Ars Technica: Apple responds to Congress, swears location data is private

Since iOS 3.2, however, Apple has used its own database of known cell tower and WiFi hotspot locations to assist in determining a particular device’s location, especially for devices that lack separate GPS hardware.

That explains how they know where my Time Capsule is even though it's wireless network is closed, encrypted and transmits at low power. The 'spy' is an insider, my iPhone, rather than a Skyhook or Google van.

A problem with this WiFi network location system is that my Time Capsule travels with me. Here I am in Germany and my iPhone thinks it's still in Cambridge. Note: my iPhone has its cellular network radio turned off (Airplane Mode).

Interestingly, iOS 4's automatic clock setting is correctly put me on European time. I would guess that the location for determining the time zone is found by IP address when querying the time server.