The choice between SIPREC vs ETSI standards is a critical architectural decision for operators. In the world of lawful interception, two technical frameworks frequently appear in discussions about how voice communications are captured and delivered: SIPREC and ETSI LI. While both relate to the recording and interception of communications, they serve fundamentally different purposes, originate from different standards bodies, and apply in different contexts. Confusion between the two is common — particularly among operators that are new to LI or that are transitioning from legacy recording solutions to modern interception platforms.
This article provides a detailed comparison of SIPREC and ETSI LI, explaining what each framework does, where it comes from, how it works technically, and when each is the appropriate solution. By the end, readers should have a clear understanding of how these two approaches relate to one another and how to make informed decisions about their use in a telecommunications environment.
SIPREC vs ETSI: Core Differences
SIPREC (SIP-based Media Recording) is a protocol framework defined by the Internet Engineering Task Force (IETF) in RFC 7866 (Session Recording Protocol) and RFC 7865 (recording metadata), with requirements in RFC 6341 and the architecture in RFC 7245. It was designed to enable the recording of SIP-based communications sessions — primarily VoIP calls — in a standardised, interoperable manner. SIPREC defines how a Session Recording Client (SRC) within the network duplicates media streams and sends them to a Session Recording Server (SRS) for storage and processing.
The primary use cases for SIPREC are enterprise call recording, quality assurance, compliance recording for financial services, and similar applications where an organisation needs to capture and retain records of voice communications. SIPREC is widely implemented in enterprise telephony platforms, contact centre solutions, and unified communications systems. Major equipment vendors support SIPREC as a standard mechanism for capturing voice traffic.
SIPREC works by establishing a parallel SIP session from the SRC to the SRS. When a communication session is identified for recording, the SRC duplicates the media streams (typically RTP audio) and establishes a new SIP session with the SRS to deliver the recorded media. The SIPREC recording metadata (RFC 7865) describes the recorded communication session: its participants, media streams and their association.
It is important to note that SIPREC was not designed for lawful interception. It does not include provisions for the confidentiality of the recording from the target, the secure delivery of intercepted material to law enforcement, the generation of intercept-related information in ETSI format, or the management of interception orders. SIPREC is a recording mechanism, not an interception mechanism, and this distinction has important technical and legal consequences.
What Is ETSI LI?
ETSI LI refers to the suite of lawful interception standards developed by the European Telecommunications Standards Institute, primarily within the Technical Committee on Lawful Interception (TC LI). The core standards include ETSI TS 101 331 (LEA requirements), the ETSI TS 102 232 series (IP handover of IRI and content, with TS 102 232-5 for VoIP/IMS), ETSI TS 101 671 (legacy handover), ETSI TS 103 120 (electronic warrant interface, HI1) and ETSI TS 103 221-1/-2 (internal X1/X2/X3 interfaces); 3GPP TS 33.127/33.128 cover mobile networks. Together, these standards define the complete architecture for lawful interception in telecommunications networks, from the points of interception within the operator’s network to the handover of intercepted material to law enforcement.
ETSI LI is specifically designed for the purpose of enabling lawful surveillance by authorised government agencies. It addresses the full interception lifecycle, including the receipt and processing of interception orders (HI1), the delivery of intercept-related information (HI2), and the delivery of content of communications (HI3). The standards incorporate detailed provisions for security, confidentiality, data integrity, and the prevention of detection by the interception target.
In most European countries the national LI rules are based on ETSI standards, often with a national profile, and variants of them are used in many other jurisdictions worldwide. For 5G, 3GPP TS 33.127/33.128 define LI using ETSI protocols. Operators that provide public telecommunications services in Europe are generally required to implement LI capabilities that conform to ETSI standards, and compliance is typically verified through testing with the relevant national authority or law enforcement technical platform.
Key Differences
The differences between SIPREC and ETSI LI are fundamental and span multiple dimensions: purpose, scope, architecture, security, and legal context.
Purpose is the most basic distinction. SIPREC is designed for call recording — a business function that serves internal organisational needs such as quality assurance, training, and regulatory compliance for specific industries. ETSI LI is designed for lawful interception — a law enforcement function that enables government agencies to monitor the communications of specific targets pursuant to a legal authorisation. The two serve entirely different stakeholders with entirely different requirements.
Scope is another significant difference. SIPREC is limited to SIP-established sessions (audio, video, DTMF and real-time text). It does not natively support the interception of non-SIP communications, the generation of structured metadata in ETSI IRI format, or the management of interception orders. ETSI LI, by contrast, covers the entire telecommunications stack — voice, data, SMS, VoLTE, IMS, and increasingly 5G services — and provides a comprehensive framework for managing the full interception lifecycle.
