PETALING JAYA: A person’s daily movements, workplace and even possible family connections could be pieced together from navigation app records, with artificial intelligence (AI) capable of turning seemingly routine travel data into detailed behavioural profiles.
The implications could extend beyond personal privacy, with experts saying repeated movement patterns involving government officials and security personnel could expose sensitive operational locations, confidential assignments and potential national security vulnerabilities.
A test conducted by theSun using a reporter’s exported Waze activity history found that AI could identify a frequently visited workplace and make plausible inferences about the background of an individual, despite being given neither a name nor occupation.
To test how much personal information could be extracted from navigation records, theSun downloaded a reporter’s Waze activity history and uploaded the file to Google’s Gemini AIusing a newly-created account with no previous conversations.
Gemini was then asked to analyse the individual behind the records without being provided any identifying details about the reporter.
The export, covering Aug 29 to Oct 26, contained 87 navigation entries, more than 16,000 timestamped location points and a separate search history.
From the records, Gemini identified a frequently recorded destination in Petaling Jaya as a likely workplace. It also suggested that journeys around Kuala Lumpur, Putrajaya and Shah Alam could involve work-related meetings, field assignments or visits to government and commercial offices.
An examination of the original file confirmed 17 navigation entries for the Petaling Jaya location across 15 separate dates. The reporter confirmed that the location was associated with his workplace.
The AI also suggested possible family or hometown connections to Kelantan after identifying two entries involving Kota Bharu, an inference consistent with the background of the reporter.
However, not all its conclusions were accurate. Gemini incorrectly interpreted certain timestamps and could not establish whether individual navigation requests represented completed journeys.
The file also contained search-history information, including a reference to the reporter’s organisation, meaning the data was not entirely anonymous.
The test did not establish that Waze shared data with Gemini. The reporter voluntarily supplied the information for analysis.
The findings were presented to Universiti Teknologi Mara Centre for Media and Information Warfare Studies senior lecturer Dr Noor Nirwandy Mat Noordin, who said similar movement records could have more serious national security implications when they involved government personnel.
He said repeated journeys by security personnel and government officials could potentially reveal operational sites, investigation locations and details of confidential assignments.
“This involves strategic matters such as the movements of government agencies, national leaders and security personnel.
“The whereabouts and precise locations of security agencies or specific individuals must remain confidential for security reasons.”
He added that navigation records could also be used to analyse the preferences, regular destinations and behaviour of an individual when combined with sufficiently advanced technology.
Nirwandy said more sophisticated systems could use the information for predictive analysis and pattern learning, although he cautioned that such conclusions depended on the available data and remained probabilities rather than certainties.
“Each government agency should have its own security benchmarks and standards, including for navigation involving strategic areas and official destinations.
“This is to ensure such information remains protected in line with national security requirements.”
Meanwhile, Malaysian Cyber Consumer Association president Sirajuddin Jalil said users could generate revealing travel patterns even without actively contributing reports or other information to navigation platforms.
“Repeated use produces a vast amount of individual data which, when processed using AI, creates an endless chain of information about us.”
Sirajuddin, who had suggested examining exported travel records using AI, said the same analysis could be applied on a much wider scale.
“If we could do this ourselves, a technology owner with advanced AI processing the data of Malaysians could study their behavioural patterns,” he said.
On Oct 7, Sirajuddin called for restrictions on Waze, citing its Israeli legal jurisdiction and potential implications for the legal rights and privacy of Malaysian users.
Following the call, the government announced restrictions on Oct 20, prohibiting civil servants from using the app for official duties while allowing the public to continue using it.
Yesterday, theSun reported that two independent cybersecurity specialists had confirmed an Israeli-linked test-server reference in Waze’s Android software, following findings published by Malaysian anti-scam website PenipuMY.
However, neither specialist established that the server was actively being used or that the data of Malaysian users had been transmitted through it.
The National Cyber Security Agency had not responded to theSun’s enquiries about its security assessment of Waze, movement-pattern analysis and the handling of previously collected location records as of press time.
Kredit: https://thesun.my/news/your-waze-history-may-reveal-more-about-you-than-you-think/
