Connected Cars, Foreign Apps, and Malaysia’s Security

 

Malaysia’s decision to prohibit civil servants from using Waze raises a larger question: should Chinese-manufactured electric vehicles face similar restrictions because of their potential to collect sensitive information?

The answer requires more than geopolitical suspicion. It demands a consistent national-security framework that evaluates technology, foreign legal obligations, access to data and the consequences of possible exploitation.

The government’s Waze directive, issued on 20 October 2026 following a National Cyber Security Committee meeting, prohibits civil servants from using the navigation application while performing official duties.

Authorities cited concerns about location data and the potential exposure of sensitive government information to foreign jurisdictions. The principle is understandable: information about where officials travel, which facilities they visit and how frequently they move can have intelligence value.

However, applying that principle to Chinese electric vehicles requires a more sophisticated assessment than simply comparing foreign origins.

Different Technologies, Comparable Risks

Waze collects location and route information to provide navigation and real-time traffic services. Aggregated movement patterns could potentially reveal visits to government offices, police facilities, military installations or critical infrastructure. A sufficiently detailed dataset might help an adversary identify routines, infer relationships between officials or establish patterns of activity.

Connected electric vehicles present a potentially broader surveillance surface. Depending on their equipment and software, they may contain GPS receivers, cameras, microphones, radar, telematics systems and internet-connected control units.

These systems can generate information about a vehicle’s location, surroundings, occupants and usage. Compromised systems could potentially expose sensitive sites, identify personnel movements or create opportunities for cyber intrusion.

The distinction is important. Waze primarily provides navigation services through a mobile application, whereas a connected vehicle may combine physical sensors, onboard computing and remote connectivity. A vulnerability in the latter could therefore have implications extending beyond personal privacy to operational security and, in some circumstances, vehicle safety.

Nevertheless, technical capability does not establish actual espionage. The existence of cameras, microphones or remote connectivity does not prove that a manufacturer transmits sensitive recordings to a foreign intelligence agency. Security assessments must distinguish between what a device can collect, what it transmits and what an adversary could obtain.

China’s Intelligence Laws and Corporate Obligations

The legal environment governing Chinese companies deserves scrutiny. Article 7 of China’s National Intelligence Law requires organisations and citizens to support, assist and cooperate with national intelligence work in accordance with law. Article 14 empowers intelligence institutions to request necessary support from relevant organisations and citizens.

These provisions create legitimate questions about the extent to which Chinese technology companies could be compelled to assist intelligence operations. The concern is not confined to state-owned enterprises: the wording of Article 7 is broad and does not exempt companies simply because they are privately owned.

China’s Data Security Law also establishes a national-security-oriented framework for data governance, while its Personal Information Protection Law regulates the processing of personal information and includes provisions governing cross-border transfers. These laws must be read together rather than assuming that every provision automatically authorises unrestricted intelligence access.

Crucially, the existence of a legal duty to cooperate does not prove that every Chinese manufacturer routinely transfers overseas vehicle data to intelligence agencies. Nor does it establish that every request would necessarily involve Malaysian information. The risk arises from the combination of potential access, corporate obligations, technological capability and limited independent visibility into certain state-directed activities.

This is a credible basis for scrutiny, not proof of a specific act of espionage.

Should Malaysia Restrict Chinese EVs?

The United Kingdom offers a useful comparison. In March 2025, the Ministry of Defence confirmed that it had no centrally mandated prohibition on Chinese-manufactured vehicles entering military premises, while acknowledging that individual defence organisations could impose stricter requirements.

In September 2026, the UK government reiterated that its policies consider potential threats from vehicles regardless of their country of manufacture and that risks are managed according to operational requirements.

This approach illustrates an alternative to an automatic blanket ban: assess threats across vehicle categories while applying additional controls where the sensitivity of a location or function justifies them.

Malaysia should adopt the same principle. Chinese EVs used by military personnel, intelligence officers, senior security officials or personnel handling classified information warrant stricter examination than vehicles used exclusively for ordinary private transport. Restrictions on connected vehicles entering sensitive installations may be justified even when the vehicles are not prohibited elsewhere.

Possible safeguards include independent technical testing, restrictions on recording and connectivity near sensitive facilities, examination of remote-access capabilities, controls on data storage and transmission, and contractual requirements governing software updates and security vulnerabilities. Procurement decisions should also consider whether manufacturers can demonstrate compliance through verifiable technical evidence.

These measures should not be limited to Chinese brands. Vehicles manufactured elsewhere may incorporate Chinese components, while manufacturers headquartered in Western countries may also collect substantial amounts of personal and location data. The relevant question is who can access the information, under what legal authority and with what technical safeguards.

Security Without Double Standards

Malaysia’s Waze decision also creates a test of policy consistency. If foreign jurisdiction over data is sufficient to trigger restrictions, the government should explain how it assesses comparable risks involving other applications, cloud services, connected vehicles and digital infrastructure.

A locally developed product is not automatically secure. TuJu, recommended as an alternative to Waze, should be evaluated through the same standards of data minimisation, encryption, access controls, independent testing and transparent privacy practices. Digital sovereignty requires demonstrable control over information, not merely domestic branding.

An indiscriminate prohibition on Chinese EVs could raise procurement costs, reduce consumer choice and complicate the adoption of electric mobility. Conversely, ignoring credible vulnerabilities could expose sensitive government operations. A risk-based policy can address both concerns without presuming either that Chinese products are inherently dangerous or that commercial technology is politically neutral.

Malaysia should therefore treat Chinese EVs with the same seriousness as Waze, but not necessarily with the same restrictions. The objective should be to protect sensitive information through proportionate, evidence-based controls. National security is too important for complacency, but it is equally ill-served by decisions that substitute a product’s nationality for a rigorous assessment of its actual risks.

References

Allison, G. (2025, March 21). UK confirms no MOD ban on Chinese electric vehicles. UK Defence Journal. https://ukdefencejournal.org.uk/uk-confirms-no-mod-ban-on-chinese-electric-vehicles/

Bernama. (2026, October 21). Civil servants banned from using Waze with immediate effect—KSN. https://www.bernama.com/en/news.php?id=2623648   

National People’s Congress of the People’s Republic of China. (2017). National Intelligence Law of the People’s Republic of China. China Law Translate. https://www.chinalawtranslate.com/en/national-intelligence-law-of-the-p-r-C-2017/

National People’s Congress of the People’s Republic of China. (2021a). Data Security Law of the People’s Republic of China. http://www.npc.gov.cn/englishnpc/c2759/c23934/202112/t20211209_385109.html

National People’s Congress of the People’s Republic of China. (2021b). Personal Information Protection Law of the People’s Republic of China. https://en.spp.gov.cn/2021-12/29/c_948419.htm

The Straits Times. (2026, October 21). Malaysia bans Waze for civil servants amid mounting fears over foreign digital surveillance. https://www.straitstimes.com/asia/se-asia/malaysia-bans-waze-for-civil-servants-amid-mounting-fears-over-foreign-digital-surveillance

UK Parliament. (2026, September 7). Written questions and answers: Question 19122. https://questions-statements.parliament.uk/written-questions/detail/2026-07-15/19122

22.10.2026

Kuala Lumpur.

© All rights reserved.