For the purposes of the present document, the terms given in TR 21.905 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905.

For the purposes of the present document, the following symbols apply:

For the purposes of the present document, the abbreviations given in TR 21.905 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR 21.905. EMS GNSS GSO HAPS LI NAS NGSO NNSF NTN PLMN PWS RAT SMS TN UE

When a UE attaches to the mobile network, the RAN selects the appropriate core network for the UE taking into account, among other things (TS 38.300):

• UE identifiers;
• UE's selected PLMN;
• UE location information (including the serving cell as known to the serving RAN node).

With NTN it is possible to deploy very large cells over large portions of a continent (possibly covering different countries), with the different core networks for the various countries connected to the same NTN RAN (MOCN network sharing scenario). In such a scenario, it may not always be possible to correctly determine the appropriate core network for a connecting UE, especially close to country borders, because the serving cell information may not be granular enough. Furthermore, a malicious UE might "fake" its selected PLMN in order to attempt connecting to a different core network. Upon such an attempt the AMF will disconnect the UE and inform the RAN node via an appropriate NGAP cause value, so the RAN can take appropriate action on subsequent attempts by the same UE. The UE may send GNSS measurements to the RAN over RRC, but this has at least the following drawbacks:

• In principle, just as a malicious UE could fake its selected PLMN, it could also fake its GNSS measurements;
• Sending GNSS measurements over RRC before AS security is set up raises security and privacy issues.

Because of the above, relying only on signalling GNSS measurements over RRC is not considered a viable solution to this issue. As recommended in SA3 LS to RAN2 (R2-2204458) the location information is sent after NAS security is established. Even after NAS security establishment, user consent for obtaining UE location information may also be required depending on regional regulation and policy. The RAN can also request radio measurements (intra-RAT neighbours, inter-RAT neighbours, WLAN, etc.) from the UE; these may be used to drive NNSF and to learn from the environment. Some further observations:

1. At least some of the information the UE supplies to the network will have to be considered as trusted, to avoid extreme conclusions (at least RRC measurements cannot be faked);
2. Core networks connecting to the same shared RAN will always require some degree of common coordination / configuration: this is typically the case for network sharing (especially MOCN). For NTN, this may include e.g. specific timer settings/behaviour for UE connection attempts;
3. Due to mere traffic load considerations, it may not be desirable to cover whole portions of a continent, including multiple countries, with a single cell. Therefore, in real deployments the served cell information may typically be more granular than in the extreme case envisaged so far.

The above has been deemed sufficient to mitigate the issue in Rel-17.

A 5G system with satellite access shall be able to determine a UE's location in order to provide service (e.g. route traffic, support emergency calls) in accordance with the governing national or regional regulatory requirements applicable to that UE. (clause 6.3.2.3 of TS 22.261). Because of this, even when providing services over entire continents with NTN, there is no "globally harmonized" set of requirements that overrules local ones. This is also valid for UE location information. In this respect, there is no difference between NTN and terrestrial networks. Because of the above, for NTN the same required granularity for UE location information estimated via GNSS should be considered as for terrestrial networks.

Network operators of 3GPP defined non-terrestrial network, have to know reliably the location information of a UE attached to the network in order to select the appropriate core network. Once the appropriate core network has been selected for a UE, it is possible to support some services subject to national regulations or other operational constraints. In TR 23.737, the list of such services has been identified in key issue #10:

• Public Warning System (PWS)
• Lawful interception (LI)
• Emergency services (EMS)
• Charging and Tariff notifications

In TR 22.926, it has been identified that "To support regulated services and features (e.g. Public Warning System, Charging and Billing, Emergency calls, Lawful Intercept, Data Retention Policy in cross-border scenarios and international regions, Network access), 3GPP networks should have the capability to locate each UE in a reliable manner and determine the policy that applies to their operation depending on their location and/or context." Furthermore, in [4], it is pointed out that "any solution addressing extraterritorial (e.g. international maritime zone and aeronautical) use cases should provide means to notify the HPLMN on roaming in and out of those areas, including the cases when the serving PLMN has not changed." Relying only on the GNSS based location information reported by the UE is not considered reliable by SA3-LI [4]. The UE reported location information (for example determined with its GNSS receiver), could be erroneous due to intentional (e.g. maliciously tampering by user or by 3rd party) or unintentional (e.g. interference) causes, hence it cannot be considered trusted by network operators. Already 3GPP has defined a network based functionality to verify the reported UE location with the identifier of the serving cell. However, radio cells in non-terrestrial networks, may be larger than the ones of terrestrial networks and may cover borders between two or more countries. Therefore, such Cell Id information may not be sufficient to discriminate the country in which the UE is located. It is expected that solutions combining both UE reported GNSS information and network based information for verification of UE location can improve the reliability of core network selection in non-terrestrial networks. This is important for

• Services subject to national regulations or other operational constraints. (e.g. Public Warning System (PWS), Lawful interception (LI), Emergency services (EMS), Charging and Tariff notifications).
• Cases where the UE reported location information (for example determined with its GNSS receiver), could be erroneous due to intentional (e.g. maliciously tampering by user or by 3rd party) or unintentional (e.g. interference) causes.
• NTN radio cells larger than terrestrial network radio cells and possibly covering borders between two or more countries.

In order to define an appropriate network based solution to verify UE location, it is necessary to determine requirements for the verification accuracy. Note that these requirements should not be assumed to be the same as the regulatory requirements applicable to the UE location in terms of Accuracy, Reliability (related to law enforcement and liability), Latency and Privacy as identified in Annex A. As identified in Annex A.2, SA3-LI recommends in S3i200056 [4] that "The logical location shall unambiguously map to the geographical area of the UE physical location. Granularity of such geographical areas needs to be able to provide network location accuracy comparable with terrestrial networks." In terrestrial networks, verification is based on Cell Id and hence, the targeted granularity is related to cell size. Similar granularity should be considered for NTN. Terrestrial macro cell size is assumed to be up to 5-10 km diameter.

