Stakeholders, responsibilities, and separation of duties
LI spans public authority, law-enforcement monitoring, communications providers, service owners, vendors, operators, security, privacy, and independent oversight. Architecture should make decision rights and prohibited combinations visible.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| LEA | The legally empowered law-enforcement authority | Its request still requires the applicable authorization |
| LEMF | The law-enforcement monitoring facility that receives authorized handover | Only approved destinations and staff may receive |
| CSP/NWO/SvP | Provider roles operating network or communications services | Responsibility follows real control, not labels |
| ADMF | Administration function managing authorized LI state | It must not silently broaden scope |
| POI | Point that observes authorized service events or communication material | It acts only from controlled provisioning |
| MF/DF | Mediation/delivery functions that normalize and send handover | They must preserve correlation, integrity, and isolation |
Apply it as a controlled workflow
- Create a RACI for authorization validation, provisioning approval, operations, receipt, audit, incident response, and deletion.
- Identify toxic combinations such as one operator creating, approving, activating, and suppressing audit.
- Implement dual control for high-risk state transitions.
- Use separate privileged identities, work queues, and cryptographic trust for each role.
- Make emergency access time-bound, visible, and post-reviewed.
- Test staff departure, role change, supplier support, and compromised administrator scenarios.
Evidence to demand
- Privileged access reviews show purpose, approver, duration, and actual use.
- No shared administrative accounts or reusable operator credentials.
- Vendor support cannot view target scope or communication material by default.
- Oversight can reconstruct decisions without needing production superuser access.
Failure to reason about
A database administrator can modify case mappings and also erase audit logs. Even if this was created for operational convenience, it defeats independent accountability. Split authorities, make audit append-only outside the operational trust domain, and exercise detection.
Feynman check
Think of a bank vault: one person has the request, another checks it, a different machine opens only the named box, and a separate recorder watches the process.