What is real-time surveillance (Echtzeitüberwachung), how does it differ from retroactive surveillance, and what authorisation does it require?
It targets one subscriber (one SIM) and intercepts all incoming/outgoing communications live — both metadata AND content — plus the serving antenna's ID, location, and azimuth. Unlike retroactive surveillance, it must be ordered by the coercive-measures court (Zwangsmassnahmengericht).
* Rueckwirkend = Metadaten + Polizei; Echtzeit = Inhalt + Gericht. *
The target is again a single subscriber (one SIM), but now monitored live. It intercepts all incoming and outgoing communications — call, SMS, and data — capturing both the metadata and the content, plus the serving antenna's ID, location, and azimuth. Capturing the actual content is the crucial escalation over retroactive surveillance, which only ever sees metadata.
Because content interception is so intrusive, it must be ordered by the coercive-measures court (Zwangsmassnahmengericht) — a judge, not merely the police. It is reserved for high-stakes work, typically organised crime (drug networks, smugglers, human trafficking, terrorism), where the goal is to map the structure of a criminal network and find its drop-off points, storage, and hideouts.
It is used sparingly for three converging reasons:
- High legal hurdle — it needs a court order, not just a police decision.
- Very high cost.
- Labour-intensive analysis — a live content stream must be processed and evaluated in real time.
Tip: The retroactive-vs-real-time distinction is the spine of this topic: retroactive = past + metadata + police-level authority; real-time = live + content + court order. Content interception is always the high bar.
Go deeper:
Lawful interception (Wikipedia) — the ETSI handover architecture and the real-time vs retained-data split.
Lawful Interception of VoIP networks (22C3, media.ccc.de) — how live content-interception equipment is built into a carrier's network.