Anwar Urges Malaysians to Switch From Waze to TuJu Over Data Security Concerns

Malaysia Puts Navigation Data at the Centre of Its Cybersecurity Push

Prime Minister Anwar Ibrahim encouraged Malaysians to use the locally developed TuJu navigation app instead of Waze on October 20, 2026, after a national security meeting examined risks involving personal information and data about people's movements.

Anwar chaired the National Cyber Security Committee's third meeting of 2026, where discussions stretched from navigation apps to digital identity, the Cyber Security Act 2024 and preparations for threats from quantum computers. His recommendation places an everyday driving tool within a wider government effort to protect information and strengthen Malaysia's control over its digital services.

The prime minister said Waze was subject to Israeli government laws and presented TuJu, developed by the Malaysian Highway Authority (LLM), as an alternative. The Malaysian announcement was a recommendation to change apps; no compulsory restriction or deadline for users to switch was announced.

Waze had around six million monthly users in Malaysia in 2017, including about 2.5 million in Kuala Lumpur. Those historical figures show the scale of its established audience, although they do not give its current reach. Kuala Lumpur accounted for roughly 42% of the Malaysian total recorded at that time.

For drivers, the immediate choice concerns which service to trust with information needed to guide a journey. For the government, the issue also involves the laws governing the company providing that service and the protection of information generated as people travel.

Why Waze's Legal Ties Drew Scrutiny

Anwar's intervention followed a call on October 7 from Malaysia Cyber Consumers Association president Siraj Jalil for authorities to review Waze's use. Siraj pointed to terms of use updated on July 8 that identify Waze Mobile Ltd, incorporated under Israeli law and with an address in Tel Aviv, as the service provider.

Siraj said the terms place use of the service under Israeli law and give courts in Tel Aviv exclusive jurisdiction over disputes. Jurisdiction means the legal authority to hear and decide a case. For users, such a clause identifies where a dispute with the service provider would be handled.

Google acquired Waze in 2013. The concern raised by Siraj focused on the legal entity and terms governing the service, while Anwar focused on possible risks to personal information and movement data. Malaysia does not recognise Israel and has no diplomatic relations with it, adding a diplomatic dimension to the government's concern.

Location information can be sensitive because repeated journeys may reveal routines, such as where someone lives, works or regularly visits. A navigation service needs location information to provide directions, making the handling of that information central to the relationship between the service and its users.

Anwar's announcement described a security concern rather than a specific incident involving the release of Malaysian users' data. The practical response he proposed was to encourage a Malaysian alternative while the government strengthens its broader cybersecurity arrangements.

What TuJu Offers Drivers

TuJu was launched on November 26, 2025, by Works Minister Alexander Nanta Linggi at the southbound Seremban rest and service area on the North-South Expressway. LLM developed the app with Prosignal Consortium Sdn Bhd, with work beginning in 2022.

The app combines route guidance and estimated arrival times with information aimed at highway users. Its features include current traffic and toll information, live highway CCTV feeds, emergency assistance and details of rest areas. It is also integrated with the government's MyJalan app.

Those functions give drivers several practical reasons to consider the service. CCTV feeds can help them inspect highway conditions, toll information can help them plan travel costs, and rest area details can help them organise stops. Emergency assistance connects the app's role in navigation with the needs of motorists facing trouble on the road.

TuJu received an updated Android interface in early October, shortly before Anwar's recommendation. The government's endorsement brings fresh attention to an app launched less than a year earlier and places it alongside a service with a long established Malaysian audience.

Drivers considering a switch will need to judge how well TuJu serves their regular journeys. The features described at its launch provide a concrete picture of its highway functions, while Anwar's recommendation adds data security to the reasons for choosing a navigation provider.

How the Policy Developed

The October 20 meeting brought together work that had been developing across several years. Malaysia's cybersecurity law, TuJu's launch and earlier discussions about digital independence all preceded the latest recommendation.

• August 26, 2024: The Cyber Security Act 2024, also known as Act 854, came into force.
• August 21, 2025: At an earlier committee meeting, Anwar called for stronger domestic capabilities in areas including cloud computing and preparations for quantum computing threats.
• November 26, 2025: TuJu was launched at the southbound Seremban rest and service area.
• October 7, 2026: MCCA president Siraj Jalil called for a review of Waze, citing its terms of use and Israeli jurisdiction.
• October 20, 2026: Anwar chaired the committee's third meeting of the year and encouraged Malaysians to use TuJu.
• Early 2027: Iraq's announced complete ban on Waze is due to begin.

Iraq has cited Waze's Israeli origins and data security concerns in announcing its ban. Iran has also previously blocked and restricted access to the app because of its connection to Israel. Malaysia's response currently centres on encouraging an alternative.

