Malaysia bans Waze for civil servants amid mounting fears over foreign digital surveillance

KUALA LUMPUR – Malaysia has banned its civil servants from using the Israel-linked navigation app Waze, citing security concerns over sensitive government information and personal data.Malaysian Prime Minister Anwar Ibrahim also urged all citizens to stop using the app, reflecting a growing global push towards digital sovereignty as governments seek greater control over citizens’ data.“Sensitive government information and the personal data of citizens must be protected from exploitation by the Israeli regime in ways that could undermine national security and sovereignty,” said a statement from the Prime Minister’s Office on Oct 21.Anwar raised concerns that the data is governed by Waze Mobile, which was incorporated in Israel and operates under Israeli law.He also urged Malaysians to stop using Waze and switch to locally developed alternatives such as TuJu, citing their purported data security and privacy protections.The announcement came after Anwar chaired a meeting with the National Cyber ​​Security Committee on Oct 20.The Straits Times previously sighted a memo on the ban, which was issued to Malaysian civil servants by Chief Secretary of the Government Shamsul Azri Abu Bakar on Oct 20.Founded in Israel in 2008 and acquired by American technology giant Google in 2013, the Waze app remains operated by Waze Mobile, which is based in Tel Aviv, according to its privacy policy.Malaysia has a longstanding support for the Palestinian cause and refuses to recognise Israel diplomatically.Global spyware fears fuel banThe decision came days after researchers at the University of Toronto’s Citizen Lab and cybersecurity firm Confiant revealed that Israeli advertising company Discover-Tech allegedly exploited online advertisements to track internet users and facilitate spyware attacks.Its ads appeared across more than 120,000 websites and 75,000 mobile apps, potentially exposing hundreds of millions of users to surveillance.The researchers linked the operation to Israeli spyware developer Candiru, whose software was used to target 45 devices belonging to Qatar-based broadcaster Al Jazeera between 2024 and 2025.Reuters also reported that the ads reached sensitive networks associated with NATO, the Pentagon and the United Nations, although there is no evidence that all these networks were compromised.Munira Mustaffa, a security expert at Chasseur Group, said recent revelations about Israeli-linked surveillance operations targeting Al Jazeera through sophisticated, virtually undetectable targeted online ads have heightened concerns around potential espionage.“The Israeli situation presents serious concerns,” Munira said.“For example, several European countries are actively seeking to reduce reliance on Microsoft after reports emerged that Unit 8200 utilised Microsoft’s cloud servers in the Netherlands and Ireland to store data on Palestinians targeted for surveillance.”Unit 8200 refers to the Israeli military’s principal signals intelligence and cyberwarfare unit.In January, France announced plans to phase out American video-conferencing services such as Zoom and Microsoft Teams across government agencies by 2027, while Germany and India have introduced their own messaging applications for public servants over security and data protection concerns.Fitness-tracking app Strava has also raised security concerns after its publicly accessible GPS heatmaps exposed military bases and troop movements worldwide, including locations near Ukraine, in 2018, potentially providing intelligence for enemy attacks.In 2023, former Russian submarine commander Stanislav Rzhitsky was shot dead while jogging in Krasnodar, with Russian media speculating that his killer had tracked his movements through fitness app Strava, which showed he regularly ran along the route where he was killed.However, it remains unclear whether the data was used to plan the assassination.Historical military precedents for banMalaysian Armed Forces had similarly raised concerns about location-based apps a decade earlier, when the augmented-reality mobile game Pokemon Go became a global phenomenon.In August 2016, then Armed Forces chief Raja Mohamed Affandi Mohamed Noor warned that the game’s GPS-based features could compromise military camps, personnel and equipment.Then defence minister Hishammuddin Hussein subsequently ordered restrictions on Pokemon Go around sensitive military installations, warning that it could be exploited to obtain images of locations not visible through Google Earth.Farlina Said, a cybersecurity expert at the Institute of Strategic and International Studies Malaysia, said that in some countries where data security for those in the public sector is higher, apps that access location should not be used unless approved or verified.“In Malaysia’s case, it may be the uncertainty of means and location where data is being processed which can raise distrust towards such applications,” Farlina told ST.However, TuJu, the navigation app promoted by Anwar and developed by the Malaysian Highway Authority, has had a rocky start, with users complaining about crashes, inaccurate information and missing features.Among the complaints are the lack of support for in-car infotainment systems and inaccurate speed readings, including instances of the app displaying vehicles travelling at negative speeds.“The shout-out for TuJu is understandable considering the circumstances, but the app’s a long way off from being dependable for most Malaysians,” user Ganaesh Devaraj wrote on Threads.Sign up for our weekly Asian Insider Malaysia Edition newsletter to make sense of the big stories in Malaysia.