Law enforcement interest in IoT data is growing as connected devices proliferate across networks. The Internet of Things (IoT) is transforming industries from logistics and agriculture to healthcare and smart cities. Billions of connected devices now communicate over cellular and non-cellular networks, generating vast quantities of machine-to-machine (M2M) data. For telecommunications operators — particularly those providing Low Power Wide Area Network (LPWAN) connectivity and M2M services — this growth brings not only commercial opportunity but also expanding regulatory obligations, including lawful interception.
The application of lawful interception obligations to IoT and M2M communications is a developing area of regulation, but the direction of travel is clear: as IoT traffic grows and becomes more relevant to criminal investigations, law enforcement interest in IoT data is growing, and operators should expect more requests for data, mainly for subscriber, location and traffic data rather than live content. This article examines the current state of LI obligations for IoT operators, the technical challenges involved, and the steps operators should take to prepare.
사물인터넷(IoT) 합법적 감청이 중요한 이유
The question of whether IoT and M2M communications fall within the scope of lawful interception obligations is primarily a legal one, and the answer varies by jurisdiction. In the European Union, the obligation to support lawful interception generally applies to providers of electronic communications services that are available to the public. Under the EU Electronic Communications Code, transmission services used for machine-to-machine communication are electronic communications services (Art. 2(4)(c) EECC). Whether they carry LI obligations depends on whether they are offered to the public and on national law, which sets the LI conditions and any exemptions.
In Germany, § 170 TKG and the TKÜV (Telekommunikations-Überwachungsverordnung) require operators of networks used for publicly available telecommunications services to provide interception capability, and M2M transmission services count as telecommunications services (§ 3 No. 61(c) TKG). The TKÜV exempts some systems from having to install interception facilities, for example systems used only to transmit measurement data (§ 3(2) No. 4 TKÜV) or systems with no more than 10,000 users (§ 3(2) No. 5). Whether an IoT offering is exempt therefore depends on what it carries, not on the label ‘IoT’. In other EU member states the details differ.
Even an operator that is exempt from installing interception facilities must cooperate with an individual order (in Germany, § 100a(4) StPO). It should therefore know how it would carry out an order on its IoT platform, even where no permanent LI system is required.
법 집행에 있어 IoT 데이터가 중요한 이유
IoT 기기는 범죄 수사와 깊은 관련이 있을 수 있는 데이터를 생성합니다. 커넥티드 차량은 위치 데이터, 주행 패턴, 통신 로그를 생성합니다. 스마트 홈 기기는 환경 데이터, 사용 패턴을 기록하며, 경우에 따라 오디오나 영상도 기록합니다. 웨어러블 건강 기기는 생체 인식 데이터와 움직임 패턴을 수집합니다. 산업용 IoT 센서는 운영 활동, 공급망 이동 현황, 환경 조건을 파악할 수 있게 해줍니다. 자판기나 공과금 계량기와 같은 단순한 M2M 기기조차도 특정 수사에 유용하게 활용될 수 있는 위치 및 사용 데이터를 생성합니다.
~처럼 법 집행 기관 IoT 데이터의 수사적 잠재력에 대한 인식이 높아짐에 따라, 수사 당국은 IoT 사업자에게 통신 감청이나 데이터 공개를 요청할 가능성이 점점 더 커지고 있다. 이러한 요청에 응하지 못하는 사업자는 규제상의 제재를 받을 뿐만 아니라, 수사 당국으로부터 비협조적이라는 평가를 받을 위험에 직면하게 되며, 이는 규제 당국과의 관계에 더 광범위한 영향을 미칠 수 있다.
IoT LI의 기술적 과제
IoT 및 M2M 통신에 대한 합법적 감청을 구현하는 데에는 기존의 음성 및 데이터 감청과는 상당히 다른 몇 가지 기술적 과제가 있습니다. 첫 번째는 통신 프로토콜의 다양성입니다. IoT 기기는 MQTT, CoAP, LwM2M, HTTP 및 독점 프로토콜 등 광범위한 프로토콜을 사용하여 LTE-M, NB-IoT, LoRaWAN, Sigfox, 위성 등 다양한 네트워크 기술을 통해 통신합니다. 각 프로토콜과 네트워크 기술은 서로 다른 특성을 가지고 있으며, 이는 감청 수행 방식에 영향을 미칩니다.
The second challenge is the volume and pattern of communications. Unlike voice calls or web browsing sessions, IoT communications are typically short, infrequent, and low-bandwidth. A sensor may transmit a few bytes of data every hour. This pattern matters less for capture, because interception points copy every packet or non-IP message of the target, however small, but it means many sessions stay idle for long periods and each transmission is reported separately.
The third challenge is target identification. IoT devices may be identified by IMSI, IMEI, IP address, or device-specific identifiers that do not correspond to traditional subscriber identities. Mapping these identifiers to a specific target — particularly when the device is owned by an organisation rather than an individual — can be complex. The administration function and the interception points must support the identifier types used for IoT devices (for example IMSI/SUPI, IMEI/PEI, external identifiers and IP addresses), and the operator must be able to map a device serial number to one of them before the task is provisioned.
The fourth challenge relates to encryption and security. Many IoT protocols implement application-layer encryption, which means that the operator may be able to capture the encrypted traffic but not access the content. The DTLS and TLS implementations used by CoAP and MQTT, for example, may encrypt the application payload in a way that the operator cannot decrypt. This limitation must be communicated transparently to law enforcement when responding to interception requests. Operators must remove encryption they apply in the network or whose keys they help generate or exchange (in Germany, § 8(3) TKÜV); application-layer encryption between device and customer platform that the operator holds no key for is delivered as captured.
