Malaysia bans navigation app Waze for civil servants citing data risks

Concern over sensitive government information and citizens’ personal data has led Malaysia to ban Waze for civil servants, while Prime Minister Anwar Ibrahim is recommending locally developed navigation apps to the wider public.

Anwar has pointed Malaysians towards alternatives such as TuJu, developed by the Malaysian Highway Authority, citing the data security and privacy protections these local services are claimed to offer.

TuJu users, however, report crashes, incorrect information and missing features, including compatibility with in-car infotainment systems. Complaints about inaccurate speed readings include vehicles being shown as travelling at negative speeds.

“The shout-out for TuJu is understandable considering the circumstances, but the app’s a long way off from being dependable for most Malaysians,” user Ganaesh Devaraj wrote on Threads.

Google, the American technology company, acquired Waze in 2013. The navigation app was founded in Israel in 2008 and continues to be operated by Waze Mobile in Tel Aviv, according to the app’s privacy policy.

Israeli law applies to Waze Mobile, a company incorporated in Israel that governs users’ data. Anwar has cited that legal status as a security concern.

“Sensitive government information and the personal data of citizens must be protected from exploitation by the Israeli regime in ways that could undermine national security and sovereignty,” the Prime Minister’s Office stated on 21 October.

The Straits Times had earlier seen the instruction in a 20 October memo issued to civil servants by Chief Secretary to the Government Shamsul Azri Abu Bakar. Anwar chaired the National Cyber Security Committee meeting on the same date, before the announcement.

Days before the ban, researchers from the University of Toronto’s Citizen Lab and cybersecurity firm Confiant linked an advertising operation to Israeli spyware developer Candiru. Software from the company had been used to target 45 devices at Qatar-based broadcaster Al Jazeera in 2024 and 2025.

The operation involved Israeli advertising company Discover-Tech, which the researchers alleged had exploited online adverts to track internet users and facilitate spyware attacks.

Reuters reported that the adverts had reached sensitive networks associated with the North Atlantic Treaty Organisation (NATO), the Pentagon and the United Nations. Evidence does not establish that all these networks were compromised.

Discover-Tech’s adverts appeared on more than 120,000 websites and 75,000 mobile apps. That reach could expose hundreds of millions of users to surveillance.

Munira Mustaffa of Chasseur Group described the adverts used against Al Jazeera as sophisticated and virtually undetectable. The security expert noted that revelations about Israeli-linked surveillance of the broadcaster had intensified concerns about possible espionage.

“The Israeli situation presents serious concerns,” Munira said.

Munira’s comments also addressed Microsoft and Unit 8200, Israel’s main military unit for signals intelligence and cyberwarfare.

“For example, several European countries are actively seeking to reduce reliance on Microsoft after reports emerged that Unit 8200 utilised Microsoft’s cloud servers in the Netherlands and Ireland to store data on Palestinians targeted for surveillance.”

An August 2016 warning from then army chief Raja Mohamed Affandi Raja Mohamed Noor focused on the threat that Pokémon GO’s Global Positioning System (GPS) features could pose to camps, personnel and equipment. The Malaysian Armed Forces raised concerns about location-based apps as the augmented-reality game became a worldwide phenomenon a decade earlier.

When then defence minister Hishammuddin Hussein subsequently ordered restrictions around sensitive military installations, his warning concerned the game’s potential use to obtain images of locations that Google Earth did not show.

Russian media suggested that fitness app Strava might have helped the killer of Stanislav Rzhitsky track him before his death in 2023. The former Russian submarine commander was shot dead while jogging in Krasnodar, along a route the app showed he used regularly. Whether the data was used to plan the assassination remains unclear.

Strava’s publicly accessible GPS heatmaps have also revealed military bases and troop movements worldwide. These included locations near Ukraine in 2018, potentially providing opponents with information for attacks.

Malaysia’s stance sits alongside its longstanding support for the Palestinian cause and refusal to recognise Israel diplomatically. Governments elsewhere are also pursuing digital sovereignty as they try to secure greater control over citizens’ data.

Security and data protection concerns have prompted Germany and India to introduce their own messaging apps for public servants. In January, France announced plans for government agencies to stop using American video-conferencing services such as Zoom and Microsoft Teams by 2027.

Farlina Said, a cybersecurity expert at the Institute of Strategic and International Studies Malaysia, noted that in some countries with higher public sector data security standards, apps with access to users’ locations should be used only after approval or verification.

“In Malaysia’s case, it may be the uncertainty of means and location where data is being processed which can raise distrust towards such applications,” Farlina told The Straits Times.

Source: The Straits Times