On Wed, Sep 6, 2017 at 2:57 PM, Nathan Ward <nznog@daork.net> wrote:

The rest of your email was interesting and I��m generally in agreement, but, focussing on just this one thing for the minute..

What is the objection to ETSI format here? The format itself looks rather straightforward, if you can provide a PCAP for this today I think you could turn this in to the ETSI format in some sort of mediation device fairly easily - either streaming or as files on an SFTP/similar server. The only reason I haven��t started cutting code to do this is I don��t know how to go about validating the output yet, heh.

Right now, I have less objections to ETSI than I did before. These are my own thoughts and not Inspire's. My objections are more regarding communications, cost and politics related rather than technological.

Previously, it was implied (at a TICSA workshop) that any vendor ETSI LI solution costs at least 6 figures. However, since looking in to options it seems the price isn't necessarily going to be that high. So, previously I was trying to avoid the high costs that seemed to be associated with ETSI solutions.

As Peter just stated, from the government's point of view they need something that can stand up in court. ETSI will do this.

However, from the legislation, specifically section 10 and section 40, we should be able to do interception in a 'format that is acceptable to the network operator and the surveillance agency'. I have been trying to work on coming up with that arrangement for a long period of time but with no success.

Section 40 mentions about a standard being gazetted in the future with industry consultation. Plus the police website right currently states 'Although no standards have been Gazetted yet, the European Telecommunications Standards Institute (ETSI) standards and specifications, specific to the type of service to be intercepted, are the standards we are currently working to.'. So, right now everything implies that whilst ETSI is preferred it is not currently the standard.

In general, everything we read implies LI formats can be worked out between the industry and the police but in reality I don't believe that has occurred. Most people I have talked to recently assumed pcaps were still completely fine - including those that actually supply LI gear.

So, in conclusion, maybe ETSI is the best format, and isn't as expensive as I had thought to achieve. However, it would have been nice if the parties involved had carried out more consultation with the industry and if were all made more aware that we are required to supply data in the ETSI format (assuming that is definitely required - which I am still unclear on).

Moving on from my personal views, as Peter suggests, if we just form a group of us, and sit down with the 'powers that be', we can hopefully work out a solution that is acceptable to all.

Cheers

Dave