[alexwright]

The radio interface could listen/wait without even replying, ie wouldn't make the GSM RFI speaker noise. If governments, carriers and law enforcement could all manage to use this so incredibly rarely that it's never been observed.. then it could be real.

Given the types of people that would have to have access / knowledge of this though. For example people that suspect their partner of infidelity and is on the police liaison team of a carrier say...

I agree it's very unlikely, someone would have noticed it by now.

[alandarev]

Oh, that is a fair point.

Though, not receiving any information back, draws the tracking practice significantly more difficult.

[Theodores]

It need only reply if it is requested to do so, therefore for 99.9 recurring percent of the time there need be nothing observable.

[alexwright]

Or reply in some side channel, piggy back the next (expected, ie when the user has switch back to normal mode) UMTS radio packet for example. I don't know the packet structure but I expect there are areas that could be re-purposed covertly. We did after all fit the entire SMS system into such a space.