Why only Waze? Local navigation apps should be scrutinised too, say tech experts

 

Locally developed navigation apps should be subjected to the same cybersecurity scrutiny as their foreign counterparts to ensure they can protect user data, tech experts say, amid the government's push of the local TuJu app over Waze.

At the same time, they challenged the government's rationale for banning Waze for civil servants because apps such as Google Maps, whose parent company Google bought Waze in 2013, also collect similar information from their users.

Experts cautioned that Malaysian-developed applications should not automatically be considered safer than foreign competitors, stressing that all should be assessed against the same cybersecurity standards.

Prime Minister Anwar Ibrahim recently touted TuJu as an alternative to Waze due to national security concerns over the latter’s Israeli roots, but TuJu soon faced complaints over technical glitches and navigation shortcomings following a surge in users, which Anwar acknowledged after overwhelming public feedback.

Malaysian Highway Authority (LLM) chairperson Hasni Mohammad later clarified in an interview with Malaysiakini that TuJu was never intended to rival Waze, but was developed primarily to improve services along tolled highways by providing traffic updates, information on rest stops, and emergency contacts.

Despite its more limited intended role, questions remain over the readiness and security of local navigation apps.

Equal cybersecurity checks

Cybersecurity consultant Aaron Ikram Mokhtar said the government should evaluate all navigation applications using consistent criteria, including the types of data collected, where they are stored, whether they are shared with third parties, and how they are protected against unauthorised access.

The Tuju highway navigation app

“TuJu still collects location data and relies on external mapping services, and there is no clear public evidence that either app has been independently audited.

“Country of origin should be one consideration, not the deciding factor. Applying the same standard to Waze, Google Maps, TuJu, and Pintaz would make the policy more credible and less selective,” he said, noting that local applications should be scrutinised as heavily to ensure their safety.

He added that local developers could introduce bug bounty programmes, which reward security researchers for identifying vulnerabilities so they can be fixed before malicious actors exploit them.

Such measures are especially important because weaknesses in one application could expose users to wider risks if they reused the same login credentials across multiple platforms, including social media and online banking services.

Building confidence by being transparent

Akati Sekurity chief executive officer Krishna Rajagopal said local developers could build public confidence by being more transparent about how their applications operated and handled users' information.

He said users who had relied on Waze for years might be reluctant to switch to unfamiliar services, particularly if the government simply instructed them to stop using one application without adequately explaining the reasons or demonstrating that alternatives were reliable.

However, clearer disclosures about data collection, security measures, and accountability could encourage users to consider locally developed applications on their own merits.

“By right, the same six requirements that the National Cyber Security Agency (Nacsa) has outlined should be answered by LLM or TuJu or any other (local) alternative.

“I think that's very important. A lot of people perhaps have a bit of uneasiness about the fact that in Malaysia, government authorities are not included in the Personal Data Protection Act.

“So if there is an incident with a local alternative, who's liable?” he asked.

Cybersecurity risks

The six factors outlined by Nacsa for assessing navigation apps’ cybersecurity risks are as follows:

• the types of data accessed,

• app permissions,

• where data is processed,

• data retention policies,

• third-party sharing arrangements, and

• the security controls implemented by developers.

The agency also highlighted that Waze collects information beyond users’ locations, including journeys and routes, GPS and device sensor data, timestamps, and IP addresses. Depending on users’ device and account settings, the app may also collect location and travel information when it is not actively being used.

Nacsa warned that such data, when collected repeatedly and analysed in aggregate, could reveal patterns in users’ movements and activities.

Waze, which is headquartered in Tel Aviv, has denied allegations that its app collects sensitive government information or allows third parties to exploit users’ personal data.

A spokesperson told Malaysiakini that the app operates under strict privacy policies to protect user data and complies with global data protection standards.

Justification?

Concerns over the readiness of local alternatives aside, the experts further questioned the government’s decision to ban Waze, particularly whether its links to Israel alone are sufficient to justify the move.

Aaron said it was important to distinguish between a potential security risk and a demonstrated threat, particularly when a restriction affects a service used by the public.

“A potential risk means an app collects data that could be misused; a demonstrated threat means there is evidence of actual misuse, a breach, or unlawful access.

“Nacsa says there is no evidence Waze has analysed aggregated location data to profile users. Therefore, the ban can be defended as precautionary, but it should not be presented as proof of an existing security incident,” Aaron said.

He instead opined that the government should publish a summary of its security assessment of Waze, including how it collects, stores, and shares users’ data, to explain why the ban is necessary.

“(Because) without that, the public cannot judge whether the ban is proportionate or based mainly on political concerns,” Aaron added.

Digital media expert and Monash University lecturer Benjamin Loh also concurred with the idea, saying the government should identify the actual national security concerns instead of treating Waze's reference to Israeli law as sufficient justification.

“Just because Waze indicates that they are somehow following Israeli laws… it's unclear whether that means that they are going to undercut or supersede Malaysian laws and start to carry that data as well,” Loh said.

Why Waze but not Google Maps?

The experts also questioned why the restriction appeared to single out Waze when other widely used foreign navigation applications, particularly Google Maps, collect similar categories of user information. Google Maps, which bought Waze in 2013, is based in the United States.

Aaron said Waze and Google Maps were technically comparable in that both could collect users' location information, routes, and device data, with background location access depending on user settings and permissions.

The more apparent distinction, he said, concerned their respective legal jurisdictions rather than a fundamental difference in the types of data they could collect.

Loh, however, described the reasoning for exempting Google Maps based on its US jurisdiction as “silly”, arguing that foreign technology companies generally operate across borders while remaining subject to the laws of the countries in which they provide services.

He said the collection of user data was common among major technology companies, including those based in the US, making it difficult to justify treating Waze differently based on its country of origin alone.

“Any app, technically speaking, is going to cater towards the law in its own respective country. But due to the international nature of how apps work anyway, most apps essentially will still cater towards the local laws in any specific country as well,” he said.

Loh said that although data protection regulations have strengthened safeguards against the misuse and distribution of personal information, major technology companies continued to collect substantial amounts of user data.

He added the government should therefore explain what made Waze a distinct security risk compared with other navigation applications, rather than apply restrictions selectively.

- Mkini