TuJu isn't the answer. Malaysia needs open map data.
On 20 October, after chairing a National Cyber Security Committee meeting, Prime Minister Anwar Ibrahim advised Malaysians to switch from Waze to TuJu, a navigation app from LLM (the Malaysian Highway Authority). His reason: Waze is subject to Israeli law, which puts data about where Malaysians go at risk. He didn't say what the specific risks were, and no breach or audit was published to back it up.
The next day, we found out the Chief Secretary to the Government had issued a directive that same day banning civil servants from using Waze. It only covers official duties, though civil servants are encouraged to uninstall it. For the rest of us it's still just advice, and Waze is still in the app stores.
The national cyber security agency, NACSA, later posted an FAQ with its reasons. Waze collects more than your location (device sensors, timestamps, IP addresses), and depending on your settings it can do that even when you're not using the app. Its terms also send disputes to Israeli courts. NACSA says there's no evidence Waze actually analyses its users this way, only that the possibility is a risk worth weighing. Its suggested alternatives are TuJu and PINTAZ, an app from a local developer.
I contribute to OpenStreetMap (OSM) and use its data in my side project, a map of bus routes and stops in Malaysian cities. So this is very much my kind of news. I downloaded TuJu. This is my "review" of it, in quotes, because most of what bothers me isn't the app. It's the map underneath.
First, you have to log in
TuJu doesn't work without an account. There's no guest mode, while Waze and Google Maps both let you navigate without signing in.
Then I checked its privacy label on the App Store, which developers fill in themselves. TuJu's developer is Prosignal Consortium Sdn Bhd, LLM's private partner in the joint venture. Its label says:
- Your precise location is collected, linked to your identity, and used for the developer's own advertising and marketing.
- The data linked to you also includes financial info and "sensitive info", a category Apple uses for things like ethnicity and religious beliefs. (Its privacy policy mentions toll payments, which may explain the financial info.)
- Data on how you use the app is used for third-party advertising, and Google Play marks TuJu as containing ads.
Waze's label isn't any better. It lists your precise location, address and search history for third-party advertising. But Waze isn't the app being sold to us as the safe choice. For an app pushed on data security grounds, TuJu's label is a strange first impression.
To be fair, TuJu has a few things Waze doesn't. It lists what each R&R has (surau, toilets, food, EV chargers), shows highway CCTV, has an SOS button, and links to LLM's MyJalan app for reporting potholes. It also works out your tolls, but that isn't new: Waze has shown toll prices in Malaysia since 2019, typed in by its volunteer editors.
The rest is rough. As of 21 October, TuJu had 2.6 stars from 100 ratings on the Malaysian App Store, with reviews mentioning a flickering map, a slow recentre button, wrong turn instructions and failed searches. The iPhone app hasn't been updated since version 1.5.5 on 25 November 2025, though the Android app got an update in August. There's no CarPlay or Android Auto yet. At launch, an LLM official told Paul Tan there were plans to add it eventually.
It still runs on Google
When TuJu launched in November 2025, Paul Tan reported that "under the skin, TuJu uses Google's mapping and POI data as well as technology from Maybank." Carz reported the same, according to The Rakyat Post. I checked the app myself. Its map has a Google logo in the corner, and side by side with Google Maps (left), TuJu (right) is the same map in different colours.
Google has owned Waze since 2013. So we're being asked to leave a Google-owned app for one that runs on Google's map data. I get that the worry is Israeli law, not Google. But if TuJu uses Google for search and routing, every search and every route still goes through Google's servers. NACSA's own FAQ points out that Google Maps is run by Google LLC in the US, with disputes under California law.
That also costs money. At list price, Google's Navigation SDK gives you 1,000 free navigation requests a month, then charges US$25 per 1,000. At 100,000 requests a month, that's about US$2,500 a month. I don't know which Google products TuJu pays for, or whether LLM got a discount. But if it's pay per use, every Malaysian who switches adds to a bill paid to the company that owns Waze. How big is that bill, and is it public money?
Waze works because of its users
Waze is closer to Wikipedia than to a normal app. Drivers report police, accidents and roadblocks as they pass them, and volunteer editors build the map itself.
They take it seriously. Malaysia's editing guide locks freeways and major highways at level 5, so editing them is normally left to senior editors. When MalaysiaNow profiled Malaysia's editors in 2020, none of them were paid. I'm in the Telegram group where they coordinate. On 20 October, a business owner asked the group to delete their Waze listing. Two editors replied with the same question before doing anything: "Reason to delete?"
Moovit works the same way for public transport. Its transit data is some of the most complete I've seen, diversions included, and a lot of it comes from volunteers it calls "Mooviters". It has claimed more than 720,000 of them. I'm one too, though I haven't edited anything yet.
Sadly, none of this can go into OSM. Waze's map data is copyrighted, and the OSM wiki says mappers aren't allowed to use it.
