Introduction

Lawful Intercept (LI) is a requirement placed upon service providers to provide legally sanctioned official access to private communications. In the existing Public Telephone Network, Lawful Intercept is performed by applying a physical 'tap' on the telephone line of the target in response to a warrant from a Law Enforcement Agency (LEA). However, Voice over IP (VoIP) has enabled the mobility of the end-user, so it is no longer possible to guarantee the interception of calls based on tapping a physical line.

Whilst the detailed requirements for LI may differ from one jurisdiction to another, the general requirements are the same. The LI system must provide transparent interception of specified traffic only and the subject must not be aware of the interception. The service provided to other users must not be affected during interception.

Architecture Overview

Although the detail of LI may vary from country to country we can describe the general requirements and also explain much of the common terminology used. The primary purpose of the service provider network is to enable private communications between individuals; any LI functionality built into the network must not affect the normal service to those individuals. The interfaces between the PTN and the Law Enforcement Monitoring Facility (LEMF) are standardised within a particular territory.

LI deals with two 'products', these are: Contents of Communications (CC): exactly what it sounds like, the voice, video or message contents. Intercept Related Information (IRI): information about the source and destination of the call etc.

European requirements are often based on the ETSI standards. In North America CALEA (Communications Assistance for Law Enforcement Act) requires operators to provide LI capabilities. The network architecture and handover specifications are based on the PacketCable™ surveillance model, however the architectures are very similar.

Basic Elements of LI in a Public Telecom Network

There are three primary elements required within the public network to achieve Lawful Intercept, these are: An Internal Intercept Function (IIF) located in the network nodes. A Mediation Function (MF) between the PTN and LEMF. An Administration Function (ADMF) to manage orders for interception in the PTN.

Internal Intercept Function (IIF) These functions are located within the network nodes and are responsible for generating the Intercept Related Information (IRI) and Contents of Communications (CC).

Mediation Function (MF) This function clearly delineates the PTN from the LEMF. It communicates with the IIFs using Internal Network Interfaces (INIs) which can be proprietary. The MF communicates to one or more LEMFs through locally standardized interfaces: the Handover Interfaces (HI2 and HI3).

Administration Function (ADMF) This function handles the serving of interception orders and communicates with the IIFs and MF though an Internal Network Interface.

Implementing LI within an VoIP Network

One of the primary problems faced when managing VoIP calls is the separation of the signalling and media streams. It is quite possible that the two streams may take completely different paths through the network. In addition, even when they do pass through the same device, it may not be aware of the relationship between the streams. Some devices within the network are however specifically designed to understand and manage the separate signalling and media streams - session border controllers. Typically located at the borders of the network, they receive Intercept Related Information from the signalling stream and Contents of Communication directly from the media stream.

Conclusion

It has become clear that VoIP services will be expected to provide Lawful Intercept capabilities to the same level experienced in the PSTN. The FCC in North America has mandated that both emergency calls and Lawful Intercept must be available. Whilst not all countries mandate this capability, any network operator building a publicly available voice or multimedia over IP service today will need to plan a network which is flexible enough to implement these regulatory services in the future.

Terminology

ADMF Administration Function

CALEA Communications Assistance for Law Enforcement Act

CC Contents of Communication

ETSI European Telecommunications Standards Institute

HI Handover Interface

IIF Internal Intercept Function

INI Internal Networks Interface

IRI Intercept Related Information

LEA Law Enforcement Agency

LEMF Law Enforcement Monitoring Facility

LI Lawful Interception

MF Mediation Function

PSTN Public Switched Telephone Network

PTN Public Telecom Network

VoIP Voice over IP

References

ETSI TS 101 332 v1.1.1 (2001-08) Telecommunications security; Lawful Interception (LI) Requirements of Law Enforcement Agencies ETSI TR 101 943 V1.1.1 (2001-07) Telecommunications security; Lawful Interception (LI); Concepts of Interception in a Generic Network Architecture

ETSI TS 101 671 V2.8.1 (2003-11) Telecommunications security; Lawful Interception (LI); Handover interface for the lawful interception of telecommunications traffic

PKT-SP-ESP1.5-I01-050128; PacketCable™ 1.5 Specifications; Electronic Surveillance

Further information on Lawful Intercept can be found in the White Papers directory at Newport Networks