diff --git a/libwvdrmengine/oemcrypto/test/oemcrypto_test_android.cpp b/libwvdrmengine/oemcrypto/test/oemcrypto_test_android.cpp
index 508e51a6..1002939b 100644
--- a/libwvdrmengine/oemcrypto/test/oemcrypto_test_android.cpp
+++ b/libwvdrmengine/oemcrypto/test/oemcrypto_test_android.cpp
@@ -78,6 +78,15 @@ TEST_F(OEMCryptoAndroidLMPTest, SupportsUsageTable) {
   ASSERT_TRUE(OEMCrypto_SupportsUsageTable());
 }
 
+TEST_F(OEMCryptoAndroidLMPTest, Level1Required) {
+  const char* char_level = OEMCrypto_SecurityLevel();
+  std::string security_level(char_level ? char_level : "");
+  EXPECT_EQ("L1", security_level)
+      << "The security level is " << security_level << ". but we expect L1.\n"
+      << "If you are testing a device that should be L3 or L2, please\n"
+      << "repeat the tests with the flag --gtest_filter=\"*-*Level1Required\"";
+}
+
 // These tests are required for M Android devices.
 class OEMCryptoAndroidMNCTest : public  OEMCryptoAndroidLMPTest {};
 
diff --git a/libwvdrmengine/run_all_unit_tests.sh b/libwvdrmengine/run_all_unit_tests.sh
index d993fd2b..cced7b4b 100755
--- a/libwvdrmengine/run_all_unit_tests.sh
+++ b/libwvdrmengine/run_all_unit_tests.sh
@@ -3,8 +3,16 @@
 final_result=0
 failed_tests=()
 
+# Below, we will append filters to the exclusion portion of GTEST_FILTER, so we
+# need to guarantee it has one.
 if [ -z "$GTEST_FILTER" ]; then
-  GTEST_FILTER="*"
+  # If it wasn't set, make it add all tests, and remove none.
+  GTEST_FILTER="*-"
+# if GTEST_FILTER already has a negative sign, we leave it alone.
+elif [ 0 -eq `expr index "$GTEST_FILTER" "-"` ]; then
+  # If GTEST_FILTER was set, but does not have a negative sign, add one.  This
+  # gives gtest an empty list of tests to skip.
+  GTEST_FILTER="$GTEST_FILTER-"
 fi
 
 # Execute a command in "adb shell" and capture the result.
@@ -28,7 +36,8 @@ fi
 echo "waiting for device"
 adb root && adb wait-for-device remount
 
-adb_shell_run FORCE_LEVEL3_OEMCRYPTO=yes /system/bin/oemcrypto_test
+adb_shell_run GTEST_FILTER="$GTEST_FILTER:*Level1Required" FORCE_LEVEL3_OEMCRYPTO=yes \
+  /system/bin/oemcrypto_test
 adb_shell_run /system/bin/oemcrypto_test
 adb_shell_run /system/bin/request_license_test
 # cdm_extended_duration_test takes >30 minutes to run.