Methods and network devices implement a lawful interception (LI) trigger control function as an LI target handler and a modified trigger control function. A generic LI triggering interface enables the modified trigger control function to query the LI target handler regarding whether entities using a network function instance are in a target list. The LI target handler has to meet the LI security requirements, but the modified trigger control function does not have to meet such requirements.