Google has added six new Advanced Protection features to Android 17, announced on October 1. The suite is aimed at journalists, elected officials and other high-risk users.

The headline feature is Intrusion Logging. It is optional and stores end-to-end encrypted forensic logs, including security and network events, in the cloud for 12 months. Users can download and decrypt the logs for expert analysis. Google says it cannot read them.

USB Protection blocks new USB data connections while the phone is locked, defaulting to charging-only. This stops attackers from pulling data through a cable.

Advanced Protection now restricts accessibility services to verified apps classified as accessibility tools. Misused accessibility permissions have been a favourite route for banking trojans and spyware.

The update also disables WebGPU in Chrome and adds a Failed Authentication Lock on select devices. Google worked with civil-liberties groups on the forensic logging design.

Google says the new controls are off by default for most users, since they restrict how some apps behave. High-risk users, such as campaign staff and activists, can switch them on in one tap from the device settings.