Question: In a Lawful Interception (LI) scenario, as per 3GPP security standards, what happens to incoming intercepted data at the Mediation Function (MF) if the receiving end system (Law Enforcement Monitoring Facility - LEMF) is down for an extended period?
Option 1: The MF will continuously buffer the data until the LEMF is back online, ensuring no data loss.
Option 2: After initial buffering at the MF, incoming intercepted data will be discarded until the LEMF or transit network is operational again.
Option 3: The intercepting nodes will temporarily halt sending new intercepted data to prevent overflow at the MF.
Option 4: The LI system automatically switches to a backup LEMF to maintain uninterrupted service.
Explanation: This option correctly reflects the procedure for handling an extended downtime of the LEMF or transit network. Initial local buffering at the MF provides temporary relief, but prolonged downtime necessitates discarding incoming intercepted data to prevent overflow, until the system is restored. This ensures system integrity and prevents data loss due to buffer overflow when the LEMF comes back online.