(1) A public telecommunications network or a telecommunications service has an interception capability if every surveillance agency that is authorised under an interception warrant or any other lawful interception authority to intercept telecommunications or services on that network, or the network operator concerned, is able to—
(a) identify and intercept telecommunications without intercepting telecommunications that are not authorised to be intercepted under the warrant or authority; and
(b) obtain call associated data relating to telecommunications (other than telecommunications that are not authorised to be intercepted under the warrant or authority); and
(c) obtain call associated data and the content of telecommunications (other than telecommunications that are not authorised to be intercepted under the warrant or authority) in a format that is able to be used by the agency; and
(d) carry out the interception of telecommunications unobtrusively, without unduly interfering with any telecommunications, and in a manner that protects the privacy of telecommunications that are not authorised to be intercepted under the warrant or authority; and
(e) undertake the actions referred to in paragraphs (a) to (d) efficiently and effectively and,—
(i) if it is reasonably achievable, at the time of transmission of the telecommunication; or
(ii) if it is not reasonably achievable, as close as practicable to that time.
(2) If a network operator, or an employee or agent of a network operator, undertakes the interception of a telecommunication on behalf of a surveillance agency under subsection (1), the interception must be taken to be complete when the network operator provides the call associated data or the content of the telecommunication, or both, to the surveillance agency.
(3) A network operator must, in order to comply with subsection (l)(c), decrypt a telecommunication on that operator's public telecommunications network or telecommunications service if—
(a) the content of that telecommunication has been encrypted; and
(b) the network operator intercepting the telecommunication has provided that encryption.
(4) However, subsection (3) does not require a network operator to—
(a) decrypt any telecommunication on that operator's public telecommunications network or telecommunications service if the encryption has been provided by means of a product that is—
(i) supplied by a person other than the operator and is available on retail sale to the public; or
(ii) supplied by the operator as an agent for that product; and
(b) ensure that a surveillance agency has the ability to decrypt any telecommunication.