Now on the backend channel issue I don't know exactly how they do it but the fact remains that I've seen this in action and I saw the box (Hughes SD Tivo) in person during the test and let me say quite clear that no wireless, ethernet nor phone connection was present period. The only ports that had something plugged into them was the two SAT feeds and the red, white and yellow video cables. Besides those ports and the power cable nothing else was plugged into this box. When the box tried to make its phone call it changed the channel on tuner 1 and the screen said sending data....please wait. Once it finished it said complete and said to press select or it would go back to the original channel in 15 seconds. I can't quite remember the test channel number but it was in the 1000s and it was labeled bcknd but beyond
that I don't know how exactly it works.
Sorry, that's not possible -- there is exists no physics to support what you described. There was something else going on that is not in your description. I'm an RFIC Research Scientist, with extensive satellite experience, and competent to call you on this one.