The hidden dangers of Waze: When crowdsourced maps become a security risk
Waze’s mapping system, edited by volunteers, is updating Israeli military locations—potentially aiding enemy surveillance.
Last October, four IDF soldiers were killed in a drone strike on a military base near Binyamina. It was a tragic incident, but not the only one in which enemy forces managed to strike a military base or other security target with alarming accuracy. These successes have raised questions about the sources of intelligence that provide terrorist organizations like Hezbollah with precise information about sensitive military targets. Theories range from reasonable possibilities—such as information inadvertently revealed by soldiers on social media—to far-fetched conspiracy claims about internal leaks.
Another possible source, however, is the popular navigation app Waze, which easily provides precise coordinates of military bases and strategic installations and even reveals security forces' traffic routes. This information is regularly updated, and some of it also appears on Google Maps, Waze’s sister app, following Google’s 2013 acquisition of Waze in a $1.3 billion deal. While there is no way to confirm whether terrorist groups are actively using this information, it is also impossible to rule it out.
“This is the most lethal mass intelligence collection system in Israel,” Amitay Dan, a researcher in information security and physical intelligence who has been studying the issue since the beginning of the war, told Calcalist.
Waze differs from other mapping apps because a significant portion of its mapping information comes directly from its users and is edited and managed by them. Other apps, such as Apple Maps or Google Maps, primarily rely on independent data collection—such as street photography vehicles—or purchasing maps from third parties. While they do incorporate user data, its processing and editing are handled internally by company employees.
Waze, on the other hand, started in 2006 as a community-driven mapping app called Freemap, where all information was based on location data provided by users and maintained by a community of map editors. This model persisted through its rebranding as Waze in 2009 and even after its acquisition by Google. In Israel, this community remains the primary force behind updating and maintaining the app’s maps.
This combination—user-generated location data and a decentralized community of independent editors—has contributed to the accumulation of sensitive security-related information on Waze. Here’s how it works: When a user takes a trip using Waze, non-identifying trip data (such as points of origin, route, and destination) is updated in Waze’s map-editing platform. If the trip occurs on an unmapped road (for example, an IDF patrol route) or ends at a destination not listed in the system, map editors can update the map and mark new roads or outposts. Sometimes they do this on their own initiative, and sometimes in response to user requests for updates.
“The editors are map enthusiasts—they live and breathe this,” said Dan.
Over the years, Waze has updated the locations of bases, military outposts, other strategic installations, and even IDF troop movement routes. “This is not new information—some of it has been available for years. But it is constantly updated, and new roads are continuously added,” Dan explained.
This information also includes photos of military bases taken by users, as Waze prompts users to upload images of destinations that lack photos in its database—despite the fact that photography is strictly prohibited at IDF bases.
Since Google uses Waze’s mapping data to enhance Google Maps, much of this sensitive information has also been integrated into the world’s most widely used mapping platform. In many cases, military bases do not appear when casually browsing the map but are still accessible if searched for by name. Ironically, marking a location as a destination on the map can inadvertently confirm that a military base exists there.
“This is sensitive information that is not available on official Israeli maps or other non-Google mapping platforms,” Dan noted.
But Waze does more than just display the locations and images of bases. Using the service’s web application, users can retrieve, in just a few steps, the exact coordinates of these bases. Such data could, in theory, be used to program guided weapons like missiles, providing them with precise strike targets.
Critically, it is not even necessary for Waze map editors to publicly mark base locations and road movements for the data to become accessible to hostile entities. All raw (though de-identified) user movement data is available on Waze’s map-editing platform, which anyone can register for and use.
“The app constantly collects traffic data, and this is exposed on Waze’s editing platform,” Dan said. “It’s available in real time, historically—this is how locations and routes are identified and updated.”
In other words, almost anyone with basic knowledge of military base locations and troop movement patterns can access Waze’s editing platform and track military patrols along roads in near real time.
According to Dan, Waze has been aware of these risks for years, as he has personally warned the company multiple times. However, he says Waze has taken little action to remove this sensitive information—except for one instance when it widely deleted photos of dozens of bases. Ironically, this effort may have backfired: since the map-editing platform logs and retains all editor activity, the mass deletion essentially created a centralized list of sensitive bases whose images had been removed while their names and locations remained.
At the time of publication, Waze had not responded to a request for comment.
The IDF Spokesperson’s Office stated: “The IDF is aware of the risks posed by information leaks to hostile entities regarding the location of IDF forces and is actively working to maintain operational security. Relevant bodies are closely monitoring these threats and implementing numerous precautionary measures to prevent unauthorized exposure of IDF force locations.”
