Presumably because he was connected to the 3G (or other data) network. Unless he can run tcpdump on the iPhone itself or become a man in the middle between the

Presumably because he was connected to the 3G (or other data) network. Unless he can run tcpdump on the iPhone itself or become a man in the middle between the iPhone and the data network, he couldn't capture traffic. An interesting test would be to connect the iPhone to a regular wireless router, measure the activity, then compare that to billing activity. Although my Android Galaxy S, for example, connects to the data network to look for updates even though it is connected to a wireless network -- so this test could be moot.