Law enforcement interest in IoT data is growing as connected devices proliferate across networks. The Internet of Things (IoT) is transforming industries from logistics and agriculture to healthcare and smart cities. Billions of connected devices now communicate over cellular and non-cellular networks, generating vast quantities of machine-to-machine (M2M) data. For telecommunications operators — particularly those providing Low Power Wide Area Network (LPWAN) connectivity and M2M services — this growth brings not only commercial opportunity but also expanding regulatory obligations, including lawful interception.
The application of lawful interception obligations to IoT and M2M communications is a developing area of regulation, but the direction of travel is clear: as IoT traffic grows and becomes more relevant to criminal investigations, law enforcement interest in IoT data is growing, and operators should expect more requests for data, mainly for subscriber, location and traffic data rather than live content. This article examines the current state of LI obligations for IoT operators, the technical challenges involved, and the steps operators should take to prepare.
为何物联网合法截取至关重要
The question of whether IoT and M2M communications fall within the scope of lawful interception obligations is primarily a legal one, and the answer varies by jurisdiction. In the European Union, the obligation to support lawful interception generally applies to providers of electronic communications services that are available to the public. Under the EU Electronic Communications Code, transmission services used for machine-to-machine communication are electronic communications services (Art. 2(4)(c) EECC). Whether they carry LI obligations depends on whether they are offered to the public and on national law, which sets the LI conditions and any exemptions.
In Germany, § 170 TKG and the TKÜV (Telekommunikations-Überwachungsverordnung) require operators of networks used for publicly available telecommunications services to provide interception capability, and M2M transmission services count as telecommunications services (§ 3 No. 61(c) TKG). The TKÜV exempts some systems from having to install interception facilities, for example systems used only to transmit measurement data (§ 3(2) No. 4 TKÜV) or systems with no more than 10,000 users (§ 3(2) No. 5). Whether an IoT offering is exempt therefore depends on what it carries, not on the label ‘IoT’. In other EU member states the details differ.
Even an operator that is exempt from installing interception facilities must cooperate with an individual order (in Germany, § 100a(4) StPO). It should therefore know how it would carry out an order on its IoT platform, even where no permanent LI system is required.
物联网数据为何对执法工作至关重要
物联网设备生成的数据对刑事调查具有重要参考价值。联网车辆会生成位置数据、驾驶模式和通信日志。智能家居设备会记录环境数据、使用模式，在某些情况下还会记录音频或视频。 可穿戴健康设备可采集生物识别数据和活动模式。工业物联网传感器可揭示运营活动、供应链动态及环境状况。即使是自动售货机或公用事业计量表等简单的机器对机器（M2M）设备，也会生成位置和使用数据，这些数据在某些调查中可能具有重要参考价值。.
作为 执法机构 随着执法部门越来越意识到物联网数据在调查中的潜力，他们越来越可能向物联网运营商提出截取或披露数据的要求。无法响应这些请求的运营商不仅将面临监管处罚，还可能被执法机构视为不配合，这可能会对运营商与监管机构的关系产生更广泛的影响。.
物联网 LI 的技术挑战
对物联网（IoT）和机器对机器（M2M）通信实施合法截获面临着若干技术挑战，这些挑战与传统的语音和数据截获有显著不同。首先是通信协议的多样性。 物联网设备使用多种协议（如 MQTT、CoAP、LwM2M、HTTP 以及专有协议）进行通信，并依托包括 LTE-M、NB-IoT、LoRaWAN、Sigfox 和卫星在内的多种网络技术。每种协议和网络技术都具有不同的特性，这些特性会影响截获操作的具体实施方式。.
The second challenge is the volume and pattern of communications. Unlike voice calls or web browsing sessions, IoT communications are typically short, infrequent, and low-bandwidth. A sensor may transmit a few bytes of data every hour. This pattern matters less for capture, because interception points copy every packet or non-IP message of the target, however small, but it means many sessions stay idle for long periods and each transmission is reported separately.
The third challenge is target identification. IoT devices may be identified by IMSI, IMEI, IP address, or device-specific identifiers that do not correspond to traditional subscriber identities. Mapping these identifiers to a specific target — particularly when the device is owned by an organisation rather than an individual — can be complex. The administration function and the interception points must support the identifier types used for IoT devices (for example IMSI/SUPI, IMEI/PEI, external identifiers and IP addresses), and the operator must be able to map a device serial number to one of them before the task is provisioned.
The fourth challenge relates to encryption and security. Many IoT protocols implement application-layer encryption, which means that the operator may be able to capture the encrypted traffic but not access the content. The DTLS and TLS implementations used by CoAP and MQTT, for example, may encrypt the application payload in a way that the operator cannot decrypt. This limitation must be communicated transparently to law enforcement when responding to interception requests. Operators must remove encryption they apply in the network or whose keys they help generate or exchange (in Germany, § 8(3) TKÜV); application-layer encryption between device and customer platform that the operator holds no key for is delivered as captured.
