SOLUTION FOR AGENCIES
Law Enforcement Monitoring from Requirements to Operation
One partner for the agency side of lawful interception: the ICS LEMF software plus onboarding, integration, analytics, training and support. Regulators and operators benefit too.
Law enforcement monitoring is the agency side of lawful interception: ordering measures, receiving intercepted data from providers and turning it into evidence. The ICS law enforcement monitoring solution combines the ICS LEMF software with the services an agency needs around it, from requirements to daily operation.
Key facts
- Scope: requirements, software, CSP onboarding, HI1/ESB integration, delivery assurance, DPI analytics, training and operations support.
- Core product: ICS LEMF, available for agencies and as a Test LEMF for operators.
- Standards: ETSI TS 103 120, TS 102 232, TS 101 671, 3GPP TS 33.108/33.128 and German ETSI-ESB.
- For regulators: standards support and operator assessment.
- For operators: handover verification with the Test LEMF.
- Experience: more than 20 years in lawful interception, multiple BNetzA acceptances, security-cleared staff.
Why is law enforcement monitoring more demanding today?
Agencies no longer deal with a handful of telephone companies. Orders go to mobile operators, MVNOs, fixed-line ISPs, VoIP and OTT providers. Each has its own endpoints, certificates and standard versions, and each must be onboarded and tested.
The data has changed too. Most intercepted traffic is encrypted IP, so recording and playback are no longer enough. Analysts need decoding, classification and correlation, and courts expect every result to be traceable.
Warrant handling is also moving from fax to electronic interfaces such as ETSI TS 103 120. In Germany, information requests already run over ETSI-ESB and E-Mail-ESB. Software alone does not solve these challenges. Agencies need a partner who understands both sides of the handover.
What the solution includes
ICS covers every building block of a monitoring center, and you choose the ones you need.
01
Requirements and tender support
We help you define realistic, testable requirements based on ETSI and 3GPP standards, from handover interfaces to DPI and analytics.
02
ICS LEMF software
The core of the solution: warrant management, CSP management, reception, decoding, audio workbench and IP analytics in one application. Learn more
03
CSP onboarding and interface testing
We configure handover endpoints and certificates, validate HI2 and HI3 formats and run test intercepts before a provider goes live.
04
HI1 and ESB integration
We connect warrant management to ETSI TS 103 120 for interception orders, with a controlled fax fallback, and to German ETSI-ESB and E-Mail-ESB for information requests.
05
Delivery quality assurance
Automated checks detect missing records, sequence gaps, keep-alive failures and IRI without matching content. Analysts work with complete data.
06
DPI and IP analytics
Deep packet inspection, TLS fingerprinting and correlation turn encrypted intercepts into timelines, maps and graphs. Learn more
From requirements to operation
A typical project follows seven steps, and each step can also be ordered on its own.
1
Requirements
We analyze your legal framework, providers and analysis needs, and document testable requirements.
2
Architecture
We design the deployment, for example active/active across two sites, virtualized or air-gapped.
3
Installation and integration
ICS LEMF is installed, and HI1, ESB, fax and existing case systems are connected.
4
CSP onboarding
Providers are registered, handover connections are configured and test intercepts are validated.
5
Acceptance and go-live
We run structured acceptance tests with you before live measures start.
6
Training
Administrators, case managers, analysts and interpreters learn the workflows of their role.
7
Operations support
We monitor delivery quality, onboard new providers and keep decoders and classifiers current.
Training and operations support
A monitoring center is only as good as the people who run it. ICS trains technical teams on ETSI standards, interfaces and troubleshooting, and analysts on encrypted traffic analysis and its limits. After go-live, our specialists support your team with provider changes, updates and delivery issues.
