---
title: "Handover interfaces: HI1, HI2, and HI3"
chapter: "06"
---

# Handover interfaces: HI1, HI2, and HI3

The handover model separates administrative information from intercepted event information and communication content. This separation supports least privilege, different throughput and confidentiality needs, and independent receipt and reconciliation.

> **Safety boundary:** this chapter teaches lawful, governed system design from
> public standards. It does not provide operational targeting, activation,
> decryption, surveillance-evasion, or covert collection instructions.

## The mental model

| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| **HI1 administration** | Conveys warrant/case lifecycle information as defined by applicable profile | Do not mix legal documents with payload channels |
| **HI2 IRI** | Conveys metadata or service events related to the authorized target | IRI can itself be highly sensitive |
| **HI3 CC** | Conveys authorized communication content | Strongest isolation, capacity, and access controls apply |
| **Correlation** | Lets receiving systems relate authorized IRI and CC | Identifiers must not collide, leak, or be rewritten unpredictably |
| **Sequencing** | Represents order and detects discontinuity | Transport order is not always service-event order |
| **Receipt** | Confirms accepted delivery or reports a bounded error | A network send is not proof of usable receipt |

## Apply it as a controlled workflow

1. Classify each handover object as administrative, IRI, CC, or control.
2. Select the applicable ETSI/3GPP and national profile.
3. Define correlation, time, sequencing, error, and retry semantics at contract level.
4. Provision endpoints and trust separately from target data.
5. Test volume, loss, duplicate, reordering, failover, and invalid-version behavior.
6. Reconcile source, mediation, and receiver counts using privacy-safe evidence.

## Evidence to demand

- Interface conformance results are tied to exact schema and profile versions.
- Delivery health reveals gaps without putting content into telemetry.
- Backpressure and outage policy are agreed by provider and receiving authority.
- Administration cannot expose communication content to case-management users.

## Failure to reason about

A delivery function reconnects after outage and retransmits a window. Without stable object identity and receiver-side duplicate handling, the same material may be counted twice. Without bounded replay, records may be lost. The contract must define both.

## Feynman check

HI1 says what authorized job exists. HI2 carries the allowed activity notes. HI3 carries allowed communication material. Separate doors help each kind of parcel receive the right protection.