Android 17 copies forensic logs to Google's servers, where no one can delete them for 12 months

Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, said that when the feature is on, devices "will store tamper-resistant, encrypted logs which are also synced to secure cloud storage." ^[21] The logs cover security and network events, including app activity ^[2]. "If a spyware attack is suspected, these logs can later be retrieved and analyzed, even if the attacker has erased their tracks on the device itself," he said ^[11].

An investigator can recover only what reached Google's servers before the attacker took control of the phone ^[4]. Help Net Security's account of the feature does not say how often logs sync, or whether spyware running on the handset can block an upload ^[4].

Advanced Protection does not switch logging on by itself. It needs a separate manual opt-in on the settings page ^[9]. Logs are written only while the feature is enabled ^[21]. A phone that opts in after a suspected compromise has no record of the period before ^[1].

The retention rule binds the user as firmly as the attacker. Logs roll over a 12-month window ^[6], and neither the user nor Google can delete them early, even after logging is disabled or the account is closed ^[7]. They include network activity from Chrome's Incognito tabs, resolved to the website but not the page ^[5]. A user who opts in puts up to a year of site-level browsing, Incognito included, into storage they cannot purge ^[2]. Google says it cannot read the end-to-end encrypted logs ^[4]. A copy the user downloads and decrypts is the user's to protect ^[8].

USB Protection switches on with Device protection ^[13]. Connections opened while the phone is unlocked, such as photo transfers and wired Android Auto, stay up after the screen locks ^[14]. Protection starts only once the phone has finished booting, and a short grace period lets a dropped connection resume on a locked screen ^[14]. Charging still works, though fast charging may need an unlock ^[15].

Failed Authentication Lock locks the device after repeated failed authentication attempts. It is an existing Android theft feature, now folded into Advanced Protection on selected Android 17 devices ^[18]. For users who already had it enabled, nothing changes in what it does ^[18].

A new View Supporting Apps page lists installed apps that check whether Advanced Protection is on, according to Il-Sung Lee, Group Product Manager for Android Security ^[19]. Developers can be notified when a user enables it, so their apps can turn on extra protections ^[19].

Google built Intrusion Logging with civil liberties and press freedom organizations ^[10]. "This is the first time a consumer mobile platform has introduced purpose-built forensic logging for detecting targeted attacks," Ó Cearbhaill said ^[12]. Existing users will get a notification when the features reach their devices ^[20].