---
title: "LI, lawful disclosure, preservation, and e-evidence"
chapter: "03"
---

# LI, lawful disclosure, preservation, and e-evidence

Related processes are often confused. LI generally concerns targeted, authorized acquisition while communication activity occurs. Lawful disclosure (LD) concerns data already held by a provider. Preservation freezes eligible stored data against deletion. European e-evidence mechanisms define structured cross-border orders and communication between authorities and service providers. Their legal bases, timing, data categories, and interfaces differ.

> **Safety boundary:** this chapter teaches lawful, governed system design from
> public standards. It does not provide operational targeting, activation,
> decryption, surveillance-evasion, or covert collection instructions.

## The mental model

| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| **Lawful interception** | Authorized acquisition associated with ongoing service activity | Use LI lifecycle and handover controls |
| **Lawful disclosure** | Authorized request and delivery of stored provider data | Search only eligible repositories and date ranges |
| **Preservation** | Temporary protection of specified existing data from normal deletion | It is not permission to disclose |
| **Production order** | Authority to provide specified stored data under applicable law | Validate scope and recipient independently |
| **Emergency request** | A special urgent legal path where law permits it | Urgency does not remove validation or later review |
| **e-Evidence interface** | Structured exchange supporting EU cross-border orders | It does not itself decide legal validity |

## Apply it as a controlled workflow

1. Classify the incoming instrument before selecting any technical workflow.
2. Determine data category, creation time, location, retention state, and legal availability.
3. Keep preservation, search, review, disclosure, and live interception state separate.
4. Use the matching ETSI family and national profile.
5. Record partial availability, lawful rejection, and deadline handling explicitly.
6. Close with delivery receipt, retention decision, and audit reconciliation.

## Evidence to demand

- The case record states whether the workflow is LI, LD, preservation, or e-evidence.
- Preserved data cannot be disclosed merely because it is held.
- A live intercept cannot silently become a historical-data fishing exercise.
- Metrics separate legal deadlines from technical service levels.

## Failure to reason about

An authority sends a preservation order for messages that may otherwise expire. The provider freezes the specified stored items. It must not start live collection or release the items until a valid production authority arrives.

## Feynman check

LI watches a permitted future stream; disclosure retrieves permitted stored pages; preservation puts a legal bookmark on existing pages; none of these permissions automatically includes the others.