As bandwidth increases by up to 100x in the next 24 months, law enforcement agencies (LEAs) may find it difficult to manage the amount of data flowing into their current Lawful Intelligence systems. One of the most obvious concepts is to filter the non-essential data such as Netflix, Prime Video, and Hulu content from the LEA channel. This can either be done at the source in the carrier network, or in the LEA domain prior to the Collection Function and storage. However, this concept has its pros and cons and may be a perilous path. This blog looks at content filtering strategies, key items the industry must consider, and how content filtering can be successfully implemented.
The idea of filtering is not new, but to meet current regional requirements there needs to be a traceable process for any filtered content. This is an LEA responsibility, which will be established in the IP flow rules and defined in the court warrant. Some form of summarization data will be required to ensure the filtered content was part of the flow. Which will generate metadata and still provide valuable insight to the law enforcement analyst.
So, the current debate is two-fold. Should the filtered content be discarded or should it be available; as the evidentiary nature may not be fully apparent in the initial investigation? If it is to remain available, who is responsible for storing the data, the service provider or the LEA.
Another consideration is that the metadata created by the filtered content needs to be rich enough to ensure the maximum amount of information is retrieved from the content source, which would include the validation of content source, the user identity confirmation, a snapshot of the flow, etc. One way to handle this is to create a content minimization framework, similar to the voice-based minimization framework currently in use. The LEA investigator could trigger a start/stop capability during the content session, once the right amount of data has been captured.
What is clear, is the decision to filter content must be a LEA decision. Which means, there should be a clear path for a service provider to transport all content to the LEA. The pragmatic approach, is to filter at the mediation platform in the service provider, saving both the service provider and the LEA network transmission and storage costs.
The filtration decision relies largely on the resolution of the data record, if it contains statistical information of the content, references to the data source, as-well-as the type of packets being discarded. Those references could be as simple as the media film or content with its appropriate identifier and show number.
Because there are four components to any profile, the LEAs can provide specificity regarding the handling of each profile element and the profile filtering. The four components are:
- Identity of the filtering content or objects
- Content assessment or potential score of use for the content
- Trigger mechanism
- Discarding methodology
For the first component, the objects would be defined by HI1 layers and include a definition, modification and the filtering details.
Content assessment represents the rules for filtering any content. These are mapped directly to the HI1 objects after the investigator has completed the minimization process. If the rules are based on the same or similar content, they can be transferrable or reusable in many investigations.
The trigger mechanism is defined in the filtering profile and is used to execute on a particular piece of content as identified by the investigator. These profile rules should be query based and be the foundation used to identify the content objects.
The discarding methodology is probably the toughest decision to be made in the filtering profile. To err on the side of caution means a significant amount of content and costs associated with processing, delivery and storing. Being too aggressive in defining the filtering profile can cause a loss of valuable insight. This final decision will rely heavily on LEA experience, knowledge of the metadata rules and the learning algorithms that accompany such decision making.
About Dr. Keith Bhatia
As CEO of SS8, Keith combines his broad technical and market knowledge to advance the future of lawful intelligence. In his tenure, he has positioned SS8 as a leader in a world connected by 5G and shaped by increasing digitalization and automation. Keith is impassioned to show how technology can have a positive impact on our world.
About SS8 Networks
SS8 provides Lawful Intelligence platforms. They work closely with leading intelligence agencies, communication providers, law enforcement agencies and standards bodies and their technology incorporates the methodologies discussed in this blog. Xcipio® is already proven to meet the very high demands of 5G and provides the ability to transcode (convert) between lawful intercept handover versions and standard families. Intellego® XT natively supports ETSI, 3GPP and CALEA handovers, as well as national variants. Intellego XT’s MetaHub component is a best-in-class data analytics tool. Both product portfolios are used worldwide for the capture, analysis and delivery of data for the purposes of criminal investigations.
Tweet Us @SS8 Follow Us LinkedIn
