Comment 3 for bug 391154

Looking at the source code for version network-manager-0.7.1~rc4.1.cf199a964, found in jaunty:

The first message is logged by nm-manager.c:hal_manager_rfkill_changed_cb().

This function is registered as a callback function for the signal "rfkill_changed". The signal in turn is fired by the function nm-hal-manager.c:killswitch_getpower_done(), which is registered when the dbus_g_proxy_begin_call() is made to send the GetPower DBUS request to Hal for a single device's killswitch state. The problem is, NetworkManager only keeps a single per HalManager instance of the rfkill state. See nm-hal-manager.c:NMHalManagerPrivate. So as soon as one active kill switch is found, "rfkill_changed" is fired, which results in hal_manager_rfkill_changed_cb disabling wireless.

Game over. I verified that this code still exists as is in 0.7.1 final.