By Shaidathul Suhana Ros
KUALA LUMPUR, Oct 21 (Bernama) -- The use of TuJu for road navigation is a step in the right direction from a national security perspective. However, the locally developed application must undergo regular independent security and privacy audits to build public confidence before users can be encouraged to switch to it.
Universiti Sains Malaysia (USM) Cyber Security Research Centre (CYRES) director Prof Dr Selvakumar Manickam said the audits should examine the types of data collected, how it is stored and transmitted, the use of third-party services, access controls and data retention periods.
He said assessments should also cover infrastructure security, penetration testing, reviews of relevant code and system components, and the risks of data breaches and misuse of location information.
“The audits must be conducted regularly, not just one-off, because cyber threats are constantly evolving. The internet does not recognise borders.
“Even if TuJu can ensure that no surveillance is conducted, weak security and privacy measures could still leave the system vulnerable to attacks by hackers and criminals worldwide, potentially exposing Malaysians’ data to cybercrime networks,” he told Bernama when contacted today.
Selvakumar said locally developed applications could give Malaysia greater control over their development, governance and data management. However, their security would depend on how the systems were designed and implemented, as no service could be guaranteed to be 100 per cent secure.
He described TuJu as a positive move from a national security perspective but stressed that the risks associated with any application should be assessed based on technical evidence, data-handling practices, access privileges and evidence of actual or potential data misuse.
“Location data collected over an extended period can reveal daily routines, home addresses, workplaces and periods when homes are unoccupied. When combined with other personal information using artificial intelligence (AI), such data could be exploited for stalking, extortion or more convincing scams,” he said.
He added that restricting location access could reduce exposure but would not eliminate all privacy risks, while switching to a different navigation application alone would not address data collection by other digital services.
Meanwhile, Malaysian Cyber Consumers Association (MCCA) president Siraj Jalil proposed that government agencies, ministries, enforcement bodies and government-linked companies (GLCs) lead the adoption of local navigation applications for official vehicles.
Siraj, who is also a member of the National Consumer Advisory Council (MPPN) under the Ministry of Domestic Trade and Cost of Living (KPDN), said early adoption by government agencies could generate the movement data needed to improve the local navigation system.
However, he cautioned that movement data from security personnel, government officers and public agency vehicles could reveal strategic routes and vulnerabilities in national infrastructure if accessed or misused by external parties.
“Public support for local technology is not just about choosing alternative applications, but also a manifestation of digital patriotism and solidarity in building a self-reliant national cyber ecosystem,” he said.
Siraj said the public should support the development of local applications through continued use and feedback, while the government should provide greater support for local innovations to foster a more competitive technology ecosystem.
To encourage adoption, he suggested incorporating practical features such as real-time flash flood alerts, information on rest and recreation (R&R) facilities, roadwork notifications and toll information, while ensuring accurate estimated arrival times (ETAs) and reliable server performance.
He also stressed that privacy protection should be incorporated from the application’s design stage, with data collection limited to what is necessary for navigation. This should be supported by regular security testing and relevant security certifications.
Siraj urged developers to state clearly in their privacy policies whether data is stored entirely in local data centres, governed by Malaysian law and protected from sale or sharing with third parties and international advertising networks.
Yesterday, Prime Minister Datuk Seri Anwar Ibrahim encouraged the public to use the local app TuJu, developed by the Malaysian Highway Authority (LLM), as an alternative for road navigation.
Anwar said the alternative was proposed over concerns about the security of information and movement data associated with using Waze, which is subject to Israeli law.
Meanwhile, Chief Secretary to the Government Tan Sri Shamsul Azri Abu Bakar announced in a letter dated Oct 20 that the use of Waze by public service personnel was prohibited with immediate effect.
The directive followed a decision made at the National Cyber Security Committee (JKSN) meeting No. 3 of 2026, chaired by Anwar yesterday.
Shamsul Azri said all ministry secretaries-general and department heads must communicate the decision to officers under their supervision, including those in the relevant agencies and departments, to ensure immediate implementation.
-- BERNAMA