. Several startups have moved toward commercial elder care monitoring products built on this principle.

Hospital Patient Monitoring

ICU patients require continuous monitoring of vital signs. Contact-based monitoring uses adhesive electrodes and pulse oximeters that create infection risk and patient discomfort. WiFi-based non-contact vital sign monitoring has been demonstrated in clinical research contexts and is being evaluated for specific monitoring applications.

Disaster Response and Search and Rescue

Locating survivors in collapsed buildings or smoke-filled structures is one of the clearest legitimate use cases. Conventional approaches require rescuers to enter unstable structures. Thermal imaging cameras require line-of-sight. WiFi sensing can detect breathing and movement through debris at distances up to several metres without requiring physical proximity to the survivor.

Smart Building Management

Occupancy detection for energy management, HVAC optimization, and security monitoring are all commercial applications where WiFi-based presence detection provides value without requiring cameras in every room.

Gesture Control and Human-Computer Interaction

At shorter range and higher granularity, WiFi sensing enables hands-free gesture control of devices, which is an active area of product development for smart home and accessibility applications.

These applications are legitimate. Acknowledging them is not a concession that the privacy risks are acceptable. It is an accurate picture of the technology's dual-use reality.

The Surveillance Threat: What the Technology Actually Enables

The same physical capability that locates an earthquake survivor through rubble enables the following without any modification to the technology:

A person in an adjacent flat, hotel room, or parked vehicle can determine whether the target is home, where in the home they are, when they are in a bedroom or bathroom, what their resting vital signs are, and whether another person is present with them. None of this requires connecting to the target's WiFi network. None of it produces a visual image. None of it generates any signal that the target's devices would register. There is no audible component. The target has no means of detecting the monitoring through normal awareness.

A ACLU staff technologist, Daniel Kahn Gillmor, specifically flagged WiFi sensing by state actors as a privacy concern for activists, noting that law enforcement access to this data creates another category of metadata that can be abused, with significant historical precedent for such overreach.

The threat model is not hypothetical. It is the straightforward extension of demonstrated technology to surveillance applications using hardware that costs under Rs 2,000 for a complete three-node sensing array.

Further reading: The ACLU's assessment of WiFi sensing and law enforcement surveillance, via MIT Technology Review: https://www.technologyreview.com/2024/02/27/1088154/wifi-sensing-tracking-movements/

What Indian Law Currently Covers — and What It Does Not

India's legal framework for addressing WiFi-based human surveillance requires threading together four bodies of law, and the result is a picture with significant gaps.

The Bharatiya Nyaya Sanhita (BNS) 2023

Section 77 of the BNS, which replaced Section 354C of the Indian Penal Code, covers voyeurism. It criminalizes watching, capturing, or disseminating the image of a woman engaged in a private act without consent, in circumstances where she would not expect to be observed. The provision targets camera-based voyeurism. Its use of the word "image" is the central limitation for WiFi-based sensing applications. A WiFi-derived body surface map is not an image in the photographic sense. Whether a court would interpret "image" to extend to a non-visual electromagnetic reconstruction of body position is an open legal question that has not been tested in Indian courts.

Section 356 of the BNS creates an offence of criminal breach of privacy covering intentional capture, publication, or transmission of an image of a private area of any person without consent. The same "image" interpretation challenge applies. A purposive reading of the provision, focusing on the legislative intent to protect bodily privacy rather than the specific medium of capture, could bring WiFi sensing within Section 356's scope. But this requires a court to take that purposive approach, and it cannot be assumed.

The Information Technology Act 2000

Section 66E of the IT Act criminalizes the intentional capture, publication, or transmission of an image of a private area of any person without consent in circumstances violating that person's privacy. The provision was enacted in the context of camera-based privacy violations and uses "image" in the same sense as the BNS provisions. The same interpretive challenge applies.

Section 43 covers unauthorized access to computer systems. If a person installs sensing hardware on or directly connected to a victim's WiFi network without authorization, Section 43 provides a cleaner basis for prosecution. However, WiFi DensePose and similar systems can be deployed entirely passively, by reading radio frequency signals that pass through walls from a device the attacker does not access or authenticate to. Passive RF sensing of ambient signals does not constitute access to a computer resource under current IT Act case law.

