Google’s Intrusion Logging Exposes Android Spyware Attacks
Google has launched Intrusion Logging for Android to help uncover spyware targeting activists and journalists.
Why it matters: Legal professionals and privacy advocates gain new forensic tools to detect unauthorized surveillance on Android devices. The move strengthens protections for high-risk users and digital rights defenders.
- Intrusion Logging creates encrypted logs of key device activities, stored in users’ Google accounts.
- Feature supports detection of spyware attacks by tracking app installs, network, and USB connections.
- Co-developed with Amnesty International to advance forensic capabilities for Android.
- Rolling out globally to devices with the Android 16 December update or newer.
Google has introduced Intrusion Logging as part of its Advanced Protection Mode, aiming to aid researchers and legal professionals uncover spyware attacks targeting high-risk individuals including activists and journalists.
- The new feature generates encrypted logs of sensitive device events — including app installations, unlocks, network connections, and USB activity — securely stored in each user’s Google account. Only users can access or share these logs with investigators.
- Developed in collaboration with Amnesty International, Intrusion Logging enhances the quality and quantity of forensic data available to analyze suspected breaches. Amnesty’s Security Lab called the advancement “a fundamental shift in the amount and quality of forensic data available on Android devices.”
- By design, it strengthens digital defenses for those mostly likely to be targeted by government spyware or forensic hacking tools, which have previously been difficult to detect. Donncha Ó Cearbhaill, Head of Amnesty’s Security Lab, highlighted that prior limitations made “reliably detect[ing] known attacks against Android” challenging.
- This tool is a key addition to Android’s Advanced Protection Mode, which already offers features such as blocking 2G networks and utilizing Memory Tagging Extension (MTE) to further harden device security.
- The feature is available on any device running the Android 16 December update or newer. It is currently rolling out globally.
As surveillance threats rise, Intrusion Logging equips legal professionals, privacy advocates, and high-risk users with essential resources to analyze and document unauthorized device access, advancing both legal responses and digital rights protection.
By the numbers:
- 1 — Number of user Google accounts where logs are secured and accessible only by the user
- 2026 — Year Intrusion Logging rolled out globally with Android 16 December update
- 4+ — Types of events tracked: unlocks, app installs/uninstalls, network, USB connections
Yes, but: Feature availability for non-Google devices or older Android versions remains unclear.