TKG 2021\uc5d0 \ub530\ub978 \uc624\uc2a4\ud2b8\ub9ac\uc544\uc758 \ud569\ubc95\uc801 \uac10\uccad \uc694\uac74\uc740 \ud1b5\uc2e0 \uc0ac\uc5c5\uc790\uc5d0\uac8c \uace0\uc720\ud55c \uacfc\uc81c\ub97c \uc81c\uc2dc\ud569\ub2c8\ub2e4. \uc624\uc2a4\ud2b8\ub9ac\uc544\uc758 \ud1b5\uc2e0 \uaddc\uc81c \ud658\uacbd\uc740 \uc774\uc804\uc758 TKG 2003\uc744 \ub300\uccb4\ud558\uace0 \uc624\uc2a4\ud2b8\ub9ac\uc544\uc758 \ubc95\uc801 \ud504\ub808\uc784\uc6cc\ud06c\ub97c \uc720\ub7fd \uc804\uc790 \ud1b5\uc2e0\ubc95(EECC)\uacfc \ub354\uc6b1 \ubc00\uc811\ud558\uac8c \uc77c\uce58\uc2dc\ud0a4\ub294 Telekommunikationsgesetz 2021(TKG 2021)\uc758 \ub3c4\uc785\uc73c\ub85c \ud070 \ubcc0\ud654\ub97c \uacaa\uc5c8\uc2b5\ub2c8\ub2e4. \uc0ac\uc5c5\uc790, \ud2b9\ud788 MVNO\uc640 \uc2e0\uaddc \uc2dc\uc7a5 \uc9c4\uc785\uc790\uc758 \uacbd\uc6b0 \uc624\uc2a4\ud2b8\ub9ac\uc544 \uc2dc\uc7a5\uc5d0\uc11c \uaddc\uc815 \uc900\uc218\ub97c \ub2ec\uc131\ud558\uace0 \uc720\uc9c0\ud558\uae30 \uc704\ud574\uc11c\ub294 \ud569\ubc95\uc801\uc778 \uac10\uccad\uc5d0 \ub300\ud55c TKG 2021\uc758 \uc758\ubbf8\ub97c \uc774\ud574\ud558\ub294 \uac83\uc774 \ud544\uc218\uc801\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
Austria splits the job in two. Real-time interception (IRI and CC) is handed over to the Federal Ministry of the Interior (BM.I) in the ETSI formats that the \u00dcberwachungsverordnung (\u00dcVO, BGBl. II Nr. 418\/2001 as amended) prescribes. Requests for stored data (Ausk\u00fcnfte) and the answers to them run through the Durchlaufstelle (DLS), an encrypted mailbox system that the Bundesrechenzentrum (BRZ) operates under \u00a7\u00a7 171\u2013172 TKG 2021. This dual structure means that operators must satisfy both the legal requirements set out in the TKG 2021 and the Strafprozessordnung (StPO), and the technical specifications of the \u00dcVO for the delivery of intercepted communications. The DLS itself is governed by the TKG-Datensicherheitsverordnung (TKG-DSVO). Getting either side wrong can result in administrative fines and coercive measures.<\/p>\n\n\n\n
The TKG 2021 establishes the general obligation for providers of public telecommunications services to cooperate with lawful interception requests. Section 162 of the TKG 2021 requires providers to supply all facilities needed for interception and data disclosure, and to cooperate with each order to the extent required. This obligation applies to all providers of public communications services, regardless of their size or business model \u2014 MVNOs are not exempt.<\/p>\n\n\n\n
The procedural basis for ordering an interception is found in the StPO (Code of Criminal Procedure). Besides the StPO, providers must also cooperate with measures under the State Protection and Intelligence Act (SNG), the Fiscal Penal Code (FinStrG) and the Military Powers Act (MBG) (\u00a7 162 TKG 2021). Under Austrian law, the interception is ordered by the public prosecutor’s office and requires prior authorisation by a court (\u00a7 137 StPO). The StPO specifies the types of offences that can trigger an interception order, the maximum duration of surveillance, and the conditions under which extensions may be granted. Operators are legally bound to comply with valid interception orders and face penalties for refusal or undue delay.<\/p>\n\n\n\n
