Towards Lawful ISAC in Cellular Networks

Imagine a world where the very airwaves carrying your phone calls and internet messages could also act as invisible eyes, detecting the shape, speed, and location of objects without a single camera lens. This is the promise of a technology called integrated sensing and communication. For decades, wireless networks have been designed solely to move data from one place to another. However, engineers have realized that these same radio waves bounce off everything they touch. By carefully listening to how these waves change after hitting an object, a network can build a picture of its surroundings. This capability is already appearing in some home Wi-Fi systems, allowing them to sense motion or track a person's movement through a room. But the next generation of cellular networks, the systems that will power our future cities and vehicles, aims to take this ability to a massive scale, covering entire countries with a single, unified sensing grid.

The leap from a small, local Wi-Fi router to a nationwide cellular network changes the nature of the technology entirely. In a home, the sensing is limited to a few rooms, and the person who owns the router is the only one who can see what is happening. In a cellular network, the sensing is pervasive and centralized, managed by large mobile operators who control the signals across vast distances. This shift creates a profound dilemma. While the technology could revolutionize safety, traffic management, and emergency response, it also introduces the risk of constant, invisible surveillance. If a network can track a car or a pedestrian without them carrying a phone, or even without them knowing they are being watched, it threatens the fundamental right to privacy. The question becomes not just whether we can build these systems, but how we can build them without violating the strict laws designed to protect human dignity and personal freedom.

A team of researchers from the University of Padova in Italy has tackled this exact challenge, weaving together the worlds of wireless engineering and legal compliance. Their work focuses on how to make this powerful sensing technology lawful within the framework of the European Union's General Data Protection Regulation, known as GDPR. This regulation sets a high bar for how personal information is collected and used, requiring that individuals know what is happening to their data and that their consent is obtained. The researchers found that applying these rules to a cellular sensing network is far more complex than simply encrypting data. Because the sensing happens through physical radio waves traveling through the air, the threat begins before any digital data is even created.

The paper identifies a critical gap in current thinking: existing privacy laws focus on "data controllers," the people or companies who decide how to use information once it has been collected. The researchers argue that in a sensing network, we need a new role called a "signal controller." This is the entity responsible for managing the transmission of the radio waves themselves. They are the first line of defense, ensuring that the signals sent out are only capable of being used by authorized receivers and that they do not inadvertently reveal private details about people who are not even part of the network. For instance, a signal controller must ensure that a wave sent to track a vehicle does not also reveal the location of a pedestrian walking nearby who has not agreed to be tracked.

To understand the scope of the problem, the researchers mapped out the different types of targets a network might encounter. Some targets are people carrying phones, some are people without phones, and others are inanimate objects like buildings or cars. The law treats these differently. People with phones are clearly protected, but the researchers point out that the technology is so sensitive it can also track people without phones, or even deduce their identity by combining movement patterns with other information. This means that almost everyone under the coverage of a cellular network could be considered a person whose privacy must be protected, regardless of whether they own a device. The study highlights specific threats, such as the risk that data collected for one purpose, like helping a self-driving car avoid a crash, could be repurposed later to build a profile of a person's daily habits for advertising or surveillance.

The researchers propose a layered approach to solve these issues, suggesting that different parts of the network must take on specific responsibilities to remain lawful. The mobile network operator, the company that owns the towers, must act as the primary guardian, supervising the entire process and ensuring that data is only collected in specific, authorized areas. They suggest that sensing should be restricted to where it is absolutely necessary, such as a factory floor or a busy highway, rather than scanning entire cities indiscriminately. Furthermore, the data should not be kept longer than needed. For example, if a sensor detects an obstacle to help a car drive safely, that information should be used immediately and then discarded, rather than stored in a database.

The hardware and software vendors who build the network equipment also have a crucial role. They must design systems that can distinguish between signals meant for sensing and those that are not, and they must include features that automatically hide the identities of people who are not the intended targets. This involves techniques like "beamforming," which directs radio waves in a tight beam toward a specific target, and "anonymization," which strips away details that could identify a person. The researchers emphasize that these technical fixes must be built into the system from the very beginning, a concept known as "privacy by design," rather than added on as an afterthought.

Finally, the paper looks at the organizations that set the rules for how these networks operate. The researchers argue that standardization bodies, the groups that write the technical manuals for future networks, must include privacy requirements in their official specifications. If the rules for building the network do not explicitly require privacy protections, then the companies building the network will have no incentive to include them. The study concludes that making integrated sensing and communication lawful is not a single technical fix but a comprehensive effort that requires engineers, lawyers, and policymakers to work together. By defining clear roles for who controls the signals, who processes the data, and who is allowed to see the results, it is possible to harness the benefits of this technology while ensuring that the privacy of every individual is respected. The path forward involves creating a system where the network is smart enough to know when to see, and wise enough to know when to look away.