Understanding Germany’s lawful interception requirements is essential for international carriers. Auslandskopfüberwachung is one of the most critical compliance requirements for telecommunications providers operating in Germany. AKÜ applies to operators of network nodes that switch publicly available voice calls to or from abroad: international gateways of fixed, mobile and VoIP networks, and voice transit carriers. Unlike normal interception, it also applies to transit networks without subscriber lines and to networks with no more than 10,000 users, which are otherwise exempt (§ 3(2) sentence 2 TKÜV). Pure internet transit and peering are not covered. This obligation is established in Germany’s Telecommunications Act (Telekommunikationsgesetz, TKG) and the Telecommunications Surveillance Ordinance (Telekommunikations-Überwachungsverordnung, TKÜV). In practice, implementing Auslandskopfüberwachung represents a significant technical and organizational challenge that demands specialized expertise and close coordination with the Federal Network Agency (Bundesnetzagentur, BNetzA).
Что такое Auslandskopfüberwachung (AKÜ)?
Auslandskopfüberwachung, often abbreviated as AKÜ, is a legally mandated measure for the lawful interception of telecommunications between domestic and foreign networks in Germany. The term “Auslandskopf” (literally “foreign head”) refers to the network gateway point where domestic telecommunications traffic is handed over to a foreign network. At this point, network operators must be able to intercept and extract the telecommunications traffic of specific target persons upon an interception order (a court order under the StPO, or an order under the G10 Act for the intelligence services) and deliver it to the authorized agencies (berechtigte Stellen), such as the Federal Intelligence Service (Bundesnachrichtendienst, BND), federal and state police authorities, or the domestic intelligence services. Auslandskopfüberwachung covers international voice calls (fixed, mobile and VoIP) and encompasses the capture, filtering, and secure transmission of communication content and the related event data (IRI) to the authorized requesting agencies (Bedarfsträger).
Правовая база: TKG § 170 и TKÜV
AKÜ is defined in § 4(2) of the Telecommunications Surveillance Ordinance (TKÜV): calls between an unknown domestic line and a foreign number named in the order must be captured at the international gateway. The general duty to keep facilities comes from § 170 Закона о телекоммуникациях (TKG), which governs the implementation of surveillance measures and the provision of information; § 3(2) sentence 2 TKÜV extends AKÜ to transit and small networks. The technical design is agreed individually with the BNetzA (§ 4(2) sentence 2 TKÜV). Under § 170 (1) No. 1 TKG, every operator of a telecommunications system used to provide publicly accessible telecommunications services is obligated to maintain, at their own expense, technical facilities for the implementation of legally mandated surveillance measures and to make organizational provisions for their immediate execution from the moment of commencing operations. The Постановление о надзоре за телекоммуникациями (TKÜV) further specifies these requirements, detailing the technical and organizational aspects of implementation including handover point specifications, transmission of the surveillance copy, security requirements, confidentiality obligations, and logging procedures. As with any interception, the copy must be delivered without encryption or compression that the operator itself applied (§ 8(3) TKÜV).
Кто обязан внедрять Auslandskopfüberwachung?
The obligation to implement Auslandskopfüberwachung applies to operators of network nodes that switch publicly available voice calls to or from abroad. This includes international gateways of fixed, mobile and VoIP networks, voice transit carriers routing calls between Germany and foreign countries, and VoIP providers offering international call services. Because § 3(2) sentence 2 TKÜV lifts the transit and small-network exemptions for such nodes, it also applies to transit networks without subscriber lines and to networks with no more than 10,000 users, which are otherwise exempt. Pure internet transit, peering and interconnection nodes are not covered (§ 3(2) No. 2 TKÜV). Companies without their own network infrastructure that offer international voice services via the facilities of other operators must, under § 170 (2) TKG, choose an operator that can implement interception orders and tell the BNetzA which services they offer and who implements the orders.