Section 66 covers computer-related offences including dishonest or fraudulent acts causing damage. Its application to passive RF sensing faces the same access requirement challenge.

The DPDP Act 2023

The Digital Personal Data Protection Act 2023 provides the most direct coverage for organizational deployments of WiFi sensing. Body position, movement patterns, vital signs, and behavioral data derived from WiFi sensing are personal data under the Act's definition: data about an identifiable individual. Where a Data Fiduciary deploys WiFi sensing to monitor identifiable individuals, Sections 4 and 5 of the DPDP Act require a lawful purpose and a notice to the data principal. Processing this data without consent is a clear DPDP violation.

The limitation is the Data Fiduciary definition. The DPDP Act's obligations apply to persons who process personal data as Data Fiduciaries, which primarily captures organizations and businesses. A private individual deploying a CSI sensing array to monitor a neighbour does not fit the Data Fiduciary mold as cleanly as a company would. Additionally, the Data Protection Board, through which the Act's enforcement operates, is not yet fully operational.

The Constitutional Right to Privacy

The Supreme Court's judgment in K.S. Puttaswamy v. Union of India (2017) established privacy as a fundamental right under Article 21 of the Constitution. This constitutional recognition is significant for setting the direction of interpretation. Where a court must choose between a narrow reading of "image" that excludes WiFi sensing and a purposive reading that includes it, the Puttaswamy right to privacy provides constitutional backing for the purposive approach.

The limitation is that Article 21 rights are directly actionable against State action. Against private individuals conducting surveillance, the constitutional right must be translated into specific statutory provisions to support a complaint.

The Three Specific Legal Gaps

First: ambient signal exploitation without network access. If the attacker reads radio frequency signals that pass through walls from the victim's router without ever authenticating to the network, no IT Act provision currently addresses this. The signals are broadcast by the victim's own device into shared physical space. There is no unauthorized access to a computer resource. The gap requires either legislative action or judicial interpretation extending the IT Act's unauthorized access concept to cover passive RF sensing.

Second: non-visual surveillance. All of India's privacy offence provisions, from Section 66E of the IT Act to Sections 77 and 356 of the BNS, are drafted around visual capture. WiFi sensing produces neither a photograph nor a video. A body surface map generated from RF data is functionally equivalent to a visual image for privacy purposes, but legally it may not qualify as an "image" under provisions drafted before this technology existed.

Third: absence of a general private-actor surveillance statute. India does not have a standalone surveillance statute that prohibits non-consensual monitoring of individuals by private actors across all technological modalities. The existing framework is a patchwork of specific provisions in the IT Act, the BNS, and the DPDP Act, each with its own definitional scope. The gaps between those provisions create the legal space through which WiFi-based surveillance currently falls.

Legal references:

• IT Act 2000 (Ministry of Electronics and IT): https://www.meity.gov.in/content/information-technology-act
• BNS 2023 (Legislative Department): https://legislative.gov.in/acts/the-bharatiya-nyaya-sanhita-2023/
• DPDP Act 2023 (Full text, MeitY): https://meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf
• K.S. Puttaswamy v. Union of India (2017), Supreme Court of India: https://main.sci.gov.in/supremecourt/2012/35071/35071_2012_Judgement_24-Aug-2017.pdf

The Strongest Legal Arguments Available Right Now

While a legislative gap exists, victims of WiFi-based surveillance in India are not without recourse. The following arguments represent the strongest available grounds under current law.

For individual victims:

The most direct route is Section 356 of the BNS (criminal breach of privacy) combined with Section 66E of the IT Act. Both require proof of intentional capture of a private area without consent. The argument that a WiFi-derived body surface map constitutes an "image" of a private area is strengthened by the Puttaswamy constitutional right to privacy and the well-established principle of purposive statutory interpretation. The provision's intent was to protect bodily privacy. A technology that reconstructs body surface maps without cameras achieves the same invasion by different means. Counsel should frame the argument around the legislative purpose rather than the literal meaning of "image."

