Android 17 now adds tamper-resistant attack logs: spyware gets harder to hide

Android 17 ‘s Advanced Protection mode is getting six new features , and Google is clearly aiming them at people who face more serious threats than the average phone owner: journalists, activists, politicians, and others who deal with a higher risk of surveillance. The biggest addition is a new Intrusion Logging system, which sits at the center of a broader anti-spyware push. Google says it records security events, network activity, and app behavior on the device, including app installs and even network activity from Google Chrome ‘s Incognito mode. The idea is that, if something goes wrong, a trusted expert can later decrypt those logs and piece together how the compromise happened. Google also says the logs show website records at the domain level, not exact pages, which makes attacks harder to pull off and harder to cover up afterward.

Google says those logs are end-to-end encrypted and stored on its servers for a rolling 12-month period. They also can’t be manually deleted, not by you, and not by Google, even if you switch logging off or close the account tied to it. According to Google, the feature was developed with input from civil liberties and press freedom groups. Amnesty International’s Security Lab described it as the first forensic logging system built specifically for a consumer mobile OS, and said it could be a major shift for this kind of investigation.

There’s more in the update. Android 17 adds USB Protection , which blocks new USB data connections while the phone is locked but still lets it charge. If you’ve already connected while the phone was unlocked, that session stays active, and Google says there’s also a short grace period built in. The feature is coming to Pixel 6 and newer, along with selected phones running Android 17. Other changes tighten access to the Accessibility API, disable WebGPU in Google Chrome, add a lockdown mode after repeated failed login attempts, and show which apps are able to check whether Advanced Protection is turned on.

If Android security matters to you, this is an update to install sooner rather than later. Just keep in mind that features like Intrusion Logging don’t turn on automatically ; you have to opt in through Advanced Protection, and you’ll need a supported device.

Manuel Bosque covers software at Softonic: desktop programs, productivity tools and the small utilities that solve one problem well. His approach is practical — what a program actually does, what it asks in return and who it is for — which is why he distrusts feature lists and prefers to test. He is part of the team that decides how software gets covered on the site, and works daily with AI tools applied to editorial production.

Latest from Manuel Bosque

Nvidia server smuggling case: California tech CEO arrested over alleged $300m China scheme

Tesla updates the Model 3 in the US: bigger screen, more range

Ford CEO Jim Farley now warns on Chinese EV threat: Europe shows how fast the market shifts

OpenAI investigates autonomous agents reaching U.S. government websites: no evidence of exposed sensitive data

How to make seasonal versions of the same hero asset in Adobe Firefly without a reshoot

PS5 Slim quietly updated: better cooling and easier battery replacement

Ken Kutaragi now says games are more technical, not more creative

Nvidia server smuggling case: California tech CEO arrested over alleged $300m China scheme

Boston Dynamics shows us that robots are more advanced than we thought

This is everything we know the new Uncharted that Naughty Dog is making