Another option would be to define an "interception" in a database of
sorts (rdbms or otherwise), and have every IAP source independently
check that database periodically (frequently), and take appropriate
action (eg. start/restart/stop an intercept, and send CmII events).
There would still need to be an interface (possibly gui?) to define an
intercept, and if each data source logged info it could also be used as
part of the "secure and accurate record" we keep.
Ideas for other options are certainly welcome.