A fifth challenge is the sheer scale of IoT deployments. An operator may have millions of IoT devices on its network, and large device populations matter mainly for identifying the right device (for example mapping a device serial number to IMSI/IMEI) and for making sure all IoT core functions are covered. The number of simultaneous intercepts remains driven by the number of orders.
针对LPWAN的注意事项
LPWAN technologies — including NB-IoT, LTE-M, LoRaWAN, and Sigfox — have specific characteristics that affect LI implementation. NB-IoT and LTE-M operate within the 3GPP ecosystem and are served by the cellular core network. 3GPP TS 33.127/33.128 already cover their IoT-specific paths: data sent over the signalling plane (Data over NAS) and Non-IP Data Delivery via the SCEF (4G) or NEF (5G). Operators must make sure these functions, not just the user-plane gateways, have interception points.
LoRaWAN and Sigfox operate outside the 3GPP ecosystem and use proprietary or open-standard network architectures. The application of LI to these technologies is less well-defined in terms of standards, and operators may need to develop custom interception solutions. The network architecture of LoRaWAN, for example, includes gateways, network servers, and application servers, and the network server sees device identifiers, timing and gateway (location) metadata, but the application payload is encrypted end-to-end with a key held by the application server. Interception at the network server gives readable content only where the operator also runs the application or join server.
IRI 和 CC 在物联网通信领域的应用
Standard IRI covers what the network knows: identities (IMSI/SUPI, IMEI/PEI, external identifiers), sessions, location. Sensor readings travel as content (CC). Any additional metadata must come from the national handover specification, not from operator-specific extensions.
CC for IoT communications is typically much smaller in volume than for voice or data sessions, but may be more diverse in format. The content of an IoT transmission might be a JSON payload, a binary sensor reading, a protocol buffer message, or a proprietary data format. CC is delivered as an unaltered copy of what was transmitted (for example IP packets or non-IP data), together with the IRI. Interpreting proprietary payload formats is the job of law enforcement’s analysis tools.
为履行物联网（IoT）相关义务做好准备
提供物联网（IoT）和机器对机器（M2M）服务的运营商应采取主动措施，为履行定位信息（LI）义务做好准备，即使相关监管要求尚未完全明确。首先，应评估您所运营的每个市场的监管状况，并咨询法律顾问和相关国家监管机构。 其次，根据物联网截获的具体要求，评估贵公司当前的LI能力，找出在目标识别、流量捕获、IRI生成和CC交付方面的不足之处。.
第三，制定一份技术路线图，以增强您的LI能力，从而支持物联网截获。该路线图应涵盖物联网网络元素与LI的集成 中介函数, the extension of target identification to support IoT device identifiers, and coverage of the IoT-specific data paths (Data over NAS, NIDD via SCEF/NEF). Fourth, engage with your LI 解决方案 与供应商沟通，了解其对物联网 LI 支持的路线图，并根据您的需求影响其开发优先级。.
最后，记录下您对物联网的实施方法 LI合规, including any limitations in your current capabilities and the steps you are taking to address them. This documentation shows the regulator why your service is exempt or how your interception capability is implemented. Where an obligation applies, it does not replace the capability: in Germany the facilities must be in place when the service starts (§ 170(1) TKG).
结论
The growth of IoT and M2M communications is bringing more law enforcement requests to operators, because IoT data is increasingly relevant to investigations. While the technical challenges of IoT LI are significant — spanning protocol diversity, traffic patterns, target identification, encryption, and scale — they are not insurmountable. Operators that assess their regulatory exposure, evaluate their technical capabilities, and invest in IoT-capable LI solutions will be well positioned to meet their obligations and to maintain compliance as the IoT ecosystem continues to grow.
物联网与合法截获的交汇，也引发了关于在日益互联的世界中监控范围的更广泛问题。 随着日常物品接入网络并产生数据流，通信截获与更广泛的数据收集之间的界限变得日益模糊。运营商应积极与监管机构和行业组织开展合作，共同构建物联网合法截获（IoT LI）的新兴框架，并提供实用的技术专长，以确保最终制定的要求既能有效支持执法工作，又能由运营商切实实施。.
物联网合法截取义务的范围因司法管辖区和服务类型而异。运营商应在部署规划的早期阶段，明确其物联网合法截取的要求。.
相关文章
如需进一步了解相关主题，请浏览这些文章：
外部资源
以下外部资源提供了更多背景资料和官方文件：
