Explained: How foreign navigation apps could reveal sensitive routes and government activity in Malaysia

KUALA LUMPUR, Oct 28 — The continuous collection of location data by foreign navigation applications does more than reveal users’ daily routines, it could also be processed into strategic intelligence, potentially compromising national security and sovereignty.

Cybersecurity expert and former CyberSecurity Malaysia (CSM) chief executive officer Datuk Amirudin Abdul Wahab said navigation applications typically collect a wide range of data, including travel histories, timestamps, IP addresses, device sensor data and frequently visited locations.

He said that while individual data points might seem harmless, aggregating them over time can create detailed digital movement profiles that reveal users’ personal information, home addresses, workplaces, and movement patterns.

“This is where the concepts of data collection and inference become critical. For instance, a senior government official’s consistent movement from home to a ministry, security meeting venues, and airports can reveal insights into the individual’s role, professional network, and operational priorities.

“The risk becomes even more acute when this location data is combined with open-source information, such as an individual’s job title and organisational affiliation,” he told Bernama.

Amirudin said modern data analytics and artificial intelligence (AI) could transform routine location data into actionable intelligence, potentially revealing meeting frequencies and the times civil servants enter or leave sensitive facilities.

On digital sovereignty and the implications of foreign laws governing applications such as Waze, he stressed that Malaysia did not need to reject all foreign technology.

Instead, the government must have a clear understanding of who controls the data, where it is processed and which legal jurisdictions apply, he said.

He described a ban on using Waze for official government business as a reasonable precaution but stressed that such a measure should be backed by transparent risk assessments and the development of robust local alternatives.

“The correct approach to digital sovereignty is through risk assessment, rather than simply banning an application based solely on who owns it,” he said.

Meanwhile, Universiti Kebangsaan Malaysia (UKM) digital transformation expert Prof Nurhizam Safie said the use of foreign navigation platforms to map remote areas and strategically significant routes through crowdsourced data could pose risks from military and geopolitical perspectives.

He said in the event of a conflict, mapping data held by foreign entities could potentially be exploited for tactical military planning, including invasion strategies, without users being aware of how their data was being used.

To address this vulnerability and reduce reliance on external service providers, Nurhizam called on the government to strengthen strategic partnerships with local technical agencies, particularly the Department of Survey and Mapping Malaysia (Jupem).

“Jupem possesses a highly comprehensive national mapping and geospatial database. Efforts to strengthen local alternative applications should involve close collaboration with the department.

“Through initiatives such as GovTech under the National Digital Department, we can leverage Jupem’s mapping data and our own satellite infrastructure to develop applications that are truly sovereign and remain under government oversight,” he said.

Nurhizam also urged the government to maximise existing infrastructure, including the Public Sector Data Centre (PDSA) in Putrajaya, to host and process data on self-hosted servers.

He said this would help ensure that data collected by local navigation applications, such as TuJu, was not transferred to, stored on, or placed under the control of third parties through overseas database servers.

“To ensure more comprehensive protection, the provisions under the Personal Data Protection Act (PDPA) should also be reviewed and strengthened, particularly those concerning data localisation and procedures for cross-border data transfers.

“We have no choice but to place our trust in local talent to develop our own software, hardware and server systems, ensuring that the goal of achieving digital sovereignty by 2030 becomes a reality,” he said. — Bernama

Special delivery? Man nabbed over cannabis and drug-laced vapes at Kelantan courier outlet

Kedah Fire Dept says ‘Bomba’ vehicle allegedly caught running red light is not its own

Don’t just use technology, create it: Malaysia must step up innovation drive, says Mosti

吉隆坡，10 月 28 日讯——外国导航应用程序不断收集位置数据，不仅会泄露用户的日常作息，还可能被处理成战略情报，从而可能损害国家安全和主权。

网络安全专家兼马来西亚网络安全局 (CSM) 前首席执行官拿督阿米鲁丁·阿卜杜勒·瓦哈卜表示，导航应用程序通常会收集各种数据，包括旅行历史、时间戳、IP 地址、设备传感器数据和经常访问的位置。

他表示，虽然单个数据点看起来可能无害，但随着时间的推移将它们汇总起来，可以创建详细的数字移动概况，从而揭示用户的个人信息、家庭住址、工作场所和移动模式。

“数据收集和推断的概念在这里就显得至关重要了。例如，一位高级政府官员频繁往返于家、部委、安全会议场所和机场之间的行程，可以揭示出该官员的角色、职业网络和工作重点。”

“当这些位置数据与开源信息（例如个人的职位和组织隶属关系）相结合时，风险会变得更加严重，”他告诉马新社。

阿米鲁丁表示，现代数据分析和人工智能 (AI) 可以将常规位置数据转化为可操作的情报，从而有可能揭示会议频率以及公务员进出敏感设施的时间。

关于数字主权以及外国法律对 Waze 等应用程序的影响，他强调马来西亚无需拒绝所有外国技术。

他表示，政府必须清楚地了解谁控制着这些数据，数据在哪里处理以及适用哪些法律管辖权。

他认为禁止使用 Waze 处理官方政府事务是一项合理的预防措施，但强调此类措施应以透明的风险评估和开发可靠的本地替代方案为支撑。

他说：“实现数字主权的正确方法是进行风险评估，而不是仅仅根据应用程序的所有者就将其禁用。”

与此同时，马来西亚国立大学（UKM）数字化转型专家努尔希扎姆·萨菲教授表示，利用外国导航平台通过众包数据绘制偏远地区和具有战略意义的路线图，可能会从军事和地缘政治角度带来风险。

他表示，一旦发生冲突，外国实体持有的地图数据可能会被用于战术军事规划，包括入侵战略，而用户却不知道自己的数据是如何被使用的。

为了解决这一脆弱性并减少对外部服务提供商的依赖，努尔希扎姆呼吁政府加强与当地技术机构的战略伙伴关系，特别是与马来西亚测绘局（Jupem）的伙伴关系。

“Jupem拥有高度全面的国家地图和地理空间数据库。加强本地替代应用的努力应与该部门密切合作。”

他说：“通过国家数字部下属的 GovTech 等项目，我们可以利用 Jupem 的地图数据和我们自己的卫星基础设施来开发真正自主且始终处于政府监督下的应用程序。”

努尔希扎姆还敦促政府最大限度地利用现有基础设施，包括布城的公共部门数据中心（PDSA），在自建服务器上托管和处理数据。

他表示，这将有助于确保途居等本地导航应用程序收集的数据不会通过海外数据库服务器传输到第三方、存储在第三方服务器上或置于第三方的控制之下。

“为确保更全面的保护，还应审查和加强《个人数据保护法》（PDPA）的规定，特别是有关数据本地化和跨境数据传输程序的规定。

他说：“我们别无选择，只能信任本地人才，自主研发软件、硬件和服务器系统，以确保到2030年实现数字主权的目标成为现实。”——马新社

特殊快递？男子在吉兰丹快递点因持有大麻和掺有毒品的电子烟被捕。

吉打州消防局表示，涉嫌闯红灯的消防车并非其所有。

莫斯蒂表示，马来西亚不仅要使用技术，更要创造技术：马来西亚必须加大创新力度。