How Waze quietly built the world's largest crowdsourced surveillance system

Waze is one of those apps that feels like magic. You're stuck in traffic, someone ahead reports a jam, and suddenly your route updates. Police speed trap ahead? A fellow driver already flagged it. It's crowdsourced navigation at its finest, millions of people helping millions of other people get where they're going faster.

But here's something most people don't think about: every time you tap that little "report" button, you're broadcasting your exact location, the precise time, and your username to anyone who knows where to look. And I mean anyone.

This isn't a vulnerability. It's not a bug. It's how the system was designed. Waze makes this data available through their public web map, and with a bit of patience and some basic scripting, you can turn that helpful traffic app into a global surveillance system capable of tracking individuals across 60 countries.

Let me show you how.

The Core Problem

When a Waze user submits a report, police ahead, traffic jam, hazard on road, whatever, that report appears on Waze's public web map. And attached to that report is the username of the person who submitted it.

That's it. That's the whole vulnerability. You report a pothole, and your username is now tied to a specific GPS coordinate at a specific time. Do that a few times a day during your commute, and you've just given anyone watching a detailed map of your daily movements.

The data captured for each report includes:

String enough of these together for a single username, and you can build a surprisingly detailed profile of where someone lives, where they work, and what routes they take in between.

Getting Around Waze's Limitations

Waze isn't completely naive about this. They cap the number of alerts returned per query to 199, regardless of how large an area you're searching. Query all of Los Angeles? You'll get 199 alerts. Query a single intersection? Still capped at 199.

This makes it impossible to scrape an entire city in one request. A place like LA generates thousands of reports per hour, you'd miss the vast majority of them.

So I got creative.

Instead of querying entire cities, I segmented them into hyperlocal geographic grids based on population density. Each grid cell covers roughly one million residents. Dense urban cores get smaller cells; sparse suburbs get larger ones.

Then I wrote a script that systematically queries each grid cell every 3-5 minutes. The script:

FOR each city in the 60 countries Waze operates in:
  DIVIDE the city into grid cells (~1 million residents each)

  EVERY 3-5 minutes:
    FOR each grid cell:
      QUERY Waze for alerts in that cell

      FOR each alert returned:
        GENERATE a unique identifier (to avoid duplicates)
        STORE: coordinates, timestamp, username, report type

    This captures ~95% of new alerts before they expire

The result? I'm capturing approximately 95% of all new alerts across every major city in 60 countries. Every few minutes. Around the clock.

The Scale of the Data

Let me show you what this looks like when you plot it on a map. Each orange pixel represents a single user report:

Europe:

Middle East:

The coverage is remarkable. You can literally see the road networks emerge from the data—highways glow bright orange, arterial roads are clearly visible, even smaller streets in dense urban areas show up.

Understanding Waze Usernames

Here's where it gets interesting from an intelligence perspective. Waze usernames fall into two categories:

Custom Usernames: When users sign up, they're prompted to choose a username. And people being people, they often pick the same username they use everywhere else. `johndoe1985` on Waze is probably `johndoe1985` on Instagram, Twitter, LinkedIn, and a dozen other platforms.

Allocated Usernames: Users who skip registration get an auto-generated username following a specific pattern: `world_` followed by random characters (e.g., `world_xl868g9m`, `world_spy06g4z`).

Custom usernames are trivially easy to deanonymize. A quick search through any username lookup service, and you can often link a Waze username to social media profiles, which leads to real names, photos, employers, and more.

Tracking a Single UserTracking a Single User

Allocated usernames are harder, but not impossible. More on that in a moment.

Tracking a Single User

Once you have a username, you can filter the historical data to see everywhere that user has submitted reports. Here's what that looks like for a single user over a three-day period in Amsterdam:

Each number on that map is a separate report. In just three days, this one user generated enough data points to clearly establish:

And remember: this user thought they were just helping other drivers avoid traffic.

Deanonymizing "Anonymous" Users

What about users with allocated usernames like `world_xl868g9m`? They didn't choose their username, so you can't search for it on other platforms. Game over, right?

Not quite.

You can deanonymize allocated usernames by correlating their location data with other open-source information. The process looks something like this:

GIVEN: An allocated username with a history of reports

STEP 1: Identify likely home location
  - Look for clusters of reports in residential areas
  - Weight reports by time of day (evening/morning = likely near home)

STEP 2: Identify likely work location
  - Look for clusters during business hours
  - Cross-reference with commercial/office areas

STEP 3: Generate candidate list
  - Search property records, voter rolls, social media for people
    who live in Area A and work in Area B

STEP 4: Narrow down
  - Cross-reference with vehicle registration if available
  - Look for other behavioral patterns that match candidates

It's not instant, but it's absolutely doable. And for high-value targets—politicians, executives, intelligence officers—it's worth the effort.

The Intelligence Applications

Let's be blunt about why this matters. This data is an intelligence goldmine.

Proactive Monitoring:

Want to know who's regularly driving past your embassy? Set up an alert for any username that appears within a certain radius more than X times per week. When someone trips the threshold, you've got a starting point for investigation.

Want to identify potential intelligence assets? Flag users who make reports in two geographically or politically interesting locations—say, someone who reports traffic in both Tehran and London, or both Moscow and Washington.

