Lawful Interception

The call data (known as Intercept Related Information or IRI in Europe and Call Data or CD in the US) consists of information about the targeted communications, including destination of a voice call (e.g., called party’s telephone number), source of a call (caller’s phone number), time of the call, duration, etc.

IRI records

• Lawful Interception, a feature as provided by service providers, requires law enforcement agency to first meet Lawful Interception Requirements by providing:
  • A list of targets
    • Type of intercepted targets can be from: PSTN, ISDN, GSM (CS), TETRA, GPRS (PD), UMTS (CS)
  • LIID (unique identifier) for the target
  • Phone number (calling or called number) of the target
  • Start/end date and time for the interception
• Service provider updates targets list in it’s equipments
• The equipments detect a matching calling or called number, and activates the interception
• Lawful Interception, then allows law enforcement agencies to intercept calls
  • By receiving a copy of the audio of both parties, through CC link (forked call) which is a call toward the agency, carrying intercepted audio
  • By receiving call information records (or IRI records)
• Intercept Related Information record (IRI record) is a CDR-style record that contain IRI information on an intercepted call

IRI records generating

Schematic showing interception of a call already routed with a Tmedia

• IRI records are generated at various states of the interception
• They provide information on the interception, and call state
• In a call, each call leg can be an interception target
• When a leg is an interception target, it’s intercepted:
  • Audio «from» this leg is forked to a new outgoing call toward the agency
  • Audio «to» this leg is forked to a new outgoing call toward the agency
  • IRI records are generated for this interception
• Both legs may be independently and simultaneously intercepted
  • 2 pairs of forked audio outgoing calls
  • 2 sets of IRI records

Types of IRI records

• Start: Indicate that the interception is starting at first event of the communication attempt
• Continue: Indicate call state change at any time during the communication (attempt)
• End: Indicate the end of the interception at the end of the communication (attempt)
• Report: For any non-communication related events

Typical information found in an IRI record

• Record type (Start, Continue, End, Report)
• LIID (unique identifier of the intercepted target assigned by an agency)
• CIN (communication identity number)
• Operator identifier
• Direction (target is originating, or terminating)
• Call state (idle, setup, connected)
• Duration of ring and conversation states
• Calling / called party numbers
• Release reason
• CC link state (setup, active, released, lack of resources)
• CC link release reason

IRI records encoding

• IRI records are encoded in ASN.1 format
• ASN.1 IDs and objects hierarchy for encoding IRI records is provided by ETSI specifications

IRI records values and files specification

• IRI records values can be
  • Mandatory in each record
  • In one record only for the whole call
  • optional (in some records only, or none at all)
• IRI record files can
  • Contain only one IRI record (one file per record)
  • Contain multiple IRI records (grouped)

IRI records uploading to the agency

• As files, using the FTP protocol
• Telcobridges supports SFTP as file transfer method as well

References

Wikipedia lawful intercept article