City of Glass

The next camera will not look like a camera. It will look like a feature update.

At 3.20 in the morning in January 1992, a federal agent stood outside Danny Kyllo’s triplex in Florence, Oregon, with a thermal imager. The device showed no faces and no rooms. It showed heat, which was enough for the government to wonder whether high-intensity lamps were operating inside, an indicator of an indoor marijuana factory.

The intrusion looked cinematic because the equipment still looked like equipment: a special instrument, held by the state, aimed at a home from the street. The Supreme Court eventually treated the scan as a Fourth Amendment search. Justice Antonin Scalia’s opinion in Kyllo v. United States drew a line around the home, and that line mattered. It also depended on a world where sense-enhancing technology still arrived as something exceptional, visible and faintly suspicious.

That world is being renovated by the least cinematic surveillance technology imaginable. The new instrument is the radio chatter inside phones, mesh routers, office access points, watches, tags, cars and base stations. A camera announces itself. No lens. It arrives as Wi-Fi, AirDrop, a handset knowing which speaker you are pointing at, or a car deciding the key is near enough to trust. These are separate systems, with separate limits, but they are converging on the same habit: treating space as something software can measure. The sensing layer is being assembled through feature updates, digital keys, building-management dashboards and standards documents nobody reads unless paid or subpoenaed.

Ultra-wideband, the technology Apple put into the iPhone 11’s U1 chip, was sold to consumers as spatial awareness. The phrase has the soft, non-committal texture of a yoga-studio brochure, a wellness name for hardware learning how close things are to other things. In consumer use, that mostly means precise relative location between cooperating devices. It helps an iPhone find an AirTag. It helps a handset hand off a file, unlock a car, or understand which nearby object is meant by a gesture. The pitch is true, as far as it goes.

In radar mode, UWB systems can transmit short pulses and read reflections from bodies, furniture, walls and other objects. UWB vendors and sensing researchers describe low-power sensing for presence, motion, gesture, distance and, in some applications, breathing. Demonstrations have worked without direct line of sight, or through bedding and certain intervening materials under favourable conditions. The qualifiers are doing real work. The leap from a ranging chip to a room-scanning surveillance system requires hardware, power, geometry, software access and legal cover that consumer devices do not supply in any simple, general way.

That caveat is the hinge. We do not yet have a normal phone that maps a neighbour’s flat in cinematic 3D, and the obstacles are not merely legal. Walls, frequencies, antenna layouts, power limits and processing budgets all get a vote. Specialist through-wall imaging systems need rather more hardware and energy than anyone wants in a trouser pocket. The weaker claim is the more durable one: ordinary environments are being taught to treat space as data.

That shift is visible beyond UWB. Wi-Fi sensing uses changes in wireless signals to infer presence and movement, and researchers have spent years pulling human activity out of channel state information, the physical-layer record of how a radio signal travels through a room. In May 2026, a team at Karlsruhe Institute of Technology described BFId, a method that used beamforming feedback from ordinary Wi-Fi equipment to identify people moving through a room even when they carried no device and had no access to the network. Reports described unencrypted beamforming feedback on Wi-Fi 5 and newer equipment and a 197-person dataset. Under the reported test conditions, BFId reached 99.5 per cent accuracy, the sort of number that makes privacy lawyers reach for coffee and then discover they have developed a second coffee.

BFId is still a research result, not a consumer product. Its value is that it shows how much environmental information can sit inside routine communication under constrained conditions. Accuracy at that level suggests that a noisy side-channel can become identity-like evidence, even if ordinary Wi-Fi logs are not courtroom testimony. A wireless network can produce records that other people may later try to make evidentiary. Beamforming asks a router to know something about the room. Massive MIMO tells a base station to steer energy around bodies and buildings. A system that improves communication by sensing its surroundings is already near the sensor line, even before the marketing department has found a gentler noun.

