Methods, devices relating to lawful interception

A Lawful Interception Administration Function, LI ADMF device comprising a memory and a processor, the memory containing instructions which when executed on the processor, cause the LI ADMF device to:

• send to a Network Repository Function, NRF, a discovery request message for discovering at least one Network Exposure Function, NEF, device and at least one Application Function, AF, device served by the NEF device;
• receive from the NRF, a discovery response message comprising information about the NEF device and information about the AF device, served by the NEF device;
• receive from a Law Enforcement Agency, LEA, a first request message for subscribing to a notification of at least one event for monitoring a list of applications for at least one user equipment, UE, wherein the notification of the event is provided by the AF device and wherein an application in the list is either determined to pose a threat to the UE or is trusted by the UE;
• send a second request message, to a NEF device which comprises an Intercept Related Information Point of Interception, IRI-POI, to subscribe to the notification of the event, wherein the NEF device is identified based on the information comprised in the discovery response message;
• and
• receive a subscribe response message from the NEF device confirming the subscription to the notification of the event.