For organizational deployments:

Where WiFi sensing is deployed by an employer, service provider, property owner, or any entity that can be categorized as a Data Fiduciary under the DPDP Act, Sections 4 and 5 of the Act provide the clearest basis for enforcement. The DPDP Act does not require proof that the data was an "image." It requires proof that personal data was processed without a lawful purpose and without notice to the data principal. Body position and vital sign data derived from WiFi sensing are personal data. Processing them without consent is a violation.

For detection-based investigation:

A complaint under BNSS Section 176(3), requesting forensic expert involvement in a cyber crime investigation, is the procedural tool for having the sensing hardware identified and documented as evidence. An investigating officer who finds an ESP32 or CSI-capable device placed in proximity to a victim's home or workplace has physical evidence of the deployment. Digital forensic analysis of the device can establish what data was collected, how long monitoring occurred, and whether the data was transmitted or stored.

Complaint channel: National Cyber Crime Reporting Portal: https://cybercrime.gov.in CERT-In advisories on emerging threats: https://www.cert-in.org.in

What the Legislative Gap Requires

The three gaps identified above point to what comprehensive legislative reform would need to address.

A technology-neutral surveillance statute for India would prohibit non-consensual monitoring of any person's physical presence, location, movement, or biological functions by any technological means, including but not limited to optical, acoustic, electromagnetic, and radio frequency sensing, without the person's knowledge and consent. Such a statute would not require legislators to enumerate every future sensing technology. It would cover all of them by defining the protected interest, physical privacy, rather than the prohibited means of violation.

The DPDP Act moves in this direction for organizational deployments. It needs extension to cover private individual actors, and it needs to be paired with an explicit prohibition on the collection method, not just the processing of data once collected.

Until that legislation exists, the courts are the primary arena. A test case establishing that WiFi-derived body surface maps constitute "images" within the meaning of IT Act Section 66E or BNS Section 356 would do more to close the legal gap than years of waiting for legislative action.

Frequently Asked Questions

Q: WiFi sensing through walls — is this actually real, or is it overstated?

A: The technology is real and has been demonstrated in peer-reviewed research at major institutions over fifteen years. The most technically rigorous demonstration to date is the 2022 Carnegie Mellon University paper "DensePose From WiFi," which reconstructed full human body surface maps from WiFi signals with accuracy comparable to camera-based systems. The practical deployment requirements, particularly the need for CSI-capable hardware rather than standard consumer routers, create a barrier that limits casual deployment today. The ratification of the IEEE 802.11bf standard in September 2025, which builds sensing capability into the WiFi specification itself, will progressively lower that barrier as new hardware is produced.

Q: Does an attacker need to connect to my WiFi network to monitor me using this technology?

A: No. That is the most important legal gap the technology creates. WiFi sensing reads the radio frequency signals that your router broadcasts through your walls, which it does whether or not any device is connected. An attacker with CSI-capable hardware placed in an adjacent room, flat, or vehicle can collect sensing data from those signals without ever authenticating to your network. The IT Act provisions that criminalize unauthorized access to computer systems require proof of access to a computer resource. Passive collection of RF signals from a network the attacker never joins does not constitute unauthorized access under current case law. This is the gap that most urgently requires either legislative action or judicial extension of existing provisions.

Q: What is Channel State Information and why does it matter legally?

A: Channel State Information is per-subcarrier amplitude and phase data that WiFi hardware already measures internally to manage signal transmission. Unlike RSSI, which is a single aggregated number, CSI captures how the signal has changed at each of dozens of frequency sub-channels simultaneously. This dimensional richness is what allows neural networks to extract detailed body position information from it. Legally, CSI is significant because it is not data a person chooses to make available. It is a measurement of physical reality that the hardware makes automatically. Nobody consented to having their body's interaction with radio waves measured and processed into body maps, because until recently it was not technically possible to do so. The law has not yet addressed what rights a person has over CSI data derived from their body's interaction with signals they did not originate.

Q: What should I do if I suspect I am being monitored through WiFi sensing?

