Your TV Signal Can See You Walk: Passive Radar Motion Detection with SDR

A hobbyist pointed an indoor dipole at a local digital TV transmitter, recorded the signal with a software defined radio, and watched the waterfall display react every time someone moved. Walking between the antenna and the transmitter barely disturbed the signal. But after moving the antenna a few centimeters into a multipath null, getting up from a chair made the trace wobble, and walking around in a neighboring room painted bold stripes across the spectrum. Counting those stripes gave a walking speed of about 1.3 metres per second. No camera, no infrared sensor, no transmitted probe signal of his own. Just a broadcast TV station, a receive-only SDR, and physics.

TL;DR: Maurycy at maurycyz.com showed that an ordinary digital TV broadcast near 490 MHz can reveal a person walking in the next room when received on an Ettus USRP B200 during selective fading, where the direct signal is partly cancelled by a reflection. Each stripe in the waterfall marks one wavelength of path change, about 0.6 metres, and the measured 2.1 stripes per second works out to 1.3 m/s or 4.6 km/h. This is passive radar, a real and long studied technique, but it detects motion and rough speed only, not images or identities, and it needs the right fading geometry plus recording and analysis. Hams can reproduce the core effect with a cheap RTL-SDR dongle, and the same multipath lessons apply to everyday shack reception.

What Passive Radar Motion Detection Is

Passive radar motion detection is the technique of sensing moving people or objects by watching how their bodies disturb existing radio signals, such as TV broadcasts, FM stations, WiFi or LTE, instead of transmitting any signal of your own.

A conventional radar sends out pulses and listens for echoes. A passive radar sends out nothing. It listens to a transmitter that is already on the air, a TV tower, an FM mast, a cell site, and watches for the tiny extra reflections that a moving body adds to the mix. When the person moves, the length of the reflected path changes, which shifts the phase of that reflection, which changes how it adds to or subtracts from the direct signal at the receiving antenna. The result is a visible flutter, fade, or stripe pattern in the received spectrum that tracks the motion.

The TV experiment is one of the clearest low cost demonstrations of this idea. The write-up, titled “Your TV can see through walls” and dated August 2, 2025 with a February 23, 2026 revision, uses an ATSC digital TV station near 490 MHz, an indoor dipole, and an Ettus USRP B200. DigitalEscapeTools covered the story on November 10, 2026, and the original page lives at maurycyz.com/projects/fading/. Everything below follows from that write-up plus the author’s comments and the published research record.

How One TV Signal Revealed Walking in the Next Room

The experiment unfolded in three stages, and the contrast between them is the whole point.

Stage 1: strong and steady. The first recording showed the local ATSC TV signal arriving loud and stable on the indoor dipole. The spectrum looked flat and unchanging. This is the normal case for a rooftop or indoor antenna with a clean line to the transmitter.

Stage 2: walking through the path, small effect. The author walked between the receiving antenna and the TV transmitter. The recording showed only a slight disturbance. A human body crossing a strong direct path blocks a small fraction of the total energy, so the spectrum barely noticed.

Stage 3: a few centimeters of antenna movement, huge effect. The author moved the antenna a few centimeters to a spot where the direct signal was partly cancelled by a strong reflection, a condition called selective fading. Suddenly the signal became extremely sensitive to nearby movement. Getting up from a chair produced a brief irregular variation. Walking around in a neighboring room, through a wall, made the spectrum change drastically, with clear repeating stripes in the waterfall display.

In a comment on Lobsters, the author added that the same approach picked up a person walking about 10 metres away with a single antenna and no special processing. He also cautioned that one antenna gives only an ambiguous range and range rate, so multiple antennas are needed for good results.

Key facts at a glance:

• Signal: local digital TV broadcast near 490 MHz
• Receiver: indoor dipole plus Ettus USRP B200 software defined radio
• Trick: antenna parked in a selective fading null, not in a strong-signal spot
• Chair test: standing up produced a brief irregular variation
• Next room test: walking produced drastic striped changes in the waterfall
• Long range note: about 10 metres with one antenna and no special processing
• Limit noted by the author: single antenna range and range rate are ambiguous

Why Selective Fading Turns a Weak Spot into a Motion Sensor

Selective fading sounds like a reception problem, and for TV watching it is one. For motion sensing it’s the sensor.

