[This answer](https://security.stackexchange.com/a/11512/7603) to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located relatively close to the victim's device. 

Assuming this scenario, I have the following questions:

* Is the attacker able to intercept only traffic **FROM** the mobile phone or also **TO** the mobile phone? I would imagine that a carrier does not forward SMS or voice calls intended for the victim's device to a fake base station as he knows which base stations belong to his network, isn't it?
* How does the integration of the fake base station into acarrier's network work? I'd assume that there has to be some sort of authentication?