Why Is Waze A Security Concern In Malaysia? Here's What Your Data Reveals

Every time you use a navigation app, you're sharing information about where you're going. Over time, those location records could potentially reveal much more, including your daily routines, workplace and visits to sensitive locations.

That's among the national-security concerns behind Malaysia's decision to restrict Waze use among civil servants conducting official duties.

Now, a viral video showing GPS dots around Putrajaya's Palace of Justice has raised another question: just how much can Waze reveal about our movements?

Malaysia's restriction follows a cybersecurity risk assessment, rather than simply concerns raised by a viral video.

According to National Cyber Security Agency (NACSA) chief Dr Megat Zuhairy Megat Tajuddin, an assessment conducted on 1 August 2026 identified potential risks involving location information and movement patterns.

The government has also raised concerns about Waze's legal jurisdiction, including its incorporation in Israel, and the implications this could have for data governance and legal recourse.

Following a National Cyber Security Committee meeting on 20 October 2026, civil servants were prohibited from using Waze while conducting official government business.

In its official FAQ, NACSA explains that assessing location-based services involves factors such as the data accessed, permissions, processing jurisdiction, retention, third-party sharing and security safeguards.

Movement patterns: Repeated location records could potentially expose sensitive routines, destinations and official travel.

Legal jurisdiction: Overseas data governance and applicable laws raise questions about how information is protected and accessed.

Data exposure: Permissions, retention, third-party sharing and security controls are relevant to assessing potential risks.

Importantly, identifying a security risk does not mean that misuse has been proven. NACSA acknowledges that it has no evidence Waze conducted the specific movement-pattern analysis described in its assessment.

Waze has also rejected allegations that it compromises users' personal information or collects sensitive government information, maintaining that it follows established privacy and data-protection standards.

Think about your daily commute. You leave home, drive to work and return along roughly the same route.

One trip may reveal little. But repeated location records, particularly when combined with timestamps and other information, could potentially expose patterns, including where you regularly start your day, where you work and when you usually travel.

For government personnel handling sensitive matters, such information could be particularly concerning if it reveals recurring visits to restricted facilities or patterns of official activity.

NACSA identifies GPS locations, routes, timestamps, IP addresses and device-related information among the data relevant to its assessment.

Location, routes, timestamps and device-related information, subject to the app's data practices and user settings.

Anonymised historical GPS observations used to improve maps, rather than a public record identifying individual drivers.

Important: These are different levels of information. Publicly visible GPS points do not establish access to detailed individual travel histories.

The viral demonstration reportedly shows GPS dots around Putrajaya's Palace of Justice. However, the presence of such dots needs to be understood in the context of how Waze's mapping tools work.

According to Waze's GPS Points documentation, Map Editor includes anonymised GPS observations collected from motorists. Editors use these to identify missing roads, understand traffic direction and improve map accuracy.

The documentation also describes periodically updated historical data, rather than a live public feed of identifiable motorists.

That means the dots alone do not prove that individual drivers are being tracked in real time. However, they illustrate why location information and the way it is processed have become part of a wider security discussion.

Yes. As of 26 October 2026, Waze has not been banned for ordinary Malaysian motorists.

The restriction applies to civil servants carrying out official duties. Prime Minister Datuk Seri Anwar Ibrahim has raised the possibility of a wider ban if suitable alternatives become available, but no nationwide prohibition has been announced.

One alternative highlighted by the government is TuJu, a locally developed navigation application. However, switching to another navigation service does not automatically eliminate location-data concerns.

In fact, Malaysia's National Security Council has also discussed privacy and security risks involving other location-based services, including Google Maps and Strava, in its 26 October article.

The broader concern is how accumulated location information could potentially reveal sensitive activities, regardless of which navigation or tracking platform is involved.

Ultimately, the Waze controversy raises a wider question about protecting sensitive location information in an increasingly connected world.

Navigation apps make everyday travel easier. But knowing where we go can also reveal more about us than we might realise.