Most indoor antennas receive each station by more than one path. There is the direct wave from the transmitter plus reflections off walls, ceilings, furniture, and buildings. This is multipath propagation. At any single frequency, the receiver sees the vector sum of all these copies. Where the direct wave and a strong reflection arrive out of step, they cancel, and the signal drops into a null. Because the phase shift of each path depends on its length measured in wavelengths, the cancellation hits some frequencies and spares others, hence selective fading.

Three things make a null position so sensitive:

• The residual signal is small. When two large vectors nearly cancel, the leftover is tiny. Any small third contribution, such as the reflection off a moving person, becomes a large fraction of the total.
• Phase changes fast with movement. At 490 MHz the wavelength is about 0.6 metres. Moving half a wavelength along the reflection path flips that contribution from adding to subtracting. A single step swings the sum visibly.
• Every frequency nulls differently. A person-sized movement shifts the whole interference pattern across the channel, so a wideband TV signal shows the effect as stripes and ripples across many frequencies at once, easy to see on a waterfall.

This is also why the first two stages looked so boring. In a strong-signal spot the direct wave dominates, and a human body contributes a percent or two of extra energy. In a null, that same body can double the residual signal or cancel it outright. Antenna position is the gain knob. A few centimeters made the difference between nothing to report and stripes you can count.

Hams already know this effect from ordinary operating. A 2 metre handheld that is full quieting in one corner of the room goes scratchy one step to the left. An indoor HF loop has sharp nulls that rotate with nearby objects. A DTV set top box reports signal quality swinging as people walk past the rabbit ears. All of these are selective fading in action. The experiment just records the fading with lab grade precision and reads motion out of it.

From Stripes to Speed: The 1.3 Metres Per Second Calculation

The prettiest part of the write-up is the speed estimate, because it needs nothing but the stripe spacing, the waterfall frame rate, and the speed of light.

Here is the measurement chain:

1. Stripe spacing on screen: about 70 pixels between stripes.
2. Waterfall update rate: 150 lines per second, so each pixel row is 1/150 of a second.
3. Time per stripe: 70 divided by 150 is about 0.47 seconds per stripe, or about 2.1 stripes per second.
4. What one stripe means: each gap between stripes happens when the reflection path length changes by one full wavelength, flipping the interference from cancelling to reinforcing and back.
5. Wavelength at 490 MHz: the speed of light divided by 490 MHz is about 0.61 metres.
6. Speed: 2.1 wavelengths per second times 0.61 metres per wavelength gives about 1.3 metres per second, which is about 4.6 km/h, a normal indoor walking pace.

The author notes the walk was perpendicular to the direct signal path, so no geometry correction was needed. If the person had walked at an angle, only the radial component of the velocity would shift the path length, and the estimate would need a cosine correction. That angular dependence is exactly why a single antenna gives ambiguous results: one stripe rate can come from a fast walker at a shallow angle or a slow walker head on. Two or more spaced antennas resolve the ambiguity by triangulating, which is standard practice in real passive radar.

Note what wasn’t measured. There’s no range readout, no position plot, no identity, and no image. The stripes encode one number, the rate of change of one reflection path length. That is enough for presence and rough speed, and it’s a long way from a camera.

What This Does and Does Not Prove About Your TV

The headline framing needs a careful read, and the DigitalEscapeTools coverage gets this right. The television in the living room isn’t doing this. The detection came from a separate software defined radio and the author’s own analysis of a recording. Nothing in the experiment involves the smart TV software, the viewing habits log, or the network connection.

What the experiment does prove:

• Ordinary broadcast energy filling a home carries information about motion.
• A receive-only setup with no licence and no transmission can extract presence and speed.
• The sensitive state is common and accidental, since nulls exist in every multipath room.