Google Maps is much harder to fix. You can only suggest an edit, and Google reviews it before anything changes. In my experience, getting anything substantial fixed is hard. Here are three of mine: two name changes, and a report that a place called "kolej matrikulasi selangor", listed at the Perlis matriculation college's address, doesn't exist. All three came back "Not accepted".
TuJu lets you report incidents, which is good. But the map underneath is Google's, so fixing a wrong road still means going through Google.
If Waze is a problem, so is Moovit
Waze's terms name Waze Mobile Ltd, an Israeli company based in Tel Aviv. They're "governed solely by the laws of the State of Israel", and disputes go to "the competent court in the Tel Aviv district in Israel". So the concern is real: on paper, a Malaysian with a dispute against Waze would have to go to court in Tel Aviv.
But Moovit is Israeli too. Intel bought it in 2020 for about US$900 million. Moovit's terms of use say claims are governed by Israeli law, with the courts of the Tel Aviv district having exclusive jurisdiction. And a transit app knows which stop you get on at every morning, and where you get off.
The government didn't mention Moovit at all, and neither does NACSA's FAQ. These are two apps a lot of Malaysians use, and both are Israeli. If Israeli jurisdiction over our movement data is the problem, it applies to both. For buses, it's one more reason I'm building my own bus map on open data.
The open map already exists
OpenStreetMap is like Wikipedia for maps. Anyone can edit it, and anyone can use the data for free. (I'm obviously biased.)
Malaysia's OSM data is better than most people think, partly because big companies depend on it. Grab builds its maps on OSM, and in 2022 The Register reported that its team made about a fifth of OSM edits in Southeast Asia. Apple has its own data team editing OSM (its edits are tagged #adt) and uses OSM data in Apple Maps. In Kuala Lumpur, Grab's team made the latest edit to 12% of the road segments on OSM, and Apple's team made 11%.
The data is free under the Open Database Licence (ODbL). You credit the OSM contributors, and if you publish an improved version of the data, you share it under the same licence. You still pay for your own servers, but nobody charges you per request. That's how I use it in my app. Organic Maps and CoMaps are full navigation apps built on OSM, and both work offline.
The catch is that OSM can only hold data people are allowed to add. Mappers can't copy from Google Maps or Waze, and in Malaysia, they mostly can't copy from the government either.
The government is sitting on the data
The OSM Malaysia wiki keeps a list of sources mappers can't use. Google and Waze are on it, as you'd expect. So is the government's own Malaysia Geoportal, whose copyright notice bans copying without written consent.
PlanMalaysia's i-Plan shows land use and zoning down to individual lots, and anyone can look at it. But it says the data belongs to the source agencies, and its copyright page bars copying or republishing it without written permission. Local councils hold council roads, street names, road closure permits and business premises licences, which is basically a ready-made list of shops and restaurants. As far as I can tell, none of it is open data.
Penang's case is almost painful. Its 2024 planning guideline asks anyone applying for planning permission to submit digital GIS plans (road centrelines, building footprints, lots), and as-built plans once the project is done. So the state has a new housing estate's road layout before the road even exists, while OSM mappers wait for satellite imagery to trace it by hand.
Road closures are their own problem. They don't belong in OSM, because map data is often used offline for weeks or months, so they need a live feed. DBKL issues closure permits and runs a traffic centre, but I couldn't find an open feed an app could plug into. Singapore's LTA already has one, with road works and incidents in real time. Perbadanan Putrajaya, for its part, told the public in August 2025 that its National Day road closures had been updated on Waze.
The Waze editors feel this. On 19 October, one of them complained in the group that JKR and other agencies share notices without coordinates, as if the public can tell where everything is. Another said LLM, the agency behind TuJu, and the highway companies are no better, giving KM markers as if the public knows where those are. Then that same editor shared a JKR detour notice from Gua Musang as the good example, because it came with a QR code for the location. That's all they're asking for: include the location. Better still, publish it as a feed any app can read.
The bright spot is data.gov.my. Datasets like this ridership one come under CC BY 4.0, and it even has a live API showing where Rapid buses in KL, Penang and Kuantan are right now, though the transit feeds don't state a licence yet. So our agencies can publish open data when they decide to. For OSM, CC BY isn't quite enough on its own, and the OSM Foundation asks for an explicit waiver. New Zealand's land agency signed one. We could too.
That bus feed shows what happens when data opens up: people build on it. There's already a Home Assistant integration that shows live RapidKL and Rapid Penang buses, and a 3D map of Malaysia's transit lines that added live buses from the same feed. With AI coding tools, the price of software has dropped a lot. Data is the expensive part now. The government wants Malaysia to be an AI Nation by 2030, and its own action plan lists data as one of the foundations. If that's serious, open the map data and let people build on it, the same way they did with the buses.
"But maps are secret"
Some people in government still don't see the point of open data. Maps especially, they say, are secret.
