Figure 1 shows the general system for interception. Technical interception is implemented within a 3GPP network by special functionality on network elements shown in the figure. Specific lawful interception architecture and functions are found in TS 33.107.

A 3GPP network shall provide access to the intercepted Content of Communications (CC) and the Intercept Related Information (IRI) of the mobile target and services related to the target (e.g. Call Forwarding) on behalf of Law Enforcement Agencies (LEAs). A target of a given 3GPP network can be a user subscribed to and operating in that 3GPP network, a user equipment operating in that 3GPP network (which is either the HPLMN or a VPLMN), or a user roaming from another 3GPP network or from any other network capable of using that 3GPP network. The intercepted CC and the IRI can only be delivered for activities on that given 3GPP network. Interception may be performed in the network access (all or selected APNs) and/or by intercepting a specific service at the application layer (e.g. VoIP). When interception is done on a per-service basis, only the IRI and CC defined for that service shall be delivered to the LEA, if authorized. To the extent that this is feasible, the intercept shall not include separated services not authorized by the warrant and provided by the same CSP. National regulations will define the service to be intercepted. For interception, there needs to be a means of identifying the target, correspondent and initiator and related parties of any targeted communication. A means shall exist for the operator to intercept communications based on long term or permanent identifiers associated with a target service or equipment, as identified by the LEA. To achieve interception, the operator may need to translate these into further associated identifiers, in order to identify the data to be intercepted. Target identities used for interception for each domain and service are target service and equipment associated with target use or any derived IDs from such elements that are to be defined in TS 33.107 and TS 33.108. Examples of these identities are IMSI, MSISDN, NAI, Tel URI, SIP URI, for the target service and IMEI, MAC for the equipment. In many cases, national regulation will require that LI activity is performed entirely within a particular legal jurisdiction, in line with the requirements in 5.1.2 and 5.1.4. It is not permitted for a CSP to rely on another CSP or jurisdiction to ensure LI activity can occur. For example, a serving network shall not share LI target identities with a home network in the case of roaming or vice versa (as described in clause 5.1.4). When encryption is provided and managed by the network, it shall be a national option as to whether the network provides the intercepted communication to the LEA decrypted, or encrypted with keys and additional information to make decryption possible. End-to-end encryption implemented in the user equipment based on encryption features provided by the operator is considered to be a network-managed encryption and is subject to the same requirements. See subclause 5.7 for additional requirements. Encryption not provided or managed by the network, e.g. user provided end-to-end encryption, cannot be removed by the network. In the case that the Communication Service Provider (CSP) provides encryption keys to the subscriber or customer but does not provide the encryption itself, the CSP shall provide the keys to the LEA if required by national regulations. When compression is provided and managed by the network, it shall be a national option as to whether the network provides the intercepted communication to the LEA decompressed, or compressed with information to make decompression possible. When encoding is provided and managed by the network, it shall be a national option as to whether the network provides the intercepted communication to the LEA decoded, or encoded with capability (e.g., codec information) to make decoding possible. Location Dependent Interception, (LDI) allows a 3GPP network to service multiple interception jurisdictions within its service area. Multiple law enforcement agencies with their own interception areas can be served by the 3GPP network. All the information or rules given for interception within a 3GPP network apply to interception within an Interception Area (IA) when LDI is invoked. A target may be marked in one or more different IAs within the same 3GPP network. Interception is neither required nor prohibited by this standard when LDI is active and the location of the target is unknown or unavailable. National regulations may require that an operator is able to intercept any communication passing through its network based on any visible identity not connected to the operator network. It shall be based on a match between this target identity and identity type (e.g. IMPU) with the detected party fields. This identity is referred as a Non-Local Identity.

The requirement for lawful interception is that all telecommunications services in the 3GPP network standards should be capable of meeting the requirements within this document. It is a national option that LI, as delivered to the LEMF, may be restricted to specific target subscribed services offered by the CSP or third party providers with a service level agreement with the CSP.