What it doesn’t prove:

• That anyone is watching a specific household this way. The setup needs a nearby receiver, a recording, analysis, and a cooperative fading geometry.
• That identities or activities can be read. Motion and rough speed are visible. Reading a screen, hearing speech, or recognizing a face aren’t, and are nowhere in the data.
• That a TV set receives or reports any of this. TV privacy problems are real, but they live in software: telemetry, advertising IDs, sponsored rows, and automatic content recognition. The antenna physics and the software tracking are separate issues that happen to share a box.

The idea itself isn’t new, which cuts both ways. It is established science rather than hype, and it’s also well enough understood that countermeasures and honest limits are documented. University College London researchers described a passive system that tracked a person behind a wall using ordinary WiFi signals, noting the same approach could use FM, GSM, LTE, and digital TV. MIT work published in 2013 demonstrated through wall tracking from a single receiver location, documented on the MIT WiTrack page. On the defensive side, a 2023 paper on arXiv proposes hiding human micro Doppler signatures by adding artificial frequency variations at the transmitter, though that defence sits with the broadcaster, not with anyone at home. The arXiv paper is at arxiv.org/pdf/2303.03001, and the background on WiFi sensing methods is summarized under channel state information on Wikipedia.

For most households this remains a curiosity, not a practical threat. It still carries a useful reminder: wireless signals leak physical activity in ways no settings menu can filter out, because the leakage is in the physics, not in the software.

Passive Sensing Compared: TV, FM, WiFi, LTE and Real Radar

Hams like tables, so here is how the TV waterfall trick stacks up against its cousins.

The pattern is consistent: the more bandwidth and the more antennas, the more you can resolve. A single dipole watching one TV channel gives presence and speed. Add bandwidth, a reference channel, and spaced antennas, and you graduate toward tracks and positions, which is what the published passive radar literature describes. Nothing in the hobby setup crosses into imaging.

How Hams Can Reproduce This With an RTL-SDR

You don’t need the USRP to see the core effect. A 30 dollar RTL-SDR dongle and free software show selective fading flutter clearly. Receive-only SDR experiments like this need no licence and transmit nothing, but keep the antenna and computer clear of transmitting rigs, and never key up into a shared feedline while testing.

A practical starting recipe:

• Pick a strong continuous signal. A local DTV multiplex, an FM broadcast carrier, or a DAB block all work. DTV is ideal because the wide flat channel makes stripes obvious.
• Use a simple indoor antenna. A dipole, rabbit ears, or a whip on a mag mount is fine. The goal is a rich multipath mix, not gain.
• Find the null first. Open the waterfall in SDR++ or GQRX, then slide the antenna in centimeter steps until the channel shows deep uneven dips across its width. Mark that spot with tape. That’s your sensor position.
• Set a fast waterfall. Aim for 50 to 150 lines per second so human motion paints visible structure instead of a slow blur. Freeze scaling and gain so changes come from the room, not the AGC.
• Run the chair test, then the hallway test. Record a baseline with the room empty, stand up from a chair, then have someone walk the next room while you watch. Save IQ or video of the waterfall for comparison.
• Count stripes for speed. Measure the seconds between repeating nulls, invert to get stripes per second, and multiply by the wavelength (300 divided by the frequency in MHz gives metres). That’s the radial path rate, an estimate of walking speed for head on motion.
• Try two antennas for extra credit. Two dipoles a wavelength or two apart feeding two dongles on one clock reveal phase differences that break the single antenna ambiguity, the first step toward real passive radar geometry.

If you already run BrowSDR or an OpenWebRX node, the same waterfall skills transfer directly. And if you maintain shack infrastructure dashboards, the Open Hamclock Backend story is a reminder that community receive-only infrastructure can be serious science, not just a toy.

Honest expectations help. Apartment blocks full of DTV reflections give dramatic nulls. Open rural sites with one clean line of sight give boring flat spectra, which is great for watching TV and useless for this trick. Intentionally seeking the null feels wrong to anyone trained to chase signal strength, and that is exactly the mindset flip the experiment teaches.

