Lawful Interception in Mobile Networks: How it Works?

Mobile networks are more complex than ever, and the need of telecom operators for a structured way to support legally authorized access to communications and related information is even greater. Lawful interception in mobile networks lets authorized law enforcement agencies access specific information from a telecom network while ensuring a proper legal and regulatory path.

Often, Lawful interception is considered the same as general network surveillance. But that’s not truly what it is. It is different from the security monitoring done by operators to catch fraud and signaling abuse. What LI does is much narrower and much more regulated. This is because LI activates only against a specific target, and that too only when a valid legal authorization is there, and only for as long as that authorization allows.

Let’s learn about how lawful interception in mobile networks works, its key components, major standards, and what telecom operators need to consider when deploying an LI system.

What is Lawful Interception in Telecom? 

Lawful Interception, or LI, is a process that enables telecom networks to hand over a specific subscriber’s communications information to law enforcement or a government agency. The most important condition for LI to be executed is that the law enforcement agency should have the legal mandate to ask for the information. It is not a software feature that anyone can access and use. 

Lawful interception has been formulated because telecom networks carry a huge share of the communication that is needed during criminal investigations, national security cases, and legal proceedings. This is the reason why LI is only conducted in a proper, controlled way so that access to information stays with the authorized agencies.

The immediate question that arises is: who all are involved in this process to make it work? Well, it’s the network operator that runs the infrastructure and builds the technical capability to intercept and deliver traffic when required. 

Then, it’s the law enforcement agencies or government agencies that request access to information, performing the required legal processes to get the warrant, court order, or an equally legal instrument depending on their geography. 

Then there’s a regulator that sits above both the operator and agencies. This regulator sets the rules operators have to follow and makes sure that the whole system operates within the defined guidelines

One crucial thing here to learn is that the lawful authorization has to specify who the target is, what kind of communication interception is being requested, and for how long the authorization holds. Only when there is a legal authorization with these details can an operator process the interception request.

Why Do Mobile Networks Need Lawful Interception? 

Regulatory requirements

In many countries, operators are bound to have LI capabilities built into their networks as a condition of holding a telecom licence. There’s no option for it.

Law enforcement investigations 

Access to specific communications is required in many criminal investigations and legal proceedings connected to a specific case. Lawful interception makes this access possible without operators having to build one-off solutions every single time a request comes in.

Authorized access to communications

The whole idea behind lawful interception is that access to information happens strictly under authorization, and not as a general capability.

Subscriber-related information 

Many times, agencies need not only the content of the communication but also the subscriber-related information, such as call records or location data, that are tied to a specific legal request. 

How Does Lawful Interception Work in Mobile Networks? 

Lawful authorization/warrant → Target identification & LI activation →  Interception within the mobile network →  Mediation & secure handover →  Authorized Law Enforcement Agency 

Step 1: Lawful Authorization 

The process begins with the legal paperwork. Before networks perform any LI function, there should be a proper order for interception with authorization under the law. This order could be in the form of a warrant or court order. The order should clearly specify who the target is, what kind of communication is covered, and how long the interception is allowed to run.

It is worth noting here that the operator is not part of this decision-making; i.e., it doesn’t define who gets intercepted. The operator’s job is to receive the court order and confirm its validity.

Step 2: Target Identification 

After the order is confirmed as legitimate, the operator needs to find which subscriber or service the interception applies to. This is done with network identifiers, such as

• Subscriber identifiers, such as the IMSI or IMEI tied to a SIM or a device
• Telephone numbers, like an MSISDN
• Network addresses, such as an IP address linked to a data session
• Service identifiers, like an account or username tied to a particular service

By using the right identifiers, the target gets mapped, and the operator activates the LI for that target only.

Step 3: Interception Within the Network

When LI is active, relevant network elements start providing information about the target’s activity. Usually, this information comes in two forms.

Intercept Related Information (IRI) 

It is the data about the communication and not the content of the communication itself. Some common examples of IRI include who called whom, when it started and ended, what type of service was used, and location details. This data is useful for understanding patterns and connections around a target. 

Content of Communication (CC) 

This is the actual content of the communication, such as the voice of a call, the text of a message, or the data flowing during a session.

One important thing to understand here is that a legal order may cover only IRI, while another may cover both.

Step 4: Mediation and Handover 

Now the intercepted data that comes out of the network is raw and comes from different sources in different formats. Handing it over to the agency as it is would be inappropriate. Therefore, a mediation function collects it, processes it, and formats it into something consistent. It also makes sure each piece is matched to the right warrant and the right target, so the agency gets what it’s entitled to and nothing else.

After that, the information is handed over to the agency, ensuring that the handover connection is secure since the data is sensitive and any leak could cause trouble.