The standards bodies know this in the dry language standards bodies prefer. 3GPP’s TR 22.837, a Release 19 study on integrated sensing and communication, is the sort of document where a future privacy fight first appears as a requirements table. Nobody protests a requirements table. Roadmap-stage 6G work describes networks that would move packets while also reading radio reflections for objects, movement, blockage and environmental conditions. Ericsson’s public material offers the safe examples: a pedestrian hidden behind a parked truck, a non-broadcasting drone, an intersection monitored by the network itself. The brochure sells safety, logistics, elder care, building management and public infrastructure, with subpoenas left politely off the page.

Older surveillance usually required installation. Someone mounted the camera, ran the wire, procured the stingray, or parked the slightly sheepish van where neighbours might notice. Radio sensing changes that procurement problem because much of the hardware surface is already being bought by everyone else, even if usable sensing records still depend on firmware support, permission models, sampling access, processing and retention. The devices arrive as phones, routers, door locks, car keys, baby monitors, office access points and bland plastic boxes after an IT refresh. No authoritarian gesture is required when replacement cycles, digital keys, setup wizards, occupancy dashboards and standards meetings can accrete similar capacities while everyone is focused on battery life and latency.

The psychological bargain is simpler than the privacy debate suggests. We are more comfortable with a sensor when it arrives as an improvement to something we already wanted. Cameras request permission to watch. Radios ask only to connect. Once that permission exists, the difference between a link and a sensor becomes not only a matter of physics, antenna geometry and processing budgets, but also firmware, APIs, retention policy and business model. A person who would object to being watched may still feel ridiculous objecting to a smarter router.

This is where the legitimate uses stop being the reassuring exception and become the mechanism. Passive health monitoring could help people live alone longer. Occupancy detection could stop office floors from burning lights for empty rooms. A car that detects a child in the rear seat is not a dystopian premise, any more than a road network that notices what a driver cannot see. Usefulness supplies the social pressure. Resistance becomes awkward precisely because the examples are real.

People do not accept ambient sensing because they have made an abstract philosophical decision against privacy. They accept it because the alternative arrives as a small accusation. If the car could have detected a child left behind, why did it not? When a hallway sensor could have noticed that your mother fell, the pendant she forgets to wear starts to resemble Victorian medicine with a charging cable. The adult child who pays for passive monitoring is buying information about a parent, but also an answer to a future accusation from siblings, doctors, insurers and herself. An office manager staring at empty rooms and high energy bills will not describe occupancy sensing as surveillance. He will call it facilities discipline. A landlord told that fall-risk detection could reduce liability hears a feature with a premium. Refusal starts to look like negligence when safety, liability and care arguments line up behind the sensor.

The legal cases are useful here less as doctrine than as fossils of older assumptions. Riley v. California told police that a seized phone is not a cigarette pack just because both can be found in a pocket. Carpenter v. United States treated historical cell-site location records as a search because the handset followed its owner with an intimacy old categories did not anticipate. Kyllo protected the home from sense-enhancing technology pointed at it from the street, at least while the technology remained outside general public use. The law kept discovering that familiar objects had become something else after everyone had already started carrying them.

The trapdoor phrase in Kyllo was general public use. It once sounded like a sensible limiting principle. The state should not aim exotic equipment at a home and claim nothing happened because nobody crossed the threshold. But radio sensing turns that phrase into a supply-chain question. UWB is constrained by 47 CFR Part 15 rules on ultra-wideband operation. Apple describes UWB in terms of secure, randomised precise relative location rather than ambient room surveillance. 3GPP’s Release 19 work is a study, not a police procurement order. Limits count. So do local processing, non-retention, permission gating and platform security, which are possible brakes rather than decorative caveats. They also show the new terrain. Privacy starts to depend on platform permissions, standards language, telemetry retention and the later moment when a vendor, judge or compliance department decides that a record is ordinary. That is the governance problem in miniature: the wall stays visible, while the decisive choices move into device firmware, app-review policy, cloud retention, compliance paperwork and the vendor logs a lawyer can later learn to name.

