← All insights
compliance mandates6 min read

VoLTE S8HR and the intercept blind spot in 5G voice roaming

VoLTE roaming architecture involves a choice that has significant lawful intercept implications: Local Breakout (LBO), where the voice session is handled by the visited network's IMS, and S8 Home Routed (S8HR), where the session is anchored in the home network's IMS and the visited network carries only the user plane traffic. The industry has moved predominantly toward S8HR for commercial and quality reasons. The intercept architecture implications of that choice have not received equivalent attention.

What S8HR means for intercept

In an S8HR deployment, the visited network (VPLMN) carries the user plane traffic for the inbound roamer's voice sessions, but the signalling — SIP, SDP, IMS control — flows through the home network's IMS. The VPLMN intercept system sees IP packets; it does not see the call signalling that would allow it to identify a session as a voice call, associate it with a target identifier, or capture call-identifying information (call parties, time, duration).

The result is that a VPLMN with a warrant for an inbound roaming subscriber — which may arise from a national warrant covering foreign visitors or from a mutual legal assistance request — can capture user plane packets but cannot produce the complete IRI record that most LI delivery standards require. The call metadata that gives the intercept its investigative value is in the home network.

The compliance question for visited networks

Whether the VPLMN has an obligation to intercept voice sessions from inbound S8HR roamers depends on the national framework. Some frameworks impose an intercept obligation on any carrier whose infrastructure carries the traffic, regardless of where the signalling is processed. Others limit the obligation to telecom operators that process the signalling layer. The VPLMN that carries S8HR user plane traffic may or may not have a full LI obligation under its national law — and the answer varies by jurisdiction.

For most VPLMN operators, the practical question is whether their LI system can distinguish S8HR voice sessions from other IP traffic and whether they have a mechanism to obtain the missing call-identifying information from the HPLMN. Neither capability is commonly deployed. The result is that S8HR voice intercept, where the obligation exists, is typically incomplete.

Addressing the gap

The 3GPP specifications address VoLTE roaming intercept through the Roaming Intercept (RICI) mechanisms in TS 33.127, which define how the HPLMN can be triggered to deliver IRI for roaming sessions. This requires implementation by both the HPLMN and VPLMN and a bilateral interface between them. Very few operator pairs have implemented this capability.

Operators should review their bilateral roaming agreements with the largest partner relationships to understand whether S8HR is the predominant voice roaming architecture and, if so, whether the RICI mechanism or an alternative approach is needed to address intercept obligations. Where the obligation is clear and the technical capability does not exist, a remediation plan — and disclosure of the gap to regulatory contacts — is the appropriate response.

Yaana Technologies

Ready to audit your intercept stack?

Talk to the Yaana team about secure-by-design infrastructure for your network.

Request a Meeting →