Lawful Interception Standards and Regulations 

There’s a reason why LI simply works across different operators, vendors, and countries – because it is standardized. Now, for the standardization, there are mainly two bodies that take care of it. The first one is ETSI, covering the wider LI framework, and the 3GPP, which writes the mobile-specific requirements. Overall, these standards cover how the LI system is built and how data moves.

ETSI Lawful Interception Standards 

ETSI’s Technical Committee on Lawful Interception maintains the largest set of LI specifications outside the mobile-only ones. The best part is that ETSI doesn’t just cover one network generation; rather, it covers the pieces every LI system needs, regardless of the technology behind it.

LI architecture

The lawful Interception Architecture, also called ETSI TS 104 007, explains the functional model of an LI system. It tells which functions exist, what each one does, and how they connect. It also brings in the X0 interface, which handles setting up trust between LI functions.

Handover interfaces

The TS 102 232 series defines the handover mechanism of information, i.e., how the intercepted information is handed over by the operator to the agency. It also mentions the formats and procedures in which both IRI and content should be handed over.

Warrant interfaces TS 103 120 describes the electronic interface for passing warrant information from the agency to the operator. Earlier, warrant details often moved by paper, email, or phone. The advantage of an electronic interface is that it cuts down on errors and leaves a clear record of LI requests.

3GPP Lawful Interception Standards

3GPP writes the standards for mobile networks themselves, and LI sits in its security work. Its LI specs are the ones that describe how interception fits into the network elements defined in each 3GPP release.

TS 33.106 – LI requirements

This is the starting point. It sets out what a 3GPP network has to support to allow lawful interception, written as requirements and not as a design.

TS 33.107 – LI architecture and functions

This one takes the requirements and describes how they get built: the functions, the network elements involved, and the interfaces between them. If you want to see where interception actually happens in a 3G or LTE network, this is the spec.

TS 33.108 – LI handover interface

This covers how the intercepted information is delivered to the agency in a 3GPP network, including the handover interface details. It works alongside the ETSI handover work.

3GPP lists these specifications under its security work, and they’re kept up to date across modern mobile-network releases. For 5G, 3GPP added a newer set with its own numbers: TS 33.126 for requirements, TS 33.127 for architecture and functions, and TS 33.128 for protocols and procedures. Anyone working with a 5G core will end up in those.

Benefits of a Standards-Based Lawful Interception System 

Let’s look at the benefits of a standards-based lawful interception system from the operator’s side. When an operator deploys an LI system built on ETSI and 3GPP standards, here’s how it benefits:

Regulatory compliance

Many governments directly require ETSI and 3GPP standards for lawful interception, or they accept them as proof that a company is following the law. A system built to those standards simplifies the compliance conversation.

Multi-vendor interoperability

Many operators end up with equipment from several suppliers. They have their core network from one, the LI platform from another, and the mediation function from a third one. Only if all these follow the same standards can they function in synchronization without requiring any custom work for pairing.

Scalable architecture

The number of simultaneous interceptions can grow at any period of time. A standardized architecture ensures that functions run separately, such as administration, interception, mediation, and delivery. It makes scaling of any part quite easier without disturbing the rest.

Faster deployment

With clearly defined interfaces and functions, it becomes easy to integrate the system with the network elements. The time period from signing the contract to having the system running gets significantly reduced, which matters when there’s a regulatory deadline attached.

Consistent handover

Consistency in the format of the intercepted data is important for agencies. A standards-based system delivers the IRI and the CC in the same format every single time, so there are no surprises for the agencies. Moreover, it also cuts down on any confusion that may cause back-and-forth between the operator and agency becuase of inconsistent formats

Better auditability

Eventually, someone will check the records and question the process of interception – what was intercepted, when it happened, who gave the permission, and who looked at the data. Having a standard, automated interception system makes it easy to prove that the process was done legally, with the entire audit trail available to track. 

Support for network evolution

3GPP covers each generation of networks and ETSI covers the architecture and interfaces around it. With changing networks from 3G to LTE to 5G, these standards evolve as well. Interception systems built on these standards have a clear route forward when the network changes, instead of needing a rebuild every time the core does.

Secure information delivery

For operators, data moving through the LI system is highly sensitive. Standards define how handover connections are secured, how the two ends verify each other, and how the internal LI interfaces get trusted in the first place.

REVE Lawful Interception Solution

REVE LI solution is an ETSI standard platform, supporting X1, X2, and X3 interfaces that handle interception activation, Intercept Related Information, and Content of Communication. It integrates directly with REVE’s own Class 5 Softswitch, and it also works with third-party switches, so operators running mixed vendor environments aren’t stuck needing separate systems for different parts of their network.

The solution is deployed on-premise, so operators keep full control over where interception data lives and how it’s protected. Get in touch to learn more about our LI solution.

Frequently Asked Questions