Malaysia Bans Waze for Civil Servants: The Real Lesson Is Digital Sovereignty, Not Just Israel

Malaysia’s decision to prohibit civil servants from using Waze raises a bigger question for African governments: who controls the digital infrastructure that increasingly knows where citizens travel, work, live and gather?

On October 20, 2026, Malaysia’s National Cyber Security Committee, chaired by Prime Minister Anwar Ibrahim, decided to prohibit civil servants from using Waze, the popular navigation application owned by Google. The directive took immediate effect, with government departments instructed to comply.

Anwar cited concerns about the security of citizens’ information and movement data, arguing that Waze’s connection to Israel and its exposure to Israeli law raised national security questions. He encouraged the use of TuJu, a navigation application developed by Malaysia’s Highway Authority, as an alternative. The directive was confirmed in an official circular issued by the government’s chief secretary. <Cite refs={["turn294699news11","turn294699search1"]} />

The decision is significant, but it should not be reduced to another episode in the political confrontation surrounding Israel and Palestine.

It raises a much broader issue: can a country claim digital sovereignty when its public institutions depend on foreign-owned technology for essential services?

For Nigeria and other African countries, this question deserves serious attention.

Navigation apps are more than digital maps

Most people use Waze for a straightforward reason: it helps them avoid traffic, identify road hazards and find faster routes.

But navigation platforms can also process valuable information about how people move. Depending on the application, its permissions and the user's settings, location-related information can include current positions, routes, destinations, search activity and device details.

When aggregated, movement data can reveal patterns that go beyond the individual user. It may help identify commuting corridors, recurring travel schedules, concentrations of activity and changes in movement around particular locations.

For ordinary consumers, these insights can improve navigation services. For security agencies, however, movement patterns may also have operational significance.

Consider a government official who regularly visits a sensitive installation, an employee responsible for critical infrastructure or a security officer whose movements reveal deployment patterns. Information that appears harmless when viewed individually can become more sensitive when combined with other records.

This does not establish that Waze has used its data to spy on Malaysian officials, nor did the publicly reported announcement provide specific evidence that Israel had accessed or exploited such information. The distinction matters: a potential security exposure is not proof of an actual breach.

Nevertheless, governments are entitled to examine the legal jurisdiction, data practices and technical safeguards of the digital services used by their institutions.

The question is not only where a company was founded

Waze was founded in Israel and acquired by Google in 2013 for approximately US$1 billion. It operates within Google's wider technology ecosystem, while the service's legal terms and corporate arrangements remain relevant to questions about jurisdiction and data handling. <Cite refs={["turn294699news11","turn294699search6"]} />

Malaysia's stated concern is that the application is subject to Israeli law. But the national-security implications of a digital product cannot be established by its country of origin alone.

A serious assessment should examine several questions:

• Which legal entity provides the service, and which jurisdictions can compel it to disclose information?
• What location data does the application collect, and how long is that data retained?
• Where is the data stored and processed?
• Which employees, contractors, partners or government authorities can access it?
• What security controls, independent audits and legal remedies are available?
• Does the organisation's privacy policy permit data sharing that could create risks for government personnel?

These questions should apply to technology from Israel, the United States, China, Europe and elsewhere.

Foreign ownership can create legal and geopolitical exposure, but nationality alone does not establish that a particular product is unsafe. Equally, a familiar international brand should not receive automatic trust simply because it is popular or convenient.

Digital sovereignty requires evidence-based risk assessment rather than assumptions about national origin.

Malaysia is attempting to build an alternative

One important element of the decision is the recommendation to use TuJu, a local navigation application developed by Malaysia's Highway Authority with a private-sector partner.

According to Malaysia's national news agency, TuJu provides route information, estimated arrival times, toll information, traffic updates, access to certain live highway cameras, information about rest areas and emergency assistance. It was launched in November 2025. <Cite refs={["turn294699search1","turn294699search4"]} />

This makes the decision more consequential than a simple instruction to uninstall a foreign application. Malaysia has identified a domestic alternative and is encouraging its adoption by public institutions.

Yet a local application is not automatically secure simply because it was developed at home.

TuJu must still demonstrate that its data collection is proportionate, its infrastructure is protected, its software is maintained and its governance is transparent. Its hosting arrangements, third-party dependencies, access controls and retention policies matter as much as the nationality of its developers.

If Malaysia wants public servants to trust the replacement, it should explain how the application protects their information and how it will be independently evaluated.

A successful domestic alternative must compete on reliability, usability and security—not merely on its national identity.

Africa faces the same structural dependency

African governments increasingly rely on foreign technology for cloud hosting, digital identity, office productivity, artificial intelligence, payments, communications and mapping.

These services bring substantial benefits. Building every component locally would be expensive, time-consuming and, in many cases, unnecessary.

The problem arises when governments adopt essential technology without adequately understanding the legal and technical dependencies beneath it.

