A new optional feature Google recently added to its Android operation system can potentially help tech abuse victims learn about unauthorized activity on their phones.
Stalkerware is often portrayed as the work of a “super hacker” hacking a phone from a distance, but Android almost always requires the perpetrator to have physical access to the unlocked device. While this is a barrier, once a perpetrator has overcome this barrier, this access often allows them to hide their tracks.
Google, which develops Android, recently added a new optional feature to the mobile operating system that keeps track of activity such as app installation and whose logs cannot be wiped. The feature is called ‘Intrusion Logging’ and is an optional addition to ‘Android Advanced Protection Mode’.
Both features were designed with performing forensics on more advanced spyware in mind – here is a blog post by Amnesty International, that also explains how to set it up – but it also helps to detect commercial stalkerware. They are especially useful in a situation where a survivor that may be targeted with stalkerware is being provided direct technical support. The analyst can set up intrusion logging and then support the device owner in reading through the activity.
There are two important caveats: the first is that it only works on Android versions 16 or higher, the second is that it only works after Intrusion Logging is enabled – it cannot be used to retroactively detect intrusions. But once set up, logged activity cannot be removed from the device.