Android's new auto-reboot feature could add fuel to the privacy battle fire

Summary

Google Play Services 25.14 includes an auto-reboot feature that kicks in after three days, meant to secure Android phones and tablets against intrusion.
That could irritate US law enforcement and intelligence agencies, which have regularly demanded more access to encrypted data, not less.
There’s the potential for a renewed fight over backdoors into encrypted operating systems, but there’s no guarantee anything will happen in the near future, given current priorities.

Usually, something like a Google Play Services update isn’t a big deal, even if you own an Android phone. The software is vital for a lot of the tasks Android apps depend on, certainly — it enables everything from single sign-on functions through to fitness tracking, malware scanning, and serving up Google ads. But on a week-by-week or month-by-month basis, updating it doesn’t normally have much consequence, certainly not compared to updating other aspects of Android.

I’m here to flag one of those significant updates. Google Play Services 25.14 includes a new auto-reboot feature that could re-ignite the battle between phone makers and law enforcement — at a time when people are more concerned about government intrusion than ever. That might sound like hyperbole, but it’ll make more sense as I explain.

Do you really need to worry about spyware on your phone?

It’s a matter of where you live, what you do, and what your security habits are like.

What’s so special about Android’s auto-reboot feature?

The devil’s in the details

A Moto Razer 40 Ultra folded closed and sitting on a table.

Google’s release notes mention only that 25.14 will automatically restart an Android device if it’s been “locked for 3 consecutive days.” In most cases, that shouldn’t be a concern. It’s rare for anyone to leave a device alone that long, especially a smartphone, and unlocking it with the correct passcode will enable business as usual.

The key is that restarting Android reverts a device to its Before First Unlock (BFU) state. Data is better encrypted, and biometric logins (i.e. facial or fingerprint recognition) won’t work until a passcode is entered. In fact, encryption keys should no longer be stored in short-term memory, making it harder for hackers to extract meaningful information, even with physical access.

If a device isn’t cracked quickly enough, it can potentially become useless as evidence.

BFU becomes especially important in the context of criminal investigations and intelligence work. If a device isn’t cracked while it’s still in its After First Unlock (AFU) state, it can potentially become useless as evidence. There’s still the possibility of brute-force entry — a flood of different passcodes and passwords can be attempted using forensic tools — but complex logins could take a while to pick apart, and if a device is set to auto-erase its contents or otherwise reject brute-force attacks, that might be the end of the line.

If any of this sounds familiar, it may be because Apple implemented something similar for iPhones with iOS 18. That introduced a feature called Inactivity Reboot, which likewise restarts a device if it hasn’t been unlocked in a while. Apple initially set the reboot window at seven days — but shortened that to just three days with October 2024’s iOS 18.1 update. It’s not entirely clear why, since Apple avoided drawing much attention to the feature. Most of what we know was uncovered by outside security researchers.

Packing light? Do these 4 things on your iPhone first

How I travel-proofed my iPhone.

The potential firestorm

It may depend on who’s paying attention

The FBI's J. Edgar Hoover Building in Washington, DC.

Creative Commons / ajay_suresh

With just about every smartphone on tighter lockdown, US law enforcement agencies could decide to revive efforts at obtaining backdoors into operating systems. As you may remember, that’s exactly what the FBI tried to order from Apple in the wake of the mass killings in San Bernardino County, California in December 2015. The agency wasn’t persuaded by Apple’s arguments that creating a backdoor would inherently compromise the security of its products — no matter that it’s often just a matter of time before unintentional vulnerabilities are discovered, let alone intentionally designing one.

The FBI managed to avoid a conclusive legal ruling by finding another way into the suspect’s iPhone, but the idea of demanding backdoor access probably hasn’t gone away. In fact, the FBI still maintains a webpage complaining about “warrant-proof encryption,” arguing that the only acceptable form of encryption is something that can be decrypted the moment a legal order is served. That’s despite advocating for end-to-end encryption of web traffic in December 2024, in a bid to protect against Chinese espionage. By definition, end-to-end encryption should only be decipherable by a sender and a recipient.

The FBI still maintains a webpage complaining about “warrant-proof encryption.”

We don’t know what the position of the FBI is under the Trump administration — which is working to install loyalists wherever possible — but it’s unlikely to be very different, especially with the administration actively pursuing illegal immigrants and pro-Palestinian activists. Phone evidence can be an invaluable tool for tracing connections, telling investigators who was talking to whom and when, and sometimes even more if text messages and location data are accessible.

This isn’t even touching on police in other countries, or what other US organizations like the National Security Agency might want. We do know that the UK government recently demanded access to iCloud backups with end-to-end encryption, so it wouldn’t be crazy to imagine it objecting to auto-reboots.

The Boox Note Air4 C sits on a wood coffee table.

This could be what finally forces Amazon to open up its Kindle ecosystem

I’m not holding my breath, but a change might be coming.

Where do things go from here?

No need to worry yet

I wouldn’t expect anything to happen right away. The Google Play Services 25.14 update has only just started rolling out, so it may take weeks to reach everyone with a compatible device. And cybersecurity experts will want to review the new technology before they make recommendations to leaders at law enforcement or intelligence agencies.

Police and spy agencies aren’t about to complain if they’re already getting what they want.

Indeed, there’s a decent chance that nothing special will happen. While US police did react to the arrival of iOS’s Inactivity Reboot, any furor seems to have simmered down, and that could be because agencies have adapted. As I mentioned, there’s a brief window after seizing a phone in which AFU will still be active, assuming someone didn’t intentionally restart the device or shut it down. Acting within that window is probably enough, and when it isn’t, a little patience with pro forensics tools may do the trick.

Police and spy agencies aren’t about to complain if they’re already getting what they want, in other words. Arguably, they probably don’t want to draw too much attention to their capabilities, since that might prompt Apple, Google, and other parties to take steps that would make investigations even tougher. Customers want to know that they have maximum protection of their privacy and security, after all.