2022 FreeHour ethical hacking caseThe 2022 FreeHour ethical hacking case refers to a legal and cybersecurity controversy in Malta involving three University of Malta computer science students – Michael Debono, Giorgio Grigolo, and Luke Bjorn Scerri – and their lecturer, Mark Joseph Vella. The group identified critical security vulnerabilities in FreeHour, Malta’s most popular student timetable management application, and reported them to the company through ethical hacking practices. Instead of receiving recognition or a standard "bug bounty" reward, the students faced criminal charges under Malta’s Computer Misuse Act, sparking national debates about cybersecurity laws, academic freedom, and ethical hacking protections.[1][2][3] BackgroundFreehourDeveloped by entrepreneur Zach Ciappara, FreeHour became Malta’s dominant student app by 2022, with features for class scheduling, social event organization, and university resource sharing. Its rapid adoption by over 90% of Maltese tertiary students made it a critical piece of educational infrastructure. However, the app’s technical architecture had not undergone independent security auditing prior to the incident.[4][3] Ethical hacking contextEthical hacking, or "white hat" security research, involves proactively identifying system vulnerabilities to prevent malicious exploitation. International tech companies like Google and Microsoft operate formal bug bounty programs, offering financial rewards and legal protections to researchers who follow responsible disclosure protocols. Malta lacked specific safe harbor laws for ethical hackers in 2022, leaving researchers vulnerable to prosecution under broad computer crime statutes.[4][3] Discovery of vulnerabilitiesIn October 2022, during a routine cybersecurity exercise, the students identified multiple critical flaws in FreeHour's API architecture. Forensic analysis revealed:
To validate their findings, Grigolo temporarily modified a non-essential app feature, immediately reverting it after capturing proof-of-concept evidence. The group documented their methodology and prepared a disclosure report following ISO/IEC 29147 guidelines for vulnerability handling.[1][3][6] Legal proceedingsArrests and chargesOn November 3, 2022, armed police conducted simultaneous raids on the students’ residences:
Disclosure and initial responseOn October 15, 2022, the students emailed FreeHour's founder detailing the vulnerabilities, accompanied by:
Lecturer Mark Vella proofread the disclosure email but did not participate in the technical research. FreeHour's legal team responded by filing a criminal complaint with the Malta Police Cybercrime Unit on October 18, invoking Article 337 of Malta’s Criminal Code regarding unauthorized computer access.[1][4][5] Charges filed in February 2024 included:
The prosecution alleged the vulnerability disclosure constituted an attempt to "extort payments through threats of public exposure"[7][6][8] Court proceedingsFirst heard in March 2025 before Magistrate Marse-Ann Farrugia, the case featured:
All defendants pleaded not guilty, with ongoing proceedings suspended following the cabinet’s pardon recommendation on March 11, 2025.[9][3] Reactions and impactAcademic community response25 student organizations including KSU (Kunsill Studenti Universitarji) issued a joint statement condemning the charges as "an assault on academic freedom and cybersecurity progress". The University of Malta Academic Staff Association (UMASA) launched a legal defense fund, raising €28,000 within 72 hours.[3] Cybersecurity industryThe Malta Information Technology Agency (MITA) revised its vulnerability disclosure policies within weeks of the case going public. Private sector impact included:
Political developmentsThe Nationalist Party proposed the Ethical Cybersecurity Research Act in January 2025, featuring:
Technical analysisIndependent audits commissioned by the defense revealed systemic issues: # Example of flawed authentication check in FreeHour API
def get_user_data(request):
user_id = request.GET.get('user_id')
if User.objects.filter(id=user_id).exists(): # No session validation
return UserDataSerializer(User.objects.get(id=user_id)).data
else:
return HttpResponse(status=404)
This code allowed any user to retrieve others' data by simply altering the user_id parameter. The students demonstrated that combining this with improper CORS configurations could enable cross-site scripting attacks against FreeHour's mobile client.[2][3] Aftermath and pardonPresidential pardonOn March 11, 2025, Justice Minister Jonathan Attard announced the cabinet's unanimous pardon recommendation based on:
The pardon requires formal approval by President Myriam Spiteri Debono, expected by April 2025 pending constitutional review. Impact on defendants
Legacy and legal reformThe case accelerated Malta’s adoption of the Convention on Cybercrime (Budapest Convention) Chapter III provisions in January 2025. Key changes included:
FreeHour implemented a public vulnerability disclosure program in June 2024, awarding the original researchers a retroactive €15,000 bounty. As of March 2025, no further security breaches have been reported in the platform.[2][3] International reactionsThe case received attention from global digital rights organizations:
Ongoing debates continue at the UN Internet Governance Forum regarding harmonization of ethical hacking regulations across civil law jurisdictions. References
|
Portal di Ensiklopedia Dunia