The requirements in this clause are additional to the requirements described elsewhere in this specification which apply to the home network in a roaming scenario. National regulations cover the definition of services and the definition of service provider categories which are subject to LI obligations. This can include how and which IMS services are considered to be covered. For the purpose of roaming, IMS VoIP Service or other 3GPP operator services (CS voice replacement) shall be considered equivalent to a CS voice service and therefore all requirements applicable to legacy CS voice (e.g. interception of voice in isolation from other services) shall be applicable to IMS VoIP Service or other equivalent services. It shall be possible to intercept all basic voice, data and messaging services provided to a target by a network. The visited network shall be able to support the interception of all services without home network assistance or visibility, using the identifiers provided by an LEA as described in clause 5.1.2. However, the visited network is not required to be able to intercept supplementary services (e.g. voicemail, home network based call forwarding) or 3rd party services not directly provided by the visited network. However, national regulation may specify minimum LI capabilities, if such services are in the visited network then they shall be considered in scope for interception (subject to an applicable lawful authorisation). National regulations may require interception to take place in the home network for outbound roamers, where the user session is routed via the home network. There is no requirement to force traffic to the home network for this purpose. National regulations may limit delivery of communications (CC and communications-associated IRI) of an outbound international roaming target by the HPLMN based on roaming specific interception constraints (e.g., roaming outside national border). To support these scenarios, it is a national option for the HPLMN to be able to support a mechanism to apply on a per-warrant/per-intercept to limit the delivery of the communications (CC and communications-associated IRI) to LE of an outbound international roaming target based on roaming specific interception constraints (e.g., roaming outside a national border). The default setting is determined based on a national option. Communications originated by the roaming target are subject to this mechanism. Communications incoming to the target that are answered by the target are subject to this mechanism. Communications incoming to the target that are not answered by the target (e.g., due to call forwarding) are not subject to this mechanism. Non-communications-associated IRI (e.g., serving system event) are not affected by this requirement. All these requirements are based on conditions and definitions contained in national regulations.

As depicted in Figure 1, the Law Enforcement Agency (LEA) provides the intercept request (e.g., lawful authorization or warrant) to the CSP. The intercept request identifies, at a minimum, the target, the type of intercept (i.e., IRI-only, or IRI and CC); the service to be intercepted (e.g. 3G PS network access(es) and/ or the services (e.g. VoIP)) that is authorized, the authorized period for interception, and the LEA delivery address(es) for the intercepted information In other situations the CC-delivery may provide metadata not sent in the IRI. In case of a IRI only intercept the CC-delivery may take place without the actual content. It is upon national regulations to implement any of these options. The CSP shall securely administer the intercept (e.g., to activate, deactivate, show, or list targets) within the 3GPP network as quickly as possible. The CSP's administration function shall use appropriate authentication and audit procedures. When LDI is used, the administration function shall allow specific IAs to be associated with targets.

Depending on national requirements, the CSP may be required to report the location of the Target at the beginning and end of CS calls and PS and IMS sessions on a per warrant or per intercept basis. It may also be a national requirement for the CSP to report the location of the Target :

• during on-going communications;
• for any mobility management event detected in the 3GPP core network which includes a target's location change or update.

The location information associated with target communication reported to the LEMF shall be at least location information trusted by the 3GPP network (i.e. the location information is either 3GPP network derived or verified). National regulation may require that the location information source be provided if known by the CSP. The 3GPP access network derived or verified location information shall be the location(s) of the access point(s) to which the Target is connected in the access network(s). The location shall be the access network identifier like the radio cell identity. For non 3GPP access networks, the location information shall be at least the identity of entry point into the 3GPP core network (e.g. fire wall or security gateway). The location information of the non-3GPP access network shall be provided if this information is available to the CSP. National regulation may require that third party provided location information associated with target communication, that may be available in the 3GPP network, is reported to the LEMF. If required by national regulation the geographic location and/or civic address information shall be reported to the LEMF. This can include additional radio coverage information.

In addition to the 3GPP network derived or verified location information as described in 5.11.1. target location information from Location Services (LCS, as described in TS 22.071 and TS 23.271) may be used additionally to provide location information to the LEMF if available. Additional requirements applicable are in Annex B.