Malaysia's decision to prohibit civil servants from using navigation application Waze has raised questions about the government's assessment of digital security risks, including why the platform was singled out and whether its locally developed alternative can meet users' expectations.

The directive, communicated by Chief Secretary to the Government Tan Sri Shamsul Azri Abu Bakar on October 20, followed a decision by the National Cyber Security Committee chaired by Prime Minister Datuk Seri Anwar Ibrahim.

The government cited concerns about the security of location and movement data, particularly in relation to Waze's Israeli legal connections, and encouraged the use of local navigation application TuJu as an alternative.

However, the decision has prompted questions from lawmakers about how the risks associated with Waze differ from those of other widely used digital platforms, including Google Maps, WhatsApp and Instagram.

The debate has since taken on another dimension following disruptions to TuJu, with the Malaysian Highway Authority (LLM) apologising on October 22 and saying it was working to restore the application's stability after a significant increase in users.

Why the government prohibited Waze

The prohibition followed a decision by the National Cyber Security Committee at a meeting chaired by Anwar on October 20.

In a letter dated October 20, Shamsul Azri instructed ministry secretaries-general and department heads to communicate the directive to officers under their supervision, including those in related agencies.

The government said the measure was intended to protect sensitive government information and personal data from potential misuse, citing concerns about Waze's collection of location and movement data.

Anwar also encouraged the use of TuJu, a Malaysian-developed navigation application, as part of efforts to promote local alternatives.

The government's concerns centre on the potential sensitivity of location data, which can reveal travel routes, recurring journeys and movement patterns when collected and analysed over time.

However, the distinction between a potential security risk and a demonstrated incident is important. The government's stated concerns do not, by themselves, establish that Waze has improperly disclosed users' movement data or that a security breach has occurred.

The decision therefore raises questions about the specific risks identified, the evidence underpinning the assessment and how the prohibition is expected to mitigate them.

MPs question why Waze was singled out

The restriction has drawn questions from lawmakers about its scope and the basis for the government's decision.

Raub MP Chow Yu Hui questioned why Waze was prohibited while other widely used applications, including Google Maps, WhatsApp and Instagram, remained accessible.

He also sought clarification on whether the restriction applied to civil servants using personal devices and whether it extended beyond official working hours.

Bandar Kuching MP Dr Kelvin Yii Lee Wuen similarly called for a clearer explanation of how Waze's security risks differed from those associated with other applications.

Their questions highlight a broader issue in digital governance: how should authorities distinguish between applications that present unacceptable security risks and those that remain permissible?

Waze is owned by Google, which also operates Google Maps. However, common ownership does not automatically mean that the two applications collect, process, store or share data in identical ways.

The government's FAQ has pointed to differences in legal arrangements and jurisdiction, noting that Waze Mobile Ltd operates under Israeli law.

Such differences may be relevant to an assessment of legal access to data, but they do not, on their own, establish the precise technical security risks posed by an application.

An explanation of the assessment would help clarify how factors such as data collection, storage, third-party access and security controls informed the decision.

TuJu promoted as a local alternative

TuJu was launched on November 26, 2025, by Works Minister Datuk Seri Alexander Nanta Linggi. It was developed by LLM in collaboration with Prosignal Consortium Sdn Bhd.

The application provides navigation and route information, estimated travel times, toll details, traffic updates and information about highway facilities. It also offers access to live closed-circuit television feeds and emergency assistance features.

The government has promoted local navigation platforms as alternatives that can support national digital sovereignty and data protection.

However, being locally developed does not automatically establish that an application offers stronger privacy safeguards. That depends on its data collection practices, technical infrastructure, access controls, retention policies and arrangements with third-party providers.

Reliability and usability are also important. Drivers depend on navigation applications for accurate directions, timely traffic information and stable performance, particularly when travelling through unfamiliar areas.

These considerations became more immediate following the government's recommendation of TuJu as an alternative to Waze.

LLM apologises after TuJu disruption

On October 22, LLM apologised for disruptions to TuJu and said it was working with Prosignal Consortium to restore system stability and increase capacity following a significant surge in users.

The authority acknowledged feedback concerning navigation functions, route accuracy and the overall user experience, saying the feedback would guide further improvements.

LLM also said it would work with the Works Ministry, the National Cyber Security Agency and other relevant parties to strengthen the country's local navigation ecosystem.

The disruption followed increased attention on TuJu after Anwar encouraged its use as an alternative to Waze.

Although the authority attributed the disruption to a significant increase in users, the reported statement did not establish the precise technical cause or confirm a timeline for the full restoration of services.

The episode highlights the operational demands that can accompany a sudden increase in adoption. An application that serves a relatively limited user base may face different capacity requirements when a much larger number of people begin using it within a short period.

However, the disruption alone does not establish that TuJu is inherently unreliable or incapable of becoming a dependable alternative. Its longer-term performance will depend on the effectiveness of the improvements being implemented.

Cybersecurity policy needs clear explanations

The Waze prohibition highlights the challenge of balancing national security with the widespread use of commercial digital services.

Governments may have legitimate reasons to restrict applications that could expose sensitive information, particularly when civil servants handle official data or carry out government duties.

At the same time, effective cybersecurity policy requires a clear understanding of the risks being addressed and why particular measures are considered necessary.

Preventive action does not necessarily require authorities to wait for a security breach before responding to a potential threat. However, explaining the basis for restrictions helps the public understand why one application is prohibited while others remain available.

The TuJu disruption adds another consideration: a recommended alternative must be able to provide the reliability and functionality users expect, alongside appropriate data protection safeguards.

These are separate requirements. A stable application is not necessarily more secure, just as a platform with strong privacy protections is not automatically the most reliable for navigation.

Ultimately, digital sovereignty cannot be measured simply by replacing a foreign application with a locally developed one.

It also depends on whether the technology adopted has appropriate safeguards, whether restrictions are proportionate to the risks identified and whether the government can explain its decisions clearly.

Malaysia's Waze ban may be intended to strengthen data security, but both the questions raised by lawmakers and the challenges faced by TuJu underline the importance of evidence-based policy, transparent risk assessments and public confidence in the alternatives being promoted.