In a circular dated 20 October 2026, the Chief Secretary to the Government barred civil servants from using Waze, effective immediately. According to Prime Minister Anwar Ibrahim, the National Cyber Security Committee (JKSN) looked at the risk of users' personal information and movement data being exposed. The National Cyber Security Agency (NACSA) coordinates questions about the directive.
Since then, many people have asked us the same thing: is Waze malware? Is it reading my messages? To find out, PenipuMY took the official Google Play version of Waze (5.25.0.1) off an Android phone and examined its code.
The directive applies to members of the public service. News reports so far do not mention any ban on ordinary users. The Prime Minister has urged Malaysians to switch to local apps such as TuJu, developed by the Malaysian Highway Authority (LLM).
We found no malware behaviour in the parts we examined. Specifically, the app:
The trackers are Google's. The app uses Google Firebase (crash reports, performance, push notifications and remote settings) and Google Ads with your advertising ID. We did not find trackers from other companies such as Facebook or AppsFlyer.
The servers belong to Waze and Google. The main server, rt.waze.com, receives the live location. Most of the addresses in the app end in waze.com or google.com.
Because Waze started in Israel, we looked specifically for Israeli web addresses, which end in .il. We found three kinds inside the app's main engine, a large native library called libwaze.so:
Going by the app's default settings, Malaysian users appear to be served by the "rest of the world" servers, not the Israeli ones. For example, the app's search and log upload addresses both point to "row" servers. However, Waze can switch the app to different servers through remote settings, and we did not record the app's network traffic, so we cannot confirm where every request goes.
In short, the Israeli addresses are there because Waze runs Israel as a separate service region. We found no evidence that Malaysian users' location is sent to a .il address. Still, the code makes it clear that the app and the team behind it remain closely tied to Israel.
Waze is not hiding anything here. It is simply how the app works. To calculate traffic, Waze sends your exact position and speed to its server the whole time the app is open. If you are signed in, your trip history is also kept on your account. Waze can also change some of the app's behaviour from its servers without an app update.
For one person driving to a mamak stall, this is not a big deal. For a government, it is a different story.
A few weeks of location data, even without a name, can reveal a lot:
This has happened before. In 2018, the fitness app Strava published a heatmap that revealed US military bases and patrol routes overseas. In 2024, Le Monde used the same app to track bodyguards of world leaders, exposing their hotels and travel plans in advance.
Because Waze is owned by Google, its data can be requested under US law. The Prime Minister's Office also pointed out that Waze Mobile Ltd, the company that controls Waze users' data, is bound by Israeli law, which is the concern the government raised. Exactly what any foreign government can access is a legal question that the app's code cannot answer.
Google Maps, ride-hailing apps, the phone's own location history and even some of the phone maker's built-in apps collect similar data. Banning one app reduces the risk but does not remove it. That is why security-sensitive agencies usually also give staff work phones with location turned off, or keep phones out of secure areas entirely.
Scammers love trending news. Be careful if you receive:
Install navigation apps only from Google Play or the App Store. Never install APK files sent by strangers. If you are unsure, check the link or number with PenipuMY first.
If you are a civil servant, remove Waze from your phone.
If you keep using it, set location access to "Only while using the app" in your phone settings.
Go to waze.com/user/download_data, or delete your account in the app's settings.
Switch them off in your phone's Google settings.
Sources: The Star, The Edge Malaysia, SoyaCincau, Bloomberg, Rappler (21 October 2026).
