Your phone knows where you go. Your car may know too. But who keeps those records, and where do they end up? Malaysia’s Waze ban raises uncomfortable questions for Brunei. In an age of connected vehicles and invisible data trails, are we surrendering our privacy in exchange for convenience?
Malaysia has barred its civil servants from using Waze. For Brunei, which depends heavily on imported vehicles and foreign-developed navigation systems, the question runs deeper.
By Malai Hassan Othman
KopiTalk with MHO | 22 October 2026 | Part One of Two
Imagine a government officer leaving his home in Kiulap at seven in the morning. He drops his children at school, drives to his ministry, and in the afternoon visits an installation he does not discuss with friends.
His phone may record the route. So may his car.
Nobody needs to hack anything or steal a document. Such records can be created simply because a journey happened, and because the technology was designed to remember it.
On Tuesday, 20 October, Malaysia’s National Cyber Security Committee, chaired by Prime Minister Anwar Ibrahim, decided to bar civil servants from using Waze. The Chief Secretary to the Government, Shamsul Azri Abu Bakar, conveyed the directive the same day.
A follow-up guidance document clarified that the ban covers official duties only. Officers were still encouraged to uninstall the application, and the Prime Minister’s Department advised all Malaysians to switch to local alternatives.
Its preferred alternative is TuJu, a navigation application developed by the Malaysian Highway Authority.
The stated reason was data. Waze was developed in Israel before Google bought it in 2013, and its privacy policy identifies Waze Mobile Ltd as operating under Israeli law.
What has not been publicly established is that Israeli intelligence has received Malaysian users’ location data. Malaysia acted on risk, not proof, as governments are entitled to do.
Malaysian MPs have since sought clarification on the risks posed by other applications. That question deserves an answer in Brunei too, because it reaches well beyond one application and one country.
Location data is rarely secret one point at a time. Its value lies in repetition. A car leaving the same house each morning and parking at the same building reveals a home, a workplace and a routine.
For an ordinary motorist, that is a privacy matter. For an officer with access to sensitive installations, or the driver of a senior official, it becomes a security matter.
This is not theory. In 2016, computer scientists at the University of California, Santa Barbara, showed that fake Waze accounts could track real users and plant false traffic jams.
In 2020, another researcher found that data exposed on Waze’s Live Map could allow individual drivers to be followed. Both weaknesses were reportedly fixed.
In 2018, the fitness application Strava published a global heatmap of its users’ runs. Analysts soon spotted the outlines of military bases, traced by soldiers jogging the same routes every morning.
None of these cases established the involvement of any intelligence agency. Each showed how ordinary movement data becomes sensitive once enough of it is gathered in one place.
Malaysia’s ban concerns an application a driver chooses to open. But a growing number of cars on Brunei’s roads no longer wait to be asked.
Some newer models come with built-in navigation, mobile connectivity and a companion application. Depending on the model and its settings, a vehicle may send location data to the manufacturer or its service providers.
In 2023, the Mozilla Foundation reviewed the privacy practices of 25 car brands, including Toyota, Ford and Volkswagen. Every one failed. Mozilla called cars the worst product category it had ever reviewed for privacy.
Governments have taken note. In 2021, China’s military barred Tesla vehicles from its complexes over concerns about their cameras. Some Chinese government offices later told staff not to park Teslas inside.
In January 2025, the United States finalised restrictions on specified connected-vehicle software and hardware linked to China or Russia, with software restrictions beginning in model year 2027 and hardware restrictions generally following in model year 2030.
The pattern is worth noticing. China worries about American cars. America worries about Chinese cars. Malaysia worries about an Israeli-linked application. Each fears data flowing into another country’s jurisdiction.
Brunei’s position is different from all three. We import the cars we drive and depend heavily on foreign-developed systems that guide them. Our vehicles come from Japan, Korea, Europe, China and elsewhere.
Larger countries may have greater room to exclude suppliers by nationality. For a small country buying from many markets, replacing one supplier may simply mean depending on another.
That leaves Brunei with a harder choice. It cannot always choose where the technology originates. It can seek to determine the terms on which those products operate here.
Brunei is not without foundations. In his titah on the 35th National Day in 2019, His Majesty Sultan Haji Hassanal Bolkiah Mu’izzaddin Waddaulah ibni Al-Marhum Sultan Haji Omar ’Ali Saifuddien Sa’adul Khairi Waddien, Sultan and Yang Di-Pertuan of Brunei Darussalam, stressed that cyber security must be given special attention.
His Majesty cautioned that the negative effects of the cyber world could seep into the nation, society and the family. Cyber Security Brunei was established the following year.
Since then, Brunei has enacted the Cybersecurity Act and published a National Cyber Security Strategy. On 1 January this year, the main provisions of the Personal Data Protection Order 2025 came into force.
These are significant achievements. Yet the published frameworks do not set out a distinct approach to the security implications of location data routinely gathered by navigation applications and connected vehicles.
The national strategy’s threat chapter gives considerable attention to scams, ransomware, phishing and hijacked social media accounts, among the incidents reported here. It does not set out specific guidance on connected vehicles and commercial location data.
The personal data law primarily regulates private-sector organisations rather than government agencies. Its obligations may apply to personal location records within its scope, but cross-border processing and enforcement raise practical questions.
Brunei has the frameworks. What remains unclear publicly is how they address the questions Malaysia has just raised.
Closing that gap need not mean banning anything. It means setting out what officers, agencies and companies are expected to do, before an incident makes the decision for us.
First, officers who handle sensitive work, or visit sensitive sites, should have clear guidance on navigation applications and location settings during official duties. Most of the risk lies in habits, not hardware.
Second, government vehicle purchases could require suppliers to disclose any connected services, and to allow location tracking to be switched off. Procurement is where a small buyer has real leverage.
Third, the relevant authorities, including the Authority for Info-communications Technology Industry (AITI), could seek clearer disclosures from car distributors and application providers about their handling of Bruneians’ location data.
Fourth, the next revision of the national strategy, which describes itself as a live document, could address connected vehicles and the wider Internet of Things directly.
Fifth, public awareness campaigns, already strong on scams and passwords, could carry one more simple message: your phone and your car may remember where you have been.
Not every measure requires substantial expenditure. Much begins with asking the right questions early, rather than answering them under pressure.
Consistency matters too. If Waze deserves scrutiny, so do Google Maps, Apple Maps, ride-hailing services, fitness trackers and connected cars. They differ in ownership, law and safeguards, and should be judged on those differences.
Local ownership is no shortcut either. A home-grown application gives a government more oversight, but it still needs independent testing, clear retention limits and honest privacy terms.
For ordinary motorists, the first steps are modest. Check which applications can see your location at all times. Open your car’s companion application and read its data settings. Ask the dealer what the car sends home.
The officer we imagined in Kiulap drives home tonight the way he always does. Depending on his settings, his phone may log the route. His car may do so too.
Somewhere, on a server he will never see, in a country he may never visit, the journey may be kept long after he has parked.
A nation that depends on others to guide its journeys must at least have a say in who keeps the record of where its people have been.




