Malaysia Flags Waze Data Risk in National Security Review
Malaysia's National Cyber Security Committee has examined the security risks that come with Waze, the navigation app founded in Israel and owned by Google, and concluded that users should weigh an alternative. Malaysia's prime minister, who chaired the meeting, said the app falls under Israeli government laws, which places the location data it collects within another country's legal reach. According to Free Malaysia Today, he set out the position in a Facebook post after the session.
The concerns named at the meeting were the security of personal data and information about where users travel. He said the government cannot compromise on Malaysians' data and identities, and pointed to TuJu, an app developed by the Malaysian Highway Authority, as the local option. No breach, audit or technical finding was published with the advice, so the assessment rests on jurisdiction rather than on evidence that data has been misused.
And the exposure is wide because adoption is wide. Malaysia once ranked among the busiest Waze markets in Asia, with roughly six million monthly users, about 2.5 million of them in Kuala Lumpur, and close to 1.2 million traffic alerts raised in a month. Location history at that scale is a detailed record of routines, and the committee treated the legal reach over that history as the risk worth flagging, ahead of any question about the maps themselves.
Other governments have taken the same argument further. Iraq has announced a complete ban that takes effect at the start of next year, citing the app's Israeli origins and data security. Iran has blocked or restricted access before, and Iraq's measure is a block on the app itself rather than guidance to citizens.
But Malaysia's step stops short of enforcement. No block was announced, no removal from app stores was ordered, and no change to how the app handles data was requested. The report carries no response from Google, which bought Waze more than a decade ago for about USD 1.15 billion, and no statement from the highway authority on how TuJu would absorb a sudden rise in users.
And the same meeting covered two other security fronts. The committee discussed the security of MyDigital ID and the risks that autonomous artificial intelligence brings to government systems. He described a split model for identity, with MyKad as the physical credential and MyDigital ID for digital transactions, backed by stronger cybersecurity measures.
Both items turn on the same question, which data leaves the country and whose law governs it. The identity work answers that with domestic control of credentials and a card that stays in its holder's hands. The navigation warning answers it by asking users to choose, since the app itself stays available.
So nothing changes on a Malaysian driver's phone unless the driver acts. The app remains on sale, the advice is not binding, and no timetable for a review has been published. What the committee has done is put the legal question on the record, at a moment when two other governments have already answered it with blocks.
Malaysia's National Cyber Security Committee examined Waze over the security of personal data and records of users' movements.
The prime minister said the app falls under Israeli laws, and suggested TuJu, built by the Malaysian Highway Authority, as the local option.
Malaysia was once among Asia's largest Waze markets, with about six million monthly users.
Iraq has announced a complete ban from the start of next year, and Iran has restricted access before.
No block, audit or change to how Waze handles data was announced, and Google gave no response in the report.
Source: Free Malaysia Today
