TuJu is the wrong answer to the Waze question — and the bigger privacy risk is the government’s own app

On 20 October civil servants were told to stop using Waze, and the rest of us were urged to switch to TuJu, the highway authority’s app. I think the switch is the wrong answer to a fair question. Here is why — with what 220 Play Store reviews say, what the Israel claim actually rests on, and where the bigger privacy risk really sits.

VibeFlow 团队 · 27 October 2026 · 12 min read

On 20 October 2026 a circular from the Chief Secretary to the Government told civil servants to stop using Waze, and the Prime Minister urged everyone else to do the same and move to local alternatives — first among them TuJu, the navigation app the Malaysian Highway Authority (LLM) launched with Prosignal Consortium in November 2025. The reason given is data: Waze Mobile is incorporated in Israel, and its terms are governed by Israeli law.

Who holds the record of where Malaysians drive is a fair question for a government to ask, and I take it seriously. I just think TuJu is the wrong answer to it, for three reasons. A map is never finished, and TuJu has nothing to keep finishing it with. TuJu was not ready for the job it was suddenly given. And the privacy argument, followed honestly, points at a government-run app at least as much as at Waze.

• 1.2★Google Play ratingAbout 5,100 reviews, read 27 October 2026
• 2.5★The same rating five days earlierAs reported by SoyaCincau on 22 October
• 111 of 119Reviews since 20 October giving one starPosted 20–25 October, the week of the push
• 500K+Downloads on Google PlayLaunched 26 November 2025

A map is never finished — and TuJu has nothing to finish it with

Building a navigation app is not the expensive part. Keeping its map true is. Roads open, U-turns close, a mall adds an entrance, a taman gets a new guardhouse, a lane is repainted. A map is only as good as the stream of corrections flowing back into it, and that stream has to be paid for — in surveyors, or in users.

Grab is the clearest example on our own doorstep. When it found in 2017 that the cities it served were badly mapped, it built its own map, GrabMaps, and fed it with what its business produces anyway: rides and deliveries every day, riders mapping alleys a car cannot enter, and drivers and merchants reporting closed roads and changed addresses. The result is good enough that Amazon now offers it to other companies through its cloud.

That is why a delivery app often knows things a general map does not. A shopping mall, a campus or an airport has many entrances and several levels, and a rider who has delivered there a hundred times knows which drop-off point is the right one — so the customer can pick it, and the next rider finds it first time. Every order is a small survey, and the business pays for it by earning money.

TuJu has no such loop. It has no meals, no rides and no parcels — only drivers on highways, who are already served by apps that do have the loop. What it has is a budget, and a budget buys a map once; it does not buy the next ten years of corrections. TuJu was not even building its own map in the first place: coverage of its launch reported that it runs on Google’s mapping data — from the company that has owned Waze since 2013.

Satellite imagery and GPS accuracy do not change that. Anyone can buy the same satellite pictures; what separates a good map from a poor one is the ground truth that comes back from the people using it. Spending public money to rebuild what already exists, without the one thing that makes a map improve, is the part I find hardest to justify.

It was not ready for the job it was given

To be fair to TuJu, it was designed as a highway companion: live toll charges, traffic and CCTV feeds from LLM’s traffic centre, R&R stops and their facilities, and a way to report a crash or a pothole. Those features are useful, and nobody else has the CCTV feeds. Being pushed overnight as the country’s replacement for Waze is a different job, and the reviews show it.

SoyaCincau drove with it after the announcement and published its review on 22 October. Turn-by-turn prompts kept repeating “keep straight” with no context about the exit coming up, one instruction appeared as raw HTML, and there was no live traffic, no speed-limit warning, and no Android Auto or Apple CarPlay. The app stood at 2.5 stars on Google Play that day. Five days later it is at 1.2.

I read every review Google Play listed as most relevant on 27 October — 220 of them — to see what people are actually complaining about. The picture changes sharply at 20 October, the day of the announcement.

Most of those reviews are not about subtle routing choices. They are about search. KLCC, Pavilion, Putrajaya, Hospital Kuala Lumpur, an Aeon mall, the nearest petrol station, the reviewer’s own taman — “no results found”, again and again. When a destination does come up, the next complaint is the one shared widely on social media: the route drawn as a single straight line from where you are to where you are going, as if the car could fly.

Others describe the map not following the car once navigation starts, or the location marker landing somewhere it is not — one reviewer in August, parked for half an hour, was shown sitting in the middle of the Straits of Malacca. A position that jumps instead of moving smoothly along the road is not a cosmetic problem: a driver who cannot trust the marker looks down at the phone more, not less.

One two-star review set out the order of work better than I could: make destination search return real places, draw real driving routes instead of straight lines, and clean up the turn-by-turn — before adding anything else. Those are the basics, and an app should not be recommended to a whole country without them.

An update listed on 23 October promises “faster maps and smoother turn-by-turn navigation”, and TuJu may well get better. My point is not that it can never work. It is that a highway information app was asked, with a few days’ notice, to replace a navigation network that Waze’s users have been building for nearly two decades.

