Another "natural" direction would have been to work on the security of smartphones.
I have a ADALM-PLUTO sdr that can do duplex from 70MHz-6GHz. Only 5mW (7dBm) Tx.
But there is a Gnu Radio gr-gsm and gr-lte plugins to make your own client (cell phone) and server (tower). There was also a nice talk at DerbyCon that went further in what you need to do to handle tower ops.