We've had the $$$$$$ scenario for air interception. The MW interception - again not the easiest, but the simple fact remains, the guy in the switch in these countries is paid peanuts. How little cash compared to the first two scenarios could change his life? Thats where your leak is -guaranteed.
Monitoring xxx interface to the BTS/Node B is all it takes. And thats giving no secrets, if you are capable of operating the commercially available equipment, you already know where to plug it in.