Interception Configuration Information

Description

Interception Configuration Information (ICI) is a critical component of the 3GPP Lawful Interception (LI) architecture, defined across multiple technical specifications. It represents the structured data that an authorized entity (typically a Law Enforcement Agency via a Lawful Interception Authority) provides to the network operator's Intercepting Control Element (ICE) to activate, modify, or deactivate an interception order. The ICI is essentially the 'warrant' in machine-readable format, containing all necessary instructions for the network to execute the interception legally and correctly.

The ICI is composed of several key information elements. Primarily, it includes the Target Identifier, which uniquely specifies the subscriber (e.g., IMSI, MSISDN) or service to be monitored. It defines the Interception Scope, specifying which types of communications are to be intercepted—such as Circuit-Switched voice calls, Packet-Switched data sessions, SMS, or IMS sessions. Furthermore, it contains the Interception Action, indicating whether to activate, deactivate, or modify an existing interception. Crucially, it provides Delivery Parameters, which detail the address (IP address and port) of the Law Enforcement Monitoring Facility (LEMF) where the intercepted content (CC) and intercept-related information (IRI) must be securely delivered.

From an architectural perspective, the ICI is received by the Administration Function (ADMF) or directly by the relevant ICEs (e.g., in the Core Network or Access Network). The ADMF validates the ICI and distributes the appropriate configuration commands to the network elements involved in the interception (e.g., MSC, SGSN, PGW, PCF). These elements then use the parameters within the ICI to identify the target's traffic, duplicate the relevant packets or signaling messages, and forward them to the designated Delivery Function (DF), which formats and sends the data to the LEMF. The ICI ensures that the interception is precisely scoped, avoiding over-collection, and that the delivery mechanism meets the required security and reliability standards. Its standardized format allows for interoperability between different network vendors and law enforcement systems.

Purpose & Motivation

ICI was created to address the critical need for a standardized, secure, and reliable method to configure lawful interception across complex, multi-vendor 3GPP networks. As telecommunications became digital and mobile, law enforcement agencies required a technically robust means to execute legal interception orders. Prior to standardization, interception mechanisms were often proprietary, country-specific, and inconsistent, making it difficult for operators to comply with legal mandates efficiently and for agencies to handle intercepted data from different networks.

The primary problem ICI solves is the translation of a legal warrant (a human-readable document) into a precise set of technical instructions that automated network equipment can understand and execute. It defines a common language between the legal world and the network world. This standardization ensures that an interception request means the same thing in Sweden as it does in South Korea, provided both follow 3GPP specs. It prevents ambiguity in defining the target, the scope of interception, and the delivery method.

Its creation was driven by legal requirements for telecommunications interception in many jurisdictions, combined with the globalization of network equipment. A standardized ICI allows network vendors to build LI capabilities into their products that will work anywhere, reduces the cost and complexity for operators to comply with local laws, and provides law enforcement with a predictable and secure interface. It balances the need for effective law enforcement with the principles of privacy and data minimization by requiring explicit configuration for each interception action.

Key Features

• Uniquely identifies the interception target using subscriber or service identifiers (e.g., IMSI, MSISDN)
• Defines the precise scope of interception (e.g., voice calls only, all packet data, SMS)
• Specifies the action: activation, deactivation, or modification of an interception order
• Contains the delivery address (IP/Port) for the Law Enforcement Monitoring Facility (LEMF)
• Provides a standardized, machine-readable format for interception warrants
• Ensures configuration is distributed securely and accurately to all relevant network elements (ICE)

Evolution Across Releases

Defining Specifications