The provider must authorize the interception.
The person intercepting is acting under color of law.
The communications are relevant to an ongoing investigation and
No communications other than those sent to or received by the trespasser are intercepted.
Provider immunity under 18 U.S.C. 2520(d)(1)
Good-faith reliance on court order, warrant, legislative or statutory authorization is a complete defense (civil and criminal)
May combine this authority with other exceptions, such as consent.