Malaysia’s Waze ban raises national security concerns over location data, Israeli links

SHAH ALAM - Malaysia’s decision to prohibit civil servants from using navigation application Waze has highlighted concerns over national security, data sovereignty and the potential exposure of sensitive government movements, with an analyst warning that the application’s Israeli origins and data-handling arrangements warrant closer scrutiny.

Dr Nirwandy Mat Noordin, an information warfare and security analyst from Universiti Teknologi MARA (UiTM), said the risks extended beyond users’ real-time locations, as accumulated navigation data could reveal recurring destinations, travel patterns and activities involving government personnel.

Nirwandy said the restriction was driven by concerns that information collected through navigation applications could expose sensitive operational details, particularly when used by personnel from security-related agencies and government departments.

Repeated journeys and frequently visited locations could allow external parties to identify routines and destinations. When accumulated over time, such information could provide insights into the operations of government divisions and critical national systems.

Although Waze is owned by Google’s parent company, Alphabet, Nirwandy said its Israeli origins remained relevant to the assessment, including questions surrounding its development, maintenance, upgrades, intellectual property and the legal jurisdictions governing its operations.

“The information potentially collected by Waze and similar applications could include navigation searches, frequently visited locations, user preferences and interactions.

“Other details, such as account information, email addresses, telephone numbers, IP addresses, device identifiers and operating systems, could also contribute to a more comprehensive profile of users.

“Such information could be used for commercial advertising and behavioural analysis, but its potential implications would be more serious if it exposed the activities of government personnel or sensitive agencies,” he told Sinar Daily.

Nirwandy said the central issue was whether Waze’s security controls, encryption standards and data-sharing arrangements were sufficient to protect information from unauthorised access or disclosure.

Without adequate technical transparency, it would be difficult to establish who could access the data, where it was stored and processed, and whether it could be shared with commercial or other parties.

Malaysia’s ban on Waze for civil servants has highlighted national security and data sovereignty concerns over potential exposure of sensitive government movements and activities linked to the app’s Israeli origins and data-handling practices. - AFP FILE PIX

“Data sovereignty was particularly important when information was processed or stored overseas, where it could be subject to foreign laws and jurisdictional requirements.

“If Israeli law applied to certain aspects of the service, Malaysia would need to consider how this could affect access to or disclosure of information belonging to Malaysian citizens and government personnel.

“The level of risk would also depend on the sensitivity of the information involved, ranging from basic personal details to confidential or top-secret material,” he added.

Nirwandy stressed that data collection was not unique to Waze, as many applications gathered information about their users.

The key consideration was whether the safeguards governing the collection, storage, processing and sharing of that information were adequate for applications used by personnel handling sensitive government matters.

Malaysia has several measures to address data protection and cybersecurity, including the Personal Data Protection Act, the Cyber Security Act and safeguards overseen by the National Cyber Security Agency (Nacsa), concerning National Critical Information Infrastructure (NCII).

The government has also introduced the Application Service Provider Class (ASPC) licensing framework under the Communications and Multimedia Act to regulate relevant service providers.

However, Nirwandy said further improvements could be needed to address risks involving foreign-operated applications that handle sensitive information.

He pointed to the United States’ National Institute of Standards and Technology (NIST), which provides technical standards and guidance, including for encryption technologies such as the Advanced Encryption Standard (AES).

“For Malaysia, greater technical clarity is needed to determine whether Waze used appropriate encryption standards, how its data-sharing practices were assessed and whether its security controls underwent independent verification.

“Detailed assessments of Waze and similar applications, including examinations of their encryption mechanisms, data storage arrangements, access controls and the technical and legal safeguards governing information use are needed as well.

“Independent technical audits and a mandatory data-risk classification system could help regulators identify applications requiring stronger protection, particularly those connected to NCII.

“Government agencies should also enforce stricter rules on the use of official devices, access to sensitive data and disclosure of information, with clear accountability for security breaches,” he mentioned.

Nirwandy said Malaysia should reduce its reliance on foreign applications for sensitive government operations by supporting the development of locally owned digital solutions.

The government could provide grants, encourage collaboration with universities and establish dedicated committees to develop secure navigation applications and other essential technologies.

Locally controlled systems, supported by robust encryption and domestic data storage arrangements, could give Malaysia greater control over how sensitive information was stored, processed and protected.

The concerns came after a warning by Nacsa chief executive Dr Megat Zuhairy Megat Tajuddin on Oct 22, that Waze’s terms of service were subject to Israeli law, potentially raising questions about the protection of Malaysians’ location data and daily movements.

A government ban on Waze for civil servants took effect immediately following a circular issued by Chief Secretary to the Government Tan Sri Shamsul Azri Abu Bakar on Oct 20.

Prime Minister Datuk Seri Anwar Ibrahim also encouraged the public to consider TuJu, a local navigation application developed by the Malaysian Highway Authority (LLM), as an alternative.

Nacsa’s warning on October 22 also highlighted the potential for artificial intelligence (AI) to increase the risks associated with tracking civil servants’ locations, routes and routines. Megat urged Malaysians to uninstall Waze to protect their personal data.

Nirwandy’s assessment pointed to the need for stronger data sovereignty, regulatory oversight and independent technical verification.

While the ban addresses immediate concerns over civil servants’ use of Waze, broader risk-based controls and secure local alternatives could help Malaysia better protect citizens’ information and sensitive government operations.