Lawful Intercept System Security: CALEA and LI Guide

A lawful intercept system is built to copy communications on demand, which makes it the most valuable target in a carrier network for any intelligence service that is not the one holding the warrant. In November 2024 the FBI and CISA stated that PRC-affiliated actors had compromised multiple US telecommunications companies and copied certain information subject to US law enforcement requests made under court orders. This guide is for carrier security architects, LI compliance officers and network operations leads who run or assure lawful intercept (LI) platforms. It takes the operator's view: how an LI estate is put together, where it is attacked, how to isolate and govern it, what US CALEA rules require of carrier procedures today, and what to monitor. The wider telecom attack surface (signalling, SIM swap, core hardening) is covered in the Telecom Network Security Guide; this page goes deeper on LI alone.

Key takeaways

The intercept target list is itself secret data. Compromise of an LI platform exposes who is under investigation, not only the intercepted content, so protect provisioning records as carefully as content delivery.
The route in is usually the surrounding network, not the LI box. The August 2025 joint advisory on Salt Typhoon and related actors describes edge device exploitation, credential capture from TACACS+ traffic, configuration changes and traffic mirroring on routers that sit beside intercept functions.
Isolation and identity are the core controls. A separate management plane, separate AAA, phishing-resistant MFA, mutual certificate authentication on internal LI interfaces and dual control for provisioning changes do most of the work.
Reconciliation catches what perimeter tools miss. Regularly compare every active intercept on every network element with the authorised order register; an intercept with no order behind it is an incident.
US obligations shifted, procedures did not. The FCC rescinded its January 2025 CALEA cybersecurity declaratory ruling on 20 November 2025, but the carrier rules on employee supervision, records and reporting compromises in 47 CFR Part 1 Subpart Z remain in force.

How a lawful intercept estate is built

Modern LI follows the ETSI and 3GPP model. 3GPP TS 33.127 (Lawful Interception architecture and functions) and TS 33.128 (protocol and procedures, Stage 3) were both at Release 19 version 19.8.0 when checked on 8 November 2026. ETSI TS 103 221-1 (Lawful Interception; Internal Network Interfaces; Part 1: X1), latest version V1.23.1 dated March 2026, defines the provisioning interface between the administration function and network elements, and Part 2 covers the X2 and X3 delivery interfaces.

Component	Role	Security significance
Administration function (ADMF; LIPF in 3GPP terms)	Receives authorised orders and provisions intercept tasks on network elements over X1	Holds the full target list; compromise reveals every active investigation
Points of interception (POI) in network elements	Routers, packet cores, IMS, messaging and voice platforms that copy target traffic and events	Spread across the network; inherit the security of each element's management plane
Mediation and delivery functions (MDF)	Collect X2 (intercept related information) and X3 (content) from POIs, format and deliver to the agency	Concentrate content in transit; must authenticate both sides
Handover interfaces to the agency	Order exchange and delivery of metadata and content to the law enforcement monitoring facility	Cross the carrier boundary; need strong mutual authentication and encryption
Order register and case records	Warrants, court orders, approvals, CALEA certifications	Ground truth for reconciliation and audit

ETSI TS 103 221-1 builds security into X1. Clause 4.3 says security relies on public and private key pairs for the ADMF and each network element, and discourages implementers from exposing any LI control interface other than X1; any local action must be captured in the element's audit log and be reversible by the ADMF. Clause 6.1 requires that ADMF and element identifiers match their X.509 certificate details, with dedicated error codes when they do not, and each ADMF has its own X1 context that another ADMF cannot see. Treat these as minimum acceptance criteria when buying or upgrading LI components.

Threats to lawful intercept systems

The joint advisory AA25-239A, "Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System" (first published 27 August 2025, version 1.1 September 2025, co-sealed by 23 agencies including NSA, CISA, FBI, NCSC-UK and BSI), names Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor in industry reporting. It does not discuss LI platforms directly, but it describes exactly the techniques that put intercept infrastructure at risk. See the Salt Typhoon Threat Actor Profile.

