arXiv: AmbSentry: Mitigating Sensing Eavesdropping in ISAC Systems by Harnessing Ambient IoT Devices

A new technical paper, AmbSentry, proposes a method to reduce the risk of sensing eavesdropping in Integrated Sensing and Communication (ISAC) systems by using ambient Internet of Things (IoT) devices as active jammers or decoys. This is not a regulatory mandate but a research publication that highlights a growing security vulnerability in 6G-era networks, where the same radio signal is used for both communication and environmental sensing. The paper suggests that malicious actors could exploit these sensing capabilities to capture private spatial data, and that existing IoT infrastructure could be repurposed to counter this threat.

Organizations affected include telecommunications operators, network equipment vendors, and any enterprise deploying ISAC-enabled infrastructure, particularly in smart cities, autonomous transport, and industrial automation. Compliance teams in these sectors should monitor this development because it signals that sensing data may soon be classified as personal or sensitive under EU data protection rules, even if it is not directly tied to an individual. The paper also implies that current security measures may be insufficient, which could influence future certification requirements under the EU Cyber Resilience Act.

Compliance teams should take three immediate actions. First, review current ISAC deployment plans to assess whether sensing data is being processed in a way that could trigger GDPR obligations. Second, engage with engineering teams to understand if ambient IoT devices in their ecosystem could be used for security purposes, and whether that creates new data processing roles. Third, track the paper’s reception in EU standardisation bodies, as it may inform upcoming technical guidelines for 6G security. No immediate regulatory filing is required, but proactive risk assessment is advised.