GOOGLE has introduced a new opt-in Android feature called Intrusion Logging as part of Advanced Protection Mode to store forensic logs for analysing sophisticated spyware attacks. According to Google, the logs record device and network activities daily, including app activity, installations, updates, and uninstalls, along with network connections, file transfers, certificate changes, and whether the device is locked or unlocked.
The feature was developed in partnership with Amnesty International and Reporters Without Borders, and the data is end-to-end encrypted and stored on Google servers, with encryption keys protected by the Google Account password and the device’s screen lock. Logs are retained for 12 months and cannot be deleted before this window by the user, though they may be downloaded offline if desired.
It is noted that Intrusion Logging also records network events generated during Chrome Incognito browsing, as it operates at the system level and does not distinguish between browsing modes.