Why This Matters for Hams: Propagation, EmComm and RF Awareness

Beyond the novelty, the experiment is a compact lesson in three things hams already care about.

First, multipath is information. The nulls that ruin a DTV picture or chop a 70 cm repeater signal at the kitchen table are the same nulls that sensed a walker through a wall. Learning to find, map, and use fades makes you better at placing antennas, diversity rigs, and APRS iGates. If a few centimeters move a UHF signal from solid to striped, the same care applies when placing a hotspot antenna or a LoRa gateway.

Second, receive-only sensing is a legitimate EmComm tool. Passive techniques detect occupancy, vehicle movement, and generator or equipment state without emitting anything, which matters for noise discipline during emergencies and for sites where transmission is restricted. A club that understands what its receivers can already hear is better prepared than one that only thinks in terms of transmitting.

Third, RF awareness cuts both ways. If your station can sense the neighbor walking, your transmissions and your local oscillators are equally visible in principle to anyone with a dongle and patience. Good practice, clean signals, sensible antenna placement, and keeping station computers free of stray radiators all follow from the same physics. The broader hamradio.my project and the station notes on the about page reflect that posture: open experimentation paired with responsibility.

Privacy in Plain Terms: Signals Leak Motion, Settings Do Not Fix That

Two different privacy stories share the living room, and it helps to keep them separate.

Story one is physics. Broadcast RF passes through walls, reflects off bodies, and can be recorded by any nearby receiver. No menu setting, no consent toggle, and no ad blocker changes Maxwell’s equations. The practical protection is distance, attenuation, and the fact that an attacker needs proximity, equipment, and analysis for a payoff as thin as presence and pace. Realistic, but not fixable in software.

Story two is software. Smart TVs ship with manufacturer telemetry, advertising services, sponsored home screen rows, and often automatic content recognition that fingerprints what is on screen. That’s the part you can control: audit installed packages, disable telemetry and ad services, block tracking domains at the router, and use a minimal launcher. The DigitalEscapeTools piece points to CleanYourTV as one open source Android TV and Google TV cleanup toolkit, a debloater plus tiny launcher plus permission audit that works over ADB. We haven’t tested it, but the category is sound: remove the spyware you can see, because you can’t remove the physics you can’t.

Do the software part properly and keep the physics part in perspective. Disable what phones home. Keep the TV off the internet if you only need HDMI. And remember that the striped waterfall says someone moved, never who they are or what they watched.

Sources and Further Reading

• Maurycy, “Your TV can see through walls,” August 2, 2025, updated February 23, 2026: maurycyz.com/projects/fading/
• DigitalEscapeTools, “Hobbyist Shows Ordinary TV Broadcast Signals Can Reveal Someone Walking in the Next Room,” November 10, 2026: digitalescapetools.com/2026/11/tv-broadcast-signal-detects-walking-next-room-sdr.html
• Author comment on Lobsters on range and single antenna ambiguity: lobste.rs/s/gvg4lv/how_passive_radar_works
• Passive radar background: en.wikipedia.org/wiki/Passive_radar
• Multipath propagation background: en.wikipedia.org/wiki/Multipath_propagation
• ATSC digital TV standards: en.wikipedia.org/wiki/ATSC_standards
• Channel state information and WiFi sensing: en.wikipedia.org/wiki/Channel_state_information
• Doppler effect primer: en.wikipedia.org/wiki/Doppler_effect
• MIT through wall tracking research: witrack.csail.mit.edu/
• Obfuscation of human micro Doppler signatures in passive radar, 2023: arxiv.org/pdf/2303.03001
• Ettus USRP B200 used in the original experiment: ettus.com/all-products/ub200-kit/
• RTL-SDR dongles for reproducing the effect on a budget: rtl-sdr.com/
• CleanYourTV open source Android TV cleanup toolkit: github.com/Gathin23/cleanyourtv

73 de 9M2PJU