1. 1 RANS Conference#10, 24 March 2011; session 2.1 1 ETSI Lawful Interception standardization Peter van der Arend Питер ван дер Аренд Chairman ETSI/TC LI (Technical Committee on Lawful Interception)

2. 2 RANS Conference#10, 24 March 2011; session 2.1 2 Lawful Interception Security LI & RD environment Retained Data European Telecommunications Standards Institute Technical Committee Lawful Interception Handover Interfaces for transport of Lawful Interception and Retained Data are standardized by TISPAN ATTM TETRA SA3-LI

3. 3 RANS Conference#10, 24 March 2011; session 2.1 3  A European standards organization, created in 1988, active in all areas of telecommunications  including radio communications, broadcasting and Information Technology  Creates different deliverables to meet market needs  Supporting EU and EFTA regulation and initiatives  A not-for-profit organization (750+ members from 60+ countries)  Members: Administrations, Administration Bodies and NSOs, Network Operators, Service Providers, Manufacturers, Users  Favours international and interregional collaboration  All publications freely available! Downloadable from ETSI Website Intro on ETSI http://pda.etsi.org/pda/queryform.asp http://portal.etsi.org

4. 4 RANS Conference#10, 24 March 2011; session 2.1 4 ETSI members in Russia  Administration  Ministry for Information  Research Body  Geyser S & P, GosNIIAS, ISPRAS, ITT RAEN,  Television Research Institute,  ZNIIS (Central Science Research Telecommunication Institute)  Service Providers  MERA NN, NIIR  Manufacturers  CJSC Peter-Service  Observers  Norsi-Trans

5. 5 RANS Conference#10, 24 March 2011; session 2.1 5  Created as stand-alone TC in October 2002  Meetings  three plenary meetings a year are organised (around 75 participants)  dedicated Rapporteur’s meetings can be organised on a specific issue (actual study items: Dynamic Triggering, eWarrant, DR Architecture)  Participation  Government organisations: Law Enforcement Agencies, Regulators  Communication Service Providers  Manufacturers  TC LI meetings can be attended by ETSI members  non-ETSI members can participate by invitation of the chairman  next plenary meeting: ETSI/TC LI#27, June 2011  Producing specifications and reports  on Lawful Interception and Retained Data handling  mainly on the Handover Interface  Promoting globally ETSI Lawful Interception and Data Retention standards amongst operators and national bodies Intro on ETSI/TC LI.

6. 6 RANS Conference#10, 24 March 2011; session 2.1 6 Why Lawful Interception implementation in EU 17th January 1995: EU Council of Ministers adopted resolution COM 96/C329/01 on Lawful Interception The providers of public telecommunications networks and services are legally required to make available to the authorities the information necessary to enable them to investigate telecommunications

7. 7 RANS Conference#10, 24 March 2011; session 2.1 7 Types of Lawful Intercepted data (TS 101 331)  Intercept Related Information (IRI)  Collection of information or data associated with telecommunication services involving the target identity: communication associated information or data (including unsuccessful communication attempts) service associated information or data (e.g. service profile management by subscriber) location information  Content of Communication (CC)  Information exchanged between two or more users of a telecommunications service

8. 8 RANS Conference#10, 24 March 2011; session 2.1 8 General network arrangements (TS 101 331)

9. 9 RANS Conference#10, 24 March 2011; session 2.1 9 Handover Interface ports (TS 101 671)  HI1: for Administrative Information  Request for lawful interception: target identity, LIID, start/duration, IRI or IRI+CC, IRI delivery address, CC delivery address,...  Management information  HI2: for delivery of Intercept Related Information (IRI)  All data related to establish the telecommunication service and to control its progress  Correlation information  HI3: for delivery of Content of Communication (CC)  Transparent en-clair copy of the communication  Correlation information

10. 10 RANS Conference#10, 24 March 2011; session 2.1 10 Handover Interface Concept (TS 101 671)

11. 11 RANS Conference#10, 24 March 2011; session 2.1 11 IIF INI HI2 (IRI) HI3 (CC) Management System HI (TS 101 671) Law Enforcement Monitoring Facility HI: Handover Interface HI1: Administration HI2: Intercept Related Information HI3: Content of Communication HI1 Authorisation Authority / Law Enforcement Agency IRI: Intercept Related Information CC: Content of Communication INI: Internal Network Interface IIF: Internal Intercepting Function AI: Administrative Interface Switching functions Administration Function 1 AI Mediation Function 2 Mediation Function 3 Target information (active interception) Mediator INI1 INI3 INI2 Warrant Data Call Content ISDN Interception network ISDN/PSTN Services step-by-step

12. 12 RANS Conference#10, 24 March 2011; session 2.1 12 Parameters in IRI records (TS 101 671)  LI related identities  LIID, target, network operator, network element, call ID,...  Timestamp  Intercepted call direction (to / from target)  Intercepted call state (in progress, connected)  Address: Calling party / Called party / Forwarded-to-party /..  E.164, TEI, IMSI, IMEI, MSISDN, SIP URI, …  Ringing tone duration / conversation duration  Type of intercept:  PSTN, ISDN, GSM (CS), TETRA, GPRS (PD), UMTS (CS)  Supplementary service information  Location information  National parameters  IRI record type (Begin, Continue, End, Report) ....