A ministry may store documents on an overseas cloud platform. A security agency may use foreign collaboration software. Public servants may use consumer applications to communicate or navigate between facilities. An AI assistant may process confidential material through infrastructure located outside the country.

Each decision can be convenient and commercially reasonable. Collectively, however, they can create dependencies that become difficult to manage during a diplomatic dispute, a regulatory conflict, a service interruption or a cybersecurity incident.

For Nigeria, the lesson is not to ban every foreign platform. It is to identify which systems handle sensitive government information, assess the risks they create and establish credible alternatives where national interests require them.

A government cannot protect digital sovereignty simply by declaring that its data belongs to Nigerians. It must understand who can access that data, where it travels and which legal systems govern the companies processing it.

Nigeria should apply the same scrutiny to its own digital infrastructure

Nigeria has made commitments to strengthen data protection, cybersecurity and digital public services. The Nigeria Data Protection Commission provides a national framework for personal-data protection, while public institutions and businesses increasingly depend on cloud and software providers operating across borders.

That makes the Malaysian example relevant, particularly for government agencies, security organisations and institutions managing sensitive personal information.

Nigeria should begin with a transparent inventory of the digital services used by public institutions. The inventory should distinguish routine consumer applications from systems that process sensitive government, law-enforcement or critical-infrastructure information.

Where a service creates a meaningful risk, agencies should conduct documented assessments covering:

1. Data sensitivity: What information is collected, and could it reveal sensitive movements or operations?
2. Legal jurisdiction: Which laws and authorities may affect access to the data?
3. Technical safeguards: Is information encrypted, access-controlled and protected against unauthorised disclosure?
4. Operational dependency: What happens if the service becomes unavailable or the provider changes its terms?
5. Alternative capacity: Is there a reliable domestic or otherwise suitable replacement?
6. Accountability: Who is responsible for monitoring the risk, responding to incidents and informing affected people?

This approach would allow Nigeria to make security decisions based on evidence rather than political pressure, public outrage or the popularity of a particular technology brand.

It would also reduce the risk of costly bans that are announced before a functional replacement is available.

Digital sovereignty requires more than buying local

There is a danger in treating digital sovereignty as a branding exercise.

A product can be developed by a local company yet rely on foreign cloud infrastructure, imported components, overseas analytics services or software libraries maintained elsewhere. A domestic application may still transfer sensitive information to third parties.

Conversely, a foreign-owned service may provide strong security controls and contractual protections. Its suitability depends on the specific use case, threat model, jurisdiction and technical architecture.

The objective should therefore be to increase national control over critical digital capabilities, not to pretend that every foreign product is dangerous or that every domestic product is secure.

For African countries, this could involve investing in local software development, cybersecurity expertise, research institutions, trusted hosting options and independent technical audits. It could also mean requiring public-sector technology contracts to disclose relevant data flows and third-party dependencies.

The goal is to make governments capable of choosing their technology providers from a position of knowledge and bargaining power.

The geopolitical dimension cannot be ignored

Malaysia's decision also sits within the country's longstanding support for the Palestinian cause and its lack of diplomatic relations with Israel. The government's stated security rationale therefore exists within a broader political context. <Cite refs={["turn294699news11","turn294699search2"]} />

That context should neither be ignored nor allowed to substitute for technical evidence.

A country may have legitimate foreign-policy reasons to avoid certain suppliers, but a cybersecurity policy should clearly explain whether its restrictions are based on a demonstrated vulnerability, a legal exposure, a strategic assessment or a broader political decision.

Those are different grounds, and each has different implications.

If governments conflate them, security policy risks becoming inconsistent: one country's technology may be restricted because of its origin while comparable risks from another country go unexamined.

A credible national-security framework should apply consistent standards, disclose as much supporting evidence as security permits and periodically review restrictions as circumstances change.

That would make the policy more defensible and more useful beyond the immediate political moment.

Conclusion: African governments should learn the principle, not simply copy the ban

Malaysia's Waze directive offers an important reminder that digital infrastructure is now part of national security. Navigation applications can process sensitive movement information, just as cloud platforms, identity systems and AI services can handle other forms of strategically valuable data.

But the strongest lesson is not that Nigeria should automatically ban Waze or any other foreign application.

It is that governments should know what their digital systems collect, who controls them, which laws govern them and what happens if the relationship becomes a security risk.

Where a serious risk exists, governments should mitigate it, restrict the relevant use or develop a credible alternative. Where the evidence does not justify a blanket prohibition, they should avoid confusing political symbolism with cybersecurity.

Malaysia has made its decision for its civil service and encouraged the use of a domestic navigation application. Whether that approach delivers stronger security will depend on the quality of the replacement and the evidence supporting the restriction.

For Nigeria and the wider African continent, digital sovereignty should mean having the technical expertise, legal safeguards and institutional capacity to make these decisions independently.

The objective is not to disconnect Africa from the world. It is to ensure that participation in the global digital economy does not leave African governments blind to the dependencies on which their security and public services increasingly rely.