LEMF SOFTWARE
ICS LEMF: Law Enforcement Monitoring Facility for Agencies and Operators
Receive, decode and analyze lawfully intercepted voice and IP data in one secure application. Operators use the Test LEMF edition to verify their own HI2 and HI3 deliveries.
A law enforcement monitoring facility (LEMF) is the system on the agency side of lawful interception. It receives, stores, decodes and analyzes the data that communication service providers (CSPs) deliver under a legal order. ICS LEMF is the LEMF software from ICS, available for agencies and as a Test LEMF for operators.
Datos clave
- Two editions: LEMF for agencies and Test LEMF for operators.
- Handover standards: ETSI TS 101 671, ETSI TS 102 232-1 to -7, 3GPP TS 33.108 and TS 33.128.
- Order and request channels: HI1 via ETSI TS 103 120 or written orders with fax and OCR; German ETSI-ESB and E-Mail-ESB for information requests.
- Deployment: on-premise, active/active across two sites, virtualized; air-gapped operation can be supported.
- Evidence integrity: digital signature on ingest, hashed exports, full audit trail, versioned re-decoding.
- Background: more than 20 years of ICS experience in lawful interception.
What does a law enforcement monitoring facility do?
In the ETSI and 3GPP reference model, the operator runs the administration function, the points of interception and the mediation function. The agency runs the LEMF. Three handover interfaces connect both sides: HI1 for warrant information, HI2 for intercept-related information (IRI) and HI3 for content of communication (CC).
The LEMF brings these streams together. It assigns every record to a case through its Lawful Interception Identifier (LIID) and shows it only to authorized users. For the basics, read HI1, HI2 and HI3 explained.
The job has grown. Agencies now receive data from mobile operators, MVNOs, ISPs, VoIP and OTT providers, and most of it is encrypted IP traffic. A modern law enforcement monitoring facility must manage providers and warrants at scale and turn IP data into evidence.
ICS LEMF modules
ICS LEMF is modular, so each agency activates the functions its investigations need.
01
CSP management
A provider registry with contacts, supported services, ETSI versions, endpoints and certificates. Onboarding tests and delivery quality monitoring flag sequence gaps, malformed records and unmatched IRI.
02
Warrant management
Case files, LIIDs, target identifiers and deadlines, with automatic reminders and the four-eyes principle. Interception orders go out via HI1 (ETSI TS 103 120) where the CSP supports it, otherwise in writing with fax templates and OCR. Information requests use ETSI-ESB or E-Mail-ESB.
03
Reception backend
Active/active reception of HI2 and HI3 around the clock, with local buffering and a digital signature on ingest. IRI and CC are correlated automatically, and ETSI TS 103 462 covers handover between LEMFs.
04
Decoding
Web sessions, e-mail (POP3, IMAP, SMTP), VoIP calls and file transfers are rebuilt as readable products. OCR and EXIF extraction make images and documents searchable.
05
Audio workbench
Playback with markers, loops, direction-separated channels, speed and pitch control and filters. Live monitoring, speech-to-text, speaker identification and an interpreter role are included.
06
IP analytics, geo and alerts
DPI classifies encrypted apps, while maps, timelines and entity graphs link people, devices and locations. Alerts fire on numbers, IP addresses, keywords, time windows and geofences. PCAP export to Wireshark and a decoder plugin API are included. Más información
How ICS LEMF handles a measure
Every interception follows the same controlled path, from court order to deletion.
1
Warrant intake
The case manager records the legal basis, targets, services and period.
2
Tasking
ICS LEMF assigns the LIID and sends the order to the CSP via HI1 or in writing.
3
Recepción
HI2 and HI3 deliveries are buffered and signed on arrival.
4
Correlation
IRI and CC are matched to the measure and checked for completeness.
5
Decoding
Readable traffic becomes products, and DPI classifies encrypted traffic.
6
Analysis
Analysts and interpreters work in timelines, maps, graphs and the audio workbench.
7
Export and deletion
Results leave as hashed exports, and deletion is documented.
Which standards does the law enforcement monitoring facility support?
ICS LEMF follows the ETSI and 3GPP handover standards used by European operators, plus the German national procedures.
| Standard | Scope |
|---|---|
| ETSI TS 101 671 | HI2/HI3 handover for circuit-switched services |
| ETSI TS 102 232-1 | Common framework for IP-based handover |
| ETSI TS 102 232-2 to -7 | Service-specific IP handover: e-mail, internet access, layer 2, IP multimedia, PSTN/ISDN services, mobile |
| 3GPP TS 33.108 | Handover for 3GPP networks up to 4G and IMS |
| 3GPP TS 33.128 | Handover for 5G networks |
| ETSI TS 103 120 | HI1: warrants, tasking and delivery instructions |
| ETSI TS 102 657 | Retained data handover, basis of the German ETSI-ESB |
| ETSI TS 103 462 | Handover of intercepted data between LEMFs |
| TR TKÜV (Germany) | National handover rules, ETSI-ESB and E-Mail-ESB |
The specifications are published by ETSI’s lawful interception committee and 3GPP.