Anwar's earlier call for domestic cloud computing capabilities gives the latest decision a wider policy context. The government is seeking greater control over technologies that carry public information, from the services people use on their phones to the infrastructure supporting digital government.

Critical Services Face Formal Security Duties

The committee also reviewed implementation of the Cyber Security Act 2024 and protection of National Critical Information Infrastructure (NCII). This term refers to computer systems and networks supporting services whose disruption could have serious national consequences.

The Act established the National Cyber Security Committee and sets out responsibilities for the chief executive of the National Cyber Security Agency (NACSA), sector leads and organisations designated as NCII entities. It also covers management of threats and incidents affecting critical infrastructure and the licensing of cybersecurity service providers.

Regulations under the Act require NCII entities to report initial details of a cyber incident within six hours of becoming aware of it. That short reporting window is a concrete obligation for affected organisations, requiring them to recognise trouble and notify authorities quickly.

Malaysia's NCII framework covers 11 sectors. They include government, banking and finance, transportation, defence and national security, healthcare, and energy. An attack on systems in these areas can affect services people depend on, from transport operations to access to healthcare.

The meeting therefore addressed both personal choices about apps and formal duties for organisations operating essential systems. The Waze recommendation concerns the handling of individual users' information, while the Act provides a structure for responding to threats against critical services.

MyKad and MyDigital ID Have Different Jobs

Anwar said the government was strengthening an integrated identity system using MyKad as the physical credential and MyDigital ID for digital transactions. He linked that work to stronger cyber protection and preparations for future threats.

In his statement after the meeting, the prime minister set out the government's position on protecting personal information:

We cannot compromise when it comes to the security of our citizens' data and identities.

MyDigital ID operates as a single sign-on service. In simple terms, it allows someone to establish their identity through a shared login system when accessing participating digital services. MyKad continues to serve as the physical identification credential.

MyDigital ID Sdn Bhd, a wholly owned company of MOF Inc., operates the platform, with oversight by NACSA under the National Security Council. NACSA and MyDigital ID explained these roles in a September 2025 statement.

Anwar said in August 2025 that MyDigital ID was gaining an average of 25,000 users a day following integration with MyJPJ, MySejahtera and MyGOV. That figure describes adoption at the time of his earlier statement. As more public services use a common identity system, protecting access to it becomes a central part of protecting users' dealings with government.

Why Quantum Computing and Autonomous AI Were Discussed

The October 20 meeting included preparations against quantum computing threats through post-quantum cryptography (PQC). Cryptography is the mathematics used to protect information, including messages, identity checks and online transactions.

Sufficiently powerful quantum computers could break some methods used today to secure digital information. PQC uses mathematical methods designed to withstand those attacks. The purpose of preparing early is to keep systems and sensitive information protected as computing technology changes.

Anwar had already discussed developing PQC with NACSA, researchers and industry at the August 2025 committee meeting. Its return to the agenda connects the government's current identity and public service systems with security planning for technologies still developing.

Autonomous artificial intelligence was another topic. Such systems can carry out tasks with less continuous human direction. In cybersecurity, that creates concerns about tools that could automate parts of an attack or act at a speed that makes human supervision difficult.

Anwar placed these emerging threats alongside existing responsibilities under the Cyber Security Act. The common task is to protect information and keep services dependable while the technology used to operate and attack them continues to change.

What Changes for Malaysians

Malaysian motorists now have an explicit recommendation from the prime minister to consider TuJu instead of Waze. TuJu's route guidance, toll information, CCTV feeds and emergency functions give that recommendation a practical focus beyond the question of where an app originated.

People using digital public services face a related government priority: stronger protection for identity and transactions. MyKad and MyDigital ID retain their separate roles, while the government links their security to its wider work on critical infrastructure and future computing threats.

Anwar said the aim was to ensure that digital public services benefit people without compromising security, public trust or national sovereignty. The October 20 meeting brought those goals into a familiar setting: the app a driver opens before beginning a journey.

Key Points

• Anwar encouraged Malaysians to use TuJu instead of Waze after a cybersecurity meeting on October 20, 2026.
• He cited concerns about personal information, movement data and Waze's obligations under Israeli law.
• TuJu was developed by LLM with Prosignal Consortium and launched on November 26, 2025.
• Malaysia announced a recommendation to switch apps, while Iraq has announced a ban beginning in early 2027.
• The committee also discussed critical infrastructure, MyDigital ID, autonomous AI and protection against quantum computing threats.
• MyKad remains the physical identity credential, while MyDigital ID supports access to digital services.