Explained: How foreign navigation apps could reveal sensitive routes and government activity in Malaysia

Experts said everyday navigation data, including travel histories and frequently visited locations, could be turned into strategic intelligence using artificial intelligence. — Bernama pic

First Published: Wednesday, 28 Oct 2026 10:31 AM MYT

KUALA LUMPUR, Oct 28 — The continuous collection of location data by foreign navigation applications does more than reveal users’ daily routines, it could also be processed into strategic intelligence, potentially compromising national security and sovereignty.

Cybersecurity expert and former CyberSecurity Malaysia (CSM) chief executive officer Datuk Amirudin Abdul Wahab said navigation applications typically collect a wide range of data, including travel histories, timestamps, IP addresses, device sensor data and frequently visited locations.

 He said that while individual data points might seem harmless, aggregating them over time can create detailed digital movement profiles that reveal users’ personal information, home addresses, workplaces, and movement patterns.

“This is where the concepts of data collection and inference become critical. For instance, a senior government official’s consistent movement from home to a ministry, security meeting venues, and airports can reveal insights into the individual’s role, professional network, and operational priorities.

“The risk becomes even more acute when this location data is combined with open-source information, such as an individual’s job title and organisational affiliation,” he told Bernama.

Amirudin said modern data analytics and artificial intelligence (AI) could transform routine location data into actionable intelligence, potentially revealing meeting frequencies and the times civil servants enter or leave sensitive facilities.

On digital sovereignty and the implications of foreign laws governing applications such as Waze, he stressed that Malaysia did not need to reject all foreign technology.

Instead, the government must have a clear understanding of who controls the data, where it is processed and which legal jurisdictions apply, he said.

He described a ban on using Waze for official government business as a reasonable precaution but stressed that such a measure should be backed by transparent risk assessments and the development of robust local alternatives.

“The correct approach to digital sovereignty is through risk assessment, rather than simply banning an application based solely on who owns it,” he said.

Meanwhile, Universiti Kebangsaan Malaysia (UKM) digital transformation expert Prof Nurhizam Safie said the use of foreign navigation platforms to map remote areas and strategically significant routes through crowdsourced data could pose risks from military and geopolitical perspectives.

He said in the event of a conflict, mapping data held by foreign entities could potentially be exploited for tactical military planning, including invasion strategies, without users being aware of how their data was being used.

To address this vulnerability and reduce reliance on external service providers, Nurhizam called on the government to strengthen strategic partnerships with local technical agencies, particularly the Department of Survey and Mapping Malaysia (Jupem).

“Jupem possesses a highly comprehensive national mapping and geospatial database. Efforts to strengthen local alternative applications should involve close collaboration with the department.

“Through initiatives such as GovTech under the National Digital Department, we can leverage Jupem’s mapping data and our own satellite infrastructure to develop applications that are truly sovereign and remain under government oversight,” he said.

Nurhizam also urged the government to maximise existing infrastructure, including the Public Sector Data Centre (PDSA) in Putrajaya, to host and process data on self-hosted servers.

He said this would help ensure that data collected by local navigation applications, such as TuJu, was not transferred to, stored on, or placed under the control of third parties through overseas database servers.

“To ensure more comprehensive protection, the provisions under the Personal Data Protection Act (PDPA) should also be reviewed and strengthened, particularly those concerning data localisation and procedures for cross-border data transfers.

“We have no choice but to place our trust in local talent to develop our own software, hardware and server systems, ensuring that the goal of achieving digital sovereignty by 2030 becomes a reality,” he said. — Bernama