Malaysia’s Waze Warning Raises Bigger Questions About Digital Security

The government’s move to steer civil servants and motorists away from Waze has put data privacy and digital sovereignty in the spotlight. But as local alternatives try to catch up, the debate extends well beyond the origins of a popular navigation app.

These days, it’s genuinely hard to even imagine trying to navigate the bewildering maze of roads in and around Kuala Lumpur without some sort of assistance. For millions of Malaysian motorists, Waze is that trusted assistant, and has become almost as essential as a phone charger. It is the familiar voice guiding drivers through Kuala Lumpur’s traffic, flagging accidents, warning of roadblocks, and suggesting alternative routes when the morning commute grinds to a halt. Asking people to abandon it is therefore likely to be met with resistance, particularly when the recommended alternatives are still developing.

Yet that is precisely what the government has encouraged following Prime Minister Anwar Ibrahim’s concerns about the navigation app’s Israeli origins and, he also suggests, the potential security implications of the information it collects.

On October 20, 2026, the National Cyber Security Committee, chaired by Anwar, decided to prohibit civil servants from using Waze. The directive was communicated to government departments the following day, with the National Cyber Security Agency (NACSA) designated to coordinate its implementation. Anwar also urged Malaysians more broadly to stop using the application and consider locally developed alternatives, particularly TuJu, a navigation platform developed by the Malaysian Highway Authority.

The government’s position is rooted in the fact that Waze Mobile Ltd. is incorporated under Israeli law and that its terms of service place contractual disputes under the jurisdiction of courts in Tel Aviv. Given Malaysia’s longstanding support for the Palestinian cause and its lack of diplomatic relations with Israel, the political sensitivities are hardly surprising.

But the decision also raises a wider question that deserves consideration: how much control should a country have over the personal and operational data collected by the foreign technology platforms that its citizens and public institutions rely upon?

There is quite likely a legitimate discussion to be had about that, and navigation applications are an interesting place to begin.

LOCATION DATA IS A SECURITY ISSUE

Waze was developed in Israel and subsequently acquired by Google in 2013 for approximately US$1 billion. It remains operated by Waze Mobile Ltd., an Israeli-incorporated company within the Google group. Its popularity rests largely on its community-driven model, which combines mapping technology with information contributed by drivers to provide real-time traffic updates, road hazards, accidents, and estimated journey times.

That functionality depends on collecting information. According to Waze’s published privacy policy, this includes location and route data, GPS and device sensor information, timestamps, IP addresses, search activity, and certain device-related details. Depending on account and device settings, location information may also be collected when the application is not actively being used.

This is hardly unusual for a navigation platform. Indeed, location data is fundamental to how these services operate. The more useful the application becomes, the more information it needs to understand where users are, where they are going, and what is happening along the way.

The potential security implications are worth examining. Repeated location records can reveal patterns of movement, regular destinations, working routines, and associations. In the case of individuals employed in sensitive government departments, security agencies, or critical infrastructure, such information could potentially provide insights that go beyond ordinary navigation.

The government’s concern is, therefore, not inherently unreasonable when viewed through this lens. Its cybersecurity agency has outlined several factors that should be considered when assessing third-party applications, including the categories of information collected, permissions granted, where data is processed, how long it is retained, whether it is shared with other parties, and the security measures protecting it.

However, an important distinction needs to be made between the collection of location information and the suggestion that such information is being passed to, or exploited by, a foreign government. Simply put, evidence suggests that such a connection does not exist.

Indeed, Waze has flatly rejected allegations that it collects sensitive government information or permits personal data to be exploited, saying its privacy policies protect users and comply with international data protection standards. Its published policy also explains that information may be shared with Google affiliates and service providers for operational and service-improvement purposes.

The company’s assurances do not, by themselves, settle the question of data security. Equally, the fact that Waze is incorporated in Israel and subject to Israeli law does not establish that the Israeli government has access to Malaysian users’ movements or is in any way monitoring them. No publicly presented evidence has demonstrated such activity.

Many of the apps and tech gadgets we use on a daily basis are from companies located in other countries. Those companies’ own agreements and terms of service similarly indicate that contracts and disputes are bound by the laws of the countries in which they are based. Google, Apple, Microsoft and many others are all headquartered in the United States, so they are subject to US law, and they must comply with applicable US laws and regulations, including laws governing privacy, national security, law enforcement access, and data protection. That doesn’t mean they automatically share information with the US government as a matter of practice; it’s just a matter of corporate jurisdiction.

It’s important to users to understand that distinction. A government can reasonably assess the risks associated with a foreign technology provider without assuming that the provider’s country of origin is proof of hostile intent.

THE CHALLENGE OF FINDING A BETTER ALTERNATIVE

For most motorists, the immediate question is considerably more practical: what replaces Waze?

