'Completely untrue': Waze denies data collection claim after govt ban

Waze has denied allegations that its navigation application collects sensitive government information or lets third parties exploit users’ personal data, after the government banned civil servants from using it.

“Allegations that Waze collects sensitive government information or allows any entity to exploit users’ personal data are completely false.

“Waze operates under...

Waze has denied allegations that its navigation application collects sensitive government information or lets third parties exploit users’ personal data, after the government banned civil servants from using it.

“Allegations that Waze collects sensitive government information or allows any entity to exploit users’ personal data are completely false.

“Waze operates under strict privacy policies to protect user data and complies with global legal data protection standards,” a Waze spokesperson said in a statement to Malaysiakini today.

Yesterday, Putrajaya banned civil servants from using the Israel-based navigation app while performing official duties, with Prime Minister Anwar Ibrahim promoting a government-backed alternative.

Later, the National Cyber Security Agency (Nacsa) issued a frequently asked questions (FAQ) guide clarifying that the ban applies only to civil servants on official duty, but still encouraged them to uninstall Waze and switch to a suitable local navigation app.

Taking to Facebook two days ago, Anwar affirmed that the government will not compromise on the security of the rakyat’s data and encouraged the use of TuJu, a local route planner developed by the Malaysian Highway Authority in partnership with Prosignal Consortium Sdn Bhd.

In a statement, the Prime Minister’s Department also advised Malaysians to stop using Waze and switch to local alternative options.

The ban is linked to the app’s Israeli roots. Anwar had raised concerns over the security of movement data and other information Waze collects, noting that the app is subject to Israeli law.

Chief Secretary to the Government Shamsul Azri Abu Bakar outlined the prohibition in a letter dated yesterday, which Malaysiakini sighted.

The letter said the directive followed a National Cybersecurity Committee meeting chaired by Anwar on the same day, and the decision was made during the meeting with immediate effect.

No evidence

In the FAQ, Nacsa explained that Waze’s data collection practices and the potential uses of the collected information must be assessed from a cybersecurity perspective.

However, Nacsa acknowledged that there was no evidence Waze conducted such analysis on its users.

“Although there is no evidence that Waze conducts such analysis on its users, the possibility of the collected data being used or exposed to such analysis remains a risk that must be considered,” according to the FAQ.

In point seven of the document, Nacsa said Waze’s privacy policy showed that the data collected by the application was “broader than location information alone”.

This includes detailed information about users’ locations, journeys, and routes, including GPS data and device sensor information combined with timestamps, internet protocol addresses, and information from other sensors or receivers on or around the device.

Nacsa also stated that, depending on users’ device and account settings, location and travel-related information could be collected even when the application was not actively in use.

From a cybersecurity perspective, it explained that continuously or repeatedly collected data could, when analysed in aggregate, reveal users’ movement patterns and activities.