Most UE positioning functionality is typically UE-associated, i.e., it assumes that a UE context is present for the UE being positioned. This means that the UE itself has already completed the initial access procedures. Because of this, all observations and mitigations already discussed in Rel-17 are still relevant and applicable.

It refers to a telephone request or text message request for emergency services (e.g. police, fire departments, or other first responders) which requires immediate action to prevent loss of life, reduce bodily injury, prevent or reduce loss of property and respond to other emergency situations determined by local policy. Accuracy Accuracy requirements for emergency calls have been identified in TR 22.872, where the position accuracy is required to be [50m Horizontal, 3m Vertical] which are the most demanding of the regulated services in terms of accuracy requirements. This is in line with the requirements of two major regulatory bodies and summarized as follows:

Reliability In this case, the mobile network operator may be liable for the provision of a "reliable" UE location (either network verified or network provided) that will be the basis to the organisation of personal assistance or rescue. Latency The delay to determine the UE location should be minimised to ensure timely assistance or rescue, While a typical call set-up is less than a second, the delay for UE location determination should not impact significantly this communication set-up time.

As a legally sanctioned official access to private communications, Lawful Interception (LI) is a security process in which a service provider or network operator collects and provides law enforcement officials with intercepted communications of private individuals or organizations. LI implementation is required for example by the European Council Resolution from 1995 [12] which allows for LI to prevent crime, including fraud and terrorism. Accuracy For lawful intercept, SA3-LI recommends in [4] that "The logical location shall unambiguously map to the geographical area of the UE physical location. Granularity of such geographical areas needs to be able to provide network location accuracy comparable with terrestrial networks." Given that for such use cases, the location accuracy in terrestrial networks is mostly based on cell ID, it directly relates to the typical cell size. Hence a macro cell size granularity (accepted granularity by SA3-LI) should be sufficient to detect country border crossings. Reliability In this case, Law enforcement applies, and therefore the mobile network operator shall be able to provide a "reliable" UE location (either network verified or network provided). In S3i210282 [8], it is noted that "any method which relies solely on UE-generated location information is unlikely to be considered reliable for network selection purposes. Therefore, a method such as GNSS/A-GNSS cannot be considered as reliable or trusted unless the information provided by the UE can be verified by the network." Latency No regulatory requirement have been identified for this. Despite this, NTN location determination should not significantly impact the LI service as provided by an TN network.

PWS is usually realised (based on country regulator rules) by CellBroadcast, which provides a direct selectivity by cellID (sends the message to all devices registered in a base station) but can reach sector accuracy (each of the antenna emitters in the same cellID) to provide geographical accuracy. E.g. to alert half of the city that is getting an imminent flood bout not the other half which is on a higher positions. Alternatively Location-Based SMS may be used, and same selectivity shall be employed. That will rely on reliable location, and at least cellID is expected to be necessary. In its Directive (EU) 2018/1972 [11], the European Union states in (293) that "Diverging national law has developed in relation to the transmission by electronic communications services of public warnings regarding imminent or developing major emergencies and disasters. In order to approximate law in that area, this Directive should therefore provide that, when public warning systems are in place, public warnings should be transmitted by providers of mobile number-based interpersonal communication services to all end-users concerned. The end-users concerned should be considered to be those who are located in the geographic areas potentially being affected by imminent or developing major emergencies and disasters during the warning period, as determined by the competent authorities." Accuracy One can assume that the service should be provided over the targeted area with an equivalent granularity as obtained in terrestrial networks that is cell size related. Hence a macro cell size granularity should be sufficient. Reliability There are no explicit regulatory requirement for this. Despite this, NTN location determination should follow same reliability requirements as the PWS systems. Latency No regulatory requirement have been identified for this. Despite this, NTN location determination should not impact significantly the PWS service as provided by an TN network.

Tariff refer to the set of parameters defining the applied charge for the use of a particular bearer /session / service. Accuracy As per Public warning service, knowing the context of the UE (country or aeronautical/maritime) is sufficient for charging and tariff notifications. One can assume that the accuracy of the UE location service should be similar to the one in typical terrestrial mobile networks that is cell size related. Hence a macro cell size granularity should be sufficient. Reliability It is the responsibility of the Mobile network operator to ensure via reliable methods that the UE is effectively in a given context for appropriate charging/billing. Latency No regulatory requirement have been identified for this. Despite this, NTN location determination should not significantly impact the charging/tariff service as provided by an TN network.

Privacy In [13], it is stated in article (71) that "The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as automatic refusal of an online credit application or e-recruiting practices without any human intervention. Such processing includes 'profiling' that consists of any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning him or her or similarly significantly affects him or her." Therefore the UE location shall be protected to preserve the privacy of the users. In [13], it is further stated in article (71) that "However, decision-making based on such processing, including profiling, should be allowed where expressly authorised by Union or Member State law to which the controller is subject, including for fraud and tax-evasion monitoring and prevention purposes conducted in accordance with the regulations, standards and recommendations of Union institutions or national oversight bodies and to ensure the security and reliability of a service provided by the controller, or necessary for the entering or performance of a contract between the data subject and a controller, or when the data subject has given his or her explicit consent." Therefore, the user location can be processed if it is to comply with regulations for example in order to provide safety to the citizen (emergency calls, public warning services), to prevent crimes (Lawful intercept) or frauds (Charging and Tariff notifications).