The anatomy of a lawful intercept.
A CALEA solution isn’t one box — it’s a chain of components that must provision a target, capture the right traffic, mediate it into a standardized format, and deliver it to an authorized agency without ever touching an innocent subscriber. Here’s how each piece of Subsentio’s lawful intercept system works.
One discipline, every network type.
Subsentio’s lawful intercept technology deploys across the network types carriers actually run — in either an active configuration (the mediation server talks directly to the network element) or a passive one (a passive monitor watches a TAP or SPAN mirror port). Both end the same way: a standardized stream in the Subsentio NOC, routed to the agency named in the order.
Circuit-switched
Legacy time-division-multiplexing environments. The access function provisions the target and intercepts call-data and call-content — content is sometimes handled independently via a dial-out function. Targeted traffic is routed to the Subsentio NOC over a secure VPN tunnel, converted to a standardized LI format, and delivered to the agency’s collection tunnel.
Voice over IP (VoIP)
Deployed active or passive. Active: the access function provisions the target and delivers a data stream of CII/CC to the mediation server. Passive: a passive monitor watches signaling and audio on a TAP/SPAN port, filters the target’s traffic once identified, and mediates it into a standardized stream to the NOC.
ISP / broadband
Active or passive. Active: the access function delivers the data streams to the mediation server for CmII/CmC delivery. Passive: a passive monitor watches authentication and IP traffic on a TAP/SPAN port, captures the identified target, and mediates a standardized LI stream to the NOC for delivery to the LEA.
Mobile packet-data
Active or passive. The access function provisions the target and delivers the data streams to the mediation server; in passive mode a passive monitor watches authentication and IP traffic on a TAP/SPAN port, then filters and mediates the target’s streams into a standardized LI format bound for the NOC.
What sits between the switch and the agency.
Every accurate intercept passes through the same functional components — properly implemented and able to speak to the network elements around them.
Access function
Provisions the target on the network element and taps call-data and call-content — actively via protocol, or passively via probe on a mirror port.
Mediation & delivery server
Three jobs: target/provisioning, session collection, and standardized delivery — converting intercepted traffic into the lawful delivery standard for the agency.
Provisioning administration
A unified interface to administer different network and target types — over SSH, HTTPS, the X1 interface, or a vendor mechanism.
Provisioning database
Stores configuration, target criteria, user records and activity logs — encrypted in flight and at rest on an industry-standard database.
Subsentio NOC
Receives targeted traffic over a site-to-site IPSec VPN, formats it to standard, and hands it to the agency’s collection tunnel.
LEA collection servers
The agency-side clients that decode, display and record the delivered stream — used by the FBI, DEA, Secret Service, US Marshals, DHS and others.
Standardized delivery, end-to-end encrypted.
The mediation server delivers call-data and call-content to the agency’s collection server in a protocol designed specifically for lawful interception. Transport is a TCP/IP (sometimes UDP/IP) socket from the Subsentio NOC to the LEA collection point.
Every connection — carrier to Subsentio, and Subsentio to agency — is a site-to-site IPSec VPN. Sessions are encapsulated by the IPSec Encapsulating Security Payload (ESP), which provides confidentiality, data-origin authentication and integrity between the VPN endpoints, with matched Phase-1/Phase-2 IPSec and ISAKMP parameters and encryption domains.
Built to the safe-harbor standards
Conform to the standard for your network type and CALEA §107 deems you compliant.
The technology, answered.
How does lawful intercept work?
In a chain. A valid order names a subscriber. The access function isolates that subscriber's traffic on the network element that carries it — actively, by provisioning the element, or passively, on a mirror of the traffic. The mediation function converts what was captured into the delivery standard the agency requires and hands it over a secured connection to the agency's collection system. Every step is logged, and the intercept ends on the order's date. That is how lawful intercept works on every network type; only the access point changes.
What is a lawful intercept system?
The set of components above, working together: access function, mediation and delivery, provisioning administration, the provisioning database and the secured delivery path — plus the people and procedures that operate them. A lawful intercept system is only compliant when the whole chain delivers what an agency can read; a single component is not a system.
What is a lawful intercept gateway (LI gateway) or LI platform?
Vendor and industry names for the mediation and delivery function: the component that receives captured traffic from the network, converts it into the handover standard (ATIS in the United States, ETSI elsewhere) and delivers it to the agency. An "LI platform" usually bundles the gateway with provisioning and administration. Whatever the name, it is the part of the chain that must speak the agency's standard exactly.
Is lawful intercept software enough on its own?
No. Most network elements ship with lawful intercept software or features, and most of those features have never been provisioned against a real target, mediated into an agency's standard, delivered over a secured connection or tested against a collection system. Lawful intercept technology is the starting point; the surrounding capability and the 24-hour operation of it are what compliance actually consists of.
What are the FCC's lawful intercept requirements?
The FCC lawful intercept rules implement CALEA through 47 CFR Part 1, Subpart Z: a carrier's intercepts may be activated only under lawful authorization and with the affirmative intervention of its own personnel (§ 1.20003), records of every interception must be kept (§ 1.20004), and the policies — the system security and integrity plan — must be filed with the Commission before commencing service (§ 1.20005). The capability itself is measured against the industry standards CALEA § 107 recognizes.
What is the ATIS lawful intercept standard?
ATIS — the Alliance for Telecommunications Industry Solutions — publishes the standards a U.S. intercept is delivered to — one for each network type: circuit-switched and wireless, interconnected VoIP, broadband Internet access, and the reporting between delivery and collection. Each is revised over time. Building to the current applicable ATIS standard is the CALEA § 107 safe harbor; delivering to it is what lets an agency's collection system read the intercept.
Do I need a lawful intercept vendor, or a Trusted Third Party?
A vendor sells the technology. A Trusted Third Party operates the obligation — validation, provisioning, delivery, the record, the watch — using technology engineered to your network. Most carriers need the second; the first is a component of it. The FCC's 2006 order expressly permits the TTP arrangement, and the carrier remains responsible for compliance either way.
Need a lawful intercept solution for your network?
We operate every component above as a trusted third party — so your team never has to. Tell us your network type and we’ll map the fit.