Abstract: An example apparatus is provided that includes a processor and a memory storing executable instructions that in response to execution by the processor cause the apparatus to at least perform a number of operations. The operations include receiving a communication including an application protocol primitive that itself includes protocol information element(s). The operations also include comparing the application protocol primitive to a protocol document type definition (DTD) including a plurality of elements, and lawful interception attribute(s) for one or more of its elements. The application protocol primitive is compared to the DTD to identify lawful interception attributes of protocol information element(s) of the primitive. The operations also include preparing one or more of the protocol information elements for transmission to an interception monitoring facility according to the lawful interception attributes of the respective protocol information element(s).