If you really want to do this and fool wireless location, I wonder if a client running at the "real" location can run something like airodump-ng and send the re

If you really want to do this and fool wireless location, I wonder if a client running at the "real" location can run something like airodump-ng and send the received (B|E)SSIDs to the remote end where a fake AP spoofs them. You don't actually need to break any crypto to do this, simply broadcast the same networks with the same security parameters (even if the key itself is different). Signal strength will be an issue but it's probably still good enough to fool the system into returning an inconclusive result. Tampering with the wireless card to prevent it from receiving anything is also a solution.