00:09Hi, welcome back to Consider This. I'm Melissa Idris. Let's continue our discussion about the
00:15government's recent directive banning civil servants from using the navigation app Waze
00:21with Prime Minister Anwar Ibrahim now considering whether or not the restriction should be extended
00:26to the wider public. So this is after concerns over the app's Israeli legal jurisdiction and its
00:34potential exposure of sensitive location data which Waze has denied. Now joining me on the show
00:40I have Sia Fong who is the Managing Director of the Cybersecurity Consultancy LGMS Berhad. Thank you
00:47so much for joining me Fong on the show. Let's start with the basics for many of us who aren't
00:51tech savvy. When we use a navigation app or any navigation app, what information is being
01:00collected? What can that information reveal about the user and our location? Primarily when you use
01:09a navigation app, of course the app itself will require your GPS location and sometimes the app
01:15will ask for your network permission to read your network. And these are the primary privileges
01:22that the app will require. But some apps may also ask you for your access to your contact list,
01:28to your phone, microphone or camera. These are all optionals but the primary mandatory required
01:34privileges for an app is the GPS location and it has the ability to read your GPS signals and even
01:43the
01:43network signals. Okay so so could a navigation app then expose what what the government is concerned
01:50about? Sensitive government information? Yes of course because the app has the privilege to read
01:56any user's location data and if you know the the app's owner, that means the the principal who created the
02:05app wants to do any analysis on the collected GPS data, of course they can. Okay all right so talk
02:12to me a
02:12little bit about the where Waze is incorporated. The government has expressed concern that Waze Mobile
02:19Limited is incorporated in Israel is subject to Israeli law from a cyber security perspective. Is there a
02:27technically credible basis for the claim that data from an app can be accessed by a foreign government?
02:37There were histories where there were cases you know where a foreign government is buying
02:43crowdsourced GPS location data from private organizations and this has proven in the US before.
02:51It's just that for Waze in particular we haven't noticed any news that where you know the
02:57the Israeli administration or any government officials are buying or selling this intelligence to anyone else but
03:03strictly coming from cyber security standpoint disregarding any geopolitical tension or anything
03:09like that but from cyber security standpoint any companies that produce an app obviously they will
03:16have the ability to collect data they will have to be the ability to analyze the data and then they
03:21also
03:22have a decision to whether or not they want to sell the accumulated data to any third party or not.
03:27Now Waze is
03:28not unique because any mapping apps any navigation apps will have similar features like Google Maps,
03:35Apple Maps or what for whatever reasons or whatever other countries they also may have their own
03:40navigation app like for example in China there's a GMAP and and all of them will have the ability to
03:47collect uh users data anyway all right so Waze is not uh not isolate not a unique isolated case okay
03:54all right so so
03:55talk to me about um this directive and what you make of it do you think that banning um Waze
04:03would be an
04:04effective security measure to address some of the government's concerns if the government's concern is
04:09exposure of location data would then restricting Waze only on government issued devices or government
04:16workers would that be sufficient uh what are your thoughts well from cyber security standpoint right just
04:23purely from cyber security standpoint without looking at any uh political agenda but banning an app is
04:29not the it's not able to solve the entire root cause you see today we have many apps that develop
04:35by
04:35multiple different nationals uh and we have ways from Israelis we we there are even more concerns about
04:42what's that what about what's that what's that is also uh similar and what about instagram social media
04:47platforms like facebook instagrams may have some kind of connections back to israel but
04:53are we what are we doing about it so i think the government has a genuine concern which is uh
04:58which
04:58is okay i think it's coming from um uh political concern but then again i think from a more long
05:05-term
05:05perspective we would i would suggest we may even have a better framework better guidelines for our
05:12government officials like what are the do's and don'ts what are the uh uh acceptable use uh in terms of
05:20applications on their personal devices i think having a long-term guidelines and framework would
05:26be better than just having a strict ban immediate strict ban on certain applications okay can you can
05:32you elaborate for me what kind of things would go into this guideline or the framework well at least
05:37the framework would specify you know what are the uh requirements requirements for government
05:42officials when they install any apps into into their personal devices are what are the do and
05:48do's and don'ts now what are the restrictions what are the considerations they should consider
