I used to work for a company contracted to a major US Telecom to provide certain SMS related network services. There were basically zero protections on user data. Anyone who wanted to could watch the stream of SMSs go by.