The difficult part to intercept is the radio link between the handset and the cell. However the rest of the connection is over good old copper/fibre/satellite using normal phone techniques and can be easily monitored, including information such as dialled digits.
So rather than have expensive radio monitoring kit I would guess they log onto the exchange and use the engineering commands.