05:52before even installing uh what are the restrictions of uh the privileges now that they can assign to an
05:58app so having a clear guidelines right then that will be better ensure that we are uh we have a
06:05better
06:05management than uh and instead of having a strict ban now looking at this case right having a strict
06:11ban on waste obviously it's going to trigger more questions like instead of using waste now what else can
06:18we use and and when we are banning waste should we even ban the entire android phone ecosystem because
06:25that is also coming from the us are we allowing us to spy on us or should we even ban
06:31ios apple because
06:32do we want a private a public company in the us to be able to read our activities and all
06:38that so it
06:39triggers far more many questions that's why i think if the i mean the concerns are genuine right the
06:45concerns from the government are genuine it's just that um i would say from a root cause perspective
06:53we might as well just have a better framework policies guidelines for the government officials
06:58and that will serve as a much better guide guidance well this this directive has really um triggered a
07:05conversation around uh digital sovereignty and i wanted to ask you about that phone um how we think about
07:13digital sovereignty in a world where tech is so interconnected tech is a global game
07:19um and what does that mean even locally developed act uh might not necessarily be more secure than a
07:27foreign application how do we think about that yeah this is very true because we are now living in a
07:32global village right so everything is interconnected we are using technologies from all over the world and
07:38aside from just exporter i mean aside from just importer we also exported so we we need to i mean
07:45we need to
07:45adapt to the mindset that now everything is globalized right so um obviously we still have things that we
07:52want to protect right so that's why i say it's still come back come back to the root cause do
07:57we have a
07:57policies or guidelines of um guidance guidance policy guidance to guide our government officials of how to
08:05protect our personal data but it's kind of inevitable because today as long as they were using a
08:11smartphone right our data is on it's it's with the u.s government right they they if they wanted to
08:17access this data they can if they wanted to right obviously the the only thing stand between the government
08:25and our data is the organization that's collecting it right now for example apple google and some of these
08:32largest giants in the world um so that's why this is uh this is going to be a complex issue
08:38when it
08:38comes to politics but from a cyber security standpoint data sovereignty is always a concern so we the the
08:45best advice i mean for someone uh to who are concerned about the personal data is that you only share
08:51what
08:51you would like to share because whatever you have shared it it will it will be always on the internet
08:57it
08:58will be always available and um that's why this is the uh the thing that i would advise from actually
09:04can i while i have you can i ask you for your advice for for the people who are so
09:09not just um i guess
09:10the people the audience watching at home who are concerned about um how data is being used but if you
09:16were also advising um this kind of of the policymakers to think about how cyber security risks are um should
09:25be
09:25mitigated from per from official devices but also from personal usage what are the things that really
09:32need to be um think thought about because i from what you were saying it's not just the types of
09:38data
09:38but it's the permissions that we give it's where the data is stored what what uh the data retention
09:43policies i'm also thinking about um how what would you prioritize if we were thinking more strategically
09:50about cyber security i'll split into short term and medium and long term so from short term perspective
09:56right i would encourage all the uh i mean i would encourage the government to draft our guidelines
10:01the usability guidelines like uh like what what are the do's and don'ts right and from a longer term
10:07perspective um our administration or our government should even encourage local talent development local
10:13uh products development now i use a very extreme case in another country for example china in china you
10:20cannot use facebook you cannot use twitter you cannot use any other applications that origin from
10:25the us but then again domestically they have encouraged the ability to develop something similar
10:31now that is not something you can build overnight right it takes it takes time it takes time to
10:35build it takes time to cultivate and and where um that's why this is a long-term game if a
10:41country
10:42really want to protect the sovereignty of the data right and you look at china china has done it and
10:47it's not
10:48easy and it is plausible it's not easy but um that is the extreme example of how you protect your
10:56entire country's sovereign data data sovereignty yeah it's definitely a long game fong thank you so
11:02much for joining me on the show i appreciate you sharing your insights with us cf fong managing director
11:06of lgms brahada cyber security consultancy wrapping up this episode of consider this i'm melissa idris
11:12signing off for the evening thank you so much for watching and good night
11:17you
