How Google’s Find Hub could use Android 16’s Secure Lock to protect your sensitive data

If you lose your Android phone and are worried about leaking your sensitive data, you can use Google’s Find Hub service to remotely lock it down or factory reset it. A factory reset is the most secure choice since it wipes all your data, but it comes with a major downside: you can no longer track the phone. Remotely locking it, on the other hand, allows you to keep tracking it but doesn’t completely secure the device. That security gap may soon be a thing of the past, however, thanks to a new Secure Lock feature introduced in the latest Android 16 update.

When you mark your device as lost or use the “secure device” option in Find Hub, the service locks it, requiring your PIN, pattern, or password to get in. It also signs you out of your Google Account, removes payment cards from Google Wallet, and can display a custom message on the lock screen.

However, this standard lock leaves several features accessible to anyone who picks up your phone. They can still pull down the Quick Settings panel, view lock screen widgets, access the digital assistant, and see the notification panel (though the notification content itself is hidden). While these don’t expose your most sensitive data, they create potential security gaps that are better off sealed.

That’s what Android 16’s new Secure Lock feature is designed to do. It not only restricts access to the aforementioned features but also enhances the lock screen by forcing multi-factor authentication for device entry. This means a thief would need to know your screen lock (your PIN, pattern, and password) and spoof your biometric data to gain access; one without the other won’t be enough. This makes Secure Lock significantly more robust than Identity Check, an existing feature that requires only biometric authentication when your device is away from a trusted location.

When I first revealed that Google was working on the Secure Lock feature earlier this year, I wasn’t sure if the feature would actually launch in Android 16. With the release of Android 16’s source code earlier this month, though, I can finally confirm the feature is part of the update and share more details about how it works.

For starters, here’s how Google describes Android 16’s new Secure Lock feature:

“Secure Lock is a new feature that enables users to remotely lock down their mobile device via authorized clients into an enhanced security state, which restricts access to sensitive data (app notifications, widgets, quick settings, assistant, etc) and requires both credential and biometric authentication for device entry.”

Secure Lock can be enabled by privileged system apps with the new MANAGE_SECURE_LOCK_DEVICE permission. These apps can then use the new AuthenticationPolicyManager API to activate the mode. Google describes this API as a “centralized interface for managing authentication related policies on the device,” adding that it includes “device locking capabilities” designed to protect Android users in “‘at risk’ environments.”

When enabling or disabling Secure Lock on a device, a custom message can be shown on the lock screen. If no message is provided, the system will show a default message such as “Device is securely locked remotely” if Secure Lock has been enabled or “Secure lock mode has been disabled” if it’s been disabled.

While it’s not in use yet, we have some evidence suggesting that Google will soon implement this feature. Recent versions of the Google Play Services app already include the MANAGE_SECURE_LOCK_DEVICE permission. Since Google’s Find Hub service is part of Play Services, it’s the clear candidate to use Secure Lock, even if we don’t know the exact custom message it will display on the lock screen.

Google could also incorporate Secure Lock into Android’s enterprise controls, though this is less likely. The AuthenticationPolicyManager API’s description states it is “not related to enterprise control surfaces and does not offer additional administrative controls,” suggesting it won’t be a tool for securing lost corporate devices. That’s why we think the Secure Lock feature will be used to silently boost the efficacy of Find Hub’s “secure device” button. We won’t know for sure until Google actually deploys it, though.