Технические требования для внедрения AKÜ
Техническая реализация Auslandskopfüberwachung требует сложной инфраструктуры, состоящей из множества компонентов. Должна быть развернута платформа для законного перехвата, способная идентифицировать, фильтровать и извлекать соответствующий телекоммуникационный трафик на международном шлюзе. Передача копий данных наблюдения уполномоченным органам осуществляется по зашифрованным соединениям, как правило, через Коробка SINA (Secure Inter-Network Architecture), which ensures tamper-proof communication between the network operator and the requesting agencies. The interfaces must comply with the Technical Directive issued by the BNetzA and be implemented according to the TR TKÜV, which today requires IP-based handover (ETSI TS 102 232-1 with -5/-6 for voice services; 3GPP TS 33.108/33.128 for mobile networks). Additionally, strict security requirements under the TKÜV must be observed, including access control, logging of all access events, deletion of order data after the measure expires, and a legally compliant role-based access concept as prescribed by the BNetzA.
The Technical Concept: BNetzA Acceptance Process
Перед запуском Auslandskopfüberwachung в эксплуатацию обязанный оператор сети должен подготовить подробный technical concept (Konzept, the documents under § 19(2) TKÜV) and submit it to the Federal Network Agency. This concept describes the technical architecture, organizational procedures, and security measures for the AKÜ implementation; for AKÜ the design is agreed individually with the BNetzA (§ 4(2) sentence 2 TKÜV). The BNetzA checks the proof of compliance in an acceptance test, in which it verifies the technical facilities and organizational provisions on site. It does not approve or license the operator. Under § 170 (1) No. 4 TKG, the operator must send the documents and agree a test date with the BNetzA without delay, and no later than one month after starting operations. Preparing a concept that passes the acceptance test requires in-depth knowledge of the regulatory requirements and practical experience with Сертификация BNetzA процедуры.
Основные проблемы в области обеспечения соответствия требованиям Auslandskopfüberwachung
Auslandskopfüberwachung poses numerous challenges for carriers and network operators. The initial investment costs for procuring and deploying the technical infrastructure are substantial, particularly for smaller providers. Connecting to the agencies through the TKÜV-VPN with an approved crypto box (currently the SINA box) requires specific security expertise and compliance with strict cryptographic standards. Ongoing operations include the timely execution of incoming surveillance orders, maintenance of technical systems, regular updates in line with amended Technical Directives, and the preparation of billing for completed measures. Furthermore, the BNetzA can order renewed inspections at any time to verify continued compliance. Errors or delays in implementation can result in significant regulatory penalties, making it essential for operators to have a reliable and proven solution in place.
ICS: ваш партнер по аусландскопфюбервачун как услуга
Как опытный поставщик услуг законного перехвата, ICS (услуги международных перевозчиков) offers a complete AKÜ-as-a-Service solution for carriers, network operators, and providers in Germany. Our service covers the full lifecycle of Auslandskopfüberwachung compliance: preparation of the technical concept that you, as the obligated operator, submit to the BNetzA (§ 170 (1) No. 4 TKG), deployment and operation of the lawful interception platform as your Erfüllungsgehilfe under § 5 (3) TKÜV, connection to the requesting agencies through the TKÜV-VPN with an approved crypto box, support during the BNetzA acceptance test, timely and legally compliant processing of incoming AKÜ orders, and ongoing reporting and billing management. By outsourcing Auslandskopfüberwachung to ICS, network operators save significant capital and operating expenses, reduce their compliance risk, and can focus on their core business. Наше решение AKÜ is modular and supports fixed, mobile and VoIP voice traffic, allowing us to tailor the solution to the specific requirements of each customer.
Действуйте сейчас: Обеспечьте соответствие требованиям Auslandskopfüberwachung
The legal obligation for Auslandskopfüberwachung takes effect from the moment a provider commences operations. Any operator switching international voice calls in Germany that has not yet met its AKÜ requirements risks sanctions from the Federal Network Agency. Contact ICS today to learn how our AKÜ-as-a-Service solution can implement your Auslandskopfüberwachung obligations cost-effectively, while you remain the obligated operator.
Внешние ресурсы
Следующие внешние ресурсы предоставляют дополнительный контекст и официальную документацию:
