Google Takes Aim at State-Sponsored Spyware
Google has quietly rolled out one of the most significant mobile security features in recent memory — and it's aimed squarely at protecting some of the world's most vulnerable users.
The tech giant has launched Intrusion Logging, a new capability built into Android's Advanced Protection Mode. The feature is designed to help human rights activists, journalists, political dissidents, and others at risk of being targeted by government-grade spyware or forensic law enforcement devices detect when their phones have been compromised.
What Is Intrusion Logging?
Intrusion Logging works by creating a tamper-resistant record of system activity on an Android device. If a sophisticated piece of spyware — like the notorious Pegasus software developed by NSO Group — attempts to infiltrate a device, the logs could capture evidence of the intrusion that the attacker cannot easily erase.
This is a meaningful shift. Historically, one of the defining characteristics of high-end government spyware is that it leaves almost no trace. Tools like Pegasus are engineered specifically to operate in the shadows, exfiltrating messages, location data, and microphone access without triggering any obvious alerts. Forensic researchers at organizations like Amnesty International's Security Lab have spent years developing specialized techniques just to detect these infections after the fact.
Intrusion Logging aims to give users — and the security researchers who support them — a fighting chance.
Who Is This For?
Advanced Protection Mode on Android has always been Google's highest-security setting, designed for users who face elevated digital threats. Think journalists covering authoritarian governments, opposition politicians in hostile regimes, NGO workers in conflict zones, or corporate executives targeted by nation-state hackers.
Enabling the mode already restricts app installations, limits data access for third-party apps, and strengthens phishing protections. Intrusion Logging adds a new layer: a structured, cryptographically protected audit trail that can be reviewed by the user or by a trusted security professional.
Google has not disclosed the full technical implementation, but the company has been working closely with digital rights organizations to ensure the feature is practical for the real-world workflows of at-risk individuals.
Why It Matters Now
The timing of this launch is notable. Commercial spyware vendors have proliferated over the past decade, with dozens of companies now selling sophisticated surveillance tools to governments around the world. The customers aren't always authoritarian regimes — democratic governments have also been caught using spyware against journalists and political opponents.
In 2021, the Pegasus Project — a global investigative journalism collaboration — revealed that the phones of more than 180 journalists across 20 countries had been targeted. Since then, Apple has added its own Lockdown Mode for high-risk users, and the mobile security industry has been racing to develop better detection capabilities.
Google's Intrusion Logging is the latest salvo in that ongoing fight — and one that security researchers have been eager to see.
How to Enable It
Intrusion Logging is available through Android's Advanced Protection Mode, which can be activated in device settings for users who enroll with a physical security key or passkey. Google recommends the feature for any user who believes they may be at elevated risk of targeted attacks.
For the average person, Advanced Protection Mode may feel overly restrictive. But for the journalists and activists who need it most, this new tool could make the difference between detecting a surveillance operation and remaining in the dark.
Source: TechCrunch. Original reporting by TechCrunch staff, published May 12, 2026.
