Google Introduces Intrusion Logging: A New Weapon in the Battle Against Spyware

Google has introduced a groundbreaking new feature to Android devices that aims to provide critical data for detecting and investigating potential spyware attacks. Dubbed 'Intrusion Logging,' this feature is designed to work in conjunction with the company's Advanced Protection Mode (APM), an opt-in security measure launched last year. APM enhances security by offering additional safeguards against sophisticated threats, particularly government-sponsored spyware and forensic tools.

Intrusion Logging creates detailed logs when something goes wrong with the software, providing a trail of events that could indicate a potential compromise. This feature has been developed in collaboration with Amnesty International and is part of Google's broader effort to enhance device security for high-risk users.

How Intrusion Logging Works

Intrusion Logging captures key events related to security, such as when the phone was unlocked, applications installed or uninstalled, websites visited, and more. These logs are stored in the user's Google account in the cloud and remain encrypted, ensuring that only the user can access them. This encryption also prevents spyware from deleting evidence of a device compromise.

When something suspicious happens on an Advanced Protection Mode-enabled device, Intrusion Logging records it for potential investigation by security researchers or law enforcement agencies. The logs include details about connections to servers and websites that might be malicious, as well as attempts to delete these logs, which could indicate an attempt to cover up an attack.

Advanced Protection Mode: A Key Component

To take full advantage of Intrusion Logging, users need to enable Advanced Protection Mode. This mode provides additional layers of security beyond what's available in regular Android devices and is specifically designed for people at high risk of targeted attacks, such as human rights defenders, activists, journalists, and dissidents.

Limitations and Availability

Intrusion Logging is currently rolling out to all devices running the latest Android update (16 December or newer) that have Advanced Protection Mode enabled. However, it's only available for Google Pixel devices linked with a Google account at this time.

While Intrusion Logging represents an important step forward in detecting and responding to spyware attacks, it does come with some limitations. For instance, users need to enable both APM and the latest software version on their device. Additionally, the feature may not be as useful for those who are wary of sharing detailed browsing history and connections with investigators.

Contact Us

If you have more information about spyware attacks or spyware makers, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, via Telegram and Keybase @lorenzofb, or email.