Google Rolls Out Android Intrusion Logging for Forensic Investigations

Summary

Google is rolling out Intrusion Logging in Android Advanced Protection Mode to preserve records that may help investigate spyware and other suspected intrusions. Amnesty International praised the feature; it is currently limited to Android 16 Pixel devices.

Key points

Intrusion Logging is rolling out as a feature of Android Advanced Protection Mode.
It records events including device unlocking, physical access, and spyware installation or removal for forensic investigation.
Amnesty International, a design partner, said the feature could help investigators detect and respond to advanced attacks.
The feature currently requires Android 16, a Pixel device, and a linked Google account.
Logs may contain sensitive information, including browser history, so Google and Amnesty stress secure sharing.
Amnesty's Security Lab head said attackers may be able to delete logs; stronger protections are planned for future versions.

Article Details

Event Type: Google is rolling out Intrusion Logging, a forensic logging feature for Android phones, developed with input from Amnesty International and others.
Impact: The feature is designed to preserve evidence of possible intrusions, including device unlocking, physical access, and spyware installation or removal, to support forensic investigations. It is currently limited to Android 16 Pixel devices, requires Android Advanced Protection Mode and a linked Google account, and logs may contain sensitive information. Amnesty International said attackers may be able to delete logs, while noting that many attacks would not give them the root access needed to do so.

People

Donncha Ó CearbhaillHead of the Amnesty International Security Lab; discussed the feature’s value for civil society investigations and noted that attackers may be able to delete logs.Eugene LidermanGoogle director of Android security and privacy; described Intrusion Logging as enabling persistent, privacy-preserving forensic logging for investigations of suspected device compromise.

Vendors

GoogleGoogle has begun rolling out Intrusion Logging for Android phones, a new forensic feature in Advanced Protection Mode designed to preserve evidence of sophisticated intrusions such as spyware installs and device

Products

AndroidGoogle has begun rolling out Intrusion Logging for Android phones, a new forensic feature in Advanced Protection Mode designed to preserve evidence of sophisticated intrusions such as spyware installs and device Android Advanced Protection ModeIntrusion Logging, a feature of Android Advanced Protection Mode, is designed specifically to keep track of possible intrusions for forensic purposes.Intrusion LoggingGoogle has begun rolling out Intrusion Logging for Android phones, a new forensic feature in Advanced Protection Mode designed to preserve evidence of sophisticated intrusions such as spyware installs and device Pixeland respond to advanced attacks on Android devices, though the feature is currently limited to Android 16 Pixel devices and requires careful handling of sensitive logs.