Google has added a forensics feature called Intrusion Logging to Advanced Protection, the security suite it introduced last year on Android 16 for users it describes as at-risk, vulnerable, or security-conscious. The company says the tool is a mobile industry first, and it is the headline addition in a set of enhancements rolled out since the suite launched.
Intrusion Logging records security and network events, encrypts them end to end, and stores them in the cloud, where Google says they are shielded from tampering and readable only by the user. Google keeps the logs for a rolling 12-month period, after which they are deleted automatically. The feature is optional and needs a separate manual opt-in from the Advanced Protection settings page, because Google says the value of long-term logging differs from person to person.
Read more: Google Confirms Advanced Talks with SpaceX to Launch Orbital AI Data Centers
The company says it worked with civil liberties and press freedom organizations on the capability, which is aimed at investigating suspected mobile compromises, a problem Google calls one of the hardest in digital forensics.
Advanced Protection itself works through a single toggle that turns on the company's strongest device-level settings across apps including Chrome, Google Messages, and Phone by Google. Once enabled, protections such as Google Play Protect and Scam Detection cannot be switched off. Google frames the suite as a defense against scams, theft, and targeted attacks on elected officials, journalists, and public figures.
The new features run on Android 17 devices, with two exceptions: USB Protection and Failed Authentication Lock are limited to select Android 17 devices. Google did not say in the notice which models qualify or when the features reach older Android versions.
The announcement extends a run of Android security work this year. In January, Google added theft protection updates that included a dedicated toggle for Failed Authentication Lock, which until then had operated without user control, and expanded Identity Check coverage to features using Android Biometric Prompt. Those updates reached devices running Android 10 and newer, while the stronger authentication safeguards required Android 16 or newer.
Intrusion Logging is the piece of the suite that leaves a record after the fact, rather than blocking an attempt in the moment.
