What lawful interception requires from an operator
Lawful interception obliges telecom operators and internet providers to give law enforcement access to the traffic of individuals or organizations, to support state security and to counter organized crime. Access mechanisms differ from country to country and even within regions. Two principles hold in most places:
- interception affects only the specific target named in the legal order;
- the target must not be aware that interception is taking place.
National frameworks differ. In Europe, ETSI lawful interception standards are widely used as the basis for national requirements. In the United States, it is regulated by CALEA, which applies to mobile carriers, facilities-based broadband internet access providers and VoIP providers. Other countries have their own laws and practices. None of this is legal advice: which services must be interceptable, how long data is kept and what a valid request looks like all depend on your jurisdiction.
The common LI building blocks
Standards bodies describe LI as a set of functions rather than a single box. ETSI and 3GPP use slightly different names, but the roles are similar:
- Administration. A function that receives the warrant details from the authority and provisions the interception inside the operator’s network. In 3GPP terminology this is the administration function (ADMF); the 3GPP architecture also separates provisioning and triggering functions.
- Point of interception. A network element that detects the target’s communication and copies two kinds of data: intercept-related information (who communicated with whom, when, from where) and the content of the communication itself.
- Mediation. A function that formats the copied data to the standard required by the authority (in 3GPP, the mediation and delivery function, MDF).
- Handover. Delivery of the formatted data to the law enforcement monitoring facility. ETSI describes three handover interfaces: HI1 for administrative information, HI2 for intercept-related information and HI3 for the content of communication. ETSI TS 102 232 (Part 1 and its service-specific parts) specifies how HI2 and HI3 are carried over IP-based networks; HI1 (tasking and management) is outside its scope and is covered by other ETSI documents.
For mobile networks, 3GPP maintains its own LI specifications. TS 33.126 sets the requirements, TS 33.127 defines the architecture and functions (including the administration function, the points of interception and the mediation and delivery function), and TS 33.128 defines the protocols and procedures. Before designing anything, check which release and which national profile your regulator requires.
Mobile networks: where interception happens
In a mobile network the subscriber identity, the session and the user plane are handled by different core elements. That shapes the LI design:
- The target is usually identified by a subscriber identifier, so the interception function must map an order to the right subscriber and keep the mapping current as sessions start and end.
- Interception points sit on core elements that see the target’s signaling and user traffic. The 3GPP LI architecture describes triggering functions that can instruct points of interception when a matching event occurs; which generations and releases apply depends on the regulator.
- Voice and messaging add their own requirements. Calls over VoLTE or Wi-Fi calling traverse the IMS and the access gateways, and the intercepted record has to stay coherent across them.
- Roaming and multiple access types (LTE, Wi-Fi) mean the same subscriber can appear at different network elements over time.
If your core includes a packet gateway or an ePDG, the target’s data session or Wi-Fi calling session passes through them. Whether and how such elements act as interception points is a design decision that depends on the applicable standard and regulator profile.
Fixed networks: interception at the traffic layer
In fixed broadband, the target is typically a subscriber line, an IP address, a login or a MAC address, and the traffic passes through an aggregation point such as a BRAS/BNG or a CG-NAT gateway. Two practical issues dominate:
- Identity. With dynamic addressing and carrier-grade NAT, an IP address alone does not identify a person. The interception system needs the link between the subscriber account, the session and the translated address.
- Placement. The copy of the traffic has to be taken where the whole target flow is visible, without changing the operator’s production network.
Deep packet inspection (DPI) on the traffic path is one way to do this. It can recognize protocols and services, so it can select the target’s flows and extract metadata from them.
Lawful interception in our Stingray Service Gateway
Lawful Interception is part of our Stingray Service Gateway (SSG) platform. The interception itself is carried out by the operator; we supply the solution for intercepting, storing and analyzing the specified traffic.
