Android 17 copies forensic logs to Google's servers, where no one can delete them for 12 months
Google's Android 17 Intrusion Logging syncs encrypted security and network logs to its servers and bars anyone from deleting them for a rolling 12 months. The feature is a separate opt-in, so the record exists only for people who enable it before an attack.
The Watch · Security desk
What happened
- Intrusion Logging is one of six features Google added to Advanced Protection in Android 17.
- Users download and decrypt the logs themselves and can pass them to trusted security experts to investigate a suspected compromise.
- USB Protection blocks new USB data connections while the phone is locked, on Pixel 6 and later and selected Android 17 devices.
- Advanced Protection now limits the AccessibilityService API, a primary fraud and scam route according to Google, to verified accessibility tools.
- Chrome's WebGPU is switched off under Advanced Protection; Google says that reduces exposure to sophisticated browser exploits.
Why it matters
- Who has to decide decision People who expect to be targeted have to enable logging before anything happens; switching it on after a suspected compromise recovers nothing from the period that matters.
- What's now possible capability A forensic examiner can work a spyware case from the off-device copy after the phone itself has been scrubbed, provided the logs synced before the attacker acted.
- What it limits constraint Someone holding a locked phone loses the charging port as a new data path; cable access now depends on a connection opened while the phone was unlocked.
Next story · Security · Oct 7
Google folds Android's October fixes into one patch level covering 25 flawsConfirmed2 publishers
Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, said that when the feature is on, devices "will store tamper-resistant, encrypted logs which are also synced to secure cloud storage." [21] The logs cover security and network events, including app activity [4]. "If a spyware attack is suspected, these logs can later be retrieved and analyzed, even if the attacker has erased their tracks on the device itself," he said [19].
An investigator can recover only what reached Google's servers before the attacker took control of the phone [14]. Help Net Security's account of the feature does not say how often logs sync, or whether spyware running on the handset can block an upload [14].
Advanced Protection does not switch logging on by itself. It needs a separate manual opt-in on the settings page [2]. Logs are written only while the feature is enabled [21]. A phone that opts in after a suspected compromise has no record of the period before [22].
The retention rule binds the user as firmly as the attacker. Logs roll over a 12-month window [15], and neither the user nor Google can delete them early, even after logging is disabled or the account is closed [16]. They include network activity from Chrome's Incognito tabs, resolved to the website but not the page [5]. A user who opts in puts up to a year of site-level browsing, Incognito included, into storage they cannot purge [23]. Google says it cannot read the end-to-end encrypted logs [14]. A copy the user downloads and decrypts is the user's to protect [17].
USB Protection switches on with Device protection [7]. Connections opened while the phone is unlocked, such as photo transfers and wired Android Auto, stay up after the screen locks [8]. Protection starts only once the phone has finished booting, and a short grace period lets a dropped connection resume on a locked screen [8]. Charging still works, though fast charging may need an unlock [9].
Failed Authentication Lock locks the device after repeated failed authentication attempts. It is an existing Android theft feature, now folded into Advanced Protection on selected Android 17 devices [11]. For users who already had it enabled, nothing changes in what it does [11].
A new View Supporting Apps page lists installed apps that check whether Advanced Protection is on, according to Il-Sung Lee, Group Product Manager for Android Security [12]. Developers can be notified when a user enables it, so their apps can turn on extra protections [12].
Google built Intrusion Logging with civil liberties and press freedom organizations [18]. "This is the first time a consumer mobile platform has introduced purpose-built forensic logging for detecting targeted attacks," Ó Cearbhaill said [20]. Existing users will get a notification when the features reach their devices [6].
What to watch
- Google technical documentation on how often Intrusion Logging syncs and whether a compromised handset can block or delay the upload.
- The rollout notifications to existing Advanced Protection users; logs only start accumulating once a user opts in after that.
- The first published spyware investigation that relies on Intrusion Logging data retrieved from Google's servers.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google has added six features to Advanced Protection in Android 17, including one (Intrusion Logging) that keeps a copy of evidence of an attack off the device.
- [2]
Intrusion Logging is optional and requires a separate manual opt-in through the Advanced Protection settings page.
- [3]
Google says apps that abuse the AccessibilityService API remain a primary route for fraud and scams; on Android 17, enabling Advanced Protection restricts access to these services to verified apps classified as accessibility tools.
- [4]
Intrusion Logging records security and network events, including app activity.
- [5]
Intrusion Logging also records network activity from Chrome's Incognito tabs; someone with access to the decrypted logs can identify visited websites, but not specific pages on those sites.
- [6]
Existing Advanced Protection users will receive a notification when the new capabilities become available on their devices.
- [7]
USB Protection blocks new USB data connections while a phone is locked; it is available on Pixel 6 and later models and selected Android 17 devices, and activates automatically when users enable Device protection in Advanced Protection settings.
- [8]
USB connections established while the phone is unlocked, including photo transfers and wired Android Auto, remain active after the screen locks; protection begins once the phone has finished starting up; a brief grace period allows disconnected USB connections to resume while the screen is locked.
- [9]
With USB Protection, USB charging remains available, although fast charging may sometimes require users to unlock the phone.
- [10]
Advanced Protection disables WebGPU in Chrome; Google says disabling it reduces exposure to sophisticated browser exploits.
- [11]
Failed Authentication Lock, an existing Android theft protection feature that locks the device after repeated failed authentication attempts, is now included in Advanced Protection on selected Android 17 devices.
- [12]
A new View Supporting Apps settings page shows which installed apps check whether Advanced Protection is enabled, Il-Sung Lee, Group Product Manager for Android Security, explained; developers can be notified when users enable Advanced Protection so their apps can activate additional security and privacy features.
- [13]
Users can download and decrypt the Intrusion Logging logs, then share them with trusted security experts to investigate a suspected compromise.
- [14]
The logs are end-to-end encrypted and stored on Google's servers. Google says it cannot read them.
- [15]
Logs are retained for a rolling 12-month period before being automatically deleted.
- [16]
Neither users nor Google can manually delete the logs before they expire, even if users disable logging or close their accounts.
- [17]
Users are responsible for protecting any copies of the logs they download and decrypt.
- [18]
Google developed Intrusion Logging with civil liberties and press freedom organizations.
- [19]
"If a spyware attack is suspected, these logs can later be retrieved and analyzed, even if the attacker has erased their tracks on the device itself," said Donncha Ó Cearbhaill, head of Amnesty International's Security Lab.
- [20]
"This is the first time a consumer mobile platform has introduced purpose-built forensic logging for detecting targeted attacks," said Donncha Ó Cearbhaill.
- [21]
"When enabled, devices will store tamper-resistant, encrypted logs which are also synced to secure cloud storage," said Donncha Ó Cearbhaill.
- [22]
Because Intrusion Logging is a separate opt-in and logs are stored only when it is enabled, no Intrusion Logging record exists for any period before a user opts in.
- [23]
A user who opts in places up to 12 months of site-level browsing history, Incognito included, in storage the user cannot delete early, even after disabling logging or closing the account.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comAndroid 17 makes it harder for spyware to cover its tracks
1 article · October 1, 2026
- thehackernews.comAndroid 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools
2 articles · October 2, 2026
Topics and entities
Topics
- Spyware forensics
- Data retention
- Mobile security
Entities
- Amnesty International
- Donncha Ó Cearbhaill
- Google Chrome
- Android
- Google Pixel
- AccessibilityService API
- Advanced Protection
- WebGPU