Android 17‘s Advanced Protection mode is getting six new features, and Google is clearly aiming them at people who face more serious threats than the average phone owner: journalists, activists, politicians, and others who deal with a higher risk of surveillance. The biggest addition is a new Intrusion Logging system, which sits at the center of a broader anti-spyware push. Google says it records security events, network activity, and app behavior on the device, including app installs and even network activity from Google Chrome‘s Incognito mode. The idea is that, if something goes wrong, a trusted expert can later decrypt those logs and piece together how the compromise happened. Google also says the logs show website records at the domain level, not exact pages, which makes attacks harder to pull off and harder to cover up afterward.
Google says those logs are end-to-end encrypted and stored on its servers for a rolling 12-month period. They also can’t be manually deleted, not by you, and not by Google, even if you switch logging off or close the account tied to it. According to Google, the feature was developed with input from civil liberties and press freedom groups. Amnesty International’s Security Lab described it as the first forensic logging system built specifically for a consumer mobile OS, and said it could be a major shift for this kind of investigation.
There’s more in the update. Android 17 adds USB Protection, which blocks new USB data connections while the phone is locked but still lets it charge. If you’ve already connected while the phone was unlocked, that session stays active, and Google says there’s also a short grace period built in. The feature is coming to Pixel 6 and newer, along with selected phones running Android 17. Other changes tighten access to the Accessibility API, disable WebGPU in Google Chrome, add a lockdown mode after repeated failed login attempts, and show which apps are able to check whether Advanced Protection is turned on.
If Android security matters to you, this is an update to install sooner rather than later. Just keep in mind that features like Intrusion Logging don’t turn on automatically; you have to opt in through Advanced Protection, and you’ll need a supported device.