Android 17 Adds Encrypted Intrusion Logging and New Spyware Protections

Summary

Android 17 adds six Advanced Protection features, including optional encrypted forensic logs retained for 12 months, USB and accessibility safeguards, Chrome WebGPU restrictions, and expanded device lock protections.

Key points

Optional Intrusion Logging records security, network, and app events for investigating suspected compromises; users can download and decrypt logs to share with trusted experts.
Logs are end-to-end encrypted, stored on Google’s servers, and retained for a rolling 12 months; neither users nor Google can delete them early.
Intrusion Logging includes Chrome Incognito network activity, which can reveal visited websites but not specific pages.
USB Protection blocks new USB data connections while a supported phone is locked, while allowing charging.
Advanced Protection on Android 17 restricts AccessibilityService access to verified accessibility apps, aiming to reduce abuse linked to fraud and scams.
Advanced Protection disables WebGPU in Chrome to reduce exposure to sophisticated browser exploits and includes Failed Authentication Lock on selected devices.
A View Supporting Apps page shows which installed apps check Advanced Protection status; developers can use that status to activate additional protections.

Article Details

Event Type: Google announced six Advanced Protection features for Android 17, including encrypted forensic logging and strengthened device and browser protections.
Impact: Intrusion Logging can preserve tamper-resistant security, network, and app-activity logs for suspected spyware investigations. Logs are end-to-end encrypted, stored on Google’s servers, retained for a rolling 12 months, and cannot be manually deleted before expiry. Other features block new USB data connections while a phone is locked, restrict AccessibilityService access to verified accessibility apps, disable WebGPU in Chrome, and add Failed Authentication Lock on selected devices.

People

Donncha Ó CearbhaillHead of Amnesty International’s Security Lab; commented on Android’s forensic logging feature.Il-Sung LeeGroup Product Manager for Android Security; explained the View Supporting Apps feature.

Vendors

GoogleGoogle is adding six new Advanced Protection features to Android 17, including encrypted Intrusion Logging that stores tamper-resistant forensic evidence in Google’s cloud for suspected spyware investigations.

Products

Android 17Google is adding six new Advanced Protection features to Android 17, including encrypted Intrusion Logging that stores tamper-resistant forensic evidence in Google’s cloud for suspected spyware investigations.Google Chrome#Android17 PixelAvailable on Pixel 6 and later models and selected Android 17 devices, it activates automatically when users enable Device protection in the Advanced Protection settings.