Google rolls out security logging for Android

Google is rolling out Intrusion Logging, an opt-in Android feature in Advanced Protection Mode that records security events to help researchers investigate spyware and forensic device attacks on phones.

The logs are created daily, stored in encrypted form in the user’s Google account.

It can show app installs, website and server connections, Android Debug Bridge access, phone unlocks, and attempts to delete records, according to Google.

Amnesty International helped develop the feature.

The feature is rolling out to devices on the Android 16 December update and newer.

However, it currently requires Advanced Protection Mode, a signed-in Google account, and a Google Pixel device.

🔗 Source: TechCrunch

🧠 Food for thought

Implications, context, and why it matters.

This feature fills a long-missing gap in Android forensics

Intrusion Logging was built because Android’s technical limits made sophisticated spyware attacks hard to detect reliably, unlike on iOS, Apple’s mobile operating system 1.
Before it arrived, researchers depended on system logs that were not built for intrusion detection. Those records were often overwritten, which erased signs of an attack 1.
The system is meant to record attacks from government-grade spyware and police forensic tools such as Cellebrite, a digital forensics company whose software can help law enforcement unlock devices and pull data 1.
No phone maker had previously launched a feature built specifically to help security researchers examine these targeted spyware attacks 1.

A Pixel-only rollout now with wider meaning for Android

For now, the feature works only on Google Pixel devices. It also needs Android 16, the December update or later, Advanced Protection Mode, and a signed-in Google account 1.
It also fits into a broader Android security overhaul. That work includes stronger Factory Reset Protection, which makes stolen phones harder to reuse, plus an upcoming Local Network Protection permission model that would let people control which apps reach devices on the same Wi-Fi network 2.
Google places Intrusion Logging inside Advanced Protection Mode, which was built to counter government spyware and police forensic devices. Apple offers Lockdown Mode, a security setting that limits some phone functions to cut exposure to attacks 1.
Lockdown Mode aims to shrink the attack surface. Intrusion Logging adds detailed encrypted records for forensic work after an incident, which Android researchers had struggled to gather consistently 1.