Lawful interception is the system inside a telecom operator's network that lets a government agency, with a legal order, receive copies of one person's calls, messages and data, and see roughly where the phone is. It is also called legal interception, or simply phone tapping. In India, every operator must build it into its network as a condition of its licence.
An order to intercept is normally signed by the Union Home Secretary, or by the Home Secretary of a state. It must name the phone numbers and give the reason, such as public safety or the security of the country. In an emergency, when the Home Secretary cannot issue the order in time, the head of the agency or its second most senior officer may issue it. In a state, that officer must be at least an Inspector General of Police. The Home Secretary must then confirm the order within seven working days, or the interception stops. The rules are now set under the Telecommunications Act, 2023. A review committee of senior officials checks the orders. An order lasts up to 60 days, and it can be renewed up to a total of 180 days.
Here is a typical case. Police in Jaipur are investigating a kidnapping. The kidnapper calls the family from one mobile number to demand a ransom. The police obtain an order for that number. An employee in the operator's interception team enters the number into the lawful interception system. Only a small number of security-cleared staff can do this, and the system logs every entry.
From then on, the system watches for that number. When the number makes or receives a call, the operator's voice switches and packet core make a copy of the call. The call itself goes through as usual. Neither the caller nor the person called can notice anything. The system sends two kinds of copy to the agency's monitoring centre. The first is the call details: which number called which, when, for how long and through which tower. The second is the content: the voice itself, or the text of an SMS. The position of the tower tells the police roughly where the phone was.
For mobile data, the system copies the target's internet traffic. Deep packet inspection (DPI) can help pick out which sessions belong to which app. But most apps now use encryption. So the copy often shows only which services the phone connected to, and when, and not what was written inside them.
Lawful interception is monitoring, not defence. It does not protect the network from attackers. Some companies that build it also build security tools that use the same skill of copying traffic at high speed. One such tool is network detection and response (NDR), which watches a company's own network for attackers. Lawful interception, in contrast, serves only government agencies, and only for the numbers named in an order.