Deployment options
ICS LEMF adapts to the security architecture of your agency.
01
On-premise in your data center
ICS LEMF runs on hardware in the agency’s own data center. All data stays under agency control.
02
Active/active across two sites
Two geographically separated sites receive and process data in parallel. If one site fails, the other continues, and local buffers protect incoming deliveries.
03
Virtualized
The software runs on the agency’s virtualization platform and scales horizontally as providers and measures grow.
04
Air-gapped operation
Air-gapped operation can be supported. ICS LEMF can run without an internet connection, and ICS agrees the update path for decoders and DPI signatures with the agency.
Security and evidence integrity
A LEMF produces evidence, so every step must be traceable in court.
- Signature on ingest: raw data is signed as soon as it is stored.
- Hashed exports and a complete audit trail of every access.
- Versioned re-decoding: when a decoder changes, earlier results and annotations stay visible.
- Privileged-content lock: recordings covered by an exclusionary rule can be flagged and locked.
- Role model: system administrator, LI administrator, case manager, analyst and interpreter, down to case level.
- Deletion workflows that document when and why data was removed.
LEMF for agencies and Test LEMF for operators
ICS LEMF comes in two editions with the same reception and decoding core. Agencies use the full law enforcement monitoring facility. Operators use the Test LEMF to check their own interception chain from the receiving end.
In Germany, operators must provide interception under § 170 TKG and the TKÜV, and the BNetzA checks their solution in an acceptance procedure. The Test LEMF shows whether HI2 and HI3 deliveries are complete and correctly formatted before and during acceptance. In daily operation, it runs end-to-end tests and raises alarms when deliveries fail or are malformed.
| Aspecto | LEMF for agencies | Test LEMF for operators |
|---|---|---|
| Users | Law enforcement agencies | MNOs, MVNOs, ISPs, VoIP and OTT providers |
| Purpose | Monitoring, analysis and evidence | Handover verification and LI chain testing |
| Input | HI1, HI2 and HI3 from many CSPs | The operator’s own HI2 and HI3 deliveries |
| Key functions | Warrants, decoding, audio, IP analytics, export | Format and completeness checks, end-to-end tests, alarms |
| When it is used | Continuous operation | Before and during BNetzA acceptance, then continuously |
¿Por qué ICS?
01
We know both sides of the handover
ICS runs lawful interception for operators every day, and that experience shapes how ICS LEMF validates deliveries.
02
Regulatory experience
ICS holds multiple BNetzA acceptances for interception solutions and knows the TKÜV and TR TKÜV in detail.
03
Equipo con autorización de seguridad
Nuestro personal cuenta con la autorización de seguridad del Ministerio Federal del Interior de Alemania y está habilitado para manejar información clasificada.
04
Open for your own modules
The decoder plugin API and our integration services let you add protocols and connect existing systems.
Preguntas frecuentes
What is a law enforcement monitoring facility?
A law enforcement monitoring facility (LEMF) is the agency-side system in lawful interception. It exchanges warrant information with communication service providers via HI1 and receives intercept-related information via HI2 and content via HI3. It stores, decodes and analyzes this data for authorized investigators, analysts and interpreters, and keeps a complete audit trail for court.
What is the difference between a LEMF and a LIMS?
A lawful interception management system (LIMS) runs on the operator side. It administers interception targets and controls the points of interception and the mediation function. The LEMF runs on the agency side and receives the results. Both are connected through the HI1, HI2 and HI3 handover interfaces, and ICS offers products for both sides.
Which handover standards does ICS LEMF support?
ICS LEMF supports ETSI TS 101 671 for circuit-switched services and ETSI TS 102 232 parts 1 to 7 for IP services. Mobile networks are covered by 3GPP TS 33.108 up to 4G and TS 33.128 for 5G. HI1 uses ETSI TS 103 120, and ETSI TS 103 462 covers handover between LEMFs.
What is the Test LEMF for operators?
The Test LEMF is an edition of ICS LEMF for network operators. It receives the operator’s own HI2 and HI3 deliveries and checks format and completeness before and during the BNetzA acceptance. In daily operation, it tests the interception chain end to end and raises alarms when deliveries fail or arrive malformed.
Can ICS LEMF analyze encrypted traffic?
ICS LEMF does not break end-to-end encryption. It decodes all traffic that is still readable and classifies encrypted traffic with deep packet inspection, TLS fingerprinting and traffic pattern analysis. Analysts see which application was used, when and how intensively. They can correlate this activity with locations, devices and other targets in the same case.
Can ICS LEMF run in an air-gapped network?
Air-gapped operation can be supported. ICS LEMF runs on-premise, in one data center or active/active across two sites, and can operate without an internet connection. ICS agrees with the agency how updates for decoders and DPI classifiers enter the secure environment. The agency keeps control over everything that is imported.
See ICS LEMF in action
Book a demo for your agency, or ask how the Test LEMF can verify your handover before the next acceptance.