What the Waze claim actually rests on

针对Waze的指控分为两部分。首先是其条款受以色列法律管辖，纠纷在特拉维夫审理。这是事实，且条款自2008年以来一直如此规定。第二部分——以色列利用Waze监视使用其服务的司机——是足以证明禁令合理性的指控，但没有人能证明。Snopes在2026年7月调查后，未发现任何可信的公开证据。Waze的母公司Google称此说法完全不实，并表示列明开发者所在国法院是行业标准做法。

未经证实不等于虚假，我并非说风险为零。我只是说，一项要求全国人民更换应用程序的政策，应该有证据支持，而目前的声明只提及“潜在风险”，而非已发生的事实。如果有证据，请公布。如果没有，请公布导致此决定的风险评估。

The bigger privacy question is the government’s own app

这是我无法接受的论点。如果担忧外国政府理论上可以获取在其国家注册的应用程序的数据，那么同样的担忧——更直接地——也适用于我们自己政府运营的应用程序。

TuJu要求您登录后才能导航，其权限屏幕显示位置、运动和使用数据可能会与马来西亚政府机构共享，用于道路使用者分析和产品改进。《2010年个人数据保护法》不适用于联邦和州政府，因此我们大多数人赖以控制公司如何处理我们数据的法律，对政府如何处理这些数据却只字未提。

位置和运动数据随时间变化，简单来说，就是您驾驶的地点和速度记录。我并非声称TuJu以这种方式使用，也没有看到任何证据表明它如此使用。但其条款中没有任何内容排除这些数据有一天会被用于告知测速摄像头或路障的设置地点，或者哪些司机的驾驶行为需要更密切的关注。这正是Waze决策所依据的“潜在风险”——只是更接近本土，且法律限制更少。

Waze，无论其真实情况如何，都赋予了司机自主权。它建立在司机互相提醒的基础上——关于堵车、事故、危险，以及，是的，警察检查站。我在这里是猜测，我想明确表示我没有证据：我怀疑最后一个功能是当局从未喜欢Waze的部分原因。我很乐意被证明是错的。无论如何，这是让司机选择自己的应用程序的理由，而不是引导他们使用某个特定应用程序。

Malaysia is not a closed internet

中国的地图应用是在Google被屏蔽的市场中成长起来的；它们从未需要在开放环境中击败Google。马来西亚没有“墙”。Google Maps、Waze、Grab、Petal Maps等都在这里运行，它们通过不断改进来争夺司机。政府推荐的应用程序不会以同样的方式面临这种压力：它的用户是被“送”来的，而不是被“赢得”的。

还有时机问题。一项基于应用程序母公司注册地而宣布的切换，以及一个甚至找不到KLCC的替代品，在我看来更像是一种政治姿态，而非网络安全计划。如果安全问题是真实的，它值得一个比这更好的答案。

What I would have done instead

• 为政府手机和政府数据设定规则——这部分是合理的——并公布其背后的风险评估。
• 制定所有导航应用程序在马来西亚必须遵守的数据处理规则，涵盖收集什么、存储在哪里以及谁可以要求获取，并将其平等地应用于Waze、Google、Grab和TuJu。
• 将政府自己的应用程序纳入《个人数据保护法》或同等法律之下，以便公众对国家拥有与对公司相同的权利。
• 让TuJu继续做好它擅长的事情——收费站、闭路电视、休息站和事故报告——并将这些信息开放给所有导航应用程序，这样司机就可以在他们已经信任的任何应用程序中获取LLM的数据。

What we built in VibeFlow — and what we have not

由于我开发了一个包含地图的应用程序，所以不比较一下会很奇怪。VibeFlow是一个社区应用程序，而不是导航公司，我也不声称它能取代Google Maps或Waze。但TuJu评论中的抱怨与我们必须解决的基本问题相同，所以这是我们目前的状况——诚实地分为应用程序中已有的功能和已构建但尚未发布的功能。

于2026年10月27日对照应用商店中的应用程序和我们的服务器进行了检查。

我于10月27日测试了我们的路线引擎，从KLCC到Pavilion：3.0公里，大约五分钟，沿真实街道有九个转弯指示——没有直线。下一次更新中的搜索功能将利用OpenStreetMap中483,692个道路和地名索引，并能理解Jln、Lrg、Tmn和Kg。通过名称查找商店或地标是我们目前唯一不如其他人的地方——这正是我认为任何新的地图应用程序在面向全国用户之前，都应该首先测试这个功能的原因。

有两件事对我来说比任何功能都重要。一旦该更新发布，路线将在我们自己的服务器上计算，因此行程将不依赖于Google。而且，所有位置功能在您开启之前都是关闭的，只保留您最新的位置。完整的规则在我们的帖子中，关于应用程序如何处理您的位置。

So, should you delete Waze?

如果您是公务员，该通告是针对您的，您应该遵守。对于其他人来说，这是一种请求，而非法律。我个人的看法是：保留能让您到达目的地的应用程序，阅读您使用的任何应用程序的隐私设置，并在TuJu能找到KLCC并绘制道路时再重新审视它。信任哪个导航应用程序是每个司机自己的决定——这种自由比任何一个应用程序都更有价值。

Sources

1. 首相办公室称，禁止公务员使用Waze是为了防止以色列政权滥用数据 ——《星报》，2026年10月21日
2. 从Waze到TuJu？安华因数据安全担忧支持马来西亚导航应用程序 ——《马来邮报》，2026年10月20日
3. 另寻他法：公务员因与以色列的关系被有效禁止使用Waze应用程序 ——《马来邮报》，2026年10月21日
4. TuJu评测：马来西亚的导航应用程序能取代Waze吗？ ——SoyaCincau，2026年10月22日
5. 如果TuJu运行良好，大多数用户会支持 ——《星报》，2026年10月22日
6. 事实核查：调查以色列控制Waze、监视应用程序用户的说法 ——Snopes，通过Yahoo Tech，2026年7月15日
7. TuJu高速公路导航应用程序首次亮相，具备实时交通、收费和闭路电视功能 ——《马来邮报》，2025年11月26日
8. TuJu应用程序上线，具备实时交通、收费和紧急工具 ——carz.com.my，2025年11月
9. 不再是未知领域：Grab如何构建其地图工具GrabMaps ——Frontier Enterprise
10. Amazon Location Service中的GrabMaps ——Amazon Web Services
11. Google Play上的TuJu——评分、发布说明和评论 ——Google Play，2026年10月27日阅读