A: Three immediate steps. First, file a complaint at cybercrime.gov.in and specifically describe the technology, referencing WiFi Channel State Information sensing, so the complaint is routed to a technically equipped unit. Second, do not disturb any suspected sensing hardware; its location and physical condition are evidence. Third, consult a cyber law advocate before framing the complaint, to identify the strongest available provision for your specific fact pattern. The current legal framework has gaps, but a purposively argued complaint under BNS Section 356, IT Act Section 66E, and the DPDP Act can mount a credible case pending test litigation that resolves the interpretive questions.

Q: Is WiFi sensing legal for employers to deploy in the workplace in India?

A: An employer deploying WiFi sensing to monitor employees' presence, movement, or vital signs in a workplace context is a Data Fiduciary processing personal data under the DPDP Act 2023. Processing that data without a lawful purpose, without notice to the employee-data principals under Section 5, and without consent or other lawful basis under Section 4 is a DPDP violation. Workplace surveillance policies must be transparent, purposively limited, and disclosed to the people being monitored. An employer who installs WiFi sensing infrastructure and does not disclose it to employees or include it in their privacy notice faces exposure under the DPDP Act. For specific workplace deployment scenarios, counsel should additionally assess whether the monitoring falls within the scope of existing employee privacy protections and industrial relations law.

Q: What is 802.11bf and why does it matter for India's legislative agenda?

A: IEEE 802.11bf is the amendment to the WiFi standard, published September 26, 2025, that formally defines sensing as a native WiFi capability. Under 802.11bf, WiFi hardware will natively support detection and estimation of range, velocity, position, motion, and other features of objects in the sensing area, explicitly including humans and animals. This means that as new routers and access points are manufactured to the 802.11bf standard, WiFi sensing will not require special firmware or modified hardware. It will be a button in the router administration interface. For India's legislative agenda, 802.11bf means the deployment barrier for WiFi-based surveillance will drop to near-zero within the product replacement cycle of consumer and enterprise WiFi hardware. Legislation that was less urgent when CSI extraction required modified firmware becomes urgent when it requires no modification at all.

References:

1. "DensePose From WiFi" — Geng, Huang, De la Torre (Carnegie Mellon University), arXiv:2301.00250 (December 2022): https://arxiv.org/abs/2301.00250
2. IEEE 802.11bf-2025 WiFi Sensing Standard (published September 26, 2025): https://standards.ieee.org/ieee/802.11bf/11574/
3. MIT Technology Review — "How Wi-Fi sensing became usable tech" (February 2024): https://www.technologyreview.com/2024/02/27/1088154/wifi-sensing-tracking-movements/
4. NIST — "IEEE 802.11bf: Enabling the Widespread Adoption of Wi-Fi Sensing": https://www.nist.gov/publications/ieee-80211bf-enabling-widespread-adoption-wi-fi-sensing
5. Synced Review — CMU DensePose From WiFi technical breakdown: https://syncedreview.com/2023/01/17/cmus-densepose-from-wifi-an-affordable-accessible-and-secure-approach-to-human-sensing/
6. ACM Computing Surveys — "Wi-Fi Sensing Techniques for Human Activity Recognition": https://dl.acm.org/doi/10.1145/3705893
7. Open Source For You — "Open Source WiFi DensePose Demonstrates Camera-Free Motion Detection Through Walls" (March 2026): https://www.opensourceforu.com/2026/03/open-source-wifi-densepose-demonstrates-camera-free-motion-detection-through-walls/
8. IT Act 2000 (MeitY): https://www.meity.gov.in/content/information-technology-act
9. DPDP Act 2023 (MeitY): https://meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf
10. BNS 2023 (Legislative Department): https://legislative.gov.in/acts/the-bharatiya-nyaya-sanhita-2023/
11. K.S. Puttaswamy v. Union of India (2017), Supreme Court: https://main.sci.gov.in/supremecourt/2012/35071/35071_2012_Judgement_24-Aug-2017.pdf
12. National Cyber Crime Reporting Portal: https://cybercrime.gov.in