Content of Communication

Description

Content of Communication (CC) is a fundamental concept in lawful interception (LI) within 3GPP networks. It refers to the actual information exchanged between two or more users of a telecommunications service, explicitly excluding Intercept Related Information (IRI), which covers signalling and control data. CC includes any user-generated or user-consumed data such as voice calls, SMS, MMS, email, file transfers, and multimedia streams. It also encompasses information stored by one user for later retrieval by another, such as voicemail or stored messages. The definition is standardized in 3GPP TS 33.106 (Lawful Interception requirements) and TS 33.108 (Handover interface for Lawful Interception).

In the architecture of lawful interception, the Content of Communication is captured at the Intercepting Control Element (ICE) or at a separate Content of Communication Interception Function (CCIF). The ICE, such as a Serving GPRS Support Node (SGSN), Gateway GPRS Support Node (GGSN), or Mobility Management Entity (MME), duplicates the CC and delivers it to the Law Enforcement Monitoring Facility (LEMF) via the Handover Interface (HI). The delivery is typically done using the HI2 interface for CC, while HI1 is used for IRI. The CC is encapsulated in a standardized format, often using the Intercept Related Information (IRI) and Content of Communication (CC) protocols defined in TS 33.108. The CC may be encrypted or unencrypted depending on the service and the interception configuration.

The separation of CC and IRI is crucial for legal and technical reasons. IRI provides the context—who, when, where, and how—while CC provides the actual content. Lawful interception systems must ensure that only authorized personnel access CC, and that it is handled with strict privacy safeguards. The CC is usually delivered in near real-time, but for some services like store-and-forward messaging, it may be delivered upon retrieval. The 3GPP specifications define the requirements for CC interception, including the need for the network to provide the CC without altering it, and to ensure that interception is transparent to the users.

Over the releases, the definition of CC has remained stable, reflecting its fundamental nature. However, the implementation has evolved to handle new services such as VoLTE, VoWiFi, rich communication services (RCS), and IoT data. The specifications have been updated to address new network architectures like 5G, where the Intercepting Control Elements may be virtualized or distributed. The CC interception in 5G is handled by the Lawful Interception functions within the 5G core network, such as the AMF, SMF, and UPF, with the CC being intercepted at the UPF for user plane data.

The importance of CC lies in its role in law enforcement and national security. It allows authorized agencies to monitor the actual communications of targets under legal warrant, while IRI provides the metadata. The 3GPP standards ensure that LI capabilities are built into the network from the start, with standardized interfaces for handover to LEMFs. This enables interoperability between different vendors and ensures that lawful interception can be performed efficiently and securely. The definition of CC is intentionally broad to cover all forms of user communication, ensuring that no service escapes interception capabilities.

Purpose & Motivation

The concept of Content of Communication exists to clearly delineate the actual user data from the signalling and control information in lawful interception. This separation is essential for legal frameworks that distinguish between the interception of content (which requires a higher level of authorization) and the interception of metadata (which may be subject to different legal thresholds). By defining CC precisely, 3GPP ensures that law enforcement agencies can obtain the necessary information while respecting privacy and legal boundaries.

Historically, as telecommunications networks evolved from circuit-switched to packet-switched and now to all-IP, the need to intercept new types of content (e.g., VoIP, messaging, streaming) became apparent. The definition of CC was crafted to be technology-agnostic, covering any information exchanged between users, including stored content. This allows the standards to remain relevant across generations. The separation of CC and IRI also simplifies the architecture: IRI can be intercepted at control plane elements, while CC is intercepted at user plane elements, allowing for efficient scaling and deployment.

The motivation for a standardized definition is to ensure consistent implementation across vendors and networks. Without a clear definition, there could be ambiguity about what constitutes content versus metadata, leading to legal challenges and technical incompatibilities. The 3GPP definition provides a common language for regulators, operators, and manufacturers, facilitating global interoperability of lawful interception systems.