One important distinction in Austrian law is between the interception of content data (Inhaltsdaten) and the collection of traffic data (Verkehrsdaten) and location data (Standortdaten). Each category has different legal thresholds and procedural requirements. Both measures generally require an intentional offence punishable by more than one year’s imprisonment (\u00a7 135 StPO). Content interception also requires a close link between the intercepted device and the suspect.<\/p>\n\n\n\n
Austria has had no general \ub370\uc774\ud130 \ubcf4\uc874<\/a> since the Constitutional Court struck it down in 2014. Since 2018 the StPO has allowed targeted preservation instead (Anlassdatenspeicherung, \u00a7 135 (2b) StPO): on an initial suspicion, the public prosecutor can order a provider to keep specific data for up to 12 months. Operators must understand how these provisions interact with their general LI obligations to avoid gaps in compliance.<\/p>\n\n\n\n The Bundesrechenzentrum (BRZ) is Austria’s federal computing centre. It does not receive intercepted communications: real-time IRI and CC are delivered by the operator to the Federal Ministry of the Interior (BM.I), the \ubc95 \uc9d1\ud589<\/a> side of the handover. The BRZ sets up and runs the Durchlaufstelle (DLS), an electronic mailbox system for the secure handling of data-disclosure requests and their answers (\u00a7\u00a7 171\u2013172 TKG 2021). Operators that pay the RTR financing contribution under \u00a7 34 KOG must answer requests through it.<\/p>\n\n\n\n The handover format is set by the \u00dcVO: ETSI ES 201 671 for classic voice, and ETSI TS 102 232-1\/-5 for VoLTE. Operators must ensure that their systems can deliver both intercept-related information (IRI) and content of communications (CC) in these formats. The Austrian options (TCP over a VPN across the public Internet, LIID and operator identifiers agreed with the BM.I) are documented in the industry recommendation AK-TK EP 023, which the RTR publishes.<\/p>\n\n\n\n Data-disclosure requests (Ausk\u00fcnfte) and their answers are exchanged through the DLS mailbox system, with authentication, integrity protection and revision-proof statistics (\u00a7 171 TKG 2021). Interception orders themselves are issued by the public prosecutor’s office on the basis of a court authorisation and are carried out by the provider together with the BM.I.<\/p>\n\n\n\n For operators new to the Austrian market, agreeing the handover with the BM.I is one of the earliest steps in the compliance journey. Before going live, the operator agrees the handover parameters with the BM.I and runs test interceptions over the agreed VPN connection. The DLS connection for data requests is set up separately with the BRZ. Operators should factor in several months for this process, as scheduling, development, and testing cycles can be lengthy \u2014 particularly for MVNOs that need to coordinate with their host MNO’s infrastructure.<\/p>\n\n\n\n MVNOs operating in Austria face the same fundamental challenge as in other European markets: every provider must cooperate with interception orders, but the technical capability to intercept often resides with the host MNO. Every provider must cooperate with interception orders (\u00a7 162 TKG 2021), and holding a notification with the Rundfunk und Telekom Regulierungs-GmbH (RTR) does not reduce that duty. The detailed technical facility duties of the \u00dcVO, however, are tied to the network in which the subscriber connections physically exist. Light MVNOs therefore need a written arrangement with their host network that covers how orders are executed and who builds the handover.