Lawful access, explained.
Two words that get used for everything from a wiretap to a records request to the encryption debate. For a carrier they come down to one question, asked two ways: when valid legal process names a subscriber, can the network produce exactly what it names — and nothing else?
Real time, or already recorded.
Every request a carrier receives is one of two things. Either it asks the network to capture a named subscriber's communications as they happen, or it asks for records the carrier already holds. The law, the process, the technology and the people involved are different for each — and a carrier is expected to handle both.
Lawful intercept
A court authorizes monitoring of one subscriber's communications in real time — the numbers and addresses under a pen-register or trap-and-trace order, or the content itself under a Title III order. The network isolates that subscriber's traffic, converts it to the standard the agency requires, delivers it for the life of the order, and stops. This is the capability CALEA requires a carrier to have ready.
Records production
Legal process asks for what the carrier already has: subscriber information, call detail records, IP assignment logs, stored content. The Stored Communications Act sets tiers of process — a subpoena, a § 2703(d) order, a warrant — that reach progressively more. The work is verifying the process, producing exactly what it names, authenticating it, and keeping the chain of custody intact.
The chain between the switch and the agency.
An intercept is not a feature that gets switched on. It is a sequence of components, each of which has to work — and be shown to have worked — every time.
Validate the order
Authority, scope, target identifiers, dates. An order with an error is returned for correction before anything is provisioned.
Provision the target
The access function is set against the named subscriber only — actively on the network element, or passively on a mirror port.
Mediate to standard
Captured traffic is converted into the delivery standard the order requires and handed off over a secured connection to the agency it names.
Log, terminate, keep
Every action is recorded. The intercept ends on the order's date. The record is what answers questions later — at a hearing, an audit, or a deposition.
The equipment a network already has usually supplies the first of those steps and none of the others. That gap — provisioning, mediation, delivery, the watch, the record — is what a Trusted Third Party exists to close. See how each component works →
The part that gets underestimated.
Carriers plan for the intercept and the records pull. What they rarely plan for is the record of the intercept and the records pull: which order authorized it, what it named, when it was valid, who did each step, when it was terminated or returned. That record is warrant management, and it is the difference between a response that was correct and a response that can be shown to have been correct. It is built into Subsentio's records production and into every intercept Subsentio runs.
Lawful access, answered.
What does "lawful access" mean?
A government's ability, with valid legal process, to obtain a person's communications or the records around them from the provider that carries them. It covers real-time interception under a court order (lawful intercept) and the production of stored records under a subpoena, court order or warrant (records production). The word that matters is lawful: access only against the process the law provides, only for what the process names.
Is lawful access the same as lawful intercept?
Lawful intercept is one kind of lawful access — the real-time kind. A pen-register order or a Title III order authorizes interception of a named subscriber's communications as they happen. Records production is the other kind: producing records the provider already holds. Most carriers receive far more requests for records than for intercepts.
What is "communication interception" on a network?
Copying a named target's traffic — the signaling around it, or the content itself, depending on the order — as it crosses the network, converting it to the delivery standard the order requires, and delivering it to the authorized agency, without touching any other subscriber. The technical chain is the access function, mediation, and standardized delivery; CALEA requires a carrier to have that chain ready before an order arrives.
What is interception software, and does my switch already have it?
Most network equipment ships with lawful-intercept features. On their own they rarely make a network compliant: the features still have to be provisioned against a specific target, mediated into the standard the agency requires, delivered over a secured connection, logged, and switched off on time. That surrounding capability — and the people who run it on a 24-hour watch — is what a Trusted Third Party provides.
What is a warrant management system?
The record of every piece of legal process from receipt to closure: what authority it carries, what it names, its valid dates, what was provisioned or produced, who did each step, and when it ended. It is what lets a carrier answer, months later, exactly what was done under an order and why. At Subsentio it is part of records production and part of every intercept.
Does lawful access require a carrier to break encryption?
CALEA requires a carrier to deliver the communications and call-identifying information the network carries; it does not require a carrier to decrypt what a subscriber encrypted with a key the carrier never had. Proposals to change that — the Lawful Access to Encrypted Data Act introduced in 2020 is the best-known — have been debated in Congress; their status changes with each session, so check the current position before relying on any of them.
Bring us the order.
Whether it is an intercept order, a subpoena, a preservation letter or an exigent request, there is a desk at Subsentio that handles that exact thing, on a 24-hour watch.