ZCS Administrator's Guide Network Edition 6.0, Rev 1

Legal Intercept for Law Enforcement

Legal Intercept attributes

Configuration

The ZCS legal intercept feature is used to obtain copies of email messages that are sent, received, or saved as drafts from targeted accounts and send these message to a designated “shadow” email address. Legal Intercept can be configured to send the complete content of the message or to send only the header information. When a targeted account sends, receives, or saves a draft message, an intercept message is automatically created to forward copies of the messages as attachments to the specified email address.

Legal Intercept attributes

The legal intercept feature can be configured either for a Class of Service or for individual accounts. The feature is configured from the CLI, using zmprov.

The following attributes are used to configure the feature:

 

zimbraInterceptAddress	Intercepted messages are sent to this address. When this attributes is empty, legal intercept is off. You can have multiple recipients for an intercepted message
zimbraInterceptSendHeadersOnly	The default is False. Change to True to have only the message headers sent, not the message body
zimbraInterceptFrom	Used to construct the From: header content used in the intercept message. The default is Postmaster@<address.com>
zimbraInterceptSubject	The template used to construct the subject -line the intercept message should show. The default subject line reads “Intercept message for account@example.com <intercepted message subject>”
zimbraInterceptBody	The template used to construct the body of the intercept message. The default message is “Intercepted message for <account@example.com. Operation=<type of message>, folder=<folder>, folder ID=<#>.”

The following parameters can be used in the From, Subject, and Body templates to modify the default intercept message:

•	ACCOUNT_DOMAIN. Domain of the account being intercepted.

•	ACCOUNT_ADDRESS. Address being intercepted.

•	MESSAGE_SUBJECT. Subject of the message being intercepted.

•	OPERATION. Operation that the user is performing, “add message”, “send message”, or “save draft”

•	FOLDER_NAME. Name of the folder to which the message was saved.

•	FOLDER_ID. ID of the folder to which the message was saved.

•	NEWLINE. Used for formatting multi-line message bodies.

Configuration

The only required configuration to setup legal intercept is to enable the feature on the target accounts. You can enable the attribute to send only the header information of the email message, not the complete message.

The default intercept cover email message and the name in the From field can also be modified.

How to set up legal intercept

1.	Define the intercept address

•	If enabling by COS, type zmprov mc <cosname> zimbraInterceptAddress <account@intercept_example.gov>

•	If enabling by account, type zmprov ma <accountname@domain.com> zimbraInterceptAddress <account@intercept_example.gov>

If you are going to use the default intercept message template and From name, legal intercept is set up.

To enable the attribute so that only header information is forwarded, go to step 2.

To modify the attributes of the intercept message continue with step 3.

2.	To send only the header information, not the complete message, type

 

zmprov ma <accountname@example.com> zimbraInterceptSendHeadersOnly TRUE

3.	To change the From name, type

 

zmprov ma <accountname@example.com> zimbraInterceptFrom <newname@example.com>

4.	To change the text of the Subject line, type

 

zmprov ma <accountname@example.com> zimbraInterceptSubject <Intercepted message subject text> parameter parameter

5.	To change the text in the message body, type

 

zmprov ma <accountname@example.com> zimbraInterceptBody <Intercepted message text> parameter <text> parameter

Note: To modify by COS, type zmprov mc.

ZCS Administrator's Guide Network Edition 6.0, Rev 1