I don‘t know about 3G, but I just checked for LTE [1] and the timing is broadcasted in SIB16, which is not encrypted, so theoretically anything could pick it up.

[1] https://www.etsi.org/deliver/etsi_ts/136300_136399/136331/11...