There's ways [1] to set up a rogue BTS / IMSI catcher that is seemingly legal [2] - by using US amateur radio bands (that are used as GSM bands in other parts of the world), not using encryption and spitting out your callsign once in a while.
Sometimes there are reserved parts of the spectrum for test networks you can get assigned for a limited time, the CCC had a GSM (and some 3G I think) network for many years.
[1] - https://www.youtube.com/watch?v=xKihq1fClQg
[2] - You should not take legal advice from strangers on the Internet.