Threat	What the advisory describes	ATT&CK	Main control
Edge device exploitation	CVE-2024-21887 (Ivanti), CVE-2024-3400 (PAN-OS), CVE-2023-20198 and CVE-2023-20273 (Cisco IOS XE Web UI), CVE-2018-0171 (Cisco Smart Install), all in the CISA KEV catalogue	T1190	Patch KEV items on edge and management devices first; remove management interfaces from untrusted networks
Valid credentials and shared secrets	Capture of TACACS+ and RADIUS traffic, AAA redirected to attacker servers, weaker authentication methods configured	T1078, T1040, T1556	Separate AAA for LI and network management, phishing-resistant MFA, rotate shared secrets
Configuration theft and change	ACL entries added for attacker addresses, configuration exports moved off-box via FTP or TFTP	T1602.002, T1098	Central golden configurations, change alerts, block device egress except to approved collectors
Traffic mirroring and capture	SPAN, RSPAN and ERSPAN sessions and native packet capture on routers	T1040	Alert on any capture or mirror session that is not an authorised intercept or approved troubleshooting
Covert tunnels and boundary bridging	GRE, mGRE and IPsec tunnels and static routes for command and control and exfiltration, including across peering links	T1572, T1599	Baseline tunnels and routes; review unexplained tunnels between autonomous systems
Insider misuse	An administrator enables an intercept without legal authority or discloses targets	Not an ATT&CK technique	Dual control, order reconciliation, CALEA certification records

An attacker who controls routers can build a shadow interception capability with mirroring and capture, without touching the LI platform at all. That is why router and switch integrity is part of LI security, not a separate problem. The Salt Typhoon Telecom Intrusions 2025 breach page shows how stolen device credentials, SNMP community strings and TACACS+ keys kept the intruders in carrier networks, in one case for more than three years according to Cisco Talos.

Isolating and hardening the LI environment

The December 2024 "Enhanced Visibility and Hardening Guidance for Communications Infrastructure" from CISA, NSA, FBI and partners in Australia, Canada and New Zealand is the baseline for the network around LI. Apply it more strictly to every element that hosts a POI or MDF, and add LI-specific layers.

Separate LI zone: place the ADMF, MDF and order systems in a dedicated segment with default-deny ACLs, reachable only from designated LI administration workstations. X1, X2 and X3 traffic should run on a dedicated VRF or out-of-band network, never across the general management network.
Out-of-band management: the guidance calls for a physically separate out-of-band management network that does not allow lateral device-to-device management, no management from the internet, and outbound connections from devices disabled.
Disable unused features: turn off Smart Install, unencrypted web management, Telnet, unneeded discovery protocols and on-device Linux containers such as Guest Shell where they are not required; the 2025 advisory recommends restricting Guest Shell through AAA command authorisation.
Strong cryptography: SSH version 2 only with at least 3072-bit RSA keys, TLS 1.3 with PKI certificates rather than self-signed ones, and SNMPv3 with authentication and encryption, with SNMPv1 and v2c disabled.
Verified software: check image hashes against vendor sources, track end-of-life dates and keep LI-hosting elements on supported releases. See the Vulnerability Management for Network Devices Guide.
Golden configuration: the guidance says devices should not be the trusted source of truth for their own configuration; store configurations centrally, compare and override regularly. See the Network Device Management Plane Hardening Guide.

Identity, access and dual control

LI security is largely an identity problem: a small number of human administrators, plus machine identities on every X1, X2 and X3 link.

