Ordinance
on the Surveillance of Post and Telecommunications
(SPTO)

¹ Sur­veil­lance Type RT_24_TEL_IRI com­prises the real-time mon­it­or­ing of a tele­phony and mul­ti­me­dia ser­vice and, if ap­plic­able, the real-time mon­it­or­ing of con­ver­ging ser­vices, in par­tic­u­lar SMS, voice mail and RCS.

² The fol­low­ing sec­ond­ary tele­com­mu­nic­a­tions data of the tele­com­mu­nic­a­tion that is sent, pro­cessed or re­ceived via the ser­vices un­der sur­veil­lance must be trans­mit­ted in real time:

a.

the date and the time of log­ging-in and log­ging-out pro­cesses and their res­ult;

b.

the AAA in­form­a­tion used by the ser­vices un­der sur­veil­lance and the in­form­a­tion on re­gis­tra­tion and sub­scrip­tion events and the cor­res­pond­ing re­sponses, in par­tic­u­lar the sub­scriber iden­ti­fi­er (e.g. SIP URI, IMPI) and the IM­SI in the case of mo­bile ser­vices or the SUPI and if ap­plic­able, the cus­tom­er’s and serv­er’s IP ad­dresses and port num­bers as well as de­tails of the pro­tocol used;

c.

the sig­nalling in­form­a­tion, in par­tic­u­lar on the serving sys­tem, on sub­scriber status and on ser­vice qual­ity;

d.

if ap­plic­able, the pres­ence in­form­a­tion;

e.

in the case of com­mu­nic­a­tions, com­mu­nic­a­tion at­tempts and tech­nic­al modi­fic­a­tions (e.g. in­clu­sion of ad­di­tion­al ser­vices, in­clu­sion of con­ver­ging ser­vices or change to con­ver­ging ser­vices, changes in net­work ac­cess tech­no­logy, loc­a­tion up­dates), if ap­plic­able:

1.

their type, the date and the time of their start and if ap­plic­able their end,

2.

the ad­dress­ing re­sources (e.g. MS­ISDN, GP­SI, E.164-num­ber, SIP URI, IM­PU) of all sub­scribers in com­mu­nic­a­tion and their role,

3.

the ac­tu­al known des­tin­a­tion ad­dress and the avail­able in­ter­me­di­ate ad­dresses where the com­mu­nic­a­tion or the com­mu­nic­a­tion at­tempt is di­ver­ted or for­war­ded,

4.

the unique device iden­ti­fi­ers in ac­cord­ance with in­ter­na­tion­al stand­ards for the ter­min­al devices of the ser­vices un­der sur­veil­lance (e.g. IMEI, PEI, MAC ad­dress),

5.

the oth­er avail­able iden­ti­fi­ers,

6.

the reas­ons for the ter­min­a­tion of com­mu­nic­a­tion or its non-ma­ter­i­al­isa­tion or for the tech­nic­al modi­fic­a­tion,

7.

the sig­nalling in­form­a­tion on ad­di­tion­al ser­vices (e.g. con­fer­ence calls, call for­ward­ing, DTMF),

8.

the status of the com­mu­nic­a­tion or of the com­mu­nic­a­tion at­tempt,

9.

in the case of mo­bile ser­vices: in ad­di­tion the cur­rent loc­a­tion data in ac­cord­ance with Art­icle 54 para­graphs 2 let­ter h and 3 de­term­ined by the net­work if pos­sible and in­dic­ated ac­cord­ingly;

f.

in the case of mo­bile ser­vices: ad­di­tion­al in­form­a­tion about the pre­vi­ous and cur­rent net­work provid­ing the ser­vice, any change in the as­signed ser­vice and device iden­ti­fi­ers, loc­a­tion-re­lated events and if ap­plic­able their reas­on, any change in the net­work ele­ment provid­ing the ser­vice, and iden­ti­fic­a­tion and au­then­tic­a­tion events in­volving the tar­get.