<\/p>\n\n\n\n \uc774\ub294 MVNO\uac00 \ub2e4\uc74c\uc744 \ud3ec\ud568\ud55c \uc790\uccb4 LI \uc778\ud504\ub77c\ub97c \uad6c\ucd95\ud558\uac70\ub098 \u2014 \uc911\uc7ac \uae30\ub2a5<\/a> capable of delivering to the BM.I \u2014 or establish a formal agreement with their host MNO under which the MNO performs interception on the MVNO’s behalf. In the latter case, the MVNO must still ensure that the arrangement meets the \u00dcVO requirements and that the MVNO retains visibility and control over the process. Simply delegating responsibility to the MNO without formal agreements and technical validation is a compliance risk that the Fernmeldeb\u00fcro and the BM.I will not overlook.<\/p>\n\n\n\n The architectural model of the MVNO also matters. Full MVNOs that operate their own core network elements have more direct control over interception capabilities and can implement LI systems that deliver directly to the BM.I. Light MVNOs and resellers, which rely more heavily on the host MNO’s infrastructure, face greater dependency and must invest more heavily in contractual and procedural safeguards.<\/p>\n\n\n\n MVNO\uc5d0\uac8c \ud2b9\ud788 \ubcf5\uc7a1\ud55c \uc601\uc5ed \uc911 \ud558\ub098\ub294 VoLTE \ud2b8\ub798\ud53d \ucc98\ub9ac\uc785\ub2c8\ub2e4. \uc624\uc2a4\ud2b8\ub9ac\uc544 \uc0ac\uc5c5\uc790\ub4e4\uc774 \uc74c\uc131 \uc11c\ube44\uc2a4\ub97c LTE\ub85c \ub9c8\uc774\uadf8\ub808\uc774\uc158\ud558\uace0 \uc810\uc810 \ub354 5G\ub85c \uc804\ud658\ud568\uc5d0 \ub530\ub77c \uc74c\uc131 \ud1b5\ud654 \ucc28\ub2e8\uc774 \uc11c\ud0b7 \uc2a4\uc704\uce58\ud615 \uc778\ud504\ub77c\uc5d0\uc11c \ud328\ud0b7 \uc2a4\uc704\uce58\ud615 \uc778\ud504\ub77c\ub85c \uc804\ud658\ub418\uc5c8\uc2b5\ub2c8\ub2e4. VoLTE \uc11c\ube44\uc2a4\ub97c \uc704\ud574 \ud638\uc2a4\ud2b8 MNO\uc5d0 \uc758\uc874\ud558\ub294 MVNO\ub294 \uae30\uc220\uc801 \uba54\ucee4\ub2c8\uc998\uc774 \uae30\uc874\uc758 \uc11c\ud0b7 \uc804\ud658 \ucc28\ub2e8\uacfc \ud06c\uac8c \ub2e4\ub974\uae30 \ub54c\ubb38\uc5d0 LI \uacc4\uc57d\uc5d0\uc11c VoLTE \ud1b5\ud654 \ucc28\ub2e8\uc744 \ubcf4\uc7a5\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n The technical requirements for LI in Austria follow ETSI standards with the Austrian options of AK-TK EP 023. Operators must support the delivery of IRI (via HI2) and CC (via HI3) in the formats prescribed by the \u00dcVO. The IRI must include all required metadata, such as calling and called numbers, timestamps, cell identifiers, and IP addresses, depending on the type of communication being intercepted.<\/p>\n\n\n\n For voice interception, the CC must be delivered as a real-time audio stream. For data interception, the CC consists of the IP packets associated with the target’s sessions. For VoLTE and VoWiFi, AK-TK EP 023 specifies delivery to the BM.I over TCP across a VPN, with the destination ports assigned by the BM.I. For other services, such as Internet access, the \u00dcVO names no handover standard, so the format and transport have to be agreed with the BM.I.