Re: TICSA and lawful intercept

On Wed, Sep 6, 2017 at 2:57 PM, Nathan Ward <[email protected]> wrote:

>
> The rest of your email was interesting and I’m generally in agreement,
> but, focussing on just this one thing for the minute..
>
> What is the objection to ETSI format here? The format itself looks rather
> straightforward, if you can provide a PCAP for this today I think you could
> turn this in to the ETSI format in some sort of mediation device fairly
> easily - either streaming or as files on an SFTP/similar server. The only
> reason I haven’t started cutting code to do this is I don’t know how to go
> about validating the output yet, heh.
>
>
Right now, I have less objections to ETSI than I did before. These are my
own thoughts and not Inspire's. My objections are more regarding
communications, cost and politics related rather than technological.

Previously, it was implied (at a TICSA workshop) that any vendor ETSI LI
solution costs at least 6 figures. However, since looking in to options it
seems the price isn't necessarily going to be that high. So, previously I
was trying to avoid the high costs that seemed to be associated with ETSI
solutions.

As Peter just stated, from the government's point of view they need
something that can stand up in court. ETSI will do this.

However, from the legislation, specifically section 10 and section 40, we
should be able to do interception in a 'format that is acceptable to the
network operator and the surveillance agency'. I have been trying to work
on coming up with that arrangement for a long period of time but with no
success.

Section 40 mentions about a standard being gazetted in the future with
*industry
consultation*. Plus the police website right currently states 'Although no
standards have been Gazetted yet, the European Telecommunications Standards
Institute (ETSI) standards and specifications, specific to the type of
service to be intercepted, are the standards we are currently working to.'.
So, right now everything implies that whilst ETSI is preferred it is not
currently the standard.

In general, everything we read implies LI formats can be worked out between
the industry and the police but in reality I don't believe that has
occurred. Most people I have talked to recently assumed pcaps were still
completely fine - including those that actually supply LI gear.

So, in conclusion, maybe ETSI is the best format, and isn't as expensive as
I had thought to achieve. However, it would have been nice if the parties
involved had carried out more consultation with the industry and if were
all made more aware that we are required to supply data in the ETSI format
(assuming that is definitely required - which I am still unclear on).

Moving on from my personal views, as Peter suggests, if we just form a
group of us, and sit down with the 'powers that be', we can hopefully work
out a solution that is acceptable to all.

Cheers
Dave

_______________________________________________
NZNOG mailing list
[email protected]
https://list.waikato.ac.nz/mailman/listinfo/nznog