Architecture differs substantially. SIPREC uses a two-party model (SRC and SRS) with a relatively simple session duplication mechanism. ETSI LI uses a multi-component architecture: points of interception in the network, an administration function that provisions them over X1, a mediation and delivery function that receives X2/X3 and hands over to the LEMF on HI2/HI3, and HI1 for orders. The ETSI architecture is designed to support complex network environments, multiple concurrent intercepts, and the separation of administrative, metadata, and content delivery functions.
Security and confidentiality requirements are fundamentally different. SIPREC is designed so that participants can be told that they are being recorded (RFC 7866 recording indications), and its RFCs explicitly exclude lawful intercept. LI requires the opposite: no party to the call may be able to detect the interception (ETSI TS 101 331). In enterprise environments, recording is typically disclosed and may even require the consent of the parties. ETSI LI, on the other hand, includes strict requirements for the confidentiality of the interception — the target must not be aware that their communications are being intercepted. This requires careful design of the interception point, the delivery infrastructure, and the administrative processes.
The legal context is also different. SIPREC operates in a commercial and regulatory environment where recording may be subject to data protection, employment, and consumer protection laws, but is not a law enforcement activity. ETSI LI operates in a law enforcement context where the interception is authorised by a court or other competent authority and is subject to specific legal safeguards, oversight mechanisms, and confidentiality requirements.
Where SIPREC Can and Cannot Be Used for LI
Given the differences between SIPREC and ETSI LI, can SIPREC be used as part of a lawful interception solution? The answer is nuanced. SIPREC can potentially be used as a media capture mechanism within the operator’s network — that is, as a non-standard point of interception that captures the target’s voice streams. However, SIPREC alone is not sufficient for lawful interception compliance. It must be supplemented with additional components that provide ETSI-compliant IRI generation, secure handover to the LEMF via HI2 and HI3, warrant management via HI1, and the confidentiality safeguards required by law.
In practice, some operators use SIPREC as a media capture mechanism within their IP voice infrastructure, with a mediation function that receives the SIPREC recordings and transforms them into ETSI-compliant handover data. This approach can be effective, particularly in environments where SIPREC is already deployed for enterprise recording and the operator wants to leverage existing infrastructure. If SIPREC is used this way, the SRC must not send recording indications to the parties, the recording server must sit inside the LI-only security domain, and the standardised alternative (X2/X3 per ETSI TS 103 221-2 from the SBC or IMS element) should be preferred where the equipment supports it. However, the mediation function must handle the conversion of SIPREC metadata to ETSI IRI format, the addition of missing data elements, the secure delivery to the LEMF, and the management of timing and correlation.
There are also scenarios where SIPREC is insufficient even as a capture mechanism. If the target’s communications include non-SIP media, data sessions, or services that SIPREC cannot capture, a separate interception mechanism will be needed. Similarly, if the network architecture does not support SIPREC at the appropriate interception point, alternative capture methods must be employed.
When to Use Each Approach
The choice between SIPREC and ETSI LI depends entirely on the use case. For enterprise call recording, quality assurance, and compliance recording in industries such as financial services, SIPREC is the appropriate solution. It provides a standardised, interoperable mechanism for capturing voice communications that meets the needs of business recording applications.
For lawful interception — the capture and delivery of communications to law enforcement pursuant to a legal authorisation — ETSI LI is the appropriate framework. Operators with LI obligations must implement systems that conform to ETSI standards (or their national equivalents), and SIPREC alone cannot satisfy these requirements.
For operators that need both capabilities, the two can coexist within the same network infrastructure. SIPREC can serve enterprise recording functions while the ETSI LI system handles lawful interception. In some architectures, common capture mechanisms may feed both systems, but the processing, delivery, and management of the captured material must follow the appropriate standards and procedures for each use case.
Conclusion
SIPREC and ETSI LI address fundamentally different requirements, even though both involve the capture of communications. SIPREC is a recording protocol for business applications; ETSI LI is a comprehensive interception framework for law enforcement. Operators must understand the distinctions between the two and implement the appropriate solution for each use case. Using SIPREC as a substitute for a full ETSI LI implementation will leave the operator non-compliant with its legal obligations, while deploying ETSI LI for routine business recording would be unnecessarily complex and costly. Clear understanding of each framework’s purpose, capabilities, and limitations is the foundation for making the right technical and architectural decisions.
The choice between SIPREC vs ETSI approaches has long-term architectural implications. Operators should carefully evaluate SIPREC vs ETSI options based on their network evolution roadmap.
Related Articles
For further reading on related topics, explore these articles:
- ETSI TS 103 120 Explained: The Electronic HI1 Warrant Interface
- HI1 vs HI2 vs HI3: Understanding the Three Lawful Interception Interfaces
- How a Mediation Function Works: The Bridge Between Your Network and Law Enforcement
External Resources
The following external resources provide additional context and official documentation:
