Handover Interface Port 3

Description

Handover Interface Port 3 (HI3) is a fundamental interface within the 3GPP lawful interception framework, specified in 33.108. It is dedicated to the delivery of the Content of Communication (CC), which constitutes the actual payload of a monitored subscriber's communication. This includes voice call audio in circuit-switched networks, VoIP packets in IMS, and user plane data packets (e.g., from web browsing, messaging) in packet-switched domains. The HI3 interface connects the network operator's Mediation Function (MF) or Delivery Function (DF) to the Law Enforcement Monitoring Facility (LEMF). Its sole purpose is to transport a duplicate of the target's communication content, ensuring it is delivered reliably, securely, and in sync with the associated metadata delivered via the HI2 interface.

Operationally, when a lawful interception warrant is active for a target, the network nodes (e.g., MSC for voice, SGSN/GGSN/UPF for data) are instructed to copy the relevant user plane traffic. This copied content is sent to the Mediation Function, which formats and packages it for delivery. For voice, this typically involves delivering Real-time Transport Protocol (RTP) streams or encoded audio frames. For packet data, it involves delivering IP packets or structured data records. The HI3 specification defines the transport mechanisms and packet formats for this content. Like HI2, it often relies on standardized protocols to ensure interoperability, though the content itself may be in its native codec or packet format. The interface must handle real-time streams for voice interception and potentially high-volume data flows for broadband data interception, requiring robust bandwidth and low-latency connections to the LEMF.

The HI3 interface works in strict coordination with HI2. The IRI delivered on HI2 provides the context—signaling when a call starts or an IP session begins—that allows the LEMF to correlate and correctly interpret the content streams received on HI3. This separation allows for efficient network design and targeted data delivery. Security measures for HI3 are extremely stringent, as it carries the most sensitive intercepted data. Transmission is always over highly secure, often physically separate, networks with strong encryption to guarantee confidentiality and integrity. The architecture ensures that content is delivered without degradation or alteration, maintaining its evidential quality. For modern services, HI3 delivery mechanisms have evolved to handle diverse content types, including IMS-based voice and video, SMS over IP, and data sessions from 5G network slices, demonstrating its adaptable role in the lawful interception ecosystem.

Purpose & Motivation

HI3 was standardized to provide a uniform method for network operators to deliver the actual content of intercepted communications to law enforcement agencies. Before 3GPP standardization, the delivery of call content was handled through various proprietary and country-specific mechanisms, which complicated lawful interception operations, especially for law enforcement dealing with multiple service providers. The lack of a standard risked incomplete interception, loss of evidence, and high integration costs for monitoring centers. HI3, introduced alongside HI2 in Release 8, created a consistent, reliable pipeline for communication content.

The purpose of HI3 is directly tied to fulfilling the technical requirements of lawful interception laws, which mandate the ability to intercept both signaling information and communication content. While metadata from HI2 reveals communication patterns, the content from HI3 is often the critical evidence in an investigation. The interface solves the technical challenge of duplicating and diverting real-time media streams and data flows from within the complex architecture of 3GPP networks (from 2G/3G circuit switching to 4G/5G all-IP networks) and delivering them externally without impacting the quality of service for the target or other users. Its creation was motivated by the need for a future-proof, technology-agnostic content delivery method that could evolve with network technologies, from traditional voice calls to VoIP and high-speed internet data.