Is it possible to catch all radio emissions from a device? Idea would be to buy a fresh Jolla and a starter/pay as you go sim card. Stand at the entrance to the Ecuadorian embassy in London and insert it. If one could catch unexpected radio chatter, would prove Qualcomm drivers are iffy, no? (probably everybody is aware of US equipment they planted there that was misconfigured and welcomed everybody to Uganda, we can expect attack or maybe just a wakeup call there)

Edit: to elaborate, I believe NSA(GCHQ) have a weakness, we know who they target. If you do such test with nexus/galaxy/iphone/lumia we could at least dismiss the notion of backdoor (if they have all UK carriers providing them with full access this won't help a lot, but next to a red-hot target I would assume they will try to backdoor, then again it might be in do-not's of spying, Uganda would suggest they follow flaky procedures though)