ETSI Updates Service Providers on eEvidence Standards

The EU eEvidence Regulation modernizes, standardizes, and secures the process of electronic evidence disclosure from communication service providers (CSPs) to law enforcement authorities, including across borders. It mandates that CSPs must build systems that receive and validate lawful orders, securely produce and deliver the required data on demanding timelines, and preserve it according to strict retention policies. The Regulation targets faster access for law enforcement while preserving chain of custody, protecting confidentiality, and maintaining auditable records.

To connect these legal workflows to operational systems, ETSI TS 104 144 defines the interface for the eEvidence Regulation and prescribes request and response formats and authentication. This standardization helps ensure that a request issued in one member state can be programmatically consumed and acted on by a provider in another. It also provides a path for CSPs to securely integrate existing systems such as warrant management, mediation, storage, and audit without the cost and complexity of bespoke integrations.

As AI becomes more deeply embedded in lawful intelligence workflows, the security posture of AI components becomes a first-order concern. ETSI TS 104 033 establishes an AI security baseline to ensure the infrastructure that supports eEvidence workflows is secure by default. It sets expectations for protecting models and data, defining security functions and interfaces, and for mitigating threats such as model extraction, poisoning, or inadvertent leakage of sensitive content.

The SS8 platform translates the standards into deployable capabilities, transforming manual email and spreadsheet processes into auditable digital exchanges and ensuring that AI speed and insight coexist with confidentiality and integrity.

Interface Definition for eEvidence: ETSI TS 104 144

By codifying the technical model for exchanging information related to eEvidence orders, TS 104 144 supports parsing and acting on requests without bespoke interpretation. The standardized API and workflow profile at the core of the specification map that information into defined message structures and workflows for tasks such as information requests, preservation orders, and evidence delivery. These measures create a common technical language for satisfying eEvidence requirements, while existing ETSI structures support integration with and reuse of capabilities already deployed for lawful disclosure and preservation.

Standardized interfaces make it easier to automate connection requests to existing lawful intelligence systems and to maintain consistent records across the request lifecycle. As the surrounding eEvidence ecosystem evolves, standardization gives CSPs a more stable architectural target for their infrastructures. The specification also enhances forward-looking cyber posture by defining secure transport using HTTPS and XML-encoded HI-1 messages, with security requirements inherited from ETSI TS 103 120.

Securing AI-Driven Intelligence: ETSI TS 104 033

Using AI systems in lawful intelligence workflows creates complex, hard-to-audit decision pathways that introduce new vulnerabilities and can mask misuse or amplify errors at scale. AI also creates threat exposures such as model poisoning, prompt-based manipulation, and covert data exfiltration. TS 104 033 helps CSPs as well as law-enforcement authorities anticipate and address these threats by specifying security components and functions.

The requirements in the specification are well-aligned with the measures built into the SS8 platform, including identity management and access control, protection of data in transit and at rest, and maintaining a secure audit trail, among others. Extending auditability, these requirements are also aligned with SS8 practices for data governance, including to ensure evidentiary integrity in AI-driven casework. The maturity of SS8 platform security contributes to making AI-oriented protections part of eEvidence readiness, rather than a separate modernization initiative.

Operational Readiness for the e-Evidence Transition

To fulfill the edicts of the EU eEvidence Regulation, CSPs must consistently convert lawful requests into efficient technical processes. In setting requirements for that baseline operational readiness, the Regulation distinguishes between preservation and production orders. Preservation protects information that may otherwise be deleted or become unavailable while an investigation progresses. Production is the subsequent act of identifying and delivering the information covered by an authorized request.

The SS8 platform reflects that distinction by orchestrating preservation and production as separate but connected processes. Retained information can be protected under the appropriate preservation workflow. If production is authorized, the platform can apply the relevant request to the retained data and deliver the requested material. Automated workflows connect data pipelines without chains of manual handoffs that introduce the potential for delay and error in fulfilling an order. Full auditability makes it possible to reconstruct the full sequence of events and processes from receipt of an order through validation, preservation or production, authorization decisions, data handling, and final delivery.

SS8 capabilities for eEvidence fulfillment help CSPs meet legal obligations with secure, efficient operational workflows. Drawing on ETSI standards, SS8 solutions extend beyond regulatory compliance to integrate eEvidence requirements with broader lawful intelligence workflows. As eEvidence readiness moves from theory to policy to operational reality, SS8 is helping organizations prepare before deadlines arrive, instead of scrambling to recover afterward.

About Osman Perksoy

Osman joined SS8 in 2024 and has 33 years of experience in the telecom industry, last 10 years of which were in senior sales positions. He is responsible for Business Development and Sales to CSPs in North America. Prior to SS8, in his role at Telenity as the VP Business Development & Sales, he grew the company's business in the Middle East and Africa regions with leading Mobile Operators. At Sonus Networks, Osman held senior management positions in product management and software development. Osman was part of the ADC Newnet CALEA unit, which got acquired by SS8 Networks after his departure. He holds an Electrical and Electronics Engineering (BSEE) degree from Bilkent University and an MBA from the University of Massachusetts. Learn more about Osman on his LinkedIn profile.

About SS8 Networks

As a leader in Lawful, Location, and Data Intelligence, SS8 is committed to making societies safer. Our mission is to extract, analyze, and visualize critical intelligence, providing real-time insights that help save lives. With 25 years of expertise, SS8 is a trusted partner of the world's largest government agencies and communication providers, consistently remaining at the forefront of innovation.

Discovery is the latest solution from SS8. Provided as a subscription, it is an investigative force multiplier for local and state police to fuse, filter, and analyze massive volumes of investigative data - in real time.

Intellego® XT monitoring, data fusion, and analytics portfolio is optimized for Law Enforcement Agencies to capture, analyze, and visualize complex data sets for real-time investigative intelligence.

LocationWise delivers the highest audited network location accuracy worldwide, providing active and passive location intelligence for emergency services, law enforcement, and mobile network operators.

Xcipio® mediation platform meets the demands of lawful intercept in any network type and provides the ability to transcode (convert) between lawful intercept handover versions and standard families.

To learn more, contact us at [email protected].

Follow us on LinkedIn or X @SS8