Thanks to Snowden we know the NSA backdoor crypto code and have leverage over the telcos to get the help they need. We also know that solutions are plausibly deniable as far as the big name companies that we know about. So the same thng could go on here.

If I had to put this in place I would get something that worked even if there were no cellphone masts in the area. Get the radio to listen to something entirely different, broadcast from some box that could be put in a car or in one of those electronic listening planes the military have. Have it work at the radio level on the phone so the cpu does not need to be used. The reply could be an entirely different identifier to the IMEA or SIM identifier with it being a simple database 'select' to get these codes.