Android's New Spyware Shield for Researchers

Google has launched a new opt-in feature for Android called Intrusion Logging, aimed at empowering security researchers to investigate spyware attacks. This feature, integrated into Android's Advanced Protection Mode, creates a new log type that records errors and collects evidence during suspected spyware incidents.

The Intrusion Logging feature generates daily encrypted logs, storing them securely in a user's Google account. This cloud-based storage prevents spyware from deleting potential evidence. The logs capture critical events such as phone unlocks, application installations, website connections, and attempts to tamper with logs, offering a detailed forensic trail.

Amnesty International, collaborating on the feature's development, highlighted its significance, noting it provides a fundamental improvement in the quantity and quality of forensic data available on Android devices. Previously, forensic analysis relied on logs not designed for intrusion detection, which were often temporary and overwritten, thus losing valuable evidence.

This new capability addresses limitations that previously hindered deep system log analysis on Android, unlike iOS. Intrusion Logging is currently rolling out to devices with the Android December update and newer, requiring Advanced Protection Mode to be enabled and a Google account linkage. Google positions this for high-risk individuals like activists and journalists.