Android 17 makes it harder for spyware to cover its tracks

When a journalist suspects their phone has been hacked, the first question is whether any trace of the attack is left. Google has added six features to Advanced Protection in Android 17, including one that keeps a copy of that evidence off the device. Existing users will receive a notification when the new capabilities become available on their devices.

Forensic logging and data retention

Intrusion Logging records security and network events, including app activity. Users can download and decrypt the logs, then share them with trusted security experts to investigate a suspected compromise. The logs are end-to-end encrypted and stored on Google’s servers. Google says it cannot read them.

The feature also records network activity from Chrome’s Incognito tabs. Someone with access to the decrypted logs can identify visited websites, but not specific pages on those sites.

Logs are retained for a rolling 12-month period before being automatically deleted. Neither users nor Google can manually delete them before they expire, even if users disable logging or close their accounts. Users are responsible for protecting any copies they download and decrypt.

Intrusion Logging is optional and requires a separate manual opt-in through the Advanced Protection settings page.

Google developed the feature with civil liberties and press freedom organizations.

“This is the first time a consumer mobile platform has introduced purpose-built forensic logging for detecting targeted attacks. When enabled, devices will store tamper-resistant, encrypted logs which are also synced to secure cloud storage. If a spyware attack is suspected, these logs can later be retrieved and analyzed, even if the attacker has erased their tracks on the device itself. It’s a potential game-changer for spyware accountability,” Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab, said.

Device and browser protections

USB Protection blocks new USB data connections while a phone is locked to help prevent unauthorized access through its charging port. Available on Pixel 6 and later models and selected Android 17 devices, it activates automatically when users enable Device protection in the Advanced Protection settings. USB charging remains available, although fast charging may sometimes require users to unlock the phone.

Connections established while the phone is unlocked, including photo transfers and wired Android Auto, remain active after the screen locks. Protection begins once the phone has finished starting up. A brief grace period allows disconnected USB connections to resume while the screen is locked, accommodating loose ports or unreliable cables.

According to Google, apps that abuse the AccessibilityService API remain a primary route for fraud and scams. Accessibility services interact directly with the screen, allowing malicious apps to read sensitive data, install malware or prevent users from uninstalling them.

On Android 17, enabling Advanced Protection automatically restricts access to these services to verified apps classified as accessibility tools. These tools primarily assist people with disabilities. The restriction aims to prevent misuse while preserving access to assistive technology.

Advanced Protection also disables WebGPU in Chrome. The technology allows websites to use a device’s graphics processor for complex graphics and computing tasks, including AI processing. Google says disabling it reduces exposure to sophisticated browser exploits.

Failed Authentication Lock, an existing Android theft protection feature, is now included in Advanced Protection on selected Android 17 devices. It automatically locks the device after repeated failed authentication attempts in settings or secured apps, helping prevent physical tampering and brute-force attempts to gain access.

App security transparency

A new settings page, View Supporting Apps, shows which installed apps check whether Advanced Protection is enabled, Il-Sung Lee, Group Product Manager for Android Security, explained.

Developers can be notified when users enable Advanced Protection, allowing their apps to automatically activate additional security and privacy features.