A fifth challenge is the sheer scale of IoT deployments. An operator may have millions of IoT devices on its network, and large device populations matter mainly for identifying the right device (for example mapping a device serial number to IMSI/IMEI) and for making sure all IoT core functions are covered. The number of simultaneous intercepts remains driven by the number of orders.
LPWAN 관련 고려 사항
LPWAN technologies — including NB-IoT, LTE-M, LoRaWAN, and Sigfox — have specific characteristics that affect LI implementation. NB-IoT and LTE-M operate within the 3GPP ecosystem and are served by the cellular core network. 3GPP TS 33.127/33.128 already cover their IoT-specific paths: data sent over the signalling plane (Data over NAS) and Non-IP Data Delivery via the SCEF (4G) or NEF (5G). Operators must make sure these functions, not just the user-plane gateways, have interception points.
LoRaWAN and Sigfox operate outside the 3GPP ecosystem and use proprietary or open-standard network architectures. The application of LI to these technologies is less well-defined in terms of standards, and operators may need to develop custom interception solutions. The network architecture of LoRaWAN, for example, includes gateways, network servers, and application servers, and the network server sees device identifiers, timing and gateway (location) metadata, but the application payload is encrypted end-to-end with a key held by the application server. Interception at the network server gives readable content only where the operator also runs the application or join server.
사물인터넷(IoT) 통신을 위한 IRI 및 CC
Standard IRI covers what the network knows: identities (IMSI/SUPI, IMEI/PEI, external identifiers), sessions, location. Sensor readings travel as content (CC). Any additional metadata must come from the national handover specification, not from operator-specific extensions.
CC for IoT communications is typically much smaller in volume than for voice or data sessions, but may be more diverse in format. The content of an IoT transmission might be a JSON payload, a binary sensor reading, a protocol buffer message, or a proprietary data format. CC is delivered as an unaltered copy of what was transmitted (for example IP packets or non-IP data), together with the IRI. Interpreting proprietary payload formats is the job of law enforcement’s analysis tools.
IoT LI 의무 이행 준비
IoT 및 M2M 서비스를 제공하는 사업자는 규제 요건이 아직 완전히 확정되지 않았더라도 LI 의무를 대비하기 위해 선제적인 조치를 취해야 합니다. 첫째, 법률 자문가 및 해당 국가의 규제 당국과 협의하여 사업 활동을 펼치는 각 시장의 규제 현황을 평가해야 합니다. 둘째, IoT 감청에 대한 구체적인 요건에 비추어 현재의 LI 역량을 평가하고, 대상 식별, 트래픽 캡처, IRI 생성 및 CC 전달 과정에서 부족한 부분을 파악해야 합니다.
셋째, IoT 감청을 지원하기 위해 LI 역량을 강화하기 위한 기술 로드맵을 수립하십시오. 이 로드맵에는 IoT 네트워크 요소와 LI의 통합 방안이 포함되어야 합니다. 중재 기능, the extension of target identification to support IoT device identifiers, and coverage of the IoT-specific data paths (Data over NAS, NIDD via SCEF/NEF). Fourth, engage with your LI 솔루션 해당 공급업체가 IoT LI 지원에 대한 로드맵을 파악하고, 귀사의 요구 사항을 바탕으로 개발 우선순위에 영향을 미칠 수 있도록 하십시오.
마지막으로, IoT에 대한 접근 방식을 문서화하십시오. LI 규정 준수, including any limitations in your current capabilities and the steps you are taking to address them. This documentation shows the regulator why your service is exempt or how your interception capability is implemented. Where an obligation applies, it does not replace the capability: in Germany the facilities must be in place when the service starts (§ 170(1) TKG).
결론
The growth of IoT and M2M communications is bringing more law enforcement requests to operators, because IoT data is increasingly relevant to investigations. While the technical challenges of IoT LI are significant — spanning protocol diversity, traffic patterns, target identification, encryption, and scale — they are not insurmountable. Operators that assess their regulatory exposure, evaluate their technical capabilities, and invest in IoT-capable LI solutions will be well positioned to meet their obligations and to maintain compliance as the IoT ecosystem continues to grow.
사물인터넷(IoT)과 합법적 통신 감청의 접점은 점점 더 상호 연결되어 가는 세상에서 감시의 범위에 대한 더 광범위한 의문을 제기하기도 합니다. 일상적인 사물들이 네트워크로 연결되어 데이터 스트림을 생성함에 따라, 통신 감청과 광범위한 데이터 수집 사이의 경계가 모호해지고 있습니다. 사업자들은 규제 당국 및 업계 단체와 적극적으로 협력하여 IoT 합법적 감청(LI)을 위한 새로운 프레임워크를 마련하는 데 기여해야 하며, 이를 통해 도출된 요구 사항이 법 집행에 효과적일 뿐만 아니라 사업자들이 실제로 이행할 수 있도록 실질적인 기술적 전문성을 제공해야 합니다.
IoT 합법적 감청 의무의 범위는 관할권 및 서비스 유형에 따라 다릅니다. 사업자는 구축 계획 초기 단계에서 자사의 IoT 합법적 감청 요건을 파악해야 합니다.
관련 기사
관련 주제에 대한 자세한 내용은 다음 문서를 참조하세요:
- 5G SA 환경에서의 네트워크 슬라이싱: LI 타겟팅을 어떻게 복잡하게 만들며(그리고 어떻게 단순화할 수 있는가)
- eSIM 및 합법적 감청: RSP 아키텍처가 규정 준수를 위해 의미하는 것
- MVNO와 MNO: 합법적인 감청에 대한 법적 책임은 누구에게 있나요?
외부 리소스
다음 외부 리소스에서 추가 컨텍스트와 공식 문서를 확인할 수 있습니다:
