Explained: How foreign navigation apps could reveal sensitive routes and government activity in Malaysia

KUALA LUMPUR, Oct 28 — Cybersecurity expert and former CyberSecurity Malaysia chief executive officer Datuk Amirudin Abdul Wahab warns that foreign navigation applications pose a threat to Malaysia's national security by collecting vast amounts of location data. While individual data points may seem innocuous, when combined over time, they create detailed digital movement profiles, revealing personal information, home addresses, workplaces, and movement patterns.

For instance, a government official's consistent route to work, meetings, and airports could expose sensitive details about their role and priorities. Combining this location data with open-source information like job titles and organizational affiliations can provide even more insight into an individual's professional life.

The risk becomes even more pronounced when this data is processed through advanced analytics and artificial intelligence, which can turn routine location data into actionable intelligence, potentially detailing meeting schedules and the timing of personnel entering or exiting sensitive facilities.

Amirudin emphasizes that Malaysia should focus on digital sovereignty through risk assessment, not merely by banning foreign technology. He suggests that a ban on using Waze for official purposes is a prudent measure, provided it is supported by transparent risk assessments and the development of robust local alternatives. He calls for the government to understand who controls the data, where it is processed, and which legal jurisdictions apply.

Moreover, UKM digital transformation expert Prof Nurhizam Safie highlights the risks associated with relying on foreign navigation platforms to map strategic areas and routes, which could be exploited in times of military conflict. He advocates for strengthening partnerships with local agencies, like the Department of Survey and Mapping Malaysia (Jupem), to develop sovereign alternatives.

Nurhizam urges the government to utilize existing infrastructure, such as the Public Sector Data Centre in Putrajaya, to host and process data locally, ensuring it remains under government control and is not stored on foreign servers. Strengthening the Personal Data Protection Act to include provisions on data localisation and cross-border data transfer procedures is also crucial.

Nurhizam stresses that achieving digital sovereignty by 2030 hinges on leveraging local talent to create tailored software, hardware, and server systems.