Google Debuts Android Spyware Logging Tool for High-Risk Users

Google introduced Intrusion Logging for Android (rolling out to supported Pixel devices on Android 16+), a system that records and preserves extensive device events—such as app installs/removals, network connections, USB transfers, certificate changes, and ADB activity—to support forensic analysis of sophisticated spyware and targeted surveillance. Logs are encrypted, uploaded to the user’s Google account (keys tied to user credentials/device locks), retained up to 12 months, and exportable to trusted investigators; the feature requires Advanced Protection Mode and a Google account and raises some privacy concerns about sensitive data in exported logs.