ØCLOAK隠

802.11bf, the WiFi-sensing amendment, was ratified in September 2025. It reads motion, presence, and respiration through drywall, using the same signal your router already broadcasts. Vodafone's "Who's Home" shipped that December, and consumer products followed within three months of the standard landing.

None of this is new physics. Every WiFi chip computes channel state information to decode traffic, a fine-grained read of how the signal bends on its way between antennas. Sensing keeps that read instead of discarding it. Enough of it, over time, resolves a body moving behind a wall, a chest rising and falling, a room that sits empty or holds a dozen people. Through-wall presence detection has run on a $9 ESP32.

$9

esp32 board

runs through-wall presence detection

$2,000

cheapest tscm sweep

priced for corporate clients

BLE trackers reach the same result from the other direction: a cheap tag, every nearby iPhone relaying its location for free, and no authentication anywhere in the protocol. Countermeasures exist for both, but they carry corporate TSCM price tags. A renter who wants to know whether their unit is being watched has nothing they can afford.

ØCLOAK Guard answers that with a single device on an ESP32-C3. In BLE mode it watches for AirTag, SmartTag, and Tile beacons, including the off-brand clones that skip the anti-stalking key rotation Apple and Samsung added. In WiFi mode it watches for the NDP and NDPA sounding frames that open an 802.11bf session. Both ride in control-plane traffic, which carries no payload encryption to hide behind, so a passive listener flags a sensing session the moment it starts.

The Guard never transmits. It listens, and it reports what it heard. Passive detection is legal in the US and the EU; active jamming is legal in neither, and the Guard does not jam. It tells you a sensor is in the room and leaves the next move to you: cover it, unplug it, walk away, or flood its read with noise.

Target price is $20–25. The first run ships turnkey boards through Seeed Fusion with 3D-printed enclosures; injection molding takes over at a thousand units.

One Guard tells you about one room. The network turns many rooms into a map. Guards and manual reports feed sightings in, the map tags each by location, and a picture of where the sensors sit builds the way Waze builds traffic out of drivers.

A report carries no account. Each device mints a rotating pseudonymous key, and the location rounds to a grid cell before it ever leaves the device, so a sighting lands in the right neighborhood and stops there. It traces back to no address, and to no person who filed it. A hardware detection from a Guard outweighs a manual report until other users confirm it, which keeps one bad actor from painting the map.

The first version is centralized: one API, one map, because that is the version that can exist this year. Decentralization is its own infrastructure project, and it waits until the traffic justifies community-run nodes.

Underneath both the Guard and the map is one skill: RF detection. Channel-state analysis, SDR spectrum work, emitter fingerprinting, sensor fusion. Consumer privacy hardware is one application of it. Counter-drone detection is another, and the work barely changes; a drone is an RF emitter with a control link and a video downlink, and finding it is the same problem as finding a sensing session.

Defense work pays better, and it kills the open-source model through export control and secrecy. Dual-use founders usually get absorbed by the paying customer, and the privacy side goes vestigial.

The structure I am testing keeps the two apart on purpose: one detection engine, trained on drone and emitter data I record myself, with two products over it. A networked defense system funds the research; a local-only consumer detector ships with zero telemetry. Drone detection needs drone data I gather directly, so the consumer device never has to become a harvesting flywheel to feed the model.

If you work in this space, defense or privacy, I would like to hear how you would draw the line.

Where it stands: paper. The threat model, the bill of materials, and the network architecture are written; no hardware has shipped. Next is five ESP32-C3 dev boards, BLE scanning that flags a real AirTag, WiFi monitor mode capturing real sounding frames, and an NLnet grant application before its next deadline. The hardware proves out first, the grant follows, and nothing ships to anyone until both hold.