LI, lawful disclosure, preservation, and e-evidence
Related processes are often confused. LI generally concerns targeted, authorized acquisition while communication activity occurs. Lawful disclosure (LD) concerns data already held by a provider. Preservation freezes eligible stored data against deletion. European e-evidence mechanisms define structured cross-border orders and communication between authorities and service providers. Their legal bases, timing, data categories, and interfaces differ.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| Lawful interception | Authorized acquisition associated with ongoing service activity | Use LI lifecycle and handover controls |
| Lawful disclosure | Authorized request and delivery of stored provider data | Search only eligible repositories and date ranges |
| Preservation | Temporary protection of specified existing data from normal deletion | It is not permission to disclose |
| Production order | Authority to provide specified stored data under applicable law | Validate scope and recipient independently |
| Emergency request | A special urgent legal path where law permits it | Urgency does not remove validation or later review |
| e-Evidence interface | Structured exchange supporting EU cross-border orders | It does not itself decide legal validity |
Apply it as a controlled workflow
- Classify the incoming instrument before selecting any technical workflow.
- Determine data category, creation time, location, retention state, and legal availability.
- Keep preservation, search, review, disclosure, and live interception state separate.
- Use the matching ETSI family and national profile.
- Record partial availability, lawful rejection, and deadline handling explicitly.
- Close with delivery receipt, retention decision, and audit reconciliation.
Evidence to demand
- The case record states whether the workflow is LI, LD, preservation, or e-evidence.
- Preserved data cannot be disclosed merely because it is held.
- A live intercept cannot silently become a historical-data fishing exercise.
- Metrics separate legal deadlines from technical service levels.
Failure to reason about
An authority sends a preservation order for messages that may otherwise expire. The provider freezes the specified stored items. It must not start live collection or release the items until a valid production authority arrives.
Feynman check
LI watches a permitted future stream; disclosure retrieves permitted stored pages; preservation puts a legal bookmark on existing pages; none of these permissions automatically includes the others.