13. 13 RANS Conference#10, 24 March 2011; session 2.1 13 LI Administration Function (AF) Lawful Interception Mediation Function (MF) HI1 HI2 (IRI) HI3 (CC) INI2 INI3 HI INI1a CCCI LEA Domain CSP Domain CCTI InterceptRelated Information Internal Interception Function (IRI - IIF) Content of Communication Internal Interception Function (CC - IIF) Content of Communication Trigger Function (CCTF) INI1b INI1c Law Enforcement Monitoring Facility Authorisation authority / Law Enforcement Agency (TS 102 232-xx) Reference model for LI in IP networks ( TR 102 528)

14. 14 RANS Conference#10, 24 March 2011; session 2.1 14  Generic header information to be added to HI2 and HI3 traffic  LIID  Authorization country code  Communication Identifier  Sequence number  Timestamp  Payload direction  Payload type  Interception Type  IRI record type (Begin, Continue, End, Report) ... Generic header information (TS 102 232-1)

15. 15 RANS Conference#10, 24 March 2011; session 2.1 15 Handover of LI via IP Networks (TS 102 232-fam) TS 102 232 part 01 Generic Headers SSD for Internet Access Services part 02 SSD for E-mail Services Handover manager Delivery session Transport layer Network layer Delivery network part 04 SSD for Layer 2 Services part 05 SSD for IP Multimedia S ervices SSD for PSTN/ ISDN Services part 06 SSD -> Service-Specific Details on top Application Presentation Session Transport Network and below part 07 SSD for Mobile Services part 03

16. 16 RANS Conference#10, 24 March 2011; session 2.1 16 SIP Server Interception Function SBC switch + (SPAN) MGW RG 2) All rtp is copied to the LI Switch and if needed Target rtp is copied to the Interception Function 3) If needed rtp to be intercepted (local SBC traffic) is copied from the SBC to the Interception Function rtp SIP rtp 1) All SIP messages are copied over SPAN ports (or via mirrors) via the LI Switch to the Interception Function SBC rtp cmd CC LI Switch Management System Law Enforcement Monitoring Facility Administration Function Mediation Function SIP IRI 3 1 1 2 2 LI possibility on a VoIP platform Authorisation Authority / Law Enforcement Agency Warrant 3 HI TS 102 232-xx (passive interception)

17. 17 RANS Conference#10, 24 March 2011; session 2.1 17 What’s next on Lawful Interception ?  Next meeting ETSI/TC LI#27, June 2011  Interception of new services, like CAT & CRS, LCLS  Key handling in case of Media Security  Technical Report on “eWarrant Interface” for general use (DTR 103 690)  Technical Specification of “Dynamic Triggering of Interception” ( DTS 102 677)  At the moment operators need tailor made integration to keep the complete service interceptable  There is a need for rules how the Network is performing Basic LI for IP related services  Also rules for triggering between networks are needed  International Dynamic Triggering might become an issue in the future

18. 18 RANS Conference#10, 24 March 2011; session 2.1 18 Dynamic Triggering: Multiple Operator (DTS 102 677) IP-Connectivity Access Network TOF=Triggering Origination Function TCF=Triggering Control Function TRF=Triggering Receiving Function HI3 DT6 DT4 DT5 Operator 2 Operator 1 HI2 TRb Operator 1 Service Domain TRa TOa DT3 TOF TRF LEMF TCF (Service Domain) INI2 HI2 DT1 DT2 Operator2 IP-CAN Domain TCF (Transport Domain) OP1 AF OP2 AF OP1 MF2 OP2 MF2 MF3 INI3 TOb INI1a INI1b TTP GTR GTO DT7 LEA Domain Legal Domain INI2 HI1 GTO=Gateway Triggering Originating GTR=Gateway Triggering Receiving

19. 19 RANS Conference#10, 24 March 2011; session 2.1 19 National LI Implementation  Definition of the services and the elements to be intercepted  Which standard to be used for the handover of the intercepted data (e.g. ETSI TS 101 671 (CS) and/or ETSI TS 102 232 (IP))  Preparation of ETSI handover specification for national implementation  definition of the optional elements for national use  how to use specific elements  definition of specific national elements  transport mechanism to be used  security mechanisms

20. 20 RANS Conference#10, 24 March 2011; session 2.1 20 Security Report  ETSI TR 102 661 Security framework in Lawful Interception and Retained Data environment  defining a security framework for securing Lawful Interception and Retained Data environment of the CSP and the Handover of the information  Advice on Security measurements  Advice on Physical security CSP= Communication Service Provider

21. 21 RANS Conference#10, 24 March 2011; session 2.1 21 More details on ETSI/TC LI can be found on: http://portal.etsi.org/li/Summary.asp Chairman TC LI: Peter@lawfulinterception.com Peter@DataRetention.eu

22. 22 RANS Conference#10, 24 March 2011; session 2.1 22

23. 23 RANS Conference#10, 24 March 2011; session 2.1 23