A police department aiming special equipment towards a home is one problem. Another begins when ordinary phones, routers, cars, office networks and building systems create or infer records while working normally: occupancy logs, proximity events, back-seat alerts, motion histories, breathing-rate estimates, device-relative positions. Some may stay local. Some may be synced to a cloud account, shown to a property manager, folded into an insurance dispute, bought by a data broker, requested by police or subpoenaed in a divorce. No dramatic dashboard. Just administration. Once a record becomes ordinary, institutions become very imaginative about its uses.

Software is good at laundering weirdness into administration. A technology being present in consumer devices does not automatically make every use lawful or understood, but law tends to reason from objects while platforms turn objects into services. We have already seen this with location data, where a warrant for phone records can become a map of a person’s life, and where courts can also decide that the map is intimate enough to require stronger process. Future warrants, civil subpoenas, insurance disputes, landlord dashboards, employer investigations or data-broker purchases might treat retained radio records as evidence of what happened in a room. Not the room itself, exactly. Just enough room to be useful.

This is why Carpenter lingers: tower logs looked administrative one by one, yet enough ordinary records, held by a phone company and produced through normal service, could become a retrospective map of a life; the case is protective, which matters, because it also shows why retained radio records would invite a fight over warrants, subpoenas and the old habit of treating business records as less intimate than they are.

In future access disputes, the first defence will probably be deficiency of detail. A smaller trespass. No one saw your face. No one heard your words. No one read your messages. The system merely registered two bodies in the conference room after hours. An elderly person stopped moving in the hallway. A child remained in a car seat. Someone crossed a flat at 2.17am. These are different kinds of intimacy, and the difference will often be treated as proof that they are not intimacy at all.

When vendors make such records saleable, the categories can sound mercifully uninteresting. A dashboard does not need to say “we watched your marriage deteriorate”. It can say room state unstable, nocturnal occupancy variance, wellness anomaly, child presence event, after-hours co-location, fall-risk excursion. The language is boring. That is the trick. There may be a dropdown for “retain for compliance”, because civilisation increasingly resembles a dropdown with a blue Save button.

A home has always leaked information. Smoke rose from chimneys, heat escaped through roofs, curtains moved at the wrong hour, and neighbours heard arguments through thin walls. Privacy survived because architecture, law, social custom and ordinary embarrassment made certain forms of knowing expensive or suspicious. You could learn a lot by pressing your ear to a wall. Decent people mostly understood why they should not.

Ambient radio sensing shifts the bargain without fully tearing down the wall. The wall stays. The decisions move. Technical design choices sit with chipset vendors, standards committees, platform-security teams and app-review rules. Retention and access choices sit with cloud defaults, enterprise dashboards and institutional demand. Legal meaning then arrives through police requests, civil subpoenas, judges and anyone else trying to fit new capabilities into old nouns. From the user’s perspective, this will seem like convenience behaving normally. The phone finds the tag. A router improves the link. A configured access point counts bodies, while the car checks the rear seat.

The final intimacy will not come from the radio alone. The radio supplies weak facts: presence, movement, proximity, routine and, sometimes, breathing. The institution supplies the story. If retained records become saleable or shareable, a wellness model could turn repeated stillness into risk. A landlord dashboard could turn visits into tenancy suspicion. An insurer could turn “not wearing pendant” into failure to mitigate. A data broker could turn one body in one flat, night after night, into a segment with a name. Loneliness enters as a product category before it becomes a confession.

Kyllo was decided on 11 June 2001, when the thermal imager still looked like a specialised instrument trained on a home from outside. The harder struggle begins when ordinary devices inside and around the house are allowed to remember what their radio fields learned while doing something else. The pressure comes from the incentive structure forming in plain sight: sensing as safety, retention as prudence, access as procedure, objection as irresponsibility.

The City of Glass need not be built as a single surveillance project. It can arrive as careful features, limited pilots, opt-in care, energy savings, regulatory compliance and records no one meant to make dramatic. Somewhere inside it, a sensor will register a person without seeing a face. The record may begin as care and, if retained, become the kind of administrative fact that can travel. Once a future dashboard can flag loneliness as a wellness anomaly, surveillance no longer has to look like something watching the home. It can look like something the home has been taught to do.

---