As lawful interception has moved from paper warrants and fax to automated, auditable workflows, the standards governing the administrative side of interception have had to evolve as well. ETSI TS 103 120 defines the electronic interface over which authorities and operators exchange warrants, interception tasks, data requests and status notifications: the electronic form of HI1. For operators, system integrators and LI solution vendors, understanding TS 103 120 is essential to building warrant-management systems that are standards-compliant and interoperable with the authorities’ systems.
This article provides a practical examination of ETSI TS 103 120, covering its scope, its relationship to the ETSI TS 102 232 delivery standards, the key concepts it defines, and its practical implications for operators. Whether you are building a new LI capability from scratch or automating an existing manual HI1 process, TS 103 120 is a specification you need to understand thoroughly.
מה מכסה תקן ETSI TS 103 120
ETSI TS 103 120 (titled “Lawful Interception (LI); Interface for warrant information”, currently at V1.24.1, 2026-08) sits within the broader family of ETSI LI standards and covers the administrative side of lawful interception and disclosure: how an authority sends an authorisation and its tasks to an operator, how the operator acknowledges, activates and reports status, and how the order is changed or ended. Delivery of IRI and CC to the LEMF is defined elsewhere (ETSI TS 102 232 series, 3GPP TS 33.128). The specification states explicitly that it is designed for HI-1 and not for HI-2 or HI-3.
TS 103 120 and the TS 102 232 series are complementary: TS 103 120 carries the order (target, LIID, delivery address, handover format), and TS 102 232 defines how the resulting IRI and CC are delivered. TS 103 120 was created to replace paper, fax and proprietary portals for warrant exchange with a standard, machine-readable eWarrant interface (first published in 2015/16 and updated regularly since).
TS 103 120 is not limited to interception: it also carries requests for retained or stored data and preservation orders. The EU e-Evidence specification ETSI TS 104 144 is built as a TS 103 120 workflow profile.
שלושת ממשקי ההעברה
The ETSI reference model has three handover interfaces: HI1 (administration), HI2 (IRI) and HI3 (content). TS 103 120 standardises only HI1.
HI1 is the administrative interface, used for the exchange of interception orders, activation instructions and status information between the law enforcement agency and the operator. HI1 can still be a manual process in many countries, but TS 103 120 defines HI1 in detail: a message format with actions (CREATE, UPDATE, GET, LIST, DELIVER), objects for the authorisation, its documents, the individual tasks and notifications, XML or JSON encoding, and HTTPS transport with mutual certificate authentication. National profiles add country-specific fields.
HI2 is the interface for delivering intercept-related information — the metadata associated with intercepted communications, such as the identities of the communicating parties, timestamps, network identifiers and session parameters. IRI is delivered over HI2 using ASN.1 structures defined in the ETSI TS 102 232 series (or 3GPP TS 33.108/33.128 for mobile networks).
HI3 is the interface for delivering the content of communications — the actual voice, data or messaging content being intercepted. Content is delivered over HI3 in PS-PDUs defined by ETSI TS 102 232-1, with service-specific formats such as TS 102 232-5 for VoIP; correlation numbers and sequence numbers tie the streams of one call together.
מושגים טכניים מרכזיים
Key concepts in TS 103 120 are the HI-1 objects (an Authorisation object for the legal instrument, Document objects for the signed warrant, Task objects for each target or data request, Notification objects for status), the generic actions that create and update them, and dictionaries that let each country add its own values without changing the schema.
TS 103 120 messages are encoded in XML or JSON, validated against ETSI-published schemas. ASN.1 is used on HI2/HI3 (TS 102 232), not on HI1.
TS 103 120 requires HTTPS with mutual certificate authentication for the HI1 exchange and leaves cryptographic details to national profiles. HI2/HI3 security is defined separately in ETSI TS 102 232-1 (VPN or TLS).
Multi-stream sessions are likewise outside TS 103 120: for a VoIP call, for example, ETSI TS 102 232-1 and -5 (or, for VoLTE, 3GPP TS 33.108 and TS 33.128) define how the SIP and RTP streams of one call are correlated on HI2/HI3.
הקשר לתקן ETSI TS 102 232
The ETSI TS 102 232 series is the cornerstone of the ETSI LI handover architecture. It defines the general framework, data structures and procedures for the handover of intercepted material, organised into several parts covering different network technologies and service types.
TS 102 232 defines the complete IP handover of IRI and content, including transport. TS 103 120 automates the order side (HI1). Many countries still use manual HI1 alongside TS 102 232 delivery, but 3GPP requires 5G networks to support TS 103 120 (TS 33.128 cl. 5.4.1). Operators should also be aware of related standards in the TS 102 232 series that address specific network technologies, such as TS 102 232-5 for IP multimedia services and TS 102 232-6 for PSTN/ISDN services.
השלכות מעשיות עבור המפעילים
The first practical implication is on the operator’s warrant-management system (ADMF/LIMS): it must accept TS 103 120 orders, validate them, map each LI task to internal provisioning, and return status notifications. This requires ongoing maintenance as the specification and the national profiles evolve.
The second implication is the need for interoperability testing with the authorities’ warrant systems, covering the workflow profiles and national dictionaries in use. This typically involves formal testing against a set of reference scenarios, covering different order types, target identification methods and edge cases such as modifications, extensions and early termination.
The third implication is indirect: an automated HI1 makes it faster to start many interceptions at once, so the delivery side (TS 102 232) must be dimensioned for the resulting load. IP networks can generate significantly more data per intercepted session than circuit-switched networks, particularly for data interception. Operators must ensure that their LI systems can handle the throughput requirements without introducing latency or data loss; delivery buffering and keep-alives are defined in ETSI TS 102 232-1, and operators must dimension their infrastructure appropriately.
A fourth practical consideration is the management of encryption. As more network traffic is encrypted, operators must implement their interception points at locations in the network where the target’s traffic is accessible in clear text. Content encryption is outside TS 103 120. The operator’s obligation to remove encryption it provides or manages, or to supply keys, comes from the LI requirements (e.g. 3GPP TS 33.126).
התפתחות וכיוונים עתידיים
TS 103 120 continues to evolve as network technologies and legal instruments advance. ETSI’s Technical Committee on Lawful Interception (TC LI) publishes new versions regularly, and operators should monitor the evolution of TS 103 120 and related standards to ensure that their systems remain compliant as new versions are published.
In 5G, 3GPP TS 33.128 adopts TS 103 120 directly as the LI_HI1 protocol, so the same warrant interface serves 4G, 5G and fixed networks. The 5G-specific LI architecture (X1, X2, X3 and the new network functions) concerns the operator-internal and delivery side and complements, rather than replaces, the TS 103 120 warrant interface.
סיכום
TS 103 120 defines how warrants and their tasks are exchanged electronically between authorities and operators. Combined with TS 102 232 (or 3GPP TS 33.128) for delivery, it enables end-to-end automated, standards-based lawful interception. For operators, understanding and implementing TS 103 120 is essential to automating HI1 in a way that is interoperable with the authorities and future-proof across 4G, 5G and fixed networks.
מאמרים קשורים
לקריאה נוספת בנושאים קשורים, עיין במאמרים הבאים:
- HI1 לעומת HI2 לעומת HI3: הבנת שלושת ממשקי היירוט החוקיים
- SIPREC לעומת ETSI LI: מה ההבדל ומתי כל אחד מהם חל?
- כיצד פועלת פונקציית הגישור: הגשר בין הרשת שלכם לבין רשויות אכיפת החוק
משאבים חיצוניים
המשאבים החיצוניים הבאים מספקים מידע רקע נוסף ומסמכים רשמיים:
