E-EVIDENCE FOR TELCOS
e-Evidence for Telcos, Built on Your Lawful Interception Stack
Telecom operators are primary addressees of European production and preservation orders. ICS automates order handling and data extraction on the architecture you already use for lawful interception.
e-Evidence for telcos is the set of processes and systems a telecom operator uses to answer European production and preservation orders. These orders fall under Regulation (EU) 2023/1543, which has applied since 18 August 2026. ICS builds e-Evidence for telcos on the operator’s existing lawful interception architecture, so orders are validated, extracted and delivered on time.
Wichtige Fakten
- Primary addressees: telecom operators hold much of the data that investigators request.
- Fristen: EPOC innerhalb von 10 Tagen, in Notfällen innerhalb von 8 Stunden. Aufbewahrung von EPOC-PR für 60 Tage, verlängerbar um 30 Tage.
- Daten: subscriber records, access logs, traffic data and, in some cases, content.
- Telekommunikationsunternehmen außerhalb der EU: must appoint a legal representative in a participating Member State.
- Strafen: bis zu 2 % des weltweiten Jahresumsatzes.
- Deutschland: e-Evidence overlaps with the TKG, the TR TKÜV, planned TKG amendments and the EBewMG.
Why are telcos primary addressees of e-Evidence orders?
Almost every investigation touches a phone number, an IP address or a mobile device. Telecom operators hold the records that link those identifiers to people, places and times. That makes them the main addressees of European Production Order Certificates (EPOC) and European Preservation Order Certificates (EPOC-PR).
Typical requests cover four groups of data:
- Subscriber records: MSISDN, IMSI and SIM registration details
- Access logs: IP address allocations, cell connections and login timestamps
- Transactional and traffic data: CDRs, SMS metadata and data session logs
- Inhaltliche Daten: requested in some cases, under stricter conditions
For the legal background, read our e-Evidence guide und die e-Evidence FAQ.
Why is manual e-Evidence handling not viable for telcos?
An EPOC must be answered within 10 days. In emergencies, the deadline is 8 hours, including nights and weekends. A manual process with emails, spreadsheets and ad-hoc database queries cannot meet that reliably at scale.
The data also sits in many systems. Subscriber details live in CRM, allocations in IP address management, and session records in RADIUS or Diameter logs. Each manual lookup adds delay and the risk of disclosing too much or too little.
Finally, every step must be documented. Authorities and data protection officers expect a clear record of what was requested, checked and delivered. Workable e-Evidence for telcos therefore needs automation from intake to delivery.
e-Evidence for telcos: what the ICS platform provides
01
Built on your LI architecture
ICS extends your lawful interception setup. The LIMS und Mediationsplattform already know your topology, data sources and provisioning.
02
Automated data extraction
Connectors pull the requested data from CRM, provisioning, CDR repositories, RADIUS and Diameter logs and IP address management.
03
Delivery through the exchange channel
Responses are returned through the e-Evidence exchange channel, including the decentralized IT system based on e-CODEX where applicable.
04
Order validation and deadlines
Each order is registered, checked for formal requirements and tracked against its 10-day or 8-hour deadline. Mehr erfahren
05
24/7 managed e-Evidence operations
ICS can operate the process around the clock as an extension of Managed LI Operations.
06
Legal representative for non-EU telcos
ICS supports notification, order reception and initial validation for telcos without an EU establishment. Mehr erfahren
How does ICS set up e-Evidence for telcos?
1
Map data sources
We identify where subscriber, access and traffic data is stored and who owns each system.
2
Reuse the LI layer
We connect the e-Evidence workflow to your existing LIMS and mediation components.
3
Define extraction rules
We set up queries per data category, so each order returns only what it requests.
4
Automate intake
Incoming EPOC and EPOC-PR orders are registered with their deadlines and routed automatically.
5
Review and deliver
Your team or ICS approves the result, and the response is sent through the secure channel.
6
Operate and audit
Every step is logged, and ICS can run the process 24/7 on your behalf.
How does e-Evidence for telcos overlap with German regulation?
In Germany, e-Evidence is one of several disclosure duties for telcos. Operators already handle interception under §§ 170 ff. TKG, the TKÜV and the TR TKÜV. They answer subscriber data requests under § 174 TKG.