Identity	Risk	Control
LI administrators	Phished or reused credentials; insider misuse	Named accounts only, phishing-resistant MFA (hardware PKI or FIDO, as the 2024 guidance recommends), AAA separate from the corporate identity store, just-in-time elevation
Provisioning approvers	Single person can activate an intercept	Two-person rule: one person enters the task, another approves it against the order (NIST SP 800-53 AC-5 Separation of Duties)
ADMF and network element certificates	Stolen private keys allow impersonation on X1	Keys in hardware security modules where supported, short validity, alerts before expiry, identifiers matched to certificates per ETSI TS 103 221-1
Device local accounts	Weak password types decrypted offline from stolen configurations	Emergency use only, strong hashing (for Cisco, Type 8 rather than Type 5 or 7), rotation after each use
TACACS+, RADIUS and SNMP secrets	Captured or harvested shared secrets give broad device access	Inventory with owners, rotation schedule, unique secrets per zone
Vendor support access	Remote access paths into LI elements	Brokered, recorded sessions with time-boxed approval

Device secrets and certificates are non-human identities and need the same lifecycle discipline as any service account. See the Telecoms Identity Security Guide.

CALEA and regulatory requirements

In the US, the Communications Assistance for Law Enforcement Act (CALEA) and the FCC's rules in 47 CFR Part 1 Subpart Z set procedural duties for carriers. As shown in the eCFR on 8 November 2026:

Section 1.20003, policies and procedures: appoint a senior officer or employee responsible for ensuring interceptions are activated only under a court order or other lawful authorisation and with an individual's affirmative intervention; state that personnel need both legal and carrier authorisation; describe how long interception records are kept; and list 24/7 contact details for law enforcement. Carriers must report to the affected agencies, within a reasonable time after discovery, any compromise of a lawful interception to unauthorised persons and any unlawful electronic surveillance on their premises.
Section 1.20004, records: a signed certification for each interception, authorised or not, including the telephone or circuit identifiers, start date and time, the officer presenting the authorisation, the person who signed it, the interception type (for example pen register, trap and trace, Title III, FISA) and the employee overseeing it. The carrier sets and documents a reasonable retention period.
Section 1.20005, submission: file policies before starting service, again within 90 days of a merger or divestiture or after amendment, through the CALEA Electronic Filing System since 29 June 2023.
Status of the 2025 cybersecurity ruling: in January 2025 the FCC issued a declaratory ruling reading CALEA section 105 as requiring carriers to secure their networks against unauthorised interception, with a proposed rulemaking. On 20 November 2025 the FCC adopted an Order on Reconsideration (FCC 25-81, published in the Federal Register on 15 December 2025) rescinding the ruling and withdrawing the proposed rules, saying section 105 is limited to interception within switching premises and that it cannot enforce the duty without implementing rules. Watch for new targeted rules.

Outside the US, LI and telecom security duties sit in national law, such as the UK Telecommunications (Security) Act framework. See the Telecoms Security Laws Map and the UK Telecommunications Security Act Guide.

Implementation roadmap

Map the estate (weeks 1 to 4): list every ADMF, MDF, POI-capable element, handover link, certificate and shared secret. Confirm which management networks can reach each.
Close known exposure (weeks 2 to 6): patch KEV vulnerabilities on edge and LI-hosting devices, remove internet-reachable management, disable Smart Install, Telnet and unused web management.
Separate identity (weeks 4 to 12): stand up dedicated AAA for the LI zone with phishing-resistant MFA, remove shared accounts, rotate every TACACS+, RADIUS and SNMP secret and local password.
Segment (months 2 to 6): move X1, X2 and X3 onto a dedicated VRF or out-of-band network; pilot on one region, keep the old path available for rollback until delivery to agencies is confirmed end to end.
Introduce dual control and reconciliation (months 3 to 6): enforce two-person provisioning and run a weekly automated comparison of active tasks (the ADMF can retrieve task identifiers from each element) against the order register.
Monitor and test (ongoing): feed LI audit logs to a separate, access-restricted SIEM tenant; run tabletop exercises for "intercept compromised" scenarios including the CALEA reporting duty; commission red team tests that include the management plane.

Small versus large operators: a smaller carrier or MVNO often relies on a vendor-hosted or shared mediation service; contract for the same controls (dedicated AAA, audit log access, reconciliation reports, breach notification) and assess the provider as a critical supplier. A large carrier should run LI security as a distinct programme with its own governance and cleared staff.