I get it, and the rules are on their side. A 2007 circular from the Chief Secretary to the Government, the same office that just banned Waze for civil servants, classifies JUPEM's main topographic map series as Terhad (Restricted). That makes them official secrets under the Official Secrets Act. Even at the National Library, you need approval just to look at them. And a 2024 circular from the natural resources ministry says map data "boleh memberi impak yang tinggi kepada keselamatan negara" (can have a high impact on national security), then sets out how agencies should license and price it.
Some places really shouldn't be on a public map, like an ammunition depot or the inside of an army camp. But the 2007 circular already handles that. Ammunition depots are mapped only up to the fence, and buildings on security force bases and power stations aren't labelled. It even says map data can come in two versions: a classified one for the security forces, and an unclassified one for the public.
So the fix is to hide specific sites, not the whole map. Locking up the whole thing costs more than it protects. Anyone can see our roads in the satellite view on their phone, and TuJu uses Google's map of them. Google already has our roads. The people locked out are Malaysian developers and mappers, and their apps end up on foreign maps. That's the opposite of what the Waze ban is meant to achieve.
The Chief Secretary's own office made the same argument in 2015. Its open data circular lists topography, postcodes, and national and local maps as data agencies can open, free of charge, "untuk pertumbuhan ekonomi dan peningkatan inovasi" (for economic growth and innovation). It also tells agencies to check their data against the Official Secrets Act first, which is how the 2007 classification ends up blocking it.
What Singapore did
Singapore's land authority runs OneMap. Its APIs are free once you register: map tiles, address and postcode search, routing by car, on foot, by bike and by public transport, plus more than 100 layers of government data. It's all under the Singapore Open Data Licence, which allows commercial use as long as you credit the source. OneMap pulls in data from over 65 public agencies, and about 67 government agencies use it for their own services.
So Singapore has one national map that anyone can build on. We have an app on top of Google that you need to log in to use.
Singapore isn't relaxed about security, either. Photographing a protected area there without authorisation is an offence. It protects the sensitive sites and still publishes the base map.
To be fair, Singapore has it easier: one government, no states. Even there, a mapper who planned to add LTA's covered walkway data to OSM in 2022 checked with LTA first, and got the go-ahead. But the basics (addresses, routing, planning areas) are open, and that's the part we could copy.
It isn't just Singapore. Denmark used to make people buy address data from each council. In 2002 it agreed to make the data free, and a 2010 study counted about €62 million in direct benefits from 2005 to 2009, against about €2 million in costs. Australia has published G-NAF, a geocoded list of the country's addresses, as open data since 2016.
GPS itself started as a US military system. After the Soviet Union shot down Korean Air Lines Flight 007 in 1983, when a navigation mistake took it into Soviet airspace, the Reagan White House announced that GPS would be opened to civilian use. The US military kept the most accurate signal for itself until 2000, the same two-version idea as our 2007 circular. A 2019 study for NIST, the US standards agency, puts the economic benefit to US businesses alone at roughly US$1.4 trillion since the 1980s. Every navigation app, TuJu included, depends on it.
What I'd ask for
No single minister can fix all of this. Under the Federal Constitution, land and local government are state matters, except in the Federal Territories. But the National Land Council (Majlis Tanah Negara) and the National Council for Local Government (Majlis Negara bagi Kerajaan Tempatan) set policies that both federal and state governments must follow (Sabah and Sarawak would need their own agreements). And in KL and Putrajaya, the land, the council and the planning are all federal.
I don't think the answer is another app. If the government wants our location data to stay safe and local, it should open up the data it already has and let everyone build on it, TuJu included:
- LLM publishes its highway data (tolls, R&R facilities, closures and CCTV) as an open API. LLM is a federal agency, so no state needs to agree.
- The agencies on data.gov.my sign the OSM waiver for their CC BY data, and JUPEM publishes the public version of its maps that the 2007 circular already allows for, under an open licence.
- KL and Putrajaya run a pilot. DBKL could start with a live feed of its closure permits, plus street names and premises licences (business name, type and address only) as open data.
- The National Land Council and the National Council for Local Government agree on one open licence for land and council map data.
- States like Penang release the road and building layers that planning applicants already submit.
- Someone funds community mapping. Grab already pays its drivers to collect map data, like missing places, so the model exists.
- If TuJu stays, it gets a guest mode and stops using our data for advertising, and LLM publishes the contract and what it pays Google.
What I'm doing
I'm sticking with OSM, and I'll keep mapping. I'm also adding a contributor feature to my bus map. It's still in development, and I want anything people add there to end up in OSM, where everyone can use it.
You don't need my app to start, though, or any mapping experience. Make an account on openstreetmap.org, find your street and press Edit. The browser editor has a short walkthrough for first-timers. On your phone, StreetComplete (Android) asks easy questions about things near you, and Every Door (iPhone and Android) is good for adding shops and entrances. Fixing the roads near your house takes about ten minutes, and nobody has to approve it first.
If you get stuck, the OSM Malaysia community has a forum and a Telegram group.
Thoughts on this? Find me on X: @harithilmi