Google Launches Android Intrusion Logging Feature

Google has launched Intrusion Logging, a new opt-in security feature for Android devices that enables users to generate encrypted forensic logs for investigating suspected spyware attacks. The tool, part of Android Advanced Protection Mode, began rolling out this week to Pixel devices running the Android 16 December update or newer.

Advanced Protection Mode, introduced last year, bundles hardened security measures to protect high-risk users such as journalists, activists, human rights defenders and dissidents from targeted surveillance, scams and sophisticated exploits. Intrusion Logging, developed in partnership with Amnesty International's Security Lab and Reporters Without Borders, addresses longstanding limitations in Android's logging system. Previous logs were often temporary, overwritten quickly and not designed for forensic analysis, making it harder to detect intrusions compared to iOS devices.

The feature collects daily logs of security-relevant events, including device unlocks, application installations and removals, network connections to websites and servers, Android Debug Bridge connections, USB data transfers, changes to system certificates and attempts to delete...