The planned rules on quick freeze and IP address retention (§§ 176, 177 TKG-E, BT-Drs. 21/6581) are still in the parliamentary process. On top of that, the EBewMG implements the e-Evidence framework in German law.
Each duty uses similar data sources but different formats, deadlines and authorities. ICS covers them on one platform with one documentation approach. That reduces duplicate integrations and keeps audits consistent. Data retention and quick freeze
Which disclosure duties does a German telco face?
The table compares the main duties and the ICS component that supports each one.
| Duty | Rechtsgrundlage | Typical request | ICS component |
|---|---|---|---|
| Lawful interception | § 170 TKG, TKÜV, TR TKÜV | Real-time IRI and CC | LIMS and LI mediation |
| Subscriber data requests | § 174 TKG | Subscriber records | Usage and subscriber data module |
| Quick freeze and IP address retention (planned) | §§ 176, 177 TKG-E | Preservation, IP-to-subscriber lookup | Data retention solution |
| Cross-border evidence orders | Regulation (EU) 2023/1543, EBewMG | EPOC and EPOC-PR | e-Evidence Compliance Plattform |
Do non-EU telcos need a legal representative?
Yes. MVNOs, transit carriers and global telecom groups without an EU establishment must appoint a legal representative if they offer services in the Union. The representative must sit in a participating Member State and be notified to the competent authority.
ICS supports these telcos with notification, order reception and initial validation. Complex cases are routed to your legal team for a decision. Rechtsvertreter und benannte Stelle
Warum ICS?
01
LI experts first
ICS has more than 20 years of experience in telecommunications and lawful interception. We know how operator networks store and deliver data.
02
Mehrere Genehmigungen der BNetzA
Our interception solutions have passed multiple BNetzA acceptance procedures. The same engineering discipline applies to e-Evidence.
03
Team mit Sicherheitsfreigabe
Our staff is security-cleared by the German Federal Ministry of the Interior and may handle classified information.
04
One platform, many duties
Interception, subscriber data, data retention and e-Evidence share one architecture and one audit approach.
Häufig gestellte Fragen
Does the e-Evidence Regulation already apply to telcos?
Yes. Regulation (EU) 2023/1543 has applied since 18 August 2026. Telecom operators that offer electronic communication services in the EU are in scope. They must be able to receive European Production and Preservation Orders, answer them within the deadlines and document each step. Operators without a working process should close that gap now, because orders can arrive at any time.
What data do authorities typically request from telcos?
Requests usually cover subscriber records such as MSISDN, IMSI and SIM registration details. Access logs with IP address allocations, cell connections and login timestamps are also common. Traffic data includes CDRs, SMS metadata and data session logs. In some cases, authorities also request content data. Each order names the data categories it needs, and the response should not go beyond them.
How does ICS use the existing LI setup for e-Evidence?
The ICS LIMS and mediation platform already know the network topology, data sources and provisioning processes. ICS builds e-Evidence for telcos on that foundation. Connectors extract data from CRM, provisioning, CDR repositories, RADIUS and Diameter logs and IP address management. This avoids a second, separate integration project and keeps security controls consistent.
Can ICS handle e-Evidence orders around the clock?
Yes. ICS offers 24/7 managed e-Evidence operations as an extension of its Managed LI Operations. Security-cleared staff receive orders, check formal requirements and start standard data extraction. Complex or unusual cases are escalated to the operator’s legal team. This setup helps operators meet the 8-hour emergency deadline without building their own round-the-clock team.
How does e-Evidence relate to German data retention plans?
They are separate legal instruments. e-Evidence covers cross-border orders under EU law and the German EBewMG. The planned quick freeze and IP address retention rules (§§ 176, 177 TKG-E, BT-Drs. 21/6581) are still in the parliamentary process. Both rely on similar data sources, so ICS supports them on one platform with shared connectors and documentation.
Do MVNOs and transit carriers outside the EU need to act?
Yes, if they offer services in the Union. Providers without an EU establishment must appoint a legal representative in a participating Member State and notify it to the competent authority. ICS supports MVNOs, transit carriers and global telecom groups with notification, order reception and initial validation, and routes complex cases to their legal teams.
Turn e-Evidence into a routine process
We show how your existing LI setup can answer EPOC and EPOC-PR orders within the legal deadlines.