Lawful Interception

Revision as of 04:14, 12 October 2016

A feature provided by service providerss to law enforcement agencies (FBI, Interpol, RCMP, etc.) that allowing law enforcement agencies to intercept calls by receiving a copy of the audio of both parties and call information records.

Overview

• Lawful Interception (process of intercepting a target's conversation)
• Interception target (someone under investigation by law enforcement agency, and whom the agency wants to intercept calls)
• Law enforcement agency ( an agency that has, by law, the power to request the interception of calls toward or from targets)
• A law enforcement agency sends, to the service provider, a list of targets to intercept (phone nubers)
• Service provider configures its equipments to intercept the targets, based on phone numbers
• When service provider equipments detect a call that involves a target to intercept, it
  • Forwards a copy of call audio (both directions) to the agency through forked calls (CC link - a call toward the agency, carrying intercepted audio)
  • Sends information records (IRI records) to the agency)

The call data (known as Intercept Related Information or IRI in Europe and Call Data or CD in the US) consists of information about the targeted communications, including destination of a voice call (e.g., called party’s telephone number), source of a call (caller’s phone number), time of the call, duration, etc.

IRI records

• Lawful Interception, a feature as provided by service providers, requires law enforcement agency to first meet Lawful Interception Requirements by providing:
  • A list of targets
    • Type of intercepted targets can be from: PSTN, ISDN, GSM (CS), TETRA, GPRS (PD), UMTS (CS)
  • LIID (unique identifier) for the target
  • Phone number (calling or called number) of the target
  • Start/end date and time for the interception
• Service provider updates targets list in it’s equipments
• The equipments detect a matching calling or called number, and activates the interception
• Lawful Interception, then allows law enforcement agencies to intercept calls
  • By receiving a copy of the audio of both parties, through CC link (forked call) which is a call toward the agency, carrying intercepted audio
  • By receiving call information records (or IRI records)
• Intercept Related Information record (IRI record) is a CDR-style record that contain IRI information on an intercepted call

IRI records generating

Schematic showing interception of a call already routed with a Tmedia

• IRI records are generated at various states of the interception
• They provide information on the interception, and call state
• In a call, each call leg can be an interception target
• When a leg is an interception target, it’s intercepted:
  • Audio «from» this leg is forked to a new outgoing call toward the agency
  • Audio «to» this leg is forked to a new outgoing call toward the agency
  • IRI records are generated for this interception
• Both legs may be independently and simultaneously intercepted
  • 2 pairs of forked audio outgoing calls
  • 2 sets of IRI records

Types of IRI records

• Start: Indicate that the interception is starting at first event of the communication attempt
• Continue: Indicate call state change at any time during the communication (attempt)
• End: Indicate the end of the interception at the end of the communication (attempt)
• Report: For any non-communication related events

Typical information found in an IRI record

• Record type (Start, Continue, End, Report)
• LIID (unique identifier of the intercepted target assigned by an agency)
• CIN (communication identity number)
• Operator identifier
• Direction (target is originating, or terminating)
• Call state (idle, setup, connected)
• Duration of ring and conversation states
• Calling / called party numbers
• Release reason
• CC link state (setup, active, released, lack of resources)
• CC link release reason

IRI records encoding

• IRI records are encoded in ASN.1 format
• ASN.1 IDs and objects hierarchy for encoding IRI records is provided by ETSI specifications

IRI records values and files specification

• IRI records values can be
  • Mandatory in each record
  • In one record only for the whole call
  • optional (in some records only, or none at all)
• IRI record files can
  • Contain only one IRI record (one file per record)
  • Contain multiple IRI records (grouped)

IRI records uploading to the agency

• As files, using the FTP protocol
• Telcobridges supports SFTP as file transfer method as well

References

Wikipedia lawful intercept article