Android 16’s new Intrusion Logging feature helps detect if your phone was hacked

Android 16 can back up device logs so you can run a forensic analysis later to find out if your device was compromised

May 13, 2025 - 19:58

Google announced Intrusion Logging, a new Android 16 feature to help high-risk users detect if their device has been compromised by hackers.
It securely backs up encrypted activity logs (like network info and app installs) to the cloud, accessible only to the user for forensic analysis.
The feature uses the new Intrusion Detection API, isn’t enabled by default, and requires activating Advanced Protection mode to use.

People working in certain fields, such as government, the business sector, or journalism, face a high risk of being targeted by sophisticated hackers. These attackers often go beyond simple phishing tricks, deploying advanced malware that silently compromises a device and its data. To better protect these at-risk users, Google has announced Intrusion Logging, a new security feature in Android 16 designed to help users detect if their device has been compromised.

According to Google, Intrusion Logging is an “industry-first feature” that “securely backs up device logs in a privacy-preserving and tamper-resistant way.” These logs are “stored in the cloud using end-to-end encryption,” making them “accessible only to the user.” If a device compromise is suspected, investigators can perform forensic analysis on these logs to search for suspicious activity.