From Moaz Nair
On April 21, 2018, the threat of foreign espionage on Malaysian soil turned fatal.
Fadi Mohammad al-Batsh, a Palestinian lecturer and drone specialist, was gunned down in Setapak by two assassins who had tracked his movements. The hit bore all the hallmarks of Israel’s intelligence agency, Mossad.
For Malaysia's National Cyber Security Agency (Nacsa), this assassination remains a chilling reminder of why the nation must stay vigilant against foreign intelligence operations.
Yet, until very recently, a massive vulnerability remained completely unaddressed, sitting quietly in the pockets of our nation's leaders – Waze.
The chief secretary to the government’s immediate directive banning civil servants from using Waze represents a massive, long-overdue milestone in digital sovereignty.
While ordinary citizens use navigation apps without a second thought, the technology poses a distinct national security risk for individuals holding strategic government, military or intelligence positions.
For Malaysia’s strategic leaders, deleting Waze is no longer a matter of personal convenience – it is a non-negotiable imperative of national defence.
Who controls the data?
To understand the risk, one must look at who controls the telemetry data.
Although Google purchased Waze in 2013, the legal entity operating the app remains Waze Mobile Ltd, which is registered and incorporated in Israel.
Waze’s terms of service explicitly state that the platform is governed solely by the laws of the state of Israel. Under Israeli national security laws, authorities can legally compel Israeli-registered entities to hand over data trails in the interest of state security.
Furthermore, Waze’s history is deeply intertwined with Israel's military apparatus. Co-founder Uri Levine is a veteran of Unit 8200, Israel's elite military cyber-intelligence unit.
With Israel's commercial tech sector heavily staffed by cyber-warfare veterans, European nations like Germany, Switzerland and France, alongside key Middle Eastern states, refuse to gamble their digital sovereignty on such a high-risk data pipeline.
Malaysia is right to follow their blueprint for protective governance.
By design, Waze continuously logs highly invasive information, including real-time GPS locations, exact travel history and background location data even when the app is closed. Advanced artificial intelligence can easily process this granular data to build highly specific movement profiles.
For a high-ranking Malaysian official, using Waze means outsourcing their daily routine, secure meeting locations and personal vulnerabilities to an entity governed by a foreign power.
The ClearPhish leak
If geopolitical risks feel abstract, the immediate cyber threats are undeniably concrete.
Cyber technology firm ClearPhish recently revealed that a database containing the records of over 7.6 million Waze users is being advertised for sale on a dark web marketplace by cybercriminals. The leaked information includes usernames, unique IDs, real-time GPS coordinates, and full travel histories.
This massive leak proves that user data is never entirely secure. In the hands of bad actors, this data can be used to map routines, launch targeted cyberattacks, or facilitate physical stalking.
When millions of users are exposed globally, relying on foreign proprietary platforms for state transit becomes a gamble Malaysia cannot afford.
Navigating the local alternatives
Securing our national transit does not mean driving blind. The government has aggressively pushed for the adoption of TuJu, a locally developed navigation application created by the Malaysian Highway Authority (LLM) and Prosignal Consortium.
Because TuJu keeps traffic data domestic, it eliminates the threat of foreign legal intervention.
Admittedly, the sudden surge of users following the ban caused TuJu's infrastructure to experience technical disruptions, prompting a public apology and optimisation promises from LLM.
While the app undergoes growing pains to map city roads as effectively as highways, it remains a vital step forward.
For officials requiring immediate, flawless global mapping or hyper-specialised privacy frameworks, open-source architectures offer airtight backups. Applications like Organic Maps operate 100% offline with zero trackers, no data collection, and no server-side profiling.
Similarly, OsmAnd allows for local route computation and completely self-contained navigation built on community-vetted OpenStreetMap data layers, entirely bypassing corporate or state surveillance architectures.
Enforcing the digital perimeter
Enforcing this shift requires more than just voluntary compliance; it demands strict, centralised technical execution by government IT and cybersecurity teams. To plug this leak entirely, government agencies must deploy comprehensive mobile device management (MDM) profiles across all state-issued smartphones to centrally blacklist and auto-uninstall Waze.
Furthermore, government network administrators must implement strict DNS filtering and firewall blocks on secure public-sector Wi-Fi networks, cutting off telemetry to Waze's backend API servers entirely. Combined with application control policies on secure endpoints, these measures transition the policy from a simple guideline into an ironclad digital perimeter.
When a leaked database can expose millions, and foreign laws can compel the surrender of live location feeds, the choice for Malaysia's leadership is clear.
Convenience cannot trump national sovereignty. Enforcing a strict digital perimeter – beginning with the immediate removal of Waze from every official device – is not a matter of lifestyle preference.
It represents a vital, immediate act of national security and digital defence.
Moaz Nair is an FMT reader.
The views expressed are those of the writer and do not necessarily reflect those of FMT.