all network devices that terminates a subscriber (broadband or mobile) has a feature called LI: https://en.wikipedia.org/wiki/Lawful_interception, which is required by law in almost all countries one requirement is that operation of LI feature is totally separate from normal network operator, so that even normal network admin are not supposed to know what kind of LI operation is ongoing...