Detection and measurement

Provisioning events: every intercept activation, change and deactivation, with the approver, order reference and target element; alert on any task without a matching order.
Local LI actions: any intercept action not made via X1 (ETSI TS 103 221-1 requires these to be audited).
Capture and mirroring: creation of SPAN, RSPAN, ERSPAN or packet capture sessions, especially filtered on TACACS+ (TCP 49) or RADIUS, as AA25-239A recommends.
Configuration drift: new local accounts, SSH keys, changed AAA server addresses, ACL edits, new tunnels or static routes, and SNMP SET operations.
Unusual services and transfers: SSH or HTTPS on non-standard high ports, FTP or TFTP from routers to unapproved destinations, log clearing or disabled logging.
Certificate health: expiry warnings and identifier mismatch errors on X1.

Metrics: percentage of active intercepts reconciled to an order in the last 7 days (target 100%); number of unmatched tasks found; percentage of LI administrators on phishing-resistant MFA; days since last rotation of AAA and SNMP secrets in the LI zone; mean time to detect unauthorised configuration change on LI-hosting elements; and percentage of KEV vulnerabilities on those elements patched within the agreed window.

Framework mapping

Framework	Reference	Applies to
NIST SP 800-53 Rev. 5	AC-2, AC-5, AC-6, IA-2, SC-7, SC-8, SC-12, CM-3, AU-6, AU-9, AU-12, SI-4, IR-6	Accounts, dual control, least privilege, MFA, segmentation, interface encryption, key management, change control, audit, monitoring, reporting
NIST CSF 2.0	PR.AA-05, PR.IR-01, PR.PS-04, DE.CM-09, GV.SC-07	Access policy, network protection, logging, monitoring, supplier risk for LI vendors
MITRE ATT&CK v20	T1190, T1078, T1040, T1556, T1602.002, T1098, T1572, T1599	Techniques reported against telecom infrastructure
US rules	47 CFR 1.20003 to 1.20005	Supervision, records, reporting compromises, filing

Common failure patterns

Shared AAA: LI elements authenticate against the same TACACS+ or RADIUS servers as the rest of the network, so one harvested secret opens both.
Long-lived device secrets: SNMP community strings, shared keys and local passwords that are never rotated and sit in configuration backups, the pattern behind the Salt Typhoon Telecom Intrusions 2025.
No reconciliation: intercepts are provisioned correctly but never checked again, so an unauthorised task or capture session goes unnoticed.
Treating LI as compliance only: the CALEA filing is current, but the platform is outside security monitoring and change management.
Vendor back doors: undocumented local interfaces or support accounts on LI-capable elements, contrary to ETSI's advice to expose only X1.
Delayed edge patching: internet-facing firewalls, VPN gateways and router web interfaces left unpatched while KEV-listed exploits circulate.

Practitioner checklist

Inventory every LI component, POI-capable element, handover link, certificate and shared secret, with owners.
Place ADMF, MDF and order systems in a dedicated zone, and run X1, X2 and X3 on a dedicated VRF or out-of-band network.
Use separate AAA for LI with phishing-resistant MFA and named accounts only.
Enforce two-person approval for every intercept activation and change.
Reconcile all active intercepts against the order register at least weekly and treat mismatches as incidents.
Alert on capture or mirror sessions, AAA changes, new accounts, new tunnels and device egress to unapproved hosts.
Patch KEV-listed vulnerabilities on edge and LI-hosting devices first, and verify image hashes.
Rotate TACACS+, RADIUS, SNMP and local credentials, and protect configuration backups as secrets.
Keep CALEA policies, officer details and per-interception certifications current, and rehearse the compromise reporting duty.
Require ETSI TS 103 221-1 certificate-based authentication and full audit of local actions from LI vendors.

Standards and references

Related NHI Mgmt Group resources: Telecom Network Security Guide · Salt Typhoon Threat Actor Profile · Telecoms Identity Security Guide · Network Device Management Plane Hardening Guide · Telecoms Security Laws Map. This guide summarises CALEA rules as published on 8 November 2026 and is not legal advice.

Lawful Intercept System Security: Protecting CALEA and LI Infrastructure After Salt Typhoon