3G uses the KASUMI or A5/3 cipher which was shown to be easily broken in in 2010 (two hours on a PC via a related key attack):

>we have actually simulated the attack in less than two hours on a single PC, and experimentally verified its correctness and complexity. Interestingly, neither our technique nor any other published attack can break MISTY in less than the $2^{128}$ complexity of exhaustive search, which indicates that the changes made by the GSM Association in moving from MISTY to KASUMI resulted in a much weaker cryptosystem. - http://eprint.iacr.org/2010/013

This is actually far worse than cell site simulation because it is a passive attack and so is totally undetectable. You could just setup recording equipment, hide them in a van and start decrypting conversations. Given how much weaker KASUMI is from MISTY is seems possible this was a backdoor engineered by an intelligence agency. If so, it certainly tells the lie to NOBUS (no one but us).

Odd how the GSM association always generates breakable ciphers.