Google has launched a new Android feature called 'Intrusion Logging' within its Advanced Protection Mode to assist security researchers in investigating spyware attacks. This initiative is a response to growing concerns about government and law enforcement spyware.
Advanced Protection Mode
Intrusion Logging is an opt-in feature that enhances Android's security by creating a new type of log to document errors and capture evidence of spyware activities. This feature is part of the Advanced Protection Mode, which Google introduced last year to make devices harder to hack, particularly in the face of government spyware and police forensic tools.
These two threats can be combined, as seen in a case from Serbia where police used a Cellebrite tool to unlock a journalist's phone and subsequently planted spyware. Google's move marks the first time a phone manufacturer has actively developed a feature to aid in analyzing and preventing such attacks.
Collaboration with Amnesty International
Amnesty International collaborated with Google to develop Intrusion Logging, describing it as a 'fundamental shift' in the forensic data available on Android devices. Previously, forensic analysis relied on inadequate logs that were often overwritten. Donncha Ó Cearbhaill, head of Amnesty's Security Lab, highlighted Android's technical limits in analyzing system logs, impacting the ability to detect known attacks.
The feature aims to improve spyware detection, addressing previous challenges faced by researchers in identifying signs of compromise on Android devices.
Deployment and Functionality
Google announced Intrusion Logging a year ago, but it is now rolling out to devices with the Android 16 December update or newer. The feature logs security-related events daily, encrypting and storing them in the user's Google account. This encryption prevents unauthorized access, ensuring only the user can share logs with investigators.
The logs track events such as phone unlocks, app installations, website connections, and attempts to delete logs. This data helps investigators understand potential attacks, including unauthorized access via forensic tools or spyware installations.
Limitations and Comparisons
While promising, Intrusion Logging is currently exclusive to Google-made Pixel devices running the latest Android version. Users must enable Advanced Protection Mode, and the feature requires a Google account linkage. Though it records browser history and connections, some users might hesitate to share this data with investigators.
Google's Advanced Protection Mode targets at-risk individuals like journalists and activists, similar to Apple's Lockdown Mode. Recent reports indicate Apple's Lockdown Mode effectively blocks spyware attacks, as confirmed by security researchers at Citizen Lab.
Amnesty International has provided guidelines for accessing logs if users suspect spyware targeting. Threat notifications from tech giants like Apple, Google, and Meta have been instrumental in uncovering abuse cases, supporting users in safeguarding their devices.
Source: https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks/
