Changes to Google Pen Registers & Live Intercepts

Google has recently changed the way they deliver target data on legal requests for live intercepts. This change affects content from live intercepts such as Gmail pen registers, Google Voice, and other google services. Instead of sending data in email, Google is now using the ETSI 102 232 CALEA standard-based intercept, which affects how the data is stored and accessed.  

PenLink’s PLX Intercept system has already accommodated this change and is available for those agencies that need a tool to analyze and view pen register and live intercept data from Google in the new format. 

What the shift to the CALEA standard means for agency IT teams: 

  • – Agencies that collect live telephonic data are likely already familiar with CALEA standards. 
  • – To receive live intercept data from Google, agencies now need a TLS connection to Google instead of the previous site-to-site VPN.  
  • – Free tools such as REBEX are available to facilitate the secure socket TLS connection. 
  • – A self-signed certificate is needed for the collection server.  
  • – Technical support is available from PenLink to set up the new connection. 

How this change affects investigators and analysts: 

  • – It is no longer possible to manually view pen register and intercept data from Google in .msg or .eml files. 
  • – Agencies can use PenLink’s PLX Intercept System to analyze and view data delivered in the new format. 
  • – Historical records are not affected by this change.  

How this change affects investigators and analysts: 

  • – PLX PRO can still be used to analyze historical Google data. 
  • – PLX Intercept is available for agencies that are running Gmail and Google Voice pen registers and live intercepts. 

For more information about capturing and processing live Google data, you can watch the on-demand webinar at www.penlink.com/GoogleData or contact [email protected]. 

For more information about PenLink’s intercept capabilities, or for technical assistance setting up your agency’s TLS connection, contact [email protected].