A friend is a network engineer who has worked on some big UK ISP projects and he says that all had a requirement to mirror traffic and make it available to an external undocumented point/body. It's just understood that it's the security services.