1. 3GPP SA3 Lawful Intercept
Brye Bonner
Chair SA3-LI
Strictly speaking IP is a routing protocol. Other transport protocols which can be used for voice, such as ATM and Frame Relay, have limited use in today’s environment and we do not want to standardize protocols that will most likely will be non-existent in a very short time.

2. 3GPP Organization
Services Aspect (SA); Security (SA WG3); Lawful Intercept (SA WG3-LI)
UMTS, GSM.
3GPP - WLAN IW
3GPP TS (stage 1)
GSM TR 01.33
3GPP TR
3GPP TS Stage 2
Interworking
GSM TS /03.33
3GPP TS /
3GPP TS Stage 3

3. 3GPP Schedule for latest release
Release 6 developed over last 14 months
Frozen September 2004
All 3GPP documents frozen at same time to allow manufacturers to develop product across all 3GPP standards. Partnership companies (ETSI is one) then ballot the release with or without national addendums.
Four times a year Plenary meets and approves change requests. Once approved by the plenary the document becomes stable and can be implemented if needed.
SA3-LI expects to freeze (Stage 1) now.
Does not expect to change (Stage 3) but is asking that it be left open until October
Is asking that (stage 2) be left open to complete WLAN stage 2 work.

4. Work Items for LI rel 6 Justification:
to develop IP-based Services, which need to be addressed by lawful interception. SA WG3-LI will study IMS phase 2, Multimedia Broadcast and Multicast Services, Priority Service, Presence Service, Subscriber Certificates, and WLAN for possible lawful interception systems.
Objective
The objective of this work item is to create a lawful interception specification for the latest Rel-6 architecture and services as described in the above justification.
The enhancements to specification TS addresses the additional work to specify the HI2 (Intercepted Related Information) and the HI3 (Content) interfaces for Packet Data, Circuit Switched and IMS delivery to the Law Enforcement Monitoring Facilities for 3G networks for Release 6. In the first step the 3G Packet Domain and phase 1 Multi Media Domain have been addressed in this specification for Rel 5. The Circuit-Switched Domain was already addressed by different regional specifications for 2G networks, and for 3G networks the Circuit-Switched Domain will be based on these documents and incorporated into Rel 6. HI1 (Administration) is not covered in this specification and is considered to be a matter of national regulation.

5. 3GPP Object Tree

6. IRI parameters observed MSISDN
Mapping between Events information and IRI information
IRI parameters
parameter
description
observed MSISDN
Target Identifier with the MSISDN of the target subscriber (monitored subscriber).
observed IMSI
Target Identifier with the IMSI of the target subscriber (monitored subscriber).
observed IMEI
Target Identifier with the IMEI of the target subscriber (monitored subscriber)
observed PDP address
PDP address used by the target..
event type
Description which type of event is delivered: PDP Context Activation, PDP Context Deactivation,GPRS Attach, etc.
event date
Date of the event generation in the xGSN
event time
Time of the event generation in the xGSN
access point name
The APN of the access point
PDP type
This field describes the PDP type as defined in TS GSM 09.60, TS GSM 04.08, TS GSM 09.02
initiator
This field indicates whether the PDP context activation, deactivation, or modification is MS directed or network initiated.
correlation number
Unique number for each PDP context delivered to the LEMF, to help the LEA, to have a correlation between each PDP Context and the IRI.

7. IRI parameters location information
When authorized, this field provides the location information of the target that is present at the SGSN at the time of event record production.
SMS
The SMS content with header which is sent with the SMS-service
failed context activation reason
This field gives information about the reason for a failed context activation of the target subscriber.
failed attach reason
This field gives information about the reason for a failed attach attempt of the target subscriber.
service center address
This field identifies the address of the relevant server within the calling (if server is originating) or called (if server is terminating) party address parameters for SMS-MO or SMS-MT.
umts QOS
This field indicates the Quality of Service associated with the PDP Context procedure.
context deactivation reason
This field gives information about the reason for context deactivation of the target subscriber.
network identifier
Operator ID plus SGSN or GGSN address.
iP assignment
Observed PDP address is statically or dynamically assigned.
SMS originating address
Identifies the originator of the SMS message.
SMS terminating address
Identifies the intended recipient of the SMS message.

8. IRI parameters SMS initiator
Indicates whether the SMS is MO, MT, or Undefined
serving SGSN number
An E.164 number of the serving SGSN.
serving SGSN address
An IP address of the serving SGSN.