There is reason to believe phones have been remotely hacked by law enforcement using carrier credentials to leave the cellular radio running and registering with the cell network even after the off button has been pushed and the phone appears to be off.
Starting point for further reading: http://www.brighthub.com/electronics/gps/articles/51103.aspx