<\/p>\n\n\n\n \ub610\ud55c \uc6b4\uc601\uc790\ub294 \uac15\ub825\ud55c \ud45c\uc801 \uc2dd\ubcc4 \uae30\ub2a5\uc744 \uad6c\ud604\ud574\uc57c \ud569\ub2c8\ub2e4. \uc624\uc2a4\ud2b8\ub9ac\uc544\uc758 \uac10\uccad \uba85\ub839\uc740 \uc804\ud654 \ubc88\ud638(MSISDN), IMSI, IMEI, IP \uc8fc\uc18c \ub610\ub294 \uc774\uba54\uc77c \uc8fc\uc18c\ub85c \ub300\uc0c1\uc744 \uc2dd\ubcc4\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \uc0ac\uc5c5\uc790\uc758 LI \uc2dc\uc2a4\ud15c\uc740 \uc774\ub7ec\ud55c \uc2dd\ubcc4\uc790\ub97c \ud65c\uc131 \uc138\uc158 \ub610\ub294 \uac00\uc785\uc790\ub85c \ud655\uc778\ud558\uace0 \uadf8\uc5d0 \ub530\ub77c \uac10\uccad\uc744 \uc2dc\uc791\ud560 \uc218 \uc788\uc5b4\uc57c \ud569\ub2c8\ub2e4. MVNO\uc758 \uacbd\uc6b0, \ub300\uc0c1\uc744 \uc815\ud655\ud558\uac8c \uc2dd\ubcc4\ud558\uace0 \ucd94\uc801\ud558\uae30 \uc704\ud574 \ud638\uc2a4\ud2b8 MNO\uc758 \uac00\uc785\uc790 \uad00\ub9ac \uc2dc\uc2a4\ud15c\uacfc\uc758 \ud1b5\ud569\uc774 \ud544\uc694\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n Before an operator receives live interception orders, the handover is tested with the BM.I over the agreed VPN connection. The test interceptions typically cover voice call interception, SMS interception, data session interception, and target identification using various selectors, and should be repeated whenever the LI systems are upgraded or modified.<\/p>\n\n\n\n Breaches of the LI duties are administrative offences prosecuted by the Fernmeldeb\u00fcro: up to EUR 50,000 for failing to cooperate with an order and up to EUR 100,000 for failing to provide the required interception facilities (\u00a7 188 TKG 2021). The RTR handles notifications and market regulation, not LI enforcement. On application by the public prosecutor, the court can also impose coercive penalties (Beugemittel) to enforce cooperation (\u00a7 93 (2) and (4) StPO).<\/p>\n\n\n\n The \u00dcVO obligations apply from the day the service launches, so operators entering the Austrian market should plan the six to twelve months of LI build and testing with the BM.I before<\/em> commercial launch. This timeline accounts for technical development, integration testing, test interceptions with the BM.I, and internal process development. MVNOs with more complex supply chains may need longer, particularly if their host MNO agreements need to be renegotiated to include LI provisions.<\/p>\n\n\n\n \uc624\uc2a4\ud2b8\ub9ac\uc544\uc758 \uaddc\uc81c \uc9d1\ud589 \ud658\uacbd\uc740 \uc9c4\ud654\ud558\uace0 \uc788\uc2b5\ub2c8\ub2e4. \ud1b5\uc2e0 \uc2dc\uc7a5\uc774 \ub354\uc6b1 \uc138\ubd84\ud654\ub418\uace0 \uc0c8\ub85c\uc6b4 MVNO, IoT \uc0ac\uc5c5\uc790, OTT \uc0ac\uc5c5\uc790\uac00 \uc2dc\uc7a5\uc5d0 \uc9c4\uc785\ud568\uc5d0 \ub530\ub77c LI \uaddc\uc815 \uc900\uc218\uc5d0 \ub300\ud55c \uaddc\uc81c \ub2f9\uad6d\uc758 \uad00\uc2ec\uc774 \ub192\uc544\uc9c8 \uac83\uc73c\ub85c \ubcf4\uc785\ub2c8\ub2e4. \uac15\ub825\ud55c \uaddc\uc815 \uc900\uc218 \ud504\ub808\uc784\uc6cc\ud06c\ub97c \uc870\uae30\uc5d0 \uad6c\ucd95\ud558\ub294 \uc0ac\uc5c5\uc790\ub294 \ud5a5\ud6c4 \uaddc\uc81c \ubcc0\ud654\uc5d0 \uc801\uc751\ud558\uace0 \ub2e8\uc18d \uc870\uce58\ub97c \ud53c\ud560 \uc218 \uc788\ub294 \uc720\ub9ac\ud55c \uc704\uce58\uc5d0 \uc11c\uac8c \ub420 \uac83\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n \ub2e4\uc74c\uc5d0 \ub300\ube44\ud558\uace0 \uc788\ub294 \uc6b4\uc601\uc790\ub4e4\uc744 \uc704\ud574 \ud569\ubc95\uc801 \uac10\uccad \uaddc\uc815 \uc900\uc218<\/a> \uc624\uc2a4\ud2b8\ub9ac\uc544\uc5d0\uc11c\ub294 \uba87 \uac00\uc9c0 \uc2e4\uc9c8\uc801\uc778 \uc870\uce58\ub97c \ucde8\ud560 \uac83\uc744 \uad8c\uc7a5\ud569\ub2c8\ub2e4. \uba3c\uc800 TKG 2021\uacfc \ud615\uc0ac\uc18c\uc1a1\ubc95(StPO)\uc758 \uad00\ub828 \uc870\ud56d\uc744 \ucca0\uc800\ud788 \uac80\ud1a0\ud558\uc5ec \ubc95\uc801 \uc758\ubb34\ub97c \ud30c\uc545\ud558\uc2ed\uc2dc\uc624. \ud615\uc0ac\uc18c\uc1a1\ubc95\uacfc \ud1b5\uc2e0 \uaddc\uc81c\uc758 \uc0c1\ud638 \uc791\uc6a9\uc5d0\ub294 \uc804\ubb38 \uc9c0\uc2dd\uc774 \ud544\uc694\ud558\ubbc0\ub85c, \uc624\uc2a4\ud2b8\ub9ac\uc544 \ud1b5\uc2e0 \ubd84\uc57c\uc5d0 \ub300\ud55c \uc804\ubb38 \uc9c0\uc2dd\uc744 \uac16\ucd98 \ubc95\ub960 \uc790\ubb38\uc744 \uad6c\ud558\uc2ed\uc2dc\uc624.