PROACTIVE APPROACH:

SET alert zones around locations of interest:
  - Embassies
  - Military bases
  - Government buildings
  - Corporate headquarters

WHEN a username appears near multiple zones:
  FLAG for further analysis

WHEN a username appears in two countries of interest:
  FLAG for further analysis

FOR each flagged user:
  Attempt to identify real-world identity
  Build movement profile from historical data

Reactive Investigation:

Already investigating someone? Search your database for usernames they're known to use. If there's a match, you've just added a detailed movement history to their file—possibly going back months or years.

Have a location connected to an investigation? Set up a radius alert and get notified whenever anyone submits a report nearby. Correlate the timing with other intelligence, and you might identify who was present at a specific place and time.

The Traffic Camera Multiplier

Here's where it gets properly dystopian.

Thousands of cities have publicly accessible traffic cameras. These cameras often have live feeds available on municipal websites. And Waze reports are timestamped to the millisecond.

Do you see where this is going?

WHEN a new Waze report is received:
  CHECK if the location is covered by a traffic camera

  IF yes:
    PULL footage from that camera at the report timestamp
    The vehicle that submitted the report is in that footage

    WITH license plate recognition:
      Vehicle identified → Registration records → Owner identified

The report timestamps are precise enough that you could, in theory, automatically identify the vehicle (and by extension, the owner) of anyone who submits a Waze report in a camera-monitored location.

I haven't built this. But someone will. Maybe someone already has.

Who's at risk?

Let's be realistic about the threat model here.

Definitely at risk:

Probably at risk:

The uncomfortable truth is that *anyone* who uses Waze regularly and submits reports is continuously broadcasting their location to anyone patient enough to collect it.

Global Coverage

This isn't a US problem or a Europe problem. The data collection covers 60+ countries:

Albania, Argentina, Australia, Austria, Belgium, Bosnia and Herzegovina, Brazil, Bulgaria, Canada, Chile, China, Colombia, Costa Rica, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, India, Indonesia, Ireland, Israel, Italy, Japan, Korea, Kosovo, Latvia, Lithuania, Luxembourg, Malaysia, Mexico, Namibia, Netherlands, New Zealand, Nicaragua, Norway, Peru, Poland, Portugal, Romania, Russia, Serbia, Singapore, Slovakia, Slovenia, South Africa, Spain, Suriname, Sweden, Switzerland, Thailand, Turkey, Ukraine, the United Kingdom, the USA, and Vietnam.

If Waze operates there, the data can be collected there.

Why I Built This

The honest answer? To prove it could be done.

It's one thing to say "Waze could theoretically be used for surveillance." It's another to actually build the system, collect the data, and show what a global movement-tracking database looks like.

My hope is that this demonstration prompts Waze (and Google, who owns them) to reconsider the privacy tradeoffs in their design. There are ways to maintain the crowdsourced benefits while protecting user privacy, anonymizing reporter usernames on the public map, for instance, or adding a delay before reports become visible.

Whether they'll actually do anything is another question. But at least now people know what's possible.

Protecting Yourself

If you use Waze and you're concerned about this:

Or just accept that this is the world we live in now, where using a helpful traffic app means broadcasting your movements to anyone who cares to look.

Your call.

This research is published by Covert Labs to raise awareness about location privacy risks in consumer applications. The data collection methodology described here is provided for educational purposes. Please use this information responsibly.

Since this is getting attention - some context on why Waze even has usernames attached to reports in the first place.

It wasn’t an oversight. Waze was designed from day one as a social platform, not just a navigation app

The main driver was Waze Carpool - a full ride-sharing service they ran from 2016 to 2022.

Drivers would pick up commuters heading the same way for a small fee.

Obviously you need identity for that.

When COVID wrecked commuting patterns they killed the feature, but the whole username system was already deeply embedded.

Beyond carpool, there’s a whole social layer most people never touch.

Friend lists, real-time location sharing with contacts, direct messaging between drivers, a “beep beep” feature that’s basically poking someone.

All requires knowing who’s who.

Then there’s the gamification that drives engagement.

You earn points for every report, compete on local leaderboards, and rank up through tiers - Baby, Grown-up, Warrior, Knight, Royalty.

Each rank gives your avatar upgrades. It’s designed to make reporting addictive.

Hard to have leaderboards without names attached.

Also worth knowing: Waze maps are maintained by ~500k volunteer editors worldwide.

Every road correction, new location, speed limit update - all attributed to usernames.

It’s how they crowdsourced accurate mapping without paying for it.

The fundamental issue is there’s no anonymous contribution option.

You either broadcast your identity with every report or you don’t participate at all.

And the average user tapping “police ahead” has zero idea their username and exact coordinates just became public data

Wasn’t expecting this to get the traction it has. If you find this kind of research useful and want to support more of it, you can buy me a coffee here: buymeacoffee.com/h4rr1son - no pressure at all, genuinely just grateful people are paying attention.

worth a read too

harry@Harrris0n

In my previous post, I demonstrated how Waze user data can be scraped from the public web map to track individuals.

But I glossed over something important: what does Waze's own privacy policy say about your data?

I went through the full policy. Here's what stood out.

seems like they heard the anger and frustration
x.com/harrris0n/stat…