It depends on your carrier's technology. According to Wikipedia all the encryption used in GSM (A5/1, A5/2 and A5/3) have been cracked (albeit some are more difficult to decrypt than others). A5/2, the least secure of these, is no longer in any GSM-related standards (and newer phones shouldn't implement it). A5/3 has not been decrypted in 3G, but people have cracked it.
GPRS and EDGE (GSM's data protocols) - the "G" or "E" above your network signal status icon - may also be vulnerable. It depends on your carrier's encryption level. Some carriers don't encrypt GPRS data at all. Others will use the GEA/1 or GEA/2 - which both have a publicly available tool called "gprsdecode" available to crack them. GEA/3 is "relatively hard to break", but the recommendation is to upgrade to GEA/4, which uses 128-bit encryption. UMTS (aka 3G) is more secure, meaning that your data is safely encrypted.
To be certain that you're actually using your carriers network, your carrier needs to have implemented USIM, and your phone needs to support it - which is guaranteed if your carrier supports UMTS and your phone supports 3G. However, to get these additional security features you need to use UMTS - which means your phone can't be on "prefer 2G networks" mode, and your phone can't connect to 2G networks.
Now, as for "doing nasty things while your phone is off" - I really don't think this is possible, but perhaps you can clarify what these "nasty things" are? And also perhaps where you've read about this.
TL;DR depends on your carrier and if you use 2G networks or 3G networks.