KUALA LUMPUR: The government's ban on Waze among civil servants has raised questions about the data security risks posed by navigation applications, with experts saying location data could reveal users' daily routines and movements around sensitive facilities.
Academy of Sciences Malaysia fellow Emeritus Professor Datuk Dr Mohamed Ridza Wahiddin said the decision was technically based on a risk assessment involving the scope of data collected, collection methods, legal jurisdiction and the potential to analyse users' movement patterns.
He said research conducted by Peter Gasper in 2020 had demonstrated that Waze could track users' movements under certain conditions.
"Although this is not evidence of current misuse, it shows that tracking risks have existed from a technical standpoint," he said.
Ridza said allowing Waze to access location data through the "Always" setting could create detailed records of users' daily routines, including their home and workplace locations, frequently travelled routes and visits to sensitive locations.
He added that Waze's "Invisible" feature only concealed a user's location from public view on the map but did not prevent the application from collecting location and route data.
Similar risks existed with Google Maps if features such as Timeline, Web and App Activity, or search service history were enabled, he said.
However, Google states that precise locations transmitted by devices are not stored in search service history or Web and App Activity. Instead, only general areas are recorded, while the associated location metadata is deleted after 30 days.
Meanwhile, cybersecurity expert Aaron Ikram Mokhtar said precautionary measures involving official duties were reasonable, as location data could become sensitive when combined and analysed.
He said the government was concerned that Waze collected location data, travel routes, movement patterns and device information, including when the application was not actively in use.
"If such data is collected from a large number of people, it could reveal movement patterns, including activity around offices or sensitive facilities," he said.
Aaron said legal jurisdiction was another concern, as Waze's terms were believed to specify Israeli law and courts for disputes arising from the use of the application.
"The government is concerned that Malaysia may not have full control over how the data of its citizens and civil servants is processed, accessed or used by parties subject to Israeli jurisdiction," he said.
However, he questioned the decision to single out Waze without a comparable public assessment of Google Maps and other navigation applications, which could also collect location data.
"The measure would be stronger if the government published a detailed risk assessment and applied the same data security policy to all navigation applications, rather than targeting just one," he said.
The government announced the ban yesterday, saying it was intended to protect government information and users' personal data from potential misuse by the Israeli regime.
In a statement, the Prime Minister's Office said the decision took into account Waze Mobile Ltd's status as a data controller incorporated and operating under Israeli law.
It said the Madani government remained firm in its position and would close any avenue that could be exploited by the Israeli regime to threaten national security and the public.
Malaysia is among three countries, alongside Iraq and Iran, that have announced moves to restrict or stop the use of Waze.
Iraq has announced plans to ban the application from 2027, with the possibility of bringing forward implementation to the end of 2026, citing data security concerns and its links to Israel. Iran had earlier blocked and restricted its use.
© New Straits Times Press (M) Bhd