1. A method comprising: intercepting data from a communication network, wherein the communication network carries data connections conveying the data, wherein the data relates to users of the communication network, and wherein the data comprises encrypted data; determining or identifying plain data from the intercepted data, wherein the plain data comprises unencrypted data; analyzing the plain data, by an apparatus with a hardware module comprising a processor, to establish one or more selection rules by: detecting predefined criteria, searching the plain data for an IP address allocated to at least one of the data connections, searching the plain data for an association between the predefined criteria and the IP address, upon discovering the searched association, adding the discovered IP address to a selection rule table; selecting a subset of the data connections for selective inspection of encrypted data, wherein the selection is based on the selection rules, wherein selecting the subset further comprises configuring a network switch to forward only the selected subset of the network connections to an inspection device, and wherein configuring the network switch further comprises causing the network switch to distribute the network connections in the subset among multiple inspection devices in accordance with a load balancing criterion; and configuring the inspection device to decrypt the encrypted data conveyed by the data connections in the selected subset.