The Malaysian government has pointed to TuJu, which was developed by the Malaysian Highway Authority in collaboration with a private technology consortium. Launched in November 2025, the application provides route information, estimated arrival times, toll details, traffic updates, access to highway CCTV feeds, and information about rest areas and emergency assistance.

It is a worthwhile local technology initiative, but TuJu was originally conceived primarily as a tolled highway information and monitoring platform. Its coverage and functionality are still being expanded to include ordinary roads, a necessary step if it is to become a comprehensive navigation option for everyday motorists.

That major difference (and, most would argue, shortcoming) helps explain some of the less-than-enthusiastic reactions from early users. Drivers accustomed to Waze expect detailed coverage, reliable estimated journey times, rapid rerouting, and a substantial community of contributors reporting accidents, congestion, road closures, and hazards. These features have been refined over many years and benefit from a large, active user base.

Building a comparable service takes time. A navigation application needs accurate mapping, dependable infrastructure, regular updates, and enough active users to make its crowd-sourced information genuinely useful. It also needs to work consistently across different parts of the country, including smaller towns and less frequently traveled roads.

TuJu is not the only alternative, however. PINTAZ is another locally developed option, while Google Maps, HERE WeGo, and other international services offer different combinations of mapping and navigation features. Communications Minister Fahmi Fadzil has clarified that the government is not directing Malaysians towards a single replacement, and that motorists are free to consider other applications besides Waze.

There is also an important distinction between encouraging the development of local technology and assuming that a locally developed application is automatically safer or more secure. TuJu and PINTAZ collect location information too, and both should be subject to the same meaningful scrutiny. Cybersecurity specialists have called for regular, independent privacy and security audits covering data collection, storage, transmission, third-party services, and access controls.

In other words, critics maintain that a Malaysian application should be expected to meet the same standards as an American, Israeli, Chinese, or European one. Its national origins may influence where data is processed and which laws apply as a matter of corporate jurisdiction, but they do not guarantee that the information is adequately protected.

A CONSISTENT APPROACH TO DIGITAL SOVEREIGNTY

Interestingly enough, the Waze controversy also brings a much larger issue into focus. Navigation is only one part of an increasingly interconnected digital ecosystem in which governments, businesses, and individuals depend on services developed and operated overseas.

Cloud storage, office software, artificial intelligence platforms, telecommunications equipment, financial services, and social media applications all handle potentially sensitive information. If the concern is that foreign jurisdictions may have legal or technical access to Malaysian data, then the principles used to assess Waze should logically extend across these other sectors.

Of course that doesn’t mean that every foreign application represents a security threat. It simply means that data governance should be based on a consistent assessment of risk rather than a company’s nationality or political expediency alone. After all, Waze has been in popular use in Malaysia for many years; its Israeli origin, however, only recently became a public-facing controversy. For some users, asking why that is might be worthwhile.

From a strictly security standpoint, however, South Korea offers an interesting example of how such concerns can be addressed. For years, its government restricted the transfer of high-resolution mapping data overseas, citing national security considerations. In February 2026, it conditionally approved Google’s request to export detailed map data, subject to safeguards that included local processing, the masking of sensitive facilities, restrictions on precise coordinates, and government oversight. The approach recognizes that international technology services can be useful while allowing security requirements to be built into their operation.

Malaysia could take a similarly measured approach. Rather than relying primarily on prohibitions, it could establish clear standards for applications handling sensitive personal and government information, require independent assessments, and specify where data may be stored, processed, and shared. Government devices and personnel with access to classified information could also be subject to stricter controls than ordinary public users.

For now, the Waze restriction remains in place for civil servants. NACSA’s published FAQ specifies that it applies both during official duties and outside working hours, including personal use. The government has also indicated that a broader prohibition on public use remains a possibility, although Anwar has acknowledged that available alternatives need to be assessed.

There is a reasonable case for Malaysia to develop its own technology, strengthen its cybersecurity capabilities, and reduce unnecessary dependence on foreign platforms. Supporting local innovation can be a sensible part of that strategy, provided the products are competitive, secure, and genuinely useful.

For public institutions, it does make some sense that the threshold should be higher: security assessments, clear data policies, and reliable alternatives should come first. Digital sovereignty is an important ambition, but it will be measured by the strength of the systems Malaysia builds and the consistency with which it protects its data. Ultimately, though, for everyday motorists not working as civil services, it’s likely accurate to say that they will adopt better navigation applications only when those alternatives offer a compelling reason to do so.

Sources: Channel NewsAsia, Bernama, Reuters, NACSA, The Star, Malay Mail, Malaysiakini, Google, Associated Press, and Yonhap News Agency.