Google presents a new security tool for Android that seeks to help detect spyware attacks

Google introduces intrusion logging to help analyze spyware intrusions
It records daily events such as unlocks, installations, server connections, ADB usage and tamper attempts, stored encrypted in the user’s Google cloud account.
Part of Advanced Protection Mode, currently enabled and limited to Pixel devices running Android 16+, with wider rollout planned

Google has introduced a new Android feature aimed at helping security researchers analyze spyware intrusions.

The feature, called Intrusion Logging, is currently available for select models and a wider range will be available soon.

In a blog describing its many new privacy and security tools for Android, Google said Intrusion Logging works by creating and collecting logs once a day and then storing them, in encrypted format, in users’ Google cloud account.

Android security boost

The logs show when the phone was unlocked, when different apps were installed/uninstalled, when the device connected to websites and servers, when the phone was connected to Android Debug Bridge, and when someone tried to delete logs related to these events.

Google is storing the logs in the cloud to ensure that whoever tampers with the device cannot completely delete their traces. He also said that the company itself does not have access to these records.

Intrusion logging is part of Android’s Advanced Protection Mode, a new privacy-oriented mode launched in 2025.

It was developed in partnership with Amnesty International and Reporters Without Borders, to reinforce the devices typically used by those who could be targeted by governments and state-sponsored hackers: journalists, political dissidents, the opposition, human rights activists, diplomats and the like.

Right now, it’s available on all Pixel devices running Android 16+, but it should come to more devices “soon.”

The intrusion log seems to have good intentions, but it may also have some limitations. For example, both Advanced Protection Mode and Intrusion Logging are optional features, meaning they are not enabled by default and many users probably won’t even know they exist.

It is currently only available for the latest and greatest Pixel devices, linked with a Google account. Finally, the log also keeps track of your browser’s browsing history and connections, which for some may be a bit much.