<\/p>\n\n\n\n Contact the BM.I early in your planning process to agree the handover parameters, and set up the DLS connection with the BRZ. Develop your technical infrastructure \u2014 whether in-house or through a managed service provider \u2014 to meet the \u00dcVO and AK-TK EP 023 requirements. Ensure that your LI \uad00\ub9ac \uc2dc\uc2a4\ud15c<\/a> \uc218\uc2e0 \ubc0f \ubc1c\ud6a8\ubd80\ud130 \ubaa8\ub2c8\ud130\ub9c1 \ubc0f \ud574\uc81c\uae4c\uc9c0, \uac10\uccad \uba85\ub839\uc758 \uc804\uccb4 \uc218\uba85 \uc8fc\uae30\ub97c \uc9c0\uc6d0\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n MVNO\uc778 \uacbd\uc6b0, \ud638\uc2a4\ud2b8 MNO \uacc4\uc57d\uc744 \uac80\ud1a0\ud558\uace0 \ud544\uc694\ud55c \uacbd\uc6b0 \uc7ac\ud611\uc0c1\ud558\uc5ec LI \ucc45\uc784\uc744 \uba85\uc2dc\uc801\uc73c\ub85c \ub2e4\ub8e8\uc138\uc694. \uac10\uccad \uc694\uccad\uc5d0 \ub300\ud55c \uba85\ud655\ud55c \uc5d0\uc2a4\uceec\ub808\uc774\uc158 \uacbd\ub85c\uc640 \uc751\ub2f5 \uc2dc\uac04 \uc57d\uc18d\uc744 \uc218\ub9bd\ud558\uc138\uc694. \ub9c8\uc9c0\ub9c9\uc73c\ub85c \uc561\uc138\uc2a4 \uc81c\uc5b4, \uae30\ubc00 \uc720\uc9c0 \uc808\ucc28, \uac10\uc0ac \ucd94\uc801 \ub4f1 \uac10\uccad \uc694\uccad\uc744 \ucc98\ub9ac\ud558\uae30 \uc704\ud55c \ub0b4\ubd80 \ud504\ub85c\uc138\uc2a4\ub97c \uac1c\ubc1c\ud558\uace0 \ubb38\uc11c\ud654\ud558\uc138\uc694.<\/p>\n\n\n\n Austria’s lawful interception framework, anchored by the TKG 2021 and the \u00dcVO, with real-time handover to the BM.I and data requests through the BRZ Durchlaufstelle, represents a well-structured but demanding compliance environment. For MVNOs and new market entrants, the combination of legal obligations and technical requirements means that early planning, proactive engagement with the BM.I and the BRZ, and investment in robust LI infrastructure are essential. The consequences of non-compliance \u2014 administrative fines, coercive measures, and reputational damage \u2014 far outweigh the costs of getting it right from the start. By understanding the Austrian LI landscape and taking a systematic approach to compliance, operators can build a solid foundation for long-term success in this important European market.<\/p>\n\n\n\n The lawful interception Austria compliance landscape continues to evolve as the \u00dcVO and the industry recommendations are updated. Operators must ensure their lawful interception Austria implementations remain aligned with current specifications.<\/p>\n\n\n\n \uad00\ub828 \uc8fc\uc81c\uc5d0 \ub300\ud55c \uc790\uc138\ud55c \ub0b4\uc6a9\uc740 \ub2e4\uc74c \ubb38\uc11c\ub97c \ucc38\uc870\ud558\uc138\uc694:<\/p>\n\n\n\n \ub2e4\uc74c \uc678\ubd80 \ub9ac\uc18c\uc2a4\uc5d0\uc11c \ucd94\uac00 \ucee8\ud14d\uc2a4\ud2b8\uc640 \uacf5\uc2dd \ubb38\uc11c\ub97c \ud655\uc778\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4:<\/p>\n\n\n\nThe BM.I Handover and the BRZ Durchlaufstelle<\/h2>\n\n\n\n
MVNO\ubcc4 \uace0\ub824 \uc0ac\ud56d<\/h2>\n\n\n\n
\uae30\uc220 \uad6c\ud604 \uc694\uad6c \uc0ac\ud56d<\/h2>\n\n\n\n
\uaddc\uc815 \uc900\uc218 \uc77c\uc815 \ubc0f \uc2dc\ud589<\/h2>\n\n\n\n
\uc2e4\uc6a9\uc801\uc778 \uad8c\uc7a5 \uc0ac\ud56d<\/h2>\n\n\n\n
\uacb0\ub860<\/h2>\n\n\n\n
\uad00\ub828 \uae30\uc0ac<\/h2>\n\n\n\n
\uc678\ubd80 \ub9ac\uc18c\uc2a4<\/h2>\n\n\n\n