A system that enables hanging lawful interception (LI) resources to be cleaned up includes a triggering function set comprising a plurality of triggering functions. The system also includes a data store comprising a plurality of auditing records corresponding to the plurality of triggering functions in the triggering function set. Each auditing record comprises a claimant attribute. Each triggering function sends an update request to the data store in response to being notified about a failed triggering function within the triggering function set. Each update request comprises a request to change ownership of the auditing record corresponding to the failed triggering function. A triggering function is selected as a new owner of the auditing record corresponding to the failed triggering function based at least in part on a match between the claimant attribute in the auditing record and a claimant field in the update request sent by the triggering function.