The Malaysian government’s decision to restrict civil servants from using Waze while on official duty is a necessary and proportionate cybersecurity measure.
It should not be portrayed as an attack on ordinary Malaysians’ freedom to choose navigation applications. Rather, it is a targeted safeguard intended to reduce the risk of exposing government information, personnel movements and citizens’ personal data.
The National Cyber Security Agency’s (NACSA) explanation is important: the concern is not merely that an application collects location data, but where that data is stored, who can access it and which legal jurisdiction governs it in the event of misuse.
When public officers use navigation applications on official duty, their routes can reveal patterns relating to government facilities, enforcement operations, official travel and sensitive sites. Individually, a route may appear harmless. Aggregated over time, however, such data can become intelligence.
Digital Minister Gobind Singh Deo has clarified that the restriction applies only to civil servants on official duty, not to the general public. This distinction matters.
Malaysians remain free to use the applications of their choice. The government is applying a higher duty of care to those entrusted with public resources and official information.
Some may ask why Waze is restricted while other navigation platforms are not. The answer lies in risk management, not convenience. Different providers operate under different corporate structures, data-handling practices, storage arrangements and legal jurisdictions.
A cybersecurity assessment must consider the full data lifecycle: collection, transmission, storage, access, retention and lawful recourse. Where the ability to obtain remedies or assurances is weaker, a precautionary approach is justified.
Critics may argue that the measure is symbolic because determined actors can still obtain location data through other means. That argument misses the point.
Cybersecurity is rarely about eliminating every risk. It is about reducing exposure, raising the cost of exploitation and protecting the most sensitive activities first. Removing an avoidable channel of potential data leakage from official government use is basic cyber hygiene.
Putrajaya should, however, communicate the policy clearly and consistently. Civil servants need practical guidance on approved applications, acceptable use, device security and reporting obligations.
The public, meanwhile, needs reassurance that this is a limited, evidence-based measure, not a wider restriction on everyday digital life.
Malaysia should also use this opportunity to strengthen its broader digital-sovereignty agenda. Public sector procurement should increasingly favour providers that can demonstrate transparent data governance, local or assured hosting arrangements, strong encryption, auditability and clear legal accountability.
At the same time, local alternatives must be secure, reliable and genuinely useful.
A sovereign-capability strategy fails if it merely substitutes one risk for another. Ultimately, this is about trust.
Citizens expect the government to protect their data, and public institutions must demonstrate that they manage digital risks with discipline. NACSA and the Digital Minister have taken a prudent step. Malaysians should support it and build on it through clearer standards, stronger vendor assurance and sustained public education.
The views expressed here are the personal opinion of the writer and do not represent those of Twentytwo13.
