If it's an RF based system, not that hard. Take a laptop, add mapping software, plug a scanner into the line in, use a software radio modem (or a real radio modem) and just listen on the transmitting frequency. Most likely, you'll start hearing the different units with the AVL system sending an NMEA sentence to the controller. As long as it's not encrypted or sent through something like a cell network card, you can probably pick it up and find them, but there's a lot of variables in the mix as well.
The system mentioned in the article sounds a lot like a system Motorola is pushing that uses a GPS-enabled remote speaker-mic to send location data. That would go over the systems control channel (seems like it's only available on digital trunk systems). That system would send each time they key the mic, on a timer basis, and when polled by dispatch.