The platform uses DPI to intercept traffic and perform behavioral analysis. The collected data can be visualized and prepared for further analysis, and the necessary metadata can be retrieved from the intercepted traffic.
The equipment does not make changes to the carrier’s network. Traffic is processed on x86 servers, and the data is stored in systems with scaling and backup support.
Authorized officers with the required access rights reach the equipment and the collected data through a dedicated control panel, over secure communication channels.
Our solution supports VoIP and voice recording for non-ETSI deployments, and it works on landline telephone networks and on the internet. Link analysis, real-time alerts and dashboards are included.
The same DPI platform also offers CG-NAT, BNG and DDoS protection as additional options. In fixed networks, NAT translations and subscriber sessions are handled at CG-NAT and BNG, which is the context that interception needs to tie an address to a subscriber.
Legislation and procedure differ from country to country, so for each case we go through the requirements and tailor the deployment to them.
Mobile vs fixed: how the requirements differ
| Aspect | Mobile network | Fixed network |
|---|---|---|
| Typical target identifier | Subscriber identity tied to a mobile session | Subscriber line, login, IP or MAC address |
| Where traffic is visible | Core elements handling signaling and the user plane | Aggregation and edge: BRAS/BNG, CG-NAT, DPI on the traffic path |
| Identity complication | Mobility, roaming, session changes | Dynamic addresses and NAT translation |
| Services in scope | Data, voice and messaging, including VoLTE and Wi-Fi calling | Internet access, VoIP, landline telephony |
| Reference standards | ETSI LI series and 3GPP TS 33.126/33.127/33.128 | ETSI LI series; national rules such as CALEA in the US |
| Main design question | Which core elements act as interception points | Where to copy traffic without changing the network |
Lawful interception and content filtering are different jobs
Operators often handle two regulatory tasks on the same platform. They are distinct:
- Lawful interception copies the traffic of a named target for the authorities, without the target knowing.
- Content filtering blocks access to resources on regulatory blacklists or the operator’s own lists. In our platform this is the URL Filtering option, which works together with DPI and supports automated download of regulator registers and automatic blocklist updates.
Both rely on traffic visibility, which is why they are often deployed on one platform. They have different legal bases and different outputs: LI delivers data to an authority, filtering changes what a subscriber can reach. Obligations for each depend on the jurisdiction. For the filtering side, see our pages on traffic filtering for carriers and regulatory compliance.
Checklist before choosing an LI approach
- Get the legal text and the regulator’s technical specification for your country. Ask which standard and version apply.
- List the services in scope: data, voice, messaging, VoIP.
- Decide where the target’s traffic is fully visible in your network and whether interception requires changes to production equipment.
- Define how targets are identified and how the identifier stays valid with dynamic addressing, NAT and mobility.
- Define who may access the system and how that access is protected and logged.
- Plan storage, scaling and backup for the intercepted data.
- Confirm the handover format and test it with the authority before go-live.
FAQ
What is the difference between HI1, HI2 and HI3?
In the ETSI model, HI1 carries administrative information such as the interception order, HI2 carries intercept-related information (metadata about the communication) and HI3 carries the content of the communication. Which of them your network must support is set by national requirements.
Does lawful interception apply to both mobile and fixed operators?
Generally yes. For example, CALEA in the United States applies to mobile carriers, facilities-based broadband internet access providers and VoIP providers. Other jurisdictions define their own scope, so check local law.
Can DPI be used for lawful interception?
Yes. In our Stingray Service Gateway Lawful Interception, DPI is used to intercept traffic and perform behavioral analysis. The details depend on the legislation and procedure of each country.
Is lawful interception the same as blocking illegal content?
No. Interception delivers a target’s traffic to law enforcement. Blocking prevents access to listed resources. They can run on the same DPI platform, as they do in our Stingray Service Gateway, but follow different legal rules.
How do I get a technical consultation?
Use the Lawful Interception page to send us a request. We will discuss your current situation: traffic volume, available equipment and the functionality you need.