Service overview
The table maps each service area to the standards and rules it is built on.
| Service area | What ICS delivers | Relevant standards and rules |
|---|---|---|
| Requirements and tender support | Requirement catalogs, evaluation criteria, test plans | ETSI TS 102 232, TS 103 120, 3GPP TS 33.108/33.128 |
| Monitoring software | ICS LEMF for agencies | ETSI TS 101 671, TS 102 232-1 to -7, TS 103 462 |
| Order and request interfaces | HI1 for orders with fax fallback, ESB for information requests | ETSI TS 103 120, ETSI TS 102 657, TR TKÜV |
| CSP onboarding | Endpoint, certificate and format validation | ETSI TS 102 232-1, national handover rules |
| Delivery quality | Completeness and format monitoring | ETSI TS 101 671, TS 102 232 |
| IP analytics | DPI, TLS fingerprinting, correlation | Directive (EU) 2016/680 for processing limits |
| Handover verification | Test LEMF for operators | § 170 TKG, TKÜV, TR TKÜV |
Who is law enforcement monitoring for?
The solution is built for agencies, but regulators and operators use parts of it as well.
01
Law enforcement agencies
Full monitoring capability with ICS LEMF, plus onboarding, integration, analytics and training. Learn more
02
Regulators
Support with national technical specifications and ETSI standards, and assessment of operator interception solutions based on our acceptance experience.
03
Network operators
Handover verification with the Test LEMF: check HI2 and HI3 before and during BNetzA acceptance and monitor the LI chain in daily operation. Learn more
Why ICS
01
Experience on both sides
More than 20 years in telecommunications, lawful interception and compliance, with daily LI operations for providers.
02
Regulatory depth
Multiple BNetzA acceptances for interception solutions and detailed knowledge of the TKÜV and TR TKÜV.
03
Security-cleared staff
Our team is security-cleared by the German Federal Ministry of the Interior and may handle classified information.
04
Own product, own developers
ICS develops ICS LEMF in-house and builds custom decoders and integrations through our integration services.
Frequently Asked Questions
What is law enforcement monitoring?
Law enforcement monitoring is the agency-side part of lawful interception. The agency issues interception orders to communication service providers, receives the intercept-related information and content they deliver, and analyzes it as evidence. It relies on a law enforcement monitoring facility (LEMF), secure handover interfaces, trained staff and documented processes that withstand judicial review.
How does the solution differ from the ICS LEMF product?
ICS LEMF is the software. The law enforcement monitoring solution adds everything around it: requirements and tender support, CSP onboarding, HI1 and ESB integration, delivery quality assurance, DPI analytics, training and operations support. Agencies can order the complete package or combine the software with selected services, depending on their in-house resources.
Can ICS support an agency’s LEMF procurement?
Yes. ICS helps agencies write precise, standards-based and testable requirements for a monitoring facility. These cover handover interfaces, warrant management, audio, DPI and evidence integrity. We also prepare evaluation criteria and acceptance test plans. Our daily work on the operator side keeps the requirements realistic and aligned with what providers actually deliver.
How does ICS onboard a new communication service provider?
ICS registers the provider with its services, supported standard versions and contacts, then configures handover endpoints and certificates. Test intercepts check that HI2 and HI3 records are complete and correctly formatted. The provider handles live measures only after successful tests, and delivery quality monitoring continues in daily operation.
What does ICS offer regulators?
Regulators get support with national technical specifications, ETSI and 3GPP standards, and the assessment of operator interception solutions. ICS knows acceptance procedures from the operator side and holds multiple BNetzA acceptances. We help define test cases that show whether an operator delivers complete and correctly formatted data.
How do network operators use the Test LEMF?
Operators connect the Test LEMF as the receiving end for their own HI2 and HI3 deliveries. It verifies format and completeness before and during the BNetzA acceptance. In daily operation, it tests the interception chain end to end and raises alarms when deliveries fail or are malformed, so problems surface before an agency reports them.
Plan your monitoring center with ICS
Tell us where you stand, from first requirements to live operation, and we will show you the next practical step.