The functional reference model
A reference model lets legal, network, platform, and receiving teams discuss responsibility without tying the design to one vendor. The essential flow is authorization administration, controlled observation, mediation, delivery, receipt, and evidence.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| HI1 | Administrative or warrant-related handover information | Keep it distinct from intercepted material |
| HI2 | Intercept-related information (IRI) handover | Preserve event semantics, timing, and correlation |
| HI3 | Content of communication (CC) handover | Apply the highest confidentiality and minimization controls |
| X1 | Internal administration interface | Provision only approved scope; authenticate both ends |
| X2 | Internal delivery of IRI toward mediation | Detect gaps, duplicates, and version mismatch |
| X3 | Internal delivery of CC toward mediation | Isolate high-volume sensitive flows |
Apply it as a controlled workflow
- Draw roles first, then interfaces, then products.
- Mark legal, administrative, provider-network, mediation, and LEA trust zones.
- Label each data class and allowed direction.
- Separate control-plane and delivery-plane failure models.
- Map every logical role to deployment, owner, keys, logs, and recovery.
- Validate the model against each supported service technology.
Evidence to demand
- A data-flow diagram names every boundary and data classification.
- IRI and CC are distinguishable through storage, transport, access, and retention.
- An interface inventory records version, national profile, endpoint owner, and certificate authority.
- No monitoring facility is reachable from general provider networks.
Failure to reason about
If one mediation service handles both administrative records and content with the same database, identity, and log sink, a compromise crosses every boundary. Logical labels do not create isolation; deployment and authority must enforce it.
Feynman check
HI means the provider hands something to the approved authority. X means provider systems talk internally. The numbers tell whether it is administration, event information, or communication content.